Publish camino-package-runtime from 7efe88cdfc5244727d80239c79845b44d1e79ccb

Add native register acknowledgments and idempotent mutation replay, shared optimistic field controllers, overlapping custom setters, non-suspending hooks and explicit Suspense. Carry checked @live provenance through batched queries and hydrate shared browser fields with coverage leases. Update tracker/scaffolds/guides and verify compiler, PostgreSQL, browser and immutable workspace paths.

.quixos-subtree-source.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "sourceRepo": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos.git",
+  "sourceRepo": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos",
-  "sourceCommit": "ce0dd80f56df35bf3db1be01236a949a704cb4c2",
+  "sourceCommit": "7efe88cdfc5244727d80239c79845b44d1e79ccb",
   "sourcePath": "quixos-instance/packages/camino-package-runtime",
   "exportName": "camino-package-runtime",
   "mirrorRemote": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/camino-package-runtime.git"

dist/bindings.d.ts

@@ -0,0 +1,103 @@
+import { type Value } from "./camino/api_pb.js";
+import { liveValue, type RuntimeHandler, type DerivedHandler } from "./index.js";
+export type { QxObjectRef } from "./references.js";
+declare const watchBrand: unique symbol;
+export type QxWatchHandle = string & {
+    readonly [watchBrand]: true;
+};
+export type MessageBinding<T> = {
+    encode(value: T): Value;
+    decode(value: Value): T;
+};
+export type QxLiveValue = ReturnType<typeof liveValue>;
+export type BindingValue<B> = B extends MessageBinding<infer T> ? T : never;
+export type QxHandler<C, O> = (context: C) => O | Promise<O>;
+export type QxDerived<C, O> = {
+    kind: "derived";
+    get: QxHandler<C, O>;
+};
+export type QxSession<C> = {
+    id: string;
+    run<T>(work: (context: C) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+};
+export type QxContextLifecycle<C> = {
+    signal?: AbortSignal;
+    openSession?: () => Promise<QxSession<C>>;
+};
+declare const contractView: unique symbol;
+/** Generated exact closed contract. A descriptor is type evidence, never authority. */
+export type QxInterfaceContract<View> = {
+    readonly interfaceRevisionId: string;
+    readonly operations: Record<string, QxOperationSpec>;
+    readonly [contractView]: (value: View) => View;
+};
+export declare const defineQxInterfaceContract: <View>(interfaceRevisionId: string, operations: Record<string, QxOperationSpec>) => QxInterfaceContract<View>;
+export type QxConformer = {
+    tryConform<View>(object: import("./references.js").QxObjectRef, contract: QxInterfaceContract<View>): Promise<View | undefined>;
+};
+export declare const qxDerived: <C, O>(get: QxHandler<C, O>) => QxDerived<C, O>;
+/** Versioned binding ABI. This mirrors the language-neutral value IR. */
+export type QxValueType = {
+    kind: "builtin";
+    name: "unit" | "watch-handle";
+} | {
+    kind: "scalar";
+    name: string;
+} | {
+    kind: "message";
+    descriptorId: string;
+} | {
+    kind: "record";
+    fields: Record<string, QxValueType>;
+} | {
+    kind: "object-ref";
+    expectation: unknown;
+} | {
+    kind: "optional" | "list";
+    value: QxValueType;
+};
+export type QxOperationSpec = {
+    id: string;
+    inputType: QxValueType;
+    outputType: QxValueType;
+};
+export type QxPortSpec = {
+    kind: "query";
+    id: string;
+    definitionDigest: string;
+    variables: QxValueType;
+    output: QxValueType;
+    watch: boolean;
+} | {
+    kind: "state";
+    id: string;
+    valueType: QxValueType;
+    primitives: string[];
+} | {
+    kind: "edge";
+    id: string;
+    primitives: string[];
+} | {
+    kind: "interface";
+    id: string;
+    interfaceRevisionId: string;
+    operations: Record<string, QxOperationSpec>;
+} | {
+    kind: "constructor";
+    id: string;
+    inputType: QxValueType;
+};
+export type QxHandlerSpec = {
+    receiver?: "none";
+    inputType: QxValueType;
+    outputType: QxValueType;
+    eventType?: QxValueType;
+    ports: Record<string, QxPortSpec>;
+};
+export type QxMessages = Record<string, MessageBinding<any>>;
+export declare const decodeQxValue: (type: QxValueType, value: Value | undefined, messages: QxMessages) => any;
+export declare const encodeQxValue: (type: QxValueType, value: any, messages: QxMessages) => Value;
+/** The sole unchecked cast connects generated contracts to the dynamic RPC runtime. */
+export declare const bindQxHandler: <C, O>(spec: QxHandlerSpec, handler: QxHandler<C, O> | QxDerived<C, O>, messages: QxMessages) => RuntimeHandler | DerivedHandler;
+//# sourceMappingURL=bindings.d.ts.map

dist/bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAGL,SAAS,EAGT,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AACrE,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI;IAAE,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;IAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAA;CAAE,CAAC;AACrF,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AACvD,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAC5E,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7D,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AACxH,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;CAAE,CAAC;AACxG,OAAO,CAAC,MAAM,YAAY,EAAE,OAAO,MAAM,CAAC;AAC1C,uFAAuF;AACvF,MAAM,MAAM,mBAAmB,CAAC,IAAI,IAAI;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACrD,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC;CAChD,CAAC;AACF,eAAO,MAAM,yBAAyB,GAAI,IAAI,uBACvB,MAAM,cACf,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,KAC1C,mBAAmB,CAAC,IAAI,CAAoF,CAAC;AAChH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,CAAC,IAAI,EACb,MAAM,EAAE,OAAO,iBAAiB,EAAE,WAAW,EAC7C,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAA+B,CAAC;AAErG,yEAAyE;AACzE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AACtD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,WAAW,CAAA;CAAE,CAAC;AAC9F,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAAE,GAC3G;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,WAAW,CAAC;IACvB,UAAU,EAAE,WAAW,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;AA6B7D,eAAO,MAAM,aAAa,SAAU,WAAW,SAAS,KAAK,GAAG,SAAS,YAAY,UAAU,KAAG,GAyCjG,CAAC;AAOF,eAAO,MAAM,aAAa,SAAU,WAAW,SAAS,GAAG,YAAY,UAAU,KAAG,KA8BnF,CAAC;AAmBF,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,QAC1B,aAAa,WACV,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAChC,UAAU,KACnB,cAAc,GAAG,cAgInB,CAAC"}

dist/bindings.js

@@ -0,0 +1,247 @@
+import { create } from "@bufbuild/protobuf";
+import { ValueSchema, ObjectValueSchema } from "./camino/api_pb.js";
+import { derived, jsToProtoValue, liveValue, protoValueToJs, } from "./index.js";
+import { assertReferenceFree, referenceToWire } from "./references.js";
+import { decodeQuerySnapshot } from "./queries.js";
+export const defineQxInterfaceContract = (interfaceRevisionId, operations) => Object.freeze({ interfaceRevisionId, operations });
+export const qxDerived = (get) => ({ kind: "derived", get });
+const bindInterfaceView = (target, contract, messages) => ({
+    objectId: target.objectId,
+    contract,
+    live: Object.fromEntries(Object.entries(contract.operations).map(([name, operation]) => [
+        name,
+        (input) => target.live(operation.id, inputFields(operation.inputType, input, messages)),
+    ])),
+    ...Object.fromEntries(Object.entries(contract.operations).map(([name, operation]) => [
+        name,
+        async (input) => decodeQxValue(operation.outputType, (await target.live(operation.id, inputFields(operation.inputType, input, messages))).$quixosValue, messages),
+    ])),
+});
+// Conversion belongs at the binding boundary. It does not add orchestrator validation.
+export const decodeQxValue = (type, value, messages) => {
+    if (type.kind === "builtin" && type.name === "unit")
+        return null;
+    if (type.kind === "optional" && !value)
+        return null;
+    if (!value)
+        throw new Error("Missing QX wire value");
+    if (type.kind === "record") {
+        if (value.kind.case !== "objectValue")
+            throw new Error("Expected QX record");
+        const fields = value.kind.value.fields;
+        if (Object.keys(fields).some((name) => !Object.hasOwn(type.fields, name)))
+            throw new Error("Unexpected QX record field");
+        return Object.fromEntries(Object.entries(type.fields).map(([name, field]) => [name, decodeQxValue(field, fields[name], messages)]));
+    }
+    if (type.kind === "optional")
+        return value.kind.case === "nullValue" ? null : decodeQxValue(type.value, value, messages);
+    if (type.kind === "list") {
+        if (value.kind.case !== "listValue")
+            throw new Error("Expected QX list");
+        return value.kind.value.values.map((entry) => decodeQxValue(type.value, entry, messages));
+    }
+    if (type.kind === "message") {
+        assertReferenceFree(protoValueToJs(value));
+        const decoded = requireMessage(messages, type.descriptorId).decode(value);
+        assertReferenceFree(decoded);
+        return decoded;
+    }
+    if (type.kind === "object-ref") {
+        if (value.kind.case !== "refValue")
+            throw new Error("Expected a declared RPC object reference");
+        return protoValueToJs(value);
+    }
+    if (value.kind.case === "refValue")
+        throw new Error("Reference supplied to a non-reference value");
+    if (type.kind === "scalar") {
+        if (type.name === "int64" || type.name === "uint64") {
+            if (value.kind.case !== "integerValue")
+                throw new Error("Expected QX integer");
+            return BigInt(value.kind.value);
+        }
+        if (type.name === "bytes") {
+            if (value.kind.case !== "bytesValue")
+                throw new Error("Expected QX bytes");
+            return value.kind.value;
+        }
+    }
+    return protoValueToJs(value);
+};
+const requireMessage = (messages, id) => {
+    const binding = messages[id];
+    if (!binding)
+        throw new Error(`Missing message binding ${id}`);
+    return binding;
+};
+export const encodeQxValue = (type, value, messages) => {
+    if (type.kind === "builtin" && type.name === "unit")
+        return jsToProtoValue(null);
+    if (type.kind === "record") {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Expected QX record");
+        if (Object.keys(value).some((name) => !Object.hasOwn(type.fields, name)))
+            throw new Error("Unexpected QX record field");
+        const fields = Object.fromEntries(Object.entries(type.fields).map(([name, field]) => {
+            if (!Object.hasOwn(value, name) && field.kind !== "optional")
+                throw new Error(`Missing QX record field ${name}`);
+            return [name, encodeQxValue(field, value[name] ?? (field.kind === "optional" ? null : value[name]), messages)];
+        }));
+        return create(ValueSchema, { kind: { case: "objectValue", value: create(ObjectValueSchema, { fields }) } });
+    }
+    if (type.kind === "optional")
+        return value === null ? jsToProtoValue(null) : encodeQxValue(type.value, value, messages);
+    if (type.kind === "list")
+        return jsToProtoValue(value.map((entry) => liveValue(encodeQxValue(type.value, entry, messages))));
+    if (type.kind === "object-ref") {
+        referenceToWire(value);
+        return jsToProtoValue(value);
+    }
+    assertReferenceFree(value);
+    if (type.kind === "message") {
+        const encoded = requireMessage(messages, type.descriptorId).encode(value);
+        assertReferenceFree(protoValueToJs(encoded));
+        return encoded;
+    }
+    return jsToProtoValue(value);
+};
+const inputValue = (context, type) => {
+    if (type.kind === "message" || type.kind === "record")
+        return create(ValueSchema, {
+            kind: { case: "objectValue", value: create(ObjectValueSchema, { fields: context.inputProto }) },
+        });
+    return context.inputProto.value;
+};
+const inputFields = (type, value, messages) => {
+    if (type.kind === "builtin" && type.name === "unit")
+        return {};
+    const encoded = encodeQxValue(type, value, messages);
+    if (type.kind === "message" || type.kind === "record") {
+        if (encoded.kind.case !== "objectValue")
+            throw new Error("Message inputs must encode an object value");
+        return Object.fromEntries(Object.entries(encoded.kind.value.fields).map(([key, entry]) => [key, liveValue(entry)]));
+    }
+    return { value: liveValue(encoded) };
+};
+/** The sole unchecked cast connects generated contracts to the dynamic RPC runtime. */
+export const bindQxHandler = (spec, handler, messages) => {
+    const bindContext = (raw) => {
+        const ports = Object.fromEntries(Object.entries(spec.ports).map(([name, port]) => {
+            switch (port.kind) {
+                case "state": {
+                    const state = raw.state(port.id);
+                    return [
+                        name,
+                        {
+                            ...(port.primitives.includes("read")
+                                ? {
+                                    get: async () => decodeQxValue(port.valueType, (await state.live()).$quixosValue, messages),
+                                    live: () => state.live(),
+                                }
+                                : {}),
+                            ...(port.primitives.includes("write")
+                                ? {
+                                    set: async (value) => state.set(liveValue(encodeQxValue(port.valueType, value, messages))),
+                                }
+                                : {}),
+                        },
+                    ];
+                }
+                case "edge": {
+                    const edge = raw.edge(port.id);
+                    return [
+                        name,
+                        {
+                            ...Object.fromEntries(port.primitives.map((primitive) => [
+                                primitive,
+                                edge[primitive],
+                            ])),
+                            ...(port.primitives.includes("resolve") ? { collection: edge.collection } : {}),
+                            ...(port.primitives.includes("resolve") &&
+                                port.primitives.includes("connect") &&
+                                port.primitives.includes("disconnect")
+                                ? { replace: edge.replace }
+                                : {}),
+                        },
+                    ];
+                }
+                case "interface": {
+                    const target = raw.interface(port.id);
+                    return [
+                        name,
+                        bindInterfaceView(target, defineQxInterfaceContract(port.interfaceRevisionId, port.operations), messages),
+                    ];
+                }
+                case "query": {
+                    const query = raw.query(port.id);
+                    const variablesToWire = (variables) => {
+                        const value = encodeQxValue(port.variables, variables, messages);
+                        if (value.kind.case !== "objectValue")
+                            throw new Error("QUERY_VARIABLE_INVALID");
+                        return value.kind.value.fields;
+                    };
+                    return [
+                        name,
+                        {
+                            async execute(variables) {
+                                const response = await query.execute(variablesToWire(variables), port.definitionDigest);
+                                if (response.pending.length || response.errors.length)
+                                    throw new Error("QUERY_INCOMPLETE");
+                                return decodeQxValue(port.output, response.value, messages);
+                            },
+                            ...(port.watch
+                                ? {
+                                    async *watch(variables, signal) {
+                                        for await (const event of query.watch(variablesToWire(variables), signal, port.definitionDigest)) {
+                                            if (!event.snapshot)
+                                                throw new Error("QUERY_SNAPSHOT_MISSING");
+                                            yield decodeQuerySnapshot(event.snapshot, port.output, event.runId, event.sequence);
+                                        }
+                                    },
+                                }
+                                : {}),
+                        },
+                    ];
+                }
+                case "constructor":
+                    return [
+                        name,
+                        {
+                            construct: (input) => raw.constructor(port.id).construct(inputFields(port.inputType, input, messages)),
+                        },
+                    ];
+            }
+        }));
+        return {
+            conform: {
+                async tryConform(object, contract) {
+                    const target = await raw.tryConform(object, contract.interfaceRevisionId);
+                    return target
+                        ? bindInterfaceView(target, contract, messages)
+                        : undefined;
+                },
+            },
+            ...(spec.receiver === "none" ? {} : { objectId: raw.objectId }),
+            signal: raw.signal,
+            ...(spec.receiver !== "none" && raw.openSession
+                ? {
+                    openSession: async () => {
+                        const session = await raw.openSession();
+                        return {
+                            id: session.id,
+                            close: () => session.close(),
+                            run: (work) => session.run((next) => work(bindContext(next))),
+                        };
+                    },
+                }
+                : {}),
+            input: decodeQxValue(spec.inputType, inputValue(raw, spec.inputType), messages),
+            ports,
+        };
+    };
+    const execute = async (raw) => {
+        const context = bindContext(raw);
+        const value = await (typeof handler === "function" ? handler(context) : handler.get(context));
+        return liveValue(encodeQxValue(spec.eventType ?? spec.outputType, value, messages));
+    };
+    return typeof handler === "function" ? execute : derived(execute);
+};

dist/camino/api_pb.d.ts

@@ -1,5 +1,6 @@
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { PersistencePlan } from "./schema_pb.js";
+import type { PersistencePlan, QueryRelationalPlan, QuerySelection } from "./schema_pb.js";
+import type { CapabilityRef, FieldEditing } from "../quixos/refs_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file camino/api.proto.
@@ -104,6 +105,14 @@ export type StateValueSource = Message<"camino.StateValueSource"> & {
      * @generated from field: uint64 revision = 5;
      */
     revision: bigint;
+    /**
+     * CRDT-backed state is still read as its materialized Value. The snapshot
+     * travels with the writable source identity so a client can retain and
+     * advance a local replica without exposing the document to package code.
+     *
+     * @generated from field: camino.CrdtValue crdt_snapshot = 6;
+     */
+    crdtSnapshot?: CrdtValue | undefined;
 };
 /**
  * Describes the message camino.StateValueSource.
@@ -199,12 +208,91 @@ export type Value = Message<"camino.Value"> & {
      * @generated from field: camino.ValueSource source = 11;
      */
     source?: ValueSource | undefined;
+    /**
+     * Trusted query coordinator annotation. Travels with values through residual
+     * row selection, then is removed in favor of final-path hydration metadata.
+     *
+     * @generated from field: camino.QueryFieldOrigin query_origin = 12;
+     */
+    queryOrigin?: QueryFieldOrigin | undefined;
 };
 /**
  * Describes the message camino.Value.
  * Use `create(ValueSchema)` to create a new message.
  */
 export declare const ValueSchema: GenMessage<Value>;
+/**
+ * @generated from message camino.QueryFieldOrigin
+ */
+export type QueryFieldOrigin = Message<"camino.QueryFieldOrigin"> & {
+    /**
+     * @generated from field: string selection_id = 1;
+     */
+    selectionId: string;
+    /**
+     * @generated from field: string atom_id = 2;
+     */
+    atomId: string;
+    /**
+     * @generated from field: string interface_revision_id = 3;
+     */
+    interfaceRevisionId: string;
+    /**
+     * @generated from field: string member_id = 4;
+     */
+    memberId: string;
+    /**
+     * @generated from field: camino.StateValueSource source = 5;
+     */
+    source?: StateValueSource | undefined;
+};
+/**
+ * Describes the message camino.QueryFieldOrigin.
+ * Use `create(QueryFieldOriginSchema)` to create a new message.
+ */
+export declare const QueryFieldOriginSchema: GenMessage<QueryFieldOrigin>;
+/**
+ * @generated from message camino.QueryLiveField
+ */
+export type QueryLiveField = Message<"camino.QueryLiveField"> & {
+    /**
+     * @generated from field: repeated camino.QueryPathPart path = 1;
+     */
+    path: QueryPathPart[];
+    /**
+     * @generated from field: string selection_id = 2;
+     */
+    selectionId: string;
+    /**
+     * @generated from field: string object_id = 3;
+     */
+    objectId: string;
+    /**
+     * @generated from field: quixos.CapabilityRef capability = 4;
+     */
+    capability?: CapabilityRef | undefined;
+    /**
+     * @generated from field: string watch_operation_id = 5;
+     */
+    watchOperationId: string;
+    /**
+     * @generated from field: string setter_operation_id = 6;
+     */
+    setterOperationId: string;
+    /**
+     * @generated from field: quixos.FieldEditing editing = 7;
+     */
+    editing?: FieldEditing | undefined;
+    /**
+     * @generated from field: camino.StateValueSource source = 8;
+     */
+    source?: StateValueSource | undefined;
+};
+/**
+ * Describes the message camino.QueryLiveField.
+ * Use `create(QueryLiveFieldSchema)` to create a new message.
+ */
+export declare const QueryLiveFieldSchema: GenMessage<QueryLiveField>;
 /**
  * @generated from message camino.InstallPersistencePlanRequest
  */
@@ -534,6 +622,78 @@ export type DisconnectEdgeResponse = Message<"camino.DisconnectEdgeResponse"> &
  * Use `create(DisconnectEdgeResponseSchema)` to create a new message.
  */
 export declare const DisconnectEdgeResponseSchema: GenMessage<DisconnectEdgeResponse>;
+/**
+ * @generated from message camino.CollectionEntry
+ */
+export type CollectionEntry = Message<"camino.CollectionEntry"> & {
+    /**
+     * Existing entry identity to preserve; empty allocates a new canonical edge.
+     *
+     * @generated from field: string edge_id = 1;
+     */
+    edgeId: string;
+    /**
+     * @generated from field: string target_object_id = 2;
+     */
+    targetObjectId: string;
+    /**
+     * @generated from field: camino.Value key = 3;
+     */
+    key?: Value | undefined;
+};
+/**
+ * Describes the message camino.CollectionEntry.
+ * Use `create(CollectionEntrySchema)` to create a new message.
+ */
+export declare const CollectionEntrySchema: GenMessage<CollectionEntry>;
+/**
+ * @generated from message camino.ReadCollectionResponse
+ */
+export type ReadCollectionResponse = Message<"camino.ReadCollectionResponse"> & {
+    /**
+     * @generated from field: uint64 revision = 1;
+     */
+    revision: bigint;
+    /**
+     * @generated from field: repeated camino.CollectionEntry entries = 2;
+     */
+    entries: CollectionEntry[];
+};
+/**
+ * Describes the message camino.ReadCollectionResponse.
+ * Use `create(ReadCollectionResponseSchema)` to create a new message.
+ */
+export declare const ReadCollectionResponseSchema: GenMessage<ReadCollectionResponse>;
+/**
+ * @generated from message camino.ReplaceCollectionRequest
+ */
+export type ReplaceCollectionRequest = Message<"camino.ReplaceCollectionRequest"> & {
+    /**
+     * @generated from field: string object_id = 1;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string edge_type_id = 2;
+     */
+    edgeTypeId: string;
+    /**
+     * @generated from field: string projection_id = 3;
+     */
+    projectionId: string;
+    /**
+     * @generated from field: uint64 expected_revision = 4;
+     */
+    expectedRevision: bigint;
+    /**
+     * @generated from field: repeated camino.CollectionEntry entries = 5;
+     */
+    entries: CollectionEntry[];
+};
+/**
+ * Describes the message camino.ReplaceCollectionRequest.
+ * Use `create(ReplaceCollectionRequestSchema)` to create a new message.
+ */
+export declare const ReplaceCollectionRequestSchema: GenMessage<ReplaceCollectionRequest>;
 /**
  * @generated from message camino.ListOpsRequest
  */
@@ -578,6 +738,12 @@ export type WatchObjectRequest = Message<"camino.WatchObjectRequest"> & {
      * @generated from field: bool include_snapshot = 3;
      */
     includeSnapshot: boolean;
+    /**
+     * Managed runtimes must watch only their injected attachments.
+     *
+     * @generated from field: repeated string attachment_ids = 4;
+     */
+    attachmentIds: string[];
 };
 /**
  * Describes the message camino.WatchObjectRequest.
@@ -688,6 +854,14 @@ export type CaminoEdge = Message<"camino.CaminoEdge"> & {
      * @generated from field: string created_at = 9;
      */
     createdAt: string;
+    /**
+     * @generated from field: string first_key_json = 10;
+     */
+    firstKeyJson: string;
+    /**
+     * @generated from field: string second_key_json = 11;
+     */
+    secondKeyJson: string;
 };
 /**
  * Describes the message camino.CaminoEdge.
@@ -732,10 +906,517 @@ export type CaminoOp = Message<"camino.CaminoOp"> & {
  * Use `create(CaminoOpSchema)` to create a new message.
  */
 export declare const CaminoOpSchema: GenMessage<CaminoOp>;
+/**
+ * @generated from message camino.QueryRequest
+ */
+export type QueryRequest = Message<"camino.QueryRequest"> & {
+    /**
+     * @generated from field: string query_id = 1;
+     */
+    queryId: string;
+    /**
+     * @generated from field: string object_id = 2;
+     */
+    objectId: string;
+    /**
+     * @generated from field: map<string, camino.Value> variables = 3;
+     */
+    variables: {
+        [key: string]: Value;
+    };
+    /**
+     * Typed callers require this exact checked definition. Administrative/raw
+     * callers may omit it to explicitly select the currently installed definition.
+     *
+     * @generated from field: string expected_definition_digest = 4;
+     */
+    expectedDefinitionDigest: string;
+};
+/**
+ * Describes the message camino.QueryRequest.
+ * Use `create(QueryRequestSchema)` to create a new message.
+ */
+export declare const QueryRequestSchema: GenMessage<QueryRequest>;
+/**
+ * @generated from message camino.QueryPathPart
+ */
+export type QueryPathPart = Message<"camino.QueryPathPart"> & {
+    /**
+     * @generated from oneof camino.QueryPathPart.part
+     */
+    part: {
+        /**
+         * @generated from field: string field = 1;
+         */
+        value: string;
+        case: "field";
+    } | {
+        /**
+         * @generated from field: uint32 index = 2;
+         */
+        value: number;
+        case: "index";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message camino.QueryPathPart.
+ * Use `create(QueryPathPartSchema)` to create a new message.
+ */
+export declare const QueryPathPartSchema: GenMessage<QueryPathPart>;
+/**
+ * @generated from message camino.QueryPendingField
+ */
+export type QueryPendingField = Message<"camino.QueryPendingField"> & {
+    /**
+     * @generated from field: repeated camino.QueryPathPart path = 1;
+     */
+    path: QueryPathPart[];
+    /**
+     * @generated from field: string object_id = 2;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string interface_revision_id = 3;
+     */
+    interfaceRevisionId: string;
+    /**
+     * @generated from field: string member_id = 4;
+     */
+    memberId: string;
+    /**
+     * @generated from field: string operation_id = 5;
+     */
+    operationId: string;
+    /**
+     * @generated from field: string value_type_json = 6;
+     */
+    valueTypeJson: string;
+    /**
+     * Internal residual facts are separate from the authored result projection.
+     *
+     * @generated from field: optional uint32 residual_window = 7;
+     */
+    residualWindow?: number | undefined;
+    /**
+     * @generated from field: uint32 residual_row = 8;
+     */
+    residualRow: number;
+    /**
+     * @generated from field: string residual_field = 9;
+     */
+    residualField: string;
+    /**
+     * @generated from field: optional uint32 relational_capture = 10;
+     */
+    relationalCapture?: number | undefined;
+    /**
+     * @generated from field: uint32 captured_object = 11;
+     */
+    capturedObject: number;
+};
+/**
+ * Describes the message camino.QueryPendingField.
+ * Use `create(QueryPendingFieldSchema)` to create a new message.
+ */
+export declare const QueryPendingFieldSchema: GenMessage<QueryPendingField>;
+/**
+ * @generated from message camino.QueryStats
+ */
+export type QueryStats = Message<"camino.QueryStats"> & {
+    /**
+     * @generated from field: uint32 sql_count = 1;
+     */
+    sqlCount: number;
+    /**
+     * @generated from field: double sql_ms = 2;
+     */
+    sqlMs: number;
+    /**
+     * @generated from field: uint32 rpc_count = 3;
+     */
+    rpcCount: number;
+    /**
+     * @generated from field: double rpc_ms = 4;
+     */
+    rpcMs: number;
+    /**
+     * @generated from field: uint32 result_bytes = 5;
+     */
+    resultBytes: number;
+    /**
+     * @generated from field: double preparation_ms = 6;
+     */
+    preparationMs: number;
+    /**
+     * @generated from field: double total_ms = 7;
+     */
+    totalMs: number;
+    /**
+     * @generated from field: uint32 relational_stages = 8;
+     */
+    relationalStages: number;
+    /**
+     * @generated from field: uint32 captured_candidates = 9;
+     */
+    capturedCandidates: number;
+    /**
+     * @generated from field: double relational_ms = 10;
+     */
+    relationalMs: number;
+    /**
+     * @generated from field: double residual_ms = 11;
+     */
+    residualMs: number;
+};
+/**
+ * Describes the message camino.QueryStats.
+ * Use `create(QueryStatsSchema)` to create a new message.
+ */
+export declare const QueryStatsSchema: GenMessage<QueryStats>;
+/**
+ * @generated from message camino.QueryResponse
+ */
+export type QueryResponse = Message<"camino.QueryResponse"> & {
+    /**
+     * @generated from field: camino.Value value = 1;
+     */
+    value?: Value | undefined;
+    /**
+     * @generated from field: string data_version = 2;
+     */
+    dataVersion: string;
+    /**
+     * @generated from field: string binding_digest = 3;
+     */
+    bindingDigest: string;
+    /**
+     * @generated from field: repeated camino.QueryPendingField pending = 4;
+     */
+    pending: QueryPendingField[];
+    /**
+     * @generated from field: camino.QueryStats stats = 5;
+     */
+    stats?: QueryStats | undefined;
+    /**
+     * Redeemable only through the host's private control socket, not an RPC grant.
+     *
+     * @generated from field: string preparation_token = 6;
+     */
+    preparationToken: string;
+    /**
+     * @generated from field: repeated camino.QueryFieldFailure errors = 7;
+     */
+    errors: QueryFieldFailure[];
+    /**
+     * @generated from field: repeated camino.QueryResidualWindow residual_windows = 8;
+     */
+    residualWindows: QueryResidualWindow[];
+    /**
+     * Native reads share one database snapshot; package enrichment does not.
+     *
+     * native-snapshot | mixed
+     *
+     * @generated from field: string consistency = 9;
+     */
+    consistency: string;
+    /**
+     * @generated from field: repeated camino.QueryRelationalCapture relational_captures = 10;
+     */
+    relationalCaptures: QueryRelationalCapture[];
+    /**
+     * @generated from field: repeated camino.QueryLiveField live_fields = 11;
+     */
+    liveFields: QueryLiveField[];
+};
+/**
+ * Describes the message camino.QueryResponse.
+ * Use `create(QueryResponseSchema)` to create a new message.
+ */
+export declare const QueryResponseSchema: GenMessage<QueryResponse>;
+/**
+ * Private coordinator input, removed before publishing a result. Memberships
+ * and native facts share one snapshot; package reads are sampled afterwards.
+ *
+ * @generated from message camino.QueryCapturedMember
+ */
+export type QueryCapturedMember = Message<"camino.QueryCapturedMember"> & {
+    /**
+     * @generated from field: string object_id = 1;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string entry_id = 2;
+     */
+    entryId: string;
+    /**
+     * @generated from field: camino.Value map_key = 3;
+     */
+    mapKey?: Value | undefined;
+};
+/**
+ * Describes the message camino.QueryCapturedMember.
+ * Use `create(QueryCapturedMemberSchema)` to create a new message.
+ */
+export declare const QueryCapturedMemberSchema: GenMessage<QueryCapturedMember>;
+/**
+ * @generated from message camino.QueryCapturedMembers
+ */
+export type QueryCapturedMembers = Message<"camino.QueryCapturedMembers"> & {
+    /**
+     * @generated from field: repeated camino.QueryCapturedMember entries = 1;
+     */
+    entries: QueryCapturedMember[];
+};
+/**
+ * Describes the message camino.QueryCapturedMembers.
+ * Use `create(QueryCapturedMembersSchema)` to create a new message.
+ */
+export declare const QueryCapturedMembersSchema: GenMessage<QueryCapturedMembers>;
+/**
+ * @generated from message camino.QueryCapturedObject
+ */
+export type QueryCapturedObject = Message<"camino.QueryCapturedObject"> & {
+    /**
+     * @generated from field: string object_id = 1;
+     */
+    objectId: string;
+    /**
+     * @generated from field: map<string, camino.Value> fields = 2;
+     */
+    fields: {
+        [key: string]: Value;
+    };
+    /**
+     * @generated from field: map<string, string> field_types = 3;
+     */
+    fieldTypes: {
+        [key: string]: string;
+    };
+    /**
+     * @generated from field: map<string, camino.QueryCapturedMembers> relationships = 4;
+     */
+    relationships: {
+        [key: string]: QueryCapturedMembers;
+    };
+};
+/**
+ * Describes the message camino.QueryCapturedObject.
+ * Use `create(QueryCapturedObjectSchema)` to create a new message.
+ */
+export declare const QueryCapturedObjectSchema: GenMessage<QueryCapturedObject>;
+/**
+ * @generated from message camino.QueryRelationalCapture
+ */
+export type QueryRelationalCapture = Message<"camino.QueryRelationalCapture"> & {
+    /**
+     * @generated from field: repeated camino.QueryPathPart path = 1;
+     */
+    path: QueryPathPart[];
+    /**
+     * @generated from field: camino.QueryRelationalPlan plan = 2;
+     */
+    plan?: QueryRelationalPlan | undefined;
+    /**
+     * @generated from field: string root_object_id = 3;
+     */
+    rootObjectId: string;
+    /**
+     * @generated from field: repeated camino.QueryCapturedObject objects = 4;
+     */
+    objects: QueryCapturedObject[];
+    /**
+     * @generated from field: string variables_json = 5;
+     */
+    variablesJson: string;
+    /**
+     * @generated from field: uint32 row_limit = 6;
+     */
+    rowLimit: number;
+    /**
+     * @generated from field: uint32 candidate_limit = 7;
+     */
+    candidateLimit: number;
+    /**
+     * @generated from field: optional uint32 residual_window = 8;
+     */
+    residualWindow?: number | undefined;
+    /**
+     * @generated from field: repeated string result_path = 9;
+     */
+    resultPath: string[];
+};
+/**
+ * Describes the message camino.QueryRelationalCapture.
+ * Use `create(QueryRelationalCaptureSchema)` to create a new message.
+ */
+export declare const QueryRelationalCaptureSchema: GenMessage<QueryRelationalCapture>;
+/**
+ * @generated from message camino.QueryResidualRow
+ */
+export type QueryResidualRow = Message<"camino.QueryResidualRow"> & {
+    /**
+     * @generated from field: string entry_id = 1;
+     */
+    entryId: string;
+    /**
+     * @generated from field: map<string, camino.Value> fields = 2;
+     */
+    fields: {
+        [key: string]: Value;
+    };
+};
+/**
+ * Describes the message camino.QueryResidualRow.
+ * Use `create(QueryResidualRowSchema)` to create a new message.
+ */
+export declare const QueryResidualRowSchema: GenMessage<QueryResidualRow>;
+/**
+ * @generated from message camino.QueryResidualOrder
+ */
+export type QueryResidualOrder = Message<"camino.QueryResidualOrder"> & {
+    /**
+     * @generated from field: string field = 1;
+     */
+    field: string;
+    /**
+     * @generated from field: bool descending = 2;
+     */
+    descending: boolean;
+};
+/**
+ * Describes the message camino.QueryResidualOrder.
+ * Use `create(QueryResidualOrderSchema)` to create a new message.
+ */
+export declare const QueryResidualOrderSchema: GenMessage<QueryResidualOrder>;
+/**
+ * @generated from message camino.QueryResidualWindow
+ */
+export type QueryResidualWindow = Message<"camino.QueryResidualWindow"> & {
+    /**
+     * @generated from field: repeated camino.QueryPathPart path = 1;
+     */
+    path: QueryPathPart[];
+    /**
+     * @generated from field: repeated camino.QueryResidualRow rows = 2;
+     */
+    rows: QueryResidualRow[];
+    /**
+     * @generated from field: string predicate_json = 3;
+     */
+    predicateJson: string;
+    /**
+     * @generated from field: repeated camino.QueryResidualOrder order = 4;
+     */
+    order: QueryResidualOrder[];
+    /**
+     * @generated from field: uint32 limit = 5;
+     */
+    limit: number;
+    /**
+     * @generated from field: bool bounded_all = 6;
+     */
+    boundedAll: boolean;
+    /**
+     * @generated from field: repeated camino.QuerySelection selection = 7;
+     */
+    selection: QuerySelection[];
+    /**
+     * @generated from field: map<string, string> field_types = 8;
+     */
+    fieldTypes: {
+        [key: string]: string;
+    };
+    /**
+     * @generated from field: bool relational = 9;
+     */
+    relational: boolean;
+    /**
+     * @generated from field: repeated string matched_entries = 10;
+     */
+    matchedEntries: string[];
+};
+/**
+ * Describes the message camino.QueryResidualWindow.
+ * Use `create(QueryResidualWindowSchema)` to create a new message.
+ */
+export declare const QueryResidualWindowSchema: GenMessage<QueryResidualWindow>;
+/**
+ * @generated from message camino.QueryFieldFailure
+ */
+export type QueryFieldFailure = Message<"camino.QueryFieldFailure"> & {
+    /**
+     * @generated from field: repeated camino.QueryPathPart path = 1;
+     */
+    path: QueryPathPart[];
+    /**
+     * @generated from field: string error = 2;
+     */
+    error: string;
+};
+/**
+ * Describes the message camino.QueryFieldFailure.
+ * Use `create(QueryFieldFailureSchema)` to create a new message.
+ */
+export declare const QueryFieldFailureSchema: GenMessage<QueryFieldFailure>;
+/**
+ * @generated from message camino.QueryChangesRequest
+ */
+export type QueryChangesRequest = Message<"camino.QueryChangesRequest"> & {
+    /**
+     * @generated from field: string query_id = 1;
+     */
+    queryId: string;
+    /**
+     * @generated from field: string object_id = 2;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string data_version = 3;
+     */
+    dataVersion: string;
+};
+/**
+ * Describes the message camino.QueryChangesRequest.
+ * Use `create(QueryChangesRequestSchema)` to create a new message.
+ */
+export declare const QueryChangesRequestSchema: GenMessage<QueryChangesRequest>;
+/**
+ * @generated from message camino.QueryChangesResponse
+ */
+export type QueryChangesResponse = Message<"camino.QueryChangesResponse"> & {
+    /**
+     * @generated from field: bool changed = 1;
+     */
+    changed: boolean;
+};
+/**
+ * Describes the message camino.QueryChangesResponse.
+ * Use `create(QueryChangesResponseSchema)` to create a new message.
+ */
+export declare const QueryChangesResponseSchema: GenMessage<QueryChangesResponse>;
 /**
  * @generated from service camino.CaminoService
  */
 export declare const CaminoService: GenService<{
+    /**
+     * @generated from rpc camino.CaminoService.ExecuteQuery
+     */
+    executeQuery: {
+        methodKind: "unary";
+        input: typeof QueryRequestSchema;
+        output: typeof QueryResponseSchema;
+    };
+    /**
+     * @generated from rpc camino.CaminoService.QueryChanges
+     */
+    queryChanges: {
+        methodKind: "unary";
+        input: typeof QueryChangesRequestSchema;
+        output: typeof QueryChangesResponseSchema;
+    };
     /**
      * @generated from rpc camino.CaminoService.InstallPersistencePlan
      */
@@ -816,6 +1497,22 @@ export declare const CaminoService: GenService<{
         input: typeof DisconnectEdgeRequestSchema;
         output: typeof DisconnectEdgeResponseSchema;
     };
+    /**
+     * @generated from rpc camino.CaminoService.ReadCollection
+     */
+    readCollection: {
+        methodKind: "unary";
+        input: typeof ResolveEdgeRequestSchema;
+        output: typeof ReadCollectionResponseSchema;
+    };
+    /**
+     * @generated from rpc camino.CaminoService.ReplaceCollection
+     */
+    replaceCollection: {
+        methodKind: "unary";
+        input: typeof ReplaceCollectionRequestSchema;
+        output: typeof ReadCollectionResponseSchema;
+    };
     /**
      * @generated from rpc camino.CaminoService.ListOps
      */

dist/index.d.ts

@@ -1,6 +1,11 @@
 import http from "node:http";
+import { type QxObjectRef } from "./references.js";
+export * from "./bindings.js";
+export * from "./queries.js";
+export { relationshipMap, relationshipList, relationshipSet } from "./relationships.js";
+export { createMigrationContext, migrationObjectId, serveMigration, type MigrationContext, type MigrationInput, type MigrationOutput, type MigrationEdge, } from "./migration.js";
 import { type Client, type ConnectRouter } from "@connectrpc/connect";
-import { CaminoService, type Value } from "./camino/api_pb.js";
+import { CaminoService, type Value, type QueryResponse } from "./camino/api_pb.js";
 import { OrchestratorRuntime } from "./quixos/orch_pb.js";
 export type CaminoClient = Client<typeof CaminoService>;
 export type OrchClient = Client<typeof OrchestratorRuntime>;
@@ -14,9 +19,7 @@ export type RuntimeDependency = {
     attachmentId: string;
     projectionId: string;
 };
-export declare const objectRef: (objectId: string) => {
+export declare const objectRef: (reference: QxObjectRef) => QxObjectRef<string>;
-    $quixosRef: string;
-};
 export declare const liveValue: (value: Value) => {
     $quixosValue: Value;
 };
@@ -34,20 +37,43 @@ export type StatePort<T = unknown> = {
 export type EdgePort = {
     edgeTypeId: string;
     projectionId: string;
-    resolve(): Promise<string[]>;
+    resolve(): Promise<QxObjectRef[]>;
-    connect(targetObjectId: string): Promise<void>;
+    connect(target: QxObjectRef): Promise<void>;
+    disconnect(target: QxObjectRef): Promise<void>;
+    collection(): Promise<RelationshipCollection>;
+    replace(entries: RelationshipEntry[], expectedRevision: bigint): Promise<RelationshipCollection>;
+};
+export type RelationshipEntry<T extends QxObjectRef = QxObjectRef> = {
+    edgeId?: string;
+    target: T;
+    key?: string | boolean | bigint;
+};
+export type RelationshipCollection<T extends QxObjectRef = QxObjectRef> = {
+    revision: bigint;
+    entries: RelationshipEntry<T>[];
 };
 export type InterfacePort = {
+    objectId: QxObjectRef;
     interfaceRevisionId: string;
     invoke(operationId: string, input?: Record<string, unknown>): Promise<unknown>;
+    live(operationId: string, input?: Record<string, unknown>): Promise<ReturnType<typeof liveValue>>;
 };
 export type ConstructorPort = {
     atomId: string;
-    construct(input?: Record<string, unknown>): Promise<string>;
+    construct(input?: Record<string, unknown>): Promise<QxObjectRef>;
 };
-export type RuntimePort = StatePort | EdgePort | InterfacePort | ConstructorPort;
+export type QueryPort = {
+    queryId: string;
+    execute(variables: Record<string, Value>, expectedDefinitionDigest?: string): Promise<QueryResponse>;
+    watch(variables: Record<string, Value>, signal: AbortSignal, expectedDefinitionDigest?: string): AsyncIterable<import("./quixos/orch_pb.js").QueryEvent>;
+};
+export type RuntimePort = StatePort | EdgePort | InterfacePort | ConstructorPort | QueryPort;
 export type RuntimeContext = {
-    objectId: string;
+    tryConform(object: QxObjectRef, interfaceRevisionId: string): Promise<InterfacePort | undefined>;
+    /** Cooperative cancellation. Completion is acknowledged only after the handler returns. */
+    signal?: AbortSignal;
+    openSession?: () => Promise<RuntimeSession>;
+    objectId: QxObjectRef;
     input: Record<string, unknown>;
     inputProto: Record<string, Value>;
     ports: ReadonlyMap<string, RuntimePort>;
@@ -55,7 +81,18 @@ export type RuntimeContext = {
     edge(portId: string): EdgePort;
     interface(portId: string): InterfacePort;
     constructor(portId: string): ConstructorPort;
+    query(portId: string): QueryPort;
 };
+export type RuntimeSession = {
+    id: string;
+    run<T>(work: (context: RuntimeContext) => Promise<T>): Promise<T>;
+    /** Close the external resource first, then close its host retention/session. */
+    close(): Promise<void>;
+};
+export declare class RuntimeAuthorityError extends Error {
+    readonly retryable: boolean;
+    constructor(message: string);
+}
 export declare const createRuntimeContext: (camino: CaminoClient, orch: OrchClient, request: RuntimeRequest) => RuntimeContext;
 export type RuntimeHandler = (context: RuntimeContext) => unknown | Promise<unknown>;
 export type DerivedHandler = {
@@ -78,5 +115,4 @@ type RuntimeRequest = {
     input: Record<string, Value>;
     dependencies: import("./quixos/refs_pb.js").InjectedDependency[];
 };
-export {};
 //# sourceMappingURL=index.d.ts.map

dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAoC,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAExG,OAAO,EACL,aAAa,EAOb,KAAK,KAAK,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE5D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AA+BnF,eAAO,MAAM,SAAS,aAAc,MAAM;IAAQ,UAAU;CAAa,CAAC;AAC1E,eAAO,MAAM,SAAS,UAAW,KAAK;IAAQ,YAAY;CAAU,CAAC;AAErE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAoC/C,CAAC;AAEF,eAAO,MAAM,cAAc,UAAW,KAAK,GAAG,SAAS,KAAG,OAoBzD,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;;CACmC,CAAC;AAEjG,MAAM,MAAM,SAAS,CAAC,CAAC,GAAG,OAAO,IAAI;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7D,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,eAAe,CAAC;AAEjF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;IACzC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;CAC9C,CAAC;AAOF,eAAO,MAAM,oBAAoB,WACvB,YAAY,QACd,UAAU,WACP,cAAc,KACtB,cA2FF,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACrF,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAC;AACtE,eAAO,MAAM,OAAO,QAAS,cAAc,KAAG,cAA4C,CAAC;AAyB3F,eAAO,MAAM,0BAA0B,WAAY;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,cAsBiB,aAAa,kBA0I9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,WAAY;IAC1C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;CAC1D,yEAaA,CAAC;AACF,KAAK,cAAc,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,YAAY,EAAE,OAAO,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;CAClE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGxF,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAoC,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAExG,OAAO,EACL,aAAa,EAOb,KAAK,KAAK,EACV,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE5D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAiCnF,eAAO,MAAM,SAAS,cAAe,WAAW,wBAG/C,CAAC;AACF,eAAO,MAAM,SAAS,UAAW,KAAK;IAAQ,YAAY;CAAU,CAAC;AAErE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAyC/C,CAAC;AAEF,eAAO,MAAM,cAAc,UAAW,KAAK,GAAG,SAAS,KAAG,OA2BzD,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;;CACmC,CAAC;AAEjG,MAAM,MAAM,SAAS,CAAC,CAAC,GAAG,OAAO,IAAI;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9C,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,IAAI;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,CAAC,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,IAAI;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,WAAW,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;CACnG,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAClE,CAAC;AACF,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,wBAAwB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACrG,KAAK,CACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAChC,MAAM,EAAE,WAAW,EACnB,wBAAwB,CAAC,EAAE,MAAM,GAChC,aAAa,CAAC,OAAO,qBAAqB,EAAE,UAAU,CAAC,CAAC;CAC5D,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,eAAe,GAAG,SAAS,CAAC;AAE7F,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACjG,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5C,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;IACzC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;IAC7C,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClE,gFAAgF;IAChF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AACF,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,YAAY,OAAO,EAAE,MAAM,EAI1B;CACF;AAOD,eAAO,MAAM,oBAAoB,WACvB,YAAY,QACd,UAAU,WACP,cAAc,KACtB,cAqMF,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACrF,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAC;AACtE,eAAO,MAAM,OAAO,QAAS,cAAc,KAAG,cAA4C,CAAC;AA0B3F,eAAO,MAAM,0BAA0B,WAAY;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,cAwJiB,aAAa,kBAgN9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,WAAY;IAC1C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;CAC1D,yEAaA,CAAC;AACF,KAAK,cAAc,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,YAAY,EAAE,OAAO,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;CAClE,CAAC"}

dist/index.js

@@ -1,6 +1,13 @@
 import http from "node:http";
+import { readFileSync } from "node:fs";
+import { createInvocationRegistry } from "./invocations.js";
+import { isObjectReference, referenceFromWire, referenceToWire, assertReferenceFree, } from "./references.js";
+export * from "./bindings.js";
+export * from "./queries.js";
+export { relationshipMap, relationshipList, relationshipSet } from "./relationships.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+export { createMigrationContext, migrationObjectId, serveMigration, } from "./migration.js";
 import { create, equals } from "@bufbuild/protobuf";
 import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { connectNodeAdapter, createConnectTransport } from "@connectrpc/connect-node";
@@ -21,11 +28,20 @@ const recordDependency = async (dependency) => {
 const bytesToBase64 = (value) => Buffer.from(value).toString("base64");
 const base64ToBytes = (value) => Buffer.from(value, "base64");
 const isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
-const isWrappedValue = (value) => isRecord(value) && "$quixosValue" in value &&
+const isWrappedValue = (value) => isRecord(value) &&
-    isRecord(value.$quixosValue) && value.$quixosValue.$typeName === "camino.Value";
+    "$quixosValue" in value &&
-export const objectRef = (objectId) => ({ $quixosRef: objectId });
+    isRecord(value.$quixosValue) &&
+    value.$quixosValue.$typeName === "camino.Value";
+export const objectRef = (reference) => {
+    referenceToWire(reference);
+    return reference;
+};
 export const liveValue = (value) => ({ $quixosValue: value });
 export const jsToProtoValue = (value) => {
+    if (isObjectReference(value))
+        return create(ValueSchema, {
+            kind: { case: "refValue", value: create(RefValueSchema, { objectId: referenceToWire(value) }) },
+        });
     if (isWrappedValue(value))
         return value.$quixosValue;
     if (value === null || value === undefined) {
@@ -46,42 +62,51 @@ export const jsToProtoValue = (value) => {
             kind: { case: "listValue", value: create(ListValueSchema, { values: value.map(jsToProtoValue) }) },
         });
     }
-    if (isRecord(value) && typeof value.$quixosRef === "string") {
+    if (isRecord(value) && "$quixosRef" in value)
+        throw new Error("Raw ID wrappers are not object references");
+    if (isRecord(value) && typeof value.$quixosCrdtType === "string" && typeof value.$quixosCrdtPayload === "string") {
         return create(ValueSchema, {
-            kind: { case: "refValue", value: create(RefValueSchema, { objectId: value.$quixosRef }) },
+            kind: {
-        });
+                case: "crdtValue",
-    }
+                value: create(CrdtValueSchema, {
-    if (isRecord(value) && typeof value.$quixosCrdtType === "string" &&
-        typeof value.$quixosCrdtPayload === "string") {
-        return create(ValueSchema, {
-            kind: { case: "crdtValue", value: create(CrdtValueSchema, {
                     type: value.$quixosCrdtType,
                     encoding: typeof value.$quixosCrdtEncoding === "string" ? value.$quixosCrdtEncoding : "base64",
                     payload: base64ToBytes(value.$quixosCrdtPayload),
-                }) },
+                }),
+            },
         });
     }
     if (!isRecord(value))
         throw new Error(`Unsupported runtime value ${typeof value}`);
     return create(ValueSchema, {
-        kind: { case: "objectValue", value: create(ObjectValueSchema, {
+        kind: {
+            case: "objectValue",
+            value: create(ObjectValueSchema, {
                 fields: Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, jsToProtoValue(entry)])),
-            }) },
+            }),
+        },
     });
 };
 export const protoValueToJs = (value) => {
     switch (value?.kind.case) {
         case "nullValue":
-        case undefined: return null;
+        case undefined:
+            return null;
         case "boolValue":
         case "numberValue":
         case "stringValue":
-        case "integerValue": return value.kind.value;
+        case "integerValue":
-        case "bytesValue": return bytesToBase64(value.kind.value);
+            return value.kind.value;
-        case "refValue": return value.kind.value.objectId;
+        case "bytesValue":
-        case "listValue": return value.kind.value.values.map(protoValueToJs);
+            return bytesToBase64(value.kind.value);
-        case "objectValue": return Object.fromEntries(Object.entries(value.kind.value.fields).map(([key, entry]) => [key, protoValueToJs(entry)]));
+        case "refValue":
-        case "crdtValue": return {
+            return referenceFromWire(value.kind.value.objectId);
+        case "listValue":
+            return value.kind.value.values.map(protoValueToJs);
+        case "objectValue":
+            return Object.fromEntries(Object.entries(value.kind.value.fields).map(([key, entry]) => [key, protoValueToJs(entry)]));
+        case "crdtValue":
+            return {
                 $quixosCrdtType: value.kind.value.type,
                 $quixosCrdtEncoding: value.kind.value.encoding,
                 $quixosCrdtPayload: bytesToBase64(value.kind.value.payload),
@@ -89,28 +114,76 @@ export const protoValueToJs = (value) => {
     }
 };
 export const protoFieldsToJs = (fields) => Object.fromEntries(Object.entries(fields).map(([key, value]) => [key, protoValueToJs(value)]));
-const targetForEdge = (edge, projectionId) => edge.firstProjectionId === projectionId ? edge.secondObjectId : edge.firstObjectId;
+export class RuntimeAuthorityError extends Error {
+    retryable;
+    constructor(message) {
+        super(message);
+        this.name = "RuntimeAuthorityError";
+        this.retryable = /WORKSPACE_FENCED|STALE_EPOCH/.test(message);
+    }
+}
+const targetForEdge = (edge, projectionId) => (edge.firstProjectionId === projectionId ? edge.secondObjectId : edge.firstObjectId);
 export const createRuntimeContext = (camino, orch, request) => {
+    const acquiredPort = (objectId, interfaceRevisionId, conformance) => {
+        const invoke = async (operationId, input = {}) => {
+            const response = await orch.invokeCapability({
+                objectId,
+                capability: create(CapabilityRefSchema, { interfaceRevisionId, operationId, conformance }),
+                input: Object.fromEntries(Object.entries(input).map(([key, value]) => [key, jsToProtoValue(value)])),
+            });
+            if (!response.ok)
+                throw new Error(response.error || "Capability invocation failed");
+            for (const dependency of response.dependencies) {
+                if (dependency.kind === "state" || dependency.kind === "edge")
+                    await recordDependency({
+                        kind: dependency.kind,
+                        objectId: dependency.objectId,
+                        attachmentId: dependency.attachmentId,
+                        ...(dependency.kind === "edge" ? { projectionId: dependency.projectionId } : {}),
+                    });
+            }
+            if (!response.result)
+                throw new Error("Capability returned no value");
+            return response.result;
+        };
+        return {
+            objectId: referenceFromWire(objectId),
+            interfaceRevisionId,
+            invoke: async (operation, input) => protoValueToJs(await invoke(operation, input)),
+            live: async (operation, input) => liveValue(await invoke(operation, input)),
+        };
+    };
     const ports = new Map();
     for (const dependency of request.dependencies) {
         switch (dependency.binding.case) {
+            case "queryId": {
+                const queryId = dependency.binding.value, objectId = dependency.objectId || request.objectId;
+                ports.set(dependency.portId, {
+                    queryId,
+                    execute: (variables, expectedDefinitionDigest) => orch.executeQuery({ queryId, objectId, variables, expectedDefinitionDigest }),
+                    watch: (variables, signal, expectedDefinitionDigest) => orch.watchQuery({ queryId, objectId, variables, expectedDefinitionDigest }, { signal }),
+                });
+                break;
+            }
             case "stateSlotId": {
                 const slotId = dependency.binding.value;
+                const dependencyObjectId = dependency.objectId || request.objectId;
                 const state = {
                     slotId,
                     async get() {
-                        await recordDependency({ kind: "state", objectId: request.objectId, attachmentId: slotId });
+                        await recordDependency({ kind: "state", objectId: dependencyObjectId, attachmentId: slotId });
-                        return protoValueToJs((await camino.readState({ objectId: request.objectId, slotId })).value);
+                        return protoValueToJs((await camino.readState({ objectId: dependencyObjectId, slotId })).value);
                     },
                     async live() {
-                        await recordDependency({ kind: "state", objectId: request.objectId, attachmentId: slotId });
+                        await recordDependency({ kind: "state", objectId: dependencyObjectId, attachmentId: slotId });
-                        const value = await camino.readState({ objectId: request.objectId, slotId });
+                        const value = await camino.readState({ objectId: dependencyObjectId, slotId });
                         if (!value.value)
                             throw new Error(`State ${slotId} returned no value`);
                         return liveValue(value.value);
                     },
                     async set(value) {
-                        await camino.writeState({ objectId: request.objectId, slotId, value: jsToProtoValue(value) });
+                        assertReferenceFree(isWrappedValue(value) ? protoValueToJs(value.$quixosValue) : value);
+                        await camino.writeState({ objectId: dependencyObjectId, slotId, value: jsToProtoValue(value) });
                     },
                 };
                 ports.set(dependency.portId, state);
@@ -118,37 +191,79 @@ export const createRuntimeContext = (camino, orch, request) => {
             }
             case "edge": {
                 const { edgeTypeId, projectionId } = dependency.binding.value;
+                const dependencyObjectId = dependency.objectId || request.objectId;
+                const collectionResult = (response) => ({
+                    revision: response.revision,
+                    entries: response.entries.map((entry) => ({
+                        edgeId: entry.edgeId,
+                        target: referenceFromWire(entry.targetObjectId),
+                        ...(entry.key
+                            ? {
+                                key: entry.key.kind.case === "integerValue"
+                                    ? BigInt(entry.key.kind.value)
+                                    : protoValueToJs(entry.key),
+                            }
+                            : {}),
+                    })),
+                });
                 const edge = {
                     edgeTypeId,
                     projectionId,
-                    async resolve() {
+                    async collection() {
-                        await recordDependency({ kind: "edge", objectId: request.objectId, attachmentId: edgeTypeId, projectionId });
+                        await recordDependency({
-                        const result = await camino.resolveEdge({ objectId: request.objectId, edgeTypeId, projectionId });
+                            kind: "edge",
-                        return result.edges.map((entry) => targetForEdge(entry, projectionId));
+                            objectId: dependencyObjectId,
+                            attachmentId: edgeTypeId,
+                            projectionId,
+                        });
+                        return collectionResult(await camino.readCollection({ objectId: dependencyObjectId, edgeTypeId, projectionId }));
                     },
-                    async connect(targetObjectId) {
+                    async replace(entries, expectedRevision) {
-                        await camino.connectEdge({ objectId: request.objectId, edgeTypeId, projectionId, targetObjectId });
+                        return collectionResult(await camino.replaceCollection({
+                            objectId: dependencyObjectId,
+                            edgeTypeId,
+                            projectionId,
+                            expectedRevision,
+                            entries: entries.map((entry) => {
+                                assertReferenceFree(entry.key);
+                                return {
+                                    edgeId: entry.edgeId ?? "",
+                                    targetObjectId: referenceToWire(entry.target),
+                                    key: entry.key === undefined ? undefined : jsToProtoValue(entry.key),
+                                };
+                            }),
+                        }));
+                    },
+                    async resolve() {
+                        await recordDependency({
+                            kind: "edge",
+                            objectId: dependencyObjectId,
+                            attachmentId: edgeTypeId,
+                            projectionId,
+                        });
+                        const result = await camino.resolveEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId });
+                        return result.edges.map((entry) => referenceFromWire(targetForEdge(entry, projectionId)));
+                    },
+                    async connect(target) {
+                        const targetObjectId = referenceToWire(target);
+                        await camino.connectEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId, targetObjectId });
+                    },
+                    async disconnect(target) {
+                        const targetObjectId = referenceToWire(target);
+                        const result = await camino.resolveEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId });
+                        for (const entry of result.edges) {
+                            if (targetForEdge(entry, projectionId) === targetObjectId)
+                                await camino.disconnectEdge({ edgeId: entry.id });
+                        }
                     },
                 };
                 ports.set(dependency.portId, edge);
                 break;
             }
-            case "receiverInterfaceRevisionId": {
+            case "interfaceRevisionId": {
                 const interfaceRevisionId = dependency.binding.value;
-                const capability = {
+                const dependencyObjectId = dependency.objectId || request.objectId;
-                    interfaceRevisionId,
+                ports.set(dependency.portId, acquiredPort(dependencyObjectId, interfaceRevisionId));
-                    async invoke(operationId, input = {}) {
-                        const response = await orch.invokeCapability({
-                            capability: create(CapabilityRefSchema, { interfaceRevisionId, operationId }),
-                            objectId: request.objectId,
-                            input: Object.fromEntries(Object.entries(input).map(([key, value]) => [key, jsToProtoValue(value)])),
-                        });
-                        if (!response.ok)
-                            throw new Error(response.error || `Capability ${operationId} failed`);
-                        return protoValueToJs(response.result);
-                    },
-                };
-                ports.set(dependency.portId, capability);
                 break;
             }
             case "constructorAtomId": {
@@ -162,7 +277,7 @@ export const createRuntimeContext = (camino, orch, request) => {
                         });
                         if (!response.object)
                             throw new Error(`Constructor ${atomId} returned no object`);
-                        return response.object.id;
+                        return referenceFromWire(response.object.id);
                     },
                 };
                 ports.set(dependency.portId, constructor);
@@ -176,7 +291,16 @@ export const createRuntimeContext = (camino, orch, request) => {
         return port;
     };
     return {
-        objectId: request.objectId,
+        async tryConform(object, interfaceRevisionId) {
+            const objectId = referenceToWire(object);
+            const { conformance } = await orch.tryConform({ objectId, interfaceRevisionId });
+            if (conformance && (conformance.objectId !== objectId || conformance.interfaceRevisionId !== interfaceRevisionId))
+                throw new Error("Conformance response does not match the requested view");
+            return conformance ? acquiredPort(objectId, interfaceRevisionId, conformance) : undefined;
+        },
+        get objectId() {
+            return referenceFromWire(request.objectId);
+        },
         input: protoFieldsToJs(request.input),
         inputProto: request.input,
         ports,
@@ -184,6 +308,7 @@ export const createRuntimeContext = (camino, orch, request) => {
         edge: (portId) => requirePort(portId, "edgeTypeId"),
         interface: (portId) => requirePort(portId, "interfaceRevisionId"),
         constructor: (portId) => requirePort(portId, "atomId"),
+        query: (portId) => requirePort(portId, "queryId"),
     };
 };
 export const derived = (get) => ({ kind: "derived", get });
@@ -200,9 +325,14 @@ const protoDependencies = (dependencies) => dependencies.map((entry) => create(D
     projectionId: entry.kind === "edge" ? entry.projectionId : "",
 }));
 export const createPackageRuntimeRoutes = (config) => {
+    const invocations = createInvocationRegistry();
     const headers = {};
-    if (process.env.CAMINO_RUNTIME_AUTH_TOKEN) {
+    const processToken = process.env.CAMINO_RUNTIME_AUTH_TOKEN ??
-        headers["x-camino-runtime-token"] = process.env.CAMINO_RUNTIME_AUTH_TOKEN;
+        (process.env.CAMINO_RUNTIME_AUTH_TOKEN_FILE
+            ? readFileSync(process.env.CAMINO_RUNTIME_AUTH_TOKEN_FILE, "utf8").trim()
+            : "");
+    if (processToken) {
+        headers["x-camino-runtime-token"] = processToken;
     }
     else if (process.env.CAMINO_RUNTIME_AUTH_REQUIRED === "1") {
         throw new Error("CAMINO_RUNTIME_AUTH_TOKEN is required");
@@ -210,33 +340,163 @@ export const createPackageRuntimeRoutes = (config) => {
     const camino = createClient(CaminoService, createConnectTransport({
         baseUrl: config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310",
         httpVersion: "1.1",
-        interceptors: headers["x-camino-runtime-token"] ? [
+        interceptors: headers["x-camino-runtime-token"]
+            ? [
                 (next) => async (request) => {
                     request.header.set("x-camino-runtime-token", headers["x-camino-runtime-token"]);
                     return await next(request);
                 },
-        ] : [],
+            ]
+            : [],
     }));
     const orch = createClient(OrchestratorRuntime, createConnectTransport({
         baseUrl: config.orchUrl ?? process.env.QUIXOS_ORCH_URL ?? "http://127.0.0.1:7311",
         httpVersion: "1.1",
     }));
+    const authenticateInstance = (header) => {
+        if (!process.env.QUIXOS_RUNTIME_INSTANCE_ID)
+            return; // standalone development ABI
+        const supplied = Buffer.from(header.get("x-quixos-instance-token") ?? "");
+        const expected = Buffer.from(processToken);
+        if (!expected.length || supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+            throw new ConnectError("Invalid runtime instance credential", Code.Unauthenticated);
+        }
+    };
+    const clientsFor = (request) => {
+        const context = request.context;
+        if (process.env.QUIXOS_RUNTIME_INSTANCE_ID &&
+            (!context?.grant || context.instanceId !== process.env.QUIXOS_RUNTIME_INSTANCE_ID || !context.workspaceEpoch)) {
+            throw new ConnectError("Managed invocation requires an exact instance and epoch grant", Code.Unauthenticated);
+        }
+        if (!context?.grant)
+            return { camino, orch };
+        const transport = (url) => createConnectTransport({
+            baseUrl: url,
+            httpVersion: "1.1",
+            interceptors: [
+                (next) => async (call) => {
+                    call.header.set("x-quixos-invocation-grant", context.grant);
+                    call.header.set("x-camino-runtime-token", processToken);
+                    return next(call);
+                },
+            ],
+        });
+        return {
+            camino: createClient(CaminoService, transport(config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310")),
+            orch: createClient(OrchestratorRuntime, transport(config.orchUrl ?? process.env.QUIXOS_ORCH_URL ?? "http://127.0.0.1:7311")),
+        };
+    };
+    const runtimeControl = async (operation, input) => {
+        const response = await fetch(`${config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310"}/__runtime/${operation}`, {
+            method: "POST",
+            headers: { "content-type": "application/json", "x-camino-runtime-token": processToken },
+            body: JSON.stringify(input),
+            signal: AbortSignal.timeout(10_000),
+        });
+        const value = (await response.json());
+        if (!response.ok)
+            throw new RuntimeAuthorityError(value.error ?? "Runtime authority request failed");
+        return value;
+    };
+    const attachSessions = (runtimeContext, request) => {
+        if (!request.context?.grant || !request.context.ownerConformanceId)
+            return;
+        runtimeContext.openSession = async () => {
+            const ownerId = request.context.ownerConformanceId;
+            const registration = {
+                grant: request.context.grant,
+                objectId: request.objectId,
+                ownerId,
+                sessionId: `session:${randomBytes(16).toString("hex")}`,
+                token: randomBytes(32).toString("base64url"),
+            };
+            const register = () => runtimeControl("register-session", registration);
+            const registered = await register().catch((error) => {
+                // Retry a transport/lost-response failure with exactly the same identity.
+                // Admission/authority errors are definitive and must not be retried here.
+                if (error instanceof RuntimeAuthorityError)
+                    throw error;
+                return register();
+            });
+            let closed = false;
+            return {
+                id: registered.sessionId,
+                async run(work) {
+                    if (closed)
+                        throw new RuntimeAuthorityError("SESSION_CLOSED");
+                    // Acquisition happens before user code. A fence failure can be retried
+                    // by the caller without replaying a side-effecting callback.
+                    const grant = await runtimeControl("acquire-session", registered);
+                    const execution = invocations.begin(grant.invocationId);
+                    const sessionRequest = {
+                        ...request,
+                        context: { grant: grant.grant, instanceId: grant.instanceId, workspaceEpoch: grant.epoch },
+                    };
+                    const clients = clientsFor(sessionRequest);
+                    const context = createRuntimeContext(clients.camino, clients.orch, sessionRequest);
+                    context.signal = execution.signal;
+                    try {
+                        return await work(context);
+                    }
+                    finally {
+                        execution.finish();
+                        await runtimeControl("complete-invocation", { invocationId: grant.invocationId }).catch((error) => console.error("Session completion will be reconciled by the host", error));
+                    }
+                },
+                async close() {
+                    await runtimeControl("close-session", registered);
+                    closed = true;
+                },
+            };
+        };
+    };
     return (router) => router.service(PackageRuntime, {
-        handshake: () => create(HandshakeResponseSchema, {
+        handshake: (request) => create(HandshakeResponseSchema, {
             packageRevisionId: config.packageRevisionId,
             runtimeProtocolVersion: "quixos-capabilities-v1",
             exportIds: Object.keys(config.exports),
+            capabilities: ["invocation-completion-v1", "instance-authentication-v1", "epoch-grants-v1"],
+            instanceId: process.env.QUIXOS_RUNTIME_INSTANCE_ID ?? "",
+            authenticationProof: request.nonce && processToken
+                ? createHmac("sha256", processToken)
+                    .update(JSON.stringify([
+                    request.nonce,
+                    process.env.QUIXOS_RUNTIME_INSTANCE_ID ?? "",
+                    config.packageRevisionId,
+                ]))
+                    .digest("hex")
+                : "",
         }),
-        invoke: async (request) => {
+        getInvocationStatus: (request, context) => {
+            authenticateInstance(context.requestHeader);
+            return invocations.status(request.invocationId);
+        },
+        cancelInvocation: (request, context) => {
+            authenticateInstance(context.requestHeader);
+            return invocations.cancel(request.invocationId);
+        },
+        invoke: async (request, context) => {
+            authenticateInstance(context.requestHeader);
+            const { camino, orch } = clientsFor(request);
             const exportId = request.export?.exportId;
             const handler = exportId ? config.exports[exportId] : undefined;
             if (!handler)
                 throw new ConnectError(`Unknown export ${exportId ?? ""}`, Code.NotFound);
+            const execution = invocations.begin(request.invocationId || (process.env.QUIXOS_RUNTIME_INSTANCE_ID ? "" : randomUUID()));
             try {
-                const result = await evaluate(handler, createRuntimeContext(camino, orch, request));
+                const runtimeContext = createRuntimeContext(camino, orch, request);
-                return create(InvokeResponseSchema, { ok: true, result: result.value });
+                attachSessions(runtimeContext, request);
+                runtimeContext.signal = AbortSignal.any([context.signal, execution.signal]);
+                const result = await evaluate(handler, runtimeContext);
+                execution.finish();
+                return create(InvokeResponseSchema, {
+                    ok: true,
+                    result: result.value,
+                    dependencies: protoDependencies(result.dependencies),
+                });
             }
             catch (error) {
+                execution.finish(true);
                 return create(InvokeResponseSchema, {
                     ok: false,
                     error: error instanceof Error ? error.message : String(error),
@@ -244,15 +504,23 @@ export const createPackageRuntimeRoutes = (config) => {
             }
         },
         watch: async function* (request, context) {
+            authenticateInstance(context.requestHeader);
+            const { camino, orch } = clientsFor(request);
             const exportId = request.export?.exportId;
             const handler = exportId ? config.exports[exportId] : undefined;
             if (!handler || !isDerived(handler)) {
                 throw new ConnectError(`Export ${exportId ?? ""} is not derived`, Code.FailedPrecondition);
             }
+            const execution = invocations.begin(request.invocationId || (process.env.QUIXOS_RUNTIME_INSTANCE_ID ? "" : randomUUID()));
+            const signal = AbortSignal.any([context.signal, execution.signal]);
+            try {
                 const watchId = `watch:${randomUUID()}`;
                 const runtimeContext = createRuntimeContext(camino, orch, request);
+                attachSessions(runtimeContext, request);
+                runtimeContext.signal = signal;
                 const subscriptions = new Map();
                 const establishing = new Map();
+                let subscriptionEpoch = 0;
                 const ensureSubscription = async (dependency) => {
                     const key = dependencyKey(dependency);
                     if (subscriptions.has(key))
@@ -262,7 +530,12 @@ export const createPackageRuntimeRoutes = (config) => {
                         return await pending;
                     const establish = (async () => {
                         const controller = new AbortController();
-                    const stream = camino.watchObject({ objectId: dependency.objectId, includeSnapshot: true }, { signal: controller.signal })[Symbol.asyncIterator]();
+                        const stream = camino
+                            .watchObject({
+                            objectId: dependency.objectId,
+                            includeSnapshot: true,
+                            attachmentIds: request.context?.grant ? [dependency.attachmentId] : [],
+                        }, { signal: controller.signal })[Symbol.asyncIterator]();
                         try {
                             // Camino subscribes before producing the snapshot, so once this
                             // resolves the following state/edge read cannot race the stream.
@@ -278,6 +551,7 @@ export const createPackageRuntimeRoutes = (config) => {
                             };
                             subscription.next = waitNext();
                             subscriptions.set(key, subscription);
+                            subscriptionEpoch += 1;
                         }
                         catch (error) {
                             controller.abort();
@@ -297,8 +571,23 @@ export const createPackageRuntimeRoutes = (config) => {
                         subscription.controller.abort();
                     }
                 };
-            context.signal.addEventListener("abort", abortAll, { once: true });
+                signal.addEventListener("abort", abortAll, { once: true });
-            let current = await evaluate(handler, runtimeContext, ensureSubscription);
+                const evaluateWithStableSubscriptions = async () => {
+                    // A direct state/edge port records its dependency before reading it,
+                    // but a nested interface invocation can only report its transitive
+                    // dependencies after that invocation returns. Once a new dependency
+                    // stream is established, evaluate again so every read contributing to
+                    // the emitted value happened after its stream became live.
+                    for (let pass = 0; pass < 32; pass += 1) {
+                        const before = subscriptionEpoch;
+                        const result = await evaluate(handler, runtimeContext, ensureSubscription);
+                        if (subscriptionEpoch === before)
+                            return result;
+                    }
+                    throw new Error("Derived dependency discovery did not stabilize after 32 passes");
+                };
+                try {
+                    let current = await evaluateWithStableSubscriptions();
                     yield create(WatchEventSchema, {
                         watchId,
                         value: current.value,
@@ -306,21 +595,17 @@ export const createPackageRuntimeRoutes = (config) => {
                         initial: true,
                     });
                     const abort = new Promise((resolve) => {
-                if (context.signal.aborted)
+                        if (signal.aborted)
                             resolve("abort");
                         else
-                    context.signal.addEventListener("abort", () => resolve("abort"), { once: true });
+                            signal.addEventListener("abort", () => resolve("abort"), { once: true });
                     });
-            try {
+                    while (!signal.aborted) {
-                while (!context.signal.aborted) {
                         if (subscriptions.size === 0) {
                             await abort;
                             break;
                         }
-                    const outcome = await Promise.race([
+                        const outcome = await Promise.race([...[...subscriptions.values()].map((entry) => entry.next), abort]);
-                        ...[...subscriptions.values()].map((entry) => entry.next),
-                        abort,
-                    ]);
                         if (outcome === "abort")
                             break;
                         const subscription = subscriptions.get(outcome.key);
@@ -331,7 +616,7 @@ export const createPackageRuntimeRoutes = (config) => {
                         if (outcome.done)
                             throw new Error(`Dependency stream ${outcome.key} ended unexpectedly`);
                         subscription.next = subscription.waitNext();
-                    const updated = await evaluate(handler, runtimeContext, ensureSubscription);
+                        const updated = await evaluateWithStableSubscriptions();
                         const active = new Set(updated.dependencies.map(dependencyKey));
                         for (const [key, entry] of subscriptions) {
                             if (!active.has(key)) {
@@ -350,9 +635,13 @@ export const createPackageRuntimeRoutes = (config) => {
                     }
                 }
                 finally {
-                context.signal.removeEventListener("abort", abortAll);
+                    signal.removeEventListener("abort", abortAll);
                     abortAll();
                 }
+            }
+            finally {
+                execution.finish();
+            }
         },
     });
 };

dist/invocations.d.ts

@@ -0,0 +1,16 @@
+/** Execution completion, not HTTP disconnection, is the drain boundary. */
+export declare const createInvocationRegistry: () => {
+    begin(id: string): {
+        signal: AbortSignal;
+        finish(failed?: boolean): void;
+    };
+    status(id: string): {
+        invocationId: string;
+        state: string;
+    };
+    cancel(id: string): {
+        invocationId: string;
+        state: string;
+    };
+};
+//# sourceMappingURL=invocations.d.ts.map

dist/invocations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocations.d.ts","sourceRoot":"","sources":["../src/invocations.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB;IAGjC,KAAK,KAAK,MAAM;QASZ,MAAM;QACN,MAAM;;IAKV,MAAM,KAAK,MAAM;QACN,YAAY;QAAM,KAAK;;IAElC,MAAM,KAAK,MAAM;;;;CASpB,CAAC"}

dist/invocations.js

@@ -0,0 +1,33 @@
+/** Execution completion, not HTTP disconnection, is the drain boundary. */
+export const createInvocationRegistry = () => {
+    const entries = new Map();
+    return {
+        begin(id) {
+            if (!id || entries.has(id))
+                throw new Error("Invocation ID is missing or already used; invocations are never replayed implicitly");
+            // Completed identities remain until process retirement. A bounded process
+            // may reject new work; it must not evict and accidentally replay a call.
+            if (entries.size >= 100_000)
+                throw new Error("Invocation registry full; explicit runtime retirement required");
+            const entry = { state: "running", controller: new AbortController() };
+            entries.set(id, entry);
+            return {
+                signal: entry.controller.signal,
+                finish(failed = false) {
+                    entry.state = failed ? "failed" : "completed";
+                },
+            };
+        },
+        status(id) {
+            return { invocationId: id, state: entries.get(id)?.state ?? "unknown" };
+        },
+        cancel(id) {
+            const entry = entries.get(id);
+            if (entry && ["running", "cancellation-requested"].includes(entry.state)) {
+                entry.state = "cancellation-requested";
+                entry.controller.abort();
+            }
+            return this.status(id);
+        },
+    };
+};

dist/migration.d.ts

@@ -0,0 +1,72 @@
+export type MigrationInput = {
+    schemaVersion: 1;
+    executionId: string;
+    exportId: string;
+    ports: {
+        name: string;
+        binding: string;
+        view: "old" | "new";
+        access: ("read" | "write" | "create" | "edge")[];
+        atomId?: string;
+        attachedAtomId?: string;
+        defaultValue?: unknown;
+        states?: {
+            objectId: string;
+            value: unknown;
+        }[];
+        edges?: MigrationEdge[];
+    }[];
+};
+export type MigrationEdge = {
+    id: string;
+    edgeTypeId: string;
+    firstObjectId: string;
+    secondObjectId: string;
+    firstProjectionId: string;
+    secondProjectionId: string;
+    firstOrdinal?: number;
+    secondOrdinal?: number;
+    firstKeyJson?: string;
+    secondKeyJson?: string;
+};
+export type MigrationOutput = {
+    schemaVersion: 1;
+    executionId: string;
+    writes: {
+        port: string;
+        objectId: string;
+        value: unknown;
+    }[];
+    creates: {
+        port: string;
+        logicalKey: string;
+        objectId: string;
+    }[];
+    edgeReplacements: {
+        port: string;
+        edges: MigrationEdge[];
+    }[];
+};
+export type MigrationContext = {
+    enumerate(port: string): {
+        objectId: string;
+        value: unknown;
+    }[];
+    read(port: string, objectId: string): unknown;
+    write(port: string, objectId: string, value: unknown): void;
+    create(port: string, logicalKey: string): string;
+    edges(port: string): MigrationEdge[];
+    replaceEdges(port: string, edges: MigrationEdge[]): void;
+};
+export declare const migrationObjectId: (executionId: string, port: string, logicalKey: string) => string;
+/** No ordinary RuntimeContext or network/database clients are supplied here.
+ * Process isolation belongs to the host, not this convenience API. */
+export declare const createMigrationContext: (input: MigrationInput) => {
+    context: MigrationContext;
+    result: () => MigrationOutput;
+};
+/** Entrypoint for an immutable package's dedicated bin/migrate executable.
+ * stdout is protocol-only; send diagnostics to stderr. The host independently
+ * validates every write, helper identity, contract, and completion receipt. */
+export declare const serveMigration: (exports: Record<string, (context: MigrationContext) => void | Promise<void>>) => Promise<void>;
+//# sourceMappingURL=migration.d.ts.map

dist/migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../src/migration.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,CAAC,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;QACpB,MAAM,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,MAAM,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,EAAE,CAAC;QAChD,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;KACzB,EAAE,CAAC;CACL,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,EAAE,CAAC,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC7D,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClE,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,aAAa,EAAE,CAAA;KAAE,EAAE,CAAC;CAC9D,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;CAC1D,CAAC;AACF,eAAO,MAAM,iBAAiB,gBAAiB,MAAM,QAAQ,MAAM,cAAc,MAAM,WAGnE,CAAC;AAErB;sEACsE;AACtE,eAAO,MAAM,sBAAsB,UAAW,cAAc;;;CAgF3D,CAAC;AAEF;;+EAE+E;AAC/E,eAAO,MAAM,cAAc,YAAmB,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,kBAgBhH,CAAC"}

dist/migration.js

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+export const migrationObjectId = (executionId, port, logicalKey) => `obj:migration:${createHash("sha256")
+    .update(JSON.stringify([executionId, port, logicalKey]))
+    .digest("hex")}`;
+/** No ordinary RuntimeContext or network/database clients are supplied here.
+ * Process isolation belongs to the host, not this convenience API. */
+export const createMigrationContext = (input) => {
+    if (input.schemaVersion !== 1 ||
+        !input.executionId ||
+        new Set(input.ports.map((entry) => entry.name)).size !== input.ports.length)
+        throw new Error("Invalid migration input");
+    const output = {
+        schemaVersion: 1,
+        executionId: input.executionId,
+        writes: [],
+        creates: [],
+        edgeReplacements: [],
+    };
+    const port = (name, access) => {
+        const selected = input.ports.find((entry) => entry.name === name);
+        if (!selected?.access.includes(access) || (selected.view === "old" && access !== "read"))
+            throw new Error(`Migration port ${name} does not grant ${access}`);
+        return selected;
+    };
+    const context = {
+        enumerate(name) {
+            const selected = port(name, "read"), states = structuredClone(selected.states ?? []);
+            if (selected.view === "new" && Object.hasOwn(selected, "defaultValue"))
+                for (const helper of output.creates) {
+                    if (input.ports.find((entry) => entry.name === helper.port)?.atomId === selected.attachedAtomId &&
+                        !states.some((entry) => entry.objectId === helper.objectId))
+                        states.push({ objectId: helper.objectId, value: structuredClone(selected.defaultValue) });
+                }
+            if (selected.view === "new")
+                for (const write of output.writes) {
+                    if (input.ports.find((entry) => entry.name === write.port)?.binding !== selected.binding)
+                        continue;
+                    const existing = states.findIndex((entry) => entry.objectId === write.objectId), entry = { objectId: write.objectId, value: structuredClone(write.value) };
+                    if (existing < 0)
+                        states.push(entry);
+                    else
+                        states[existing] = entry;
+                }
+            return states.sort((a, b) => (a.objectId < b.objectId ? -1 : a.objectId > b.objectId ? 1 : 0));
+        },
+        read(name, objectId) {
+            return context.enumerate(name).find((entry) => entry.objectId === objectId)?.value;
+        },
+        write(name, objectId, value) {
+            port(name, "write");
+            const previous = output.writes.findIndex((entry) => entry.port === name && entry.objectId === objectId);
+            const entry = { port: name, objectId, value: structuredClone(value) };
+            if (previous < 0)
+                output.writes.push(entry);
+            else
+                output.writes[previous] = entry;
+        },
+        create(name, logicalKey) {
+            port(name, "create");
+            if (!logicalKey || logicalKey.length > 1024)
+                throw new Error("Migration creation requires a bounded stable logical key");
+            const objectId = migrationObjectId(input.executionId, name, logicalKey);
+            if (!output.creates.some((entry) => entry.objectId === objectId))
+                output.creates.push({ port: name, logicalKey, objectId });
+            return objectId;
+        },
+        edges(name) {
+            const selected = port(name, "read");
+            const replacement = selected.view === "new"
+                ? output.edgeReplacements.find((entry) => input.ports.find((candidate) => candidate.name === entry.port)?.binding === selected.binding)
+                : undefined;
+            return structuredClone(replacement?.edges ?? selected.edges ?? []);
+        },
+        replaceEdges(name, edges) {
+            port(name, "edge");
+            const previous = output.edgeReplacements.findIndex((entry) => entry.port === name);
+            const entry = { port: name, edges: structuredClone(edges) };
+            if (previous < 0)
+                output.edgeReplacements.push(entry);
+            else
+                output.edgeReplacements[previous] = entry;
+        },
+    };
+    return { context, result: () => structuredClone(output) };
+};
+/** Entrypoint for an immutable package's dedicated bin/migrate executable.
+ * stdout is protocol-only; send diagnostics to stderr. The host independently
+ * validates every write, helper identity, contract, and completion receipt. */
+export const serveMigration = async (exports) => {
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of process.stdin) {
+        bytes += chunk.length;
+        if (bytes > 16 * 1024 * 1024)
+            throw new Error("Migration input exceeds 16 MiB");
+        chunks.push(Buffer.from(chunk));
+    }
+    const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    const implementation = Object.hasOwn(exports, input.exportId) ? exports[input.exportId] : undefined;
+    if (!implementation)
+        throw new Error("Unknown migration export");
+    const execution = createMigrationContext(input);
+    await implementation(execution.context);
+    const result = JSON.stringify(execution.result());
+    if (Buffer.byteLength(result) > 16 * 1024 * 1024)
+        throw new Error("Migration output exceeds 16 MiB");
+    process.stdout.write(`${result}\n`);
+};

dist/queries.d.ts

@@ -0,0 +1,38 @@
+import { type QxValueType } from "./bindings.js";
+import type { QueryResponse } from "./camino/api_pb.js";
+import type { QxObjectRef } from "./references.js";
+export type QxQueryPartial<T> = T extends QxObjectRef ? T : T extends readonly (infer Item)[] ? QxQueryPartial<Item>[] : T extends object ? {
+    [Key in keyof T]?: QxQueryPartial<T[Key]>;
+} : T;
+export type QxQuerySnapshot<T> = {
+    runId: string;
+    sequence: bigint;
+    dataVersion: string;
+    bindingDigest: string;
+    consistency: string;
+    fields: {
+        path: readonly (string | number)[];
+        status: "pending" | "error";
+        error?: string;
+    }[];
+} & ({
+    status: "ready";
+    data: T;
+} | {
+    status: "partial";
+    data: QxQueryPartial<T>;
+});
+declare const queryTypes: unique symbol;
+/** Generated shape evidence, not permission to run a query. */
+export interface QxQueryDescriptor<Variables, Result, Root extends string = string> {
+    readonly id: string;
+    readonly definitionDigest: string;
+    readonly rootInterfaceRevisionId: Root;
+    readonly variables: QxValueType;
+    readonly output: QxValueType;
+    readonly watch: boolean;
+    readonly [queryTypes]?: (variables: Variables, result: Result) => [Variables, Result];
+}
+export declare function decodeQuerySnapshot<T>(response: QueryResponse, output: QxValueType, runId: string, sequence: bigint): QxQuerySnapshot<T>;
+export {};
+//# sourceMappingURL=queries.d.ts.map

dist/queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../src/queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,WAAW,GACjD,CAAC,GACD,CAAC,SAAS,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,GAC/B,cAAc,CAAC,IAAI,CAAC,EAAE,GACtB,CAAC,SAAS,MAAM,GACd;KAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;CAAE,GAC7C,CAAC,CAAC;AACV,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/F,GAAG,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC;AACpF,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AACxC,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,SAAS,MAAM,GAAG,MAAM;IAChF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CACvF;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,eAAe,CAAC,CAAC,CAAC,CA6CpB"}

dist/queries.js

@@ -0,0 +1,57 @@
+import { decodeQxValue } from "./bindings.js";
+export function decodeQuerySnapshot(response, output, runId, sequence) {
+    if (response.preparationToken || response.residualWindows.length || response.relationalCaptures.length)
+        throw new Error("QUERY_RESULT_UNFINISHED: private preparation is not a query result");
+    const fields = [
+        ...response.pending.map((field) => ({ path: field.path, status: "pending" })),
+        ...response.errors.map((field) => ({ path: field.path, status: "error", error: field.error })),
+    ].map((field) => ({
+        ...field,
+        path: field.path.map((part) => {
+            if (part.part.case !== "field" && part.part.case !== "index")
+                throw new Error("QUERY_PATCH_INVALID");
+            return part.part.value;
+        }),
+    }));
+    // Pending/error values are absent, not successful nulls of a scalar type.
+    const shape = structuredClone(output);
+    for (const field of fields) {
+        let cursor = shape;
+        for (const [index, part] of field.path.entries()) {
+            while (cursor.kind === "optional")
+                cursor = cursor.value;
+            const last = index === field.path.length - 1;
+            if (typeof part === "string" && cursor.kind === "record" && cursor.fields[part]) {
+                if (last)
+                    cursor.fields[part] = { kind: "optional", value: cursor.fields[part] };
+                else
+                    cursor = cursor.fields[part];
+            }
+            else if (typeof part === "number" && cursor.kind === "list")
+                cursor = cursor.value;
+            else
+                throw new Error("QUERY_PATCH_INVALID");
+        }
+    }
+    const data = decodeQxValue(shape, response.value, {});
+    for (const field of fields) {
+        let cursor = data;
+        for (const [index, part] of field.path.entries()) {
+            if (!cursor || typeof cursor !== "object")
+                throw new Error("QUERY_PATCH_INVALID");
+            if (index === field.path.length - 1)
+                delete cursor[part];
+            else
+                cursor = cursor[part];
+        }
+    }
+    return {
+        runId,
+        sequence,
+        dataVersion: response.dataVersion,
+        bindingDigest: response.bindingDigest,
+        consistency: response.consistency,
+        fields,
+        ...(fields.length ? { status: "partial", data } : { status: "ready", data }),
+    };
+}

dist/quixos/orch_pb.d.ts

@@ -1,13 +1,88 @@
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { CaminoObject, Value } from "../camino/api_pb.js";
+import type { CaminoObject, CrdtValue, QueryPathPart, QueryRequestSchema, QueryResponse, QueryResponseSchema, Value } from "../camino/api_pb.js";
+import type { InstalledQuery } from "../camino/schema_pb.js";
 import type { PackageDescriptor } from "./package_pb.js";
-import type { CapabilityRef, PackageExportRef } from "./refs_pb.js";
+import type { CapabilityRef, ConformanceWitness, FieldEditing, PackageExportRef } from "./refs_pb.js";
 import type { DerivedDependency } from "./runtime_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file quixos/orch.proto.
  */
 export declare const file_quixos_orch: GenFile;
+/**
+ * @generated from message quixos.orch.QueryEvent
+ */
+export type QueryEvent = Message<"quixos.orch.QueryEvent"> & {
+    /**
+     * @generated from field: string run_id = 1;
+     */
+    runId: string;
+    /**
+     * @generated from field: uint64 sequence = 2;
+     */
+    sequence: bigint;
+    /**
+     * @generated from field: string kind = 3;
+     */
+    kind: string;
+    /**
+     * @generated from field: camino.QueryResponse snapshot = 4;
+     */
+    snapshot?: QueryResponse | undefined;
+    /**
+     * @generated from field: repeated camino.QueryPathPart path = 5;
+     */
+    path: QueryPathPart[];
+    /**
+     * @generated from field: camino.Value value = 6;
+     */
+    value?: Value | undefined;
+    /**
+     * @generated from field: string error = 7;
+     */
+    error: string;
+};
+/**
+ * Describes the message quixos.orch.QueryEvent.
+ * Use `create(QueryEventSchema)` to create a new message.
+ */
+export declare const QueryEventSchema: GenMessage<QueryEvent>;
+/**
+ * Exact closed interface lookup; no policy selection or competing conformances.
+ *
+ * @generated from message quixos.orch.TryConformRequest
+ */
+export type TryConformRequest = Message<"quixos.orch.TryConformRequest"> & {
+    /**
+     * @generated from field: string object_id = 1;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string interface_revision_id = 2;
+     */
+    interfaceRevisionId: string;
+};
+/**
+ * Describes the message quixos.orch.TryConformRequest.
+ * Use `create(TryConformRequestSchema)` to create a new message.
+ */
+export declare const TryConformRequestSchema: GenMessage<TryConformRequest>;
+/**
+ * @generated from message quixos.orch.TryConformResponse
+ */
+export type TryConformResponse = Message<"quixos.orch.TryConformResponse"> & {
+    /**
+     * Absent only when this object lacks a known contract. Other failures are errors.
+     *
+     * @generated from field: quixos.ConformanceWitness conformance = 1;
+     */
+    conformance?: ConformanceWitness | undefined;
+};
+/**
+ * Describes the message quixos.orch.TryConformResponse.
+ * Use `create(TryConformResponseSchema)` to create a new message.
+ */
+export declare const TryConformResponseSchema: GenMessage<TryConformResponse>;
 /**
  * @generated from message quixos.orch.ConstructObjectRequest
  */
@@ -42,6 +117,46 @@ export type ConstructObjectResponse = Message<"quixos.orch.ConstructObjectRespon
  * Use `create(ConstructObjectResponseSchema)` to create a new message.
  */
 export declare const ConstructObjectResponseSchema: GenMessage<ConstructObjectResponse>;
+/**
+ * @generated from message quixos.orch.ResolveOrConstructRelatedObjectRequest
+ */
+export type ResolveOrConstructRelatedObjectRequest = Message<"quixos.orch.ResolveOrConstructRelatedObjectRequest"> & {
+    /**
+     * @generated from field: string object_id = 1;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string interface_revision_id = 2;
+     */
+    interfaceRevisionId: string;
+    /**
+     * @generated from field: string member_id = 3;
+     */
+    memberId: string;
+};
+/**
+ * Describes the message quixos.orch.ResolveOrConstructRelatedObjectRequest.
+ * Use `create(ResolveOrConstructRelatedObjectRequestSchema)` to create a new message.
+ */
+export declare const ResolveOrConstructRelatedObjectRequestSchema: GenMessage<ResolveOrConstructRelatedObjectRequest>;
+/**
+ * @generated from message quixos.orch.ResolveOrConstructRelatedObjectResponse
+ */
+export type ResolveOrConstructRelatedObjectResponse = Message<"quixos.orch.ResolveOrConstructRelatedObjectResponse"> & {
+    /**
+     * @generated from field: camino.CaminoObject object = 1;
+     */
+    object?: CaminoObject | undefined;
+    /**
+     * @generated from field: bool constructed = 2;
+     */
+    constructed: boolean;
+};
+/**
+ * Describes the message quixos.orch.ResolveOrConstructRelatedObjectResponse.
+ * Use `create(ResolveOrConstructRelatedObjectResponseSchema)` to create a new message.
+ */
+export declare const ResolveOrConstructRelatedObjectResponseSchema: GenMessage<ResolveOrConstructRelatedObjectResponse>;
 /**
  * @generated from message quixos.orch.InvokeCapabilityRequest
  */
@@ -60,12 +175,43 @@ export type InvokeCapabilityRequest = Message<"quixos.orch.InvokeCapabilityReque
     input: {
         [key: string]: Value;
     };
+    /**
+     * Identifies one logical client mutation across the capability and Camino
+     * layers so a live-value controller can recognize its own confirmation.
+     *
+     * @generated from field: string client_mutation_id = 4;
+     */
+    clientMutationId: string;
 };
 /**
  * Describes the message quixos.orch.InvokeCapabilityRequest.
  * Use `create(InvokeCapabilityRequestSchema)` to create a new message.
  */
 export declare const InvokeCapabilityRequestSchema: GenMessage<InvokeCapabilityRequest>;
+/**
+ * @generated from message quixos.orch.InvokeClassCapabilityRequest
+ */
+export type InvokeClassCapabilityRequest = Message<"quixos.orch.InvokeClassCapabilityRequest"> & {
+    /**
+     * @generated from field: string conformance_id = 1;
+     */
+    conformanceId: string;
+    /**
+     * @generated from field: string operation_id = 2;
+     */
+    operationId: string;
+    /**
+     * @generated from field: map<string, camino.Value> input = 3;
+     */
+    input: {
+        [key: string]: Value;
+    };
+};
+/**
+ * Describes the message quixos.orch.InvokeClassCapabilityRequest.
+ * Use `create(InvokeClassCapabilityRequestSchema)` to create a new message.
+ */
+export declare const InvokeClassCapabilityRequestSchema: GenMessage<InvokeClassCapabilityRequest>;
 /**
  * @generated from message quixos.orch.InvokeCapabilityResponse
  */
@@ -90,12 +236,71 @@ export type InvokeCapabilityResponse = Message<"quixos.orch.InvokeCapabilityResp
      * @generated from field: string error = 5;
      */
     error: string;
+    /**
+     * @generated from field: repeated quixos.runtime.DerivedDependency dependencies = 6;
+     */
+    dependencies: DerivedDependency[];
+    /**
+     * @generated from field: quixos.FieldEditing field_editing = 7;
+     */
+    fieldEditing?: FieldEditing | undefined;
 };
 /**
  * Describes the message quixos.orch.InvokeCapabilityResponse.
  * Use `create(InvokeCapabilityResponseSchema)` to create a new message.
  */
 export declare const InvokeCapabilityResponseSchema: GenMessage<InvokeCapabilityResponse>;
+/**
+ * @generated from message quixos.orch.EditCapabilityFieldRequest
+ */
+export type EditCapabilityFieldRequest = Message<"quixos.orch.EditCapabilityFieldRequest"> & {
+    /**
+     * The public getter; setter must belong to the same value member.
+     *
+     * @generated from field: quixos.CapabilityRef capability = 1;
+     */
+    capability?: CapabilityRef | undefined;
+    /**
+     * @generated from field: string object_id = 2;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string setter_operation_id = 3;
+     */
+    setterOperationId: string;
+    /**
+     * @generated from field: string binding_digest = 4;
+     */
+    bindingDigest: string;
+    /**
+     * @generated from oneof quixos.orch.EditCapabilityFieldRequest.edit
+     */
+    edit: {
+        /**
+         * @generated from field: camino.CrdtValue update = 5;
+         */
+        value: CrdtValue;
+        case: "update";
+    } | {
+        /**
+         * @generated from field: camino.Value replacement = 7;
+         */
+        value: Value;
+        case: "replacement";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+    /**
+     * @generated from field: string client_mutation_id = 6;
+     */
+    clientMutationId: string;
+};
+/**
+ * Describes the message quixos.orch.EditCapabilityFieldRequest.
+ * Use `create(EditCapabilityFieldRequestSchema)` to create a new message.
+ */
+export declare const EditCapabilityFieldRequestSchema: GenMessage<EditCapabilityFieldRequest>;
 /**
  * @generated from message quixos.orch.WatchCapabilityRequest
  */
@@ -152,6 +357,10 @@ export type WatchCapabilityEvent = Message<"quixos.orch.WatchCapabilityEvent"> &
      * @generated from field: bool initial = 7;
      */
     initial: boolean;
+    /**
+     * @generated from field: quixos.FieldEditing field_editing = 8;
+     */
+    fieldEditing?: FieldEditing | undefined;
 };
 /**
  * Describes the message quixos.orch.WatchCapabilityEvent.
@@ -161,7 +370,18 @@ export declare const WatchCapabilityEventSchema: GenMessage<WatchCapabilityEvent
 /**
  * @generated from message quixos.orch.GetWorkspaceRequest
  */
-export type GetWorkspaceRequest = Message<"quixos.orch.GetWorkspaceRequest"> & {};
+export type GetWorkspaceRequest = Message<"quixos.orch.GetWorkspaceRequest"> & {
+    /**
+     * Revision polling must not download the entire interface graph.
+     *
+     * @generated from field: bool include_interface_contracts = 1;
+     */
+    includeInterfaceContracts: boolean;
+    /**
+     * @generated from field: bool include_query_contracts = 2;
+     */
+    includeQueryContracts: boolean;
+};
 /**
  * Describes the message quixos.orch.GetWorkspaceRequest.
  * Use `create(GetWorkspaceRequestSchema)` to create a new message.
@@ -183,12 +403,165 @@ export type GetWorkspaceResponse = Message<"quixos.orch.GetWorkspaceResponse"> &
      * @generated from field: string source_root_commit = 3;
      */
     sourceRootCommit: string;
+    /**
+     * Checked constructors whose wire input can be empty. The create panel uses
+     * class factory conformances instead of this constructor inventory.
+     *
+     * @generated from field: repeated string empty_input_constructible_atom_ids = 4;
+     */
+    emptyInputConstructibleAtomIds: string[];
+    /**
+     * @generated from field: repeated quixos.orch.CapabilityInputContract capability_inputs = 5;
+     */
+    capabilityInputs: CapabilityInputContract[];
+    /**
+     * @generated from field: repeated quixos.orch.ConstructorInputContract constructor_inputs = 6;
+     */
+    constructorInputs: ConstructorInputContract[];
+    /**
+     * Exact closed interface contracts used by checked presentation consumers.
+     *
+     * @generated from field: string interfaces_json = 7;
+     */
+    interfacesJson: string;
+    /**
+     * @generated from field: repeated quixos.orch.ClassCapability class_capabilities = 8;
+     */
+    classCapabilities: ClassCapability[];
+    /**
+     * @generated from field: repeated quixos.orch.QueryDescription queries = 9;
+     */
+    queries: QueryDescription[];
+    /**
+     * @generated from field: uint32 active_query_executions = 10;
+     */
+    activeQueryExecutions: number;
 };
 /**
  * Describes the message quixos.orch.GetWorkspaceResponse.
  * Use `create(GetWorkspaceResponseSchema)` to create a new message.
  */
 export declare const GetWorkspaceResponseSchema: GenMessage<GetWorkspaceResponse>;
+/**
+ * @generated from message quixos.orch.QueryDescription
+ */
+export type QueryDescription = Message<"quixos.orch.QueryDescription"> & {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * @generated from field: string name = 2;
+     */
+    name: string;
+    /**
+     * @generated from field: string package_revision_id = 3;
+     */
+    packageRevisionId: string;
+    /**
+     * @generated from field: string document = 4;
+     */
+    document: string;
+    /**
+     * @generated from field: string schema = 5;
+     */
+    schema: string;
+    /**
+     * @generated from field: repeated string source_files = 6;
+     */
+    sourceFiles: string[];
+    /**
+     * @generated from field: string effects_json = 7;
+     */
+    effectsJson: string;
+    /**
+     * @generated from field: camino.InstalledQuery plan = 8;
+     */
+    plan?: InstalledQuery | undefined;
+};
+/**
+ * Describes the message quixos.orch.QueryDescription.
+ * Use `create(QueryDescriptionSchema)` to create a new message.
+ */
+export declare const QueryDescriptionSchema: GenMessage<QueryDescription>;
+/**
+ * @generated from message quixos.orch.ClassCapability
+ */
+export type ClassCapability = Message<"quixos.orch.ClassCapability"> & {
+    /**
+     * @generated from field: string conformance_id = 1;
+     */
+    conformanceId: string;
+    /**
+     * @generated from field: string atom_id = 2;
+     */
+    atomId: string;
+    /**
+     * @generated from field: string interface_revision_id = 3;
+     */
+    interfaceRevisionId: string;
+    /**
+     * @generated from field: string definition_id = 4;
+     */
+    definitionId: string;
+    /**
+     * @generated from field: string operation_id = 5;
+     */
+    operationId: string;
+    /**
+     * @generated from field: string input_type_json = 6;
+     */
+    inputTypeJson: string;
+    /**
+     * @generated from field: string output_type_json = 7;
+     */
+    outputTypeJson: string;
+};
+/**
+ * Describes the message quixos.orch.ClassCapability.
+ * Use `create(ClassCapabilitySchema)` to create a new message.
+ */
+export declare const ClassCapabilitySchema: GenMessage<ClassCapability>;
+/**
+ * @generated from message quixos.orch.CapabilityInputContract
+ */
+export type CapabilityInputContract = Message<"quixos.orch.CapabilityInputContract"> & {
+    /**
+     * @generated from field: string interface_revision_id = 1;
+     */
+    interfaceRevisionId: string;
+    /**
+     * @generated from field: string operation_id = 2;
+     */
+    operationId: string;
+    /**
+     * @generated from field: string type_json = 3;
+     */
+    typeJson: string;
+};
+/**
+ * Describes the message quixos.orch.CapabilityInputContract.
+ * Use `create(CapabilityInputContractSchema)` to create a new message.
+ */
+export declare const CapabilityInputContractSchema: GenMessage<CapabilityInputContract>;
+/**
+ * @generated from message quixos.orch.ConstructorInputContract
+ */
+export type ConstructorInputContract = Message<"quixos.orch.ConstructorInputContract"> & {
+    /**
+     * @generated from field: string atom_id = 1;
+     */
+    atomId: string;
+    /**
+     * @generated from field: string type_json = 2;
+     */
+    typeJson: string;
+};
+/**
+ * Describes the message quixos.orch.ConstructorInputContract.
+ * Use `create(ConstructorInputContractSchema)` to create a new message.
+ */
+export declare const ConstructorInputContractSchema: GenMessage<ConstructorInputContract>;
 /**
  * @generated from message quixos.orch.ListActivationsRequest
  */
@@ -402,6 +775,30 @@ export declare const PackageRuntimeStatusSchema: GenMessage<PackageRuntimeStatus
  * @generated from service quixos.orch.OrchestratorRuntime
  */
 export declare const OrchestratorRuntime: GenService<{
+    /**
+     * @generated from rpc quixos.orch.OrchestratorRuntime.ExecuteQuery
+     */
+    executeQuery: {
+        methodKind: "unary";
+        input: typeof QueryRequestSchema;
+        output: typeof QueryResponseSchema;
+    };
+    /**
+     * @generated from rpc quixos.orch.OrchestratorRuntime.WatchQuery
+     */
+    watchQuery: {
+        methodKind: "server_streaming";
+        input: typeof QueryRequestSchema;
+        output: typeof QueryEventSchema;
+    };
+    /**
+     * @generated from rpc quixos.orch.OrchestratorRuntime.TryConform
+     */
+    tryConform: {
+        methodKind: "unary";
+        input: typeof TryConformRequestSchema;
+        output: typeof TryConformResponseSchema;
+    };
     /**
      * @generated from rpc quixos.orch.OrchestratorRuntime.InvokeCapability
      */
@@ -410,6 +807,22 @@ export declare const OrchestratorRuntime: GenService<{
         input: typeof InvokeCapabilityRequestSchema;
         output: typeof InvokeCapabilityResponseSchema;
     };
+    /**
+     * @generated from rpc quixos.orch.OrchestratorRuntime.EditCapabilityField
+     */
+    editCapabilityField: {
+        methodKind: "unary";
+        input: typeof EditCapabilityFieldRequestSchema;
+        output: typeof InvokeCapabilityResponseSchema;
+    };
+    /**
+     * @generated from rpc quixos.orch.OrchestratorRuntime.InvokeClassCapability
+     */
+    invokeClassCapability: {
+        methodKind: "unary";
+        input: typeof InvokeClassCapabilityRequestSchema;
+        output: typeof InvokeCapabilityResponseSchema;
+    };
     /**
      * @generated from rpc quixos.orch.OrchestratorRuntime.WatchCapability
      */
@@ -426,6 +839,14 @@ export declare const OrchestratorRuntime: GenService<{
         input: typeof ConstructObjectRequestSchema;
         output: typeof ConstructObjectResponseSchema;
     };
+    /**
+     * @generated from rpc quixos.orch.OrchestratorRuntime.ResolveOrConstructRelatedObject
+     */
+    resolveOrConstructRelatedObject: {
+        methodKind: "unary";
+        input: typeof ResolveOrConstructRelatedObjectRequestSchema;
+        output: typeof ResolveOrConstructRelatedObjectResponseSchema;
+    };
     /**
      * @generated from rpc quixos.orch.OrchestratorRuntime.GetWorkspace
      */

dist/quixos/refs_pb.d.ts

@@ -1,4 +1,4 @@
-import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file quixos/refs.proto.
@@ -16,12 +16,101 @@ export type CapabilityRef = Message<"quixos.CapabilityRef"> & {
      * @generated from field: string operation_id = 2;
      */
     operationId: string;
+    /**
+     * Optional fence for a view acquired through TryConform. Not an authority grant.
+     *
+     * @generated from field: quixos.ConformanceWitness conformance = 3;
+     */
+    conformance?: ConformanceWitness | undefined;
 };
 /**
  * Describes the message quixos.CapabilityRef.
  * Use `create(CapabilityRefSchema)` to create a new message.
  */
 export declare const CapabilityRefSchema: GenMessage<CapabilityRef>;
+/**
+ * Resolved native editing semantics. A source snapshot alone grants no writer.
+ *
+ * @generated from message quixos.FieldEditing
+ */
+export type FieldEditing = Message<"quixos.FieldEditing"> & {
+    /**
+     * @generated from field: string getter_operation_id = 1;
+     */
+    getterOperationId: string;
+    /**
+     * @generated from field: string setter_operation_id = 2;
+     */
+    setterOperationId: string;
+    /**
+     * @generated from field: string document_type = 3;
+     */
+    documentType: string;
+    /**
+     * @generated from field: string binding_digest = 4;
+     */
+    bindingDigest: string;
+    /**
+     * @generated from field: quixos.FieldEditing.Mode mode = 5;
+     */
+    mode: FieldEditing_Mode;
+};
+/**
+ * Describes the message quixos.FieldEditing.
+ * Use `create(FieldEditingSchema)` to create a new message.
+ */
+export declare const FieldEditingSchema: GenMessage<FieldEditing>;
+/**
+ * @generated from enum quixos.FieldEditing.Mode
+ */
+export declare enum FieldEditing_Mode {
+    /**
+     * @generated from enum value: UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: REGISTER = 1;
+     */
+    REGISTER = 1,
+    /**
+     * @generated from enum value: CRDT = 2;
+     */
+    CRDT = 2
+}
+/**
+ * Describes the enum quixos.FieldEditing.Mode.
+ */
+export declare const FieldEditing_ModeSchema: GenEnum<FieldEditing_Mode>;
+/**
+ * @generated from message quixos.ConformanceWitness
+ */
+export type ConformanceWitness = Message<"quixos.ConformanceWitness"> & {
+    /**
+     * @generated from field: string object_id = 1;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string interface_revision_id = 2;
+     */
+    interfaceRevisionId: string;
+    /**
+     * @generated from field: string conformance_id = 3;
+     */
+    conformanceId: string;
+    /**
+     * @generated from field: string workspace_revision_id = 4;
+     */
+    workspaceRevisionId: string;
+    /**
+     * @generated from field: string workspace_epoch = 5;
+     */
+    workspaceEpoch: string;
+};
+/**
+ * Describes the message quixos.ConformanceWitness.
+ * Use `create(ConformanceWitnessSchema)` to create a new message.
+ */
+export declare const ConformanceWitnessSchema: GenMessage<ConformanceWitness>;
 /**
  * @generated from message quixos.PackageExportRef
  */
@@ -65,20 +154,33 @@ export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
         case: "edge";
     } | {
         /**
-         * @generated from field: string receiver_interface_revision_id = 4;
+         * @generated from field: string interface_revision_id = 4;
          */
         value: string;
-        case: "receiverInterfaceRevisionId";
+        case: "interfaceRevisionId";
     } | {
         /**
          * @generated from field: string constructor_atom_id = 5;
          */
         value: string;
         case: "constructorAtomId";
+    } | {
+        /**
+         * @generated from field: string query_id = 7;
+         */
+        value: string;
+        case: "queryId";
     } | {
         case: undefined;
         value?: undefined;
     };
+    /**
+     * Defaults to the invocation receiver. A checked dependency traversal can
+     * select a related object explicitly before the package runtime starts.
+     *
+     * @generated from field: string object_id = 6;
+     */
+    objectId: string;
 };
 /**
  * Describes the message quixos.InjectedDependency.

dist/quixos/refs_pb.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refs_pb.d.ts","sourceRoot":"","sources":["../../src/quixos/refs_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,OACsiB,CAAC;AAEtkB;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IAC5D;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,CAAC,aAAa,CACxB,CAAC;AAEnC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,yBAAyB,CAAC,GAAG;IAClE;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC9B,CAAC;AAEnC;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IACtE;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,OAAO,EAAE;QACP;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,aAAa,CAAC;KACrB,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,cAAc,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,6BAA6B,CAAC;KACrC,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,mBAAmB,CAAC;KAC3B,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,kBAAkB,CAClC,CAAC;AAEnC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAAG;IAC9D;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CAC1B,CAAC"}
+{"version":3,"file":"refs_pb.d.ts","sourceRoot":"","sources":["../../src/quixos/refs_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,OACsnC,CAAC;AAEtpC;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IAC5D;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC9C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,CAAC,aAAa,CACxB,CAAC;AAEnC;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG;IAC1D;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,IAAI,EAAE,iBAAiB,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,YAAY,CACtB,CAAC;AAEnC;;GAEG;AACH,oBAAY,iBAAiB;IAC3B;;OAEG;IACH,WAAW,IAAI;IAEf;;OAEG;IACH,QAAQ,IAAI;IAEZ;;OAEG;IACH,IAAI,IAAI;CACT;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,CAAC,iBAAiB,CAC7B,CAAC;AAEnC;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IACtE;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,kBAAkB,CAClC,CAAC;AAEnC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,yBAAyB,CAAC,GAAG;IAClE;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC9B,CAAC;AAEnC;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IACtE;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,OAAO,EAAE;QACP;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,aAAa,CAAC;KACrB,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,cAAc,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,qBAAqB,CAAC;KAC7B,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,mBAAmB,CAAC;KAC3B,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,SAAS,CAAC;KACjB,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAE3C;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,kBAAkB,CAClC,CAAC;AAEnC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAAG;IAC9D;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CAC1B,CAAC"}

dist/quixos/refs_pb.js

@@ -1,28 +1,60 @@
 // @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/refs.proto (package quixos, syntax proto3)
 /* eslint-disable */
-import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 /**
  * Describes the file quixos/refs.proto.
  */
-export const file_quixos_refs = /*@__PURE__*/ fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zIkQKDUNhcGFiaWxpdHlSZWYSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAEgASgJEhQKDG9wZXJhdGlvbl9pZBgCIAEoCSJCChBQYWNrYWdlRXhwb3J0UmVmEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSEQoJZXhwb3J0X2lkGAIgASgJIroBChJJbmplY3RlZERlcGVuZGVuY3kSDwoHcG9ydF9pZBgBIAEoCRIXCg1zdGF0ZV9zbG90X2lkGAIgASgJSAASJgoEZWRnZRgDIAEoCzIWLnF1aXhvcy5FZGdlRGVwZW5kZW5jeUgAEigKHnJlY2VpdmVyX2ludGVyZmFjZV9yZXZpc2lvbl9pZBgEIAEoCUgAEh0KE2NvbnN0cnVjdG9yX2F0b21faWQYBSABKAlIAEIJCgdiaW5kaW5nIj0KDkVkZ2VEZXBlbmRlbmN5EhQKDGVkZ2VfdHlwZV9pZBgBIAEoCRIVCg1wcm9qZWN0aW9uX2lkGAIgASgJYgZwcm90bzM");
+export const file_quixos_refs = /*@__PURE__*/ fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zInUKDUNhcGFiaWxpdHlSZWYSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAEgASgJEhQKDG9wZXJhdGlvbl9pZBgCIAEoCRIvCgtjb25mb3JtYW5jZRgDIAEoCzIaLnF1aXhvcy5Db25mb3JtYW5jZVdpdG5lc3Mi0QEKDEZpZWxkRWRpdGluZxIbChNnZXR0ZXJfb3BlcmF0aW9uX2lkGAEgASgJEhsKE3NldHRlcl9vcGVyYXRpb25faWQYAiABKAkSFQoNZG9jdW1lbnRfdHlwZRgDIAEoCRIWCg5iaW5kaW5nX2RpZ2VzdBgEIAEoCRInCgRtb2RlGAUgASgOMhkucXVpeG9zLkZpZWxkRWRpdGluZy5Nb2RlIi8KBE1vZGUSDwoLVU5TUEVDSUZJRUQQABIMCghSRUdJU1RFUhABEggKBENSRFQQAiKWAQoSQ29uZm9ybWFuY2VXaXRuZXNzEhEKCW9iamVjdF9pZBgBIAEoCRIdChVpbnRlcmZhY2VfcmV2aXNpb25faWQYAiABKAkSFgoOY29uZm9ybWFuY2VfaWQYAyABKAkSHQoVd29ya3NwYWNlX3JldmlzaW9uX2lkGAQgASgJEhcKD3dvcmtzcGFjZV9lcG9jaBgFIAEoCSJCChBQYWNrYWdlRXhwb3J0UmVmEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSEQoJZXhwb3J0X2lkGAIgASgJItgBChJJbmplY3RlZERlcGVuZGVuY3kSDwoHcG9ydF9pZBgBIAEoCRIXCg1zdGF0ZV9zbG90X2lkGAIgASgJSAASJgoEZWRnZRgDIAEoCzIWLnF1aXhvcy5FZGdlRGVwZW5kZW5jeUgAEh8KFWludGVyZmFjZV9yZXZpc2lvbl9pZBgEIAEoCUgAEh0KE2NvbnN0cnVjdG9yX2F0b21faWQYBSABKAlIABISCghxdWVyeV9pZBgHIAEoCUgAEhEKCW9iamVjdF9pZBgGIAEoCUIJCgdiaW5kaW5nIj0KDkVkZ2VEZXBlbmRlbmN5EhQKDGVkZ2VfdHlwZV9pZBgBIAEoCRIVCg1wcm9qZWN0aW9uX2lkGAIgASgJYgZwcm90bzM");
 /**
  * Describes the message quixos.CapabilityRef.
  * Use `create(CapabilityRefSchema)` to create a new message.
  */
 export const CapabilityRefSchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 0);
+/**
+ * Describes the message quixos.FieldEditing.
+ * Use `create(FieldEditingSchema)` to create a new message.
+ */
+export const FieldEditingSchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 1);
+/**
+ * @generated from enum quixos.FieldEditing.Mode
+ */
+export var FieldEditing_Mode;
+(function (FieldEditing_Mode) {
+    /**
+     * @generated from enum value: UNSPECIFIED = 0;
+     */
+    FieldEditing_Mode[FieldEditing_Mode["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * @generated from enum value: REGISTER = 1;
+     */
+    FieldEditing_Mode[FieldEditing_Mode["REGISTER"] = 1] = "REGISTER";
+    /**
+     * @generated from enum value: CRDT = 2;
+     */
+    FieldEditing_Mode[FieldEditing_Mode["CRDT"] = 2] = "CRDT";
+})(FieldEditing_Mode || (FieldEditing_Mode = {}));
+/**
+ * Describes the enum quixos.FieldEditing.Mode.
+ */
+export const FieldEditing_ModeSchema = /*@__PURE__*/ enumDesc(file_quixos_refs, 1, 0);
+/**
+ * Describes the message quixos.ConformanceWitness.
+ * Use `create(ConformanceWitnessSchema)` to create a new message.
+ */
+export const ConformanceWitnessSchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 2);
 /**
  * Describes the message quixos.PackageExportRef.
  * Use `create(PackageExportRefSchema)` to create a new message.
  */
-export const PackageExportRefSchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 1);
+export const PackageExportRefSchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 3);
 /**
  * Describes the message quixos.InjectedDependency.
  * Use `create(InjectedDependencySchema)` to create a new message.
  */
-export const InjectedDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 2);
+export const InjectedDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 4);
 /**
  * Describes the message quixos.EdgeDependency.
  * Use `create(EdgeDependencySchema)` to create a new message.
  */
-export const EdgeDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 3);
+export const EdgeDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_refs, 5);

dist/quixos/runtime_pb.d.ts

@@ -14,6 +14,10 @@ export type HandshakeRequest = Message<"quixos.runtime.HandshakeRequest"> & {
      * @generated from field: string orch_protocol_version = 1;
      */
     orchProtocolVersion: string;
+    /**
+     * @generated from field: string nonce = 2;
+     */
+    nonce: string;
 };
 /**
  * Describes the message quixos.runtime.HandshakeRequest.
@@ -36,12 +40,94 @@ export type HandshakeResponse = Message<"quixos.runtime.HandshakeResponse"> & {
      * @generated from field: repeated string export_ids = 3;
      */
     exportIds: string[];
+    /**
+     * @generated from field: string instance_id = 4;
+     */
+    instanceId: string;
+    /**
+     * @generated from field: string authentication_proof = 5;
+     */
+    authenticationProof: string;
+    /**
+     * @generated from field: repeated string capabilities = 6;
+     */
+    capabilities: string[];
 };
 /**
  * Describes the message quixos.runtime.HandshakeResponse.
  * Use `create(HandshakeResponseSchema)` to create a new message.
  */
 export declare const HandshakeResponseSchema: GenMessage<HandshakeResponse>;
+/**
+ * @generated from message quixos.runtime.InvocationContext
+ */
+export type InvocationContext = Message<"quixos.runtime.InvocationContext"> & {
+    /**
+     * @generated from field: string workspace_epoch = 1;
+     */
+    workspaceEpoch: string;
+    /**
+     * @generated from field: string instance_id = 2;
+     */
+    instanceId: string;
+    /**
+     * @generated from field: string binding_digest = 3;
+     */
+    bindingDigest: string;
+    /**
+     * @generated from field: string grant = 4;
+     */
+    grant: string;
+    /**
+     * @generated from field: string session_id = 5;
+     */
+    sessionId: string;
+    /**
+     * Host-selected owner; packages must not invent workspace-local ownership.
+     *
+     * @generated from field: string owner_conformance_id = 6;
+     */
+    ownerConformanceId: string;
+};
+/**
+ * Describes the message quixos.runtime.InvocationContext.
+ * Use `create(InvocationContextSchema)` to create a new message.
+ */
+export declare const InvocationContextSchema: GenMessage<InvocationContext>;
+/**
+ * @generated from message quixos.runtime.InvocationControlRequest
+ */
+export type InvocationControlRequest = Message<"quixos.runtime.InvocationControlRequest"> & {
+    /**
+     * @generated from field: string invocation_id = 1;
+     */
+    invocationId: string;
+};
+/**
+ * Describes the message quixos.runtime.InvocationControlRequest.
+ * Use `create(InvocationControlRequestSchema)` to create a new message.
+ */
+export declare const InvocationControlRequestSchema: GenMessage<InvocationControlRequest>;
+/**
+ * @generated from message quixos.runtime.InvocationStatus
+ */
+export type InvocationStatus = Message<"quixos.runtime.InvocationStatus"> & {
+    /**
+     * @generated from field: string invocation_id = 1;
+     */
+    invocationId: string;
+    /**
+     * unknown, running, cancellation-requested, completed, failed
+     *
+     * @generated from field: string state = 2;
+     */
+    state: string;
+};
+/**
+ * Describes the message quixos.runtime.InvocationStatus.
+ * Use `create(InvocationStatusSchema)` to create a new message.
+ */
+export declare const InvocationStatusSchema: GenMessage<InvocationStatus>;
 /**
  * @generated from message quixos.runtime.InvokeRequest
  */
@@ -68,6 +154,10 @@ export type InvokeRequest = Message<"quixos.runtime.InvokeRequest"> & {
      * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
      */
     dependencies: InjectedDependency[];
+    /**
+     * @generated from field: quixos.runtime.InvocationContext context = 6;
+     */
+    context?: InvocationContext | undefined;
 };
 /**
  * Describes the message quixos.runtime.InvokeRequest.
@@ -90,6 +180,10 @@ export type InvokeResponse = Message<"quixos.runtime.InvokeResponse"> & {
      * @generated from field: string error = 3;
      */
     error: string;
+    /**
+     * @generated from field: repeated quixos.runtime.DerivedDependency dependencies = 4;
+     */
+    dependencies: DerivedDependency[];
 };
 /**
  * Describes the message quixos.runtime.InvokeResponse.
@@ -122,6 +216,10 @@ export type WatchRequest = Message<"quixos.runtime.WatchRequest"> & {
      * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
      */
     dependencies: InjectedDependency[];
+    /**
+     * @generated from field: quixos.runtime.InvocationContext context = 6;
+     */
+    context?: InvocationContext | undefined;
 };
 /**
  * Describes the message quixos.runtime.WatchRequest.
@@ -212,5 +310,21 @@ export declare const PackageRuntime: GenService<{
         input: typeof WatchRequestSchema;
         output: typeof WatchEventSchema;
     };
+    /**
+     * @generated from rpc quixos.runtime.PackageRuntime.GetInvocationStatus
+     */
+    getInvocationStatus: {
+        methodKind: "unary";
+        input: typeof InvocationControlRequestSchema;
+        output: typeof InvocationStatusSchema;
+    };
+    /**
+     * @generated from rpc quixos.runtime.PackageRuntime.CancelInvocation
+     */
+    cancelInvocation: {
+        methodKind: "unary";
+        input: typeof InvocationControlRequestSchema;
+        output: typeof InvocationStatusSchema;
+    };
 }>;
 //# sourceMappingURL=runtime_pb.d.ts.map

dist/quixos/runtime_pb.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime_pb.d.ts","sourceRoot":"","sources":["../../src/quixos/runtime_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAEpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,OACouD,CAAC;AAEvwD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,iCAAiC,CAAC,GAAG;IAC1E;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC3B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG;IACpE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,CAAC,aAAa,CACrB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,+BAA+B,CAAC,GAAG;IACtE;;OAEG;IACH,EAAE,EAAE,OAAO,CAAC;IAEZ;;OAEG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACvB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC,GAAG;IAClE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,YAAY,CACnB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IAC9D;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE1B;;OAEG;IACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAElC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,UAAU,CACf,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC;IACtC;;OAEG;IACH,SAAS,EAAE;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,sBAAsB,CAAC;QACrC,MAAM,EAAE,OAAO,uBAAuB,CAAC;KACxC,CAAC;IACF;;OAEG;IACH,MAAM,EAAE;QACN,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,mBAAmB,CAAC;QAClC,MAAM,EAAE,OAAO,oBAAoB,CAAC;KACrC,CAAC;IACF;;OAEG;IACH,KAAK,EAAE;QACL,UAAU,EAAE,kBAAkB,CAAC;QAC/B,KAAK,EAAE,OAAO,kBAAkB,CAAC;QACjC,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,CAAC;CACH,CACoC,CAAC"}
+{"version":3,"file":"runtime_pb.d.ts","sourceRoot":"","sources":["../../src/quixos/runtime_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAEpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,OACypF,CAAC;AAE5rF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,iCAAiC,CAAC,GAAG;IAC1E;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC3B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,yCAAyC,CAAC,GAAG;IAC1F;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,UAAU,CAAC,wBAAwB,CAC3C,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,iCAAiC,CAAC,GAAG;IAC1E;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC3B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG;IACpE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEnC;;OAEG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,CAAC,aAAa,CACrB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,+BAA+B,CAAC,GAAG;IACtE;;OAEG;IACH,EAAE,EAAE,OAAO,CAAC;IAEZ;;OAEG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACvB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC,GAAG;IAClE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEnC;;OAEG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,YAAY,CACnB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IAC9D;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE1B;;OAEG;IACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAElC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,UAAU,CACf,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC;IACtC;;OAEG;IACH,SAAS,EAAE;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,sBAAsB,CAAC;QACrC,MAAM,EAAE,OAAO,uBAAuB,CAAC;KACxC,CAAC;IACF;;OAEG;IACH,MAAM,EAAE;QACN,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,mBAAmB,CAAC;QAClC,MAAM,EAAE,OAAO,oBAAoB,CAAC;KACrC,CAAC;IACF;;OAEG;IACH,KAAK,EAAE;QACL,UAAU,EAAE,kBAAkB,CAAC;QAC/B,KAAK,EAAE,OAAO,kBAAkB,CAAC;QACjC,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,CAAC;IACF;;OAEG;IACH,mBAAmB,EAAE;QACnB,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,8BAA8B,CAAC;QAC7C,MAAM,EAAE,OAAO,sBAAsB,CAAC;KACvC,CAAC;IACF;;OAEG;IACH,gBAAgB,EAAE;QAChB,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,8BAA8B,CAAC;QAC7C,MAAM,EAAE,OAAO,sBAAsB,CAAC;KACvC,CAAC;CACH,CACoC,CAAC"}

dist/quixos/runtime_pb.js

@@ -7,7 +7,7 @@ import { file_quixos_refs } from "./refs_pb.js";
 /**
  * Describes the file quixos/runtime.proto.
  */
-export const file_quixos_runtime = /*@__PURE__*/ fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiMQoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkiZgoRSGFuZHNoYWtlUmVzcG9uc2USGwoTcGFja2FnZV9yZXZpc2lvbl9pZBgBIAEoCRIgChhydW50aW1lX3Byb3RvY29sX3ZlcnNpb24YAiABKAkSEgoKZXhwb3J0X2lkcxgDIAMoCSKLAgoNSW52b2tlUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI3CgVpbnB1dBgEIAMoCzIoLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QuSW5wdXRFbnRyeRIwCgxkZXBlbmRlbmNpZXMYBSADKAsyGi5xdWl4b3MuSW5qZWN0ZWREZXBlbmRlbmN5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJKCg5JbnZva2VSZXNwb25zZRIKCgJvaxgBIAEoCBIdCgZyZXN1bHQYAiABKAsyDS5jYW1pbm8uVmFsdWUSDQoFZXJyb3IYAyABKAkiiQIKDFdhdGNoUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI2CgVpbnB1dBgEIAMoCzInLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdC5JbnB1dEVudHJ5EjAKDGRlcGVuZGVuY2llcxgFIAMoCzIaLnF1aXhvcy5JbmplY3RlZERlcGVuZGVuY3kaOwoKSW5wdXRFbnRyeRILCgNrZXkYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWU6AjgBImIKEURlcml2ZWREZXBlbmRlbmN5EgwKBGtpbmQYASABKAkSEQoJb2JqZWN0X2lkGAIgASgJEhUKDWF0dGFjaG1lbnRfaWQYAyABKAkSFQoNcHJvamVjdGlvbl9pZBgEIAEoCSKVAQoKV2F0Y2hFdmVudBIQCgh3YXRjaF9pZBgBIAEoCRIcCgV2YWx1ZRgCIAEoCzINLmNhbWluby5WYWx1ZRI3CgxkZXBlbmRlbmNpZXMYAyADKAsyIS5xdWl4b3MucnVudGltZS5EZXJpdmVkRGVwZW5kZW5jeRINCgVlcnJvchgEIAEoCRIPCgdpbml0aWFsGAUgASgIMvABCg5QYWNrYWdlUnVudGltZRJQCglIYW5kc2hha2USIC5xdWl4b3MucnVudGltZS5IYW5kc2hha2VSZXF1ZXN0GiEucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVzcG9uc2USRwoGSW52b2tlEh0ucXVpeG9zLnJ1bnRpbWUuSW52b2tlUmVxdWVzdBoeLnF1aXhvcy5ydW50aW1lLkludm9rZVJlc3BvbnNlEkMKBVdhdGNoEhwucXVpeG9zLnJ1bnRpbWUuV2F0Y2hSZXF1ZXN0GhoucXVpeG9zLnJ1bnRpbWUuV2F0Y2hFdmVudDABYgZwcm90bzM", [file_camino_api, file_quixos_refs]);
+export const file_quixos_runtime = /*@__PURE__*/ fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiQAoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkSDQoFbm9uY2UYAiABKAkirwEKEUhhbmRzaGFrZVJlc3BvbnNlEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSIAoYcnVudGltZV9wcm90b2NvbF92ZXJzaW9uGAIgASgJEhIKCmV4cG9ydF9pZHMYAyADKAkSEwoLaW5zdGFuY2VfaWQYBCABKAkSHAoUYXV0aGVudGljYXRpb25fcHJvb2YYBSABKAkSFAoMY2FwYWJpbGl0aWVzGAYgAygJIpoBChFJbnZvY2F0aW9uQ29udGV4dBIXCg93b3Jrc3BhY2VfZXBvY2gYASABKAkSEwoLaW5zdGFuY2VfaWQYAiABKAkSFgoOYmluZGluZ19kaWdlc3QYAyABKAkSDQoFZ3JhbnQYBCABKAkSEgoKc2Vzc2lvbl9pZBgFIAEoCRIcChRvd25lcl9jb25mb3JtYW5jZV9pZBgGIAEoCSIxChhJbnZvY2F0aW9uQ29udHJvbFJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCSI4ChBJbnZvY2F0aW9uU3RhdHVzEhUKDWludm9jYXRpb25faWQYASABKAkSDQoFc3RhdGUYAiABKAkivwIKDUludm9rZVJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCRIoCgZleHBvcnQYAiABKAsyGC5xdWl4b3MuUGFja2FnZUV4cG9ydFJlZhIRCglvYmplY3RfaWQYAyABKAkSNwoFaW5wdXQYBCADKAsyKC5xdWl4b3MucnVudGltZS5JbnZva2VSZXF1ZXN0LklucHV0RW50cnkSMAoMZGVwZW5kZW5jaWVzGAUgAygLMhoucXVpeG9zLkluamVjdGVkRGVwZW5kZW5jeRIyCgdjb250ZXh0GAYgASgLMiEucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRleHQaOwoKSW5wdXRFbnRyeRILCgNrZXkYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWU6AjgBIoMBCg5JbnZva2VSZXNwb25zZRIKCgJvaxgBIAEoCBIdCgZyZXN1bHQYAiABKAsyDS5jYW1pbm8uVmFsdWUSDQoFZXJyb3IYAyABKAkSNwoMZGVwZW5kZW5jaWVzGAQgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kivQIKDFdhdGNoUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI2CgVpbnB1dBgEIAMoCzInLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdC5JbnB1dEVudHJ5EjAKDGRlcGVuZGVuY2llcxgFIAMoCzIaLnF1aXhvcy5JbmplY3RlZERlcGVuZGVuY3kSMgoHY29udGV4dBgGIAEoCzIhLnF1aXhvcy5ydW50aW1lLkludm9jYXRpb25Db250ZXh0GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJiChFEZXJpdmVkRGVwZW5kZW5jeRIMCgRraW5kGAEgASgJEhEKCW9iamVjdF9pZBgCIAEoCRIVCg1hdHRhY2htZW50X2lkGAMgASgJEhUKDXByb2plY3Rpb25faWQYBCABKAkilQEKCldhdGNoRXZlbnQSEAoId2F0Y2hfaWQYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWUSNwoMZGVwZW5kZW5jaWVzGAMgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kSDQoFZXJyb3IYBCABKAkSDwoHaW5pdGlhbBgFIAEoCDKzAwoOUGFja2FnZVJ1bnRpbWUSUAoJSGFuZHNoYWtlEiAucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVxdWVzdBohLnF1aXhvcy5ydW50aW1lLkhhbmRzaGFrZVJlc3BvbnNlEkcKBkludm9rZRIdLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QaHi5xdWl4b3MucnVudGltZS5JbnZva2VSZXNwb25zZRJDCgVXYXRjaBIcLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdBoaLnF1aXhvcy5ydW50aW1lLldhdGNoRXZlbnQwARJhChNHZXRJbnZvY2F0aW9uU3RhdHVzEigucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRyb2xSZXF1ZXN0GiAucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvblN0YXR1cxJeChBDYW5jZWxJbnZvY2F0aW9uEigucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRyb2xSZXF1ZXN0GiAucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvblN0YXR1c2IGcHJvdG8z", [file_camino_api, file_quixos_refs]);
 /**
  * Describes the message quixos.runtime.HandshakeRequest.
  * Use `create(HandshakeRequestSchema)` to create a new message.
@@ -18,31 +18,46 @@ export const HandshakeRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runt
  * Use `create(HandshakeResponseSchema)` to create a new message.
  */
 export const HandshakeResponseSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 1);
+/**
+ * Describes the message quixos.runtime.InvocationContext.
+ * Use `create(InvocationContextSchema)` to create a new message.
+ */
+export const InvocationContextSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 2);
+/**
+ * Describes the message quixos.runtime.InvocationControlRequest.
+ * Use `create(InvocationControlRequestSchema)` to create a new message.
+ */
+export const InvocationControlRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 3);
+/**
+ * Describes the message quixos.runtime.InvocationStatus.
+ * Use `create(InvocationStatusSchema)` to create a new message.
+ */
+export const InvocationStatusSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 4);
 /**
  * Describes the message quixos.runtime.InvokeRequest.
  * Use `create(InvokeRequestSchema)` to create a new message.
  */
-export const InvokeRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 2);
+export const InvokeRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 5);
 /**
  * Describes the message quixos.runtime.InvokeResponse.
  * Use `create(InvokeResponseSchema)` to create a new message.
  */
-export const InvokeResponseSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 3);
+export const InvokeResponseSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 6);
 /**
  * Describes the message quixos.runtime.WatchRequest.
  * Use `create(WatchRequestSchema)` to create a new message.
  */
-export const WatchRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 4);
+export const WatchRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 7);
 /**
  * Describes the message quixos.runtime.DerivedDependency.
  * Use `create(DerivedDependencySchema)` to create a new message.
  */
-export const DerivedDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 5);
+export const DerivedDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 8);
 /**
  * Describes the message quixos.runtime.WatchEvent.
  * Use `create(WatchEventSchema)` to create a new message.
  */
-export const WatchEventSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 6);
+export const WatchEventSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 9);
 /**
  * @generated from service quixos.runtime.PackageRuntime
  */

dist/references.d.ts

@@ -0,0 +1,14 @@
+declare const referenceBrand: unique symbol;
+export interface QxObjectRef<Identity extends string = string> {
+    readonly [referenceBrand]: {
+        readonly [K in Identity]: true;
+    };
+    equals(other: QxObjectRef<string>): boolean;
+}
+export declare const isObjectReference: (value: unknown) => value is QxObjectRef;
+/** Internal transport boundary; intentionally not exported from the SDK entry. */
+export declare const referenceFromWire: (id: string) => QxObjectRef;
+export declare const referenceToWire: (value: unknown) => string;
+export declare const assertReferenceFree: (value: unknown, seen?: Set<object>) => void;
+export {};
+//# sourceMappingURL=references.d.ts.map

dist/references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../src/references.ts"],"names":[],"mappings":"AAGA,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAC5C,MAAM,WAAW,WAAW,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM;IAC3D,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,QAAQ,GAAG,IAAI;KAAE,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;CAC7C;AAmBD,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,KAAK,IAAI,WACU,CAAC;AAEvE,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,OAAQ,MAAM,KAAG,WAG9C,CAAC;AACF,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,MAGhD,CAAC;AACF,eAAO,MAAM,mBAAmB,UAAW,OAAO,yBAA6B,IAU9E,CAAC"}

dist/references.js

@@ -0,0 +1,46 @@
+/** Opaque runtime identity. The wire codec, never ordinary package state, owns
+ * the raw ID. These handles do not themselves confer authority or a lease. */
+const identities = new WeakMap();
+class Reference {
+    constructor(id) {
+        identities.set(this, id);
+        Object.freeze(this);
+    }
+    equals(other) {
+        return isObjectReference(other) && identities.get(this) === identities.get(other);
+    }
+    toJSON() {
+        throw new Error("Object references cannot be serialized into ordinary data");
+    }
+    toString() {
+        throw new Error("Object references cannot be coerced to strings");
+    }
+    [Symbol.toPrimitive]() {
+        throw new Error("Object references cannot be coerced to scalar values");
+    }
+}
+export const isObjectReference = (value) => typeof value === "object" && value !== null && identities.has(value);
+/** Internal transport boundary; intentionally not exported from the SDK entry. */
+export const referenceFromWire = (id) => {
+    if (typeof id !== "string" || !id)
+        throw new Error("Missing object reference identity");
+    return new Reference(id);
+};
+export const referenceToWire = (value) => {
+    if (!isObjectReference(value))
+        throw new Error("Expected an opaque object reference, not a raw ID");
+    return identities.get(value);
+};
+export const assertReferenceFree = (value, seen = new Set()) => {
+    if (!value || typeof value !== "object")
+        return;
+    if (isObjectReference(value))
+        throw new Error("Managed references belong in declared RPC references or graph relationships, not ordinary state/messages");
+    if (seen.has(value))
+        throw new Error("Cyclic ordinary data");
+    seen.add(value);
+    if (!(value instanceof Uint8Array))
+        for (const child of Object.values(value))
+            assertReferenceFree(child, seen);
+    seen.delete(value);
+};

dist/relationships.d.ts

@@ -0,0 +1,30 @@
+import type { QxObjectRef } from "./references.js";
+import type { RelationshipCollection, RelationshipEntry } from "./index.js";
+type Key = string | boolean | bigint;
+type Port<T extends QxObjectRef> = {
+    collection(): Promise<RelationshipCollection<T>>;
+    replace(entries: RelationshipEntry<T>[], expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+/** Helpers never retry a failed CAS or silently overwrite concurrent edits. */
+export declare const relationshipMap: <T extends QxObjectRef, K extends Key = Key>(port: Port<T>) => {
+    read: () => Promise<RelationshipCollection<T>>;
+    get(key: K): Promise<{
+        revision: bigint;
+        value: T | undefined;
+    }>;
+    set(key: K, target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    delete(key: K, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+export declare const relationshipList: <T extends QxObjectRef>(port: Port<T>) => {
+    read: () => Promise<RelationshipCollection<T>>;
+    insert(index: number, target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    move(edgeId: string, index: number, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    delete(edgeId: string, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+export declare const relationshipSet: <T extends QxObjectRef>(port: Port<T>) => {
+    read: () => Promise<RelationshipCollection<T>>;
+    add(target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    delete(target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+export {};
+//# sourceMappingURL=relationships.d.ts.map

dist/relationships.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationships.d.ts","sourceRoot":"","sources":["../src/relationships.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC5E,KAAK,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AACrC,KAAK,IAAI,CAAC,CAAC,SAAS,WAAW,IAAI;IACjC,UAAU,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CACxG,CAAC;AAMF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,GAAG,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI;IACE,GAAG,MAAM,CAAC;;;;IAIV,GAAG,MAAM,CAAC,UAAU,CAAC,oBAAoB,MAAM;IAO/C,MAAM,MAAM,CAAC,oBAAoB,MAAM;CAO7C,CAAC;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,WAAW,QAAQ,IAAI,CAAC,CAAC,CAAC;IACnE,IAAI;IACE,MAAM,QAAQ,MAAM,UAAU,CAAC,oBAAoB,MAAM;IAOzD,IAAI,SAAS,MAAM,SAAS,MAAM,oBAAoB,MAAM;IAS5D,MAAM,SAAS,MAAM,oBAAoB,MAAM;CAQrD,CAAC;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,WAAW,QAAQ,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI;IACE,GAAG,SAAS,CAAC,oBAAoB,MAAM;IAKvC,MAAM,SAAS,CAAC,oBAAoB,MAAM;CAOhD,CAAC"}

dist/relationships.js

@@ -0,0 +1,63 @@
+const checked = async (port, revision) => {
+    const snapshot = await port.collection();
+    if (snapshot.revision !== revision)
+        throw new Error("STALE_COLLECTION_REVISION");
+    return snapshot;
+};
+/** Helpers never retry a failed CAS or silently overwrite concurrent edits. */
+export const relationshipMap = (port) => ({
+    read: () => port.collection(),
+    async get(key) {
+        const snapshot = await port.collection();
+        return { revision: snapshot.revision, value: snapshot.entries.find((entry) => entry.key === key)?.target };
+    },
+    async set(key, target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        const entries = snapshot.entries.filter((entry) => entry.key !== key);
+        const existing = snapshot.entries.find((entry) => entry.key === key && entry.target.equals(target));
+        entries.push(existing ?? { key, target });
+        return port.replace(entries, expectedRevision);
+    },
+    async delete(key, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        return port.replace(snapshot.entries.filter((entry) => entry.key !== key), expectedRevision);
+    },
+});
+export const relationshipList = (port) => ({
+    read: () => port.collection(),
+    async insert(index, target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        if (!Number.isSafeInteger(index) || index < 0 || index > snapshot.entries.length)
+            throw new Error("List index out of bounds");
+        snapshot.entries.splice(index, 0, { target });
+        return port.replace(snapshot.entries, expectedRevision);
+    },
+    async move(edgeId, index, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        const prior = snapshot.entries.findIndex((entry) => entry.edgeId === edgeId);
+        if (prior < 0 || !Number.isSafeInteger(index) || index < 0 || index >= snapshot.entries.length)
+            throw new Error("Unknown list entry or invalid index");
+        const [entry] = snapshot.entries.splice(prior, 1);
+        snapshot.entries.splice(index, 0, entry);
+        return port.replace(snapshot.entries, expectedRevision);
+    },
+    async delete(edgeId, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        if (!snapshot.entries.some((entry) => entry.edgeId === edgeId))
+            throw new Error("Unknown list entry");
+        return port.replace(snapshot.entries.filter((entry) => entry.edgeId !== edgeId), expectedRevision);
+    },
+});
+export const relationshipSet = (port) => ({
+    read: () => port.collection(),
+    async add(target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        if (snapshot.entries.some((entry) => entry.target.equals(target)))
+            return snapshot;
+        return port.replace([...snapshot.entries, { target }], expectedRevision);
+    },
+    async delete(target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        return port.replace(snapshot.entries.filter((entry) => !entry.target.equals(target)), expectedRevision);
+    },
+});

flake.lock

@@ -74,17 +74,17 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1788542526,
+        "lastModified": 1789723189,
-        "narHash": "sha256-NaEdW9HKjRpOhZ8TBs6ieD/YuJ2jDyLPVk076wk6Kzs=",
+        "narHash": "sha256-IsiBSkuu/d2IgASVi4S1ZdKk1mTglS+HMJWrNYQohJM=",
-        "ref": "refs/tags/quixos-reachability/27373d801b31fbced51cc33bc2a9c92499a46ba3",
+        "ref": "refs/tags/quixos-reachability/b0d31ba51c4c1c49ec2ba715c99e5f5327505d01",
-        "rev": "27373d801b31fbced51cc33bc2a9c92499a46ba3",
+        "rev": "b0d31ba51c4c1c49ec2ba715c99e5f5327505d01",
-        "revCount": 28,
+        "revCount": 92,
         "type": "git",
         "url": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"
       },
       "original": {
-        "ref": "refs/tags/quixos-reachability/27373d801b31fbced51cc33bc2a9c92499a46ba3",
+        "ref": "refs/tags/quixos-reachability/b0d31ba51c4c1c49ec2ba715c99e5f5327505d01",
-        "rev": "27373d801b31fbced51cc33bc2a9c92499a46ba3",
+        "rev": "b0d31ba51c4c1c49ec2ba715c99e5f5327505d01",
         "type": "git",
         "url": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"
       }
@@ -92,17 +92,17 @@
     "quixosNixHelpers": {
       "flake": false,
       "locked": {
-        "lastModified": 1788543053,
+        "lastModified": 1788574090,
-        "narHash": "sha256-3YReATWEVxZinYVi/l3cwOz+oFoZUrwj24kUBQTmUpQ=",
+        "narHash": "sha256-bSgc0LS2Ub01fnE14VqazdZzFuVPl4sykmA2d1l4kDs=",
-        "ref": "refs/tags/quixos-reachability/56bbcd22d17f8c7f120b1e0b5bd1d5a86e91a80a",
+        "ref": "refs/tags/quixos-reachability/7177130c0365f2fa58ea4877366e1c5d17db4c01",
-        "rev": "56bbcd22d17f8c7f120b1e0b5bd1d5a86e91a80a",
+        "rev": "7177130c0365f2fa58ea4877366e1c5d17db4c01",
-        "revCount": 8,
+        "revCount": 4,
         "type": "git",
         "url": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-nix-helpers.git"
       },
       "original": {
-        "ref": "refs/tags/quixos-reachability/56bbcd22d17f8c7f120b1e0b5bd1d5a86e91a80a",
+        "ref": "refs/tags/quixos-reachability/7177130c0365f2fa58ea4877366e1c5d17db4c01",
-        "rev": "56bbcd22d17f8c7f120b1e0b5bd1d5a86e91a80a",
+        "rev": "7177130c0365f2fa58ea4877366e1c5d17db4c01",
         "type": "git",
         "url": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-nix-helpers.git"
       }

flake.nix

@@ -4,18 +4,23 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     flake-utils.url = "github:numtide/flake-utils";
-    quixos-protocol.url = "git+https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git?ref=refs/tags/quixos-reachability/27373d801b31fbced51cc33bc2a9c92499a46ba3&rev=27373d801b31fbced51cc33bc2a9c92499a46ba3";
+    quixos-protocol.url = "git+https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git?ref=refs/tags/quixos-reachability/b0d31ba51c4c1c49ec2ba715c99e5f5327505d01&rev=b0d31ba51c4c1c49ec2ba715c99e5f5327505d01";
     quixosNixHelpers = {
-      url = "git+https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-nix-helpers.git?ref=refs/tags/quixos-reachability/56bbcd22d17f8c7f120b1e0b5bd1d5a86e91a80a&rev=56bbcd22d17f8c7f120b1e0b5bd1d5a86e91a80a";
+      url = "git+https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-nix-helpers.git?ref=refs/tags/quixos-reachability/7177130c0365f2fa58ea4877366e1c5d17db4c01&rev=7177130c0365f2fa58ea4877366e1c5d17db4c01";
       flake = false;
     };
   };
 
-  outputs = inputs@{ nixpkgs, flake-utils, quixosNixHelpers, ... }:
+  outputs =
+    inputs@{
+      nixpkgs,
+      flake-utils,
+      quixosNixHelpers,
+      ...
+    }:
     let
       quixosHelpers = import "${quixosNixHelpers}/quixos-package-helpers.nix";
-    in
+      packageOutputs = quixosHelpers.mkCaminoTsYarnNixifyFlake {
-    quixosHelpers.mkCaminoTsYarnNixifyFlake {
         inherit inputs nixpkgs flake-utils;
         packageRoot = ./.;
         sourceName = "quixos-camino-package-runtime-source";
@@ -23,14 +28,48 @@
         nativeBuildInputs = { pkgs, ... }: [
           pkgs.protobuf
         ];
-      buildEnv = { inputs, pkgs, system }: {
+        buildEnv =
-        QUIXOS_PROTO_PATH = "${pkgs.protobuf}/include:${inputs.quixos-protocol.packages.${system}.default}/proto";
+          {
+            inputs,
+            pkgs,
+            system,
+          }:
+          {
+            QUIXOS_PROTO_PATH = "${pkgs.protobuf}/include:${
+              inputs.quixos-protocol.packages.${system}.default
+            }/proto";
           };
         devShellPackages = { pkgs, ... }: [
           pkgs.protobuf
         ];
-      devShellHook = { inputs, pkgs, system, ... }: ''
+        devShellHook =
-        export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:${inputs.quixos-protocol.packages.${system}.default}/proto''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
+          {
+            inputs,
+            pkgs,
+            system,
+            ...
+          }:
+          ''
+            export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:${
+              inputs.quixos-protocol.packages.${system}.default
+            }/proto''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
           '';
       };
+    in
+    packageOutputs
+    // flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+        builtPackage = packageOutputs.packages.${system}.default;
+      in
+      {
+        checks.dist-current = pkgs.runCommand "camino-package-runtime-dist-current" { } ''
+          diff --recursive --unified \
+            ${./dist} \
+            ${builtPackage}/libexec/-quixos-camino-package-runtime/dist
+          touch "$out"
+        '';
+      }
+    );
 }

src/bindings.ts

@@ -0,0 +1,325 @@
+import { create } from "@bufbuild/protobuf";
+import { ValueSchema, ObjectValueSchema, type Value } from "./camino/api_pb.js";
+import {
+  derived,
+  jsToProtoValue,
+  liveValue,
+  protoValueToJs,
+  type RuntimeContext,
+  type RuntimeHandler,
+  type DerivedHandler,
+} from "./index.js";
+
+export type { QxObjectRef } from "./references.js";
+import { assertReferenceFree, referenceToWire } from "./references.js";
+import { decodeQuerySnapshot } from "./queries.js";
+declare const watchBrand: unique symbol;
+export type QxWatchHandle = string & { readonly [watchBrand]: true };
+export type MessageBinding<T> = { encode(value: T): Value; decode(value: Value): T };
+export type QxLiveValue = ReturnType<typeof liveValue>;
+export type BindingValue<B> = B extends MessageBinding<infer T> ? T : never;
+export type QxHandler<C, O> = (context: C) => O | Promise<O>;
+export type QxDerived<C, O> = { kind: "derived"; get: QxHandler<C, O> };
+export type QxSession<C> = { id: string; run<T>(work: (context: C) => Promise<T>): Promise<T>; close(): Promise<void> };
+export type QxContextLifecycle<C> = { signal?: AbortSignal; openSession?: () => Promise<QxSession<C>> };
+declare const contractView: unique symbol;
+/** Generated exact closed contract. A descriptor is type evidence, never authority. */
+export type QxInterfaceContract<View> = {
+  readonly interfaceRevisionId: string;
+  readonly operations: Record<string, QxOperationSpec>;
+  readonly [contractView]: (value: View) => View;
+};
+export const defineQxInterfaceContract = <View>(
+  interfaceRevisionId: string,
+  operations: Record<string, QxOperationSpec>,
+): QxInterfaceContract<View> => Object.freeze({ interfaceRevisionId, operations }) as QxInterfaceContract<View>;
+export type QxConformer = {
+  tryConform<View>(
+    object: import("./references.js").QxObjectRef,
+    contract: QxInterfaceContract<View>,
+  ): Promise<View | undefined>;
+};
+export const qxDerived = <C, O>(get: QxHandler<C, O>): QxDerived<C, O> => ({ kind: "derived", get });
+
+/** Versioned binding ABI. This mirrors the language-neutral value IR. */
+export type QxValueType =
+  | { kind: "builtin"; name: "unit" | "watch-handle" }
+  | { kind: "scalar"; name: string }
+  | { kind: "message"; descriptorId: string }
+  | { kind: "record"; fields: Record<string, QxValueType> }
+  | { kind: "object-ref"; expectation: unknown }
+  | { kind: "optional" | "list"; value: QxValueType };
+export type QxOperationSpec = { id: string; inputType: QxValueType; outputType: QxValueType };
+export type QxPortSpec =
+  | { kind: "query"; id: string; definitionDigest: string; variables: QxValueType; output: QxValueType; watch: boolean }
+  | { kind: "state"; id: string; valueType: QxValueType; primitives: string[] }
+  | { kind: "edge"; id: string; primitives: string[] }
+  | { kind: "interface"; id: string; interfaceRevisionId: string; operations: Record<string, QxOperationSpec> }
+  | { kind: "constructor"; id: string; inputType: QxValueType };
+export type QxHandlerSpec = {
+  receiver?: "none";
+  inputType: QxValueType;
+  outputType: QxValueType;
+  eventType?: QxValueType;
+  ports: Record<string, QxPortSpec>;
+};
+export type QxMessages = Record<string, MessageBinding<any>>;
+
+const bindInterfaceView = (
+  target: import("./index.js").InterfacePort,
+  contract: QxInterfaceContract<unknown>,
+  messages: QxMessages,
+) => ({
+  objectId: target.objectId,
+  contract,
+  live: Object.fromEntries(
+    Object.entries(contract.operations).map(([name, operation]) => [
+      name,
+      (input: unknown) => target.live(operation.id, inputFields(operation.inputType, input, messages)),
+    ]),
+  ),
+  ...Object.fromEntries(
+    Object.entries(contract.operations).map(([name, operation]) => [
+      name,
+      async (input: unknown) =>
+        decodeQxValue(
+          operation.outputType,
+          (await target.live(operation.id, inputFields(operation.inputType, input, messages))).$quixosValue,
+          messages,
+        ),
+    ]),
+  ),
+});
+
+// Conversion belongs at the binding boundary. It does not add orchestrator validation.
+export const decodeQxValue = (type: QxValueType, value: Value | undefined, messages: QxMessages): any => {
+  if (type.kind === "builtin" && type.name === "unit") return null;
+  if (type.kind === "optional" && !value) return null;
+  if (!value) throw new Error("Missing QX wire value");
+  if (type.kind === "record") {
+    if (value.kind.case !== "objectValue") throw new Error("Expected QX record");
+    const fields = value.kind.value.fields;
+    if (Object.keys(fields).some((name) => !Object.hasOwn(type.fields, name)))
+      throw new Error("Unexpected QX record field");
+    return Object.fromEntries(
+      Object.entries(type.fields).map(([name, field]) => [name, decodeQxValue(field, fields[name], messages)]),
+    );
+  }
+  if (type.kind === "optional")
+    return value.kind.case === "nullValue" ? null : decodeQxValue(type.value, value, messages);
+  if (type.kind === "list") {
+    if (value.kind.case !== "listValue") throw new Error("Expected QX list");
+    return value.kind.value.values.map((entry) => decodeQxValue(type.value, entry, messages));
+  }
+  if (type.kind === "message") {
+    assertReferenceFree(protoValueToJs(value));
+    const decoded = requireMessage(messages, type.descriptorId).decode(value);
+    assertReferenceFree(decoded);
+    return decoded;
+  }
+  if (type.kind === "object-ref") {
+    if (value.kind.case !== "refValue") throw new Error("Expected a declared RPC object reference");
+    return protoValueToJs(value);
+  }
+  if (value.kind.case === "refValue") throw new Error("Reference supplied to a non-reference value");
+  if (type.kind === "scalar") {
+    if (type.name === "int64" || type.name === "uint64") {
+      if (value.kind.case !== "integerValue") throw new Error("Expected QX integer");
+      return BigInt(value.kind.value);
+    }
+    if (type.name === "bytes") {
+      if (value.kind.case !== "bytesValue") throw new Error("Expected QX bytes");
+      return value.kind.value;
+    }
+  }
+  return protoValueToJs(value);
+};
+
+const requireMessage = (messages: QxMessages, id: string) => {
+  const binding = messages[id];
+  if (!binding) throw new Error(`Missing message binding ${id}`);
+  return binding;
+};
+export const encodeQxValue = (type: QxValueType, value: any, messages: QxMessages): Value => {
+  if (type.kind === "builtin" && type.name === "unit") return jsToProtoValue(null);
+  if (type.kind === "record") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected QX record");
+    if (Object.keys(value).some((name) => !Object.hasOwn(type.fields, name)))
+      throw new Error("Unexpected QX record field");
+    const fields = Object.fromEntries(
+      Object.entries(type.fields).map(([name, field]) => {
+        if (!Object.hasOwn(value, name) && field.kind !== "optional")
+          throw new Error(`Missing QX record field ${name}`);
+        return [name, encodeQxValue(field, value[name] ?? (field.kind === "optional" ? null : value[name]), messages)];
+      }),
+    );
+    return create(ValueSchema, { kind: { case: "objectValue", value: create(ObjectValueSchema, { fields }) } });
+  }
+  if (type.kind === "optional")
+    return value === null ? jsToProtoValue(null) : encodeQxValue(type.value, value, messages);
+  if (type.kind === "list")
+    return jsToProtoValue(value.map((entry: unknown) => liveValue(encodeQxValue(type.value, entry, messages))));
+  if (type.kind === "object-ref") {
+    referenceToWire(value);
+    return jsToProtoValue(value);
+  }
+  assertReferenceFree(value);
+  if (type.kind === "message") {
+    const encoded = requireMessage(messages, type.descriptorId).encode(value);
+    assertReferenceFree(protoValueToJs(encoded));
+    return encoded;
+  }
+  return jsToProtoValue(value);
+};
+
+const inputValue = (context: RuntimeContext, type: QxValueType) => {
+  if (type.kind === "message" || type.kind === "record")
+    return create(ValueSchema, {
+      kind: { case: "objectValue", value: create(ObjectValueSchema, { fields: context.inputProto }) },
+    });
+  return context.inputProto.value;
+};
+const inputFields = (type: QxValueType, value: unknown, messages: QxMessages): Record<string, unknown> => {
+  if (type.kind === "builtin" && type.name === "unit") return {};
+  const encoded = encodeQxValue(type, value, messages);
+  if (type.kind === "message" || type.kind === "record") {
+    if (encoded.kind.case !== "objectValue") throw new Error("Message inputs must encode an object value");
+    return Object.fromEntries(Object.entries(encoded.kind.value.fields).map(([key, entry]) => [key, liveValue(entry)]));
+  }
+  return { value: liveValue(encoded) };
+};
+
+/** The sole unchecked cast connects generated contracts to the dynamic RPC runtime. */
+export const bindQxHandler = <C, O>(
+  spec: QxHandlerSpec,
+  handler: QxHandler<C, O> | QxDerived<C, O>,
+  messages: QxMessages,
+): RuntimeHandler | DerivedHandler => {
+  const bindContext = (raw: RuntimeContext): C => {
+    const ports = Object.fromEntries(
+      Object.entries(spec.ports).map(([name, port]) => {
+        switch (port.kind) {
+          case "state": {
+            const state = raw.state(port.id);
+            return [
+              name,
+              {
+                ...(port.primitives.includes("read")
+                  ? {
+                      get: async () => decodeQxValue(port.valueType, (await state.live()).$quixosValue, messages),
+                      live: () => state.live(),
+                    }
+                  : {}),
+                ...(port.primitives.includes("write")
+                  ? {
+                      set: async (value: unknown) =>
+                        state.set(liveValue(encodeQxValue(port.valueType, value, messages))),
+                    }
+                  : {}),
+              },
+            ];
+          }
+          case "edge": {
+            const edge = raw.edge(port.id);
+            return [
+              name,
+              {
+                ...Object.fromEntries(
+                  port.primitives.map((primitive) => [
+                    primitive,
+                    edge[primitive as "resolve" | "connect" | "disconnect"],
+                  ]),
+                ),
+                ...(port.primitives.includes("resolve") ? { collection: edge.collection } : {}),
+                ...(port.primitives.includes("resolve") &&
+                port.primitives.includes("connect") &&
+                port.primitives.includes("disconnect")
+                  ? { replace: edge.replace }
+                  : {}),
+              },
+            ];
+          }
+          case "interface": {
+            const target = raw.interface(port.id);
+            return [
+              name,
+              bindInterfaceView(target, defineQxInterfaceContract(port.interfaceRevisionId, port.operations), messages),
+            ];
+          }
+          case "query": {
+            const query = raw.query(port.id);
+            const variablesToWire = (variables: unknown) => {
+              const value = encodeQxValue(port.variables, variables, messages);
+              if (value.kind.case !== "objectValue") throw new Error("QUERY_VARIABLE_INVALID");
+              return value.kind.value.fields;
+            };
+            return [
+              name,
+              {
+                async execute(variables: unknown) {
+                  const response = await query.execute(variablesToWire(variables), port.definitionDigest);
+                  if (response.pending.length || response.errors.length) throw new Error("QUERY_INCOMPLETE");
+                  return decodeQxValue(port.output, response.value, messages);
+                },
+                ...(port.watch
+                  ? {
+                      async *watch(variables: unknown, signal: AbortSignal) {
+                        for await (const event of query.watch(
+                          variablesToWire(variables),
+                          signal,
+                          port.definitionDigest,
+                        )) {
+                          if (!event.snapshot) throw new Error("QUERY_SNAPSHOT_MISSING");
+                          yield decodeQuerySnapshot(event.snapshot, port.output, event.runId, event.sequence);
+                        }
+                      },
+                    }
+                  : {}),
+              },
+            ];
+          }
+          case "constructor":
+            return [
+              name,
+              {
+                construct: (input: unknown) =>
+                  raw.constructor(port.id).construct(inputFields(port.inputType, input, messages)),
+              },
+            ];
+        }
+      }),
+    );
+    return {
+      conform: {
+        async tryConform<View>(object: import("./references.js").QxObjectRef, contract: QxInterfaceContract<View>) {
+          const target = await raw.tryConform(object, contract.interfaceRevisionId);
+          return target
+            ? (bindInterfaceView(target, contract as QxInterfaceContract<unknown>, messages) as View)
+            : undefined;
+        },
+      } satisfies QxConformer,
+      ...(spec.receiver === "none" ? {} : { objectId: raw.objectId }),
+      signal: raw.signal,
+      ...(spec.receiver !== "none" && raw.openSession
+        ? {
+            openSession: async () => {
+              const session = await raw.openSession!();
+              return {
+                id: session.id,
+                close: () => session.close(),
+                run: <T>(work: (context: C) => Promise<T>) => session.run((next) => work(bindContext(next))),
+              };
+            },
+          }
+        : {}),
+      input: decodeQxValue(spec.inputType, inputValue(raw, spec.inputType), messages),
+      ports,
+    } as C;
+  };
+  const execute = async (raw: RuntimeContext) => {
+    const context = bindContext(raw);
+    const value = await (typeof handler === "function" ? handler(context) : handler.get(context));
+    return liveValue(encodeQxValue(spec.eventType ?? spec.outputType, value, messages));
+  };
+  return typeof handler === "function" ? execute : derived(execute);
+};

src/index.ts

@@ -1,6 +1,27 @@
 import http from "node:http";
+import { readFileSync } from "node:fs";
+import { createInvocationRegistry } from "./invocations.js";
+import {
+  isObjectReference,
+  referenceFromWire,
+  referenceToWire,
+  assertReferenceFree,
+  type QxObjectRef,
+} from "./references.js";
+export * from "./bindings.js";
+export * from "./queries.js";
+export { relationshipMap, relationshipList, relationshipSet } from "./relationships.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+export {
+  createMigrationContext,
+  migrationObjectId,
+  serveMigration,
+  type MigrationContext,
+  type MigrationInput,
+  type MigrationOutput,
+  type MigrationEdge,
+} from "./migration.js";
 import { create, equals } from "@bufbuild/protobuf";
 import { Code, ConnectError, createClient, type Client, type ConnectRouter } from "@connectrpc/connect";
 import { connectNodeAdapter, createConnectTransport } from "@connectrpc/connect-node";
@@ -13,6 +34,7 @@ import {
   RefValueSchema,
   ValueSchema,
   type Value,
+  type QueryResponse,
 } from "./camino/api_pb.js";
 import { OrchestratorRuntime } from "./quixos/orch_pb.js";
 import {
@@ -22,7 +44,7 @@ import {
   PackageRuntime,
   WatchEventSchema,
 } from "./quixos/runtime_pb.js";
-import { CapabilityRefSchema } from "./quixos/refs_pb.js";
+import { CapabilityRefSchema, type ConformanceWitness } from "./quixos/refs_pb.js";
 
 export type CaminoClient = Client<typeof CaminoService>;
 export type OrchClient = Client<typeof OrchestratorRuntime>;
@@ -57,13 +79,22 @@ const base64ToBytes = (value: string) => Buffer.from(value, "base64");
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   Boolean(value) && typeof value === "object" && !Array.isArray(value);
 const isWrappedValue = (value: unknown): value is { $quixosValue: Value } =>
-  isRecord(value) && "$quixosValue" in value &&
+  isRecord(value) &&
-  isRecord(value.$quixosValue) && value.$quixosValue.$typeName === "camino.Value";
+  "$quixosValue" in value &&
+  isRecord(value.$quixosValue) &&
+  value.$quixosValue.$typeName === "camino.Value";
 
-export const objectRef = (objectId: string) => ({ $quixosRef: objectId });
+export const objectRef = (reference: QxObjectRef) => {
+  referenceToWire(reference);
+  return reference;
+};
 export const liveValue = (value: Value) => ({ $quixosValue: value });
 
 export const jsToProtoValue = (value: unknown): Value => {
+  if (isObjectReference(value))
+    return create(ValueSchema, {
+      kind: { case: "refValue", value: create(RefValueSchema, { objectId: referenceToWire(value) }) },
+    });
   if (isWrappedValue(value)) return value.$quixosValue;
   if (value === null || value === undefined) {
     return create(ValueSchema, { kind: { case: "nullValue", value: create(NullValueSchema, {}) } });
@@ -78,44 +109,52 @@ export const jsToProtoValue = (value: unknown): Value => {
       kind: { case: "listValue", value: create(ListValueSchema, { values: value.map(jsToProtoValue) }) },
     });
   }
-  if (isRecord(value) && typeof value.$quixosRef === "string") {
+  if (isRecord(value) && "$quixosRef" in value) throw new Error("Raw ID wrappers are not object references");
+  if (isRecord(value) && typeof value.$quixosCrdtType === "string" && typeof value.$quixosCrdtPayload === "string") {
     return create(ValueSchema, {
-      kind: { case: "refValue", value: create(RefValueSchema, { objectId: value.$quixosRef }) },
+      kind: {
-    });
+        case: "crdtValue",
-  }
+        value: create(CrdtValueSchema, {
-  if (isRecord(value) && typeof value.$quixosCrdtType === "string" &&
-      typeof value.$quixosCrdtPayload === "string") {
-    return create(ValueSchema, {
-      kind: { case: "crdtValue", value: create(CrdtValueSchema, {
           type: value.$quixosCrdtType,
           encoding: typeof value.$quixosCrdtEncoding === "string" ? value.$quixosCrdtEncoding : "base64",
           payload: base64ToBytes(value.$quixosCrdtPayload),
-      }) },
+        }),
+      },
     });
   }
   if (!isRecord(value)) throw new Error(`Unsupported runtime value ${typeof value}`);
   return create(ValueSchema, {
-    kind: { case: "objectValue", value: create(ObjectValueSchema, {
+    kind: {
+      case: "objectValue",
+      value: create(ObjectValueSchema, {
         fields: Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, jsToProtoValue(entry)])),
-    }) },
+      }),
+    },
   });
 };
 
 export const protoValueToJs = (value: Value | undefined): unknown => {
   switch (value?.kind.case) {
     case "nullValue":
-    case undefined: return null;
+    case undefined:
+      return null;
     case "boolValue":
     case "numberValue":
     case "stringValue":
-    case "integerValue": return value.kind.value;
+    case "integerValue":
-    case "bytesValue": return bytesToBase64(value.kind.value);
+      return value.kind.value;
-    case "refValue": return value.kind.value.objectId;
+    case "bytesValue":
-    case "listValue": return value.kind.value.values.map(protoValueToJs);
+      return bytesToBase64(value.kind.value);
-    case "objectValue": return Object.fromEntries(
+    case "refValue":
+      return referenceFromWire(value.kind.value.objectId);
+    case "listValue":
+      return value.kind.value.values.map(protoValueToJs);
+    case "objectValue":
+      return Object.fromEntries(
         Object.entries(value.kind.value.fields).map(([key, entry]) => [key, protoValueToJs(entry)]),
       );
-    case "crdtValue": return {
+    case "crdtValue":
+      return {
         $quixosCrdtType: value.kind.value.type,
         $quixosCrdtEncoding: value.kind.value.encoding,
         $quixosCrdtPayload: bytesToBase64(value.kind.value.payload),
@@ -135,21 +174,48 @@ export type StatePort<T = unknown> = {
 export type EdgePort = {
   edgeTypeId: string;
   projectionId: string;
-  resolve(): Promise<string[]>;
+  resolve(): Promise<QxObjectRef[]>;
-  connect(targetObjectId: string): Promise<void>;
+  connect(target: QxObjectRef): Promise<void>;
+  disconnect(target: QxObjectRef): Promise<void>;
+  collection(): Promise<RelationshipCollection>;
+  replace(entries: RelationshipEntry[], expectedRevision: bigint): Promise<RelationshipCollection>;
+};
+export type RelationshipEntry<T extends QxObjectRef = QxObjectRef> = {
+  edgeId?: string;
+  target: T;
+  key?: string | boolean | bigint;
+};
+export type RelationshipCollection<T extends QxObjectRef = QxObjectRef> = {
+  revision: bigint;
+  entries: RelationshipEntry<T>[];
 };
 export type InterfacePort = {
+  objectId: QxObjectRef;
   interfaceRevisionId: string;
   invoke(operationId: string, input?: Record<string, unknown>): Promise<unknown>;
+  live(operationId: string, input?: Record<string, unknown>): Promise<ReturnType<typeof liveValue>>;
 };
 export type ConstructorPort = {
   atomId: string;
-  construct(input?: Record<string, unknown>): Promise<string>;
+  construct(input?: Record<string, unknown>): Promise<QxObjectRef>;
 };
-export type RuntimePort = StatePort | EdgePort | InterfacePort | ConstructorPort;
+export type QueryPort = {
+  queryId: string;
+  execute(variables: Record<string, Value>, expectedDefinitionDigest?: string): Promise<QueryResponse>;
+  watch(
+    variables: Record<string, Value>,
+    signal: AbortSignal,
+    expectedDefinitionDigest?: string,
+  ): AsyncIterable<import("./quixos/orch_pb.js").QueryEvent>;
+};
+export type RuntimePort = StatePort | EdgePort | InterfacePort | ConstructorPort | QueryPort;
 
 export type RuntimeContext = {
-  objectId: string;
+  tryConform(object: QxObjectRef, interfaceRevisionId: string): Promise<InterfacePort | undefined>;
+  /** Cooperative cancellation. Completion is acknowledged only after the handler returns. */
+  signal?: AbortSignal;
+  openSession?: () => Promise<RuntimeSession>;
+  objectId: QxObjectRef;
   input: Record<string, unknown>;
   inputProto: Record<string, Value>;
   ports: ReadonlyMap<string, RuntimePort>;
@@ -157,37 +223,98 @@ export type RuntimeContext = {
   edge(portId: string): EdgePort;
   interface(portId: string): InterfacePort;
   constructor(portId: string): ConstructorPort;
+  query(portId: string): QueryPort;
 };
 
+export type RuntimeSession = {
+  id: string;
+  run<T>(work: (context: RuntimeContext) => Promise<T>): Promise<T>;
+  /** Close the external resource first, then close its host retention/session. */
+  close(): Promise<void>;
+};
+export class RuntimeAuthorityError extends Error {
+  readonly retryable: boolean;
+  constructor(message: string) {
+    super(message);
+    this.name = "RuntimeAuthorityError";
+    this.retryable = /WORKSPACE_FENCED|STALE_EPOCH/.test(message);
+  }
+}
+
 const targetForEdge = (
   edge: { firstObjectId: string; secondObjectId: string; firstProjectionId: string },
   projectionId: string,
-) => edge.firstProjectionId === projectionId ? edge.secondObjectId : edge.firstObjectId;
+) => (edge.firstProjectionId === projectionId ? edge.secondObjectId : edge.firstObjectId);
 
 export const createRuntimeContext = (
   camino: CaminoClient,
   orch: OrchClient,
   request: RuntimeRequest,
 ): RuntimeContext => {
+  const acquiredPort = (
+    objectId: string,
+    interfaceRevisionId: string,
+    conformance?: ConformanceWitness,
+  ): InterfacePort => {
+    const invoke = async (operationId: string, input: Record<string, unknown> = {}) => {
+      const response = await orch.invokeCapability({
+        objectId,
+        capability: create(CapabilityRefSchema, { interfaceRevisionId, operationId, conformance }),
+        input: Object.fromEntries(Object.entries(input).map(([key, value]) => [key, jsToProtoValue(value)])),
+      });
+      if (!response.ok) throw new Error(response.error || "Capability invocation failed");
+      for (const dependency of response.dependencies) {
+        if (dependency.kind === "state" || dependency.kind === "edge")
+          await recordDependency({
+            kind: dependency.kind,
+            objectId: dependency.objectId,
+            attachmentId: dependency.attachmentId,
+            ...(dependency.kind === "edge" ? { projectionId: dependency.projectionId } : {}),
+          } as RuntimeDependency);
+      }
+      if (!response.result) throw new Error("Capability returned no value");
+      return response.result;
+    };
+    return {
+      objectId: referenceFromWire(objectId),
+      interfaceRevisionId,
+      invoke: async (operation, input) => protoValueToJs(await invoke(operation, input)),
+      live: async (operation, input) => liveValue(await invoke(operation, input)),
+    };
+  };
   const ports = new Map<string, RuntimePort>();
   for (const dependency of request.dependencies) {
     switch (dependency.binding.case) {
+      case "queryId": {
+        const queryId = dependency.binding.value,
+          objectId = dependency.objectId || request.objectId;
+        ports.set(dependency.portId, {
+          queryId,
+          execute: (variables, expectedDefinitionDigest) =>
+            orch.executeQuery({ queryId, objectId, variables, expectedDefinitionDigest }),
+          watch: (variables, signal, expectedDefinitionDigest) =>
+            orch.watchQuery({ queryId, objectId, variables, expectedDefinitionDigest }, { signal }),
+        });
+        break;
+      }
       case "stateSlotId": {
         const slotId = dependency.binding.value;
+        const dependencyObjectId = dependency.objectId || request.objectId;
         const state: StatePort = {
           slotId,
           async get() {
-            await recordDependency({ kind: "state", objectId: request.objectId, attachmentId: slotId });
+            await recordDependency({ kind: "state", objectId: dependencyObjectId, attachmentId: slotId });
-            return protoValueToJs((await camino.readState({ objectId: request.objectId, slotId })).value);
+            return protoValueToJs((await camino.readState({ objectId: dependencyObjectId, slotId })).value);
           },
           async live() {
-            await recordDependency({ kind: "state", objectId: request.objectId, attachmentId: slotId });
+            await recordDependency({ kind: "state", objectId: dependencyObjectId, attachmentId: slotId });
-            const value = await camino.readState({ objectId: request.objectId, slotId });
+            const value = await camino.readState({ objectId: dependencyObjectId, slotId });
             if (!value.value) throw new Error(`State ${slotId} returned no value`);
             return liveValue(value.value);
           },
           async set(value) {
-            await camino.writeState({ objectId: request.objectId, slotId, value: jsToProtoValue(value) });
+            assertReferenceFree(isWrappedValue(value) ? protoValueToJs(value.$quixosValue) : value);
+            await camino.writeState({ objectId: dependencyObjectId, slotId, value: jsToProtoValue(value) });
           },
         };
         ports.set(dependency.portId, state);
@@ -195,36 +322,87 @@ export const createRuntimeContext = (
       }
       case "edge": {
         const { edgeTypeId, projectionId } = dependency.binding.value;
+        const dependencyObjectId = dependency.objectId || request.objectId;
+        const collectionResult = (response: {
+          revision: bigint;
+          entries: { edgeId: string; targetObjectId: string; key?: Value }[];
+        }): RelationshipCollection => ({
+          revision: response.revision,
+          entries: response.entries.map((entry) => ({
+            edgeId: entry.edgeId,
+            target: referenceFromWire(entry.targetObjectId),
+            ...(entry.key
+              ? {
+                  key:
+                    entry.key.kind.case === "integerValue"
+                      ? BigInt(entry.key.kind.value)
+                      : (protoValueToJs(entry.key) as string | boolean),
+                }
+              : {}),
+          })),
+        });
         const edge: EdgePort = {
           edgeTypeId,
           projectionId,
-          async resolve() {
+          async collection() {
-            await recordDependency({ kind: "edge", objectId: request.objectId, attachmentId: edgeTypeId, projectionId });
+            await recordDependency({
-            const result = await camino.resolveEdge({ objectId: request.objectId, edgeTypeId, projectionId });
+              kind: "edge",
-            return result.edges.map((entry) => targetForEdge(entry, projectionId));
+              objectId: dependencyObjectId,
+              attachmentId: edgeTypeId,
+              projectionId,
+            });
+            return collectionResult(
+              await camino.readCollection({ objectId: dependencyObjectId, edgeTypeId, projectionId }),
+            );
           },
-          async connect(targetObjectId) {
+          async replace(entries, expectedRevision) {
-            await camino.connectEdge({ objectId: request.objectId, edgeTypeId, projectionId, targetObjectId });
+            return collectionResult(
+              await camino.replaceCollection({
+                objectId: dependencyObjectId,
+                edgeTypeId,
+                projectionId,
+                expectedRevision,
+                entries: entries.map((entry) => {
+                  assertReferenceFree(entry.key);
+                  return {
+                    edgeId: entry.edgeId ?? "",
+                    targetObjectId: referenceToWire(entry.target),
+                    key: entry.key === undefined ? undefined : jsToProtoValue(entry.key),
+                  };
+                }),
+              }),
+            );
+          },
+          async resolve() {
+            await recordDependency({
+              kind: "edge",
+              objectId: dependencyObjectId,
+              attachmentId: edgeTypeId,
+              projectionId,
+            });
+            const result = await camino.resolveEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId });
+            return result.edges.map((entry) => referenceFromWire(targetForEdge(entry, projectionId)));
+          },
+          async connect(target) {
+            const targetObjectId = referenceToWire(target);
+            await camino.connectEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId, targetObjectId });
+          },
+          async disconnect(target) {
+            const targetObjectId = referenceToWire(target);
+            const result = await camino.resolveEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId });
+            for (const entry of result.edges) {
+              if (targetForEdge(entry, projectionId) === targetObjectId)
+                await camino.disconnectEdge({ edgeId: entry.id });
+            }
           },
         };
         ports.set(dependency.portId, edge);
         break;
       }
-      case "receiverInterfaceRevisionId": {
+      case "interfaceRevisionId": {
         const interfaceRevisionId = dependency.binding.value;
-        const capability: InterfacePort = {
+        const dependencyObjectId = dependency.objectId || request.objectId;
-          interfaceRevisionId,
+        ports.set(dependency.portId, acquiredPort(dependencyObjectId, interfaceRevisionId));
-          async invoke(operationId, input = {}) {
-            const response = await orch.invokeCapability({
-              capability: create(CapabilityRefSchema, { interfaceRevisionId, operationId }),
-              objectId: request.objectId,
-              input: Object.fromEntries(Object.entries(input).map(([key, value]) => [key, jsToProtoValue(value)])),
-            });
-            if (!response.ok) throw new Error(response.error || `Capability ${operationId} failed`);
-            return protoValueToJs(response.result);
-          },
-        };
-        ports.set(dependency.portId, capability);
         break;
       }
       case "constructorAtomId": {
@@ -237,7 +415,7 @@ export const createRuntimeContext = (
               input: Object.fromEntries(Object.entries(input).map(([key, value]) => [key, jsToProtoValue(value)])),
             });
             if (!response.object) throw new Error(`Constructor ${atomId} returned no object`);
-            return response.object.id;
+            return referenceFromWire(response.object.id);
           },
         };
         ports.set(dependency.portId, constructor);
@@ -250,7 +428,16 @@ export const createRuntimeContext = (
     return port as T;
   };
   return {
-    objectId: request.objectId,
+    async tryConform(object, interfaceRevisionId) {
+      const objectId = referenceToWire(object);
+      const { conformance } = await orch.tryConform({ objectId, interfaceRevisionId });
+      if (conformance && (conformance.objectId !== objectId || conformance.interfaceRevisionId !== interfaceRevisionId))
+        throw new Error("Conformance response does not match the requested view");
+      return conformance ? acquiredPort(objectId, interfaceRevisionId, conformance) : undefined;
+    },
+    get objectId() {
+      return referenceFromWire(request.objectId);
+    },
     input: protoFieldsToJs(request.input),
     inputProto: request.input,
     ports,
@@ -258,6 +445,7 @@ export const createRuntimeContext = (
     edge: (portId: string) => requirePort<EdgePort>(portId, "edgeTypeId"),
     interface: (portId: string) => requirePort<InterfacePort>(portId, "interfaceRevisionId"),
     constructor: (portId: string) => requirePort<ConstructorPort>(portId, "atomId"),
+    query: (portId: string) => requirePort<QueryPort>(portId, "queryId"),
   };
 };
 
@@ -273,20 +461,21 @@ const evaluate = async (
   observe?: (dependency: RuntimeDependency) => Promise<void>,
 ) => {
   const dependencies = new Map<string, RuntimeDependency>();
-  const result = await dependencyScope.run(
+  const result = await dependencyScope.run({ dependencies, observe }, () =>
-    { dependencies, observe },
+    isDerived(handler) ? handler.get(context) : handler(context),
-    () => isDerived(handler) ? handler.get(context) : handler(context),
   );
   return { value: jsToProtoValue(result), dependencies: [...dependencies.values()] };
 };
 
-const protoDependencies = (dependencies: RuntimeDependency[]) => dependencies.map((entry) =>
+const protoDependencies = (dependencies: RuntimeDependency[]) =>
+  dependencies.map((entry) =>
     create(DerivedDependencySchema, {
       kind: entry.kind,
       objectId: entry.objectId,
       attachmentId: entry.attachmentId,
       projectionId: entry.kind === "edge" ? entry.projectionId : "",
-  }));
+    }),
+  );
 
 export const createPackageRuntimeRoutes = (config: {
   packageRevisionId: string;
@@ -294,41 +483,209 @@ export const createPackageRuntimeRoutes = (config: {
   caminoUrl?: string;
   orchUrl?: string;
 }) => {
+  const invocations = createInvocationRegistry();
   const headers: Record<string, string> = {};
-  if (process.env.CAMINO_RUNTIME_AUTH_TOKEN) {
+  const processToken =
-    headers["x-camino-runtime-token"] = process.env.CAMINO_RUNTIME_AUTH_TOKEN;
+    process.env.CAMINO_RUNTIME_AUTH_TOKEN ??
+    (process.env.CAMINO_RUNTIME_AUTH_TOKEN_FILE
+      ? readFileSync(process.env.CAMINO_RUNTIME_AUTH_TOKEN_FILE, "utf8").trim()
+      : "");
+  if (processToken) {
+    headers["x-camino-runtime-token"] = processToken;
   } else if (process.env.CAMINO_RUNTIME_AUTH_REQUIRED === "1") {
     throw new Error("CAMINO_RUNTIME_AUTH_TOKEN is required");
   }
-  const camino = createClient(CaminoService, createConnectTransport({
+  const camino = createClient(
+    CaminoService,
+    createConnectTransport({
       baseUrl: config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310",
       httpVersion: "1.1",
-    interceptors: headers["x-camino-runtime-token"] ? [
+      interceptors: headers["x-camino-runtime-token"]
+        ? [
             (next) => async (request) => {
               request.header.set("x-camino-runtime-token", headers["x-camino-runtime-token"]!);
               return await next(request);
             },
-    ] : [],
+          ]
-  }));
+        : [],
-  const orch = createClient(OrchestratorRuntime, createConnectTransport({
+    }),
+  );
+  const orch = createClient(
+    OrchestratorRuntime,
+    createConnectTransport({
       baseUrl: config.orchUrl ?? process.env.QUIXOS_ORCH_URL ?? "http://127.0.0.1:7311",
       httpVersion: "1.1",
-  }));
+    }),
+  );
 
-  return (router: ConnectRouter) => router.service(PackageRuntime, {
+  const authenticateInstance = (header: Headers) => {
-    handshake: () => create(HandshakeResponseSchema, {
+    if (!process.env.QUIXOS_RUNTIME_INSTANCE_ID) return; // standalone development ABI
+    const supplied = Buffer.from(header.get("x-quixos-instance-token") ?? "");
+    const expected = Buffer.from(processToken);
+    if (!expected.length || supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+      throw new ConnectError("Invalid runtime instance credential", Code.Unauthenticated);
+    }
+  };
+  const clientsFor = (request: { context?: { grant: string; instanceId: string; workspaceEpoch: string } }) => {
+    const context = request.context;
+    if (
+      process.env.QUIXOS_RUNTIME_INSTANCE_ID &&
+      (!context?.grant || context.instanceId !== process.env.QUIXOS_RUNTIME_INSTANCE_ID || !context.workspaceEpoch)
+    ) {
+      throw new ConnectError("Managed invocation requires an exact instance and epoch grant", Code.Unauthenticated);
+    }
+    if (!context?.grant) return { camino, orch };
+    const transport = (url: string) =>
+      createConnectTransport({
+        baseUrl: url,
+        httpVersion: "1.1",
+        interceptors: [
+          (next) => async (call) => {
+            call.header.set("x-quixos-invocation-grant", context.grant);
+            call.header.set("x-camino-runtime-token", processToken);
+            return next(call);
+          },
+        ],
+      });
+    return {
+      camino: createClient(
+        CaminoService,
+        transport(config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310"),
+      ),
+      orch: createClient(
+        OrchestratorRuntime,
+        transport(config.orchUrl ?? process.env.QUIXOS_ORCH_URL ?? "http://127.0.0.1:7311"),
+      ),
+    };
+  };
+  const runtimeControl = async <T>(operation: string, input: unknown): Promise<T> => {
+    const response = await fetch(
+      `${config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310"}/__runtime/${operation}`,
+      {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-camino-runtime-token": processToken },
+        body: JSON.stringify(input),
+        signal: AbortSignal.timeout(10_000),
+      },
+    );
+    const value = (await response.json()) as T & { error?: string };
+    if (!response.ok) throw new RuntimeAuthorityError(value.error ?? "Runtime authority request failed");
+    return value;
+  };
+  const attachSessions = (
+    runtimeContext: RuntimeContext,
+    request: RuntimeRequest & {
+      context?: { grant: string; instanceId: string; workspaceEpoch: string; ownerConformanceId?: string };
+    },
+  ) => {
+    if (!request.context?.grant || !request.context.ownerConformanceId) return;
+    runtimeContext.openSession = async () => {
+      const ownerId = request.context!.ownerConformanceId!;
+      const registration = {
+        grant: request.context!.grant,
+        objectId: request.objectId,
+        ownerId,
+        sessionId: `session:${randomBytes(16).toString("hex")}`,
+        token: randomBytes(32).toString("base64url"),
+      };
+      const register = () => runtimeControl<{ sessionId: string; token: string }>("register-session", registration);
+      const registered = await register().catch((error) => {
+        // Retry a transport/lost-response failure with exactly the same identity.
+        // Admission/authority errors are definitive and must not be retried here.
+        if (error instanceof RuntimeAuthorityError) throw error;
+        return register();
+      });
+      let closed = false;
+      return {
+        id: registered.sessionId,
+        async run(work) {
+          if (closed) throw new RuntimeAuthorityError("SESSION_CLOSED");
+          // Acquisition happens before user code. A fence failure can be retried
+          // by the caller without replaying a side-effecting callback.
+          const grant = await runtimeControl<{
+            grant: string;
+            epoch: string;
+            instanceId: string;
+            invocationId: string;
+            bindingDigest: string;
+          }>("acquire-session", registered);
+          const execution = invocations.begin(grant.invocationId);
+          const sessionRequest = {
+            ...request,
+            context: { grant: grant.grant, instanceId: grant.instanceId, workspaceEpoch: grant.epoch },
+          };
+          const clients = clientsFor(sessionRequest);
+          const context = createRuntimeContext(clients.camino, clients.orch, sessionRequest);
+          context.signal = execution.signal;
+          try {
+            return await work(context);
+          } finally {
+            execution.finish();
+            await runtimeControl("complete-invocation", { invocationId: grant.invocationId }).catch((error) =>
+              console.error("Session completion will be reconciled by the host", error),
+            );
+          }
+        },
+        async close() {
+          await runtimeControl("close-session", registered);
+          closed = true;
+        },
+      };
+    };
+  };
+
+  return (router: ConnectRouter) =>
+    router.service(PackageRuntime, {
+      handshake: (request) =>
+        create(HandshakeResponseSchema, {
           packageRevisionId: config.packageRevisionId,
           runtimeProtocolVersion: "quixos-capabilities-v1",
           exportIds: Object.keys(config.exports),
+          capabilities: ["invocation-completion-v1", "instance-authentication-v1", "epoch-grants-v1"],
+          instanceId: process.env.QUIXOS_RUNTIME_INSTANCE_ID ?? "",
+          authenticationProof:
+            request.nonce && processToken
+              ? createHmac("sha256", processToken)
+                  .update(
+                    JSON.stringify([
+                      request.nonce,
+                      process.env.QUIXOS_RUNTIME_INSTANCE_ID ?? "",
+                      config.packageRevisionId,
+                    ]),
+                  )
+                  .digest("hex")
+              : "",
         }),
-    invoke: async (request) => {
+      getInvocationStatus: (request, context) => {
+        authenticateInstance(context.requestHeader);
+        return invocations.status(request.invocationId);
+      },
+      cancelInvocation: (request, context) => {
+        authenticateInstance(context.requestHeader);
+        return invocations.cancel(request.invocationId);
+      },
+      invoke: async (request, context) => {
+        authenticateInstance(context.requestHeader);
+        const { camino, orch } = clientsFor(request);
         const exportId = request.export?.exportId;
         const handler = exportId ? config.exports[exportId] : undefined;
         if (!handler) throw new ConnectError(`Unknown export ${exportId ?? ""}`, Code.NotFound);
+        const execution = invocations.begin(
+          request.invocationId || (process.env.QUIXOS_RUNTIME_INSTANCE_ID ? "" : randomUUID()),
+        );
         try {
-        const result = await evaluate(handler, createRuntimeContext(camino, orch, request));
+          const runtimeContext = createRuntimeContext(camino, orch, request);
-        return create(InvokeResponseSchema, { ok: true, result: result.value });
+          attachSessions(runtimeContext, request);
+          runtimeContext.signal = AbortSignal.any([context.signal, execution.signal]);
+          const result = await evaluate(handler, runtimeContext);
+          execution.finish();
+          return create(InvokeResponseSchema, {
+            ok: true,
+            result: result.value,
+            dependencies: protoDependencies(result.dependencies),
+          });
         } catch (error) {
+          execution.finish(true);
           return create(InvokeResponseSchema, {
             ok: false,
             error: error instanceof Error ? error.message : String(error),
@@ -336,13 +693,22 @@ export const createPackageRuntimeRoutes = (config: {
         }
       },
       watch: async function* (request, context) {
+        authenticateInstance(context.requestHeader);
+        const { camino, orch } = clientsFor(request);
         const exportId = request.export?.exportId;
         const handler = exportId ? config.exports[exportId] : undefined;
         if (!handler || !isDerived(handler)) {
           throw new ConnectError(`Export ${exportId ?? ""} is not derived`, Code.FailedPrecondition);
         }
+        const execution = invocations.begin(
+          request.invocationId || (process.env.QUIXOS_RUNTIME_INSTANCE_ID ? "" : randomUUID()),
+        );
+        const signal = AbortSignal.any([context.signal, execution.signal]);
+        try {
           const watchId = `watch:${randomUUID()}`;
           const runtimeContext = createRuntimeContext(camino, orch, request);
+          attachSessions(runtimeContext, request);
+          runtimeContext.signal = signal;
           type WatchOutcome = { key: string; done: boolean; error?: unknown };
           type Subscription = {
             dependency: RuntimeDependency;
@@ -352,6 +718,7 @@ export const createPackageRuntimeRoutes = (config: {
           };
           const subscriptions = new Map<string, Subscription>();
           const establishing = new Map<string, Promise<void>>();
+          let subscriptionEpoch = 0;
 
           const ensureSubscription = async (dependency: RuntimeDependency) => {
             const key = dependencyKey(dependency);
@@ -360,16 +727,23 @@ export const createPackageRuntimeRoutes = (config: {
             if (pending) return await pending;
             const establish = (async () => {
               const controller = new AbortController();
-          const stream = camino.watchObject(
+              const stream = camino
-            { objectId: dependency.objectId, includeSnapshot: true },
+                .watchObject(
+                  {
+                    objectId: dependency.objectId,
+                    includeSnapshot: true,
+                    attachmentIds: request.context?.grant ? [dependency.attachmentId] : [],
+                  },
                   { signal: controller.signal },
-          )[Symbol.asyncIterator]();
+                )
+                [Symbol.asyncIterator]();
               try {
                 // Camino subscribes before producing the snapshot, so once this
                 // resolves the following state/edge read cannot race the stream.
                 const snapshot = await stream.next();
                 if (snapshot.done) throw new Error(`Dependency stream ${key} ended during setup`);
-            const waitNext = () => stream.next().then(
+                const waitNext = () =>
+                  stream.next().then(
                     (result) => ({ key, done: Boolean(result.done) }),
                     (error: unknown) => ({ key, done: true, error }),
                   );
@@ -381,6 +755,7 @@ export const createPackageRuntimeRoutes = (config: {
                 };
                 subscription.next = waitNext();
                 subscriptions.set(key, subscription);
+                subscriptionEpoch += 1;
               } catch (error) {
                 controller.abort();
                 throw error;
@@ -399,9 +774,24 @@ export const createPackageRuntimeRoutes = (config: {
               subscription.controller.abort();
             }
           };
-      context.signal.addEventListener("abort", abortAll, { once: true });
+          signal.addEventListener("abort", abortAll, { once: true });
 
-      let current = await evaluate(handler, runtimeContext, ensureSubscription);
+          const evaluateWithStableSubscriptions = async () => {
+            // A direct state/edge port records its dependency before reading it,
+            // but a nested interface invocation can only report its transitive
+            // dependencies after that invocation returns. Once a new dependency
+            // stream is established, evaluate again so every read contributing to
+            // the emitted value happened after its stream became live.
+            for (let pass = 0; pass < 32; pass += 1) {
+              const before = subscriptionEpoch;
+              const result = await evaluate(handler, runtimeContext, ensureSubscription);
+              if (subscriptionEpoch === before) return result;
+            }
+            throw new Error("Derived dependency discovery did not stabilize after 32 passes");
+          };
+
+          try {
+            let current = await evaluateWithStableSubscriptions();
             yield create(WatchEventSchema, {
               watchId,
               value: current.value,
@@ -410,19 +800,15 @@ export const createPackageRuntimeRoutes = (config: {
             });
 
             const abort = new Promise<"abort">((resolve) => {
-        if (context.signal.aborted) resolve("abort");
+              if (signal.aborted) resolve("abort");
-        else context.signal.addEventListener("abort", () => resolve("abort"), { once: true });
+              else signal.addEventListener("abort", () => resolve("abort"), { once: true });
             });
-      try {
+            while (!signal.aborted) {
-        while (!context.signal.aborted) {
               if (subscriptions.size === 0) {
                 await abort;
                 break;
               }
-          const outcome = await Promise.race([
+              const outcome = await Promise.race([...[...subscriptions.values()].map((entry) => entry.next), abort]);
-            ...[...subscriptions.values()].map((entry) => entry.next),
-            abort,
-          ]);
               if (outcome === "abort") break;
               const subscription = subscriptions.get(outcome.key);
               if (!subscription) continue;
@@ -430,7 +816,7 @@ export const createPackageRuntimeRoutes = (config: {
               if (outcome.done) throw new Error(`Dependency stream ${outcome.key} ended unexpectedly`);
               subscription.next = subscription.waitNext();
 
-          const updated = await evaluate(handler, runtimeContext, ensureSubscription);
+              const updated = await evaluateWithStableSubscriptions();
               const active = new Set(updated.dependencies.map(dependencyKey));
               for (const [key, entry] of subscriptions) {
                 if (!active.has(key)) {
@@ -448,9 +834,12 @@ export const createPackageRuntimeRoutes = (config: {
               current = updated;
             }
           } finally {
-        context.signal.removeEventListener("abort", abortAll);
+            signal.removeEventListener("abort", abortAll);
             abortAll();
           }
+        } finally {
+          execution.finish();
+        }
       },
     });
 };

src/invocations.ts

@@ -0,0 +1,32 @@
+/** Execution completion, not HTTP disconnection, is the drain boundary. */
+export const createInvocationRegistry = () => {
+  const entries = new Map<string, { state: string; controller: AbortController }>();
+  return {
+    begin(id: string) {
+      if (!id || entries.has(id))
+        throw new Error("Invocation ID is missing or already used; invocations are never replayed implicitly");
+      // Completed identities remain until process retirement. A bounded process
+      // may reject new work; it must not evict and accidentally replay a call.
+      if (entries.size >= 100_000) throw new Error("Invocation registry full; explicit runtime retirement required");
+      const entry = { state: "running", controller: new AbortController() };
+      entries.set(id, entry);
+      return {
+        signal: entry.controller.signal,
+        finish(failed = false) {
+          entry.state = failed ? "failed" : "completed";
+        },
+      };
+    },
+    status(id: string) {
+      return { invocationId: id, state: entries.get(id)?.state ?? "unknown" };
+    },
+    cancel(id: string) {
+      const entry = entries.get(id);
+      if (entry && ["running", "cancellation-requested"].includes(entry.state)) {
+        entry.state = "cancellation-requested";
+        entry.controller.abort();
+      }
+      return this.status(id);
+    },
+  };
+};

src/migration.ts

@@ -0,0 +1,154 @@
+import { createHash } from "node:crypto";
+
+export type MigrationInput = {
+  schemaVersion: 1;
+  executionId: string;
+  exportId: string;
+  ports: {
+    name: string;
+    binding: string;
+    view: "old" | "new";
+    access: ("read" | "write" | "create" | "edge")[];
+    atomId?: string;
+    attachedAtomId?: string;
+    defaultValue?: unknown;
+    states?: { objectId: string; value: unknown }[];
+    edges?: MigrationEdge[];
+  }[];
+};
+export type MigrationEdge = {
+  id: string;
+  edgeTypeId: string;
+  firstObjectId: string;
+  secondObjectId: string;
+  firstProjectionId: string;
+  secondProjectionId: string;
+  firstOrdinal?: number;
+  secondOrdinal?: number;
+  firstKeyJson?: string;
+  secondKeyJson?: string;
+};
+export type MigrationOutput = {
+  schemaVersion: 1;
+  executionId: string;
+  writes: { port: string; objectId: string; value: unknown }[];
+  creates: { port: string; logicalKey: string; objectId: string }[];
+  edgeReplacements: { port: string; edges: MigrationEdge[] }[];
+};
+export type MigrationContext = {
+  enumerate(port: string): { objectId: string; value: unknown }[];
+  read(port: string, objectId: string): unknown;
+  write(port: string, objectId: string, value: unknown): void;
+  create(port: string, logicalKey: string): string;
+  edges(port: string): MigrationEdge[];
+  replaceEdges(port: string, edges: MigrationEdge[]): void;
+};
+export const migrationObjectId = (executionId: string, port: string, logicalKey: string) =>
+  `obj:migration:${createHash("sha256")
+    .update(JSON.stringify([executionId, port, logicalKey]))
+    .digest("hex")}`;
+
+/** No ordinary RuntimeContext or network/database clients are supplied here.
+ * Process isolation belongs to the host, not this convenience API. */
+export const createMigrationContext = (input: MigrationInput) => {
+  if (
+    input.schemaVersion !== 1 ||
+    !input.executionId ||
+    new Set(input.ports.map((entry) => entry.name)).size !== input.ports.length
+  )
+    throw new Error("Invalid migration input");
+  const output: MigrationOutput = {
+    schemaVersion: 1,
+    executionId: input.executionId,
+    writes: [],
+    creates: [],
+    edgeReplacements: [],
+  };
+  const port = (name: string, access: string) => {
+    const selected = input.ports.find((entry) => entry.name === name);
+    if (!selected?.access.includes(access as "read") || (selected.view === "old" && access !== "read"))
+      throw new Error(`Migration port ${name} does not grant ${access}`);
+    return selected;
+  };
+  const context: MigrationContext = {
+    enumerate(name) {
+      const selected = port(name, "read"),
+        states = structuredClone(selected.states ?? []);
+      if (selected.view === "new" && Object.hasOwn(selected, "defaultValue"))
+        for (const helper of output.creates) {
+          if (
+            input.ports.find((entry) => entry.name === helper.port)?.atomId === selected.attachedAtomId &&
+            !states.some((entry) => entry.objectId === helper.objectId)
+          )
+            states.push({ objectId: helper.objectId, value: structuredClone(selected.defaultValue) });
+        }
+      if (selected.view === "new")
+        for (const write of output.writes) {
+          if (input.ports.find((entry) => entry.name === write.port)?.binding !== selected.binding) continue;
+          const existing = states.findIndex((entry) => entry.objectId === write.objectId),
+            entry = { objectId: write.objectId, value: structuredClone(write.value) };
+          if (existing < 0) states.push(entry);
+          else states[existing] = entry;
+        }
+      return states.sort((a, b) => (a.objectId < b.objectId ? -1 : a.objectId > b.objectId ? 1 : 0));
+    },
+    read(name, objectId) {
+      return context.enumerate(name).find((entry) => entry.objectId === objectId)?.value;
+    },
+    write(name, objectId, value) {
+      port(name, "write");
+      const previous = output.writes.findIndex((entry) => entry.port === name && entry.objectId === objectId);
+      const entry = { port: name, objectId, value: structuredClone(value) };
+      if (previous < 0) output.writes.push(entry);
+      else output.writes[previous] = entry;
+    },
+    create(name, logicalKey) {
+      port(name, "create");
+      if (!logicalKey || logicalKey.length > 1024)
+        throw new Error("Migration creation requires a bounded stable logical key");
+      const objectId = migrationObjectId(input.executionId, name, logicalKey);
+      if (!output.creates.some((entry) => entry.objectId === objectId))
+        output.creates.push({ port: name, logicalKey, objectId });
+      return objectId;
+    },
+    edges(name) {
+      const selected = port(name, "read");
+      const replacement =
+        selected.view === "new"
+          ? output.edgeReplacements.find(
+              (entry) => input.ports.find((candidate) => candidate.name === entry.port)?.binding === selected.binding,
+            )
+          : undefined;
+      return structuredClone(replacement?.edges ?? selected.edges ?? []);
+    },
+    replaceEdges(name, edges) {
+      port(name, "edge");
+      const previous = output.edgeReplacements.findIndex((entry) => entry.port === name);
+      const entry = { port: name, edges: structuredClone(edges) };
+      if (previous < 0) output.edgeReplacements.push(entry);
+      else output.edgeReplacements[previous] = entry;
+    },
+  };
+  return { context, result: () => structuredClone(output) };
+};
+
+/** Entrypoint for an immutable package's dedicated bin/migrate executable.
+ * stdout is protocol-only; send diagnostics to stderr. The host independently
+ * validates every write, helper identity, contract, and completion receipt. */
+export const serveMigration = async (exports: Record<string, (context: MigrationContext) => void | Promise<void>>) => {
+  const chunks: Buffer[] = [];
+  let bytes = 0;
+  for await (const chunk of process.stdin) {
+    bytes += chunk.length;
+    if (bytes > 16 * 1024 * 1024) throw new Error("Migration input exceeds 16 MiB");
+    chunks.push(Buffer.from(chunk));
+  }
+  const input = JSON.parse(Buffer.concat(chunks).toString("utf8")) as MigrationInput;
+  const implementation = Object.hasOwn(exports, input.exportId) ? exports[input.exportId] : undefined;
+  if (!implementation) throw new Error("Unknown migration export");
+  const execution = createMigrationContext(input);
+  await implementation(execution.context);
+  const result = JSON.stringify(execution.result());
+  if (Buffer.byteLength(result) > 16 * 1024 * 1024) throw new Error("Migration output exceeds 16 MiB");
+  process.stdout.write(`${result}\n`);
+};

src/queries.ts

@@ -0,0 +1,82 @@
+import { decodeQxValue, type QxValueType } from "./bindings.js";
+import type { QueryResponse } from "./camino/api_pb.js";
+import type { QxObjectRef } from "./references.js";
+
+export type QxQueryPartial<T> = T extends QxObjectRef
+  ? T
+  : T extends readonly (infer Item)[]
+    ? QxQueryPartial<Item>[]
+    : T extends object
+      ? { [Key in keyof T]?: QxQueryPartial<T[Key]> }
+      : T;
+export type QxQuerySnapshot<T> = {
+  runId: string;
+  sequence: bigint;
+  dataVersion: string;
+  bindingDigest: string;
+  consistency: string;
+  fields: { path: readonly (string | number)[]; status: "pending" | "error"; error?: string }[];
+} & ({ status: "ready"; data: T } | { status: "partial"; data: QxQueryPartial<T> });
+declare const queryTypes: unique symbol;
+/** Generated shape evidence, not permission to run a query. */
+export interface QxQueryDescriptor<Variables, Result, Root extends string = string> {
+  readonly id: string;
+  readonly definitionDigest: string;
+  readonly rootInterfaceRevisionId: Root;
+  readonly variables: QxValueType;
+  readonly output: QxValueType;
+  readonly watch: boolean;
+  readonly [queryTypes]?: (variables: Variables, result: Result) => [Variables, Result];
+}
+
+export function decodeQuerySnapshot<T>(
+  response: QueryResponse,
+  output: QxValueType,
+  runId: string,
+  sequence: bigint,
+): QxQuerySnapshot<T> {
+  if (response.preparationToken || response.residualWindows.length || response.relationalCaptures.length)
+    throw new Error("QUERY_RESULT_UNFINISHED: private preparation is not a query result");
+  const fields = [
+    ...response.pending.map((field) => ({ path: field.path, status: "pending" as const })),
+    ...response.errors.map((field) => ({ path: field.path, status: "error" as const, error: field.error })),
+  ].map((field) => ({
+    ...field,
+    path: field.path.map((part) => {
+      if (part.part.case !== "field" && part.part.case !== "index") throw new Error("QUERY_PATCH_INVALID");
+      return part.part.value;
+    }),
+  }));
+  // Pending/error values are absent, not successful nulls of a scalar type.
+  const shape = structuredClone(output);
+  for (const field of fields) {
+    let cursor = shape;
+    for (const [index, part] of field.path.entries()) {
+      while (cursor.kind === "optional") cursor = cursor.value;
+      const last = index === field.path.length - 1;
+      if (typeof part === "string" && cursor.kind === "record" && cursor.fields[part]) {
+        if (last) cursor.fields[part] = { kind: "optional", value: cursor.fields[part]! };
+        else cursor = cursor.fields[part]!;
+      } else if (typeof part === "number" && cursor.kind === "list") cursor = cursor.value;
+      else throw new Error("QUERY_PATCH_INVALID");
+    }
+  }
+  const data = decodeQxValue(shape, response.value, {}) as Record<string, unknown>;
+  for (const field of fields) {
+    let cursor: unknown = data;
+    for (const [index, part] of field.path.entries()) {
+      if (!cursor || typeof cursor !== "object") throw new Error("QUERY_PATCH_INVALID");
+      if (index === field.path.length - 1) delete (cursor as Record<string | number, unknown>)[part];
+      else cursor = (cursor as Record<string | number, unknown>)[part];
+    }
+  }
+  return {
+    runId,
+    sequence,
+    dataVersion: response.dataVersion,
+    bindingDigest: response.bindingDigest,
+    consistency: response.consistency,
+    fields,
+    ...(fields.length ? { status: "partial", data } : { status: "ready", data }),
+  } as QxQuerySnapshot<T>;
+}

src/quixos/refs_pb.ts

@@ -2,15 +2,15 @@
 // @generated from file quixos/refs.proto (package quixos, syntax proto3)
 /* eslint-disable */
 
-import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
-import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file quixos/refs.proto.
  */
 export const file_quixos_refs: GenFile = /*@__PURE__*/
-  fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zIkQKDUNhcGFiaWxpdHlSZWYSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAEgASgJEhQKDG9wZXJhdGlvbl9pZBgCIAEoCSJCChBQYWNrYWdlRXhwb3J0UmVmEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSEQoJZXhwb3J0X2lkGAIgASgJIroBChJJbmplY3RlZERlcGVuZGVuY3kSDwoHcG9ydF9pZBgBIAEoCRIXCg1zdGF0ZV9zbG90X2lkGAIgASgJSAASJgoEZWRnZRgDIAEoCzIWLnF1aXhvcy5FZGdlRGVwZW5kZW5jeUgAEigKHnJlY2VpdmVyX2ludGVyZmFjZV9yZXZpc2lvbl9pZBgEIAEoCUgAEh0KE2NvbnN0cnVjdG9yX2F0b21faWQYBSABKAlIAEIJCgdiaW5kaW5nIj0KDkVkZ2VEZXBlbmRlbmN5EhQKDGVkZ2VfdHlwZV9pZBgBIAEoCRIVCg1wcm9qZWN0aW9uX2lkGAIgASgJYgZwcm90bzM");
+  fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zInUKDUNhcGFiaWxpdHlSZWYSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAEgASgJEhQKDG9wZXJhdGlvbl9pZBgCIAEoCRIvCgtjb25mb3JtYW5jZRgDIAEoCzIaLnF1aXhvcy5Db25mb3JtYW5jZVdpdG5lc3Mi0QEKDEZpZWxkRWRpdGluZxIbChNnZXR0ZXJfb3BlcmF0aW9uX2lkGAEgASgJEhsKE3NldHRlcl9vcGVyYXRpb25faWQYAiABKAkSFQoNZG9jdW1lbnRfdHlwZRgDIAEoCRIWCg5iaW5kaW5nX2RpZ2VzdBgEIAEoCRInCgRtb2RlGAUgASgOMhkucXVpeG9zLkZpZWxkRWRpdGluZy5Nb2RlIi8KBE1vZGUSDwoLVU5TUEVDSUZJRUQQABIMCghSRUdJU1RFUhABEggKBENSRFQQAiKWAQoSQ29uZm9ybWFuY2VXaXRuZXNzEhEKCW9iamVjdF9pZBgBIAEoCRIdChVpbnRlcmZhY2VfcmV2aXNpb25faWQYAiABKAkSFgoOY29uZm9ybWFuY2VfaWQYAyABKAkSHQoVd29ya3NwYWNlX3JldmlzaW9uX2lkGAQgASgJEhcKD3dvcmtzcGFjZV9lcG9jaBgFIAEoCSJCChBQYWNrYWdlRXhwb3J0UmVmEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSEQoJZXhwb3J0X2lkGAIgASgJItgBChJJbmplY3RlZERlcGVuZGVuY3kSDwoHcG9ydF9pZBgBIAEoCRIXCg1zdGF0ZV9zbG90X2lkGAIgASgJSAASJgoEZWRnZRgDIAEoCzIWLnF1aXhvcy5FZGdlRGVwZW5kZW5jeUgAEh8KFWludGVyZmFjZV9yZXZpc2lvbl9pZBgEIAEoCUgAEh0KE2NvbnN0cnVjdG9yX2F0b21faWQYBSABKAlIABISCghxdWVyeV9pZBgHIAEoCUgAEhEKCW9iamVjdF9pZBgGIAEoCUIJCgdiaW5kaW5nIj0KDkVkZ2VEZXBlbmRlbmN5EhQKDGVkZ2VfdHlwZV9pZBgBIAEoCRIVCg1wcm9qZWN0aW9uX2lkGAIgASgJYgZwcm90bzM");
 
 /**
  * @generated from message quixos.CapabilityRef
@@ -25,6 +25,13 @@ export type CapabilityRef = Message<"quixos.CapabilityRef"> & {
    * @generated from field: string operation_id = 2;
    */
   operationId: string;
+
+  /**
+   * Optional fence for a view acquired through TryConform. Not an authority grant.
+   *
+   * @generated from field: quixos.ConformanceWitness conformance = 3;
+   */
+  conformance?: ConformanceWitness | undefined;
 };
 
 /**
@@ -34,6 +41,108 @@ export type CapabilityRef = Message<"quixos.CapabilityRef"> & {
 export const CapabilityRefSchema: GenMessage<CapabilityRef> = /*@__PURE__*/
   messageDesc(file_quixos_refs, 0);
 
+/**
+ * Resolved native editing semantics. A source snapshot alone grants no writer.
+ *
+ * @generated from message quixos.FieldEditing
+ */
+export type FieldEditing = Message<"quixos.FieldEditing"> & {
+  /**
+   * @generated from field: string getter_operation_id = 1;
+   */
+  getterOperationId: string;
+
+  /**
+   * @generated from field: string setter_operation_id = 2;
+   */
+  setterOperationId: string;
+
+  /**
+   * @generated from field: string document_type = 3;
+   */
+  documentType: string;
+
+  /**
+   * @generated from field: string binding_digest = 4;
+   */
+  bindingDigest: string;
+
+  /**
+   * @generated from field: quixos.FieldEditing.Mode mode = 5;
+   */
+  mode: FieldEditing_Mode;
+};
+
+/**
+ * Describes the message quixos.FieldEditing.
+ * Use `create(FieldEditingSchema)` to create a new message.
+ */
+export const FieldEditingSchema: GenMessage<FieldEditing> = /*@__PURE__*/
+  messageDesc(file_quixos_refs, 1);
+
+/**
+ * @generated from enum quixos.FieldEditing.Mode
+ */
+export enum FieldEditing_Mode {
+  /**
+   * @generated from enum value: UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: REGISTER = 1;
+   */
+  REGISTER = 1,
+
+  /**
+   * @generated from enum value: CRDT = 2;
+   */
+  CRDT = 2,
+}
+
+/**
+ * Describes the enum quixos.FieldEditing.Mode.
+ */
+export const FieldEditing_ModeSchema: GenEnum<FieldEditing_Mode> = /*@__PURE__*/
+  enumDesc(file_quixos_refs, 1, 0);
+
+/**
+ * @generated from message quixos.ConformanceWitness
+ */
+export type ConformanceWitness = Message<"quixos.ConformanceWitness"> & {
+  /**
+   * @generated from field: string object_id = 1;
+   */
+  objectId: string;
+
+  /**
+   * @generated from field: string interface_revision_id = 2;
+   */
+  interfaceRevisionId: string;
+
+  /**
+   * @generated from field: string conformance_id = 3;
+   */
+  conformanceId: string;
+
+  /**
+   * @generated from field: string workspace_revision_id = 4;
+   */
+  workspaceRevisionId: string;
+
+  /**
+   * @generated from field: string workspace_epoch = 5;
+   */
+  workspaceEpoch: string;
+};
+
+/**
+ * Describes the message quixos.ConformanceWitness.
+ * Use `create(ConformanceWitnessSchema)` to create a new message.
+ */
+export const ConformanceWitnessSchema: GenMessage<ConformanceWitness> = /*@__PURE__*/
+  messageDesc(file_quixos_refs, 2);
+
 /**
  * @generated from message quixos.PackageExportRef
  */
@@ -54,7 +163,7 @@ export type PackageExportRef = Message<"quixos.PackageExportRef"> & {
  * Use `create(PackageExportRefSchema)` to create a new message.
  */
 export const PackageExportRefSchema: GenMessage<PackageExportRef> = /*@__PURE__*/
-  messageDesc(file_quixos_refs, 1);
+  messageDesc(file_quixos_refs, 3);
 
 /**
  * @generated from message quixos.InjectedDependency
@@ -82,17 +191,31 @@ export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
     case: "edge";
   } | {
     /**
-     * @generated from field: string receiver_interface_revision_id = 4;
+     * @generated from field: string interface_revision_id = 4;
      */
     value: string;
-    case: "receiverInterfaceRevisionId";
+    case: "interfaceRevisionId";
   } | {
     /**
      * @generated from field: string constructor_atom_id = 5;
      */
     value: string;
     case: "constructorAtomId";
+  } | {
+    /**
+     * @generated from field: string query_id = 7;
+     */
+    value: string;
+    case: "queryId";
   } | { case: undefined; value?: undefined };
+
+  /**
+   * Defaults to the invocation receiver. A checked dependency traversal can
+   * select a related object explicitly before the package runtime starts.
+   *
+   * @generated from field: string object_id = 6;
+   */
+  objectId: string;
 };
 
 /**
@@ -100,7 +223,7 @@ export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
  * Use `create(InjectedDependencySchema)` to create a new message.
  */
 export const InjectedDependencySchema: GenMessage<InjectedDependency> = /*@__PURE__*/
-  messageDesc(file_quixos_refs, 2);
+  messageDesc(file_quixos_refs, 4);
 
 /**
  * @generated from message quixos.EdgeDependency
@@ -122,5 +245,5 @@ export type EdgeDependency = Message<"quixos.EdgeDependency"> & {
  * Use `create(EdgeDependencySchema)` to create a new message.
  */
 export const EdgeDependencySchema: GenMessage<EdgeDependency> = /*@__PURE__*/
-  messageDesc(file_quixos_refs, 3);
+  messageDesc(file_quixos_refs, 5);
 

src/quixos/runtime_pb.ts

@@ -14,7 +14,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file quixos/runtime.proto.
  */
 export const file_quixos_runtime: GenFile = /*@__PURE__*/
-  fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiMQoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkiZgoRSGFuZHNoYWtlUmVzcG9uc2USGwoTcGFja2FnZV9yZXZpc2lvbl9pZBgBIAEoCRIgChhydW50aW1lX3Byb3RvY29sX3ZlcnNpb24YAiABKAkSEgoKZXhwb3J0X2lkcxgDIAMoCSKLAgoNSW52b2tlUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI3CgVpbnB1dBgEIAMoCzIoLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QuSW5wdXRFbnRyeRIwCgxkZXBlbmRlbmNpZXMYBSADKAsyGi5xdWl4b3MuSW5qZWN0ZWREZXBlbmRlbmN5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJKCg5JbnZva2VSZXNwb25zZRIKCgJvaxgBIAEoCBIdCgZyZXN1bHQYAiABKAsyDS5jYW1pbm8uVmFsdWUSDQoFZXJyb3IYAyABKAkiiQIKDFdhdGNoUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI2CgVpbnB1dBgEIAMoCzInLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdC5JbnB1dEVudHJ5EjAKDGRlcGVuZGVuY2llcxgFIAMoCzIaLnF1aXhvcy5JbmplY3RlZERlcGVuZGVuY3kaOwoKSW5wdXRFbnRyeRILCgNrZXkYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWU6AjgBImIKEURlcml2ZWREZXBlbmRlbmN5EgwKBGtpbmQYASABKAkSEQoJb2JqZWN0X2lkGAIgASgJEhUKDWF0dGFjaG1lbnRfaWQYAyABKAkSFQoNcHJvamVjdGlvbl9pZBgEIAEoCSKVAQoKV2F0Y2hFdmVudBIQCgh3YXRjaF9pZBgBIAEoCRIcCgV2YWx1ZRgCIAEoCzINLmNhbWluby5WYWx1ZRI3CgxkZXBlbmRlbmNpZXMYAyADKAsyIS5xdWl4b3MucnVudGltZS5EZXJpdmVkRGVwZW5kZW5jeRINCgVlcnJvchgEIAEoCRIPCgdpbml0aWFsGAUgASgIMvABCg5QYWNrYWdlUnVudGltZRJQCglIYW5kc2hha2USIC5xdWl4b3MucnVudGltZS5IYW5kc2hha2VSZXF1ZXN0GiEucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVzcG9uc2USRwoGSW52b2tlEh0ucXVpeG9zLnJ1bnRpbWUuSW52b2tlUmVxdWVzdBoeLnF1aXhvcy5ydW50aW1lLkludm9rZVJlc3BvbnNlEkMKBVdhdGNoEhwucXVpeG9zLnJ1bnRpbWUuV2F0Y2hSZXF1ZXN0GhoucXVpeG9zLnJ1bnRpbWUuV2F0Y2hFdmVudDABYgZwcm90bzM", [file_camino_api, file_quixos_refs]);
+  fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiQAoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkSDQoFbm9uY2UYAiABKAkirwEKEUhhbmRzaGFrZVJlc3BvbnNlEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSIAoYcnVudGltZV9wcm90b2NvbF92ZXJzaW9uGAIgASgJEhIKCmV4cG9ydF9pZHMYAyADKAkSEwoLaW5zdGFuY2VfaWQYBCABKAkSHAoUYXV0aGVudGljYXRpb25fcHJvb2YYBSABKAkSFAoMY2FwYWJpbGl0aWVzGAYgAygJIpoBChFJbnZvY2F0aW9uQ29udGV4dBIXCg93b3Jrc3BhY2VfZXBvY2gYASABKAkSEwoLaW5zdGFuY2VfaWQYAiABKAkSFgoOYmluZGluZ19kaWdlc3QYAyABKAkSDQoFZ3JhbnQYBCABKAkSEgoKc2Vzc2lvbl9pZBgFIAEoCRIcChRvd25lcl9jb25mb3JtYW5jZV9pZBgGIAEoCSIxChhJbnZvY2F0aW9uQ29udHJvbFJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCSI4ChBJbnZvY2F0aW9uU3RhdHVzEhUKDWludm9jYXRpb25faWQYASABKAkSDQoFc3RhdGUYAiABKAkivwIKDUludm9rZVJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCRIoCgZleHBvcnQYAiABKAsyGC5xdWl4b3MuUGFja2FnZUV4cG9ydFJlZhIRCglvYmplY3RfaWQYAyABKAkSNwoFaW5wdXQYBCADKAsyKC5xdWl4b3MucnVudGltZS5JbnZva2VSZXF1ZXN0LklucHV0RW50cnkSMAoMZGVwZW5kZW5jaWVzGAUgAygLMhoucXVpeG9zLkluamVjdGVkRGVwZW5kZW5jeRIyCgdjb250ZXh0GAYgASgLMiEucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRleHQaOwoKSW5wdXRFbnRyeRILCgNrZXkYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWU6AjgBIoMBCg5JbnZva2VSZXNwb25zZRIKCgJvaxgBIAEoCBIdCgZyZXN1bHQYAiABKAsyDS5jYW1pbm8uVmFsdWUSDQoFZXJyb3IYAyABKAkSNwoMZGVwZW5kZW5jaWVzGAQgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kivQIKDFdhdGNoUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI2CgVpbnB1dBgEIAMoCzInLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdC5JbnB1dEVudHJ5EjAKDGRlcGVuZGVuY2llcxgFIAMoCzIaLnF1aXhvcy5JbmplY3RlZERlcGVuZGVuY3kSMgoHY29udGV4dBgGIAEoCzIhLnF1aXhvcy5ydW50aW1lLkludm9jYXRpb25Db250ZXh0GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJiChFEZXJpdmVkRGVwZW5kZW5jeRIMCgRraW5kGAEgASgJEhEKCW9iamVjdF9pZBgCIAEoCRIVCg1hdHRhY2htZW50X2lkGAMgASgJEhUKDXByb2plY3Rpb25faWQYBCABKAkilQEKCldhdGNoRXZlbnQSEAoId2F0Y2hfaWQYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWUSNwoMZGVwZW5kZW5jaWVzGAMgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kSDQoFZXJyb3IYBCABKAkSDwoHaW5pdGlhbBgFIAEoCDKzAwoOUGFja2FnZVJ1bnRpbWUSUAoJSGFuZHNoYWtlEiAucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVxdWVzdBohLnF1aXhvcy5ydW50aW1lLkhhbmRzaGFrZVJlc3BvbnNlEkcKBkludm9rZRIdLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QaHi5xdWl4b3MucnVudGltZS5JbnZva2VSZXNwb25zZRJDCgVXYXRjaBIcLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdBoaLnF1aXhvcy5ydW50aW1lLldhdGNoRXZlbnQwARJhChNHZXRJbnZvY2F0aW9uU3RhdHVzEigucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRyb2xSZXF1ZXN0GiAucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvblN0YXR1cxJeChBDYW5jZWxJbnZvY2F0aW9uEigucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRyb2xSZXF1ZXN0GiAucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvblN0YXR1c2IGcHJvdG8z", [file_camino_api, file_quixos_refs]);
 
 /**
  * @generated from message quixos.runtime.HandshakeRequest
@@ -24,6 +24,11 @@ export type HandshakeRequest = Message<"quixos.runtime.HandshakeRequest"> & {
    * @generated from field: string orch_protocol_version = 1;
    */
   orchProtocolVersion: string;
+
+  /**
+   * @generated from field: string nonce = 2;
+   */
+  nonce: string;
 };
 
 /**
@@ -51,6 +56,21 @@ export type HandshakeResponse = Message<"quixos.runtime.HandshakeResponse"> & {
    * @generated from field: repeated string export_ids = 3;
    */
   exportIds: string[];
+
+  /**
+   * @generated from field: string instance_id = 4;
+   */
+  instanceId: string;
+
+  /**
+   * @generated from field: string authentication_proof = 5;
+   */
+  authenticationProof: string;
+
+  /**
+   * @generated from field: repeated string capabilities = 6;
+   */
+  capabilities: string[];
 };
 
 /**
@@ -60,6 +80,91 @@ export type HandshakeResponse = Message<"quixos.runtime.HandshakeResponse"> & {
 export const HandshakeResponseSchema: GenMessage<HandshakeResponse> = /*@__PURE__*/
   messageDesc(file_quixos_runtime, 1);
 
+/**
+ * @generated from message quixos.runtime.InvocationContext
+ */
+export type InvocationContext = Message<"quixos.runtime.InvocationContext"> & {
+  /**
+   * @generated from field: string workspace_epoch = 1;
+   */
+  workspaceEpoch: string;
+
+  /**
+   * @generated from field: string instance_id = 2;
+   */
+  instanceId: string;
+
+  /**
+   * @generated from field: string binding_digest = 3;
+   */
+  bindingDigest: string;
+
+  /**
+   * @generated from field: string grant = 4;
+   */
+  grant: string;
+
+  /**
+   * @generated from field: string session_id = 5;
+   */
+  sessionId: string;
+
+  /**
+   * Host-selected owner; packages must not invent workspace-local ownership.
+   *
+   * @generated from field: string owner_conformance_id = 6;
+   */
+  ownerConformanceId: string;
+};
+
+/**
+ * Describes the message quixos.runtime.InvocationContext.
+ * Use `create(InvocationContextSchema)` to create a new message.
+ */
+export const InvocationContextSchema: GenMessage<InvocationContext> = /*@__PURE__*/
+  messageDesc(file_quixos_runtime, 2);
+
+/**
+ * @generated from message quixos.runtime.InvocationControlRequest
+ */
+export type InvocationControlRequest = Message<"quixos.runtime.InvocationControlRequest"> & {
+  /**
+   * @generated from field: string invocation_id = 1;
+   */
+  invocationId: string;
+};
+
+/**
+ * Describes the message quixos.runtime.InvocationControlRequest.
+ * Use `create(InvocationControlRequestSchema)` to create a new message.
+ */
+export const InvocationControlRequestSchema: GenMessage<InvocationControlRequest> = /*@__PURE__*/
+  messageDesc(file_quixos_runtime, 3);
+
+/**
+ * @generated from message quixos.runtime.InvocationStatus
+ */
+export type InvocationStatus = Message<"quixos.runtime.InvocationStatus"> & {
+  /**
+   * @generated from field: string invocation_id = 1;
+   */
+  invocationId: string;
+
+  /**
+   * unknown, running, cancellation-requested, completed, failed
+   *
+   * @generated from field: string state = 2;
+   */
+  state: string;
+};
+
+/**
+ * Describes the message quixos.runtime.InvocationStatus.
+ * Use `create(InvocationStatusSchema)` to create a new message.
+ */
+export const InvocationStatusSchema: GenMessage<InvocationStatus> = /*@__PURE__*/
+  messageDesc(file_quixos_runtime, 4);
+
 /**
  * @generated from message quixos.runtime.InvokeRequest
  */
@@ -88,6 +193,11 @@ export type InvokeRequest = Message<"quixos.runtime.InvokeRequest"> & {
    * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
    */
   dependencies: InjectedDependency[];
+
+  /**
+   * @generated from field: quixos.runtime.InvocationContext context = 6;
+   */
+  context?: InvocationContext | undefined;
 };
 
 /**
@@ -95,7 +205,7 @@ export type InvokeRequest = Message<"quixos.runtime.InvokeRequest"> & {
  * Use `create(InvokeRequestSchema)` to create a new message.
  */
 export const InvokeRequestSchema: GenMessage<InvokeRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_runtime, 2);
+  messageDesc(file_quixos_runtime, 5);
 
 /**
  * @generated from message quixos.runtime.InvokeResponse
@@ -115,6 +225,11 @@ export type InvokeResponse = Message<"quixos.runtime.InvokeResponse"> & {
    * @generated from field: string error = 3;
    */
   error: string;
+
+  /**
+   * @generated from field: repeated quixos.runtime.DerivedDependency dependencies = 4;
+   */
+  dependencies: DerivedDependency[];
 };
 
 /**
@@ -122,7 +237,7 @@ export type InvokeResponse = Message<"quixos.runtime.InvokeResponse"> & {
  * Use `create(InvokeResponseSchema)` to create a new message.
  */
 export const InvokeResponseSchema: GenMessage<InvokeResponse> = /*@__PURE__*/
-  messageDesc(file_quixos_runtime, 3);
+  messageDesc(file_quixos_runtime, 6);
 
 /**
  * @generated from message quixos.runtime.WatchRequest
@@ -152,6 +267,11 @@ export type WatchRequest = Message<"quixos.runtime.WatchRequest"> & {
    * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
    */
   dependencies: InjectedDependency[];
+
+  /**
+   * @generated from field: quixos.runtime.InvocationContext context = 6;
+   */
+  context?: InvocationContext | undefined;
 };
 
 /**
@@ -159,7 +279,7 @@ export type WatchRequest = Message<"quixos.runtime.WatchRequest"> & {
  * Use `create(WatchRequestSchema)` to create a new message.
  */
 export const WatchRequestSchema: GenMessage<WatchRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_runtime, 4);
+  messageDesc(file_quixos_runtime, 7);
 
 /**
  * @generated from message quixos.runtime.DerivedDependency
@@ -191,7 +311,7 @@ export type DerivedDependency = Message<"quixos.runtime.DerivedDependency"> & {
  * Use `create(DerivedDependencySchema)` to create a new message.
  */
 export const DerivedDependencySchema: GenMessage<DerivedDependency> = /*@__PURE__*/
-  messageDesc(file_quixos_runtime, 5);
+  messageDesc(file_quixos_runtime, 8);
 
 /**
  * @generated from message quixos.runtime.WatchEvent
@@ -228,7 +348,7 @@ export type WatchEvent = Message<"quixos.runtime.WatchEvent"> & {
  * Use `create(WatchEventSchema)` to create a new message.
  */
 export const WatchEventSchema: GenMessage<WatchEvent> = /*@__PURE__*/
-  messageDesc(file_quixos_runtime, 6);
+  messageDesc(file_quixos_runtime, 9);
 
 /**
  * @generated from service quixos.runtime.PackageRuntime
@@ -258,6 +378,22 @@ export const PackageRuntime: GenService<{
     input: typeof WatchRequestSchema;
     output: typeof WatchEventSchema;
   },
+  /**
+   * @generated from rpc quixos.runtime.PackageRuntime.GetInvocationStatus
+   */
+  getInvocationStatus: {
+    methodKind: "unary";
+    input: typeof InvocationControlRequestSchema;
+    output: typeof InvocationStatusSchema;
+  },
+  /**
+   * @generated from rpc quixos.runtime.PackageRuntime.CancelInvocation
+   */
+  cancelInvocation: {
+    methodKind: "unary";
+    input: typeof InvocationControlRequestSchema;
+    output: typeof InvocationStatusSchema;
+  },
 }> = /*@__PURE__*/
   serviceDesc(file_quixos_runtime, 0);
 

src/references.ts

@@ -0,0 +1,49 @@
+/** Opaque runtime identity. The wire codec, never ordinary package state, owns
+ * the raw ID. These handles do not themselves confer authority or a lease. */
+const identities = new WeakMap<object, string>();
+declare const referenceBrand: unique symbol;
+export interface QxObjectRef<Identity extends string = string> {
+  readonly [referenceBrand]: { readonly [K in Identity]: true };
+  equals(other: QxObjectRef<string>): boolean;
+}
+class Reference {
+  constructor(id: string) {
+    identities.set(this, id);
+    Object.freeze(this);
+  }
+  equals(other: unknown) {
+    return isObjectReference(other) && identities.get(this) === identities.get(other);
+  }
+  toJSON(): never {
+    throw new Error("Object references cannot be serialized into ordinary data");
+  }
+  toString(): never {
+    throw new Error("Object references cannot be coerced to strings");
+  }
+  [Symbol.toPrimitive](): never {
+    throw new Error("Object references cannot be coerced to scalar values");
+  }
+}
+export const isObjectReference = (value: unknown): value is QxObjectRef =>
+  typeof value === "object" && value !== null && identities.has(value);
+
+/** Internal transport boundary; intentionally not exported from the SDK entry. */
+export const referenceFromWire = (id: string): QxObjectRef => {
+  if (typeof id !== "string" || !id) throw new Error("Missing object reference identity");
+  return new Reference(id) as unknown as QxObjectRef;
+};
+export const referenceToWire = (value: unknown): string => {
+  if (!isObjectReference(value)) throw new Error("Expected an opaque object reference, not a raw ID");
+  return identities.get(value)!;
+};
+export const assertReferenceFree = (value: unknown, seen = new Set<object>()): void => {
+  if (!value || typeof value !== "object") return;
+  if (isObjectReference(value))
+    throw new Error(
+      "Managed references belong in declared RPC references or graph relationships, not ordinary state/messages",
+    );
+  if (seen.has(value)) throw new Error("Cyclic ordinary data");
+  seen.add(value);
+  if (!(value instanceof Uint8Array)) for (const child of Object.values(value)) assertReferenceFree(child, seen);
+  seen.delete(value);
+};

src/relationships.ts

@@ -0,0 +1,76 @@
+import type { QxObjectRef } from "./references.js";
+import type { RelationshipCollection, RelationshipEntry } from "./index.js";
+type Key = string | boolean | bigint;
+type Port<T extends QxObjectRef> = {
+  collection(): Promise<RelationshipCollection<T>>;
+  replace(entries: RelationshipEntry<T>[], expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+const checked = async <T extends QxObjectRef>(port: Port<T>, revision: bigint) => {
+  const snapshot = await port.collection();
+  if (snapshot.revision !== revision) throw new Error("STALE_COLLECTION_REVISION");
+  return snapshot;
+};
+/** Helpers never retry a failed CAS or silently overwrite concurrent edits. */
+export const relationshipMap = <T extends QxObjectRef, K extends Key = Key>(port: Port<T>) => ({
+  read: () => port.collection(),
+  async get(key: K) {
+    const snapshot = await port.collection();
+    return { revision: snapshot.revision, value: snapshot.entries.find((entry) => entry.key === key)?.target };
+  },
+  async set(key: K, target: T, expectedRevision: bigint) {
+    const snapshot = await checked(port, expectedRevision);
+    const entries = snapshot.entries.filter((entry) => entry.key !== key);
+    const existing = snapshot.entries.find((entry) => entry.key === key && entry.target.equals(target));
+    entries.push(existing ?? { key, target });
+    return port.replace(entries, expectedRevision);
+  },
+  async delete(key: K, expectedRevision: bigint) {
+    const snapshot = await checked(port, expectedRevision);
+    return port.replace(
+      snapshot.entries.filter((entry) => entry.key !== key),
+      expectedRevision,
+    );
+  },
+});
+export const relationshipList = <T extends QxObjectRef>(port: Port<T>) => ({
+  read: () => port.collection(),
+  async insert(index: number, target: T, expectedRevision: bigint) {
+    const snapshot = await checked(port, expectedRevision);
+    if (!Number.isSafeInteger(index) || index < 0 || index > snapshot.entries.length)
+      throw new Error("List index out of bounds");
+    snapshot.entries.splice(index, 0, { target });
+    return port.replace(snapshot.entries, expectedRevision);
+  },
+  async move(edgeId: string, index: number, expectedRevision: bigint) {
+    const snapshot = await checked(port, expectedRevision);
+    const prior = snapshot.entries.findIndex((entry) => entry.edgeId === edgeId);
+    if (prior < 0 || !Number.isSafeInteger(index) || index < 0 || index >= snapshot.entries.length)
+      throw new Error("Unknown list entry or invalid index");
+    const [entry] = snapshot.entries.splice(prior, 1);
+    snapshot.entries.splice(index, 0, entry);
+    return port.replace(snapshot.entries, expectedRevision);
+  },
+  async delete(edgeId: string, expectedRevision: bigint) {
+    const snapshot = await checked(port, expectedRevision);
+    if (!snapshot.entries.some((entry) => entry.edgeId === edgeId)) throw new Error("Unknown list entry");
+    return port.replace(
+      snapshot.entries.filter((entry) => entry.edgeId !== edgeId),
+      expectedRevision,
+    );
+  },
+});
+export const relationshipSet = <T extends QxObjectRef>(port: Port<T>) => ({
+  read: () => port.collection(),
+  async add(target: T, expectedRevision: bigint) {
+    const snapshot = await checked(port, expectedRevision);
+    if (snapshot.entries.some((entry) => entry.target.equals(target))) return snapshot;
+    return port.replace([...snapshot.entries, { target }], expectedRevision);
+  },
+  async delete(target: T, expectedRevision: bigint) {
+    const snapshot = await checked(port, expectedRevision);
+    return port.replace(
+      snapshot.entries.filter((entry) => !entry.target.equals(target)),
+      expectedRevision,
+    );
+  },
+});

test/bindings.test.mjs

@@ -0,0 +1,212 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { referenceFromWire } from "../dist/references.js";
+import {
+  bindQxHandler,
+  decodeQxValue,
+  encodeQxValue,
+  jsToProtoValue,
+  liveValue,
+  protoValueToJs,
+} from "../dist/index.js";
+const scalar = (name) => ({ kind: "scalar", name });
+const unit = { kind: "builtin", name: "unit" };
+test("free function handlers never acquire a receiver or object session", async () => {
+  const handler = bindQxHandler(
+    { receiver: "none", inputType: unit, outputType: unit, ports: {} },
+    async (context) => {
+      assert.equal("objectId" in context, false);
+      assert.equal("openSession" in context, false);
+    },
+    {},
+  );
+  await handler({
+    inputProto: {},
+    get objectId() {
+      throw new Error("no receiver exists");
+    },
+    openSession() {
+      assert.fail("no object session");
+    },
+  });
+});
+test("React props no longer have an opaque-message reference escape hatch", () => {
+  const descriptorId = "org.quixos.web-studio.ReactProps";
+  const reference = referenceFromWire("obj:task");
+  const type = { kind: "message", descriptorId };
+  const messages = { [descriptorId]: { encode: jsToProtoValue, decode: protoValueToJs } };
+  assert.throws(() => encodeQxValue(type, { subject: reference }, messages), /Managed references/);
+  assert.throws(() => decodeQxValue(type, jsToProtoValue({ subject: reference }), messages), /Managed references/);
+});
+test("declared record inputs preserve opaque references without opening message codecs", async () => {
+  const target = referenceFromWire("obj:board");
+  const type = {
+    kind: "record",
+    fields: {
+      target: { kind: "object-ref", expectation: { kind: "atom", atomId: "board" } },
+      x: scalar("double"),
+      note: { kind: "optional", value: scalar("string") },
+    },
+  };
+  const encoded = encodeQxValue(type, { target, x: 12 }, {});
+  const decoded = decodeQxValue(type, encoded, {});
+  assert.ok(decoded.target.equals(target));
+  assert.equal(decoded.x, 12);
+  assert.equal(decoded.note, null);
+  assert.throws(() => JSON.stringify(decoded), /cannot be serialized/);
+  assert.throws(() => encodeQxValue(type, { target, x: 12, hidden: target }, {}), /Unexpected/);
+  assert.throws(() => encodeQxValue(type, { x: 12 }, {}), /Missing/);
+  assert.throws(() => encodeQxValue(type, { target: "obj:board", x: 12 }, {}), /opaque object reference/);
+  const handler = bindQxHandler(
+    { inputType: type, outputType: unit, ports: {} },
+    async (context) => {
+      assert.ok(context.input.target.equals(target));
+      assert.equal(context.input.x, 12);
+    },
+    {},
+  );
+  await handler({ objectId: target, inputProto: encoded.kind.value.fields });
+});
+test("typed sessions rebind ports and cancellation to each acquired invocation", async () => {
+  const first = new AbortController(),
+    second = new AbortController();
+  let closed = false;
+  const context = (value, signal) => ({
+    objectId: referenceFromWire("obj:owner"),
+    inputProto: {},
+    signal,
+    state: () => ({ live: async () => liveValue(jsToProtoValue(value)) }),
+  });
+  const raw = {
+    ...context(1n, first.signal),
+    openSession: async () => ({
+      id: "session:test",
+      run: (work) => work(context(2n, second.signal)),
+      close: async () => {
+        closed = true;
+      },
+    }),
+  };
+  const handler = bindQxHandler(
+    {
+      inputType: unit,
+      outputType: unit,
+      ports: { counter: { kind: "state", id: "counter", valueType: scalar("int64"), primitives: ["read"] } },
+    },
+    async (bound) => {
+      assert.equal(bound.signal, first.signal);
+      const session = await bound.openSession();
+      await session.run(async (next) => {
+        assert.equal(next.signal, second.signal);
+        assert.equal(await next.ports.counter.get(), 2n);
+        assert.equal(next.openSession, undefined);
+      });
+      await session.close();
+    },
+    {},
+  );
+  await handler(raw);
+  assert.equal(closed, true);
+});
+test("binding codecs round trip nested bytes, 64-bit integers, nulls, and references", () => {
+  const values = [
+    [scalar("int64"), -(2n ** 63n)],
+    [scalar("uint64"), 2n ** 64n - 1n],
+    [scalar("bytes"), new Uint8Array([0, 255])],
+    [{ kind: "list", value: { kind: "optional", value: scalar("int64") } }, [null, 2n ** 60n]],
+    [{ kind: "object-ref", expectation: { kind: "atom", atomId: "thing" } }, referenceFromWire("obj:thing")],
+  ];
+  for (const [type, value] of values) assert.deepEqual(decodeQxValue(type, encodeQxValue(type, value, {}), {}), value);
+});
+
+test("opaque references pass declared RPC boundaries but cannot enter ordinary data", () => {
+  const reference = referenceFromWire("obj:thing");
+  const type = { kind: "object-ref", expectation: { kind: "atom", atomId: "thing" } };
+  const roundtrip = decodeQxValue(type, encodeQxValue(type, reference, {}), {});
+  assert.equal(reference.equals(roundtrip), true);
+  assert.equal(reference.equals(referenceFromWire("obj:other")), false);
+  assert.throws(() => JSON.stringify({ nested: [reference] }), /cannot be serialized/);
+  assert.throws(() => String(reference), /cannot be coerced/);
+  assert.throws(() => encodeQxValue(type, "obj:thing", {}), /opaque/);
+  assert.throws(() => encodeQxValue(scalar("string"), reference, {}), /Managed references/);
+  const message = { kind: "message", descriptorId: "Payload" };
+  assert.throws(
+    () => encodeQxValue(message, { nested: reference }, { Payload: { encode: jsToProtoValue } }),
+    /Managed references/,
+  );
+  assert.throws(
+    () => encodeQxValue(message, {}, { Payload: { encode: () => jsToProtoValue(reference) } }),
+    /Managed references/,
+  );
+  assert.throws(
+    () => decodeQxValue(message, jsToProtoValue(reference), { Payload: { decode: () => ({}) } }),
+    /Managed references/,
+  );
+});
+test("typed state and interface ports preserve declared values and exact operation IDs", async () => {
+  const spec = {
+    inputType: scalar("int64"),
+    outputType: scalar("bytes"),
+    ports: {
+      data: { kind: "state", id: "state-id", valueType: scalar("int64"), primitives: ["read", "write"] },
+      reader: {
+        kind: "interface",
+        id: "interface-id",
+        operations: { "payload.get": { id: "get-id", inputType: unit, outputType: scalar("bytes") } },
+      },
+    },
+  };
+  let written;
+  const handler = bindQxHandler(
+    spec,
+    async ({ input, ports }) => {
+      assert.equal(input, 2n ** 60n);
+      assert.equal(await ports.data.get(), 9n);
+      assert.deepEqual((await ports.data.live()).$quixosValue, jsToProtoValue(9n));
+      assert.ok(ports.reader.objectId.equals(referenceFromWire("obj:reader")));
+      assert.deepEqual((await ports.reader.live["payload.get"]()).$quixosValue, jsToProtoValue(new Uint8Array([7])));
+      await ports.data.set(input);
+      return ports.reader["payload.get"]();
+    },
+    {},
+  );
+  const result = await handler({
+    inputProto: { value: jsToProtoValue(2n ** 60n) },
+    objectId: "obj",
+    state: (id) => {
+      assert.equal(id, "state-id");
+      return {
+        live: async () => liveValue(jsToProtoValue(9n)),
+        set: async (value) => {
+          written = value;
+        },
+      };
+    },
+    interface: (id) => {
+      assert.equal(id, "interface-id");
+      return {
+        objectId: referenceFromWire("obj:reader"),
+        live: async (operation, input) => {
+          assert.equal(operation, "get-id");
+          assert.deepEqual(input, {});
+          return liveValue(jsToProtoValue(new Uint8Array([7])));
+        },
+      };
+    },
+  });
+  assert.equal(written.$quixosValue.kind.value, String(2n ** 60n));
+  assert.deepEqual(result.$quixosValue.kind.value, new Uint8Array([7]));
+});
+test("external message bindings and derived event types are used at the boundary", async () => {
+  const message = { kind: "message", descriptorId: "Payload" };
+  const messages = { Payload: { encode: jsToProtoValue, decode: protoValueToJs } };
+  const handler = bindQxHandler(
+    { inputType: message, outputType: { kind: "builtin", name: "watch-handle" }, eventType: message, ports: {} },
+    { kind: "derived", get: ({ input }) => ({ value: input.title }) },
+    messages,
+  );
+  assert.equal(handler.kind, "derived");
+  const result = await handler.get({ objectId: "obj", inputProto: { title: jsToProtoValue("hello") } });
+  assert.deepEqual(protoValueToJs(result.$quixosValue), { value: "hello" });
+  assert.throws(() => encodeQxValue(message, {}, {}), /Missing message binding/);
+});

test/conformance.test.mjs

@@ -0,0 +1,72 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { bindQxHandler, createRuntimeContext, defineQxInterfaceContract, jsToProtoValue } from "../dist/index.js";
+import { referenceFromWire } from "../dist/references.js";
+
+const unit = { kind: "builtin", name: "unit" };
+test("generated conformance views use checked codecs and retain their fence on invocation", async () => {
+  const contract = defineQxInterfaceContract("Named", {
+    "name.get": { id: "get", inputType: unit, outputType: { kind: "scalar", name: "string" } },
+  });
+  const object = referenceFromWire("object");
+  const witness = {
+    objectId: "object",
+    interfaceRevisionId: "Named",
+    workspaceEpoch: "1",
+    workspaceRevisionId: "w",
+    conformanceId: "named",
+  };
+  const requests = [];
+  const raw = createRuntimeContext(
+    {},
+    {
+      async tryConform(request) {
+        requests.push(request);
+        return { conformance: witness };
+      },
+      async invokeCapability(request) {
+        for (const key of Object.keys(witness)) assert.equal(request.capability.conformance[key], witness[key]);
+        assert.deepEqual(request.input, {});
+        return { ok: true, result: jsToProtoValue("Hello"), dependencies: [] };
+      },
+    },
+    { objectId: "object", input: {}, dependencies: [] },
+  );
+  const handler = bindQxHandler(
+    { inputType: unit, outputType: unit, ports: {} },
+    async (context) => {
+      const view = await context.conform.tryConform(object, contract);
+      assert.ok(view.objectId.equals(object));
+      assert.equal(view.contract, contract);
+      assert.equal(await view["name.get"](), "Hello");
+    },
+    {},
+  );
+  await handler(raw);
+  assert.deepEqual(requests, [{ objectId: "object", interfaceRevisionId: "Named" }]);
+});
+
+test("package discovery preserves absence and denied errors and refuses raw IDs", async () => {
+  const request = { objectId: "object", input: {}, dependencies: [] };
+  const raw = createRuntimeContext(
+    {},
+    {
+      async tryConform() {
+        return {};
+      },
+    },
+    request,
+  );
+  assert.equal(await raw.tryConform(referenceFromWire("object"), "Missing"), undefined);
+  await assert.rejects(raw.tryConform("object", "Named"), /opaque object reference/);
+  const denied = createRuntimeContext(
+    {},
+    {
+      async tryConform() {
+        throw Error("permission denied");
+      },
+    },
+    request,
+  );
+  await assert.rejects(denied.tryConform(referenceFromWire("object"), "Named"), /permission denied/);
+});

test/credential-file.test.mjs

@@ -0,0 +1,47 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+
+test("supervised SDK reads a credential file and proves instance identity without an environment token", async (t) => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "qx-sdk-credential-"));
+  t.after(() => fs.rm(directory, { recursive: true, force: true }));
+  const token = crypto.randomBytes(32).toString("hex");
+  const filename = path.join(directory, "process-token");
+  await fs.writeFile(filename, token, { mode: 0o600 });
+  const env = {
+    ...process.env,
+    CAMINO_RUNTIME_AUTH_TOKEN_FILE: filename,
+    CAMINO_RUNTIME_AUTH_REQUIRED: "1",
+    QUIXOS_RUNTIME_INSTANCE_ID: "instance:test",
+  };
+  delete env.CAMINO_RUNTIME_AUTH_TOKEN;
+  const result = spawnSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "-e",
+      `
+    import {createPackageRuntimeRoutes} from ${JSON.stringify(new URL("../dist/index.js", import.meta.url).href)};
+    createPackageRuntimeRoutes({packageRevisionId:'package:test',exports:{}})({
+      service(_type, implementation) { console.log(JSON.stringify(implementation.handshake({nonce:'challenge'}))); }
+    });
+  `,
+    ],
+    { env, encoding: "utf8" },
+  );
+  assert.equal(result.status, 0, result.stderr);
+  const handshake = JSON.parse(result.stdout);
+  assert.equal(
+    handshake.authenticationProof,
+    crypto
+      .createHmac("sha256", token)
+      .update(JSON.stringify(["challenge", "instance:test", "package:test"]))
+      .digest("hex"),
+  );
+  assert.ok(handshake.capabilities.includes("epoch-grants-v1"));
+  assert.ok(!result.stdout.includes(token));
+});

test/invocations.test.mjs

@@ -0,0 +1,15 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createInvocationRegistry } from "../dist/invocations.js";
+
+test("cancel requests do not acknowledge execution completion or allow replay", () => {
+  const registry = createInvocationRegistry();
+  const execution = registry.begin("call-1");
+  assert.equal(registry.cancel("call-1").state, "cancellation-requested");
+  assert.equal(execution.signal.aborted, true);
+  assert.equal(registry.status("call-1").state, "cancellation-requested");
+  execution.finish();
+  assert.equal(registry.status("call-1").state, "completed");
+  assert.throws(() => registry.begin("call-1"), /already used/);
+  assert.equal(registry.status("missing").state, "unknown");
+});

test/migration.test.mjs

@@ -0,0 +1,36 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createMigrationContext, migrationObjectId } from "../dist/migration.js";
+test("migration context offers restricted ports and deterministic helper identities", () => {
+  const input = {
+    schemaVersion: 1,
+    executionId: "operation:transition",
+    exportId: "migrate",
+    ports: [
+      {
+        name: "old",
+        binding: "slot:name",
+        view: "old",
+        access: ["read"],
+        states: [{ objectId: "obj:one", value: "Alice" }],
+      },
+      { name: "new", binding: "slot:name", view: "new", access: ["write"] },
+      { name: "newRead", binding: "slot:name", view: "new", access: ["read"] },
+      { name: "helpers", binding: "atom:helper", view: "new", access: ["create"] },
+    ],
+  };
+  const { context, result } = createMigrationContext(input);
+  assert.equal(context.read("old", "obj:one"), "Alice");
+  assert.throws(() => context.write("old", "obj:one", "Bob"), /does not grant/);
+  assert.throws(() => context.read("new", "obj:one"), /does not grant/);
+  context.write("new", "obj:one", "Alice");
+  assert.equal(context.read("newRead", "obj:one"), "Alice");
+  context.write("new", "obj:one", "Bob");
+  assert.equal(context.read("newRead", "obj:one"), "Bob");
+  assert.equal(context.read("old", "obj:one"), "Alice");
+  const helper = context.create("helpers", "one");
+  assert.equal(helper, migrationObjectId(input.executionId, "helpers", "one"));
+  assert.equal(context.create("helpers", "one"), helper);
+  assert.equal(result().creates.length, 1);
+  assert.deepEqual(input.ports[0].states, [{ objectId: "obj:one", value: "Alice" }]);
+});

test/queries.test.mjs

@@ -0,0 +1,63 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { create } from "@bufbuild/protobuf";
+import { QueryResponseSchema } from "../dist/camino/api_pb.js";
+import { InjectedDependencySchema } from "../dist/quixos/refs_pb.js";
+import { createRuntimeContext, decodeQuerySnapshot, jsToProtoValue, protoValueToJs } from "../dist/index.js";
+
+test("private relational captures cannot be decoded as a completed public query", () => {
+  const response = create(QueryResponseSchema, { relationalCaptures: [{ rootObjectId: "obj:private" }] });
+  assert.throws(
+    () => decodeQuerySnapshot(response, { kind: "record", fields: {} }, "run", 1n),
+    /QUERY_RESULT_UNFINISHED/,
+  );
+});
+
+test("query ports carry only an injected query identity and root", async () => {
+  let seen;
+  const context = createRuntimeContext(
+    {},
+    {
+      executeQuery: async (request) => {
+        seen = request;
+        return create(QueryResponseSchema);
+      },
+    },
+    {
+      objectId: "obj:receiver",
+      input: {},
+      dependencies: [
+        create(InjectedDependencySchema, {
+          portId: "list",
+          objectId: "obj:collection",
+          binding: { case: "queryId", value: "pkg@1:upcoming" },
+        }),
+      ],
+    },
+  );
+  await context.query("list").execute({ first: jsToProtoValue(30) }, "checked-definition");
+  assert.equal(seen.expectedDefinitionDigest, "checked-definition");
+  assert.equal(seen.objectId, "obj:collection");
+  assert.equal(seen.queryId, "pkg@1:upcoming");
+  assert.equal(protoValueToJs(seen.variables.first), 30);
+  assert.throws(() => context.query("not-injected"), /Missing/);
+});
+
+test("query snapshots distinguish an unavailable scalar from a successful null", () => {
+  const output = {
+    kind: "record",
+    fields: { title: { kind: "scalar", name: "string" }, score: { kind: "scalar", name: "int64" } },
+  };
+  const response = create(QueryResponseSchema, {
+    value: jsToProtoValue({ title: "Native title", score: null }),
+    pending: [{ path: [{ part: { case: "field", value: "score" } }] }],
+  });
+  const snapshot = decodeQuerySnapshot(response, output, "run1", 1n);
+  assert.equal(snapshot.status, "partial");
+  assert.deepEqual(snapshot.data, { title: "Native title" });
+  assert.deepEqual(snapshot.fields, [{ path: ["score"], status: "pending" }]);
+  assert.equal(output.fields.score.kind, "scalar");
+  response.pending = [];
+  response.value = jsToProtoValue({ title: "Native title", score: 9007199254740993n });
+  assert.equal(decodeQuerySnapshot(response, output, "run1", 2n).data.score, 9007199254740993n);
+});

test/relationships.test.mjs

@@ -0,0 +1,34 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { relationshipMap, relationshipList, relationshipSet } from "../dist/index.js";
+import { referenceFromWire } from "../dist/references.js";
+test("relationship helpers preserve handles and require explicit collection revisions", async () => {
+  let current = { revision: 0n, entries: [] },
+    serial = 0;
+  const port = {
+    collection: async () => ({ revision: current.revision, entries: current.entries.map((entry) => ({ ...entry })) }),
+    replace: async (entries, revision) => {
+      assert.equal(revision, current.revision);
+      current = {
+        revision: revision + 1n,
+        entries: entries.map((entry) => ({ ...entry, edgeId: entry.edgeId ?? `edge:${++serial}` })),
+      };
+      return port.collection();
+    },
+  };
+  const a = referenceFromWire("obj:a"),
+    b = referenceFromWire("obj:b");
+  const map = relationshipMap(port);
+  await map.set("a1", a, 0n);
+  assert.equal((await map.get("a1")).value.equals(a), true);
+  await assert.rejects(() => map.set("b1", b, 0n), /STALE_COLLECTION/);
+  await map.delete("a1", 1n);
+  const list = relationshipList(port);
+  const inserted = await list.insert(0, a, 2n);
+  await list.insert(1, b, 3n);
+  const moved = await list.move(inserted.entries[0].edgeId, 1, 4n);
+  assert.equal(moved.entries[1].target.equals(a), true);
+  const set = relationshipSet(port);
+  const unchanged = await set.add(referenceFromWire("obj:a"), 5n);
+  assert.equal(unchanged.revision, 5n);
+});

test/runtime.test.mjs

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import http from "node:http";
 import test from "node:test";
+import { referenceFromWire } from "../dist/references.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient } from "@connectrpc/connect";
 import { connectNodeAdapter, createConnectTransport } from "@connectrpc/connect-node";
@@ -9,18 +10,20 @@ import {
   createRuntimeContext,
   derived,
   jsToProtoValue,
+  liveValue,
   protoValueToJs,
 } from "../dist/index.js";
 import {
   CaminoObjectSchema,
   CaminoService,
+  CrdtValueSchema,
+  StateValueSourceSchema,
+  ValueSchema,
+  ValueSourceSchema,
 } from "../dist/camino/api_pb.js";
-import {
+import { EdgeDependencySchema, InjectedDependencySchema, PackageExportRefSchema } from "../dist/quixos/refs_pb.js";
-  EdgeDependencySchema,
+import { InvokeCapabilityResponseSchema, OrchestratorRuntime } from "../dist/quixos/orch_pb.js";
-  InjectedDependencySchema,
+import { DerivedDependencySchema, PackageRuntime } from "../dist/quixos/runtime_pb.js";
-  PackageExportRefSchema,
-} from "../dist/quixos/refs_pb.js";
-import { PackageRuntime } from "../dist/quixos/runtime_pb.js";
 
 const listen = async (routes) => {
   const server = http.createServer((request, response) => void connectNodeAdapter({ routes })(request, response));
@@ -39,16 +42,40 @@ const listen = async (routes) => {
 test("generic values preserve nested values and object references", () => {
   const value = jsToProtoValue({
     title: "A task",
-    target: { $quixosRef: "obj:target" },
+    target: referenceFromWire("obj:target"),
     tags: ["one", "two"],
   });
   assert.deepEqual(protoValueToJs(value), {
     title: "A task",
-    target: "obj:target",
+    target: referenceFromWire("obj:target"),
     tags: ["one", "two"],
   });
 });
 
+test("live values preserve writable CRDT source identity through derivation", () => {
+  const value = create(ValueSchema, {
+    kind: { case: "stringValue", value: "notes" },
+    source: create(ValueSourceSchema, {
+      state: create(StateValueSourceSchema, {
+        objectId: "obj:task",
+        slotId: "slot:task:notes",
+        revision: 7n,
+        crdtSnapshot: create(CrdtValueSchema, {
+          type: "quixos.automerge-document.v1",
+          encoding: "automerge-snapshot-v1",
+          payload: new Uint8Array([1, 2, 3]),
+        }),
+      }),
+    }),
+  });
+
+  const forwarded = jsToProtoValue(liveValue(value));
+  assert.equal(forwarded.source?.state?.objectId, "obj:task");
+  assert.equal(forwarded.source?.state?.slotId, "slot:task:notes");
+  assert.equal(forwarded.source?.state?.revision, 7n);
+  assert.deepEqual(forwarded.source?.state?.crdtSnapshot?.payload, new Uint8Array([1, 2, 3]));
+});
+
 test("runtime context exposes only explicitly injected ports", async () => {
   const writes = [];
   const camino = {
@@ -62,7 +89,10 @@ test("runtime context exposes only explicitly injected ports", async () => {
     resolveEdge: async () => ({ edges: [] }),
     connectEdge: async () => ({}),
   };
-  const context = createRuntimeContext(camino, {}, {
+  const context = createRuntimeContext(
+    camino,
+    {},
+    {
       objectId: "obj:task",
       input: {},
       dependencies: [
@@ -81,7 +111,8 @@ test("runtime context exposes only explicitly injected ports", async () => {
           },
         }),
       ],
-  });
+    },
+  );
 
   assert.equal(await context.state("port:title").get(), "obj:task/slot:task:title");
   await context.state("port:title").set("Changed");
@@ -93,11 +124,224 @@ test("runtime context exposes only explicitly injected ports", async () => {
   assert.deepEqual(await context.edge("port:children").resolve(), []);
 });
 
+test("injected ports preserve an explicitly traversed object through PackageRuntime RPC", async () => {
+  const reads = [];
+  const caminoServer = await listen((router) =>
+    router.service(CaminoService, {
+      readState: (request) => {
+        reads.push(request);
+        return { value: jsToProtoValue("Project name") };
+      },
+    }),
+  );
+  const runtimeServer = await listen(
+    createPackageRuntimeRoutes({
+      packageRevisionId: "package:test@1",
+      caminoUrl: caminoServer.url,
+      exports: {
+        "export:test:value": (context) => context.state("port:value").get(),
+      },
+    }),
+  );
+  const client = createClient(
+    PackageRuntime,
+    createConnectTransport({
+      baseUrl: runtimeServer.url,
+      httpVersion: "1.1",
+    }),
+  );
+  try {
+    const response = await client.invoke({
+      export: create(PackageExportRefSchema, {
+        packageRevisionId: "package:test@1",
+        exportId: "export:test:value",
+      }),
+      objectId: "obj:component",
+      dependencies: [
+        create(InjectedDependencySchema, {
+          portId: "port:value",
+          objectId: "obj:project",
+          binding: { case: "stateSlotId", value: "slot:project:name" },
+        }),
+      ],
+    });
+    assert.equal(response.ok, true);
+    assert.equal(protoValueToJs(response.result), "Project name");
+    assert.equal(reads.length, 1);
+    assert.equal(reads[0]?.objectId, "obj:project");
+  } finally {
+    await runtimeServer.close();
+    await caminoServer.close();
+  }
+});
+
+test("interface views invoke a related object and propagate transitive live dependencies", async () => {
+  const invocations = [];
+  const sourceValue = create(ValueSchema, {
+    kind: { case: "stringValue", value: "Project name" },
+    source: create(ValueSourceSchema, {
+      state: create(StateValueSourceSchema, {
+        objectId: "obj:project",
+        slotId: "slot:project:name",
+        revision: 4n,
+      }),
+    }),
+  });
+  const orchServer = await listen((router) =>
+    router.service(OrchestratorRuntime, {
+      invokeCapability: (request) => {
+        invocations.push(request);
+        return create(InvokeCapabilityResponseSchema, {
+          ok: true,
+          result: sourceValue,
+          dependencies: [
+            create(DerivedDependencySchema, {
+              kind: "state",
+              objectId: "obj:project",
+              attachmentId: "slot:project:name",
+            }),
+          ],
+        });
+      },
+    }),
+  );
+  const runtimeServer = await listen(
+    createPackageRuntimeRoutes({
+      packageRevisionId: "package:test@1",
+      orchUrl: orchServer.url,
+      exports: {
+        "export:test:value": derived((context) => context.interface("port:named").live("operation:named:name:get")),
+      },
+    }),
+  );
+  const client = createClient(
+    PackageRuntime,
+    createConnectTransport({
+      baseUrl: runtimeServer.url,
+      httpVersion: "1.1",
+    }),
+  );
+  try {
+    const response = await client.invoke({
+      export: create(PackageExportRefSchema, {
+        packageRevisionId: "package:test@1",
+        exportId: "export:test:value",
+      }),
+      objectId: "obj:component",
+      dependencies: [
+        create(InjectedDependencySchema, {
+          portId: "port:named",
+          objectId: "obj:project",
+          binding: { case: "interfaceRevisionId", value: "interface:named@1" },
+        }),
+      ],
+    });
+    assert.equal(response.ok, true);
+    assert.equal(invocations[0]?.objectId, "obj:project");
+    assert.equal(invocations[0]?.capability?.interfaceRevisionId, "interface:named@1");
+    assert.equal(response.dependencies[0]?.objectId, "obj:project");
+    assert.equal(response.dependencies[0]?.attachmentId, "slot:project:name");
+    assert.equal(response.result?.source?.state?.revision, 4n);
+  } finally {
+    await runtimeServer.close();
+    await orchServer.close();
+  }
+});
+
+test("derived interface views reread after their transitive subscriptions become live", async () => {
+  let current = "before subscription";
+  let invocationCount = 0;
+  const caminoServer = await listen((router) =>
+    router.service(CaminoService, {
+      watchObject: async function* (request, context) {
+        // Model a write racing the first nested capability read. Camino makes
+        // the subscription live before yielding this snapshot.
+        current = "after subscription";
+        yield {
+          objectId: request.objectId,
+          snapshot: create(CaminoObjectSchema, {
+            id: request.objectId,
+            atomId: "atom:project",
+            workspaceRevisionId: "workspace:test@1",
+          }),
+        };
+        await new Promise((resolve) => context.signal.addEventListener("abort", resolve, { once: true }));
+      },
+    }),
+  );
+  const orchServer = await listen((router) =>
+    router.service(OrchestratorRuntime, {
+      invokeCapability: () => {
+        invocationCount += 1;
+        return create(InvokeCapabilityResponseSchema, {
+          ok: true,
+          result: jsToProtoValue(current),
+          dependencies: [
+            create(DerivedDependencySchema, {
+              kind: "state",
+              objectId: "obj:project",
+              attachmentId: "slot:project:name",
+            }),
+          ],
+        });
+      },
+    }),
+  );
+  const runtimeServer = await listen(
+    createPackageRuntimeRoutes({
+      packageRevisionId: "package:test@1",
+      caminoUrl: caminoServer.url,
+      orchUrl: orchServer.url,
+      exports: {
+        "export:test:value": derived((context) => context.interface("port:named").invoke("operation:named:name:get")),
+      },
+    }),
+  );
+  const client = createClient(
+    PackageRuntime,
+    createConnectTransport({
+      baseUrl: runtimeServer.url,
+      httpVersion: "1.1",
+    }),
+  );
+  const controller = new AbortController();
+  try {
+    const stream = client
+      .watch(
+        {
+          export: create(PackageExportRefSchema, {
+            packageRevisionId: "package:test@1",
+            exportId: "export:test:value",
+          }),
+          objectId: "obj:component",
+          dependencies: [
+            create(InjectedDependencySchema, {
+              portId: "port:named",
+              objectId: "obj:project",
+              binding: { case: "interfaceRevisionId", value: "interface:named@1" },
+            }),
+          ],
+        },
+        { signal: controller.signal },
+      )
+      [Symbol.asyncIterator]();
+    const initial = await stream.next();
+    assert.equal(protoValueToJs(initial.value?.value), "after subscription");
+    assert.equal(invocationCount, 2);
+  } finally {
+    controller.abort();
+    await runtimeServer.close();
+    await orchServer.close();
+    await caminoServer.close();
+  }
+});
+
 test("derived watches subscribe before reading and emit only real changes", async () => {
   let current = "before";
   let subscribed = false;
   const changes = [];
-  const caminoServer = await listen((router) => router.service(CaminoService, {
+  const caminoServer = await listen((router) =>
+    router.service(CaminoService, {
       readState: () => {
         assert.equal(subscribed, true, "the dependency stream must be live before the state read");
         return { value: jsToProtoValue(current) };
@@ -122,31 +366,44 @@ test("derived watches subscribe before reading and emit only real changes", asyn
           yield { objectId: request.objectId };
         }
       },
-  }));
+    }),
-  const runtimeServer = await listen(createPackageRuntimeRoutes({
+  );
+  const runtimeServer = await listen(
+    createPackageRuntimeRoutes({
       packageRevisionId: "package:test@1",
       caminoUrl: caminoServer.url,
       exports: {
         "export:test:value": derived((context) => context.state("port:value").get()),
       },
-  }));
+    }),
-  const client = createClient(PackageRuntime, createConnectTransport({
+  );
+  const client = createClient(
+    PackageRuntime,
+    createConnectTransport({
       baseUrl: runtimeServer.url,
       httpVersion: "1.1",
-  }));
+    }),
+  );
   const controller = new AbortController();
   try {
-    const stream = client.watch({
+    const stream = client
+      .watch(
+        {
           export: create(PackageExportRefSchema, {
             packageRevisionId: "package:test@1",
             exportId: "export:test:value",
           }),
           objectId: "obj:test",
-      dependencies: [create(InjectedDependencySchema, {
+          dependencies: [
+            create(InjectedDependencySchema, {
               portId: "port:value",
               binding: { case: "stateSlotId", value: "slot:test:value" },
-      })],
+            }),
-    }, { signal: controller.signal })[Symbol.asyncIterator]();
+          ],
+        },
+        { signal: controller.signal },
+      )
+      [Symbol.asyncIterator]();
     const initial = await stream.next();
     assert.equal(protoValueToJs(initial.value?.value), "before");
     assert.equal(initial.value?.initial, true);