Publish quixos-protocol from 33266c4ba9e0dd7b6370715522b281807e8b038b

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

.quixos-subtree-source.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "sourceRepo": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos.git",
-  "sourceCommit": "2249fe2b76dea4e52b099696c2418f0dd2444f52",
+  "sourceCommit": "33266c4ba9e0dd7b6370715522b281807e8b038b",
   "sourcePath": "quixos-protocol",
   "exportName": "quixos-protocol",
   "mirrorRemote": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"

.yarnrc.yml

@@ -0,0 +1,24 @@
+enableScripts: true
+
+generateDefaultNix: false
+
+individualNixPackaging: true
+
+nodeLinker: node-modules
+
+supportedArchitectures:
+  os:
+    - current
+    - linux
+  cpu:
+    - current
+    - x64
+    - arm64
+  libc:
+    - current
+    - glibc
+
+plugins:
+  - checksum: 271de9a785321a37c564b8e2a6b5cd689850b20572d5fee8ec0a6b8e7a5d4cfb59e533524af2b4a537e00da12828abd062eaec6978556e3dd9149a020db2591b
+    path: .yarn/plugins/yarn-plugin-nixify.cjs
+    spec: "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/yarn-plugin-nixify-patched/raw/commit/4528fdd20b30d869262443b3f044549810e75fb8/dist/yarn-plugin-nixify.js"

README.md

@@ -1,8 +1,121 @@
-# Quixos Protocol
+# Quixos protocol and capability compiler
 
-Shared protobuf definitions for Camino, camino-orch, package descriptors, and
+This package owns the shared protobuf APIs for Camino, `quixos-orch`, package
-future package runtime RPC.
+runtimes, package descriptors, and generic runtime values. It also owns the v1
+capability authoring language and semantic compiler.
 
-This package owns the canonical proto source. Current services still generate
+## Capability language
-local TypeScript bindings from these protos; the generated bindings here are
+
-available for later consolidation.
+The grammar is `grammar/QuixosCapability.g4`. The parser lowers source into the
+parser-independent records in `src/capability-model`; validation then produces
+an immutable checked workspace JSON document. Runtime semantics do not depend
+on parse-tree shapes or declaration order.
+
+```sh
+nix develop
+quixos-workspace-compile \
+  --root ../quixos-instance/workspaces/todo \
+  --checkout-root /tmp/quixos-resolved-resources
+```
+
+`workspace.qx` contains workspace-local atoms, attachments, conformances, and
+constructor bindings. Each imported interface has an `interface.qx` in its own
+repository; each imported package similarly has a `package.qx`. Source
+locations never appear in those declarations. `quixos.lock` supplies their
+exact Git repositories and commits, and the workspace compiler resolves that
+dependency graph recursively.
+
+Inside an interface or package manifest, `import interface Named;` is a true
+source dependency: the repository lock must pin it, and tooling may use the
+full contract for generated types. `external atom` and `external interface`
+declare nominal identities which the final importing workspace must provide.
+The latter is appropriate for relationship targets and other opaque
+references; it deliberately does not grant the contract needed for an
+interface invocation port. This distinction permits mutually referential
+interface identities without creating a cycle in the Git Merkle graph.
+
+The compiler validates exact identities, recursive lock/source agreement,
+external requirement satisfaction, interface operation coverage,
+attachment ownership, native state/edge providers, package receiver and
+dependency-port requirements, constructors, and the exact runtime closure.
+Generics, interface composition, declarative forwarding, automatic
+relationship materialization, and first-class bundles are intentionally absent
+from v1.
+
+## Repository locks
+
+Every workspace, interface, and package repository carries a `quixos.lock`.
+This is not a miniature workspace: a resource lock is only a Quixos toolchain
+pin plus a dependency list. It pins exact Git sources for the interfaces and
+packages named by that resource's own manifest. The v1 Git source is deliberately only a repository
+URL and full commit ID; the publisher-owned reachability tag and Nix fetch
+details are derived from those values.
+
+```sh
+quixos-lock-check quixos.lock
+quixos-resource-compile \
+  --root . --kind package \
+  --repository https://repos.quixos.org/example/package-example.git \
+  --commit 1111111111111111111111111111111111111111 \
+  --checkout-root /tmp/quixos-resource-dependencies
+qx resource publish
+```
+
+The resource compiler validates the local manifest against the recursively
+resolved locks without turning the resource into a workspace. The final
+command runs from a jj checkout. It performs that same recursive compilation,
+snapshots the current working-copy commit, and pushes the immutable tag
+`refs/tags/quixos-reachability/<commit>` without advancing an authoring
+bookmark.
+
+A workspace root may split its resource pins into same-repository fragments:
+
+```text
+quixos-lock version 1 {
+  quixos source {
+    repository "https://repos.quixos.org/quixos/quixos.git";
+    commit "1111111111111111111111111111111111111111";
+  }
+  import "locks/web-studio.lock";
+}
+```
+
+```text
+quixos-lock fragment version 1 {
+  package CanvasRuntime source {
+    repository "https://repos.quixos.org/org-quixos-web-studio/package-canvas-runtime.git";
+    commit "2222222222222222222222222222222222222222";
+  }
+}
+```
+
+Import paths are normalized, repository-root-relative paths. Absolute paths,
+URLs, traversal, empty segments, directories, and symbolic links are rejected.
+Fragments may import other fragments; cycles fail, shared fragments are loaded
+once, and duplicate resource bindings fail across the flattened closure.
+`quixos-lock-check` resolves the complete closure and reports its `sourceFiles`
+alongside the flattened resources. The root Git commit content-addresses every
+fragment, so fragments do not become independent repositories or identities.
+
+## Package descriptors
+
+Executable package metadata remains protobuf text format:
+
+```sh
+quixos-descriptor-check path/to/descriptor.quixos-package.txtpb
+```
+
+Descriptors identify exact package revisions and exported runtime symbols.
+The checked workspace binds interface operations to those exports and supplies
+their exact dependency ports.
+
+## Tests
+
+```sh
+nix develop -c yarn test
+```
+
+The suite covers parsing/diagnostics, recursive repository assembly, external
+requirement validation, source-order independence, ordinary call operations,
+semantic validation, exact closure/tree-shaking, private and shared
+attachments, related-object interface-port injection, and constructors.

flake.nix

@@ -10,26 +10,54 @@
     flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs { inherit system; };
-        quixos-protocol = pkgs.stdenvNoCC.mkDerivation {
+        nodejs = pkgs.nodejs_24;
-          pname = "quixos-protocol";
+        quixos-protocol = (pkgs.callPackage ./yarn-project.nix { inherit nodejs; }) {
-          version = "0.1.0";
+          src = pkgs.lib.cleanSource ./.;
-          src = ./.;
+          overrideAttrs = old: {
-          npmDeps = pkgs.importNpmLock { npmRoot = ./.; };
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-          npmConfigHook = pkgs.importNpmLock.npmConfigHook;
+            pkgs.diffutils
-          nativeBuildInputs = [
+            pkgs.esbuild
-            pkgs.importNpmLock.npmConfigHook
-            pkgs.nodejs_24
             pkgs.protobuf
           ];
           buildPhase = ''
             runHook preBuild
+            mkdir -p "$TMPDIR/generated-before"
+            cp --recursive src/gen "$TMPDIR/generated-before/proto"
+            cp --recursive src/capability-language/generated "$TMPDIR/generated-before/capability"
+            cp --recursive src/resource-lock/generated "$TMPDIR/generated-before/lock"
             export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:$PWD/proto''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
-            npm run build
+            patchShebangs node_modules/.bin node_modules/@bufbuild/protoc-gen-es/bin
+            yarn build
+            diff --recursive --unified "$TMPDIR/generated-before/proto" src/gen
+            diff --recursive --unified "$TMPDIR/generated-before/capability" src/capability-language/generated
+            diff --recursive --unified "$TMPDIR/generated-before/lock" src/resource-lock/generated
+            esbuild dist/src/descriptor-check.js \
+              --bundle --platform=node --target=node24 --format=esm \
+              --outfile=quixos-descriptor-check.mjs
+            esbuild dist/src/capability-language/cli.js \
+              --bundle --platform=node --target=node24 --format=esm \
+              --outfile=quixos-capability-compile.mjs
+            esbuild dist/src/capability-language/workspace-cli.js \
+              --bundle --platform=node --target=node24 --format=esm \
+              --outfile=quixos-workspace-compile.mjs
+            esbuild dist/src/capability-language/resource-cli.js \
+              --bundle --platform=node --target=node24 --format=esm \
+              --outfile=quixos-resource-compile.mjs
+            esbuild dist/src/resource-lock/cli.js \
+              --bundle --platform=node --target=node24 --format=esm \
+              --outfile=quixos-lock-check.mjs
             runHook postBuild
           '';
+          doCheck = true;
+          checkPhase = ''
+            runHook preCheck
+            yarn test
+            runHook postCheck
+          '';
           installPhase = ''
             runHook preInstall
             mkdir -p "$out"
+            cp --reflink=auto --recursive grammar "$out/grammar"
             cp --reflink=auto --recursive proto "$out/proto"
             cp --reflink=auto --recursive dist "$out/dist"
             cp package.json "$out/package.json"
@@ -38,19 +66,47 @@
 #!/bin/sh
 export PATH="${pkgs.protobuf}/bin:\$PATH"
 export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:$out/proto\''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
-exec ${pkgs.nodejs_24}/bin/node "$out/dist/src/descriptor-check.js" "\$@"
+exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs" "\$@"
 EOF
             chmod +x "$out/bin/quixos-descriptor-check"
+            cat > "$out/bin/quixos-capability-compile" <<EOF
+#!/bin/sh
+exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-capability-compile.mjs" "\$@"
+EOF
+            chmod +x "$out/bin/quixos-capability-compile"
+            cat > "$out/bin/quixos-workspace-compile" <<EOF
+#!/bin/sh
+exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-workspace-compile.mjs" "\$@"
+EOF
+            chmod +x "$out/bin/quixos-workspace-compile"
+            cat > "$out/bin/quixos-resource-compile" <<EOF
+#!/bin/sh
+exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-resource-compile.mjs" "\$@"
+EOF
+            chmod +x "$out/bin/quixos-resource-compile"
+            cat > "$out/bin/quixos-lock-check" <<EOF
+#!/bin/sh
+exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-lock-check.mjs" "\$@"
+EOF
+            chmod +x "$out/bin/quixos-lock-check"
+            mkdir -p "$out/libexec/quixos-protocol"
+            install -m644 quixos-descriptor-check.mjs "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs"
+            install -m644 quixos-capability-compile.mjs "$out/libexec/quixos-protocol/quixos-capability-compile.mjs"
+            install -m644 quixos-workspace-compile.mjs "$out/libexec/quixos-protocol/quixos-workspace-compile.mjs"
+            install -m644 quixos-resource-compile.mjs "$out/libexec/quixos-protocol/quixos-resource-compile.mjs"
+            install -m644 quixos-lock-check.mjs "$out/libexec/quixos-protocol/quixos-lock-check.mjs"
             runHook postInstall
           '';
+          };
         };
       in {
         packages.default = quixos-protocol;
+        checks.default = quixos-protocol;
         devShells.default = pkgs.mkShell {
           packages = [
-            pkgs.nodejs_24
+            nodejs
             pkgs.protobuf
-            pkgs.typescript
+            quixos-protocol.yarn-freestanding
             quixos-protocol
           ];
           shellHook = ''

grammar/QuixosCapability.g4

@@ -0,0 +1,428 @@
+grammar QuixosCapability;
+
+document
+  : workspaceDecl EOF
+  | interfaceResourceDecl EOF
+  | packageResourceDecl EOF
+  ;
+
+workspaceDecl
+  : WORKSPACE identifier ID stringLiteral REVISION stringLiteral COMMIT stringLiteral
+    LBRACE workspaceItem* RBRACE
+  ;
+
+workspaceItem
+  : atomDecl
+  | resourceImportDecl
+  | sharedAttachmentDecl
+  | conformanceDecl
+  | constructorBindingDecl
+  ;
+
+resourceImportDecl
+  : IMPORT INTERFACE identifier SEMI
+  | IMPORT PACKAGE identifier SEMI
+  ;
+
+externalAtomDecl
+  : EXTERNAL ATOM identifier ID stringLiteral SEMI
+  ;
+
+externalInterfaceDecl
+  : EXTERNAL INTERFACE identifier REVISION stringLiteral SEMI
+  ;
+
+resourcePreamble
+  : resourceImportDecl
+  | externalAtomDecl
+  | externalInterfaceDecl
+  ;
+
+atomDecl
+  : ATOM identifier ID stringLiteral (DOC stringLiteral)? SEMI
+  ;
+
+interfaceResourceDecl
+  : resourcePreamble* INTERFACE identifier ID stringLiteral REVISION stringLiteral
+    LBRACE interfaceMember* RBRACE
+  ;
+
+interfaceMember
+  : valueMember
+  | relationshipMember
+  | operationMember
+  ;
+
+operationMember
+  : OPERATION identifier ID stringLiteral COLON valueType ARROW valueType
+    LBRACE CALL ID stringLiteral SEMI RBRACE
+  ;
+
+valueMember
+  : VALUE identifier ID stringLiteral COLON valueType
+    LBRACE valueMemberOperation* RBRACE
+  ;
+
+valueMemberOperation
+  : GET ID stringLiteral SEMI
+  | SET ID stringLiteral SEMI
+  | WATCH START ID stringLiteral STOP ID stringLiteral SEMI
+  ;
+
+relationshipMember
+  : RELATION identifier ID stringLiteral COLON cardinality targetConstraint ORDERED?
+    LBRACE relationshipOperation* RBRACE
+  ;
+
+relationshipOperation
+  : RESOLVE ID stringLiteral SEMI
+  | CONNECT ID stringLiteral SEMI
+  | DISCONNECT ID stringLiteral SEMI
+  | WATCH START ID stringLiteral STOP ID stringLiteral SEMI
+  ;
+
+targetConstraint
+  : ATOM identifier
+  | INTERFACE identifier
+  ;
+
+packageResourceDecl
+  : resourcePreamble* PACKAGE identifier ID stringLiteral REVISION stringLiteral
+    LBRACE packageExport* RBRACE
+  ;
+
+packageExport
+  : packageOperationExport
+  | packageFunctionExport
+  | packageConstructorExport
+  ;
+
+packageOperationExport
+  : OPERATION identifier ID stringLiteral COLON valueType ARROW valueType
+    MODE operationMode eventClause? RECEIVER receiverRequirement dependencyBlock? SEMI
+  ;
+
+packageFunctionExport
+  : FUNCTION identifier ID stringLiteral COLON valueType ARROW valueType
+    dependencyBlock? SEMI
+  ;
+
+packageConstructorExport
+  : CONSTRUCTOR identifier ID stringLiteral CONSTRUCTS identifier COLON valueType
+    dependencyBlock? SEMI
+  ;
+
+eventClause
+  : EMITS valueType
+  ;
+
+operationMode
+  : CALL
+  | WATCH_START
+  | WATCH_STOP
+  | SUBSCRIBE
+  | UNSUBSCRIBE
+  ;
+
+receiverRequirement
+  : ANY
+  | ATOM identifier
+  | INTERFACES LBRACK identifierList? RBRACK
+  ;
+
+identifierList
+  : identifier (COMMA identifier)*
+  ;
+
+dependencyBlock
+  : REQUIRES LBRACE dependencyPort* RBRACE
+  ;
+
+dependencyPort
+  : STATE identifier ID stringLiteral COLON valueType primitiveList SEMI
+  | EDGE identifier ID stringLiteral COLON cardinality targetConstraint primitiveList SEMI
+  | INTERFACE identifier ID stringLiteral COLON identifier SEMI
+  | CONSTRUCTOR identifier ID stringLiteral COLON identifier SEMI
+  ;
+
+primitiveList
+  : LBRACK primitive (COMMA primitive)* RBRACK
+  ;
+
+primitive
+  : READ
+  | WRITE
+  | RESOLVE
+  | CONNECT
+  | DISCONNECT
+  | WATCH_START
+  | WATCH_STOP
+  ;
+
+sharedAttachmentDecl
+  : SHARED attachmentDecl
+  ;
+
+attachmentDecl
+  : stateDecl
+  | edgeDecl
+  ;
+
+stateDecl
+  : STATE identifier ID stringLiteral ON identifier COLON valueType
+    POLICY storagePolicy (DEFAULT jsonLiteral)? SEMI
+  ;
+
+storagePolicy
+  : OPTIMISTIC_REGISTER
+  | CRDT LPAREN valueType RPAREN
+  ;
+
+edgeDecl
+  : EDGE identifier ID stringLiteral LBRACE edgeEndpoint edgeEndpoint RBRACE
+  ;
+
+edgeEndpoint
+  : targetConstraint PROJECTION identifier ID stringLiteral cardinality ORDERED? SEMI
+  ;
+
+conformanceDecl
+  : CONFORM identifier AS identifier LBRACE conformanceItem* RBRACE
+  ;
+
+conformanceItem
+  : PRIVATE attachmentDecl
+  | operationBindingDecl
+  | relationshipMaterializationDecl
+  ;
+
+relationshipMaterializationDecl
+  : MATERIALIZE identifier IF ABSENT USING CONSTRUCTOR identifier VIA EDGE identifier DOT identifier SEMI
+  ;
+
+operationBindingDecl
+  : BIND memberOperationRef TO operationProvider SEMI
+  ;
+
+memberOperationRef
+  : identifier DOT operationName
+  ;
+
+operationName
+  : identifier
+  | CALL
+  | GET
+  | SET
+  | RESOLVE
+  | CONNECT
+  | DISCONNECT
+  | WATCH_START
+  | WATCH_STOP
+  | SUBSCRIBE
+  | UNSUBSCRIBE
+  ;
+
+operationProvider
+  : STATE identifier DOT statePrimitive
+  | EDGE identifier DOT identifier DOT edgePrimitive
+  | PACKAGE identifier DOT identifier dependencyBindingBlock?
+  ;
+
+statePrimitive
+  : READ
+  | WRITE
+  | WATCH_START
+  | WATCH_STOP
+  ;
+
+edgePrimitive
+  : RESOLVE
+  | CONNECT
+  | DISCONNECT
+  | WATCH_START
+  | WATCH_STOP
+  ;
+
+dependencyBindingBlock
+  : WITH LBRACE dependencyBinding* RBRACE
+  ;
+
+dependencyBinding
+  : identifier TO STATE identifier (VIA EDGE identifier DOT identifier)? SEMI
+  | identifier TO EDGE identifier DOT identifier (VIA EDGE identifier DOT identifier)? SEMI
+  | identifier TO INTERFACE identifier (VIA EDGE identifier DOT identifier)? SEMI
+  | identifier TO CONSTRUCTOR identifier SEMI
+  ;
+
+constructorBindingDecl
+  : CONSTRUCTOR identifier TO identifier DOT identifier dependencyBindingBlock? SEMI
+  ;
+
+valueType
+  : scalarType
+  | UNIT
+  | WATCH_HANDLE
+  | MESSAGE stringLiteral
+  | ATOM_REF LT identifier GT
+  | INTERFACE_REF LT identifier GT
+  | OPTIONAL LT valueType GT
+  | LIST LT valueType GT
+  ;
+
+scalarType
+  : BOOL
+  | BYTES
+  | DOUBLE
+  | INT32
+  | INT64
+  | STRING
+  | UINT32
+  | UINT64
+  ;
+
+cardinality
+  : OPTIONAL_ONE
+  | EXACTLY_ONE
+  | MANY
+  | MANY_UNIQUE
+  ;
+
+jsonLiteral
+  : stringLiteral
+  | INTEGER
+  | JSON_NUMBER
+  | TRUE
+  | FALSE
+  | NULL
+  | jsonObject
+  | jsonArray
+  ;
+
+jsonObject
+  : LBRACE (jsonMember (COMMA jsonMember)*)? RBRACE
+  ;
+
+jsonMember
+  : stringLiteral COLON jsonLiteral
+  ;
+
+jsonArray
+  : LBRACK (jsonLiteral (COMMA jsonLiteral)*)? RBRACK
+  ;
+
+identifier
+  : IDENTIFIER
+  | SOURCE
+  ;
+
+stringLiteral
+  : STRING_LITERAL
+  ;
+
+WORKSPACE: 'workspace';
+IMPORT: 'import';
+EXTERNAL: 'external';
+ATOM: 'atom';
+INTERFACE: 'interface';
+INTERFACES: 'interfaces';
+PACKAGE: 'package';
+VALUE: 'value';
+RELATION: 'relation';
+OPERATION: 'operation';
+FUNCTION: 'function';
+CONSTRUCTOR: 'constructor';
+CONSTRUCTS: 'constructs';
+CONFORM: 'conform';
+AS: 'as';
+BIND: 'bind';
+TO: 'to';
+PRIVATE: 'private';
+SHARED: 'shared';
+STATE: 'state';
+EDGE: 'edge';
+PROJECTION: 'projection';
+WITH: 'with';
+USING: 'using';
+VIA: 'via';
+MATERIALIZE: 'materialize';
+IF: 'if';
+ABSENT: 'absent';
+ON: 'on';
+POLICY: 'policy';
+DEFAULT: 'default';
+SOURCE: 'source';
+REPOSITORY: 'repository';
+COMMIT: 'commit';
+REVISION: 'revision';
+ID: 'id';
+DOC: 'doc';
+MODE: 'mode';
+EMITS: 'emits';
+RECEIVER: 'receiver';
+REQUIRES: 'requires';
+ANY: 'any';
+GET: 'get';
+SET: 'set';
+WATCH: 'watch';
+START: 'start';
+STOP: 'stop';
+READ: 'read';
+WRITE: 'write';
+RESOLVE: 'resolve';
+CONNECT: 'connect';
+DISCONNECT: 'disconnect';
+CALL: 'call';
+WATCH_START: 'watch-start';
+WATCH_STOP: 'watch-stop';
+SUBSCRIBE: 'subscribe';
+UNSUBSCRIBE: 'unsubscribe';
+OPTIMISTIC_REGISTER: 'optimistic-register';
+CRDT: 'crdt';
+OPTIONAL_ONE: 'optional-one';
+EXACTLY_ONE: 'exactly-one';
+MANY_UNIQUE: 'many-unique';
+MANY: 'many';
+ORDERED: 'ordered';
+UNIT: 'unit';
+WATCH_HANDLE: 'watch-handle';
+MESSAGE: 'message';
+ATOM_REF: 'atom-ref';
+INTERFACE_REF: 'interface-ref';
+OPTIONAL: 'optional';
+LIST: 'list';
+BOOL: 'bool';
+BYTES: 'bytes';
+DOUBLE: 'double';
+INT32: 'int32';
+INT64: 'int64';
+STRING: 'string';
+UINT32: 'uint32';
+UINT64: 'uint64';
+TRUE: 'true';
+FALSE: 'false';
+NULL: 'null';
+
+ARROW: '->';
+COLON: ':';
+SEMI: ';';
+COMMA: ',';
+DOT: '.';
+LBRACE: '{';
+RBRACE: '}';
+LBRACK: '[';
+RBRACK: ']';
+LPAREN: '(';
+RPAREN: ')';
+LT: '<';
+GT: '>';
+
+INTEGER: '-'? [0-9]+;
+JSON_NUMBER: '-'? ('0' | [1-9] [0-9]*) ('.' [0-9]+)? ([eE] [+-]? [0-9]+)?;
+IDENTIFIER: [A-Za-z_] [A-Za-z0-9_]*;
+STRING_LITERAL: '"' (ESC | ~["\\\r\n])* '"';
+fragment ESC: '\\' (["\\/bfnrt] | 'u' HEX HEX HEX HEX);
+fragment HEX: [0-9a-fA-F];
+
+LINE_COMMENT: '//' ~[\r\n]* -> skip;
+BLOCK_COMMENT: '/*' .*? '*/' -> skip;
+WS: [ \t\r\n]+ -> skip;

grammar/QuixosLock.g4

@@ -0,0 +1,62 @@
+grammar QuixosLock;
+
+document
+  : QUIXOS_LOCK FRAGMENT? VERSION INTEGER LBRACE
+    (quixosEntry | importEntry | resourceEntry)* RBRACE EOF
+  ;
+
+quixosEntry
+  : QUIXOS SOURCE sourceBlock
+  ;
+
+resourceEntry
+  : resourceKind identifier SOURCE sourceBlock
+  ;
+
+importEntry
+  : IMPORT stringLiteral SEMI
+  ;
+
+resourceKind
+  : INTERFACE
+  | PACKAGE
+  ;
+
+sourceBlock
+  : LBRACE
+    REPOSITORY stringLiteral SEMI
+    COMMIT stringLiteral SEMI
+    RBRACE
+  ;
+
+identifier
+  : IDENTIFIER
+  ;
+
+stringLiteral
+  : STRING_LITERAL
+  ;
+
+QUIXOS_LOCK: 'quixos-lock';
+FRAGMENT: 'fragment';
+VERSION: 'version';
+QUIXOS: 'quixos';
+SOURCE: 'source';
+INTERFACE: 'interface';
+PACKAGE: 'package';
+REPOSITORY: 'repository';
+COMMIT: 'commit';
+IMPORT: 'import';
+
+LBRACE: '{';
+RBRACE: '}';
+SEMI: ';';
+INTEGER: [0-9]+;
+IDENTIFIER: [A-Za-z_] [A-Za-z0-9_]*;
+STRING_LITERAL: '"' (ESC | ~["\\\r\n])* '"';
+fragment ESC: '\\' (["\\/bfnrt] | 'u' HEX HEX HEX HEX);
+fragment HEX: [0-9a-fA-F];
+
+LINE_COMMENT: '//' ~[\r\n]* -> skip;
+BLOCK_COMMENT: '/*' .*? '*/' -> skip;
+WS: [ \t\r\n]+ -> skip;

package-lock.json

@@ -1,142 +0,0 @@
-{
-  "name": "@quixos/quixos-protocol",
-  "version": "0.1.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@quixos/quixos-protocol",
-      "version": "0.1.0",
-      "dependencies": {
-        "@bufbuild/protobuf": "^2.12.1",
-        "@bufbuild/protoc-gen-es": "^2.12.1"
-      },
-      "bin": {
-        "quixos-descriptor-check": "dist/src/descriptor-check.js"
-      },
-      "devDependencies": {
-        "@types/node": "^24",
-        "typescript": "^5.9.3"
-      }
-    },
-    "node_modules/@bufbuild/protobuf": {
-      "version": "2.12.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.12.1.tgz",
-      "integrity": "sha512-BvAMfS6LrgZiryOAZ4pBYucu4wG/Ei/9o9DZ9akbREnMLbPJiom2i8b9C8IsKErQoiKqVhrerzt3kOT/RrzLHg==",
-      "license": "(Apache-2.0 AND BSD-3-Clause)"
-    },
-    "node_modules/@bufbuild/protoc-gen-es": {
-      "version": "2.12.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protoc-gen-es/-/protoc-gen-es-2.12.1.tgz",
-      "integrity": "sha512-SWa7XvRYRouMo+vBQmpNFZ+ZEqQ8AC0LpL4QWAo1gvstLhFh/Y7Nf/a+MK7ZxDq5LZSThwfk974L1sFxO3OaGw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@bufbuild/protobuf": "2.12.1",
-        "@bufbuild/protoplugin": "2.12.1"
-      },
-      "bin": {
-        "protoc-gen-es": "bin/protoc-gen-es"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@bufbuild/protobuf": "2.12.1"
-      },
-      "peerDependenciesMeta": {
-        "@bufbuild/protobuf": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@bufbuild/protoplugin": {
-      "version": "2.12.1",
-      "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-2.12.1.tgz",
-      "integrity": "sha512-PY58KxQVAD1BnnKtStOctsMoegEVGfBnY5AOqVQOIu711nA13oYtTqJM8df5lUQg2J1DR3XxUXptE+fWX5oLdA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@bufbuild/protobuf": "2.12.1",
-        "@typescript/vfs": "^1.6.2",
-        "typescript": "5.4.5"
-      }
-    },
-    "node_modules/@bufbuild/protoplugin/node_modules/typescript": {
-      "version": "5.4.5",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
-      "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "24.13.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
-      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
-    "node_modules/@typescript/vfs": {
-      "version": "1.6.4",
-      "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.4.tgz",
-      "integrity": "sha512-PJFXFS4ZJKiJ9Qiuix6Dz/OwEIqHD7Dme1UwZhTK11vR+5dqW2ACbdndWQexBzCx+CPuMe5WBYQWCsFyGlQLlQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.3"
-      },
-      "peerDependencies": {
-        "typescript": "*"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT"
-    }
-  }
-}

package.json

@@ -2,24 +2,37 @@
   "name": "@quixos/quixos-protocol",
   "version": "0.1.0",
   "private": true,
+  "packageManager": "yarn@4.18.0",
   "type": "module",
   "bin": {
-    "quixos-descriptor-check": "dist/src/descriptor-check.js"
+    "quixos-capability-compile": "dist/src/capability-language/cli.js",
+    "quixos-resource-compile": "dist/src/capability-language/resource-cli.js",
+    "quixos-workspace-compile": "dist/src/capability-language/workspace-cli.js",
+    "quixos-descriptor-check": "dist/src/descriptor-check.js",
+    "quixos-lock-check": "dist/src/resource-lock/cli.js"
   },
   "exports": {
+    "./capability-model": "./dist/src/capability-model/index.js",
+    "./capability-language": "./dist/src/capability-language/index.js",
+    "./resource-lock": "./dist/src/resource-lock/index.js",
     "./gen/*": "./dist/src/gen/*"
   },
   "scripts": {
-    "build": "npm run generate && tsc -p tsconfig.build.json",
+    "build": "yarn generate && tsc -p tsconfig.build.json",
-    "generate": "rm -rf src/gen && mkdir -p src/gen && protoc --plugin=protoc-gen-es=./node_modules/.bin/protoc-gen-es --es_out=src/gen --es_opt=target=ts,import_extension=js --proto_path=proto --proto_path=$QUIXOS_PROTO_PATH proto/quixos/refs.proto proto/quixos/package.proto proto/quixos/orch.proto proto/quixos/runtime.proto proto/camino/schema.proto proto/camino/api.proto proto/camino/options.proto",
+    "generate": "yarn generate:proto && yarn generate:parser",
-    "typecheck": "npm run generate && tsc --noEmit"
+    "generate:proto": "rm -rf src/gen && mkdir -p src/gen && protoc --experimental_allow_proto3_optional --plugin=protoc-gen-es=./node_modules/.bin/protoc-gen-es --es_out=src/gen --es_opt=target=ts,import_extension=js --proto_path=proto --proto_path=$QUIXOS_PROTO_PATH proto/quixos/refs.proto proto/quixos/package.proto proto/quixos/orch.proto proto/quixos/runtime.proto proto/camino/schema.proto proto/camino/api.proto",
+    "generate:parser": "rm -rf src/capability-language/generated src/resource-lock/generated && mkdir -p src/capability-language/generated src/resource-lock/generated && antlr-ng -D language=TypeScript --generate-visitor --generate-listener false --output-directory src/capability-language/generated grammar/QuixosCapability.g4 && antlr-ng -D language=TypeScript --generate-visitor --generate-listener false --output-directory src/resource-lock/generated grammar/QuixosLock.g4",
+    "test": "yarn generate && tsc -p tsconfig.test.json && node --test dist/test/*.test.js",
+    "typecheck": "yarn generate && tsc --noEmit"
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.12.1",
-    "@bufbuild/protoc-gen-es": "^2.12.1"
+    "@bufbuild/protoc-gen-es": "^2.12.1",
+    "antlr4ng": "^3.0.16"
   },
   "devDependencies": {
     "@types/node": "^24",
-    "typescript": "^5.9.3"
+    "antlr-ng": "^1.0.10",
+    "typescript": "^7.0.2"
   }
 }

proto/camino/api.proto

@@ -3,74 +3,45 @@ syntax = "proto3";
 package camino;
 
 import "camino/schema.proto";
-import "quixos/refs.proto";
 
 service CaminoService {
-  rpc RegisterSchema(RegisterSchemaRequest) returns (RegisterSchemaResponse);
+  rpc InstallPersistencePlan(InstallPersistencePlanRequest) returns (InstallPersistencePlanResponse);
-  rpc ListClasses(ListClassesRequest) returns (ListClassesResponse);
+  rpc GetPersistencePlan(GetPersistencePlanRequest) returns (GetPersistencePlanResponse);
   rpc CreateObject(CreateObjectRequest) returns (CreateObjectResponse);
   rpc GetObject(GetObjectRequest) returns (GetObjectResponse);
   rpc ListObjects(ListObjectsRequest) returns (ListObjectsResponse);
-  rpc SetField(SetFieldRequest) returns (SetFieldResponse);
+  rpc ReadState(ReadStateRequest) returns (ReadStateResponse);
-  rpc AddEdge(AddEdgeRequest) returns (AddEdgeResponse);
+  rpc WriteState(WriteStateRequest) returns (WriteStateResponse);
-  rpc ListEdges(ListEdgesRequest) returns (ListEdgesResponse);
+  rpc ConnectEdge(ConnectEdgeRequest) returns (ConnectEdgeResponse);
-  rpc RemoveEdge(RemoveEdgeRequest) returns (RemoveEdgeResponse);
+  rpc ResolveEdge(ResolveEdgeRequest) returns (ResolveEdgeResponse);
+  rpc DisconnectEdge(DisconnectEdgeRequest) returns (DisconnectEdgeResponse);
   rpc ListOps(ListOpsRequest) returns (ListOpsResponse);
   rpc WatchObject(WatchObjectRequest) returns (stream WatchObjectEvent);
 }
 
-message RegisterSchemaRequest {
-  string source_file = 1;
-}
-
-message RegisterSchemaResponse {
-  repeated string class_ids = 1;
-  repeated ClassSchema classes = 2;
-}
-
-message ListClassesRequest {}
-
-message RegisteredClass {
-  string id = 1;
-  ClassSchema schema = 2;
-}
-
-message ListClassesResponse {
-  repeated RegisteredClass classes = 1;
-}
-
 message NullValue {}
-
+message ObjectValue { map<string, Value> fields = 1; }
-message ObjectValue {
+message ListValue { repeated Value values = 1; }
-  map<string, Value> fields = 1;
+message RefValue { string object_id = 1; }
-}
-
-message ListValue {
-  repeated Value values = 1;
-}
-
-message RefValue {
-  string object_id = 1;
-}
-
 message CrdtValue {
   string type = 1;
   string encoding = 2;
   bytes payload = 3;
 }
 
-message FieldValueSource {
+message StateValueSource {
   string object_id = 1;
-  string field_name = 2;
+  string slot_id = 2;
-  string field_type = 3;
+  string value_type_json = 3;
-  string field_storage = 4;
+  string storage_policy_json = 4;
-  string conflict_strategy = 5;
+  uint64 revision = 5;
-  uint64 revision = 6;
+  // CRDT-backed state is still read as its materialized Value. The snapshot
+  // travels with the writable source identity so a client can retain and
+  // advance a local replica without exposing the document to package code.
+  CrdtValue crdt_snapshot = 6;
 }
 
-message ValueSource {
+message ValueSource { StateValueSource state = 1; }
-  FieldValueSource field = 1;
-}
 
 message Value {
   oneof kind {
@@ -88,84 +59,62 @@ message Value {
   ValueSource source = 11;
 }
 
+message InstallPersistencePlanRequest { PersistencePlan plan = 1; }
+message InstallPersistencePlanResponse { PersistencePlan plan = 1; }
+message GetPersistencePlanRequest {}
+message GetPersistencePlanResponse { PersistencePlan plan = 1; }
+
 message CreateObjectRequest {
-  string class_id = 1;
+  string atom_id = 1;
-  map<string, Value> fields = 2;
+  map<string, Value> initial_state = 2;
 }
+message CreateObjectResponse { CaminoObject object = 1; }
+message GetObjectRequest { string object_id = 1; }
+message GetObjectResponse { CaminoObject object = 1; }
+message ListObjectsRequest { string atom_id = 1; }
+message ListObjectsResponse { repeated CaminoObject objects = 1; }
 
-message CreateObjectResponse {
+message ReadStateRequest {
-  CaminoObject object = 1;
-}
-
-message GetObjectRequest {
   string object_id = 1;
+  string slot_id = 2;
 }
-
+message ReadStateResponse { Value value = 1; }
-message GetObjectResponse {
+message WriteStateRequest {
-  CaminoObject object = 1;
-}
-
-message ListObjectsRequest {
-  string class_id = 1;
-}
-
-message ListObjectsResponse {
-  repeated CaminoObject objects = 1;
-}
-
-message SetFieldRequest {
   string object_id = 1;
-  string field_name = 2;
+  string slot_id = 2;
   Value value = 3;
   string client_mutation_id = 4;
 }
-
+message WriteStateResponse {
-message SetFieldResponse {
+  Value value = 1;
-  CaminoObject object = 1;
+  CaminoObject object = 2;
 }
 
-message AddEdgeRequest {
+message ConnectEdgeRequest {
-  string from_object_id = 1;
+  string edge_type_id = 1;
-  string source_field = 2;
+  string projection_id = 2;
-  string to_object_id = 3;
+  string object_id = 3;
-  map<string, Value> fields = 4;
+  string target_object_id = 4;
   optional int32 ordinal = 5;
+  optional int32 target_ordinal = 6;
 }
-
+message ConnectEdgeResponse { CaminoEdge edge = 1; }
-message AddEdgeResponse {
+message ResolveEdgeRequest {
-  CaminoEdge edge = 1;
-}
-
-message ListEdgesRequest {
   string object_id = 1;
+  string edge_type_id = 2;
+  string projection_id = 3;
 }
+message ResolveEdgeResponse { repeated CaminoEdge edges = 1; }
+message DisconnectEdgeRequest { string edge_id = 1; }
+message DisconnectEdgeResponse { string edge_id = 1; }
 
-message ListEdgesResponse {
+message ListOpsRequest { string object_id = 1; }
-  repeated CaminoEdge edges = 1;
+message ListOpsResponse { repeated CaminoOp ops = 1; }
-}
-
-message RemoveEdgeRequest {
-  string edge_id = 1;
-}
-
-message RemoveEdgeResponse {
-  string edge_id = 1;
-}
-
-message ListOpsRequest {
-  string object_id = 1;
-}
-
-message ListOpsResponse {
-  repeated CaminoOp ops = 1;
-}
-
 message WatchObjectRequest {
   string object_id = 1;
   string after_op_id = 2;
   bool include_snapshot = 3;
 }
-
 message WatchObjectEvent {
   string object_id = 1;
   CaminoObject snapshot = 2;
@@ -174,32 +123,24 @@ message WatchObjectEvent {
 
 message CaminoObject {
   string id = 1;
-  string class_id = 2;
+  string atom_id = 2;
-  uint32 schema_version = 3;
+  string workspace_revision_id = 3;
   string created_at = 4;
   string updated_at = 5;
-  map<string, Value> fields = 6;
+  map<string, Value> state = 6;
-  map<string, uint64> field_revisions = 7;
+  map<string, uint64> state_revisions = 7;
-  map<string, string> field_conflicts = 8;
 }
 
 message CaminoEdge {
   string id = 1;
   string edge_type_id = 2;
-  string from_object_id = 3;
+  string first_object_id = 3;
-  string to_object_id = 4;
+  string second_object_id = 4;
-  // Legacy canonical source-side projection fields. Prefer endpoint fields.
+  string first_projection_id = 5;
-  string source_field = 5;
+  string second_projection_id = 6;
-  string cardinality = 6;
+  optional int32 first_ordinal = 7;
-  string inverse = 7;
+  optional int32 second_ordinal = 8;
-  map<string, Value> fields = 8;
+  string created_at = 9;
-  optional int32 ordinal = 9;
-  string created_at = 10;
-  string updated_at = 11;
-  string from_projection = 12;
-  string to_projection = 13;
-  string from_cardinality = 14;
-  string to_cardinality = 15;
 }
 
 message CaminoOp {
@@ -208,7 +149,6 @@ message CaminoOp {
   string op_kind = 3;
   Value payload = 4;
   string actor = 5;
-  quixos.FunctionRef function_ref = 6;
+  string created_at = 6;
-  string created_at = 7;
+  string client_mutation_id = 7;
-  string client_mutation_id = 8;
 }

proto/camino/options.proto

@@ -1,86 +0,0 @@
-syntax = "proto3";
-
-package camino;
-
-import "google/protobuf/descriptor.proto";
-import "camino/schema.proto";
-import "quixos/refs.proto";
-
-extend google.protobuf.FileOptions {
-  string schema_namespace = 51000;
-  string schema_version = 51001;
-}
-
-extend google.protobuf.MessageOptions {
-  ClassOptions class = 51010;
-  repeated MethodOptions method = 51011;
-  repeated MigrationOptions migration = 51012;
-  InterfaceOptions interface = 51013;
-  repeated ImplementsOptions implements = 51014;
-  ConstructorOptions constructor = 51015;
-}
-
-extend google.protobuf.FieldOptions {
-  ConflictStrategy conflict = 51020;
-  EdgeOptions edge = 51021;
-  FieldStorage field_storage = 51022;
-  FieldOps field_ops = 51023;
-  InterfaceFieldContract interface_field = 51024;
-  bool display_label = 51025;
-}
-
-extend google.protobuf.MethodOptions {
-  quixos.FunctionRef impl = 51030;
-}
-
-message ClassOptions {
-  uint32 version = 1;
-  SymbolRef id = 2;
-}
-
-message InterfaceOptions {
-  uint32 version = 1;
-  SymbolRef id = 2;
-}
-
-message ImplementsOptions {
-  SymbolRef interface = 1;
-  repeated TypeBinding type_binding = 2;
-}
-
-message ConstructorOptions {
-  quixos.FunctionRef function = 1;
-}
-
-message EdgeOptions {
-  SymbolRef id = 1;
-  // Shorthand for other_endpoint.class.
-  SymbolRef target = 2;
-  // Shorthand for this_endpoint.cardinality.
-  Cardinality cardinality = 3;
-  // Shorthand for other_endpoint.projection.
-  string inverse = 4;
-  EdgeEndpointOptions this_endpoint = 5;
-  EdgeEndpointOptions other_endpoint = 6;
-  repeated SymbolRef tag = 7;
-  repeated SymbolRef implements = 8;
-}
-
-message EdgeEndpointOptions {
-  SymbolRef class = 1;
-  SymbolRef interface = 2;
-  string projection = 3;
-  Cardinality cardinality = 4;
-  bool indexed = 5;
-}
-
-message MethodOptions {
-  string name = 1;
-  quixos.FunctionRef function = 2;
-}
-
-message MigrationOptions {
-  uint32 from_version = 1;
-  uint32 to_version = 2;
-  quixos.FunctionRef function = 3;
-}

proto/camino/schema.proto

@@ -2,205 +2,62 @@ syntax = "proto3";
 
 package camino;
 
-import "quixos/refs.proto";
-
-message SymbolRef {
-  string namespace = 1;
-  string name = 2;
-  string version = 3;
-  string hash = 4;
-}
-
-enum ConflictStrategy {
-  CONFLICT_STRATEGY_UNSPECIFIED = 0;
-  REPLACE = 1;
-  PRESERVE_CONFLICTS = 2;
-  CRDT = 3;
-}
-
 enum Cardinality {
   CARDINALITY_UNSPECIFIED = 0;
   OPTIONAL_ONE = 1;
   EXACTLY_ONE = 2;
   MANY = 3;
   MANY_UNIQUE = 4;
-  MANY_ORDERED = 5;
-  MANY_UNIQUE_ORDERED = 6;
 }
 
-enum DocRefStrength {
+message AtomDefinition {
-  DOC_REF_STRENGTH_UNSPECIFIED = 0;
+  string atom_id = 1;
-  SOFT_REF = 1;
+  string display_name = 2;
-  PROJECTED_EDGE = 2;
 }
 
-enum FieldStorageKind {
+message AtomConformance {
-  FIELD_STORAGE_KIND_UNSPECIFIED = 0;
+  string atom_id = 1;
-  STORED = 1;
+  string interface_revision_id = 2;
-  DERIVED = 2;
-  LAZY = 3;
-  EXTERNAL = 4;
-  STATIC_FINAL = 5;
 }
 
-message Ref {
+message StateAttachment {
-  string object_id = 1;
+  string slot_id = 1;
+  string attached_atom_id = 2;
+  string display_name = 3;
+  string value_type_json = 4;
+  string storage_policy_json = 5;
+  string default_value_json = 6;
 }
 
-message CustomField {}
+message EndpointConstraint {
-
+  oneof kind {
-message WatchStartResult {
+    string atom_id = 1;
-  string watch_id = 1;
+    string interface_revision_id = 2;
+  }
 }
 
-message WatchStopRequest {
+message EdgeEndpoint {
-  string watch_id = 1;
+  string projection_id = 1;
-}
+  string display_name = 2;
-
+  EndpointConstraint constraint = 3;
-message WatchStopResult {}
-
-message CrdtText {
-  bytes payload = 1;
-}
-
-message CrdtRichText {
-  bytes payload = 1;
-}
-
-message CrdtJson {
-  bytes payload = 1;
-}
-
-message ClassSchema {
-  SymbolRef id = 1;
-  uint32 version = 2;
-  repeated FieldSchema fields = 3;
-  repeated EdgeSchema edges = 4;
-  repeated MethodSchema methods = 5;
-  repeated MigrationSpec migrations = 6;
-  string source_file = 7;
-  string proto_message = 8;
-  repeated OperationServiceSchema operation_services = 9;
-  repeated InterfaceImplementationSchema implements = 10;
-  ConstructorSpec constructor = 11;
-}
-
-message FieldSchema {
-  string name = 1;
-  uint32 tag = 2;
-  TypeRef type = 3;
-  ConflictStrategy conflict = 4;
-  bool repeated = 5;
-  bool optional = 6;
-  FieldStorage storage = 7;
-  FieldOps ops = 8;
-  InterfaceFieldContract interface_contract = 9;
-  bool is_display_label = 10;
-}
-
-message FieldStorage {
-  FieldStorageKind kind = 1;
-  quixos.FunctionRef resolver = 2;
-  bool cache = 3;
-}
-
-message TypeRef {
-  string proto_type = 1;
-  SymbolRef symbol = 2;
-}
-
-message TypeBinding {
-  string name = 1;
-  TypeRef type = 2;
-}
-
-message InterfaceFieldContract {
-  bool required = 1;
-  bool readable = 2;
-  bool writable = 3;
-  bool watchable = 4;
-  string type_param = 5;
-  TypeRef type = 6;
-}
-
-message InterfaceImplementationSchema {
-  SymbolRef interface = 1;
-  repeated TypeBinding type_bindings = 2;
-}
-
-message InterfaceSchema {
-  SymbolRef id = 1;
-  uint32 version = 2;
-  repeated FieldSchema fields = 3;
-  string source_file = 4;
-  string proto_message = 5;
-}
-
-enum FieldImplementation {
-  FIELD_IMPLEMENTATION_UNSPECIFIED = 0;
-  SERVICE = 1;
-}
-
-message FieldOps {
-  FieldImplementation implementation = 1;
-  string service = 2;
-}
-
-message EdgeSchema {
-  SymbolRef id = 1;
-  // Legacy/source-side projection fields. Prefer from_endpoint/to_endpoint.
-  string source_field = 2;
-  SymbolRef from_class = 3;
-  SymbolRef to_class = 4;
-  Cardinality cardinality = 5;
-  string inverse = 6;
-  repeated FieldSchema fields = 7;
-  EdgeEndpointSchema from_endpoint = 8;
-  EdgeEndpointSchema to_endpoint = 9;
-  SymbolRef declaring_class = 10;
-  repeated SymbolRef tags = 11;
-  repeated SymbolRef implements = 12;
-}
-
-message EdgeEndpointSchema {
-  SymbolRef class = 1;
-  SymbolRef interface = 2;
-  string projection = 3;
   Cardinality cardinality = 4;
-  bool indexed = 5;
+  bool ordered = 5;
 }
 
-message MethodSchema {
+message EdgeAttachment {
-  string name = 1;
+  string edge_type_id = 1;
-  quixos.FunctionRef function = 2;
+  string display_name = 2;
+  EdgeEndpoint first = 3;
+  EdgeEndpoint second = 4;
 }
 
-message MigrationSpec {
+// Camino consumes this persistence-only projection of a checked workspace.
-  uint32 from_version = 1;
+// Interfaces, operation bindings, packages, and constructors stay in orch.
-  uint32 to_version = 2;
+message PersistencePlan {
-  quixos.FunctionRef function = 3;
+  string workspace_id = 1;
-}
+  string workspace_revision_id = 2;
-
+  repeated AtomDefinition atoms = 3;
-message ConstructorSpec {
+  repeated AtomConformance conformances = 4;
-  quixos.FunctionRef function = 1;
+  repeated StateAttachment states = 5;
-}
+  repeated EdgeAttachment edges = 6;
-
-message OperationSchema {
-  string name = 1;
-  TypeRef input_type = 2;
-  TypeRef output_type = 3;
-  quixos.FunctionRef function = 4;
-}
-
-message OperationServiceSchema {
-  string name = 1;
-  string full_name = 2;
-  repeated OperationSchema operations = 3;
-}
-
-message DocRefDeclaration {
-  string local_name = 1;
-  SymbolRef type = 2;
-  SymbolRef target_class = 3;
-  DocRefStrength strength = 4;
 }

proto/quixos/orch.proto

@@ -8,35 +8,56 @@ import "quixos/refs.proto";
 import "quixos/runtime.proto";
 
 service OrchestratorRuntime {
-  rpc InvokeFunction(InvokeFunctionRequest) returns (InvokeFunctionResponse);
+  rpc InvokeCapability(InvokeCapabilityRequest) returns (InvokeCapabilityResponse);
-  rpc WatchFunction(WatchFunctionRequest) returns (stream WatchFunctionEvent);
+  rpc WatchCapability(WatchCapabilityRequest) returns (stream WatchCapabilityEvent);
+  rpc ConstructObject(ConstructObjectRequest) returns (ConstructObjectResponse);
+  rpc ResolveOrConstructRelatedObject(ResolveOrConstructRelatedObjectRequest) returns (ResolveOrConstructRelatedObjectResponse);
+  rpc GetWorkspace(GetWorkspaceRequest) returns (GetWorkspaceResponse);
   rpc ListPackageDescriptors(ListPackageDescriptorsRequest) returns (ListPackageDescriptorsResponse);
   rpc ListPackageRuntimes(ListPackageRuntimesRequest) returns (ListPackageRuntimesResponse);
   rpc ListActivations(ListActivationsRequest) returns (ListActivationsResponse);
   rpc CloseActivation(CloseActivationRequest) returns (CloseActivationResponse);
 }
 
-message InvokeFunctionRequest {
+message ConstructObjectRequest {
-  quixos.FunctionRef function = 1;
+  string atom_id = 1;
-  string object_id = 2;
+  map<string, camino.Value> input = 2;
-  map<string, camino.Value> input = 3;
+}
+message ConstructObjectResponse { camino.CaminoObject object = 1; }
+
+message ResolveOrConstructRelatedObjectRequest {
+  string object_id = 1;
+  string interface_revision_id = 2;
+  string member_id = 3;
+}
+message ResolveOrConstructRelatedObjectResponse {
+  camino.CaminoObject object = 1;
+  bool constructed = 2;
 }
 
-message InvokeFunctionResponse {
+message InvokeCapabilityRequest {
+  quixos.CapabilityRef capability = 1;
+  string object_id = 2;
+  map<string, camino.Value> input = 3;
+  // Identifies one logical client mutation across the capability and Camino
+  // layers so a live-value controller can recognize its own confirmation.
+  string client_mutation_id = 4;
+}
+message InvokeCapabilityResponse {
   string invocation_id = 1;
   Activation activation = 2;
   bool ok = 3;
   camino.Value result = 4;
   string error = 5;
+  repeated quixos.runtime.DerivedDependency dependencies = 6;
 }
 
-message WatchFunctionRequest {
+message WatchCapabilityRequest {
-  quixos.FunctionRef function = 1;
+  quixos.CapabilityRef capability = 1;
   string object_id = 2;
   map<string, camino.Value> input = 3;
 }
-
+message WatchCapabilityEvent {
-message WatchFunctionEvent {
   string invocation_id = 1;
   Activation activation = 2;
   string watch_id = 3;
@@ -46,36 +67,24 @@ message WatchFunctionEvent {
   bool initial = 7;
 }
 
+message GetWorkspaceRequest {}
+message GetWorkspaceResponse {
+  string workspace_id = 1;
+  string workspace_revision_id = 2;
+  string source_root_commit = 3;
+}
 message ListActivationsRequest {}
-
 message ListPackageDescriptorsRequest {}
-
+message ListPackageDescriptorsResponse { repeated quixos.PackageDescriptor descriptors = 1; }
-message ListPackageDescriptorsResponse {
-  repeated quixos.PackageDescriptor descriptors = 1;
-}
-
 message ListPackageRuntimesRequest {}
-
+message ListPackageRuntimesResponse { repeated PackageRuntimeStatus runtimes = 1; }
-message ListPackageRuntimesResponse {
+message ListActivationsResponse { repeated Activation activations = 1; }
-  repeated PackageRuntimeStatus runtimes = 1;
+message CloseActivationRequest { string activation_id = 1; string reason = 2; }
-}
+message CloseActivationResponse { Activation activation = 1; }
-
-message ListActivationsResponse {
-  repeated Activation activations = 1;
-}
-
-message CloseActivationRequest {
-  string activation_id = 1;
-  string reason = 2;
-}
-
-message CloseActivationResponse {
-  Activation activation = 1;
-}
 
 message Activation {
   string activation_id = 1;
-  quixos.FunctionRef function = 2;
+  quixos.PackageExportRef export = 2;
   string object_id = 3;
   string state = 4;
   uint32 demand = 5;
@@ -88,17 +97,15 @@ message Activation {
 
 message PackageRuntimeStatus {
   string runtime_key = 1;
-  string package_namespace = 2;
+  string package_revision_id = 2;
-  string package_name = 3;
+  string source_repository = 3;
-  uint32 descriptor_version = 4;
+  string source_commit = 4;
-  string source_repo = 5;
+  string build_target = 5;
-  string server_installable = 6;
+  string server_path = 6;
-  string source_path = 7;
+  uint32 pid = 7;
-  string server_path = 8;
+  string state = 8;
-  uint32 pid = 9;
+  string started_at = 9;
-  string state = 10;
+  string last_handshake_at = 10;
-  string started_at = 11;
+  string runtime_protocol_version = 11;
-  string last_handshake_at = 12;
+  uint32 advertised_export_count = 12;
-  string runtime_protocol_version = 13;
-  uint32 advertised_function_count = 14;
 }

proto/quixos/package.proto

@@ -2,70 +2,14 @@ syntax = "proto3";
 
 package quixos;
 
-import "camino/schema.proto";
-import "quixos/refs.proto";
-
-message PackageRef {
-  string package_namespace = 1;
-  string package_name = 2;
-  uint32 descriptor_version = 3;
-  string version_ref = 4;
-}
-
 message PackageDescriptor {
-  string package_namespace = 1;
+  string package_id = 1;
-  string package_name = 2;
+  string package_revision_id = 2;
-  uint32 descriptor_version = 3;
+  string runtime_protocol_version = 3;
-  uint32 interface_compatible_back_to = 4;
+  repeated RuntimeExport exports = 4;
-  uint32 runner_compatible_back_to = 5;
-  string source_repo = 6;
-  string source_ref = 7;
-  string resolved_source_ref = 8;
-  string server_installable = 9;
-  string runtime_protocol_version = 10;
-  repeated ClassExport class_exports = 11;
-  repeated FunctionExport function_exports = 12;
-  repeated ComponentExport component_exports = 13;
-  repeated SidecarExport sidecar_exports = 14;
-  repeated PackageDependency dependencies = 15;
 }
 
-enum FunctionCapabilityKind {
+message RuntimeExport {
-  FUNCTION_CAPABILITY_KIND_UNSPECIFIED = 0;
+  string export_id = 1;
-  METHOD = 1;
+  string runtime_symbol = 2;
-  FIELD_RESOLVER = 2;
-  MIGRATION = 3;
-  CONSTRUCTOR = 4;
-}
-
-message ClassExport {
-  camino.SymbolRef class_id = 1;
-  string source_file = 2;
-}
-
-message FunctionExport {
-  FunctionRef function = 1;
-  string input_type = 2;
-  string output_type = 3;
-  uint32 interface_version = 4;
-  uint32 interface_compatible_back_to = 5;
-  FunctionCapabilityKind capability_kind = 6;
-}
-
-message ComponentExport {
-  string symbol = 1;
-  string props_type = 2;
-  repeated camino.SymbolRef supported_classes = 3;
-}
-
-message SidecarExport {
-  string symbol = 1;
-  string side_effect_mode = 2;
-}
-
-message PackageDependency {
-  PackageRef package = 1;
-  uint32 interface_compatible_back_to = 2;
-  bool refactor_required = 3;
-  string compatibility_note = 4;
 }

proto/quixos/refs.proto

@@ -2,10 +2,30 @@ syntax = "proto3";
 
 package quixos;
 
-message FunctionRef {
+message CapabilityRef {
-  string package_namespace = 1;
+  string interface_revision_id = 1;
-  string package_name = 2;
+  string operation_id = 2;
-  string symbol = 3;
+}
-  string version_ref = 4;
+
-  string operation = 5;
+message PackageExportRef {
+  string package_revision_id = 1;
+  string export_id = 2;
+}
+
+message InjectedDependency {
+  string port_id = 1;
+  oneof binding {
+    string state_slot_id = 2;
+    EdgeDependency edge = 3;
+    string interface_revision_id = 4;
+    string constructor_atom_id = 5;
+  }
+  // Defaults to the invocation receiver. A checked dependency traversal can
+  // select a related object explicitly before the package runtime starts.
+  string object_id = 6;
+}
+
+message EdgeDependency {
+  string edge_type_id = 1;
+  string projection_id = 2;
 }

proto/quixos/runtime.proto

@@ -11,42 +11,40 @@ service PackageRuntime {
   rpc Watch(WatchRequest) returns (stream WatchEvent);
 }
 
-message HandshakeRequest {
+message HandshakeRequest { string orch_protocol_version = 1; }
-  string orch_protocol_version = 1;
-}
-
 message HandshakeResponse {
-  string package_namespace = 1;
+  string package_revision_id = 1;
-  string package_name = 2;
+  string runtime_protocol_version = 2;
-  string runtime_protocol_version = 3;
+  repeated string export_ids = 3;
-  repeated quixos.FunctionRef functions = 4;
 }
 
 message InvokeRequest {
   string invocation_id = 1;
-  quixos.FunctionRef function = 2;
+  quixos.PackageExportRef export = 2;
   string object_id = 3;
   map<string, camino.Value> input = 4;
+  repeated quixos.InjectedDependency dependencies = 5;
 }
-
 message InvokeResponse {
   bool ok = 1;
   camino.Value result = 2;
   string error = 3;
+  repeated DerivedDependency dependencies = 4;
 }
 
 message WatchRequest {
   string invocation_id = 1;
-  quixos.FunctionRef function = 2;
+  quixos.PackageExportRef export = 2;
   string object_id = 3;
   map<string, camino.Value> input = 4;
+  repeated quixos.InjectedDependency dependencies = 5;
 }
 
 message DerivedDependency {
   string kind = 1;
   string object_id = 2;
-  string field_name = 3;
+  string attachment_id = 3;
-  string source_field = 4;
+  string projection_id = 4;
 }
 
 message WatchEvent {

src/capability-language/assembly.ts

@@ -0,0 +1,359 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import {
+  capabilityId,
+  compileWorkspaceRevision,
+  type AtomDefinition,
+  type CompiledWorkspaceRevision,
+  type InterfaceRevision,
+  type PackageRevision,
+  type SourceRevision,
+  type WorkspaceRevision,
+} from "../capability-model/index.js";
+import {
+  loadQuixosLock,
+  type GitSource,
+  type LockedResource,
+  type QuixosRepositoryLock,
+} from "../resource-lock/index.js";
+import {
+  compileCapabilityResourceSource,
+  compileCapabilitySource,
+  type CapabilityImportEnvironment,
+  type CapabilityResource,
+  type CapabilityResourceImport,
+} from "./parser.js";
+
+export type CapabilityRepositorySnapshot = {
+  directory: string;
+};
+
+export type CapabilityRepositoryResolver = (
+  source: GitSource,
+  kind: LockedResource["kind"],
+) => Promise<CapabilityRepositorySnapshot>;
+
+export type ResolvedCapabilityResource = {
+  key: string;
+  kind: LockedResource["kind"];
+  source: GitSource;
+  directory: string;
+  lock: QuixosRepositoryLock;
+  resource: CapabilityResource;
+  dependencies: ReadonlyMap<string, ResolvedCapabilityResource>;
+};
+
+export type CompiledWorkspaceRepository = {
+  workspace: WorkspaceRevision;
+  plan: CompiledWorkspaceRevision;
+  lock: QuixosRepositoryLock;
+  resources: ResolvedCapabilityResource[];
+  directResources: ReadonlyMap<string, ResolvedCapabilityResource>;
+};
+
+export type CompiledCapabilityResourceRepository = {
+  resource: CapabilityResource;
+  lock: QuixosRepositoryLock;
+  resources: ResolvedCapabilityResource[];
+  directResources: ReadonlyMap<string, ResolvedCapabilityResource>;
+};
+
+const sourceKey = (kind: LockedResource["kind"], source: GitSource) =>
+  `${kind}\0${source.repository}\0${source.commit.toLowerCase()}`;
+
+const bindingKey = (kind: LockedResource["kind"], binding: string) =>
+  `${kind}\0${binding}`;
+
+const importsKey = (entry: CapabilityResourceImport | LockedResource) =>
+  bindingKey(entry.kind, entry.binding);
+
+const assertImportsMatchLock = (
+  label: string,
+  imports: readonly CapabilityResourceImport[],
+  resources: readonly LockedResource[],
+) => {
+  const authored = [...imports].map(importsKey).sort();
+  const locked = [...resources].map(importsKey).sort();
+  if (
+    authored.length !== locked.length ||
+    authored.some((entry, index) => entry !== locked[index])
+  ) {
+    throw new Error(
+      `${label} imports do not match quixos.lock:\n` +
+      `authored: ${authored.join(", ") || "none"}\n` +
+      `locked: ${locked.join(", ") || "none"}`,
+    );
+  }
+};
+
+const exactRevisions = <Revision extends {
+  revisionId: string;
+  source: SourceRevision;
+}>(revisions: readonly Revision[]) => {
+  const seen = new Set<string>();
+  return revisions.filter((revision) => {
+    const key = `${revision.revisionId}\0${revision.source.repository}\0${revision.source.commit}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+};
+
+const exactAtoms = (atoms: readonly AtomDefinition[]) => {
+  const seen = new Set<string>();
+  return atoms.filter((atom) => {
+    if (seen.has(atom.id)) return false;
+    seen.add(atom.id);
+    return true;
+  });
+};
+
+const diagnosticsMessage = (
+  label: string,
+  diagnostics: readonly {
+    fileName: string;
+    line: number;
+    column: number;
+    phase: string;
+    code: string;
+    message: string;
+    path?: string;
+  }[],
+) => `${label} did not compile:\n${diagnostics.map((entry) => {
+  const location = entry.line > 0
+    ? `${entry.fileName}:${entry.line}:${entry.column + 1}`
+    : `${entry.fileName}${entry.path ? `:${entry.path}` : ""}`;
+  return `${location}: ${entry.phase} ${entry.code}: ${entry.message}`;
+}).join("\n")}`;
+
+const revisionFor = (node: ResolvedCapabilityResource) =>
+  node.resource.revision;
+
+const resourceClosure = (
+  roots: readonly ResolvedCapabilityResource[],
+): ResolvedCapabilityResource[] => {
+  const result: ResolvedCapabilityResource[] = [];
+  const seen = new Set<string>();
+  const visit = (node: ResolvedCapabilityResource) => {
+    if (seen.has(node.key)) return;
+    seen.add(node.key);
+    for (const dependency of node.dependencies.values()) visit(dependency);
+    result.push(node);
+  };
+  for (const root of roots) visit(root);
+  return result;
+};
+
+const environmentFor = (
+  direct: readonly [LockedResource, ResolvedCapabilityResource][],
+  closure: readonly ResolvedCapabilityResource[],
+): CapabilityImportEnvironment => ({
+  interfaces: new Map(direct.flatMap(([locked, node]) =>
+    node.resource.kind === "interface"
+      ? [[locked.binding, node.resource.revision] as const]
+      : [])),
+  packages: new Map(direct.flatMap(([locked, node]) =>
+    node.resource.kind === "package"
+      ? [[locked.binding, node.resource.revision] as const]
+      : [])),
+  interfaceClosure: exactRevisions(closure.flatMap((node) =>
+    node.resource.kind === "interface" ? [node.resource.revision] : [])),
+  packageClosure: exactRevisions(closure.flatMap((node) =>
+    node.resource.kind === "package" ? [node.resource.revision] : [])),
+  externalAtoms: exactAtoms(closure.flatMap((node) => node.resource.externalAtoms)),
+});
+
+const createResourceGraphResolver = (
+  quixosCommit: string,
+  resolveResource: CapabilityRepositoryResolver,
+) => {
+  const resolved = new Map<string, Promise<ResolvedCapabilityResource>>();
+  const active: string[] = [];
+
+  const visit = async (
+    locked: LockedResource,
+    suppliedSnapshot?: CapabilityRepositorySnapshot,
+  ): Promise<ResolvedCapabilityResource> => {
+    const key = sourceKey(locked.kind, locked.source);
+    const cached = resolved.get(key);
+    if (cached) {
+      if (active.includes(key)) {
+        throw new Error(`Resource dependency cycle: ${[...active, key].join(" -> ")}`);
+      }
+      return await cached;
+    }
+    const pending = (async () => {
+      active.push(key);
+      try {
+        const snapshot = suppliedSnapshot ?? await resolveResource(locked.source, locked.kind);
+        const lockResult = await loadQuixosLock(path.join(snapshot.directory, "quixos.lock"));
+        if (!lockResult.ok) {
+          throw new Error(diagnosticsMessage(`${locked.kind} ${locked.binding} lock`, lockResult.diagnostics));
+        }
+        if (lockResult.lock.quixos.commit.toLowerCase() !== quixosCommit.toLowerCase()) {
+          throw new Error(
+            `${locked.kind} ${locked.binding} selects Quixos ${lockResult.lock.quixos.commit}, ` +
+            `but the repository graph selects ${quixosCommit}`,
+          );
+        }
+        const directPairs: Array<[LockedResource, ResolvedCapabilityResource]> = [];
+        for (const dependency of lockResult.lock.resources) {
+          directPairs.push([dependency, await visit(dependency)]);
+        }
+        const dependencyClosure = resourceClosure(
+          directPairs.map(([, node]) => node),
+        );
+        const environment = environmentFor(directPairs, dependencyClosure);
+        const manifestName = locked.kind === "interface" ? "interface.qx" : "package.qx";
+        const manifestPath = path.join(snapshot.directory, manifestName);
+        const sourceText = await readFile(manifestPath, "utf8");
+        const compiled = compileCapabilityResourceSource(sourceText, {
+          source: locked.source,
+          fileName: manifestPath,
+          environment,
+        });
+        if (!compiled.ok) {
+          throw new Error(diagnosticsMessage(`${locked.kind} ${locked.binding}`, compiled.diagnostics));
+        }
+        if (compiled.resource.kind !== locked.kind) {
+          throw new Error(
+            `${manifestPath} declares ${compiled.resource.kind}, not ${locked.kind}`,
+          );
+        }
+        assertImportsMatchLock(manifestPath, compiled.resource.imports, lockResult.lock.resources);
+        return {
+          key,
+          kind: locked.kind,
+          source: locked.source,
+          directory: snapshot.directory,
+          lock: lockResult.lock,
+          resource: compiled.resource,
+          dependencies: new Map(directPairs.map(([dependency, node]) => [
+            bindingKey(dependency.kind, dependency.binding),
+            node,
+          ])),
+        };
+      } finally {
+        active.pop();
+      }
+    })();
+    resolved.set(key, pending);
+    return await pending;
+  };
+
+  return {
+    visit,
+    nodes: async () => await Promise.all(resolved.values()),
+  };
+};
+
+export const compileCapabilityResourceRepository = async (options: {
+  rootDirectory: string;
+  kind: LockedResource["kind"];
+  source: GitSource;
+  resolveResource: CapabilityRepositoryResolver;
+}): Promise<CompiledCapabilityResourceRepository> => {
+  const lockResult = await loadQuixosLock(path.join(options.rootDirectory, "quixos.lock"));
+  if (!lockResult.ok) {
+    throw new Error(diagnosticsMessage("Resource lock", lockResult.diagnostics));
+  }
+  const resolver = createResourceGraphResolver(
+    lockResult.lock.quixos.commit,
+    options.resolveResource,
+  );
+  const root = await resolver.visit({
+    kind: options.kind,
+    binding: "<root>",
+    source: options.source,
+  }, { directory: options.rootDirectory });
+  return {
+    resource: root.resource,
+    lock: root.lock,
+    resources: await resolver.nodes(),
+    directResources: root.dependencies,
+  };
+};
+
+export const compileWorkspaceRepository = async (options: {
+  rootDirectory: string;
+  resolveResource: CapabilityRepositoryResolver;
+  workspaceId?: string;
+  workspaceRevisionId?: string;
+  sourceRootCommit?: string;
+}): Promise<CompiledWorkspaceRepository> => {
+  const rootLockResult = await loadQuixosLock(
+    path.join(options.rootDirectory, "quixos.lock"),
+  );
+  if (!rootLockResult.ok) {
+    throw new Error(diagnosticsMessage("Workspace lock", rootLockResult.diagnostics));
+  }
+  const rootLock = rootLockResult.lock;
+  const resolver = createResourceGraphResolver(rootLock.quixos.commit, options.resolveResource);
+
+  const directPairs: Array<[LockedResource, ResolvedCapabilityResource]> = [];
+  for (const locked of rootLock.resources) {
+    directPairs.push([locked, await resolver.visit(locked)]);
+  }
+  const nodes = await resolver.nodes();
+  const environment = environmentFor(directPairs, nodes);
+  const workspacePath = path.join(options.rootDirectory, "workspace.qx");
+  const workspaceSource = await readFile(workspacePath, "utf8");
+  const compiled = compileCapabilitySource(workspaceSource, workspacePath, environment);
+  if (!compiled.ok) {
+    throw new Error(diagnosticsMessage("Workspace", compiled.diagnostics));
+  }
+  assertImportsMatchLock(workspacePath, compiled.imports, rootLock.resources);
+  const availableInterfaceIds = new Set(
+    nodes.flatMap((node) => node.resource.kind === "interface"
+      ? [node.resource.revision.revisionId]
+      : []),
+  );
+  const availableAtomIds = new Set(compiled.workspace.atoms.map((atom) => atom.id));
+  for (const node of nodes) {
+    for (const requirement of node.resource.externalInterfaces) {
+      if (!availableInterfaceIds.has(requirement.revisionId)) {
+        throw new Error(
+          `${node.kind} ${node.resource.revision.displayName} requires external interface ` +
+          `${requirement.binding} (${requirement.revisionId}), but the workspace resource graph does not provide it`,
+        );
+      }
+    }
+    for (const atom of node.resource.externalAtoms) {
+      if (!availableAtomIds.has(atom.id)) {
+        throw new Error(
+          `${node.kind} ${node.resource.revision.displayName} requires external atom ` +
+          `${atom.displayName} (${atom.id}), but the workspace does not define it`,
+        );
+      }
+    }
+  }
+  const workspace: WorkspaceRevision = {
+    ...compiled.workspace,
+    ...(options.workspaceId
+      ? { workspaceId: capabilityId.workspace(options.workspaceId) }
+      : {}),
+    ...(options.workspaceRevisionId
+      ? { id: capabilityId.workspaceRevision(options.workspaceRevisionId) }
+      : {}),
+    ...(options.sourceRootCommit
+      ? { sourceRootCommit: options.sourceRootCommit }
+      : {}),
+  };
+  const checked = compileWorkspaceRevision(workspace);
+  if (!checked.ok) {
+    throw new Error(
+      `Instantiated workspace did not compile:\n${checked.issues.map((entry) =>
+        `${entry.path}: ${entry.message}`).join("\n")}`,
+    );
+  }
+  return {
+    workspace,
+    plan: checked.plan,
+    lock: rootLock,
+    resources: nodes,
+    directResources: new Map(directPairs.map(([locked, node]) => [
+      bindingKey(locked.kind, locked.binding),
+      node,
+    ])),
+  };
+};

src/capability-language/cli.ts

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+import { readFile } from "node:fs/promises";
+import process from "node:process";
+import { compileCapabilitySource } from "./parser.js";
+import { capabilityId } from "../capability-model/types.js";
+import { compileWorkspaceRevision } from "../capability-model/validation.js";
+
+const usage = `usage: quixos-capability-compile [--check]
+       [--workspace-id ID] [--workspace-revision-id ID]
+       [--source-root-commit GIT_REV] <workspace.qx | ->
+
+Parses, lowers, and validates a Quixos capability workspace. By default the
+checked semantic workspace revision is written as JSON. --check emits no JSON.
+The identity overrides instantiate a checked built-in/template assembly for one
+real workspace; both must be supplied together.`;
+
+const parseArgs = (args: string[]) => {
+  let checkOnly = false;
+  let workspaceId: string | undefined;
+  let workspaceRevisionId: string | undefined;
+  let sourceRootCommit: string | undefined;
+  const positional: string[] = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index]!;
+    if (argument === "--check") checkOnly = true;
+    else if (argument === "--workspace-id") workspaceId = args[++index];
+    else if (argument === "--workspace-revision-id") workspaceRevisionId = args[++index];
+    else if (argument === "--source-root-commit") sourceRootCommit = args[++index];
+    else if (argument === "-") positional.push(argument);
+    else if (argument.startsWith("-")) throw new Error(usage);
+    else positional.push(argument);
+  }
+  if (positional.length !== 1 || Boolean(workspaceId) !== Boolean(workspaceRevisionId)) {
+    throw new Error(usage);
+  }
+  return { checkOnly, workspaceId, workspaceRevisionId, sourceRootCommit, fileName: positional[0]! };
+};
+
+const main = async () => {
+  const args = process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    process.stdout.write(`${usage}\n`);
+    return;
+  }
+  const {
+    checkOnly,
+    workspaceId,
+    workspaceRevisionId,
+    sourceRootCommit,
+    fileName,
+  } = parseArgs(args);
+  const source =
+    fileName === "-"
+      ? await new Promise<string>((resolve, reject) => {
+          const chunks: Buffer[] = [];
+          process.stdin.on("data", (chunk: Buffer) => chunks.push(chunk));
+          process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+          process.stdin.on("error", reject);
+        })
+      : await readFile(fileName, "utf8");
+  const result = compileCapabilitySource(source, fileName);
+  if (!result.ok) {
+    for (const diagnostic of result.diagnostics) {
+      const location = diagnostic.line
+        ? `${diagnostic.fileName}:${diagnostic.line}:${diagnostic.column + 1}`
+        : `${diagnostic.fileName}${diagnostic.path ? `:${diagnostic.path}` : ""}`;
+      process.stderr.write(
+        `${location}: ${diagnostic.phase} ${diagnostic.code}: ${diagnostic.message}\n`,
+      );
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const workspace = workspaceId && workspaceRevisionId
+    ? {
+        ...result.workspace,
+        workspaceId: capabilityId.workspace(workspaceId),
+        id: capabilityId.workspaceRevision(workspaceRevisionId),
+        ...(sourceRootCommit ? { sourceRootCommit } : {}),
+      }
+    : { ...result.workspace, ...(sourceRootCommit ? { sourceRootCommit } : {}) };
+  const instantiated = compileWorkspaceRevision(workspace);
+  if (!instantiated.ok) {
+    throw new Error(instantiated.issues.map((issue) => `${issue.path}: ${issue.message}`).join("\n"));
+  }
+  if (!checkOnly) {
+    process.stdout.write(`${JSON.stringify(workspace, null, 2)}\n`);
+  }
+};
+
+main().catch((error: unknown) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+});

src/capability-language/generated/QuixosCapability.tokens

@@ -0,0 +1,197 @@
+WORKSPACE=1
+IMPORT=2
+EXTERNAL=3
+ATOM=4
+INTERFACE=5
+INTERFACES=6
+PACKAGE=7
+VALUE=8
+RELATION=9
+OPERATION=10
+FUNCTION=11
+CONSTRUCTOR=12
+CONSTRUCTS=13
+CONFORM=14
+AS=15
+BIND=16
+TO=17
+PRIVATE=18
+SHARED=19
+STATE=20
+EDGE=21
+PROJECTION=22
+WITH=23
+USING=24
+VIA=25
+MATERIALIZE=26
+IF=27
+ABSENT=28
+ON=29
+POLICY=30
+DEFAULT=31
+SOURCE=32
+REPOSITORY=33
+COMMIT=34
+REVISION=35
+ID=36
+DOC=37
+MODE=38
+EMITS=39
+RECEIVER=40
+REQUIRES=41
+ANY=42
+GET=43
+SET=44
+WATCH=45
+START=46
+STOP=47
+READ=48
+WRITE=49
+RESOLVE=50
+CONNECT=51
+DISCONNECT=52
+CALL=53
+WATCH_START=54
+WATCH_STOP=55
+SUBSCRIBE=56
+UNSUBSCRIBE=57
+OPTIMISTIC_REGISTER=58
+CRDT=59
+OPTIONAL_ONE=60
+EXACTLY_ONE=61
+MANY_UNIQUE=62
+MANY=63
+ORDERED=64
+UNIT=65
+WATCH_HANDLE=66
+MESSAGE=67
+ATOM_REF=68
+INTERFACE_REF=69
+OPTIONAL=70
+LIST=71
+BOOL=72
+BYTES=73
+DOUBLE=74
+INT32=75
+INT64=76
+STRING=77
+UINT32=78
+UINT64=79
+TRUE=80
+FALSE=81
+NULL=82
+ARROW=83
+COLON=84
+SEMI=85
+COMMA=86
+DOT=87
+LBRACE=88
+RBRACE=89
+LBRACK=90
+RBRACK=91
+LPAREN=92
+RPAREN=93
+LT=94
+GT=95
+INTEGER=96
+JSON_NUMBER=97
+IDENTIFIER=98
+STRING_LITERAL=99
+LINE_COMMENT=100
+BLOCK_COMMENT=101
+WS=102
+'workspace'=1
+'import'=2
+'external'=3
+'atom'=4
+'interface'=5
+'interfaces'=6
+'package'=7
+'value'=8
+'relation'=9
+'operation'=10
+'function'=11
+'constructor'=12
+'constructs'=13
+'conform'=14
+'as'=15
+'bind'=16
+'to'=17
+'private'=18
+'shared'=19
+'state'=20
+'edge'=21
+'projection'=22
+'with'=23
+'using'=24
+'via'=25
+'materialize'=26
+'if'=27
+'absent'=28
+'on'=29
+'policy'=30
+'default'=31
+'source'=32
+'repository'=33
+'commit'=34
+'revision'=35
+'id'=36
+'doc'=37
+'mode'=38
+'emits'=39
+'receiver'=40
+'requires'=41
+'any'=42
+'get'=43
+'set'=44
+'watch'=45
+'start'=46
+'stop'=47
+'read'=48
+'write'=49
+'resolve'=50
+'connect'=51
+'disconnect'=52
+'call'=53
+'watch-start'=54
+'watch-stop'=55
+'subscribe'=56
+'unsubscribe'=57
+'optimistic-register'=58
+'crdt'=59
+'optional-one'=60
+'exactly-one'=61
+'many-unique'=62
+'many'=63
+'ordered'=64
+'unit'=65
+'watch-handle'=66
+'message'=67
+'atom-ref'=68
+'interface-ref'=69
+'optional'=70
+'list'=71
+'bool'=72
+'bytes'=73
+'double'=74
+'int32'=75
+'int64'=76
+'string'=77
+'uint32'=78
+'uint64'=79
+'true'=80
+'false'=81
+'null'=82
+'->'=83
+':'=84
+';'=85
+','=86
+'.'=87
+'{'=88
+'}'=89
+'['=90
+']'=91
+'('=92
+')'=93
+'<'=94
+'>'=95

src/capability-language/generated/QuixosCapabilityLexer.tokens

@@ -0,0 +1,197 @@
+WORKSPACE=1
+IMPORT=2
+EXTERNAL=3
+ATOM=4
+INTERFACE=5
+INTERFACES=6
+PACKAGE=7
+VALUE=8
+RELATION=9
+OPERATION=10
+FUNCTION=11
+CONSTRUCTOR=12
+CONSTRUCTS=13
+CONFORM=14
+AS=15
+BIND=16
+TO=17
+PRIVATE=18
+SHARED=19
+STATE=20
+EDGE=21
+PROJECTION=22
+WITH=23
+USING=24
+VIA=25
+MATERIALIZE=26
+IF=27
+ABSENT=28
+ON=29
+POLICY=30
+DEFAULT=31
+SOURCE=32
+REPOSITORY=33
+COMMIT=34
+REVISION=35
+ID=36
+DOC=37
+MODE=38
+EMITS=39
+RECEIVER=40
+REQUIRES=41
+ANY=42
+GET=43
+SET=44
+WATCH=45
+START=46
+STOP=47
+READ=48
+WRITE=49
+RESOLVE=50
+CONNECT=51
+DISCONNECT=52
+CALL=53
+WATCH_START=54
+WATCH_STOP=55
+SUBSCRIBE=56
+UNSUBSCRIBE=57
+OPTIMISTIC_REGISTER=58
+CRDT=59
+OPTIONAL_ONE=60
+EXACTLY_ONE=61
+MANY_UNIQUE=62
+MANY=63
+ORDERED=64
+UNIT=65
+WATCH_HANDLE=66
+MESSAGE=67
+ATOM_REF=68
+INTERFACE_REF=69
+OPTIONAL=70
+LIST=71
+BOOL=72
+BYTES=73
+DOUBLE=74
+INT32=75
+INT64=76
+STRING=77
+UINT32=78
+UINT64=79
+TRUE=80
+FALSE=81
+NULL=82
+ARROW=83
+COLON=84
+SEMI=85
+COMMA=86
+DOT=87
+LBRACE=88
+RBRACE=89
+LBRACK=90
+RBRACK=91
+LPAREN=92
+RPAREN=93
+LT=94
+GT=95
+INTEGER=96
+JSON_NUMBER=97
+IDENTIFIER=98
+STRING_LITERAL=99
+LINE_COMMENT=100
+BLOCK_COMMENT=101
+WS=102
+'workspace'=1
+'import'=2
+'external'=3
+'atom'=4
+'interface'=5
+'interfaces'=6
+'package'=7
+'value'=8
+'relation'=9
+'operation'=10
+'function'=11
+'constructor'=12
+'constructs'=13
+'conform'=14
+'as'=15
+'bind'=16
+'to'=17
+'private'=18
+'shared'=19
+'state'=20
+'edge'=21
+'projection'=22
+'with'=23
+'using'=24
+'via'=25
+'materialize'=26
+'if'=27
+'absent'=28
+'on'=29
+'policy'=30
+'default'=31
+'source'=32
+'repository'=33
+'commit'=34
+'revision'=35
+'id'=36
+'doc'=37
+'mode'=38
+'emits'=39
+'receiver'=40
+'requires'=41
+'any'=42
+'get'=43
+'set'=44
+'watch'=45
+'start'=46
+'stop'=47
+'read'=48
+'write'=49
+'resolve'=50
+'connect'=51
+'disconnect'=52
+'call'=53
+'watch-start'=54
+'watch-stop'=55
+'subscribe'=56
+'unsubscribe'=57
+'optimistic-register'=58
+'crdt'=59
+'optional-one'=60
+'exactly-one'=61
+'many-unique'=62
+'many'=63
+'ordered'=64
+'unit'=65
+'watch-handle'=66
+'message'=67
+'atom-ref'=68
+'interface-ref'=69
+'optional'=70
+'list'=71
+'bool'=72
+'bytes'=73
+'double'=74
+'int32'=75
+'int64'=76
+'string'=77
+'uint32'=78
+'uint64'=79
+'true'=80
+'false'=81
+'null'=82
+'->'=83
+':'=84
+';'=85
+','=86
+'.'=87
+'{'=88
+'}'=89
+'['=90
+']'=91
+'('=92
+')'=93
+'<'=94
+'>'=95

src/capability-language/generated/QuixosCapabilityLexer.ts

@@ -0,0 +1,556 @@
+
+import * as antlr from "antlr4ng";
+import { Token } from "antlr4ng";
+
+
+export class QuixosCapabilityLexer extends antlr.Lexer {
+    public static readonly WORKSPACE = 1;
+    public static readonly IMPORT = 2;
+    public static readonly EXTERNAL = 3;
+    public static readonly ATOM = 4;
+    public static readonly INTERFACE = 5;
+    public static readonly INTERFACES = 6;
+    public static readonly PACKAGE = 7;
+    public static readonly VALUE = 8;
+    public static readonly RELATION = 9;
+    public static readonly OPERATION = 10;
+    public static readonly FUNCTION = 11;
+    public static readonly CONSTRUCTOR = 12;
+    public static readonly CONSTRUCTS = 13;
+    public static readonly CONFORM = 14;
+    public static readonly AS = 15;
+    public static readonly BIND = 16;
+    public static readonly TO = 17;
+    public static readonly PRIVATE = 18;
+    public static readonly SHARED = 19;
+    public static readonly STATE = 20;
+    public static readonly EDGE = 21;
+    public static readonly PROJECTION = 22;
+    public static readonly WITH = 23;
+    public static readonly USING = 24;
+    public static readonly VIA = 25;
+    public static readonly MATERIALIZE = 26;
+    public static readonly IF = 27;
+    public static readonly ABSENT = 28;
+    public static readonly ON = 29;
+    public static readonly POLICY = 30;
+    public static readonly DEFAULT = 31;
+    public static readonly SOURCE = 32;
+    public static readonly REPOSITORY = 33;
+    public static readonly COMMIT = 34;
+    public static readonly REVISION = 35;
+    public static readonly ID = 36;
+    public static readonly DOC = 37;
+    public static readonly MODE = 38;
+    public static readonly EMITS = 39;
+    public static readonly RECEIVER = 40;
+    public static readonly REQUIRES = 41;
+    public static readonly ANY = 42;
+    public static readonly GET = 43;
+    public static readonly SET = 44;
+    public static readonly WATCH = 45;
+    public static readonly START = 46;
+    public static readonly STOP = 47;
+    public static readonly READ = 48;
+    public static readonly WRITE = 49;
+    public static readonly RESOLVE = 50;
+    public static readonly CONNECT = 51;
+    public static readonly DISCONNECT = 52;
+    public static readonly CALL = 53;
+    public static readonly WATCH_START = 54;
+    public static readonly WATCH_STOP = 55;
+    public static readonly SUBSCRIBE = 56;
+    public static readonly UNSUBSCRIBE = 57;
+    public static readonly OPTIMISTIC_REGISTER = 58;
+    public static readonly CRDT = 59;
+    public static readonly OPTIONAL_ONE = 60;
+    public static readonly EXACTLY_ONE = 61;
+    public static readonly MANY_UNIQUE = 62;
+    public static readonly MANY = 63;
+    public static readonly ORDERED = 64;
+    public static readonly UNIT = 65;
+    public static readonly WATCH_HANDLE = 66;
+    public static readonly MESSAGE = 67;
+    public static readonly ATOM_REF = 68;
+    public static readonly INTERFACE_REF = 69;
+    public static readonly OPTIONAL = 70;
+    public static readonly LIST = 71;
+    public static readonly BOOL = 72;
+    public static readonly BYTES = 73;
+    public static readonly DOUBLE = 74;
+    public static readonly INT32 = 75;
+    public static readonly INT64 = 76;
+    public static readonly STRING = 77;
+    public static readonly UINT32 = 78;
+    public static readonly UINT64 = 79;
+    public static readonly TRUE = 80;
+    public static readonly FALSE = 81;
+    public static readonly NULL = 82;
+    public static readonly ARROW = 83;
+    public static readonly COLON = 84;
+    public static readonly SEMI = 85;
+    public static readonly COMMA = 86;
+    public static readonly DOT = 87;
+    public static readonly LBRACE = 88;
+    public static readonly RBRACE = 89;
+    public static readonly LBRACK = 90;
+    public static readonly RBRACK = 91;
+    public static readonly LPAREN = 92;
+    public static readonly RPAREN = 93;
+    public static readonly LT = 94;
+    public static readonly GT = 95;
+    public static readonly INTEGER = 96;
+    public static readonly JSON_NUMBER = 97;
+    public static readonly IDENTIFIER = 98;
+    public static readonly STRING_LITERAL = 99;
+    public static readonly LINE_COMMENT = 100;
+    public static readonly BLOCK_COMMENT = 101;
+    public static readonly WS = 102;
+
+    public static readonly channelNames = [
+        "DEFAULT_TOKEN_CHANNEL", "HIDDEN"
+    ];
+
+    public static readonly literalNames = [
+        null, "'workspace'", "'import'", "'external'", "'atom'", "'interface'", 
+        "'interfaces'", "'package'", "'value'", "'relation'", "'operation'", 
+        "'function'", "'constructor'", "'constructs'", "'conform'", "'as'", 
+        "'bind'", "'to'", "'private'", "'shared'", "'state'", "'edge'", 
+        "'projection'", "'with'", "'using'", "'via'", "'materialize'", "'if'", 
+        "'absent'", "'on'", "'policy'", "'default'", "'source'", "'repository'", 
+        "'commit'", "'revision'", "'id'", "'doc'", "'mode'", "'emits'", 
+        "'receiver'", "'requires'", "'any'", "'get'", "'set'", "'watch'", 
+        "'start'", "'stop'", "'read'", "'write'", "'resolve'", "'connect'", 
+        "'disconnect'", "'call'", "'watch-start'", "'watch-stop'", "'subscribe'", 
+        "'unsubscribe'", "'optimistic-register'", "'crdt'", "'optional-one'", 
+        "'exactly-one'", "'many-unique'", "'many'", "'ordered'", "'unit'", 
+        "'watch-handle'", "'message'", "'atom-ref'", "'interface-ref'", 
+        "'optional'", "'list'", "'bool'", "'bytes'", "'double'", "'int32'", 
+        "'int64'", "'string'", "'uint32'", "'uint64'", "'true'", "'false'", 
+        "'null'", "'->'", "':'", "';'", "','", "'.'", "'{'", "'}'", "'['", 
+        "']'", "'('", "')'", "'<'", "'>'"
+    ];
+
+    public static readonly symbolicNames = [
+        null, "WORKSPACE", "IMPORT", "EXTERNAL", "ATOM", "INTERFACE", "INTERFACES", 
+        "PACKAGE", "VALUE", "RELATION", "OPERATION", "FUNCTION", "CONSTRUCTOR", 
+        "CONSTRUCTS", "CONFORM", "AS", "BIND", "TO", "PRIVATE", "SHARED", 
+        "STATE", "EDGE", "PROJECTION", "WITH", "USING", "VIA", "MATERIALIZE", 
+        "IF", "ABSENT", "ON", "POLICY", "DEFAULT", "SOURCE", "REPOSITORY", 
+        "COMMIT", "REVISION", "ID", "DOC", "MODE", "EMITS", "RECEIVER", 
+        "REQUIRES", "ANY", "GET", "SET", "WATCH", "START", "STOP", "READ", 
+        "WRITE", "RESOLVE", "CONNECT", "DISCONNECT", "CALL", "WATCH_START", 
+        "WATCH_STOP", "SUBSCRIBE", "UNSUBSCRIBE", "OPTIMISTIC_REGISTER", 
+        "CRDT", "OPTIONAL_ONE", "EXACTLY_ONE", "MANY_UNIQUE", "MANY", "ORDERED", 
+        "UNIT", "WATCH_HANDLE", "MESSAGE", "ATOM_REF", "INTERFACE_REF", 
+        "OPTIONAL", "LIST", "BOOL", "BYTES", "DOUBLE", "INT32", "INT64", 
+        "STRING", "UINT32", "UINT64", "TRUE", "FALSE", "NULL", "ARROW", 
+        "COLON", "SEMI", "COMMA", "DOT", "LBRACE", "RBRACE", "LBRACK", "RBRACK", 
+        "LPAREN", "RPAREN", "LT", "GT", "INTEGER", "JSON_NUMBER", "IDENTIFIER", 
+        "STRING_LITERAL", "LINE_COMMENT", "BLOCK_COMMENT", "WS"
+    ];
+
+    public static readonly modeNames = [
+        "DEFAULT_MODE",
+    ];
+
+    public static readonly ruleNames = [
+        "WORKSPACE", "IMPORT", "EXTERNAL", "ATOM", "INTERFACE", "INTERFACES", 
+        "PACKAGE", "VALUE", "RELATION", "OPERATION", "FUNCTION", "CONSTRUCTOR", 
+        "CONSTRUCTS", "CONFORM", "AS", "BIND", "TO", "PRIVATE", "SHARED", 
+        "STATE", "EDGE", "PROJECTION", "WITH", "USING", "VIA", "MATERIALIZE", 
+        "IF", "ABSENT", "ON", "POLICY", "DEFAULT", "SOURCE", "REPOSITORY", 
+        "COMMIT", "REVISION", "ID", "DOC", "MODE", "EMITS", "RECEIVER", 
+        "REQUIRES", "ANY", "GET", "SET", "WATCH", "START", "STOP", "READ", 
+        "WRITE", "RESOLVE", "CONNECT", "DISCONNECT", "CALL", "WATCH_START", 
+        "WATCH_STOP", "SUBSCRIBE", "UNSUBSCRIBE", "OPTIMISTIC_REGISTER", 
+        "CRDT", "OPTIONAL_ONE", "EXACTLY_ONE", "MANY_UNIQUE", "MANY", "ORDERED", 
+        "UNIT", "WATCH_HANDLE", "MESSAGE", "ATOM_REF", "INTERFACE_REF", 
+        "OPTIONAL", "LIST", "BOOL", "BYTES", "DOUBLE", "INT32", "INT64", 
+        "STRING", "UINT32", "UINT64", "TRUE", "FALSE", "NULL", "ARROW", 
+        "COLON", "SEMI", "COMMA", "DOT", "LBRACE", "RBRACE", "LBRACK", "RBRACK", 
+        "LPAREN", "RPAREN", "LT", "GT", "INTEGER", "JSON_NUMBER", "IDENTIFIER", 
+        "STRING_LITERAL", "ESC", "HEX", "LINE_COMMENT", "BLOCK_COMMENT", 
+        "WS",
+    ];
+
+
+    public constructor(input: antlr.CharStream) {
+        super(input);
+        this.interpreter = new antlr.LexerATNSimulator(this, QuixosCapabilityLexer._ATN, QuixosCapabilityLexer.decisionsToDFA, new antlr.PredictionContextCache());
+    }
+
+    public get grammarFileName(): string { return "QuixosCapability.g4"; }
+
+    public get literalNames(): (string | null)[] { return QuixosCapabilityLexer.literalNames; }
+    public get symbolicNames(): (string | null)[] { return QuixosCapabilityLexer.symbolicNames; }
+    public get ruleNames(): string[] { return QuixosCapabilityLexer.ruleNames; }
+
+    public get serializedATN(): number[] { return QuixosCapabilityLexer._serializedATN; }
+
+    public get channelNames(): string[] { return QuixosCapabilityLexer.channelNames; }
+
+    public get modeNames(): string[] { return QuixosCapabilityLexer.modeNames; }
+
+    public static readonly _serializedATN: number[] = [
+        4,0,102,957,6,-1,2,0,7,0,2,1,7,1,2,2,7,2,2,3,7,3,2,4,7,4,2,5,7,5,
+        2,6,7,6,2,7,7,7,2,8,7,8,2,9,7,9,2,10,7,10,2,11,7,11,2,12,7,12,2,
+        13,7,13,2,14,7,14,2,15,7,15,2,16,7,16,2,17,7,17,2,18,7,18,2,19,7,
+        19,2,20,7,20,2,21,7,21,2,22,7,22,2,23,7,23,2,24,7,24,2,25,7,25,2,
+        26,7,26,2,27,7,27,2,28,7,28,2,29,7,29,2,30,7,30,2,31,7,31,2,32,7,
+        32,2,33,7,33,2,34,7,34,2,35,7,35,2,36,7,36,2,37,7,37,2,38,7,38,2,
+        39,7,39,2,40,7,40,2,41,7,41,2,42,7,42,2,43,7,43,2,44,7,44,2,45,7,
+        45,2,46,7,46,2,47,7,47,2,48,7,48,2,49,7,49,2,50,7,50,2,51,7,51,2,
+        52,7,52,2,53,7,53,2,54,7,54,2,55,7,55,2,56,7,56,2,57,7,57,2,58,7,
+        58,2,59,7,59,2,60,7,60,2,61,7,61,2,62,7,62,2,63,7,63,2,64,7,64,2,
+        65,7,65,2,66,7,66,2,67,7,67,2,68,7,68,2,69,7,69,2,70,7,70,2,71,7,
+        71,2,72,7,72,2,73,7,73,2,74,7,74,2,75,7,75,2,76,7,76,2,77,7,77,2,
+        78,7,78,2,79,7,79,2,80,7,80,2,81,7,81,2,82,7,82,2,83,7,83,2,84,7,
+        84,2,85,7,85,2,86,7,86,2,87,7,87,2,88,7,88,2,89,7,89,2,90,7,90,2,
+        91,7,91,2,92,7,92,2,93,7,93,2,94,7,94,2,95,7,95,2,96,7,96,2,97,7,
+        97,2,98,7,98,2,99,7,99,2,100,7,100,2,101,7,101,2,102,7,102,2,103,
+        7,103,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,
+        1,1,1,1,1,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,3,1,3,1,3,1,3,1,
+        3,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,5,1,5,1,5,1,5,1,5,1,
+        5,1,5,1,5,1,5,1,5,1,5,1,6,1,6,1,6,1,6,1,6,1,6,1,6,1,6,1,7,1,7,1,
+        7,1,7,1,7,1,7,1,8,1,8,1,8,1,8,1,8,1,8,1,8,1,8,1,8,1,9,1,9,1,9,1,
+        9,1,9,1,9,1,9,1,9,1,9,1,9,1,10,1,10,1,10,1,10,1,10,1,10,1,10,1,10,
+        1,10,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,11,1,11,
+        1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,12,1,13,1,13,
+        1,13,1,13,1,13,1,13,1,13,1,13,1,14,1,14,1,14,1,15,1,15,1,15,1,15,
+        1,15,1,16,1,16,1,16,1,17,1,17,1,17,1,17,1,17,1,17,1,17,1,17,1,18,
+        1,18,1,18,1,18,1,18,1,18,1,18,1,19,1,19,1,19,1,19,1,19,1,19,1,20,
+        1,20,1,20,1,20,1,20,1,21,1,21,1,21,1,21,1,21,1,21,1,21,1,21,1,21,
+        1,21,1,21,1,22,1,22,1,22,1,22,1,22,1,23,1,23,1,23,1,23,1,23,1,23,
+        1,24,1,24,1,24,1,24,1,25,1,25,1,25,1,25,1,25,1,25,1,25,1,25,1,25,
+        1,25,1,25,1,25,1,26,1,26,1,26,1,27,1,27,1,27,1,27,1,27,1,27,1,27,
+        1,28,1,28,1,28,1,29,1,29,1,29,1,29,1,29,1,29,1,29,1,30,1,30,1,30,
+        1,30,1,30,1,30,1,30,1,30,1,31,1,31,1,31,1,31,1,31,1,31,1,31,1,32,
+        1,32,1,32,1,32,1,32,1,32,1,32,1,32,1,32,1,32,1,32,1,33,1,33,1,33,
+        1,33,1,33,1,33,1,33,1,34,1,34,1,34,1,34,1,34,1,34,1,34,1,34,1,34,
+        1,35,1,35,1,35,1,36,1,36,1,36,1,36,1,37,1,37,1,37,1,37,1,37,1,38,
+        1,38,1,38,1,38,1,38,1,38,1,39,1,39,1,39,1,39,1,39,1,39,1,39,1,39,
+        1,39,1,40,1,40,1,40,1,40,1,40,1,40,1,40,1,40,1,40,1,41,1,41,1,41,
+        1,41,1,42,1,42,1,42,1,42,1,43,1,43,1,43,1,43,1,44,1,44,1,44,1,44,
+        1,44,1,44,1,45,1,45,1,45,1,45,1,45,1,45,1,46,1,46,1,46,1,46,1,46,
+        1,47,1,47,1,47,1,47,1,47,1,48,1,48,1,48,1,48,1,48,1,48,1,49,1,49,
+        1,49,1,49,1,49,1,49,1,49,1,49,1,50,1,50,1,50,1,50,1,50,1,50,1,50,
+        1,50,1,51,1,51,1,51,1,51,1,51,1,51,1,51,1,51,1,51,1,51,1,51,1,52,
+        1,52,1,52,1,52,1,52,1,53,1,53,1,53,1,53,1,53,1,53,1,53,1,53,1,53,
+        1,53,1,53,1,53,1,54,1,54,1,54,1,54,1,54,1,54,1,54,1,54,1,54,1,54,
+        1,54,1,55,1,55,1,55,1,55,1,55,1,55,1,55,1,55,1,55,1,55,1,56,1,56,
+        1,56,1,56,1,56,1,56,1,56,1,56,1,56,1,56,1,56,1,56,1,57,1,57,1,57,
+        1,57,1,57,1,57,1,57,1,57,1,57,1,57,1,57,1,57,1,57,1,57,1,57,1,57,
+        1,57,1,57,1,57,1,57,1,58,1,58,1,58,1,58,1,58,1,59,1,59,1,59,1,59,
+        1,59,1,59,1,59,1,59,1,59,1,59,1,59,1,59,1,59,1,60,1,60,1,60,1,60,
+        1,60,1,60,1,60,1,60,1,60,1,60,1,60,1,60,1,61,1,61,1,61,1,61,1,61,
+        1,61,1,61,1,61,1,61,1,61,1,61,1,61,1,62,1,62,1,62,1,62,1,62,1,63,
+        1,63,1,63,1,63,1,63,1,63,1,63,1,63,1,64,1,64,1,64,1,64,1,64,1,65,
+        1,65,1,65,1,65,1,65,1,65,1,65,1,65,1,65,1,65,1,65,1,65,1,65,1,66,
+        1,66,1,66,1,66,1,66,1,66,1,66,1,66,1,67,1,67,1,67,1,67,1,67,1,67,
+        1,67,1,67,1,67,1,68,1,68,1,68,1,68,1,68,1,68,1,68,1,68,1,68,1,68,
+        1,68,1,68,1,68,1,68,1,69,1,69,1,69,1,69,1,69,1,69,1,69,1,69,1,69,
+        1,70,1,70,1,70,1,70,1,70,1,71,1,71,1,71,1,71,1,71,1,72,1,72,1,72,
+        1,72,1,72,1,72,1,73,1,73,1,73,1,73,1,73,1,73,1,73,1,74,1,74,1,74,
+        1,74,1,74,1,74,1,75,1,75,1,75,1,75,1,75,1,75,1,76,1,76,1,76,1,76,
+        1,76,1,76,1,76,1,77,1,77,1,77,1,77,1,77,1,77,1,77,1,78,1,78,1,78,
+        1,78,1,78,1,78,1,78,1,79,1,79,1,79,1,79,1,79,1,80,1,80,1,80,1,80,
+        1,80,1,80,1,81,1,81,1,81,1,81,1,81,1,82,1,82,1,82,1,83,1,83,1,84,
+        1,84,1,85,1,85,1,86,1,86,1,87,1,87,1,88,1,88,1,89,1,89,1,90,1,90,
+        1,91,1,91,1,92,1,92,1,93,1,93,1,94,1,94,1,95,3,95,858,8,95,1,95,
+        4,95,861,8,95,11,95,12,95,862,1,96,3,96,866,8,96,1,96,1,96,1,96,
+        5,96,871,8,96,10,96,12,96,874,9,96,3,96,876,8,96,1,96,1,96,4,96,
+        880,8,96,11,96,12,96,881,3,96,884,8,96,1,96,1,96,3,96,888,8,96,1,
+        96,4,96,891,8,96,11,96,12,96,892,3,96,895,8,96,1,97,1,97,5,97,899,
+        8,97,10,97,12,97,902,9,97,1,98,1,98,1,98,5,98,907,8,98,10,98,12,
+        98,910,9,98,1,98,1,98,1,99,1,99,1,99,1,99,1,99,1,99,1,99,1,99,3,
+        99,922,8,99,1,100,1,100,1,101,1,101,1,101,1,101,5,101,930,8,101,
+        10,101,12,101,933,9,101,1,101,1,101,1,102,1,102,1,102,1,102,5,102,
+        941,8,102,10,102,12,102,944,9,102,1,102,1,102,1,102,1,102,1,102,
+        1,103,4,103,952,8,103,11,103,12,103,953,1,103,1,103,1,942,0,104,
+        1,1,3,2,5,3,7,4,9,5,11,6,13,7,15,8,17,9,19,10,21,11,23,12,25,13,
+        27,14,29,15,31,16,33,17,35,18,37,19,39,20,41,21,43,22,45,23,47,24,
+        49,25,51,26,53,27,55,28,57,29,59,30,61,31,63,32,65,33,67,34,69,35,
+        71,36,73,37,75,38,77,39,79,40,81,41,83,42,85,43,87,44,89,45,91,46,
+        93,47,95,48,97,49,99,50,101,51,103,52,105,53,107,54,109,55,111,56,
+        113,57,115,58,117,59,119,60,121,61,123,62,125,63,127,64,129,65,131,
+        66,133,67,135,68,137,69,139,70,141,71,143,72,145,73,147,74,149,75,
+        151,76,153,77,155,78,157,79,159,80,161,81,163,82,165,83,167,84,169,
+        85,171,86,173,87,175,88,177,89,179,90,181,91,183,92,185,93,187,94,
+        189,95,191,96,193,97,195,98,197,99,199,0,201,0,203,100,205,101,207,
+        102,1,0,11,1,0,48,57,1,0,49,57,2,0,69,69,101,101,2,0,43,43,45,45,
+        3,0,65,90,95,95,97,122,4,0,48,57,65,90,95,95,97,122,4,0,10,10,13,
+        13,34,34,92,92,8,0,34,34,47,47,92,92,98,98,102,102,110,110,114,114,
+        116,116,3,0,48,57,65,70,97,102,2,0,10,10,13,13,3,0,9,10,13,13,32,
+        32,971,0,1,1,0,0,0,0,3,1,0,0,0,0,5,1,0,0,0,0,7,1,0,0,0,0,9,1,0,0,
+        0,0,11,1,0,0,0,0,13,1,0,0,0,0,15,1,0,0,0,0,17,1,0,0,0,0,19,1,0,0,
+        0,0,21,1,0,0,0,0,23,1,0,0,0,0,25,1,0,0,0,0,27,1,0,0,0,0,29,1,0,0,
+        0,0,31,1,0,0,0,0,33,1,0,0,0,0,35,1,0,0,0,0,37,1,0,0,0,0,39,1,0,0,
+        0,0,41,1,0,0,0,0,43,1,0,0,0,0,45,1,0,0,0,0,47,1,0,0,0,0,49,1,0,0,
+        0,0,51,1,0,0,0,0,53,1,0,0,0,0,55,1,0,0,0,0,57,1,0,0,0,0,59,1,0,0,
+        0,0,61,1,0,0,0,0,63,1,0,0,0,0,65,1,0,0,0,0,67,1,0,0,0,0,69,1,0,0,
+        0,0,71,1,0,0,0,0,73,1,0,0,0,0,75,1,0,0,0,0,77,1,0,0,0,0,79,1,0,0,
+        0,0,81,1,0,0,0,0,83,1,0,0,0,0,85,1,0,0,0,0,87,1,0,0,0,0,89,1,0,0,
+        0,0,91,1,0,0,0,0,93,1,0,0,0,0,95,1,0,0,0,0,97,1,0,0,0,0,99,1,0,0,
+        0,0,101,1,0,0,0,0,103,1,0,0,0,0,105,1,0,0,0,0,107,1,0,0,0,0,109,
+        1,0,0,0,0,111,1,0,0,0,0,113,1,0,0,0,0,115,1,0,0,0,0,117,1,0,0,0,
+        0,119,1,0,0,0,0,121,1,0,0,0,0,123,1,0,0,0,0,125,1,0,0,0,0,127,1,
+        0,0,0,0,129,1,0,0,0,0,131,1,0,0,0,0,133,1,0,0,0,0,135,1,0,0,0,0,
+        137,1,0,0,0,0,139,1,0,0,0,0,141,1,0,0,0,0,143,1,0,0,0,0,145,1,0,
+        0,0,0,147,1,0,0,0,0,149,1,0,0,0,0,151,1,0,0,0,0,153,1,0,0,0,0,155,
+        1,0,0,0,0,157,1,0,0,0,0,159,1,0,0,0,0,161,1,0,0,0,0,163,1,0,0,0,
+        0,165,1,0,0,0,0,167,1,0,0,0,0,169,1,0,0,0,0,171,1,0,0,0,0,173,1,
+        0,0,0,0,175,1,0,0,0,0,177,1,0,0,0,0,179,1,0,0,0,0,181,1,0,0,0,0,
+        183,1,0,0,0,0,185,1,0,0,0,0,187,1,0,0,0,0,189,1,0,0,0,0,191,1,0,
+        0,0,0,193,1,0,0,0,0,195,1,0,0,0,0,197,1,0,0,0,0,203,1,0,0,0,0,205,
+        1,0,0,0,0,207,1,0,0,0,1,209,1,0,0,0,3,219,1,0,0,0,5,226,1,0,0,0,
+        7,235,1,0,0,0,9,240,1,0,0,0,11,250,1,0,0,0,13,261,1,0,0,0,15,269,
+        1,0,0,0,17,275,1,0,0,0,19,284,1,0,0,0,21,294,1,0,0,0,23,303,1,0,
+        0,0,25,315,1,0,0,0,27,326,1,0,0,0,29,334,1,0,0,0,31,337,1,0,0,0,
+        33,342,1,0,0,0,35,345,1,0,0,0,37,353,1,0,0,0,39,360,1,0,0,0,41,366,
+        1,0,0,0,43,371,1,0,0,0,45,382,1,0,0,0,47,387,1,0,0,0,49,393,1,0,
+        0,0,51,397,1,0,0,0,53,409,1,0,0,0,55,412,1,0,0,0,57,419,1,0,0,0,
+        59,422,1,0,0,0,61,429,1,0,0,0,63,437,1,0,0,0,65,444,1,0,0,0,67,455,
+        1,0,0,0,69,462,1,0,0,0,71,471,1,0,0,0,73,474,1,0,0,0,75,478,1,0,
+        0,0,77,483,1,0,0,0,79,489,1,0,0,0,81,498,1,0,0,0,83,507,1,0,0,0,
+        85,511,1,0,0,0,87,515,1,0,0,0,89,519,1,0,0,0,91,525,1,0,0,0,93,531,
+        1,0,0,0,95,536,1,0,0,0,97,541,1,0,0,0,99,547,1,0,0,0,101,555,1,0,
+        0,0,103,563,1,0,0,0,105,574,1,0,0,0,107,579,1,0,0,0,109,591,1,0,
+        0,0,111,602,1,0,0,0,113,612,1,0,0,0,115,624,1,0,0,0,117,644,1,0,
+        0,0,119,649,1,0,0,0,121,662,1,0,0,0,123,674,1,0,0,0,125,686,1,0,
+        0,0,127,691,1,0,0,0,129,699,1,0,0,0,131,704,1,0,0,0,133,717,1,0,
+        0,0,135,725,1,0,0,0,137,734,1,0,0,0,139,748,1,0,0,0,141,757,1,0,
+        0,0,143,762,1,0,0,0,145,767,1,0,0,0,147,773,1,0,0,0,149,780,1,0,
+        0,0,151,786,1,0,0,0,153,792,1,0,0,0,155,799,1,0,0,0,157,806,1,0,
+        0,0,159,813,1,0,0,0,161,818,1,0,0,0,163,824,1,0,0,0,165,829,1,0,
+        0,0,167,832,1,0,0,0,169,834,1,0,0,0,171,836,1,0,0,0,173,838,1,0,
+        0,0,175,840,1,0,0,0,177,842,1,0,0,0,179,844,1,0,0,0,181,846,1,0,
+        0,0,183,848,1,0,0,0,185,850,1,0,0,0,187,852,1,0,0,0,189,854,1,0,
+        0,0,191,857,1,0,0,0,193,865,1,0,0,0,195,896,1,0,0,0,197,903,1,0,
+        0,0,199,913,1,0,0,0,201,923,1,0,0,0,203,925,1,0,0,0,205,936,1,0,
+        0,0,207,951,1,0,0,0,209,210,5,119,0,0,210,211,5,111,0,0,211,212,
+        5,114,0,0,212,213,5,107,0,0,213,214,5,115,0,0,214,215,5,112,0,0,
+        215,216,5,97,0,0,216,217,5,99,0,0,217,218,5,101,0,0,218,2,1,0,0,
+        0,219,220,5,105,0,0,220,221,5,109,0,0,221,222,5,112,0,0,222,223,
+        5,111,0,0,223,224,5,114,0,0,224,225,5,116,0,0,225,4,1,0,0,0,226,
+        227,5,101,0,0,227,228,5,120,0,0,228,229,5,116,0,0,229,230,5,101,
+        0,0,230,231,5,114,0,0,231,232,5,110,0,0,232,233,5,97,0,0,233,234,
+        5,108,0,0,234,6,1,0,0,0,235,236,5,97,0,0,236,237,5,116,0,0,237,238,
+        5,111,0,0,238,239,5,109,0,0,239,8,1,0,0,0,240,241,5,105,0,0,241,
+        242,5,110,0,0,242,243,5,116,0,0,243,244,5,101,0,0,244,245,5,114,
+        0,0,245,246,5,102,0,0,246,247,5,97,0,0,247,248,5,99,0,0,248,249,
+        5,101,0,0,249,10,1,0,0,0,250,251,5,105,0,0,251,252,5,110,0,0,252,
+        253,5,116,0,0,253,254,5,101,0,0,254,255,5,114,0,0,255,256,5,102,
+        0,0,256,257,5,97,0,0,257,258,5,99,0,0,258,259,5,101,0,0,259,260,
+        5,115,0,0,260,12,1,0,0,0,261,262,5,112,0,0,262,263,5,97,0,0,263,
+        264,5,99,0,0,264,265,5,107,0,0,265,266,5,97,0,0,266,267,5,103,0,
+        0,267,268,5,101,0,0,268,14,1,0,0,0,269,270,5,118,0,0,270,271,5,97,
+        0,0,271,272,5,108,0,0,272,273,5,117,0,0,273,274,5,101,0,0,274,16,
+        1,0,0,0,275,276,5,114,0,0,276,277,5,101,0,0,277,278,5,108,0,0,278,
+        279,5,97,0,0,279,280,5,116,0,0,280,281,5,105,0,0,281,282,5,111,0,
+        0,282,283,5,110,0,0,283,18,1,0,0,0,284,285,5,111,0,0,285,286,5,112,
+        0,0,286,287,5,101,0,0,287,288,5,114,0,0,288,289,5,97,0,0,289,290,
+        5,116,0,0,290,291,5,105,0,0,291,292,5,111,0,0,292,293,5,110,0,0,
+        293,20,1,0,0,0,294,295,5,102,0,0,295,296,5,117,0,0,296,297,5,110,
+        0,0,297,298,5,99,0,0,298,299,5,116,0,0,299,300,5,105,0,0,300,301,
+        5,111,0,0,301,302,5,110,0,0,302,22,1,0,0,0,303,304,5,99,0,0,304,
+        305,5,111,0,0,305,306,5,110,0,0,306,307,5,115,0,0,307,308,5,116,
+        0,0,308,309,5,114,0,0,309,310,5,117,0,0,310,311,5,99,0,0,311,312,
+        5,116,0,0,312,313,5,111,0,0,313,314,5,114,0,0,314,24,1,0,0,0,315,
+        316,5,99,0,0,316,317,5,111,0,0,317,318,5,110,0,0,318,319,5,115,0,
+        0,319,320,5,116,0,0,320,321,5,114,0,0,321,322,5,117,0,0,322,323,
+        5,99,0,0,323,324,5,116,0,0,324,325,5,115,0,0,325,26,1,0,0,0,326,
+        327,5,99,0,0,327,328,5,111,0,0,328,329,5,110,0,0,329,330,5,102,0,
+        0,330,331,5,111,0,0,331,332,5,114,0,0,332,333,5,109,0,0,333,28,1,
+        0,0,0,334,335,5,97,0,0,335,336,5,115,0,0,336,30,1,0,0,0,337,338,
+        5,98,0,0,338,339,5,105,0,0,339,340,5,110,0,0,340,341,5,100,0,0,341,
+        32,1,0,0,0,342,343,5,116,0,0,343,344,5,111,0,0,344,34,1,0,0,0,345,
+        346,5,112,0,0,346,347,5,114,0,0,347,348,5,105,0,0,348,349,5,118,
+        0,0,349,350,5,97,0,0,350,351,5,116,0,0,351,352,5,101,0,0,352,36,
+        1,0,0,0,353,354,5,115,0,0,354,355,5,104,0,0,355,356,5,97,0,0,356,
+        357,5,114,0,0,357,358,5,101,0,0,358,359,5,100,0,0,359,38,1,0,0,0,
+        360,361,5,115,0,0,361,362,5,116,0,0,362,363,5,97,0,0,363,364,5,116,
+        0,0,364,365,5,101,0,0,365,40,1,0,0,0,366,367,5,101,0,0,367,368,5,
+        100,0,0,368,369,5,103,0,0,369,370,5,101,0,0,370,42,1,0,0,0,371,372,
+        5,112,0,0,372,373,5,114,0,0,373,374,5,111,0,0,374,375,5,106,0,0,
+        375,376,5,101,0,0,376,377,5,99,0,0,377,378,5,116,0,0,378,379,5,105,
+        0,0,379,380,5,111,0,0,380,381,5,110,0,0,381,44,1,0,0,0,382,383,5,
+        119,0,0,383,384,5,105,0,0,384,385,5,116,0,0,385,386,5,104,0,0,386,
+        46,1,0,0,0,387,388,5,117,0,0,388,389,5,115,0,0,389,390,5,105,0,0,
+        390,391,5,110,0,0,391,392,5,103,0,0,392,48,1,0,0,0,393,394,5,118,
+        0,0,394,395,5,105,0,0,395,396,5,97,0,0,396,50,1,0,0,0,397,398,5,
+        109,0,0,398,399,5,97,0,0,399,400,5,116,0,0,400,401,5,101,0,0,401,
+        402,5,114,0,0,402,403,5,105,0,0,403,404,5,97,0,0,404,405,5,108,0,
+        0,405,406,5,105,0,0,406,407,5,122,0,0,407,408,5,101,0,0,408,52,1,
+        0,0,0,409,410,5,105,0,0,410,411,5,102,0,0,411,54,1,0,0,0,412,413,
+        5,97,0,0,413,414,5,98,0,0,414,415,5,115,0,0,415,416,5,101,0,0,416,
+        417,5,110,0,0,417,418,5,116,0,0,418,56,1,0,0,0,419,420,5,111,0,0,
+        420,421,5,110,0,0,421,58,1,0,0,0,422,423,5,112,0,0,423,424,5,111,
+        0,0,424,425,5,108,0,0,425,426,5,105,0,0,426,427,5,99,0,0,427,428,
+        5,121,0,0,428,60,1,0,0,0,429,430,5,100,0,0,430,431,5,101,0,0,431,
+        432,5,102,0,0,432,433,5,97,0,0,433,434,5,117,0,0,434,435,5,108,0,
+        0,435,436,5,116,0,0,436,62,1,0,0,0,437,438,5,115,0,0,438,439,5,111,
+        0,0,439,440,5,117,0,0,440,441,5,114,0,0,441,442,5,99,0,0,442,443,
+        5,101,0,0,443,64,1,0,0,0,444,445,5,114,0,0,445,446,5,101,0,0,446,
+        447,5,112,0,0,447,448,5,111,0,0,448,449,5,115,0,0,449,450,5,105,
+        0,0,450,451,5,116,0,0,451,452,5,111,0,0,452,453,5,114,0,0,453,454,
+        5,121,0,0,454,66,1,0,0,0,455,456,5,99,0,0,456,457,5,111,0,0,457,
+        458,5,109,0,0,458,459,5,109,0,0,459,460,5,105,0,0,460,461,5,116,
+        0,0,461,68,1,0,0,0,462,463,5,114,0,0,463,464,5,101,0,0,464,465,5,
+        118,0,0,465,466,5,105,0,0,466,467,5,115,0,0,467,468,5,105,0,0,468,
+        469,5,111,0,0,469,470,5,110,0,0,470,70,1,0,0,0,471,472,5,105,0,0,
+        472,473,5,100,0,0,473,72,1,0,0,0,474,475,5,100,0,0,475,476,5,111,
+        0,0,476,477,5,99,0,0,477,74,1,0,0,0,478,479,5,109,0,0,479,480,5,
+        111,0,0,480,481,5,100,0,0,481,482,5,101,0,0,482,76,1,0,0,0,483,484,
+        5,101,0,0,484,485,5,109,0,0,485,486,5,105,0,0,486,487,5,116,0,0,
+        487,488,5,115,0,0,488,78,1,0,0,0,489,490,5,114,0,0,490,491,5,101,
+        0,0,491,492,5,99,0,0,492,493,5,101,0,0,493,494,5,105,0,0,494,495,
+        5,118,0,0,495,496,5,101,0,0,496,497,5,114,0,0,497,80,1,0,0,0,498,
+        499,5,114,0,0,499,500,5,101,0,0,500,501,5,113,0,0,501,502,5,117,
+        0,0,502,503,5,105,0,0,503,504,5,114,0,0,504,505,5,101,0,0,505,506,
+        5,115,0,0,506,82,1,0,0,0,507,508,5,97,0,0,508,509,5,110,0,0,509,
+        510,5,121,0,0,510,84,1,0,0,0,511,512,5,103,0,0,512,513,5,101,0,0,
+        513,514,5,116,0,0,514,86,1,0,0,0,515,516,5,115,0,0,516,517,5,101,
+        0,0,517,518,5,116,0,0,518,88,1,0,0,0,519,520,5,119,0,0,520,521,5,
+        97,0,0,521,522,5,116,0,0,522,523,5,99,0,0,523,524,5,104,0,0,524,
+        90,1,0,0,0,525,526,5,115,0,0,526,527,5,116,0,0,527,528,5,97,0,0,
+        528,529,5,114,0,0,529,530,5,116,0,0,530,92,1,0,0,0,531,532,5,115,
+        0,0,532,533,5,116,0,0,533,534,5,111,0,0,534,535,5,112,0,0,535,94,
+        1,0,0,0,536,537,5,114,0,0,537,538,5,101,0,0,538,539,5,97,0,0,539,
+        540,5,100,0,0,540,96,1,0,0,0,541,542,5,119,0,0,542,543,5,114,0,0,
+        543,544,5,105,0,0,544,545,5,116,0,0,545,546,5,101,0,0,546,98,1,0,
+        0,0,547,548,5,114,0,0,548,549,5,101,0,0,549,550,5,115,0,0,550,551,
+        5,111,0,0,551,552,5,108,0,0,552,553,5,118,0,0,553,554,5,101,0,0,
+        554,100,1,0,0,0,555,556,5,99,0,0,556,557,5,111,0,0,557,558,5,110,
+        0,0,558,559,5,110,0,0,559,560,5,101,0,0,560,561,5,99,0,0,561,562,
+        5,116,0,0,562,102,1,0,0,0,563,564,5,100,0,0,564,565,5,105,0,0,565,
+        566,5,115,0,0,566,567,5,99,0,0,567,568,5,111,0,0,568,569,5,110,0,
+        0,569,570,5,110,0,0,570,571,5,101,0,0,571,572,5,99,0,0,572,573,5,
+        116,0,0,573,104,1,0,0,0,574,575,5,99,0,0,575,576,5,97,0,0,576,577,
+        5,108,0,0,577,578,5,108,0,0,578,106,1,0,0,0,579,580,5,119,0,0,580,
+        581,5,97,0,0,581,582,5,116,0,0,582,583,5,99,0,0,583,584,5,104,0,
+        0,584,585,5,45,0,0,585,586,5,115,0,0,586,587,5,116,0,0,587,588,5,
+        97,0,0,588,589,5,114,0,0,589,590,5,116,0,0,590,108,1,0,0,0,591,592,
+        5,119,0,0,592,593,5,97,0,0,593,594,5,116,0,0,594,595,5,99,0,0,595,
+        596,5,104,0,0,596,597,5,45,0,0,597,598,5,115,0,0,598,599,5,116,0,
+        0,599,600,5,111,0,0,600,601,5,112,0,0,601,110,1,0,0,0,602,603,5,
+        115,0,0,603,604,5,117,0,0,604,605,5,98,0,0,605,606,5,115,0,0,606,
+        607,5,99,0,0,607,608,5,114,0,0,608,609,5,105,0,0,609,610,5,98,0,
+        0,610,611,5,101,0,0,611,112,1,0,0,0,612,613,5,117,0,0,613,614,5,
+        110,0,0,614,615,5,115,0,0,615,616,5,117,0,0,616,617,5,98,0,0,617,
+        618,5,115,0,0,618,619,5,99,0,0,619,620,5,114,0,0,620,621,5,105,0,
+        0,621,622,5,98,0,0,622,623,5,101,0,0,623,114,1,0,0,0,624,625,5,111,
+        0,0,625,626,5,112,0,0,626,627,5,116,0,0,627,628,5,105,0,0,628,629,
+        5,109,0,0,629,630,5,105,0,0,630,631,5,115,0,0,631,632,5,116,0,0,
+        632,633,5,105,0,0,633,634,5,99,0,0,634,635,5,45,0,0,635,636,5,114,
+        0,0,636,637,5,101,0,0,637,638,5,103,0,0,638,639,5,105,0,0,639,640,
+        5,115,0,0,640,641,5,116,0,0,641,642,5,101,0,0,642,643,5,114,0,0,
+        643,116,1,0,0,0,644,645,5,99,0,0,645,646,5,114,0,0,646,647,5,100,
+        0,0,647,648,5,116,0,0,648,118,1,0,0,0,649,650,5,111,0,0,650,651,
+        5,112,0,0,651,652,5,116,0,0,652,653,5,105,0,0,653,654,5,111,0,0,
+        654,655,5,110,0,0,655,656,5,97,0,0,656,657,5,108,0,0,657,658,5,45,
+        0,0,658,659,5,111,0,0,659,660,5,110,0,0,660,661,5,101,0,0,661,120,
+        1,0,0,0,662,663,5,101,0,0,663,664,5,120,0,0,664,665,5,97,0,0,665,
+        666,5,99,0,0,666,667,5,116,0,0,667,668,5,108,0,0,668,669,5,121,0,
+        0,669,670,5,45,0,0,670,671,5,111,0,0,671,672,5,110,0,0,672,673,5,
+        101,0,0,673,122,1,0,0,0,674,675,5,109,0,0,675,676,5,97,0,0,676,677,
+        5,110,0,0,677,678,5,121,0,0,678,679,5,45,0,0,679,680,5,117,0,0,680,
+        681,5,110,0,0,681,682,5,105,0,0,682,683,5,113,0,0,683,684,5,117,
+        0,0,684,685,5,101,0,0,685,124,1,0,0,0,686,687,5,109,0,0,687,688,
+        5,97,0,0,688,689,5,110,0,0,689,690,5,121,0,0,690,126,1,0,0,0,691,
+        692,5,111,0,0,692,693,5,114,0,0,693,694,5,100,0,0,694,695,5,101,
+        0,0,695,696,5,114,0,0,696,697,5,101,0,0,697,698,5,100,0,0,698,128,
+        1,0,0,0,699,700,5,117,0,0,700,701,5,110,0,0,701,702,5,105,0,0,702,
+        703,5,116,0,0,703,130,1,0,0,0,704,705,5,119,0,0,705,706,5,97,0,0,
+        706,707,5,116,0,0,707,708,5,99,0,0,708,709,5,104,0,0,709,710,5,45,
+        0,0,710,711,5,104,0,0,711,712,5,97,0,0,712,713,5,110,0,0,713,714,
+        5,100,0,0,714,715,5,108,0,0,715,716,5,101,0,0,716,132,1,0,0,0,717,
+        718,5,109,0,0,718,719,5,101,0,0,719,720,5,115,0,0,720,721,5,115,
+        0,0,721,722,5,97,0,0,722,723,5,103,0,0,723,724,5,101,0,0,724,134,
+        1,0,0,0,725,726,5,97,0,0,726,727,5,116,0,0,727,728,5,111,0,0,728,
+        729,5,109,0,0,729,730,5,45,0,0,730,731,5,114,0,0,731,732,5,101,0,
+        0,732,733,5,102,0,0,733,136,1,0,0,0,734,735,5,105,0,0,735,736,5,
+        110,0,0,736,737,5,116,0,0,737,738,5,101,0,0,738,739,5,114,0,0,739,
+        740,5,102,0,0,740,741,5,97,0,0,741,742,5,99,0,0,742,743,5,101,0,
+        0,743,744,5,45,0,0,744,745,5,114,0,0,745,746,5,101,0,0,746,747,5,
+        102,0,0,747,138,1,0,0,0,748,749,5,111,0,0,749,750,5,112,0,0,750,
+        751,5,116,0,0,751,752,5,105,0,0,752,753,5,111,0,0,753,754,5,110,
+        0,0,754,755,5,97,0,0,755,756,5,108,0,0,756,140,1,0,0,0,757,758,5,
+        108,0,0,758,759,5,105,0,0,759,760,5,115,0,0,760,761,5,116,0,0,761,
+        142,1,0,0,0,762,763,5,98,0,0,763,764,5,111,0,0,764,765,5,111,0,0,
+        765,766,5,108,0,0,766,144,1,0,0,0,767,768,5,98,0,0,768,769,5,121,
+        0,0,769,770,5,116,0,0,770,771,5,101,0,0,771,772,5,115,0,0,772,146,
+        1,0,0,0,773,774,5,100,0,0,774,775,5,111,0,0,775,776,5,117,0,0,776,
+        777,5,98,0,0,777,778,5,108,0,0,778,779,5,101,0,0,779,148,1,0,0,0,
+        780,781,5,105,0,0,781,782,5,110,0,0,782,783,5,116,0,0,783,784,5,
+        51,0,0,784,785,5,50,0,0,785,150,1,0,0,0,786,787,5,105,0,0,787,788,
+        5,110,0,0,788,789,5,116,0,0,789,790,5,54,0,0,790,791,5,52,0,0,791,
+        152,1,0,0,0,792,793,5,115,0,0,793,794,5,116,0,0,794,795,5,114,0,
+        0,795,796,5,105,0,0,796,797,5,110,0,0,797,798,5,103,0,0,798,154,
+        1,0,0,0,799,800,5,117,0,0,800,801,5,105,0,0,801,802,5,110,0,0,802,
+        803,5,116,0,0,803,804,5,51,0,0,804,805,5,50,0,0,805,156,1,0,0,0,
+        806,807,5,117,0,0,807,808,5,105,0,0,808,809,5,110,0,0,809,810,5,
+        116,0,0,810,811,5,54,0,0,811,812,5,52,0,0,812,158,1,0,0,0,813,814,
+        5,116,0,0,814,815,5,114,0,0,815,816,5,117,0,0,816,817,5,101,0,0,
+        817,160,1,0,0,0,818,819,5,102,0,0,819,820,5,97,0,0,820,821,5,108,
+        0,0,821,822,5,115,0,0,822,823,5,101,0,0,823,162,1,0,0,0,824,825,
+        5,110,0,0,825,826,5,117,0,0,826,827,5,108,0,0,827,828,5,108,0,0,
+        828,164,1,0,0,0,829,830,5,45,0,0,830,831,5,62,0,0,831,166,1,0,0,
+        0,832,833,5,58,0,0,833,168,1,0,0,0,834,835,5,59,0,0,835,170,1,0,
+        0,0,836,837,5,44,0,0,837,172,1,0,0,0,838,839,5,46,0,0,839,174,1,
+        0,0,0,840,841,5,123,0,0,841,176,1,0,0,0,842,843,5,125,0,0,843,178,
+        1,0,0,0,844,845,5,91,0,0,845,180,1,0,0,0,846,847,5,93,0,0,847,182,
+        1,0,0,0,848,849,5,40,0,0,849,184,1,0,0,0,850,851,5,41,0,0,851,186,
+        1,0,0,0,852,853,5,60,0,0,853,188,1,0,0,0,854,855,5,62,0,0,855,190,
+        1,0,0,0,856,858,5,45,0,0,857,856,1,0,0,0,857,858,1,0,0,0,858,860,
+        1,0,0,0,859,861,7,0,0,0,860,859,1,0,0,0,861,862,1,0,0,0,862,860,
+        1,0,0,0,862,863,1,0,0,0,863,192,1,0,0,0,864,866,5,45,0,0,865,864,
+        1,0,0,0,865,866,1,0,0,0,866,875,1,0,0,0,867,876,5,48,0,0,868,872,
+        7,1,0,0,869,871,7,0,0,0,870,869,1,0,0,0,871,874,1,0,0,0,872,870,
+        1,0,0,0,872,873,1,0,0,0,873,876,1,0,0,0,874,872,1,0,0,0,875,867,
+        1,0,0,0,875,868,1,0,0,0,876,883,1,0,0,0,877,879,5,46,0,0,878,880,
+        7,0,0,0,879,878,1,0,0,0,880,881,1,0,0,0,881,879,1,0,0,0,881,882,
+        1,0,0,0,882,884,1,0,0,0,883,877,1,0,0,0,883,884,1,0,0,0,884,894,
+        1,0,0,0,885,887,7,2,0,0,886,888,7,3,0,0,887,886,1,0,0,0,887,888,
+        1,0,0,0,888,890,1,0,0,0,889,891,7,0,0,0,890,889,1,0,0,0,891,892,
+        1,0,0,0,892,890,1,0,0,0,892,893,1,0,0,0,893,895,1,0,0,0,894,885,
+        1,0,0,0,894,895,1,0,0,0,895,194,1,0,0,0,896,900,7,4,0,0,897,899,
+        7,5,0,0,898,897,1,0,0,0,899,902,1,0,0,0,900,898,1,0,0,0,900,901,
+        1,0,0,0,901,196,1,0,0,0,902,900,1,0,0,0,903,908,5,34,0,0,904,907,
+        3,199,99,0,905,907,8,6,0,0,906,904,1,0,0,0,906,905,1,0,0,0,907,910,
+        1,0,0,0,908,906,1,0,0,0,908,909,1,0,0,0,909,911,1,0,0,0,910,908,
+        1,0,0,0,911,912,5,34,0,0,912,198,1,0,0,0,913,921,5,92,0,0,914,922,
+        7,7,0,0,915,916,5,117,0,0,916,917,3,201,100,0,917,918,3,201,100,
+        0,918,919,3,201,100,0,919,920,3,201,100,0,920,922,1,0,0,0,921,914,
+        1,0,0,0,921,915,1,0,0,0,922,200,1,0,0,0,923,924,7,8,0,0,924,202,
+        1,0,0,0,925,926,5,47,0,0,926,927,5,47,0,0,927,931,1,0,0,0,928,930,
+        8,9,0,0,929,928,1,0,0,0,930,933,1,0,0,0,931,929,1,0,0,0,931,932,
+        1,0,0,0,932,934,1,0,0,0,933,931,1,0,0,0,934,935,6,101,0,0,935,204,
+        1,0,0,0,936,937,5,47,0,0,937,938,5,42,0,0,938,942,1,0,0,0,939,941,
+        9,0,0,0,940,939,1,0,0,0,941,944,1,0,0,0,942,943,1,0,0,0,942,940,
+        1,0,0,0,943,945,1,0,0,0,944,942,1,0,0,0,945,946,5,42,0,0,946,947,
+        5,47,0,0,947,948,1,0,0,0,948,949,6,102,0,0,949,206,1,0,0,0,950,952,
+        7,10,0,0,951,950,1,0,0,0,952,953,1,0,0,0,953,951,1,0,0,0,953,954,
+        1,0,0,0,954,955,1,0,0,0,955,956,6,103,0,0,956,208,1,0,0,0,18,0,857,
+        862,865,872,875,881,883,887,892,894,900,906,908,921,931,942,953,
+        1,6,0,0
+    ];
+
+    private static __ATN: antlr.ATN;
+    public static get _ATN(): antlr.ATN {
+        if (!QuixosCapabilityLexer.__ATN) {
+            QuixosCapabilityLexer.__ATN = new antlr.ATNDeserializer().deserialize(QuixosCapabilityLexer._serializedATN);
+        }
+
+        return QuixosCapabilityLexer.__ATN;
+    }
+
+
+    private static readonly vocabulary = new antlr.Vocabulary(QuixosCapabilityLexer.literalNames, QuixosCapabilityLexer.symbolicNames, []);
+
+    public override get vocabulary(): antlr.Vocabulary {
+        return QuixosCapabilityLexer.vocabulary;
+    }
+
+    private static readonly decisionsToDFA = QuixosCapabilityLexer._ATN.decisionToState.map( (ds: antlr.DecisionState, index: number) => new antlr.DFA(ds, index) );
+}

src/capability-language/generated/QuixosCapabilityVisitor.ts

@@ -0,0 +1,408 @@
+
+import { AbstractParseTreeVisitor } from "antlr4ng";
+
+
+import { DocumentContext } from "./QuixosCapabilityParser.js";
+import { WorkspaceDeclContext } from "./QuixosCapabilityParser.js";
+import { WorkspaceItemContext } from "./QuixosCapabilityParser.js";
+import { ResourceImportDeclContext } from "./QuixosCapabilityParser.js";
+import { ExternalAtomDeclContext } from "./QuixosCapabilityParser.js";
+import { ExternalInterfaceDeclContext } from "./QuixosCapabilityParser.js";
+import { ResourcePreambleContext } from "./QuixosCapabilityParser.js";
+import { AtomDeclContext } from "./QuixosCapabilityParser.js";
+import { InterfaceResourceDeclContext } from "./QuixosCapabilityParser.js";
+import { InterfaceMemberContext } from "./QuixosCapabilityParser.js";
+import { OperationMemberContext } from "./QuixosCapabilityParser.js";
+import { ValueMemberContext } from "./QuixosCapabilityParser.js";
+import { ValueMemberOperationContext } from "./QuixosCapabilityParser.js";
+import { RelationshipMemberContext } from "./QuixosCapabilityParser.js";
+import { RelationshipOperationContext } from "./QuixosCapabilityParser.js";
+import { TargetConstraintContext } from "./QuixosCapabilityParser.js";
+import { PackageResourceDeclContext } from "./QuixosCapabilityParser.js";
+import { PackageExportContext } from "./QuixosCapabilityParser.js";
+import { PackageOperationExportContext } from "./QuixosCapabilityParser.js";
+import { PackageFunctionExportContext } from "./QuixosCapabilityParser.js";
+import { PackageConstructorExportContext } from "./QuixosCapabilityParser.js";
+import { EventClauseContext } from "./QuixosCapabilityParser.js";
+import { OperationModeContext } from "./QuixosCapabilityParser.js";
+import { ReceiverRequirementContext } from "./QuixosCapabilityParser.js";
+import { IdentifierListContext } from "./QuixosCapabilityParser.js";
+import { DependencyBlockContext } from "./QuixosCapabilityParser.js";
+import { DependencyPortContext } from "./QuixosCapabilityParser.js";
+import { PrimitiveListContext } from "./QuixosCapabilityParser.js";
+import { PrimitiveContext } from "./QuixosCapabilityParser.js";
+import { SharedAttachmentDeclContext } from "./QuixosCapabilityParser.js";
+import { AttachmentDeclContext } from "./QuixosCapabilityParser.js";
+import { StateDeclContext } from "./QuixosCapabilityParser.js";
+import { StoragePolicyContext } from "./QuixosCapabilityParser.js";
+import { EdgeDeclContext } from "./QuixosCapabilityParser.js";
+import { EdgeEndpointContext } from "./QuixosCapabilityParser.js";
+import { ConformanceDeclContext } from "./QuixosCapabilityParser.js";
+import { ConformanceItemContext } from "./QuixosCapabilityParser.js";
+import { RelationshipMaterializationDeclContext } from "./QuixosCapabilityParser.js";
+import { OperationBindingDeclContext } from "./QuixosCapabilityParser.js";
+import { MemberOperationRefContext } from "./QuixosCapabilityParser.js";
+import { OperationNameContext } from "./QuixosCapabilityParser.js";
+import { OperationProviderContext } from "./QuixosCapabilityParser.js";
+import { StatePrimitiveContext } from "./QuixosCapabilityParser.js";
+import { EdgePrimitiveContext } from "./QuixosCapabilityParser.js";
+import { DependencyBindingBlockContext } from "./QuixosCapabilityParser.js";
+import { DependencyBindingContext } from "./QuixosCapabilityParser.js";
+import { ConstructorBindingDeclContext } from "./QuixosCapabilityParser.js";
+import { ValueTypeContext } from "./QuixosCapabilityParser.js";
+import { ScalarTypeContext } from "./QuixosCapabilityParser.js";
+import { CardinalityContext } from "./QuixosCapabilityParser.js";
+import { JsonLiteralContext } from "./QuixosCapabilityParser.js";
+import { JsonObjectContext } from "./QuixosCapabilityParser.js";
+import { JsonMemberContext } from "./QuixosCapabilityParser.js";
+import { JsonArrayContext } from "./QuixosCapabilityParser.js";
+import { IdentifierContext } from "./QuixosCapabilityParser.js";
+import { StringLiteralContext } from "./QuixosCapabilityParser.js";
+
+
+/**
+ * This interface defines a complete generic visitor for a parse tree produced
+ * by `QuixosCapabilityParser`.
+ *
+ * @param <Result> The return type of the visit operation. Use `void` for
+ * operations with no return type.
+ */
+export class QuixosCapabilityVisitor<Result> extends AbstractParseTreeVisitor<Result> {
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.document`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitDocument?: (ctx: DocumentContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.workspaceDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitWorkspaceDecl?: (ctx: WorkspaceDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.workspaceItem`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitWorkspaceItem?: (ctx: WorkspaceItemContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.resourceImportDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitResourceImportDecl?: (ctx: ResourceImportDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.externalAtomDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitExternalAtomDecl?: (ctx: ExternalAtomDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.externalInterfaceDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitExternalInterfaceDecl?: (ctx: ExternalInterfaceDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.resourcePreamble`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitResourcePreamble?: (ctx: ResourcePreambleContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.atomDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitAtomDecl?: (ctx: AtomDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.interfaceResourceDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitInterfaceResourceDecl?: (ctx: InterfaceResourceDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.interfaceMember`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitInterfaceMember?: (ctx: InterfaceMemberContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.operationMember`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitOperationMember?: (ctx: OperationMemberContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.valueMember`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitValueMember?: (ctx: ValueMemberContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.valueMemberOperation`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitValueMemberOperation?: (ctx: ValueMemberOperationContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.relationshipMember`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitRelationshipMember?: (ctx: RelationshipMemberContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.relationshipOperation`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitRelationshipOperation?: (ctx: RelationshipOperationContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.targetConstraint`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitTargetConstraint?: (ctx: TargetConstraintContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.packageResourceDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitPackageResourceDecl?: (ctx: PackageResourceDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.packageExport`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitPackageExport?: (ctx: PackageExportContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.packageOperationExport`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitPackageOperationExport?: (ctx: PackageOperationExportContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.packageFunctionExport`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitPackageFunctionExport?: (ctx: PackageFunctionExportContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.packageConstructorExport`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitPackageConstructorExport?: (ctx: PackageConstructorExportContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.eventClause`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitEventClause?: (ctx: EventClauseContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.operationMode`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitOperationMode?: (ctx: OperationModeContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.receiverRequirement`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitReceiverRequirement?: (ctx: ReceiverRequirementContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.identifierList`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitIdentifierList?: (ctx: IdentifierListContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.dependencyBlock`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitDependencyBlock?: (ctx: DependencyBlockContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.dependencyPort`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitDependencyPort?: (ctx: DependencyPortContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.primitiveList`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitPrimitiveList?: (ctx: PrimitiveListContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.primitive`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitPrimitive?: (ctx: PrimitiveContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.sharedAttachmentDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitSharedAttachmentDecl?: (ctx: SharedAttachmentDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.attachmentDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitAttachmentDecl?: (ctx: AttachmentDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.stateDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitStateDecl?: (ctx: StateDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.storagePolicy`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitStoragePolicy?: (ctx: StoragePolicyContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.edgeDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitEdgeDecl?: (ctx: EdgeDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.edgeEndpoint`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitEdgeEndpoint?: (ctx: EdgeEndpointContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.conformanceDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitConformanceDecl?: (ctx: ConformanceDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.conformanceItem`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitConformanceItem?: (ctx: ConformanceItemContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.relationshipMaterializationDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitRelationshipMaterializationDecl?: (ctx: RelationshipMaterializationDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.operationBindingDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitOperationBindingDecl?: (ctx: OperationBindingDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.memberOperationRef`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitMemberOperationRef?: (ctx: MemberOperationRefContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.operationName`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitOperationName?: (ctx: OperationNameContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.operationProvider`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitOperationProvider?: (ctx: OperationProviderContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.statePrimitive`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitStatePrimitive?: (ctx: StatePrimitiveContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.edgePrimitive`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitEdgePrimitive?: (ctx: EdgePrimitiveContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.dependencyBindingBlock`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitDependencyBindingBlock?: (ctx: DependencyBindingBlockContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.dependencyBinding`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitDependencyBinding?: (ctx: DependencyBindingContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.constructorBindingDecl`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitConstructorBindingDecl?: (ctx: ConstructorBindingDeclContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.valueType`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitValueType?: (ctx: ValueTypeContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.scalarType`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitScalarType?: (ctx: ScalarTypeContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.cardinality`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitCardinality?: (ctx: CardinalityContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.jsonLiteral`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitJsonLiteral?: (ctx: JsonLiteralContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.jsonObject`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitJsonObject?: (ctx: JsonObjectContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.jsonMember`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitJsonMember?: (ctx: JsonMemberContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.jsonArray`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitJsonArray?: (ctx: JsonArrayContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.identifier`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitIdentifier?: (ctx: IdentifierContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosCapabilityParser.stringLiteral`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitStringLiteral?: (ctx: StringLiteralContext) => Result;
+}
+

src/capability-language/git-resolver.ts

@@ -0,0 +1,86 @@
+import childProcess from "node:child_process";
+import crypto from "node:crypto";
+import { mkdir, readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import type { CapabilityRepositoryResolver } from "./assembly.js";
+
+const execFile = promisify(childProcess.execFile);
+
+const sourceKey = (kind: string, repository: string, commit: string) =>
+  `${kind}\0${repository}\0${commit.toLowerCase()}`;
+
+const checkoutName = (kind: string, repository: string, commit: string) => {
+  const digest = crypto
+    .createHash("sha256")
+    .update(sourceKey(kind, repository, commit))
+    .digest("hex")
+    .slice(0, 24);
+  return `${kind}-${digest}`;
+};
+
+export const createGitCapabilityResolver = async (options: {
+  checkoutRoot: string;
+  snapshotMap?: string;
+}): Promise<CapabilityRepositoryResolver> => {
+  await mkdir(options.checkoutRoot, { recursive: true });
+  const checkoutRoot = await realpath(options.checkoutRoot);
+  const snapshots = new Map<string, string>();
+  if (options.snapshotMap) {
+    const snapshotMapPath = await realpath(options.snapshotMap);
+    const document = JSON.parse(await readFile(snapshotMapPath, "utf8")) as {
+      resources?: Array<{
+        kind: string;
+        repository: string;
+        commit: string;
+        directory: string;
+      }>;
+    };
+    for (const entry of document.resources ?? []) {
+      if (entry.kind !== "interface" && entry.kind !== "package") {
+        throw new Error(`Snapshot map has unsupported resource kind ${entry.kind}`);
+      }
+      const key = sourceKey(entry.kind, entry.repository, entry.commit);
+      if (snapshots.has(key)) throw new Error(`Snapshot map repeats ${key}`);
+      const directory = path.resolve(path.dirname(snapshotMapPath), entry.directory);
+      snapshots.set(key, await realpath(directory));
+    }
+  }
+
+  const checkouts = new Map<string, Promise<{ directory: string }>>();
+  return async (source, kind) => {
+    const key = sourceKey(kind, source.repository, source.commit);
+    const snapshot = snapshots.get(key);
+    if (snapshot) return { directory: snapshot };
+    const existing = checkouts.get(key);
+    if (existing) return await existing;
+    const pending = (async () => {
+      const directory = path.join(
+        checkoutRoot,
+        checkoutName(kind, source.repository, source.commit),
+      );
+      await execFile("git", [
+        "-c",
+        "advice.detachedHead=false",
+        "clone",
+        "--depth",
+        "1",
+        "--single-branch",
+        "--branch",
+        `quixos-reachability/${source.commit.toLowerCase()}`,
+        source.repository,
+        directory,
+      ]);
+      const { stdout } = await execFile("git", ["-C", directory, "rev-parse", "HEAD"]);
+      if (stdout.trim().toLowerCase() !== source.commit.toLowerCase()) {
+        throw new Error(
+          `Locked commit mismatch for ${source.repository}: ` +
+          `wanted ${source.commit}, fetched ${stdout.trim()}`,
+        );
+      }
+      return { directory };
+    })();
+    checkouts.set(key, pending);
+    return await pending;
+  };
+};

src/capability-language/index.ts

@@ -0,0 +1,2 @@
+export * from "./parser.js";
+export * from "./assembly.js";

src/capability-language/resource-cli.ts

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+
+import { writeFile } from "node:fs/promises";
+import process from "node:process";
+import {
+  compileCapabilityResourceRepository,
+  type ResolvedCapabilityResource,
+} from "./assembly.js";
+import { createGitCapabilityResolver } from "./git-resolver.js";
+
+const usage = `usage: quixos-resource-compile --root DIRECTORY --kind interface|package
+       --repository URL --commit GIT_REV --checkout-root DIRECTORY
+       [--snapshot-map PATH] [--graph-out PATH]
+
+Resolves a standalone resource's recursive dependency-lock graph, validates
+its interface.qx or package.qx manifest, and emits the checked resource as JSON.`;
+
+const parseArgs = (args: string[]) => {
+  const values = new Map<string, string>();
+  for (let index = 0; index < args.length; index += 2) {
+    const key = args[index];
+    const value = args[index + 1];
+    if (!key?.startsWith("--") || !value) throw new Error(usage);
+    values.set(key, value);
+  }
+  const rootDirectory = values.get("--root");
+  const kind = values.get("--kind");
+  const repository = values.get("--repository");
+  const commit = values.get("--commit")?.toLowerCase();
+  const checkoutRoot = values.get("--checkout-root");
+  if (!rootDirectory || !repository || !commit || !checkoutRoot ||
+      (kind !== "interface" && kind !== "package")) {
+    throw new Error(usage);
+  }
+  if (!/^([0-9a-f]{40}|[0-9a-f]{64})$/.test(commit)) {
+    throw new Error("--commit must be a full Git object ID");
+  }
+  return {
+    rootDirectory,
+    kind,
+    repository,
+    commit,
+    checkoutRoot,
+    snapshotMap: values.get("--snapshot-map"),
+    graphOut: values.get("--graph-out"),
+  } as const;
+};
+
+const graphEntry = (node: ResolvedCapabilityResource) => ({
+  key: node.key,
+  kind: node.kind,
+  source: node.source,
+  directory: node.directory,
+  resourceId: node.resource.kind === "interface"
+    ? node.resource.revision.interfaceId
+    : node.resource.revision.packageId,
+  revisionId: node.resource.revision.revisionId,
+  dependencies: [...node.dependencies.entries()].map(([binding, dependency]) => ({
+    binding,
+    resourceKey: dependency.key,
+  })),
+});
+
+const main = async () => {
+  if (process.argv.includes("--help") || process.argv.includes("-h")) {
+    process.stdout.write(`${usage}\n`);
+    return;
+  }
+  const options = parseArgs(process.argv.slice(2));
+  const resolveResource = await createGitCapabilityResolver({
+    checkoutRoot: options.checkoutRoot,
+    snapshotMap: options.snapshotMap,
+  });
+  const compiled = await compileCapabilityResourceRepository({
+    rootDirectory: options.rootDirectory,
+    kind: options.kind,
+    source: {
+      resolver: "git",
+      repository: options.repository,
+      commit: options.commit,
+    },
+    resolveResource,
+  });
+  if (options.graphOut) {
+    await writeFile(options.graphOut, `${JSON.stringify({
+      formatVersion: 1,
+      quixos: compiled.lock.quixos,
+      root: graphEntry(compiled.resources.find((node) =>
+        node.source.repository === options.repository &&
+        node.source.commit === options.commit &&
+        node.kind === options.kind)!),
+      resources: compiled.resources.map(graphEntry),
+    }, null, 2)}\n`);
+  }
+  process.stdout.write(`${JSON.stringify(compiled.resource, null, 2)}\n`);
+};
+
+main().catch((error: unknown) => {
+  process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
+  process.exitCode = 1;
+});

src/capability-language/workspace-cli.ts

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+import { writeFile } from "node:fs/promises";
+import process from "node:process";
+import { compileWorkspaceRepository } from "./assembly.js";
+import { createGitCapabilityResolver } from "./git-resolver.js";
+
+const usage = `usage: quixos-workspace-compile --root DIRECTORY --checkout-root DIRECTORY
+       [--snapshot-map PATH] [--graph-out PATH] [--workspace-id ID] [--workspace-revision-id ID]
+       [--source-root-commit GIT_REV]
+
+Resolves a workspace's recursive resource-lock graph, clones every exact
+resource revision, validates standalone interface/package manifests, and emits
+the checked workspace plan as JSON.`;
+
+const parseArgs = (args: string[]) => {
+  const values = new Map<string, string>();
+  for (let index = 0; index < args.length; index += 2) {
+    const key = args[index];
+    const value = args[index + 1];
+    if (!key?.startsWith("--") || !value) throw new Error(usage);
+    values.set(key, value);
+  }
+  const rootDirectory = values.get("--root");
+  const checkoutRoot = values.get("--checkout-root");
+  if (!rootDirectory || !checkoutRoot) throw new Error(usage);
+  return {
+    rootDirectory,
+    checkoutRoot,
+    graphOut: values.get("--graph-out"),
+    snapshotMap: values.get("--snapshot-map"),
+    workspaceId: values.get("--workspace-id"),
+    workspaceRevisionId: values.get("--workspace-revision-id"),
+    sourceRootCommit: values.get("--source-root-commit"),
+  };
+};
+
+const main = async () => {
+  if (process.argv.includes("--help") || process.argv.includes("-h")) {
+    process.stdout.write(`${usage}\n`);
+    return;
+  }
+  const options = parseArgs(process.argv.slice(2));
+  const resolveResource = await createGitCapabilityResolver({
+    checkoutRoot: options.checkoutRoot,
+    snapshotMap: options.snapshotMap,
+  });
+  const assembled = await compileWorkspaceRepository({
+    rootDirectory: options.rootDirectory,
+    workspaceId: options.workspaceId,
+    workspaceRevisionId: options.workspaceRevisionId,
+    sourceRootCommit: options.sourceRootCommit,
+    resolveResource,
+  });
+
+  if (options.graphOut) {
+    await writeFile(options.graphOut, `${JSON.stringify({
+      formatVersion: 1,
+      quixos: assembled.lock.quixos,
+      directResources: [...assembled.directResources.entries()].map(([bindingKey, node]) => {
+        const [kind, binding] = bindingKey.split("\0");
+        return { kind, binding, resourceKey: node.key, directory: node.directory };
+      }),
+      resources: assembled.resources.map((node) => ({
+        key: node.key,
+        kind: node.kind,
+        source: node.source,
+        directory: node.directory,
+        resourceId: node.resource.kind === "interface"
+          ? node.resource.revision.interfaceId
+          : node.resource.revision.packageId,
+        revisionId: node.resource.revision.revisionId,
+        dependencies: [...node.dependencies.entries()].map(([binding, dependency]) => ({
+          binding,
+          resourceKey: dependency.key,
+        })),
+      })),
+    }, null, 2)}\n`);
+  }
+  process.stdout.write(`${JSON.stringify(assembled.workspace, null, 2)}\n`);
+};
+
+main().catch((error: unknown) => {
+  process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
+  process.exitCode = 1;
+});

src/capability-model/index.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./validation.js";

src/capability-model/types.ts

@@ -0,0 +1,394 @@
+declare const opaqueIdBrand: unique symbol;
+
+type OpaqueId<Kind extends string> = string & {
+  readonly [opaqueIdBrand]: Kind;
+};
+
+export type WorkspaceId = OpaqueId<"WorkspaceId">;
+export type WorkspaceRevisionId = OpaqueId<"WorkspaceRevisionId">;
+export type AtomId = OpaqueId<"AtomId">;
+export type InterfaceId = OpaqueId<"InterfaceId">;
+export type InterfaceRevisionId = OpaqueId<"InterfaceRevisionId">;
+export type MemberId = OpaqueId<"MemberId">;
+export type OperationId = OpaqueId<"OperationId">;
+export type SlotId = OpaqueId<"SlotId">;
+export type EdgeTypeId = OpaqueId<"EdgeTypeId">;
+export type EdgeProjectionId = OpaqueId<"EdgeProjectionId">;
+export type PackageId = OpaqueId<"PackageId">;
+export type PackageRevisionId = OpaqueId<"PackageRevisionId">;
+export type PackageExportId = OpaqueId<"PackageExportId">;
+export type DependencyPortId = OpaqueId<"DependencyPortId">;
+export type ObjectId = OpaqueId<"ObjectId">;
+
+const opaque = <Kind extends string>(value: string) => value as OpaqueId<Kind>;
+
+/**
+ * Textual IDs remain opaque to the semantic model. Authoring tools may mint
+ * UUID-backed values later without changing the checked IR.
+ */
+export const capabilityId = {
+  workspace: (value: string) => opaque<"WorkspaceId">(value),
+  workspaceRevision: (value: string) =>
+    opaque<"WorkspaceRevisionId">(value),
+  atom: (value: string) => opaque<"AtomId">(value),
+  interface: (value: string) => opaque<"InterfaceId">(value),
+  interfaceRevision: (value: string) =>
+    opaque<"InterfaceRevisionId">(value),
+  member: (value: string) => opaque<"MemberId">(value),
+  operation: (value: string) => opaque<"OperationId">(value),
+  slot: (value: string) => opaque<"SlotId">(value),
+  edgeType: (value: string) => opaque<"EdgeTypeId">(value),
+  edgeProjection: (value: string) => opaque<"EdgeProjectionId">(value),
+  package: (value: string) => opaque<"PackageId">(value),
+  packageRevision: (value: string) => opaque<"PackageRevisionId">(value),
+  packageExport: (value: string) => opaque<"PackageExportId">(value),
+  dependencyPort: (value: string) => opaque<"DependencyPortId">(value),
+  object: (value: string) => opaque<"ObjectId">(value),
+} as const;
+
+export interface SourceRevision {
+  repository: string;
+  commit: string;
+}
+
+export type ScalarValueTypeName =
+  | "bool"
+  | "bytes"
+  | "double"
+  | "int32"
+  | "int64"
+  | "string"
+  | "uint32"
+  | "uint64";
+
+export type ObjectExpectation =
+  | { kind: "atom"; atomId: AtomId }
+  | {
+      kind: "interface";
+      interfaceRevisionId: InterfaceRevisionId;
+    };
+
+export type ValueType =
+  | { kind: "builtin"; name: "unit" | "watch-handle" }
+  | { kind: "scalar"; name: ScalarValueTypeName }
+  | { kind: "message"; descriptorId: string }
+  | { kind: "object-ref"; expectation: ObjectExpectation }
+  | { kind: "optional"; value: ValueType }
+  | { kind: "list"; value: ValueType };
+
+export const valueType = {
+  unit: { kind: "builtin", name: "unit" } as const,
+  watchHandle: { kind: "builtin", name: "watch-handle" } as const,
+  bool: { kind: "scalar", name: "bool" } as const,
+  bytes: { kind: "scalar", name: "bytes" } as const,
+  double: { kind: "scalar", name: "double" } as const,
+  int32: { kind: "scalar", name: "int32" } as const,
+  int64: { kind: "scalar", name: "int64" } as const,
+  string: { kind: "scalar", name: "string" } as const,
+  uint32: { kind: "scalar", name: "uint32" } as const,
+  uint64: { kind: "scalar", name: "uint64" } as const,
+  message: (descriptorId: string): ValueType => ({
+    kind: "message",
+    descriptorId,
+  }),
+  atomRef: (atomId: AtomId): ValueType => ({
+    kind: "object-ref",
+    expectation: { kind: "atom", atomId },
+  }),
+  interfaceRef: (interfaceRevisionId: InterfaceRevisionId): ValueType => ({
+    kind: "object-ref",
+    expectation: { kind: "interface", interfaceRevisionId },
+  }),
+  optional: (value: ValueType): ValueType => ({ kind: "optional", value }),
+  list: (value: ValueType): ValueType => ({ kind: "list", value }),
+} as const;
+
+export interface AtomDefinition {
+  id: AtomId;
+  displayName: string;
+  documentation?: string;
+}
+
+export type InterfaceOperationMode =
+  | "call"
+  | "watch-start"
+  | "watch-stop"
+  | "subscribe"
+  | "unsubscribe";
+
+export interface InterfaceOperation {
+  id: OperationId;
+  displayName: string;
+  inputType: ValueType;
+  outputType: ValueType;
+  mode: InterfaceOperationMode;
+  /** Required for watch-start/subscribe and absent for other modes. */
+  eventType?: ValueType;
+}
+
+interface InterfaceMemberBase {
+  id: MemberId;
+  displayName: string;
+  operations: InterfaceOperation[];
+}
+
+export interface ValueInterfaceMember extends InterfaceMemberBase {
+  kind: "value";
+  valueType: ValueType;
+}
+
+export type EdgeCardinality =
+  | "optional-one"
+  | "exactly-one"
+  | "many"
+  | "many-unique";
+
+export type EdgeEndpointConstraint =
+  | { kind: "atom"; atomId: AtomId }
+  | {
+      kind: "interface";
+      interfaceRevisionId: InterfaceRevisionId;
+    };
+
+export interface RelationshipInterfaceMember extends InterfaceMemberBase {
+  kind: "relationship";
+  target: EdgeEndpointConstraint;
+  cardinality: EdgeCardinality;
+  ordered: boolean;
+}
+
+/** A named callable capability that is not value or relationship sugar. */
+export interface OperationInterfaceMember extends InterfaceMemberBase {
+  kind: "operation";
+  inputType: ValueType;
+  outputType: ValueType;
+}
+
+export type InterfaceMember =
+  | ValueInterfaceMember
+  | RelationshipInterfaceMember
+  | OperationInterfaceMember;
+
+export interface InterfaceRevision {
+  interfaceId: InterfaceId;
+  revisionId: InterfaceRevisionId;
+  displayName: string;
+  source: SourceRevision;
+  members: InterfaceMember[];
+}
+
+export type StoragePolicy =
+  | { kind: "optimistic-register" }
+  | { kind: "crdt-document"; updateType: ValueType };
+
+export interface StateSlotDefinition {
+  kind: "state";
+  id: SlotId;
+  attachedTo: AtomId;
+  displayName: string;
+  valueType: ValueType;
+  storagePolicy: StoragePolicy;
+  defaultValue?: unknown;
+}
+
+export interface EdgeEndpoint {
+  projectionId: EdgeProjectionId;
+  displayName: string;
+  constraint: EdgeEndpointConstraint;
+  cardinality: EdgeCardinality;
+  ordered: boolean;
+}
+
+export interface EdgeDefinition {
+  kind: "edge";
+  id: EdgeTypeId;
+  displayName: string;
+  endpoints: [EdgeEndpoint, EdgeEndpoint];
+}
+
+export type PersistentAttachment = StateSlotDefinition | EdgeDefinition;
+
+export type StatePrimitive =
+  | "read"
+  | "write"
+  | "watch-start"
+  | "watch-stop";
+
+export type EdgePrimitive =
+  | "resolve"
+  | "connect"
+  | "disconnect"
+  | "watch-start"
+  | "watch-stop";
+
+export type PackageReceiverRequirement =
+  | { kind: "any-object" }
+  | { kind: "exact-atom"; atomId: AtomId }
+  | {
+      kind: "all-interfaces";
+      interfaceRevisionIds: InterfaceRevisionId[];
+    };
+
+export type DependencyPortRequirement =
+  | {
+      kind: "state";
+      valueType: ValueType;
+      primitives: StatePrimitive[];
+    }
+  | {
+      kind: "edge";
+      target: EdgeEndpointConstraint;
+      cardinality: EdgeCardinality;
+      primitives: EdgePrimitive[];
+    }
+  | {
+      kind: "interface";
+      interfaceRevisionId: InterfaceRevisionId;
+    }
+  | { kind: "constructor"; atomId: AtomId };
+
+export interface DependencyPort {
+  id: DependencyPortId;
+  displayName: string;
+  requirement: DependencyPortRequirement;
+}
+
+interface PackageExportBase {
+  id: PackageExportId;
+  displayName: string;
+  inputType: ValueType;
+  outputType: ValueType;
+  dependencyPorts: DependencyPort[];
+}
+
+export interface PackageOperationExport extends PackageExportBase {
+  kind: "operation";
+  mode: InterfaceOperationMode;
+  eventType?: ValueType;
+  receiverRequirement: PackageReceiverRequirement;
+}
+
+export interface PackageFunctionExport extends PackageExportBase {
+  kind: "function";
+}
+
+export interface PackageConstructorExport extends PackageExportBase {
+  kind: "constructor";
+  constructsAtom: AtomId;
+}
+
+export type PackageExport =
+  | PackageOperationExport
+  | PackageFunctionExport
+  | PackageConstructorExport;
+
+export interface PackageRevision {
+  packageId: PackageId;
+  revisionId: PackageRevisionId;
+  displayName: string;
+  source: SourceRevision;
+  exports: PackageExport[];
+}
+
+export type DependencyBinding =
+  | { kind: "state"; slotId: SlotId; via?: EdgeTraversal }
+  | {
+      kind: "edge";
+      edgeTypeId: EdgeTypeId;
+      projectionId: EdgeProjectionId;
+      via?: EdgeTraversal;
+    }
+  | {
+      kind: "interface";
+      interfaceRevisionId: InterfaceRevisionId;
+      via?: EdgeTraversal;
+    }
+  | { kind: "constructor"; atomId: AtomId };
+
+export interface BoundDependency {
+  portId: DependencyPortId;
+  binding: DependencyBinding;
+}
+
+/** Selects the object at the other end of an exactly-one relationship. */
+export interface EdgeTraversal {
+  edgeTypeId: EdgeTypeId;
+  projectionId: EdgeProjectionId;
+}
+
+/**
+ * Provisional get-or-create recipe for a relationship implementation. The
+ * host projection is supplied by the relationship's resolve binding; this
+ * projection originates at the object constructed for the relationship.
+ */
+export interface RelationshipMaterialization {
+  memberId: MemberId;
+  constructorAtomId: AtomId;
+  edgeTypeId: EdgeTypeId;
+  constructedProjectionId: EdgeProjectionId;
+}
+
+export type Binding =
+  | {
+      kind: "state";
+      slotId: SlotId;
+      primitive: StatePrimitive;
+    }
+  | {
+      kind: "edge";
+      edgeTypeId: EdgeTypeId;
+      projectionId: EdgeProjectionId;
+      primitive: EdgePrimitive;
+    }
+  | {
+      kind: "package";
+      packageRevisionId: PackageRevisionId;
+      exportId: PackageExportId;
+      dependencies: BoundDependency[];
+    };
+
+export interface OperationBinding {
+  operationId: OperationId;
+  binding: Binding;
+}
+
+export interface Conformance {
+  atomId: AtomId;
+  interfaceRevisionId: InterfaceRevisionId;
+  privateAttachments: PersistentAttachment[];
+  operationBindings: OperationBinding[];
+  relationshipMaterializations: RelationshipMaterialization[];
+}
+
+export interface AtomConstructorBinding {
+  atomId: AtomId;
+  packageRevisionId: PackageRevisionId;
+  exportId: PackageExportId;
+  dependencies: BoundDependency[];
+}
+
+export interface WorkspaceRevision {
+  id: WorkspaceRevisionId;
+  workspaceId: WorkspaceId;
+  parentRevisionIds: WorkspaceRevisionId[];
+  sourceRootCommit: string;
+  atoms: AtomDefinition[];
+  sharedAttachments: PersistentAttachment[];
+  interfaceImports: InterfaceRevision[];
+  packageImports: PackageRevision[];
+  conformances: Conformance[];
+  constructors: AtomConstructorBinding[];
+}
+
+export type AttachmentOwner =
+  | { kind: "workspace" }
+  | {
+      kind: "conformance";
+      atomId: AtomId;
+      interfaceRevisionId: InterfaceRevisionId;
+    };
+
+export interface OwnedAttachment {
+  attachment: PersistentAttachment;
+  owner: AttachmentOwner;
+}

src/descriptor.ts

@@ -3,23 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fromBinary, toJsonString } from "@bufbuild/protobuf";
 import type { PackageDescriptor } from "./gen/quixos/package_pb.js";
-import {
+import { PackageDescriptorSchema } from "./gen/quixos/package_pb.js";
-  FunctionCapabilityKind,
-  PackageDescriptorSchema,
-} from "./gen/quixos/package_pb.js";
-
-const functionKey = (value: {
-  packageNamespace: string;
-  packageName: string;
-  symbol: string;
-  versionRef: string;
-}) =>
-  [
-    value.packageNamespace,
-    value.packageName,
-    value.symbol,
-    value.versionRef,
-  ].join(":");
 
 const protoPaths = () => {
   const candidates = [
@@ -76,87 +60,25 @@ export const validatePackageDescriptor = (
   descriptor: PackageDescriptor,
 ): string[] => {
   const errors: string[] = [];
-  if (!descriptor.packageNamespace) {
+  if (!descriptor.packageId) {
-    errors.push("packageNamespace is required");
+    errors.push("packageId is required");
   }
-  if (!descriptor.packageName) {
+  if (!descriptor.packageRevisionId) {
-    errors.push("packageName is required");
+    errors.push("packageRevisionId is required");
   }
-  if (descriptor.descriptorVersion === 0) {
+  if (!descriptor.runtimeProtocolVersion) {
-    errors.push("descriptorVersion must be greater than zero");
+    errors.push("runtimeProtocolVersion is required");
   }
-  if (
+  const seenExports = new Set<string>();
-    descriptor.interfaceCompatibleBackTo !== 0 &&
+  for (const [index, entry] of descriptor.exports.entries()) {
-    descriptor.interfaceCompatibleBackTo > descriptor.descriptorVersion
+    if (!entry.exportId) errors.push(`exports[${index}].exportId is required`);
-  ) {
+    if (!entry.runtimeSymbol) {
-    errors.push("interfaceCompatibleBackTo must not exceed descriptorVersion");
+      errors.push(`exports[${index}].runtimeSymbol is required`);
-  }
-  if (
-    descriptor.runnerCompatibleBackTo !== 0 &&
-    descriptor.runnerCompatibleBackTo > descriptor.descriptorVersion
-  ) {
-    errors.push("runnerCompatibleBackTo must not exceed descriptorVersion");
-  }
-
-  const seenFunctions = new Set<string>();
-  for (const [index, entry] of descriptor.functionExports.entries()) {
-    const fn = entry.function;
-    if (!fn) {
-      errors.push(`functionExports[${index}].function is required`);
-      continue;
     }
-    if (!fn.packageNamespace) {
+    if (seenExports.has(entry.exportId)) {
-      fn.packageNamespace = descriptor.packageNamespace;
+      errors.push(`duplicate export: ${entry.exportId}`);
-    }
-    if (!fn.packageName) {
-      fn.packageName = descriptor.packageName;
-    }
-    if (
-      fn.packageNamespace !== descriptor.packageNamespace ||
-      fn.packageName !== descriptor.packageName
-    ) {
-      errors.push(
-        `functionExports[${index}] must export from this package (${descriptor.packageNamespace}/${descriptor.packageName})`,
-      );
-    }
-    if (!fn.symbol) {
-      errors.push(`functionExports[${index}].function.symbol is required`);
-    }
-    if (entry.interfaceVersion === 0) {
-      errors.push(`functionExports[${index}].interfaceVersion is required`);
-    }
-    if (entry.capabilityKind === FunctionCapabilityKind.FUNCTION_CAPABILITY_KIND_UNSPECIFIED) {
-      errors.push(`functionExports[${index}].capabilityKind is required`);
-    }
-    if (
-      entry.interfaceCompatibleBackTo !== 0 &&
-      entry.interfaceCompatibleBackTo > entry.interfaceVersion
-    ) {
-      errors.push(
-        `functionExports[${index}].interfaceCompatibleBackTo must not exceed interfaceVersion`,
-      );
-    }
-    const key = functionKey(fn);
-    if (seenFunctions.has(key)) {
-      errors.push(`duplicate function export: ${key}`);
-    }
-    seenFunctions.add(key);
-  }
-
-  for (const [index, entry] of descriptor.dependencies.entries()) {
-    if (!entry.package) {
-      errors.push(`dependencies[${index}].package is required`);
-      continue;
-    }
-    if (!entry.package.packageNamespace) {
-      errors.push(`dependencies[${index}].package.packageNamespace is required`);
-    }
-    if (!entry.package.packageName) {
-      errors.push(`dependencies[${index}].package.packageName is required`);
-    }
-    if (entry.package.descriptorVersion === 0) {
-      errors.push(`dependencies[${index}].package.descriptorVersion is required`);
     }
+    seenExports.add(entry.exportId);
   }
 
   return errors;

src/gen/camino/options_pb.ts

@@ -1,337 +0,0 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
-// @generated from file camino/options.proto (package camino, syntax proto3)
-/* eslint-disable */
-
-import type { GenExtension, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
-import { extDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
-import type { FieldOptions, FileOptions, MessageOptions, MethodOptions as MethodOptions$1 } from "@bufbuild/protobuf/wkt";
-import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
-import type { Cardinality, ConflictStrategy, FieldOps, FieldStorage, InterfaceFieldContract, SymbolRef, TypeBinding } from "./schema_pb.js";
-import { file_camino_schema } from "./schema_pb.js";
-import type { FunctionRef } from "../quixos/refs_pb.js";
-import { file_quixos_refs } from "../quixos/refs_pb.js";
-import type { Message } from "@bufbuild/protobuf";
-
-/**
- * Describes the file camino/options.proto.
- */
-export const file_camino_options: GenFile = /*@__PURE__*/
-  fileDesc("ChRjYW1pbm8vb3B0aW9ucy5wcm90bxIGY2FtaW5vIj4KDENsYXNzT3B0aW9ucxIPCgd2ZXJzaW9uGAEgASgNEh0KAmlkGAIgASgLMhEuY2FtaW5vLlN5bWJvbFJlZiJCChBJbnRlcmZhY2VPcHRpb25zEg8KB3ZlcnNpb24YASABKA0SHQoCaWQYAiABKAsyES5jYW1pbm8uU3ltYm9sUmVmImQKEUltcGxlbWVudHNPcHRpb25zEiQKCWludGVyZmFjZRgBIAEoCzIRLmNhbWluby5TeW1ib2xSZWYSKQoMdHlwZV9iaW5kaW5nGAIgAygLMhMuY2FtaW5vLlR5cGVCaW5kaW5nIjsKEkNvbnN0cnVjdG9yT3B0aW9ucxIlCghmdW5jdGlvbhgBIAEoCzITLnF1aXhvcy5GdW5jdGlvblJlZiK6AgoLRWRnZU9wdGlvbnMSHQoCaWQYASABKAsyES5jYW1pbm8uU3ltYm9sUmVmEiEKBnRhcmdldBgCIAEoCzIRLmNhbWluby5TeW1ib2xSZWYSKAoLY2FyZGluYWxpdHkYAyABKA4yEy5jYW1pbm8uQ2FyZGluYWxpdHkSDwoHaW52ZXJzZRgEIAEoCRIyCg10aGlzX2VuZHBvaW50GAUgASgLMhsuY2FtaW5vLkVkZ2VFbmRwb2ludE9wdGlvbnMSMwoOb3RoZXJfZW5kcG9pbnQYBiABKAsyGy5jYW1pbm8uRWRnZUVuZHBvaW50T3B0aW9ucxIeCgN0YWcYByADKAsyES5jYW1pbm8uU3ltYm9sUmVmEiUKCmltcGxlbWVudHMYCCADKAsyES5jYW1pbm8uU3ltYm9sUmVmIqwBChNFZGdlRW5kcG9pbnRPcHRpb25zEiAKBWNsYXNzGAEgASgLMhEuY2FtaW5vLlN5bWJvbFJlZhIkCglpbnRlcmZhY2UYAiABKAsyES5jYW1pbm8uU3ltYm9sUmVmEhIKCnByb2plY3Rpb24YAyABKAkSKAoLY2FyZGluYWxpdHkYBCABKA4yEy5jYW1pbm8uQ2FyZGluYWxpdHkSDwoHaW5kZXhlZBgFIAEoCCJECg1NZXRob2RPcHRpb25zEgwKBG5hbWUYASABKAkSJQoIZnVuY3Rpb24YAiABKAsyEy5xdWl4b3MuRnVuY3Rpb25SZWYiYwoQTWlncmF0aW9uT3B0aW9ucxIUCgxmcm9tX3ZlcnNpb24YASABKA0SEgoKdG9fdmVyc2lvbhgCIAEoDRIlCghmdW5jdGlvbhgDIAEoCzITLnF1aXhvcy5GdW5jdGlvblJlZjpJChBzY2hlbWFfbmFtZXNwYWNlEhwuZ29vZ2xlLnByb3RvYnVmLkZpbGVPcHRpb25zGLiOAyABKAlSD3NjaGVtYU5hbWVzcGFjZTpFCg5zY2hlbWFfdmVyc2lvbhIcLmdvb2dsZS5wcm90b2J1Zi5GaWxlT3B0aW9ucxi5jgMgASgJUg1zY2hlbWFWZXJzaW9uOk0KBWNsYXNzEh8uZ29vZ2xlLnByb3RvYnVmLk1lc3NhZ2VPcHRpb25zGMKOAyABKAsyFC5jYW1pbm8uQ2xhc3NPcHRpb25zUgVjbGFzczpQCgZtZXRob2QSHy5nb29nbGUucHJvdG9idWYuTWVzc2FnZU9wdGlvbnMYw44DIAMoCzIVLmNhbWluby5NZXRob2RPcHRpb25zUgZtZXRob2Q6WQoJbWlncmF0aW9uEh8uZ29vZ2xlLnByb3RvYnVmLk1lc3NhZ2VPcHRpb25zGMSOAyADKAsyGC5jYW1pbm8uTWlncmF0aW9uT3B0aW9uc1IJbWlncmF0aW9uOlkKCWludGVyZmFjZRIfLmdvb2dsZS5wcm90b2J1Zi5NZXNzYWdlT3B0aW9ucxjFjgMgASgLMhguY2FtaW5vLkludGVyZmFjZU9wdGlvbnNSCWludGVyZmFjZTpcCgppbXBsZW1lbnRzEh8uZ29vZ2xlLnByb3RvYnVmLk1lc3NhZ2VPcHRpb25zGMaOAyADKAsyGS5jYW1pbm8uSW1wbGVtZW50c09wdGlvbnNSCmltcGxlbWVudHM6XwoLY29uc3RydWN0b3ISHy5nb29nbGUucHJvdG9idWYuTWVzc2FnZU9wdGlvbnMYx44DIAEoCzIaLmNhbWluby5Db25zdHJ1Y3Rvck9wdGlvbnNSC2NvbnN0cnVjdG9yOlUKCGNvbmZsaWN0Eh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxjMjgMgASgOMhguY2FtaW5vLkNvbmZsaWN0U3RyYXRlZ3lSCGNvbmZsaWN0OkgKBGVkZ2USHS5nb29nbGUucHJvdG9idWYuRmllbGRPcHRpb25zGM2OAyABKAsyEy5jYW1pbm8uRWRnZU9wdGlvbnNSBGVkZ2U6WgoNZmllbGRfc3RvcmFnZRIdLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE9wdGlvbnMYzo4DIAEoCzIULmNhbWluby5GaWVsZFN0b3JhZ2VSDGZpZWxkU3RvcmFnZTpOCglmaWVsZF9vcHMSHS5nb29nbGUucHJvdG9idWYuRmllbGRPcHRpb25zGM+OAyABKAsyEC5jYW1pbm8uRmllbGRPcHNSCGZpZWxkT3BzOmgKD2ludGVyZmFjZV9maWVsZBIdLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE9wdGlvbnMY0I4DIAEoCzIeLmNhbWluby5JbnRlcmZhY2VGaWVsZENvbnRyYWN0Ug5pbnRlcmZhY2VGaWVsZDpECg1kaXNwbGF5X2xhYmVsEh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxjRjgMgASgIUgxkaXNwbGF5TGFiZWw6SQoEaW1wbBIeLmdvb2dsZS5wcm90b2J1Zi5NZXRob2RPcHRpb25zGNaOAyABKAsyEy5xdWl4b3MuRnVuY3Rpb25SZWZSBGltcGxiBnByb3RvMw", [file_google_protobuf_descriptor, file_camino_schema, file_quixos_refs]);
-
-/**
- * @generated from message camino.ClassOptions
- */
-export type ClassOptions = Message<"camino.ClassOptions"> & {
-  /**
-   * @generated from field: uint32 version = 1;
-   */
-  version: number;
-
-  /**
-   * @generated from field: camino.SymbolRef id = 2;
-   */
-  id?: SymbolRef | undefined;
-};
-
-/**
- * Describes the message camino.ClassOptions.
- * Use `create(ClassOptionsSchema)` to create a new message.
- */
-export const ClassOptionsSchema: GenMessage<ClassOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 0);
-
-/**
- * @generated from message camino.InterfaceOptions
- */
-export type InterfaceOptions = Message<"camino.InterfaceOptions"> & {
-  /**
-   * @generated from field: uint32 version = 1;
-   */
-  version: number;
-
-  /**
-   * @generated from field: camino.SymbolRef id = 2;
-   */
-  id?: SymbolRef | undefined;
-};
-
-/**
- * Describes the message camino.InterfaceOptions.
- * Use `create(InterfaceOptionsSchema)` to create a new message.
- */
-export const InterfaceOptionsSchema: GenMessage<InterfaceOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 1);
-
-/**
- * @generated from message camino.ImplementsOptions
- */
-export type ImplementsOptions = Message<"camino.ImplementsOptions"> & {
-  /**
-   * @generated from field: camino.SymbolRef interface = 1;
-   */
-  interface?: SymbolRef | undefined;
-
-  /**
-   * @generated from field: repeated camino.TypeBinding type_binding = 2;
-   */
-  typeBinding: TypeBinding[];
-};
-
-/**
- * Describes the message camino.ImplementsOptions.
- * Use `create(ImplementsOptionsSchema)` to create a new message.
- */
-export const ImplementsOptionsSchema: GenMessage<ImplementsOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 2);
-
-/**
- * @generated from message camino.ConstructorOptions
- */
-export type ConstructorOptions = Message<"camino.ConstructorOptions"> & {
-  /**
-   * @generated from field: quixos.FunctionRef function = 1;
-   */
-  function?: FunctionRef | undefined;
-};
-
-/**
- * Describes the message camino.ConstructorOptions.
- * Use `create(ConstructorOptionsSchema)` to create a new message.
- */
-export const ConstructorOptionsSchema: GenMessage<ConstructorOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 3);
-
-/**
- * @generated from message camino.EdgeOptions
- */
-export type EdgeOptions = Message<"camino.EdgeOptions"> & {
-  /**
-   * @generated from field: camino.SymbolRef id = 1;
-   */
-  id?: SymbolRef | undefined;
-
-  /**
-   * Shorthand for other_endpoint.class.
-   *
-   * @generated from field: camino.SymbolRef target = 2;
-   */
-  target?: SymbolRef | undefined;
-
-  /**
-   * Shorthand for this_endpoint.cardinality.
-   *
-   * @generated from field: camino.Cardinality cardinality = 3;
-   */
-  cardinality: Cardinality;
-
-  /**
-   * Shorthand for other_endpoint.projection.
-   *
-   * @generated from field: string inverse = 4;
-   */
-  inverse: string;
-
-  /**
-   * @generated from field: camino.EdgeEndpointOptions this_endpoint = 5;
-   */
-  thisEndpoint?: EdgeEndpointOptions | undefined;
-
-  /**
-   * @generated from field: camino.EdgeEndpointOptions other_endpoint = 6;
-   */
-  otherEndpoint?: EdgeEndpointOptions | undefined;
-
-  /**
-   * @generated from field: repeated camino.SymbolRef tag = 7;
-   */
-  tag: SymbolRef[];
-
-  /**
-   * @generated from field: repeated camino.SymbolRef implements = 8;
-   */
-  implements: SymbolRef[];
-};
-
-/**
- * Describes the message camino.EdgeOptions.
- * Use `create(EdgeOptionsSchema)` to create a new message.
- */
-export const EdgeOptionsSchema: GenMessage<EdgeOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 4);
-
-/**
- * @generated from message camino.EdgeEndpointOptions
- */
-export type EdgeEndpointOptions = Message<"camino.EdgeEndpointOptions"> & {
-  /**
-   * @generated from field: camino.SymbolRef class = 1;
-   */
-  class?: SymbolRef | undefined;
-
-  /**
-   * @generated from field: camino.SymbolRef interface = 2;
-   */
-  interface?: SymbolRef | undefined;
-
-  /**
-   * @generated from field: string projection = 3;
-   */
-  projection: string;
-
-  /**
-   * @generated from field: camino.Cardinality cardinality = 4;
-   */
-  cardinality: Cardinality;
-
-  /**
-   * @generated from field: bool indexed = 5;
-   */
-  indexed: boolean;
-};
-
-/**
- * Describes the message camino.EdgeEndpointOptions.
- * Use `create(EdgeEndpointOptionsSchema)` to create a new message.
- */
-export const EdgeEndpointOptionsSchema: GenMessage<EdgeEndpointOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 5);
-
-/**
- * @generated from message camino.MethodOptions
- */
-export type MethodOptions = Message<"camino.MethodOptions"> & {
-  /**
-   * @generated from field: string name = 1;
-   */
-  name: string;
-
-  /**
-   * @generated from field: quixos.FunctionRef function = 2;
-   */
-  function?: FunctionRef | undefined;
-};
-
-/**
- * Describes the message camino.MethodOptions.
- * Use `create(MethodOptionsSchema)` to create a new message.
- */
-export const MethodOptionsSchema: GenMessage<MethodOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 6);
-
-/**
- * @generated from message camino.MigrationOptions
- */
-export type MigrationOptions = Message<"camino.MigrationOptions"> & {
-  /**
-   * @generated from field: uint32 from_version = 1;
-   */
-  fromVersion: number;
-
-  /**
-   * @generated from field: uint32 to_version = 2;
-   */
-  toVersion: number;
-
-  /**
-   * @generated from field: quixos.FunctionRef function = 3;
-   */
-  function?: FunctionRef | undefined;
-};
-
-/**
- * Describes the message camino.MigrationOptions.
- * Use `create(MigrationOptionsSchema)` to create a new message.
- */
-export const MigrationOptionsSchema: GenMessage<MigrationOptions> = /*@__PURE__*/
-  messageDesc(file_camino_options, 7);
-
-/**
- * @generated from extension: string schema_namespace = 51000;
- */
-export const schema_namespace: GenExtension<FileOptions, string> = /*@__PURE__*/
-  extDesc(file_camino_options, 0);
-
-/**
- * @generated from extension: string schema_version = 51001;
- */
-export const schema_version: GenExtension<FileOptions, string> = /*@__PURE__*/
-  extDesc(file_camino_options, 1);
-
-/**
- * @generated from extension: camino.ClassOptions class = 51010;
- */
-export const class$: GenExtension<MessageOptions, ClassOptions> = /*@__PURE__*/
-  extDesc(file_camino_options, 2);
-
-/**
- * @generated from extension: repeated camino.MethodOptions method = 51011;
- */
-export const method: GenExtension<MessageOptions, MethodOptions[]> = /*@__PURE__*/
-  extDesc(file_camino_options, 3);
-
-/**
- * @generated from extension: repeated camino.MigrationOptions migration = 51012;
- */
-export const migration: GenExtension<MessageOptions, MigrationOptions[]> = /*@__PURE__*/
-  extDesc(file_camino_options, 4);
-
-/**
- * @generated from extension: camino.InterfaceOptions interface = 51013;
- */
-export const interface$: GenExtension<MessageOptions, InterfaceOptions> = /*@__PURE__*/
-  extDesc(file_camino_options, 5);
-
-/**
- * @generated from extension: repeated camino.ImplementsOptions implements = 51014;
- */
-export const implements$: GenExtension<MessageOptions, ImplementsOptions[]> = /*@__PURE__*/
-  extDesc(file_camino_options, 6);
-
-/**
- * @generated from extension: camino.ConstructorOptions constructor = 51015;
- */
-export const constructor: GenExtension<MessageOptions, ConstructorOptions> = /*@__PURE__*/
-  extDesc(file_camino_options, 7);
-
-/**
- * @generated from extension: camino.ConflictStrategy conflict = 51020;
- */
-export const conflict: GenExtension<FieldOptions, ConflictStrategy> = /*@__PURE__*/
-  extDesc(file_camino_options, 8);
-
-/**
- * @generated from extension: camino.EdgeOptions edge = 51021;
- */
-export const edge: GenExtension<FieldOptions, EdgeOptions> = /*@__PURE__*/
-  extDesc(file_camino_options, 9);
-
-/**
- * @generated from extension: camino.FieldStorage field_storage = 51022;
- */
-export const field_storage: GenExtension<FieldOptions, FieldStorage> = /*@__PURE__*/
-  extDesc(file_camino_options, 10);
-
-/**
- * @generated from extension: camino.FieldOps field_ops = 51023;
- */
-export const field_ops: GenExtension<FieldOptions, FieldOps> = /*@__PURE__*/
-  extDesc(file_camino_options, 11);
-
-/**
- * @generated from extension: camino.InterfaceFieldContract interface_field = 51024;
- */
-export const interface_field: GenExtension<FieldOptions, InterfaceFieldContract> = /*@__PURE__*/
-  extDesc(file_camino_options, 12);
-
-/**
- * @generated from extension: bool display_label = 51025;
- */
-export const display_label: GenExtension<FieldOptions, boolean> = /*@__PURE__*/
-  extDesc(file_camino_options, 13);
-
-/**
- * @generated from extension: quixos.FunctionRef impl = 51030;
- */
-export const impl: GenExtension<MethodOptions$1, FunctionRef> = /*@__PURE__*/
-  extDesc(file_camino_options, 14);
-

src/gen/quixos/orch_pb.ts

@@ -1,14 +1,14 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/orch.proto (package quixos.orch, syntax proto3)
 /* eslint-disable */
 
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-import type { Value } from "../camino/api_pb.js";
+import type { CaminoObject, Value } from "../camino/api_pb.js";
 import { file_camino_api } from "../camino/api_pb.js";
 import type { PackageDescriptor } from "./package_pb.js";
 import { file_quixos_package } from "./package_pb.js";
-import type { FunctionRef } from "./refs_pb.js";
+import type { CapabilityRef, PackageExportRef } from "./refs_pb.js";
 import { file_quixos_refs } from "./refs_pb.js";
 import type { DerivedDependency } from "./runtime_pb.js";
 import { file_quixos_runtime } from "./runtime_pb.js";
@@ -18,16 +18,104 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file quixos/orch.proto.
  */
 export const file_quixos_orch: GenFile = /*@__PURE__*/
-  fileDesc("ChFxdWl4b3Mvb3JjaC5wcm90bxILcXVpeG9zLm9yY2gizAEKFUludm9rZUZ1bmN0aW9uUmVxdWVzdBIlCghmdW5jdGlvbhgBIAEoCzITLnF1aXhvcy5GdW5jdGlvblJlZhIRCglvYmplY3RfaWQYAiABKAkSPAoFaW5wdXQYAyADKAsyLS5xdWl4b3Mub3JjaC5JbnZva2VGdW5jdGlvblJlcXVlc3QuSW5wdXRFbnRyeRo7CgpJbnB1dEVudHJ5EgsKA2tleRgBIAEoCRIcCgV2YWx1ZRgCIAEoCzINLmNhbWluby5WYWx1ZToCOAEilgEKFkludm9rZUZ1bmN0aW9uUmVzcG9uc2USFQoNaW52b2NhdGlvbl9pZBgBIAEoCRIrCgphY3RpdmF0aW9uGAIgASgLMhcucXVpeG9zLm9yY2guQWN0aXZhdGlvbhIKCgJvaxgDIAEoCBIdCgZyZXN1bHQYBCABKAsyDS5jYW1pbm8uVmFsdWUSDQoFZXJyb3IYBSABKAkiygEKFFdhdGNoRnVuY3Rpb25SZXF1ZXN0EiUKCGZ1bmN0aW9uGAEgASgLMhMucXVpeG9zLkZ1bmN0aW9uUmVmEhEKCW9iamVjdF9pZBgCIAEoCRI7CgVpbnB1dBgDIAMoCzIsLnF1aXhvcy5vcmNoLldhdGNoRnVuY3Rpb25SZXF1ZXN0LklucHV0RW50cnkaOwoKSW5wdXRFbnRyeRILCgNrZXkYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWU6AjgBIuEBChJXYXRjaEZ1bmN0aW9uRXZlbnQSFQoNaW52b2NhdGlvbl9pZBgBIAEoCRIrCgphY3RpdmF0aW9uGAIgASgLMhcucXVpeG9zLm9yY2guQWN0aXZhdGlvbhIQCgh3YXRjaF9pZBgDIAEoCRIcCgV2YWx1ZRgEIAEoCzINLmNhbWluby5WYWx1ZRI3CgxkZXBlbmRlbmNpZXMYBSADKAsyIS5xdWl4b3MucnVudGltZS5EZXJpdmVkRGVwZW5kZW5jeRINCgVlcnJvchgGIAEoCRIPCgdpbml0aWFsGAcgASgIIhgKFkxpc3RBY3RpdmF0aW9uc1JlcXVlc3QiHwodTGlzdFBhY2thZ2VEZXNjcmlwdG9yc1JlcXVlc3QiUAoeTGlzdFBhY2thZ2VEZXNjcmlwdG9yc1Jlc3BvbnNlEi4KC2Rlc2NyaXB0b3JzGAEgAygLMhkucXVpeG9zLlBhY2thZ2VEZXNjcmlwdG9yIhwKGkxpc3RQYWNrYWdlUnVudGltZXNSZXF1ZXN0IlIKG0xpc3RQYWNrYWdlUnVudGltZXNSZXNwb25zZRIzCghydW50aW1lcxgBIAMoCzIhLnF1aXhvcy5vcmNoLlBhY2thZ2VSdW50aW1lU3RhdHVzIkcKF0xpc3RBY3RpdmF0aW9uc1Jlc3BvbnNlEiwKC2FjdGl2YXRpb25zGAEgAygLMhcucXVpeG9zLm9yY2guQWN0aXZhdGlvbiI/ChZDbG9zZUFjdGl2YXRpb25SZXF1ZXN0EhUKDWFjdGl2YXRpb25faWQYASABKAkSDgoGcmVhc29uGAIgASgJIkYKF0Nsb3NlQWN0aXZhdGlvblJlc3BvbnNlEisKCmFjdGl2YXRpb24YASABKAsyFy5xdWl4b3Mub3JjaC5BY3RpdmF0aW9uIugBCgpBY3RpdmF0aW9uEhUKDWFjdGl2YXRpb25faWQYASABKAkSJQoIZnVuY3Rpb24YAiABKAsyEy5xdWl4b3MuRnVuY3Rpb25SZWYSEQoJb2JqZWN0X2lkGAMgASgJEg0KBXN0YXRlGAQgASgJEg4KBmRlbWFuZBgFIAEoDRIRCglvcGVuZWRfYXQYBiABKAkSFAoMbGFzdF91c2VkX2F0GAcgASgJEhgKEGlkbGVfZGVhZGxpbmVfYXQYCCABKAkSEQoJY2xvc2VkX2F0GAkgASgJEhQKDGNsb3NlX3JlYXNvbhgKIAEoCSLjAgoUUGFja2FnZVJ1bnRpbWVTdGF0dXMSEwoLcnVudGltZV9rZXkYASABKAkSGQoRcGFja2FnZV9uYW1lc3BhY2UYAiABKAkSFAoMcGFja2FnZV9uYW1lGAMgASgJEhoKEmRlc2NyaXB0b3JfdmVyc2lvbhgEIAEoDRITCgtzb3VyY2VfcmVwbxgFIAEoCRIaChJzZXJ2ZXJfaW5zdGFsbGFibGUYBiABKAkSEwoLc291cmNlX3BhdGgYByABKAkSEwoLc2VydmVyX3BhdGgYCCABKAkSCwoDcGlkGAkgASgNEg0KBXN0YXRlGAogASgJEhIKCnN0YXJ0ZWRfYXQYCyABKAkSGQoRbGFzdF9oYW5kc2hha2VfYXQYDCABKAkSIAoYcnVudGltZV9wcm90b2NvbF92ZXJzaW9uGA0gASgJEiEKGWFkdmVydGlzZWRfZnVuY3Rpb25fY291bnQYDiABKA0y4AQKE09yY2hlc3RyYXRvclJ1bnRpbWUSWQoOSW52b2tlRnVuY3Rpb24SIi5xdWl4b3Mub3JjaC5JbnZva2VGdW5jdGlvblJlcXVlc3QaIy5xdWl4b3Mub3JjaC5JbnZva2VGdW5jdGlvblJlc3BvbnNlElUKDVdhdGNoRnVuY3Rpb24SIS5xdWl4b3Mub3JjaC5XYXRjaEZ1bmN0aW9uUmVxdWVzdBofLnF1aXhvcy5vcmNoLldhdGNoRnVuY3Rpb25FdmVudDABEnEKFkxpc3RQYWNrYWdlRGVzY3JpcHRvcnMSKi5xdWl4b3Mub3JjaC5MaXN0UGFja2FnZURlc2NyaXB0b3JzUmVxdWVzdBorLnF1aXhvcy5vcmNoLkxpc3RQYWNrYWdlRGVzY3JpcHRvcnNSZXNwb25zZRJoChNMaXN0UGFja2FnZVJ1bnRpbWVzEicucXVpeG9zLm9yY2guTGlzdFBhY2thZ2VSdW50aW1lc1JlcXVlc3QaKC5xdWl4b3Mub3JjaC5MaXN0UGFja2FnZVJ1bnRpbWVzUmVzcG9uc2USXAoPTGlzdEFjdGl2YXRpb25zEiMucXVpeG9zLm9yY2guTGlzdEFjdGl2YXRpb25zUmVxdWVzdBokLnF1aXhvcy5vcmNoLkxpc3RBY3RpdmF0aW9uc1Jlc3BvbnNlElwKD0Nsb3NlQWN0aXZhdGlvbhIjLnF1aXhvcy5vcmNoLkNsb3NlQWN0aXZhdGlvblJlcXVlc3QaJC5xdWl4b3Mub3JjaC5DbG9zZUFjdGl2YXRpb25SZXNwb25zZWIGcHJvdG8z", [file_camino_api, file_quixos_package, file_quixos_refs, file_quixos_runtime]);
+  fileDesc("ChFxdWl4b3Mvb3JjaC5wcm90bxILcXVpeG9zLm9yY2gipQEKFkNvbnN0cnVjdE9iamVjdFJlcXVlc3QSDwoHYXRvbV9pZBgBIAEoCRI9CgVpbnB1dBgCIAMoCzIuLnF1aXhvcy5vcmNoLkNvbnN0cnVjdE9iamVjdFJlcXVlc3QuSW5wdXRFbnRyeRo7CgpJbnB1dEVudHJ5EgsKA2tleRgBIAEoCRIcCgV2YWx1ZRgCIAEoCzINLmNhbWluby5WYWx1ZToCOAEiPwoXQ29uc3RydWN0T2JqZWN0UmVzcG9uc2USJAoGb2JqZWN0GAEgASgLMhQuY2FtaW5vLkNhbWlub09iamVjdCJtCiZSZXNvbHZlT3JDb25zdHJ1Y3RSZWxhdGVkT2JqZWN0UmVxdWVzdBIRCglvYmplY3RfaWQYASABKAkSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAIgASgJEhEKCW1lbWJlcl9pZBgDIAEoCSJkCidSZXNvbHZlT3JDb25zdHJ1Y3RSZWxhdGVkT2JqZWN0UmVzcG9uc2USJAoGb2JqZWN0GAEgASgLMhQuY2FtaW5vLkNhbWlub09iamVjdBITCgtjb25zdHJ1Y3RlZBgCIAEoCCLwAQoXSW52b2tlQ2FwYWJpbGl0eVJlcXVlc3QSKQoKY2FwYWJpbGl0eRgBIAEoCzIVLnF1aXhvcy5DYXBhYmlsaXR5UmVmEhEKCW9iamVjdF9pZBgCIAEoCRI+CgVpbnB1dBgDIAMoCzIvLnF1aXhvcy5vcmNoLkludm9rZUNhcGFiaWxpdHlSZXF1ZXN0LklucHV0RW50cnkSGgoSY2xpZW50X211dGF0aW9uX2lkGAQgASgJGjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASLRAQoYSW52b2tlQ2FwYWJpbGl0eVJlc3BvbnNlEhUKDWludm9jYXRpb25faWQYASABKAkSKwoKYWN0aXZhdGlvbhgCIAEoCzIXLnF1aXhvcy5vcmNoLkFjdGl2YXRpb24SCgoCb2sYAyABKAgSHQoGcmVzdWx0GAQgASgLMg0uY2FtaW5vLlZhbHVlEg0KBWVycm9yGAUgASgJEjcKDGRlcGVuZGVuY2llcxgGIAMoCzIhLnF1aXhvcy5ydW50aW1lLkRlcml2ZWREZXBlbmRlbmN5ItIBChZXYXRjaENhcGFiaWxpdHlSZXF1ZXN0EikKCmNhcGFiaWxpdHkYASABKAsyFS5xdWl4b3MuQ2FwYWJpbGl0eVJlZhIRCglvYmplY3RfaWQYAiABKAkSPQoFaW5wdXQYAyADKAsyLi5xdWl4b3Mub3JjaC5XYXRjaENhcGFiaWxpdHlSZXF1ZXN0LklucHV0RW50cnkaOwoKSW5wdXRFbnRyeRILCgNrZXkYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWU6AjgBIuMBChRXYXRjaENhcGFiaWxpdHlFdmVudBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEisKCmFjdGl2YXRpb24YAiABKAsyFy5xdWl4b3Mub3JjaC5BY3RpdmF0aW9uEhAKCHdhdGNoX2lkGAMgASgJEhwKBXZhbHVlGAQgASgLMg0uY2FtaW5vLlZhbHVlEjcKDGRlcGVuZGVuY2llcxgFIAMoCzIhLnF1aXhvcy5ydW50aW1lLkRlcml2ZWREZXBlbmRlbmN5Eg0KBWVycm9yGAYgASgJEg8KB2luaXRpYWwYByABKAgiFQoTR2V0V29ya3NwYWNlUmVxdWVzdCJnChRHZXRXb3Jrc3BhY2VSZXNwb25zZRIUCgx3b3Jrc3BhY2VfaWQYASABKAkSHQoVd29ya3NwYWNlX3JldmlzaW9uX2lkGAIgASgJEhoKEnNvdXJjZV9yb290X2NvbW1pdBgDIAEoCSIYChZMaXN0QWN0aXZhdGlvbnNSZXF1ZXN0Ih8KHUxpc3RQYWNrYWdlRGVzY3JpcHRvcnNSZXF1ZXN0IlAKHkxpc3RQYWNrYWdlRGVzY3JpcHRvcnNSZXNwb25zZRIuCgtkZXNjcmlwdG9ycxgBIAMoCzIZLnF1aXhvcy5QYWNrYWdlRGVzY3JpcHRvciIcChpMaXN0UGFja2FnZVJ1bnRpbWVzUmVxdWVzdCJSChtMaXN0UGFja2FnZVJ1bnRpbWVzUmVzcG9uc2USMwoIcnVudGltZXMYASADKAsyIS5xdWl4b3Mub3JjaC5QYWNrYWdlUnVudGltZVN0YXR1cyJHChdMaXN0QWN0aXZhdGlvbnNSZXNwb25zZRIsCgthY3RpdmF0aW9ucxgBIAMoCzIXLnF1aXhvcy5vcmNoLkFjdGl2YXRpb24iPwoWQ2xvc2VBY3RpdmF0aW9uUmVxdWVzdBIVCg1hY3RpdmF0aW9uX2lkGAEgASgJEg4KBnJlYXNvbhgCIAEoCSJGChdDbG9zZUFjdGl2YXRpb25SZXNwb25zZRIrCgphY3RpdmF0aW9uGAEgASgLMhcucXVpeG9zLm9yY2guQWN0aXZhdGlvbiLrAQoKQWN0aXZhdGlvbhIVCg1hY3RpdmF0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRINCgVzdGF0ZRgEIAEoCRIOCgZkZW1hbmQYBSABKA0SEQoJb3BlbmVkX2F0GAYgASgJEhQKDGxhc3RfdXNlZF9hdBgHIAEoCRIYChBpZGxlX2RlYWRsaW5lX2F0GAggASgJEhEKCWNsb3NlZF9hdBgJIAEoCRIUCgxjbG9zZV9yZWFzb24YCiABKAkiswIKFFBhY2thZ2VSdW50aW1lU3RhdHVzEhMKC3J1bnRpbWVfa2V5GAEgASgJEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYAiABKAkSGQoRc291cmNlX3JlcG9zaXRvcnkYAyABKAkSFQoNc291cmNlX2NvbW1pdBgEIAEoCRIUCgxidWlsZF90YXJnZXQYBSABKAkSEwoLc2VydmVyX3BhdGgYBiABKAkSCwoDcGlkGAcgASgNEg0KBXN0YXRlGAggASgJEhIKCnN0YXJ0ZWRfYXQYCSABKAkSGQoRbGFzdF9oYW5kc2hha2VfYXQYCiABKAkSIAoYcnVudGltZV9wcm90b2NvbF92ZXJzaW9uGAsgASgJEh8KF2FkdmVydGlzZWRfZXhwb3J0X2NvdW50GAwgASgNMq4HChNPcmNoZXN0cmF0b3JSdW50aW1lEl8KEEludm9rZUNhcGFiaWxpdHkSJC5xdWl4b3Mub3JjaC5JbnZva2VDYXBhYmlsaXR5UmVxdWVzdBolLnF1aXhvcy5vcmNoLkludm9rZUNhcGFiaWxpdHlSZXNwb25zZRJbCg9XYXRjaENhcGFiaWxpdHkSIy5xdWl4b3Mub3JjaC5XYXRjaENhcGFiaWxpdHlSZXF1ZXN0GiEucXVpeG9zLm9yY2guV2F0Y2hDYXBhYmlsaXR5RXZlbnQwARJcCg9Db25zdHJ1Y3RPYmplY3QSIy5xdWl4b3Mub3JjaC5Db25zdHJ1Y3RPYmplY3RSZXF1ZXN0GiQucXVpeG9zLm9yY2guQ29uc3RydWN0T2JqZWN0UmVzcG9uc2USjAEKH1Jlc29sdmVPckNvbnN0cnVjdFJlbGF0ZWRPYmplY3QSMy5xdWl4b3Mub3JjaC5SZXNvbHZlT3JDb25zdHJ1Y3RSZWxhdGVkT2JqZWN0UmVxdWVzdBo0LnF1aXhvcy5vcmNoLlJlc29sdmVPckNvbnN0cnVjdFJlbGF0ZWRPYmplY3RSZXNwb25zZRJTCgxHZXRXb3Jrc3BhY2USIC5xdWl4b3Mub3JjaC5HZXRXb3Jrc3BhY2VSZXF1ZXN0GiEucXVpeG9zLm9yY2guR2V0V29ya3NwYWNlUmVzcG9uc2UScQoWTGlzdFBhY2thZ2VEZXNjcmlwdG9ycxIqLnF1aXhvcy5vcmNoLkxpc3RQYWNrYWdlRGVzY3JpcHRvcnNSZXF1ZXN0GisucXVpeG9zLm9yY2guTGlzdFBhY2thZ2VEZXNjcmlwdG9yc1Jlc3BvbnNlEmgKE0xpc3RQYWNrYWdlUnVudGltZXMSJy5xdWl4b3Mub3JjaC5MaXN0UGFja2FnZVJ1bnRpbWVzUmVxdWVzdBooLnF1aXhvcy5vcmNoLkxpc3RQYWNrYWdlUnVudGltZXNSZXNwb25zZRJcCg9MaXN0QWN0aXZhdGlvbnMSIy5xdWl4b3Mub3JjaC5MaXN0QWN0aXZhdGlvbnNSZXF1ZXN0GiQucXVpeG9zLm9yY2guTGlzdEFjdGl2YXRpb25zUmVzcG9uc2USXAoPQ2xvc2VBY3RpdmF0aW9uEiMucXVpeG9zLm9yY2guQ2xvc2VBY3RpdmF0aW9uUmVxdWVzdBokLnF1aXhvcy5vcmNoLkNsb3NlQWN0aXZhdGlvblJlc3BvbnNlYgZwcm90bzM", [file_camino_api, file_quixos_package, file_quixos_refs, file_quixos_runtime]);
 
 /**
- * @generated from message quixos.orch.InvokeFunctionRequest
+ * @generated from message quixos.orch.ConstructObjectRequest
  */
-export type InvokeFunctionRequest = Message<"quixos.orch.InvokeFunctionRequest"> & {
+export type ConstructObjectRequest = Message<"quixos.orch.ConstructObjectRequest"> & {
   /**
-   * @generated from field: quixos.FunctionRef function = 1;
+   * @generated from field: string atom_id = 1;
    */
-  function?: FunctionRef | undefined;
+  atomId: string;
+
+  /**
+   * @generated from field: map<string, camino.Value> input = 2;
+   */
+  input: { [key: string]: Value };
+};
+
+/**
+ * Describes the message quixos.orch.ConstructObjectRequest.
+ * Use `create(ConstructObjectRequestSchema)` to create a new message.
+ */
+export const ConstructObjectRequestSchema: GenMessage<ConstructObjectRequest> = /*@__PURE__*/
+  messageDesc(file_quixos_orch, 0);
+
+/**
+ * @generated from message quixos.orch.ConstructObjectResponse
+ */
+export type ConstructObjectResponse = Message<"quixos.orch.ConstructObjectResponse"> & {
+  /**
+   * @generated from field: camino.CaminoObject object = 1;
+   */
+  object?: CaminoObject | undefined;
+};
+
+/**
+ * Describes the message quixos.orch.ConstructObjectResponse.
+ * Use `create(ConstructObjectResponseSchema)` to create a new message.
+ */
+export const ConstructObjectResponseSchema: GenMessage<ConstructObjectResponse> = /*@__PURE__*/
+  messageDesc(file_quixos_orch, 1);
+
+/**
+ * @generated from message quixos.orch.ResolveOrConstructRelatedObjectRequest
+ */
+export type ResolveOrConstructRelatedObjectRequest = Message<"quixos.orch.ResolveOrConstructRelatedObjectRequest"> & {
+  /**
+   * @generated from field: string object_id = 1;
+   */
+  objectId: string;
+
+  /**
+   * @generated from field: string interface_revision_id = 2;
+   */
+  interfaceRevisionId: string;
+
+  /**
+   * @generated from field: string member_id = 3;
+   */
+  memberId: string;
+};
+
+/**
+ * Describes the message quixos.orch.ResolveOrConstructRelatedObjectRequest.
+ * Use `create(ResolveOrConstructRelatedObjectRequestSchema)` to create a new message.
+ */
+export const ResolveOrConstructRelatedObjectRequestSchema: GenMessage<ResolveOrConstructRelatedObjectRequest> = /*@__PURE__*/
+  messageDesc(file_quixos_orch, 2);
+
+/**
+ * @generated from message quixos.orch.ResolveOrConstructRelatedObjectResponse
+ */
+export type ResolveOrConstructRelatedObjectResponse = Message<"quixos.orch.ResolveOrConstructRelatedObjectResponse"> & {
+  /**
+   * @generated from field: camino.CaminoObject object = 1;
+   */
+  object?: CaminoObject | undefined;
+
+  /**
+   * @generated from field: bool constructed = 2;
+   */
+  constructed: boolean;
+};
+
+/**
+ * Describes the message quixos.orch.ResolveOrConstructRelatedObjectResponse.
+ * Use `create(ResolveOrConstructRelatedObjectResponseSchema)` to create a new message.
+ */
+export const ResolveOrConstructRelatedObjectResponseSchema: GenMessage<ResolveOrConstructRelatedObjectResponse> = /*@__PURE__*/
+  messageDesc(file_quixos_orch, 3);
+
+/**
+ * @generated from message quixos.orch.InvokeCapabilityRequest
+ */
+export type InvokeCapabilityRequest = Message<"quixos.orch.InvokeCapabilityRequest"> & {
+  /**
+   * @generated from field: quixos.CapabilityRef capability = 1;
+   */
+  capability?: CapabilityRef | undefined;
 
   /**
    * @generated from field: string object_id = 2;
@@ -38,19 +126,27 @@ export type InvokeFunctionRequest = Message<"quixos.orch.InvokeFunctionRequest">
    * @generated from field: map<string, camino.Value> input = 3;
    */
   input: { [key: string]: Value };
+
+  /**
+   * Identifies one logical client mutation across the capability and Camino
+   * layers so a live-value controller can recognize its own confirmation.
+   *
+   * @generated from field: string client_mutation_id = 4;
+   */
+  clientMutationId: string;
 };
 
 /**
- * Describes the message quixos.orch.InvokeFunctionRequest.
+ * Describes the message quixos.orch.InvokeCapabilityRequest.
- * Use `create(InvokeFunctionRequestSchema)` to create a new message.
+ * Use `create(InvokeCapabilityRequestSchema)` to create a new message.
  */
-export const InvokeFunctionRequestSchema: GenMessage<InvokeFunctionRequest> = /*@__PURE__*/
+export const InvokeCapabilityRequestSchema: GenMessage<InvokeCapabilityRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 0);
+  messageDesc(file_quixos_orch, 4);
 
 /**
- * @generated from message quixos.orch.InvokeFunctionResponse
+ * @generated from message quixos.orch.InvokeCapabilityResponse
  */
-export type InvokeFunctionResponse = Message<"quixos.orch.InvokeFunctionResponse"> & {
+export type InvokeCapabilityResponse = Message<"quixos.orch.InvokeCapabilityResponse"> & {
   /**
    * @generated from field: string invocation_id = 1;
    */
@@ -75,23 +171,28 @@ export type InvokeFunctionResponse = Message<"quixos.orch.InvokeFunctionResponse
    * @generated from field: string error = 5;
    */
   error: string;
+
+  /**
+   * @generated from field: repeated quixos.runtime.DerivedDependency dependencies = 6;
+   */
+  dependencies: DerivedDependency[];
 };
 
 /**
- * Describes the message quixos.orch.InvokeFunctionResponse.
+ * Describes the message quixos.orch.InvokeCapabilityResponse.
- * Use `create(InvokeFunctionResponseSchema)` to create a new message.
+ * Use `create(InvokeCapabilityResponseSchema)` to create a new message.
  */
-export const InvokeFunctionResponseSchema: GenMessage<InvokeFunctionResponse> = /*@__PURE__*/
+export const InvokeCapabilityResponseSchema: GenMessage<InvokeCapabilityResponse> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 1);
+  messageDesc(file_quixos_orch, 5);
 
 /**
- * @generated from message quixos.orch.WatchFunctionRequest
+ * @generated from message quixos.orch.WatchCapabilityRequest
  */
-export type WatchFunctionRequest = Message<"quixos.orch.WatchFunctionRequest"> & {
+export type WatchCapabilityRequest = Message<"quixos.orch.WatchCapabilityRequest"> & {
   /**
-   * @generated from field: quixos.FunctionRef function = 1;
+   * @generated from field: quixos.CapabilityRef capability = 1;
    */
-  function?: FunctionRef | undefined;
+  capability?: CapabilityRef | undefined;
 
   /**
    * @generated from field: string object_id = 2;
@@ -105,16 +206,16 @@ export type WatchFunctionRequest = Message<"quixos.orch.WatchFunctionRequest"> &
 };
 
 /**
- * Describes the message quixos.orch.WatchFunctionRequest.
+ * Describes the message quixos.orch.WatchCapabilityRequest.
- * Use `create(WatchFunctionRequestSchema)` to create a new message.
+ * Use `create(WatchCapabilityRequestSchema)` to create a new message.
  */
-export const WatchFunctionRequestSchema: GenMessage<WatchFunctionRequest> = /*@__PURE__*/
+export const WatchCapabilityRequestSchema: GenMessage<WatchCapabilityRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 2);
+  messageDesc(file_quixos_orch, 6);
 
 /**
- * @generated from message quixos.orch.WatchFunctionEvent
+ * @generated from message quixos.orch.WatchCapabilityEvent
  */
-export type WatchFunctionEvent = Message<"quixos.orch.WatchFunctionEvent"> & {
+export type WatchCapabilityEvent = Message<"quixos.orch.WatchCapabilityEvent"> & {
   /**
    * @generated from field: string invocation_id = 1;
    */
@@ -152,11 +253,51 @@ export type WatchFunctionEvent = Message<"quixos.orch.WatchFunctionEvent"> & {
 };
 
 /**
- * Describes the message quixos.orch.WatchFunctionEvent.
+ * Describes the message quixos.orch.WatchCapabilityEvent.
- * Use `create(WatchFunctionEventSchema)` to create a new message.
+ * Use `create(WatchCapabilityEventSchema)` to create a new message.
  */
-export const WatchFunctionEventSchema: GenMessage<WatchFunctionEvent> = /*@__PURE__*/
+export const WatchCapabilityEventSchema: GenMessage<WatchCapabilityEvent> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 3);
+  messageDesc(file_quixos_orch, 7);
+
+/**
+ * @generated from message quixos.orch.GetWorkspaceRequest
+ */
+export type GetWorkspaceRequest = Message<"quixos.orch.GetWorkspaceRequest"> & {
+};
+
+/**
+ * Describes the message quixos.orch.GetWorkspaceRequest.
+ * Use `create(GetWorkspaceRequestSchema)` to create a new message.
+ */
+export const GetWorkspaceRequestSchema: GenMessage<GetWorkspaceRequest> = /*@__PURE__*/
+  messageDesc(file_quixos_orch, 8);
+
+/**
+ * @generated from message quixos.orch.GetWorkspaceResponse
+ */
+export type GetWorkspaceResponse = Message<"quixos.orch.GetWorkspaceResponse"> & {
+  /**
+   * @generated from field: string workspace_id = 1;
+   */
+  workspaceId: string;
+
+  /**
+   * @generated from field: string workspace_revision_id = 2;
+   */
+  workspaceRevisionId: string;
+
+  /**
+   * @generated from field: string source_root_commit = 3;
+   */
+  sourceRootCommit: string;
+};
+
+/**
+ * Describes the message quixos.orch.GetWorkspaceResponse.
+ * Use `create(GetWorkspaceResponseSchema)` to create a new message.
+ */
+export const GetWorkspaceResponseSchema: GenMessage<GetWorkspaceResponse> = /*@__PURE__*/
+  messageDesc(file_quixos_orch, 9);
 
 /**
  * @generated from message quixos.orch.ListActivationsRequest
@@ -169,7 +310,7 @@ export type ListActivationsRequest = Message<"quixos.orch.ListActivationsRequest
  * Use `create(ListActivationsRequestSchema)` to create a new message.
  */
 export const ListActivationsRequestSchema: GenMessage<ListActivationsRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 4);
+  messageDesc(file_quixos_orch, 10);
 
 /**
  * @generated from message quixos.orch.ListPackageDescriptorsRequest
@@ -182,7 +323,7 @@ export type ListPackageDescriptorsRequest = Message<"quixos.orch.ListPackageDesc
  * Use `create(ListPackageDescriptorsRequestSchema)` to create a new message.
  */
 export const ListPackageDescriptorsRequestSchema: GenMessage<ListPackageDescriptorsRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 5);
+  messageDesc(file_quixos_orch, 11);
 
 /**
  * @generated from message quixos.orch.ListPackageDescriptorsResponse
@@ -199,7 +340,7 @@ export type ListPackageDescriptorsResponse = Message<"quixos.orch.ListPackageDes
  * Use `create(ListPackageDescriptorsResponseSchema)` to create a new message.
  */
 export const ListPackageDescriptorsResponseSchema: GenMessage<ListPackageDescriptorsResponse> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 6);
+  messageDesc(file_quixos_orch, 12);
 
 /**
  * @generated from message quixos.orch.ListPackageRuntimesRequest
@@ -212,7 +353,7 @@ export type ListPackageRuntimesRequest = Message<"quixos.orch.ListPackageRuntime
  * Use `create(ListPackageRuntimesRequestSchema)` to create a new message.
  */
 export const ListPackageRuntimesRequestSchema: GenMessage<ListPackageRuntimesRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 7);
+  messageDesc(file_quixos_orch, 13);
 
 /**
  * @generated from message quixos.orch.ListPackageRuntimesResponse
@@ -229,7 +370,7 @@ export type ListPackageRuntimesResponse = Message<"quixos.orch.ListPackageRuntim
  * Use `create(ListPackageRuntimesResponseSchema)` to create a new message.
  */
 export const ListPackageRuntimesResponseSchema: GenMessage<ListPackageRuntimesResponse> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 8);
+  messageDesc(file_quixos_orch, 14);
 
 /**
  * @generated from message quixos.orch.ListActivationsResponse
@@ -246,7 +387,7 @@ export type ListActivationsResponse = Message<"quixos.orch.ListActivationsRespon
  * Use `create(ListActivationsResponseSchema)` to create a new message.
  */
 export const ListActivationsResponseSchema: GenMessage<ListActivationsResponse> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 9);
+  messageDesc(file_quixos_orch, 15);
 
 /**
  * @generated from message quixos.orch.CloseActivationRequest
@@ -268,7 +409,7 @@ export type CloseActivationRequest = Message<"quixos.orch.CloseActivationRequest
  * Use `create(CloseActivationRequestSchema)` to create a new message.
  */
 export const CloseActivationRequestSchema: GenMessage<CloseActivationRequest> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 10);
+  messageDesc(file_quixos_orch, 16);
 
 /**
  * @generated from message quixos.orch.CloseActivationResponse
@@ -285,7 +426,7 @@ export type CloseActivationResponse = Message<"quixos.orch.CloseActivationRespon
  * Use `create(CloseActivationResponseSchema)` to create a new message.
  */
 export const CloseActivationResponseSchema: GenMessage<CloseActivationResponse> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 11);
+  messageDesc(file_quixos_orch, 17);
 
 /**
  * @generated from message quixos.orch.Activation
@@ -297,9 +438,9 @@ export type Activation = Message<"quixos.orch.Activation"> & {
   activationId: string;
 
   /**
-   * @generated from field: quixos.FunctionRef function = 2;
+   * @generated from field: quixos.PackageExportRef export = 2;
    */
-  function?: FunctionRef | undefined;
+  export?: PackageExportRef | undefined;
 
   /**
    * @generated from field: string object_id = 3;
@@ -347,7 +488,7 @@ export type Activation = Message<"quixos.orch.Activation"> & {
  * Use `create(ActivationSchema)` to create a new message.
  */
 export const ActivationSchema: GenMessage<Activation> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 12);
+  messageDesc(file_quixos_orch, 18);
 
 /**
  * @generated from message quixos.orch.PackageRuntimeStatus
@@ -359,69 +500,59 @@ export type PackageRuntimeStatus = Message<"quixos.orch.PackageRuntimeStatus"> &
   runtimeKey: string;
 
   /**
-   * @generated from field: string package_namespace = 2;
+   * @generated from field: string package_revision_id = 2;
    */
-  packageNamespace: string;
+  packageRevisionId: string;
 
   /**
-   * @generated from field: string package_name = 3;
+   * @generated from field: string source_repository = 3;
    */
-  packageName: string;
+  sourceRepository: string;
 
   /**
-   * @generated from field: uint32 descriptor_version = 4;
+   * @generated from field: string source_commit = 4;
    */
-  descriptorVersion: number;
+  sourceCommit: string;
 
   /**
-   * @generated from field: string source_repo = 5;
+   * @generated from field: string build_target = 5;
    */
-  sourceRepo: string;
+  buildTarget: string;
 
   /**
-   * @generated from field: string server_installable = 6;
+   * @generated from field: string server_path = 6;
-   */
-  serverInstallable: string;
-
-  /**
-   * @generated from field: string source_path = 7;
-   */
-  sourcePath: string;
-
-  /**
-   * @generated from field: string server_path = 8;
    */
   serverPath: string;
 
   /**
-   * @generated from field: uint32 pid = 9;
+   * @generated from field: uint32 pid = 7;
    */
   pid: number;
 
   /**
-   * @generated from field: string state = 10;
+   * @generated from field: string state = 8;
    */
   state: string;
 
   /**
-   * @generated from field: string started_at = 11;
+   * @generated from field: string started_at = 9;
    */
   startedAt: string;
 
   /**
-   * @generated from field: string last_handshake_at = 12;
+   * @generated from field: string last_handshake_at = 10;
    */
   lastHandshakeAt: string;
 
   /**
-   * @generated from field: string runtime_protocol_version = 13;
+   * @generated from field: string runtime_protocol_version = 11;
    */
   runtimeProtocolVersion: string;
 
   /**
-   * @generated from field: uint32 advertised_function_count = 14;
+   * @generated from field: uint32 advertised_export_count = 12;
    */
-  advertisedFunctionCount: number;
+  advertisedExportCount: number;
 };
 
 /**
@@ -429,27 +560,51 @@ export type PackageRuntimeStatus = Message<"quixos.orch.PackageRuntimeStatus"> &
  * Use `create(PackageRuntimeStatusSchema)` to create a new message.
  */
 export const PackageRuntimeStatusSchema: GenMessage<PackageRuntimeStatus> = /*@__PURE__*/
-  messageDesc(file_quixos_orch, 13);
+  messageDesc(file_quixos_orch, 19);
 
 /**
  * @generated from service quixos.orch.OrchestratorRuntime
  */
 export const OrchestratorRuntime: GenService<{
   /**
-   * @generated from rpc quixos.orch.OrchestratorRuntime.InvokeFunction
+   * @generated from rpc quixos.orch.OrchestratorRuntime.InvokeCapability
    */
-  invokeFunction: {
+  invokeCapability: {
     methodKind: "unary";
-    input: typeof InvokeFunctionRequestSchema;
+    input: typeof InvokeCapabilityRequestSchema;
-    output: typeof InvokeFunctionResponseSchema;
+    output: typeof InvokeCapabilityResponseSchema;
   },
   /**
-   * @generated from rpc quixos.orch.OrchestratorRuntime.WatchFunction
+   * @generated from rpc quixos.orch.OrchestratorRuntime.WatchCapability
    */
-  watchFunction: {
+  watchCapability: {
     methodKind: "server_streaming";
-    input: typeof WatchFunctionRequestSchema;
+    input: typeof WatchCapabilityRequestSchema;
-    output: typeof WatchFunctionEventSchema;
+    output: typeof WatchCapabilityEventSchema;
+  },
+  /**
+   * @generated from rpc quixos.orch.OrchestratorRuntime.ConstructObject
+   */
+  constructObject: {
+    methodKind: "unary";
+    input: typeof ConstructObjectRequestSchema;
+    output: typeof ConstructObjectResponseSchema;
+  },
+  /**
+   * @generated from rpc quixos.orch.OrchestratorRuntime.ResolveOrConstructRelatedObject
+   */
+  resolveOrConstructRelatedObject: {
+    methodKind: "unary";
+    input: typeof ResolveOrConstructRelatedObjectRequestSchema;
+    output: typeof ResolveOrConstructRelatedObjectResponseSchema;
+  },
+  /**
+   * @generated from rpc quixos.orch.OrchestratorRuntime.GetWorkspace
+   */
+  getWorkspace: {
+    methodKind: "unary";
+    input: typeof GetWorkspaceRequestSchema;
+    output: typeof GetWorkspaceResponseSchema;
   },
   /**
    * @generated from rpc quixos.orch.OrchestratorRuntime.ListPackageDescriptors

src/gen/quixos/package_pb.ts

@@ -1,131 +1,40 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/package.proto (package quixos, syntax proto3)
 /* eslint-disable */
 
-import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
-import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
-import type { SymbolRef } from "../camino/schema_pb.js";
-import { file_camino_schema } from "../camino/schema_pb.js";
-import type { FunctionRef } from "./refs_pb.js";
-import { file_quixos_refs } from "./refs_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file quixos/package.proto.
  */
 export const file_quixos_package: GenFile = /*@__PURE__*/
-  fileDesc("ChRxdWl4b3MvcGFja2FnZS5wcm90bxIGcXVpeG9zIm4KClBhY2thZ2VSZWYSGQoRcGFja2FnZV9uYW1lc3BhY2UYASABKAkSFAoMcGFja2FnZV9uYW1lGAIgASgJEhoKEmRlc2NyaXB0b3JfdmVyc2lvbhgDIAEoDRITCgt2ZXJzaW9uX3JlZhgEIAEoCSKgBAoRUGFja2FnZURlc2NyaXB0b3ISGQoRcGFja2FnZV9uYW1lc3BhY2UYASABKAkSFAoMcGFja2FnZV9uYW1lGAIgASgJEhoKEmRlc2NyaXB0b3JfdmVyc2lvbhgDIAEoDRIkChxpbnRlcmZhY2VfY29tcGF0aWJsZV9iYWNrX3RvGAQgASgNEiEKGXJ1bm5lcl9jb21wYXRpYmxlX2JhY2tfdG8YBSABKA0SEwoLc291cmNlX3JlcG8YBiABKAkSEgoKc291cmNlX3JlZhgHIAEoCRIbChNyZXNvbHZlZF9zb3VyY2VfcmVmGAggASgJEhoKEnNlcnZlcl9pbnN0YWxsYWJsZRgJIAEoCRIgChhydW50aW1lX3Byb3RvY29sX3ZlcnNpb24YCiABKAkSKgoNY2xhc3NfZXhwb3J0cxgLIAMoCzITLnF1aXhvcy5DbGFzc0V4cG9ydBIwChBmdW5jdGlvbl9leHBvcnRzGAwgAygLMhYucXVpeG9zLkZ1bmN0aW9uRXhwb3J0EjIKEWNvbXBvbmVudF9leHBvcnRzGA0gAygLMhcucXVpeG9zLkNvbXBvbmVudEV4cG9ydBIuCg9zaWRlY2FyX2V4cG9ydHMYDiADKAsyFS5xdWl4b3MuU2lkZWNhckV4cG9ydBIvCgxkZXBlbmRlbmNpZXMYDyADKAsyGS5xdWl4b3MuUGFja2FnZURlcGVuZGVuY3kiRwoLQ2xhc3NFeHBvcnQSIwoIY2xhc3NfaWQYASABKAsyES5jYW1pbm8uU3ltYm9sUmVmEhMKC3NvdXJjZV9maWxlGAIgASgJItoBCg5GdW5jdGlvbkV4cG9ydBIlCghmdW5jdGlvbhgBIAEoCzITLnF1aXhvcy5GdW5jdGlvblJlZhISCgppbnB1dF90eXBlGAIgASgJEhMKC291dHB1dF90eXBlGAMgASgJEhkKEWludGVyZmFjZV92ZXJzaW9uGAQgASgNEiQKHGludGVyZmFjZV9jb21wYXRpYmxlX2JhY2tfdG8YBSABKA0SNwoPY2FwYWJpbGl0eV9raW5kGAYgASgOMh4ucXVpeG9zLkZ1bmN0aW9uQ2FwYWJpbGl0eUtpbmQiYwoPQ29tcG9uZW50RXhwb3J0Eg4KBnN5bWJvbBgBIAEoCRISCgpwcm9wc190eXBlGAIgASgJEiwKEXN1cHBvcnRlZF9jbGFzc2VzGAMgAygLMhEuY2FtaW5vLlN5bWJvbFJlZiI5Cg1TaWRlY2FyRXhwb3J0Eg4KBnN5bWJvbBgBIAEoCRIYChBzaWRlX2VmZmVjdF9tb2RlGAIgASgJIpUBChFQYWNrYWdlRGVwZW5kZW5jeRIjCgdwYWNrYWdlGAEgASgLMhIucXVpeG9zLlBhY2thZ2VSZWYSJAocaW50ZXJmYWNlX2NvbXBhdGlibGVfYmFja190bxgCIAEoDRIZChFyZWZhY3Rvcl9yZXF1aXJlZBgDIAEoCBIaChJjb21wYXRpYmlsaXR5X25vdGUYBCABKAkqggEKFkZ1bmN0aW9uQ2FwYWJpbGl0eUtpbmQSKAokRlVOQ1RJT05fQ0FQQUJJTElUWV9LSU5EX1VOU1BFQ0lGSUVEEAASCgoGTUVUSE9EEAESEgoORklFTERfUkVTT0xWRVIQAhINCglNSUdSQVRJT04QAxIPCgtDT05TVFJVQ1RPUhAEYgZwcm90bzM", [file_camino_schema, file_quixos_refs]);
+  fileDesc("ChRxdWl4b3MvcGFja2FnZS5wcm90bxIGcXVpeG9zIo4BChFQYWNrYWdlRGVzY3JpcHRvchISCgpwYWNrYWdlX2lkGAEgASgJEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYAiABKAkSIAoYcnVudGltZV9wcm90b2NvbF92ZXJzaW9uGAMgASgJEiYKB2V4cG9ydHMYBCADKAsyFS5xdWl4b3MuUnVudGltZUV4cG9ydCI6Cg1SdW50aW1lRXhwb3J0EhEKCWV4cG9ydF9pZBgBIAEoCRIWCg5ydW50aW1lX3N5bWJvbBgCIAEoCWIGcHJvdG8z");
-
-/**
- * @generated from message quixos.PackageRef
- */
-export type PackageRef = Message<"quixos.PackageRef"> & {
-  /**
-   * @generated from field: string package_namespace = 1;
-   */
-  packageNamespace: string;
-
-  /**
-   * @generated from field: string package_name = 2;
-   */
-  packageName: string;
-
-  /**
-   * @generated from field: uint32 descriptor_version = 3;
-   */
-  descriptorVersion: number;
-
-  /**
-   * @generated from field: string version_ref = 4;
-   */
-  versionRef: string;
-};
-
-/**
- * Describes the message quixos.PackageRef.
- * Use `create(PackageRefSchema)` to create a new message.
- */
-export const PackageRefSchema: GenMessage<PackageRef> = /*@__PURE__*/
-  messageDesc(file_quixos_package, 0);
 
 /**
  * @generated from message quixos.PackageDescriptor
  */
 export type PackageDescriptor = Message<"quixos.PackageDescriptor"> & {
   /**
-   * @generated from field: string package_namespace = 1;
+   * @generated from field: string package_id = 1;
    */
-  packageNamespace: string;
+  packageId: string;
 
   /**
-   * @generated from field: string package_name = 2;
+   * @generated from field: string package_revision_id = 2;
    */
-  packageName: string;
+  packageRevisionId: string;
 
   /**
-   * @generated from field: uint32 descriptor_version = 3;
+   * @generated from field: string runtime_protocol_version = 3;
-   */
-  descriptorVersion: number;
-
-  /**
-   * @generated from field: uint32 interface_compatible_back_to = 4;
-   */
-  interfaceCompatibleBackTo: number;
-
-  /**
-   * @generated from field: uint32 runner_compatible_back_to = 5;
-   */
-  runnerCompatibleBackTo: number;
-
-  /**
-   * @generated from field: string source_repo = 6;
-   */
-  sourceRepo: string;
-
-  /**
-   * @generated from field: string source_ref = 7;
-   */
-  sourceRef: string;
-
-  /**
-   * @generated from field: string resolved_source_ref = 8;
-   */
-  resolvedSourceRef: string;
-
-  /**
-   * @generated from field: string server_installable = 9;
-   */
-  serverInstallable: string;
-
-  /**
-   * @generated from field: string runtime_protocol_version = 10;
    */
   runtimeProtocolVersion: string;
 
   /**
-   * @generated from field: repeated quixos.ClassExport class_exports = 11;
+   * @generated from field: repeated quixos.RuntimeExport exports = 4;
    */
-  classExports: ClassExport[];
+  exports: RuntimeExport[];
-
-  /**
-   * @generated from field: repeated quixos.FunctionExport function_exports = 12;
-   */
-  functionExports: FunctionExport[];
-
-  /**
-   * @generated from field: repeated quixos.ComponentExport component_exports = 13;
-   */
-  componentExports: ComponentExport[];
-
-  /**
-   * @generated from field: repeated quixos.SidecarExport sidecar_exports = 14;
-   */
-  sidecarExports: SidecarExport[];
-
-  /**
-   * @generated from field: repeated quixos.PackageDependency dependencies = 15;
-   */
-  dependencies: PackageDependency[];
 };
 
 /**
@@ -133,186 +42,27 @@ export type PackageDescriptor = Message<"quixos.PackageDescriptor"> & {
  * Use `create(PackageDescriptorSchema)` to create a new message.
  */
 export const PackageDescriptorSchema: GenMessage<PackageDescriptor> = /*@__PURE__*/
+  messageDesc(file_quixos_package, 0);
+
+/**
+ * @generated from message quixos.RuntimeExport
+ */
+export type RuntimeExport = Message<"quixos.RuntimeExport"> & {
+  /**
+   * @generated from field: string export_id = 1;
+   */
+  exportId: string;
+
+  /**
+   * @generated from field: string runtime_symbol = 2;
+   */
+  runtimeSymbol: string;
+};
+
+/**
+ * Describes the message quixos.RuntimeExport.
+ * Use `create(RuntimeExportSchema)` to create a new message.
+ */
+export const RuntimeExportSchema: GenMessage<RuntimeExport> = /*@__PURE__*/
   messageDesc(file_quixos_package, 1);
 
-/**
- * @generated from message quixos.ClassExport
- */
-export type ClassExport = Message<"quixos.ClassExport"> & {
-  /**
-   * @generated from field: camino.SymbolRef class_id = 1;
-   */
-  classId?: SymbolRef | undefined;
-
-  /**
-   * @generated from field: string source_file = 2;
-   */
-  sourceFile: string;
-};
-
-/**
- * Describes the message quixos.ClassExport.
- * Use `create(ClassExportSchema)` to create a new message.
- */
-export const ClassExportSchema: GenMessage<ClassExport> = /*@__PURE__*/
-  messageDesc(file_quixos_package, 2);
-
-/**
- * @generated from message quixos.FunctionExport
- */
-export type FunctionExport = Message<"quixos.FunctionExport"> & {
-  /**
-   * @generated from field: quixos.FunctionRef function = 1;
-   */
-  function?: FunctionRef | undefined;
-
-  /**
-   * @generated from field: string input_type = 2;
-   */
-  inputType: string;
-
-  /**
-   * @generated from field: string output_type = 3;
-   */
-  outputType: string;
-
-  /**
-   * @generated from field: uint32 interface_version = 4;
-   */
-  interfaceVersion: number;
-
-  /**
-   * @generated from field: uint32 interface_compatible_back_to = 5;
-   */
-  interfaceCompatibleBackTo: number;
-
-  /**
-   * @generated from field: quixos.FunctionCapabilityKind capability_kind = 6;
-   */
-  capabilityKind: FunctionCapabilityKind;
-};
-
-/**
- * Describes the message quixos.FunctionExport.
- * Use `create(FunctionExportSchema)` to create a new message.
- */
-export const FunctionExportSchema: GenMessage<FunctionExport> = /*@__PURE__*/
-  messageDesc(file_quixos_package, 3);
-
-/**
- * @generated from message quixos.ComponentExport
- */
-export type ComponentExport = Message<"quixos.ComponentExport"> & {
-  /**
-   * @generated from field: string symbol = 1;
-   */
-  symbol: string;
-
-  /**
-   * @generated from field: string props_type = 2;
-   */
-  propsType: string;
-
-  /**
-   * @generated from field: repeated camino.SymbolRef supported_classes = 3;
-   */
-  supportedClasses: SymbolRef[];
-};
-
-/**
- * Describes the message quixos.ComponentExport.
- * Use `create(ComponentExportSchema)` to create a new message.
- */
-export const ComponentExportSchema: GenMessage<ComponentExport> = /*@__PURE__*/
-  messageDesc(file_quixos_package, 4);
-
-/**
- * @generated from message quixos.SidecarExport
- */
-export type SidecarExport = Message<"quixos.SidecarExport"> & {
-  /**
-   * @generated from field: string symbol = 1;
-   */
-  symbol: string;
-
-  /**
-   * @generated from field: string side_effect_mode = 2;
-   */
-  sideEffectMode: string;
-};
-
-/**
- * Describes the message quixos.SidecarExport.
- * Use `create(SidecarExportSchema)` to create a new message.
- */
-export const SidecarExportSchema: GenMessage<SidecarExport> = /*@__PURE__*/
-  messageDesc(file_quixos_package, 5);
-
-/**
- * @generated from message quixos.PackageDependency
- */
-export type PackageDependency = Message<"quixos.PackageDependency"> & {
-  /**
-   * @generated from field: quixos.PackageRef package = 1;
-   */
-  package?: PackageRef | undefined;
-
-  /**
-   * @generated from field: uint32 interface_compatible_back_to = 2;
-   */
-  interfaceCompatibleBackTo: number;
-
-  /**
-   * @generated from field: bool refactor_required = 3;
-   */
-  refactorRequired: boolean;
-
-  /**
-   * @generated from field: string compatibility_note = 4;
-   */
-  compatibilityNote: string;
-};
-
-/**
- * Describes the message quixos.PackageDependency.
- * Use `create(PackageDependencySchema)` to create a new message.
- */
-export const PackageDependencySchema: GenMessage<PackageDependency> = /*@__PURE__*/
-  messageDesc(file_quixos_package, 6);
-
-/**
- * @generated from enum quixos.FunctionCapabilityKind
- */
-export enum FunctionCapabilityKind {
-  /**
-   * @generated from enum value: FUNCTION_CAPABILITY_KIND_UNSPECIFIED = 0;
-   */
-  FUNCTION_CAPABILITY_KIND_UNSPECIFIED = 0,
-
-  /**
-   * @generated from enum value: METHOD = 1;
-   */
-  METHOD = 1,
-
-  /**
-   * @generated from enum value: FIELD_RESOLVER = 2;
-   */
-  FIELD_RESOLVER = 2,
-
-  /**
-   * @generated from enum value: MIGRATION = 3;
-   */
-  MIGRATION = 3,
-
-  /**
-   * @generated from enum value: CONSTRUCTOR = 4;
-   */
-  CONSTRUCTOR = 4,
-}
-
-/**
- * Describes the enum quixos.FunctionCapabilityKind.
- */
-export const FunctionCapabilityKindSchema: GenEnum<FunctionCapabilityKind> = /*@__PURE__*/
-  enumDesc(file_quixos_package, 0);
-

src/gen/quixos/refs_pb.ts

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/refs.proto (package quixos, syntax proto3)
 /* eslint-disable */
 
@@ -10,42 +10,125 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file quixos/refs.proto.
  */
 export const file_quixos_refs: GenFile = /*@__PURE__*/
-  fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zInYKC0Z1bmN0aW9uUmVmEhkKEXBhY2thZ2VfbmFtZXNwYWNlGAEgASgJEhQKDHBhY2thZ2VfbmFtZRgCIAEoCRIOCgZzeW1ib2wYAyABKAkSEwoLdmVyc2lvbl9yZWYYBCABKAkSEQoJb3BlcmF0aW9uGAUgASgJYgZwcm90bzM");
+  fileDesc("ChFxdWl4b3MvcmVmcy5wcm90bxIGcXVpeG9zIkQKDUNhcGFiaWxpdHlSZWYSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAEgASgJEhQKDG9wZXJhdGlvbl9pZBgCIAEoCSJCChBQYWNrYWdlRXhwb3J0UmVmEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSEQoJZXhwb3J0X2lkGAIgASgJIsQBChJJbmplY3RlZERlcGVuZGVuY3kSDwoHcG9ydF9pZBgBIAEoCRIXCg1zdGF0ZV9zbG90X2lkGAIgASgJSAASJgoEZWRnZRgDIAEoCzIWLnF1aXhvcy5FZGdlRGVwZW5kZW5jeUgAEh8KFWludGVyZmFjZV9yZXZpc2lvbl9pZBgEIAEoCUgAEh0KE2NvbnN0cnVjdG9yX2F0b21faWQYBSABKAlIABIRCglvYmplY3RfaWQYBiABKAlCCQoHYmluZGluZyI9Cg5FZGdlRGVwZW5kZW5jeRIUCgxlZGdlX3R5cGVfaWQYASABKAkSFQoNcHJvamVjdGlvbl9pZBgCIAEoCWIGcHJvdG8z");
 
 /**
- * @generated from message quixos.FunctionRef
+ * @generated from message quixos.CapabilityRef
  */
-export type FunctionRef = Message<"quixos.FunctionRef"> & {
+export type CapabilityRef = Message<"quixos.CapabilityRef"> & {
   /**
-   * @generated from field: string package_namespace = 1;
+   * @generated from field: string interface_revision_id = 1;
    */
-  packageNamespace: string;
+  interfaceRevisionId: string;
 
   /**
-   * @generated from field: string package_name = 2;
+   * @generated from field: string operation_id = 2;
    */
-  packageName: string;
+  operationId: string;
-
-  /**
-   * @generated from field: string symbol = 3;
-   */
-  symbol: string;
-
-  /**
-   * @generated from field: string version_ref = 4;
-   */
-  versionRef: string;
-
-  /**
-   * @generated from field: string operation = 5;
-   */
-  operation: string;
 };
 
 /**
- * Describes the message quixos.FunctionRef.
+ * Describes the message quixos.CapabilityRef.
- * Use `create(FunctionRefSchema)` to create a new message.
+ * Use `create(CapabilityRefSchema)` to create a new message.
  */
-export const FunctionRefSchema: GenMessage<FunctionRef> = /*@__PURE__*/
+export const CapabilityRefSchema: GenMessage<CapabilityRef> = /*@__PURE__*/
   messageDesc(file_quixos_refs, 0);
 
+/**
+ * @generated from message quixos.PackageExportRef
+ */
+export type PackageExportRef = Message<"quixos.PackageExportRef"> & {
+  /**
+   * @generated from field: string package_revision_id = 1;
+   */
+  packageRevisionId: string;
+
+  /**
+   * @generated from field: string export_id = 2;
+   */
+  exportId: string;
+};
+
+/**
+ * Describes the message quixos.PackageExportRef.
+ * Use `create(PackageExportRefSchema)` to create a new message.
+ */
+export const PackageExportRefSchema: GenMessage<PackageExportRef> = /*@__PURE__*/
+  messageDesc(file_quixos_refs, 1);
+
+/**
+ * @generated from message quixos.InjectedDependency
+ */
+export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
+  /**
+   * @generated from field: string port_id = 1;
+   */
+  portId: string;
+
+  /**
+   * @generated from oneof quixos.InjectedDependency.binding
+   */
+  binding: {
+    /**
+     * @generated from field: string state_slot_id = 2;
+     */
+    value: string;
+    case: "stateSlotId";
+  } | {
+    /**
+     * @generated from field: quixos.EdgeDependency edge = 3;
+     */
+    value: EdgeDependency;
+    case: "edge";
+  } | {
+    /**
+     * @generated from field: string interface_revision_id = 4;
+     */
+    value: string;
+    case: "interfaceRevisionId";
+  } | {
+    /**
+     * @generated from field: string constructor_atom_id = 5;
+     */
+    value: string;
+    case: "constructorAtomId";
+  } | { case: undefined; value?: undefined };
+
+  /**
+   * Defaults to the invocation receiver. A checked dependency traversal can
+   * select a related object explicitly before the package runtime starts.
+   *
+   * @generated from field: string object_id = 6;
+   */
+  objectId: string;
+};
+
+/**
+ * Describes the message quixos.InjectedDependency.
+ * Use `create(InjectedDependencySchema)` to create a new message.
+ */
+export const InjectedDependencySchema: GenMessage<InjectedDependency> = /*@__PURE__*/
+  messageDesc(file_quixos_refs, 2);
+
+/**
+ * @generated from message quixos.EdgeDependency
+ */
+export type EdgeDependency = Message<"quixos.EdgeDependency"> & {
+  /**
+   * @generated from field: string edge_type_id = 1;
+   */
+  edgeTypeId: string;
+
+  /**
+   * @generated from field: string projection_id = 2;
+   */
+  projectionId: string;
+};
+
+/**
+ * Describes the message quixos.EdgeDependency.
+ * Use `create(EdgeDependencySchema)` to create a new message.
+ */
+export const EdgeDependencySchema: GenMessage<EdgeDependency> = /*@__PURE__*/
+  messageDesc(file_quixos_refs, 3);
+

src/gen/quixos/runtime_pb.ts

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/runtime.proto (package quixos.runtime, syntax proto3)
 /* eslint-disable */
 
@@ -6,7 +6,7 @@ import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegen
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import type { Value } from "../camino/api_pb.js";
 import { file_camino_api } from "../camino/api_pb.js";
-import type { FunctionRef } from "./refs_pb.js";
+import type { InjectedDependency, PackageExportRef } from "./refs_pb.js";
 import { file_quixos_refs } from "./refs_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 
@@ -14,7 +14,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file quixos/runtime.proto.
  */
 export const file_quixos_runtime: GenFile = /*@__PURE__*/
-  fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiMQoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkijgEKEUhhbmRzaGFrZVJlc3BvbnNlEhkKEXBhY2thZ2VfbmFtZXNwYWNlGAEgASgJEhQKDHBhY2thZ2VfbmFtZRgCIAEoCRIgChhydW50aW1lX3Byb3RvY29sX3ZlcnNpb24YAyABKAkSJgoJZnVuY3Rpb25zGAQgAygLMhMucXVpeG9zLkZ1bmN0aW9uUmVmItYBCg1JbnZva2VSZXF1ZXN0EhUKDWludm9jYXRpb25faWQYASABKAkSJQoIZnVuY3Rpb24YAiABKAsyEy5xdWl4b3MuRnVuY3Rpb25SZWYSEQoJb2JqZWN0X2lkGAMgASgJEjcKBWlucHV0GAQgAygLMigucXVpeG9zLnJ1bnRpbWUuSW52b2tlUmVxdWVzdC5JbnB1dEVudHJ5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJKCg5JbnZva2VSZXNwb25zZRIKCgJvaxgBIAEoCBIdCgZyZXN1bHQYAiABKAsyDS5jYW1pbm8uVmFsdWUSDQoFZXJyb3IYAyABKAki1AEKDFdhdGNoUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEiUKCGZ1bmN0aW9uGAIgASgLMhMucXVpeG9zLkZ1bmN0aW9uUmVmEhEKCW9iamVjdF9pZBgDIAEoCRI2CgVpbnB1dBgEIAMoCzInLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdC5JbnB1dEVudHJ5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJeChFEZXJpdmVkRGVwZW5kZW5jeRIMCgRraW5kGAEgASgJEhEKCW9iamVjdF9pZBgCIAEoCRISCgpmaWVsZF9uYW1lGAMgASgJEhQKDHNvdXJjZV9maWVsZBgEIAEoCSKVAQoKV2F0Y2hFdmVudBIQCgh3YXRjaF9pZBgBIAEoCRIcCgV2YWx1ZRgCIAEoCzINLmNhbWluby5WYWx1ZRI3CgxkZXBlbmRlbmNpZXMYAyADKAsyIS5xdWl4b3MucnVudGltZS5EZXJpdmVkRGVwZW5kZW5jeRINCgVlcnJvchgEIAEoCRIPCgdpbml0aWFsGAUgASgIMvABCg5QYWNrYWdlUnVudGltZRJQCglIYW5kc2hha2USIC5xdWl4b3MucnVudGltZS5IYW5kc2hha2VSZXF1ZXN0GiEucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVzcG9uc2USRwoGSW52b2tlEh0ucXVpeG9zLnJ1bnRpbWUuSW52b2tlUmVxdWVzdBoeLnF1aXhvcy5ydW50aW1lLkludm9rZVJlc3BvbnNlEkMKBVdhdGNoEhwucXVpeG9zLnJ1bnRpbWUuV2F0Y2hSZXF1ZXN0GhoucXVpeG9zLnJ1bnRpbWUuV2F0Y2hFdmVudDABYgZwcm90bzM", [file_camino_api, file_quixos_refs]);
+  fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiMQoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkiZgoRSGFuZHNoYWtlUmVzcG9uc2USGwoTcGFja2FnZV9yZXZpc2lvbl9pZBgBIAEoCRIgChhydW50aW1lX3Byb3RvY29sX3ZlcnNpb24YAiABKAkSEgoKZXhwb3J0X2lkcxgDIAMoCSKLAgoNSW52b2tlUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI3CgVpbnB1dBgEIAMoCzIoLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QuSW5wdXRFbnRyeRIwCgxkZXBlbmRlbmNpZXMYBSADKAsyGi5xdWl4b3MuSW5qZWN0ZWREZXBlbmRlbmN5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASKDAQoOSW52b2tlUmVzcG9uc2USCgoCb2sYASABKAgSHQoGcmVzdWx0GAIgASgLMg0uY2FtaW5vLlZhbHVlEg0KBWVycm9yGAMgASgJEjcKDGRlcGVuZGVuY2llcxgEIAMoCzIhLnF1aXhvcy5ydW50aW1lLkRlcml2ZWREZXBlbmRlbmN5IokCCgxXYXRjaFJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCRIoCgZleHBvcnQYAiABKAsyGC5xdWl4b3MuUGFja2FnZUV4cG9ydFJlZhIRCglvYmplY3RfaWQYAyABKAkSNgoFaW5wdXQYBCADKAsyJy5xdWl4b3MucnVudGltZS5XYXRjaFJlcXVlc3QuSW5wdXRFbnRyeRIwCgxkZXBlbmRlbmNpZXMYBSADKAsyGi5xdWl4b3MuSW5qZWN0ZWREZXBlbmRlbmN5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJiChFEZXJpdmVkRGVwZW5kZW5jeRIMCgRraW5kGAEgASgJEhEKCW9iamVjdF9pZBgCIAEoCRIVCg1hdHRhY2htZW50X2lkGAMgASgJEhUKDXByb2plY3Rpb25faWQYBCABKAkilQEKCldhdGNoRXZlbnQSEAoId2F0Y2hfaWQYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWUSNwoMZGVwZW5kZW5jaWVzGAMgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kSDQoFZXJyb3IYBCABKAkSDwoHaW5pdGlhbBgFIAEoCDLwAQoOUGFja2FnZVJ1bnRpbWUSUAoJSGFuZHNoYWtlEiAucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVxdWVzdBohLnF1aXhvcy5ydW50aW1lLkhhbmRzaGFrZVJlc3BvbnNlEkcKBkludm9rZRIdLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QaHi5xdWl4b3MucnVudGltZS5JbnZva2VSZXNwb25zZRJDCgVXYXRjaBIcLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdBoaLnF1aXhvcy5ydW50aW1lLldhdGNoRXZlbnQwAWIGcHJvdG8z", [file_camino_api, file_quixos_refs]);
 
 /**
  * @generated from message quixos.runtime.HandshakeRequest
@@ -38,24 +38,19 @@ export const HandshakeRequestSchema: GenMessage<HandshakeRequest> = /*@__PURE__*
  */
 export type HandshakeResponse = Message<"quixos.runtime.HandshakeResponse"> & {
   /**
-   * @generated from field: string package_namespace = 1;
+   * @generated from field: string package_revision_id = 1;
    */
-  packageNamespace: string;
+  packageRevisionId: string;
 
   /**
-   * @generated from field: string package_name = 2;
+   * @generated from field: string runtime_protocol_version = 2;
-   */
-  packageName: string;
-
-  /**
-   * @generated from field: string runtime_protocol_version = 3;
    */
   runtimeProtocolVersion: string;
 
   /**
-   * @generated from field: repeated quixos.FunctionRef functions = 4;
+   * @generated from field: repeated string export_ids = 3;
    */
-  functions: FunctionRef[];
+  exportIds: string[];
 };
 
 /**
@@ -75,9 +70,9 @@ export type InvokeRequest = Message<"quixos.runtime.InvokeRequest"> & {
   invocationId: string;
 
   /**
-   * @generated from field: quixos.FunctionRef function = 2;
+   * @generated from field: quixos.PackageExportRef export = 2;
    */
-  function?: FunctionRef | undefined;
+  export?: PackageExportRef | undefined;
 
   /**
    * @generated from field: string object_id = 3;
@@ -88,6 +83,11 @@ export type InvokeRequest = Message<"quixos.runtime.InvokeRequest"> & {
    * @generated from field: map<string, camino.Value> input = 4;
    */
   input: { [key: string]: Value };
+
+  /**
+   * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
+   */
+  dependencies: InjectedDependency[];
 };
 
 /**
@@ -115,6 +115,11 @@ export type InvokeResponse = Message<"quixos.runtime.InvokeResponse"> & {
    * @generated from field: string error = 3;
    */
   error: string;
+
+  /**
+   * @generated from field: repeated quixos.runtime.DerivedDependency dependencies = 4;
+   */
+  dependencies: DerivedDependency[];
 };
 
 /**
@@ -134,9 +139,9 @@ export type WatchRequest = Message<"quixos.runtime.WatchRequest"> & {
   invocationId: string;
 
   /**
-   * @generated from field: quixos.FunctionRef function = 2;
+   * @generated from field: quixos.PackageExportRef export = 2;
    */
-  function?: FunctionRef | undefined;
+  export?: PackageExportRef | undefined;
 
   /**
    * @generated from field: string object_id = 3;
@@ -147,6 +152,11 @@ export type WatchRequest = Message<"quixos.runtime.WatchRequest"> & {
    * @generated from field: map<string, camino.Value> input = 4;
    */
   input: { [key: string]: Value };
+
+  /**
+   * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
+   */
+  dependencies: InjectedDependency[];
 };
 
 /**
@@ -171,14 +181,14 @@ export type DerivedDependency = Message<"quixos.runtime.DerivedDependency"> & {
   objectId: string;
 
   /**
-   * @generated from field: string field_name = 3;
+   * @generated from field: string attachment_id = 3;
    */
-  fieldName: string;
+  attachmentId: string;
 
   /**
-   * @generated from field: string source_field = 4;
+   * @generated from field: string projection_id = 4;
    */
-  sourceField: string;
+  projectionId: string;
 };
 
 /**

src/resource-lock/cli.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { loadQuixosLock } from "./loader.js";
+
+const fileName = process.argv[2];
+if (!fileName || process.argv.length !== 3) {
+  console.error("Usage: quixos-lock-check <quixos.lock>");
+  process.exit(2);
+}
+
+const result = await loadQuixosLock(fileName);
+if (!result.ok) {
+  for (const diagnostic of result.diagnostics) {
+    console.error(
+      `${diagnostic.fileName}:${diagnostic.line}:${diagnostic.column + 1}: ${diagnostic.phase}/${diagnostic.code}: ${diagnostic.message}`,
+    );
+  }
+  process.exit(1);
+}
+console.log(JSON.stringify(result.lock, null, 2));

src/resource-lock/generated/QuixosLock.interp

@@ -0,0 +1,57 @@
+token literal names:
+null
+'quixos-lock'
+'fragment'
+'version'
+'quixos'
+'source'
+'interface'
+'package'
+'repository'
+'commit'
+'import'
+'{'
+'}'
+';'
+null
+null
+null
+null
+null
+null
+
+token symbolic names:
+null
+QUIXOS_LOCK
+FRAGMENT
+VERSION
+QUIXOS
+SOURCE
+INTERFACE
+PACKAGE
+REPOSITORY
+COMMIT
+IMPORT
+LBRACE
+RBRACE
+SEMI
+INTEGER
+IDENTIFIER
+STRING_LITERAL
+LINE_COMMENT
+BLOCK_COMMENT
+WS
+
+rule names:
+document
+quixosEntry
+resourceEntry
+importEntry
+resourceKind
+sourceBlock
+identifier
+stringLiteral
+
+
+atn:
+[4, 1, 19, 63, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 4, 7, 4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 1, 0, 1, 0, 3, 0, 19, 8, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 5, 0, 27, 8, 0, 10, 0, 12, 0, 30, 9, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 3, 1, 3, 1, 3, 1, 3, 1, 4, 1, 4, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 1, 6, 1, 6, 1, 7, 1, 7, 1, 7, 0, 0, 8, 0, 2, 4, 6, 8, 10, 12, 14, 0, 1, 1, 0, 6, 7, 58, 0, 16, 1, 0, 0, 0, 2, 34, 1, 0, 0, 0, 4, 38, 1, 0, 0, 0, 6, 43, 1, 0, 0, 0, 8, 47, 1, 0, 0, 0, 10, 49, 1, 0, 0, 0, 12, 58, 1, 0, 0, 0, 14, 60, 1, 0, 0, 0, 16, 18, 5, 1, 0, 0, 17, 19, 5, 2, 0, 0, 18, 17, 1, 0, 0, 0, 18, 19, 1, 0, 0, 0, 19, 20, 1, 0, 0, 0, 20, 21, 5, 3, 0, 0, 21, 22, 5, 14, 0, 0, 22, 28, 5, 11, 0, 0, 23, 27, 3, 2, 1, 0, 24, 27, 3, 6, 3, 0, 25, 27, 3, 4, 2, 0, 26, 23, 1, 0, 0, 0, 26, 24, 1, 0, 0, 0, 26, 25, 1, 0, 0, 0, 27, 30, 1, 0, 0, 0, 28, 26, 1, 0, 0, 0, 28, 29, 1, 0, 0, 0, 29, 31, 1, 0, 0, 0, 30, 28, 1, 0, 0, 0, 31, 32, 5, 12, 0, 0, 32, 33, 5, 0, 0, 1, 33, 1, 1, 0, 0, 0, 34, 35, 5, 4, 0, 0, 35, 36, 5, 5, 0, 0, 36, 37, 3, 10, 5, 0, 37, 3, 1, 0, 0, 0, 38, 39, 3, 8, 4, 0, 39, 40, 3, 12, 6, 0, 40, 41, 5, 5, 0, 0, 41, 42, 3, 10, 5, 0, 42, 5, 1, 0, 0, 0, 43, 44, 5, 10, 0, 0, 44, 45, 3, 14, 7, 0, 45, 46, 5, 13, 0, 0, 46, 7, 1, 0, 0, 0, 47, 48, 7, 0, 0, 0, 48, 9, 1, 0, 0, 0, 49, 50, 5, 11, 0, 0, 50, 51, 5, 8, 0, 0, 51, 52, 3, 14, 7, 0, 52, 53, 5, 13, 0, 0, 53, 54, 5, 9, 0, 0, 54, 55, 3, 14, 7, 0, 55, 56, 5, 13, 0, 0, 56, 57, 5, 12, 0, 0, 57, 11, 1, 0, 0, 0, 58, 59, 5, 15, 0, 0, 59, 13, 1, 0, 0, 0, 60, 61, 5, 16, 0, 0, 61, 15, 1, 0, 0, 0, 3, 18, 26, 28]

src/resource-lock/generated/QuixosLock.tokens

@@ -0,0 +1,32 @@
+QUIXOS_LOCK=1
+FRAGMENT=2
+VERSION=3
+QUIXOS=4
+SOURCE=5
+INTERFACE=6
+PACKAGE=7
+REPOSITORY=8
+COMMIT=9
+IMPORT=10
+LBRACE=11
+RBRACE=12
+SEMI=13
+INTEGER=14
+IDENTIFIER=15
+STRING_LITERAL=16
+LINE_COMMENT=17
+BLOCK_COMMENT=18
+WS=19
+'quixos-lock'=1
+'fragment'=2
+'version'=3
+'quixos'=4
+'source'=5
+'interface'=6
+'package'=7
+'repository'=8
+'commit'=9
+'import'=10
+'{'=11
+'}'=12
+';'=13

src/resource-lock/generated/QuixosLockLexer.tokens

@@ -0,0 +1,32 @@
+QUIXOS_LOCK=1
+FRAGMENT=2
+VERSION=3
+QUIXOS=4
+SOURCE=5
+INTERFACE=6
+PACKAGE=7
+REPOSITORY=8
+COMMIT=9
+IMPORT=10
+LBRACE=11
+RBRACE=12
+SEMI=13
+INTEGER=14
+IDENTIFIER=15
+STRING_LITERAL=16
+LINE_COMMENT=17
+BLOCK_COMMENT=18
+WS=19
+'quixos-lock'=1
+'fragment'=2
+'version'=3
+'quixos'=4
+'source'=5
+'interface'=6
+'package'=7
+'repository'=8
+'commit'=9
+'import'=10
+'{'=11
+'}'=12
+';'=13

src/resource-lock/generated/QuixosLockLexer.ts

@@ -0,0 +1,164 @@
+
+import * as antlr from "antlr4ng";
+import { Token } from "antlr4ng";
+
+
+export class QuixosLockLexer extends antlr.Lexer {
+    public static readonly QUIXOS_LOCK = 1;
+    public static readonly FRAGMENT = 2;
+    public static readonly VERSION = 3;
+    public static readonly QUIXOS = 4;
+    public static readonly SOURCE = 5;
+    public static readonly INTERFACE = 6;
+    public static readonly PACKAGE = 7;
+    public static readonly REPOSITORY = 8;
+    public static readonly COMMIT = 9;
+    public static readonly IMPORT = 10;
+    public static readonly LBRACE = 11;
+    public static readonly RBRACE = 12;
+    public static readonly SEMI = 13;
+    public static readonly INTEGER = 14;
+    public static readonly IDENTIFIER = 15;
+    public static readonly STRING_LITERAL = 16;
+    public static readonly LINE_COMMENT = 17;
+    public static readonly BLOCK_COMMENT = 18;
+    public static readonly WS = 19;
+
+    public static readonly channelNames = [
+        "DEFAULT_TOKEN_CHANNEL", "HIDDEN"
+    ];
+
+    public static readonly literalNames = [
+        null, "'quixos-lock'", "'fragment'", "'version'", "'quixos'", "'source'", 
+        "'interface'", "'package'", "'repository'", "'commit'", "'import'", 
+        "'{'", "'}'", "';'"
+    ];
+
+    public static readonly symbolicNames = [
+        null, "QUIXOS_LOCK", "FRAGMENT", "VERSION", "QUIXOS", "SOURCE", 
+        "INTERFACE", "PACKAGE", "REPOSITORY", "COMMIT", "IMPORT", "LBRACE", 
+        "RBRACE", "SEMI", "INTEGER", "IDENTIFIER", "STRING_LITERAL", "LINE_COMMENT", 
+        "BLOCK_COMMENT", "WS"
+    ];
+
+    public static readonly modeNames = [
+        "DEFAULT_MODE",
+    ];
+
+    public static readonly ruleNames = [
+        "QUIXOS_LOCK", "FRAGMENT", "VERSION", "QUIXOS", "SOURCE", "INTERFACE", 
+        "PACKAGE", "REPOSITORY", "COMMIT", "IMPORT", "LBRACE", "RBRACE", 
+        "SEMI", "INTEGER", "IDENTIFIER", "STRING_LITERAL", "ESC", "HEX", 
+        "LINE_COMMENT", "BLOCK_COMMENT", "WS",
+    ];
+
+
+    public constructor(input: antlr.CharStream) {
+        super(input);
+        this.interpreter = new antlr.LexerATNSimulator(this, QuixosLockLexer._ATN, QuixosLockLexer.decisionsToDFA, new antlr.PredictionContextCache());
+    }
+
+    public get grammarFileName(): string { return "QuixosLock.g4"; }
+
+    public get literalNames(): (string | null)[] { return QuixosLockLexer.literalNames; }
+    public get symbolicNames(): (string | null)[] { return QuixosLockLexer.symbolicNames; }
+    public get ruleNames(): string[] { return QuixosLockLexer.ruleNames; }
+
+    public get serializedATN(): number[] { return QuixosLockLexer._serializedATN; }
+
+    public get channelNames(): string[] { return QuixosLockLexer.channelNames; }
+
+    public get modeNames(): string[] { return QuixosLockLexer.modeNames; }
+
+    public static readonly _serializedATN: number[] = [
+        4,0,19,201,6,-1,2,0,7,0,2,1,7,1,2,2,7,2,2,3,7,3,2,4,7,4,2,5,7,5,
+        2,6,7,6,2,7,7,7,2,8,7,8,2,9,7,9,2,10,7,10,2,11,7,11,2,12,7,12,2,
+        13,7,13,2,14,7,14,2,15,7,15,2,16,7,16,2,17,7,17,2,18,7,18,2,19,7,
+        19,2,20,7,20,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,
+        1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,
+        1,3,1,3,1,3,1,3,1,3,1,3,1,3,1,4,1,4,1,4,1,4,1,4,1,4,1,4,1,5,1,5,
+        1,5,1,5,1,5,1,5,1,5,1,5,1,5,1,5,1,6,1,6,1,6,1,6,1,6,1,6,1,6,1,6,
+        1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,7,1,8,1,8,1,8,1,8,1,8,
+        1,8,1,8,1,9,1,9,1,9,1,9,1,9,1,9,1,9,1,10,1,10,1,11,1,11,1,12,1,12,
+        1,13,4,13,137,8,13,11,13,12,13,138,1,14,1,14,5,14,143,8,14,10,14,
+        12,14,146,9,14,1,15,1,15,1,15,5,15,151,8,15,10,15,12,15,154,9,15,
+        1,15,1,15,1,16,1,16,1,16,1,16,1,16,1,16,1,16,1,16,3,16,166,8,16,
+        1,17,1,17,1,18,1,18,1,18,1,18,5,18,174,8,18,10,18,12,18,177,9,18,
+        1,18,1,18,1,19,1,19,1,19,1,19,5,19,185,8,19,10,19,12,19,188,9,19,
+        1,19,1,19,1,19,1,19,1,19,1,20,4,20,196,8,20,11,20,12,20,197,1,20,
+        1,20,1,186,0,21,1,1,3,2,5,3,7,4,9,5,11,6,13,7,15,8,17,9,19,10,21,
+        11,23,12,25,13,27,14,29,15,31,16,33,0,35,0,37,17,39,18,41,19,1,0,
+        8,1,0,48,57,3,0,65,90,95,95,97,122,4,0,48,57,65,90,95,95,97,122,
+        4,0,10,10,13,13,34,34,92,92,8,0,34,34,47,47,92,92,98,98,102,102,
+        110,110,114,114,116,116,3,0,48,57,65,70,97,102,2,0,10,10,13,13,3,
+        0,9,10,13,13,32,32,206,0,1,1,0,0,0,0,3,1,0,0,0,0,5,1,0,0,0,0,7,1,
+        0,0,0,0,9,1,0,0,0,0,11,1,0,0,0,0,13,1,0,0,0,0,15,1,0,0,0,0,17,1,
+        0,0,0,0,19,1,0,0,0,0,21,1,0,0,0,0,23,1,0,0,0,0,25,1,0,0,0,0,27,1,
+        0,0,0,0,29,1,0,0,0,0,31,1,0,0,0,0,37,1,0,0,0,0,39,1,0,0,0,0,41,1,
+        0,0,0,1,43,1,0,0,0,3,55,1,0,0,0,5,64,1,0,0,0,7,72,1,0,0,0,9,79,1,
+        0,0,0,11,86,1,0,0,0,13,96,1,0,0,0,15,104,1,0,0,0,17,115,1,0,0,0,
+        19,122,1,0,0,0,21,129,1,0,0,0,23,131,1,0,0,0,25,133,1,0,0,0,27,136,
+        1,0,0,0,29,140,1,0,0,0,31,147,1,0,0,0,33,157,1,0,0,0,35,167,1,0,
+        0,0,37,169,1,0,0,0,39,180,1,0,0,0,41,195,1,0,0,0,43,44,5,113,0,0,
+        44,45,5,117,0,0,45,46,5,105,0,0,46,47,5,120,0,0,47,48,5,111,0,0,
+        48,49,5,115,0,0,49,50,5,45,0,0,50,51,5,108,0,0,51,52,5,111,0,0,52,
+        53,5,99,0,0,53,54,5,107,0,0,54,2,1,0,0,0,55,56,5,102,0,0,56,57,5,
+        114,0,0,57,58,5,97,0,0,58,59,5,103,0,0,59,60,5,109,0,0,60,61,5,101,
+        0,0,61,62,5,110,0,0,62,63,5,116,0,0,63,4,1,0,0,0,64,65,5,118,0,0,
+        65,66,5,101,0,0,66,67,5,114,0,0,67,68,5,115,0,0,68,69,5,105,0,0,
+        69,70,5,111,0,0,70,71,5,110,0,0,71,6,1,0,0,0,72,73,5,113,0,0,73,
+        74,5,117,0,0,74,75,5,105,0,0,75,76,5,120,0,0,76,77,5,111,0,0,77,
+        78,5,115,0,0,78,8,1,0,0,0,79,80,5,115,0,0,80,81,5,111,0,0,81,82,
+        5,117,0,0,82,83,5,114,0,0,83,84,5,99,0,0,84,85,5,101,0,0,85,10,1,
+        0,0,0,86,87,5,105,0,0,87,88,5,110,0,0,88,89,5,116,0,0,89,90,5,101,
+        0,0,90,91,5,114,0,0,91,92,5,102,0,0,92,93,5,97,0,0,93,94,5,99,0,
+        0,94,95,5,101,0,0,95,12,1,0,0,0,96,97,5,112,0,0,97,98,5,97,0,0,98,
+        99,5,99,0,0,99,100,5,107,0,0,100,101,5,97,0,0,101,102,5,103,0,0,
+        102,103,5,101,0,0,103,14,1,0,0,0,104,105,5,114,0,0,105,106,5,101,
+        0,0,106,107,5,112,0,0,107,108,5,111,0,0,108,109,5,115,0,0,109,110,
+        5,105,0,0,110,111,5,116,0,0,111,112,5,111,0,0,112,113,5,114,0,0,
+        113,114,5,121,0,0,114,16,1,0,0,0,115,116,5,99,0,0,116,117,5,111,
+        0,0,117,118,5,109,0,0,118,119,5,109,0,0,119,120,5,105,0,0,120,121,
+        5,116,0,0,121,18,1,0,0,0,122,123,5,105,0,0,123,124,5,109,0,0,124,
+        125,5,112,0,0,125,126,5,111,0,0,126,127,5,114,0,0,127,128,5,116,
+        0,0,128,20,1,0,0,0,129,130,5,123,0,0,130,22,1,0,0,0,131,132,5,125,
+        0,0,132,24,1,0,0,0,133,134,5,59,0,0,134,26,1,0,0,0,135,137,7,0,0,
+        0,136,135,1,0,0,0,137,138,1,0,0,0,138,136,1,0,0,0,138,139,1,0,0,
+        0,139,28,1,0,0,0,140,144,7,1,0,0,141,143,7,2,0,0,142,141,1,0,0,0,
+        143,146,1,0,0,0,144,142,1,0,0,0,144,145,1,0,0,0,145,30,1,0,0,0,146,
+        144,1,0,0,0,147,152,5,34,0,0,148,151,3,33,16,0,149,151,8,3,0,0,150,
+        148,1,0,0,0,150,149,1,0,0,0,151,154,1,0,0,0,152,150,1,0,0,0,152,
+        153,1,0,0,0,153,155,1,0,0,0,154,152,1,0,0,0,155,156,5,34,0,0,156,
+        32,1,0,0,0,157,165,5,92,0,0,158,166,7,4,0,0,159,160,5,117,0,0,160,
+        161,3,35,17,0,161,162,3,35,17,0,162,163,3,35,17,0,163,164,3,35,17,
+        0,164,166,1,0,0,0,165,158,1,0,0,0,165,159,1,0,0,0,166,34,1,0,0,0,
+        167,168,7,5,0,0,168,36,1,0,0,0,169,170,5,47,0,0,170,171,5,47,0,0,
+        171,175,1,0,0,0,172,174,8,6,0,0,173,172,1,0,0,0,174,177,1,0,0,0,
+        175,173,1,0,0,0,175,176,1,0,0,0,176,178,1,0,0,0,177,175,1,0,0,0,
+        178,179,6,18,0,0,179,38,1,0,0,0,180,181,5,47,0,0,181,182,5,42,0,
+        0,182,186,1,0,0,0,183,185,9,0,0,0,184,183,1,0,0,0,185,188,1,0,0,
+        0,186,187,1,0,0,0,186,184,1,0,0,0,187,189,1,0,0,0,188,186,1,0,0,
+        0,189,190,5,42,0,0,190,191,5,47,0,0,191,192,1,0,0,0,192,193,6,19,
+        0,0,193,40,1,0,0,0,194,196,7,7,0,0,195,194,1,0,0,0,196,197,1,0,0,
+        0,197,195,1,0,0,0,197,198,1,0,0,0,198,199,1,0,0,0,199,200,6,20,0,
+        0,200,42,1,0,0,0,9,0,138,144,150,152,165,175,186,197,1,6,0,0
+    ];
+
+    private static __ATN: antlr.ATN;
+    public static get _ATN(): antlr.ATN {
+        if (!QuixosLockLexer.__ATN) {
+            QuixosLockLexer.__ATN = new antlr.ATNDeserializer().deserialize(QuixosLockLexer._serializedATN);
+        }
+
+        return QuixosLockLexer.__ATN;
+    }
+
+
+    private static readonly vocabulary = new antlr.Vocabulary(QuixosLockLexer.literalNames, QuixosLockLexer.symbolicNames, []);
+
+    public override get vocabulary(): antlr.Vocabulary {
+        return QuixosLockLexer.vocabulary;
+    }
+
+    private static readonly decisionsToDFA = QuixosLockLexer._ATN.decisionToState.map( (ds: antlr.DecisionState, index: number) => new antlr.DFA(ds, index) );
+}

src/resource-lock/generated/QuixosLockParser.ts

@@ -0,0 +1,642 @@
+
+import * as antlr from "antlr4ng";
+import { Token } from "antlr4ng";
+
+import { QuixosLockVisitor } from "./QuixosLockVisitor.js";
+
+// for running tests with parameters, TODO: discuss strategy for typed parameters in CI
+// eslint-disable-next-line no-unused-vars
+type int = number;
+
+
+export class QuixosLockParser extends antlr.Parser {
+    public static readonly QUIXOS_LOCK = 1;
+    public static readonly FRAGMENT = 2;
+    public static readonly VERSION = 3;
+    public static readonly QUIXOS = 4;
+    public static readonly SOURCE = 5;
+    public static readonly INTERFACE = 6;
+    public static readonly PACKAGE = 7;
+    public static readonly REPOSITORY = 8;
+    public static readonly COMMIT = 9;
+    public static readonly IMPORT = 10;
+    public static readonly LBRACE = 11;
+    public static readonly RBRACE = 12;
+    public static readonly SEMI = 13;
+    public static readonly INTEGER = 14;
+    public static readonly IDENTIFIER = 15;
+    public static readonly STRING_LITERAL = 16;
+    public static readonly LINE_COMMENT = 17;
+    public static readonly BLOCK_COMMENT = 18;
+    public static readonly WS = 19;
+    public static readonly RULE_document = 0;
+    public static readonly RULE_quixosEntry = 1;
+    public static readonly RULE_resourceEntry = 2;
+    public static readonly RULE_importEntry = 3;
+    public static readonly RULE_resourceKind = 4;
+    public static readonly RULE_sourceBlock = 5;
+    public static readonly RULE_identifier = 6;
+    public static readonly RULE_stringLiteral = 7;
+
+    public static readonly literalNames = [
+        null, "'quixos-lock'", "'fragment'", "'version'", "'quixos'", "'source'", 
+        "'interface'", "'package'", "'repository'", "'commit'", "'import'", 
+        "'{'", "'}'", "';'"
+    ];
+
+    public static readonly symbolicNames = [
+        null, "QUIXOS_LOCK", "FRAGMENT", "VERSION", "QUIXOS", "SOURCE", 
+        "INTERFACE", "PACKAGE", "REPOSITORY", "COMMIT", "IMPORT", "LBRACE", 
+        "RBRACE", "SEMI", "INTEGER", "IDENTIFIER", "STRING_LITERAL", "LINE_COMMENT", 
+        "BLOCK_COMMENT", "WS"
+    ];
+    public static readonly ruleNames = [
+        "document", "quixosEntry", "resourceEntry", "importEntry", "resourceKind", 
+        "sourceBlock", "identifier", "stringLiteral",
+    ];
+
+    public get grammarFileName(): string { return "QuixosLock.g4"; }
+    public get literalNames(): (string | null)[] { return QuixosLockParser.literalNames; }
+    public get symbolicNames(): (string | null)[] { return QuixosLockParser.symbolicNames; }
+    public get ruleNames(): string[] { return QuixosLockParser.ruleNames; }
+    public get serializedATN(): number[] { return QuixosLockParser._serializedATN; }
+
+    protected createFailedPredicateException(predicate?: string, message?: string): antlr.FailedPredicateException {
+        return new antlr.FailedPredicateException(this, predicate, message);
+    }
+
+    public constructor(input: antlr.TokenStream) {
+        super(input);
+        this.interpreter = new antlr.ParserATNSimulator(this, QuixosLockParser._ATN, QuixosLockParser.decisionsToDFA, new antlr.PredictionContextCache());
+    }
+    public document(): DocumentContext {
+        let localContext = new DocumentContext(this.context, this.state);
+        this.enterRule(localContext, 0, QuixosLockParser.RULE_document);
+        let _la: number;
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 16;
+            this.match(QuixosLockParser.QUIXOS_LOCK);
+            this.state = 18;
+            this.errorHandler.sync(this);
+            _la = this.tokenStream.LA(1);
+            if (_la === 2) {
+                {
+                this.state = 17;
+                this.match(QuixosLockParser.FRAGMENT);
+                }
+            }
+
+            this.state = 20;
+            this.match(QuixosLockParser.VERSION);
+            this.state = 21;
+            this.match(QuixosLockParser.INTEGER);
+            this.state = 22;
+            this.match(QuixosLockParser.LBRACE);
+            this.state = 28;
+            this.errorHandler.sync(this);
+            _la = this.tokenStream.LA(1);
+            while ((((_la) & ~0x1F) === 0 && ((1 << _la) & 1232) !== 0)) {
+                {
+                this.state = 26;
+                this.errorHandler.sync(this);
+                switch (this.tokenStream.LA(1)) {
+                case QuixosLockParser.QUIXOS:
+                    {
+                    this.state = 23;
+                    this.quixosEntry();
+                    }
+                    break;
+                case QuixosLockParser.IMPORT:
+                    {
+                    this.state = 24;
+                    this.importEntry();
+                    }
+                    break;
+                case QuixosLockParser.INTERFACE:
+                case QuixosLockParser.PACKAGE:
+                    {
+                    this.state = 25;
+                    this.resourceEntry();
+                    }
+                    break;
+                default:
+                    throw new antlr.NoViableAltException(this);
+                }
+                }
+                this.state = 30;
+                this.errorHandler.sync(this);
+                _la = this.tokenStream.LA(1);
+            }
+            this.state = 31;
+            this.match(QuixosLockParser.RBRACE);
+            this.state = 32;
+            this.match(QuixosLockParser.EOF);
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+    public quixosEntry(): QuixosEntryContext {
+        let localContext = new QuixosEntryContext(this.context, this.state);
+        this.enterRule(localContext, 2, QuixosLockParser.RULE_quixosEntry);
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 34;
+            this.match(QuixosLockParser.QUIXOS);
+            this.state = 35;
+            this.match(QuixosLockParser.SOURCE);
+            this.state = 36;
+            this.sourceBlock();
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+    public resourceEntry(): ResourceEntryContext {
+        let localContext = new ResourceEntryContext(this.context, this.state);
+        this.enterRule(localContext, 4, QuixosLockParser.RULE_resourceEntry);
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 38;
+            this.resourceKind();
+            this.state = 39;
+            this.identifier();
+            this.state = 40;
+            this.match(QuixosLockParser.SOURCE);
+            this.state = 41;
+            this.sourceBlock();
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+    public importEntry(): ImportEntryContext {
+        let localContext = new ImportEntryContext(this.context, this.state);
+        this.enterRule(localContext, 6, QuixosLockParser.RULE_importEntry);
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 43;
+            this.match(QuixosLockParser.IMPORT);
+            this.state = 44;
+            this.stringLiteral();
+            this.state = 45;
+            this.match(QuixosLockParser.SEMI);
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+    public resourceKind(): ResourceKindContext {
+        let localContext = new ResourceKindContext(this.context, this.state);
+        this.enterRule(localContext, 8, QuixosLockParser.RULE_resourceKind);
+        let _la: number;
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 47;
+            _la = this.tokenStream.LA(1);
+            if(!(_la === 6 || _la === 7)) {
+            this.errorHandler.recoverInline(this);
+            }
+            else {
+                this.errorHandler.reportMatch(this);
+                this.consume();
+            }
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+    public sourceBlock(): SourceBlockContext {
+        let localContext = new SourceBlockContext(this.context, this.state);
+        this.enterRule(localContext, 10, QuixosLockParser.RULE_sourceBlock);
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 49;
+            this.match(QuixosLockParser.LBRACE);
+            this.state = 50;
+            this.match(QuixosLockParser.REPOSITORY);
+            this.state = 51;
+            this.stringLiteral();
+            this.state = 52;
+            this.match(QuixosLockParser.SEMI);
+            this.state = 53;
+            this.match(QuixosLockParser.COMMIT);
+            this.state = 54;
+            this.stringLiteral();
+            this.state = 55;
+            this.match(QuixosLockParser.SEMI);
+            this.state = 56;
+            this.match(QuixosLockParser.RBRACE);
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+    public identifier(): IdentifierContext {
+        let localContext = new IdentifierContext(this.context, this.state);
+        this.enterRule(localContext, 12, QuixosLockParser.RULE_identifier);
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 58;
+            this.match(QuixosLockParser.IDENTIFIER);
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+    public stringLiteral(): StringLiteralContext {
+        let localContext = new StringLiteralContext(this.context, this.state);
+        this.enterRule(localContext, 14, QuixosLockParser.RULE_stringLiteral);
+        try {
+            this.enterOuterAlt(localContext, 1);
+            {
+            this.state = 60;
+            this.match(QuixosLockParser.STRING_LITERAL);
+            }
+        }
+        catch (re) {
+            if (re instanceof antlr.RecognitionException) {
+                this.errorHandler.reportError(this, re);
+                this.errorHandler.recover(this, re);
+            } else {
+                throw re;
+            }
+        }
+        finally {
+            this.exitRule();
+        }
+        return localContext;
+    }
+
+    public static readonly _serializedATN: number[] = [
+        4,1,19,63,2,0,7,0,2,1,7,1,2,2,7,2,2,3,7,3,2,4,7,4,2,5,7,5,2,6,7,
+        6,2,7,7,7,1,0,1,0,3,0,19,8,0,1,0,1,0,1,0,1,0,1,0,1,0,5,0,27,8,0,
+        10,0,12,0,30,9,0,1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,2,1,2,1,2,1,2,1,2,
+        1,3,1,3,1,3,1,3,1,4,1,4,1,5,1,5,1,5,1,5,1,5,1,5,1,5,1,5,1,5,1,6,
+        1,6,1,7,1,7,1,7,0,0,8,0,2,4,6,8,10,12,14,0,1,1,0,6,7,58,0,16,1,0,
+        0,0,2,34,1,0,0,0,4,38,1,0,0,0,6,43,1,0,0,0,8,47,1,0,0,0,10,49,1,
+        0,0,0,12,58,1,0,0,0,14,60,1,0,0,0,16,18,5,1,0,0,17,19,5,2,0,0,18,
+        17,1,0,0,0,18,19,1,0,0,0,19,20,1,0,0,0,20,21,5,3,0,0,21,22,5,14,
+        0,0,22,28,5,11,0,0,23,27,3,2,1,0,24,27,3,6,3,0,25,27,3,4,2,0,26,
+        23,1,0,0,0,26,24,1,0,0,0,26,25,1,0,0,0,27,30,1,0,0,0,28,26,1,0,0,
+        0,28,29,1,0,0,0,29,31,1,0,0,0,30,28,1,0,0,0,31,32,5,12,0,0,32,33,
+        5,0,0,1,33,1,1,0,0,0,34,35,5,4,0,0,35,36,5,5,0,0,36,37,3,10,5,0,
+        37,3,1,0,0,0,38,39,3,8,4,0,39,40,3,12,6,0,40,41,5,5,0,0,41,42,3,
+        10,5,0,42,5,1,0,0,0,43,44,5,10,0,0,44,45,3,14,7,0,45,46,5,13,0,0,
+        46,7,1,0,0,0,47,48,7,0,0,0,48,9,1,0,0,0,49,50,5,11,0,0,50,51,5,8,
+        0,0,51,52,3,14,7,0,52,53,5,13,0,0,53,54,5,9,0,0,54,55,3,14,7,0,55,
+        56,5,13,0,0,56,57,5,12,0,0,57,11,1,0,0,0,58,59,5,15,0,0,59,13,1,
+        0,0,0,60,61,5,16,0,0,61,15,1,0,0,0,3,18,26,28
+    ];
+
+    private static __ATN: antlr.ATN;
+    public static get _ATN(): antlr.ATN {
+        if (!QuixosLockParser.__ATN) {
+            QuixosLockParser.__ATN = new antlr.ATNDeserializer().deserialize(QuixosLockParser._serializedATN);
+        }
+
+        return QuixosLockParser.__ATN;
+    }
+
+
+    private static readonly vocabulary = new antlr.Vocabulary(QuixosLockParser.literalNames, QuixosLockParser.symbolicNames, []);
+
+    public override get vocabulary(): antlr.Vocabulary {
+        return QuixosLockParser.vocabulary;
+    }
+
+    private static readonly decisionsToDFA = QuixosLockParser._ATN.decisionToState.map( (ds: antlr.DecisionState, index: number) => new antlr.DFA(ds, index) );
+}
+
+export class DocumentContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public QUIXOS_LOCK(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.QUIXOS_LOCK, 0)!;
+    }
+    public VERSION(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.VERSION, 0)!;
+    }
+    public INTEGER(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.INTEGER, 0)!;
+    }
+    public LBRACE(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.LBRACE, 0)!;
+    }
+    public RBRACE(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.RBRACE, 0)!;
+    }
+    public EOF(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.EOF, 0)!;
+    }
+    public FRAGMENT(): antlr.TerminalNode | null {
+        return this.getToken(QuixosLockParser.FRAGMENT, 0);
+    }
+    public quixosEntry(): QuixosEntryContext[];
+    public quixosEntry(i: number): QuixosEntryContext | null;
+    public quixosEntry(i?: number): QuixosEntryContext[] | QuixosEntryContext | null {
+        if (i === undefined) {
+            return this.getRuleContexts(QuixosEntryContext);
+        }
+
+        return this.getRuleContext(i, QuixosEntryContext);
+    }
+    public importEntry(): ImportEntryContext[];
+    public importEntry(i: number): ImportEntryContext | null;
+    public importEntry(i?: number): ImportEntryContext[] | ImportEntryContext | null {
+        if (i === undefined) {
+            return this.getRuleContexts(ImportEntryContext);
+        }
+
+        return this.getRuleContext(i, ImportEntryContext);
+    }
+    public resourceEntry(): ResourceEntryContext[];
+    public resourceEntry(i: number): ResourceEntryContext | null;
+    public resourceEntry(i?: number): ResourceEntryContext[] | ResourceEntryContext | null {
+        if (i === undefined) {
+            return this.getRuleContexts(ResourceEntryContext);
+        }
+
+        return this.getRuleContext(i, ResourceEntryContext);
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_document;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitDocument) {
+            return visitor.visitDocument(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}
+
+
+export class QuixosEntryContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public QUIXOS(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.QUIXOS, 0)!;
+    }
+    public SOURCE(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.SOURCE, 0)!;
+    }
+    public sourceBlock(): SourceBlockContext {
+        return this.getRuleContext(0, SourceBlockContext)!;
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_quixosEntry;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitQuixosEntry) {
+            return visitor.visitQuixosEntry(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}
+
+
+export class ResourceEntryContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public resourceKind(): ResourceKindContext {
+        return this.getRuleContext(0, ResourceKindContext)!;
+    }
+    public identifier(): IdentifierContext {
+        return this.getRuleContext(0, IdentifierContext)!;
+    }
+    public SOURCE(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.SOURCE, 0)!;
+    }
+    public sourceBlock(): SourceBlockContext {
+        return this.getRuleContext(0, SourceBlockContext)!;
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_resourceEntry;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitResourceEntry) {
+            return visitor.visitResourceEntry(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}
+
+
+export class ImportEntryContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public IMPORT(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.IMPORT, 0)!;
+    }
+    public stringLiteral(): StringLiteralContext {
+        return this.getRuleContext(0, StringLiteralContext)!;
+    }
+    public SEMI(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.SEMI, 0)!;
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_importEntry;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitImportEntry) {
+            return visitor.visitImportEntry(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}
+
+
+export class ResourceKindContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public INTERFACE(): antlr.TerminalNode | null {
+        return this.getToken(QuixosLockParser.INTERFACE, 0);
+    }
+    public PACKAGE(): antlr.TerminalNode | null {
+        return this.getToken(QuixosLockParser.PACKAGE, 0);
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_resourceKind;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitResourceKind) {
+            return visitor.visitResourceKind(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}
+
+
+export class SourceBlockContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public LBRACE(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.LBRACE, 0)!;
+    }
+    public REPOSITORY(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.REPOSITORY, 0)!;
+    }
+    public stringLiteral(): StringLiteralContext[];
+    public stringLiteral(i: number): StringLiteralContext | null;
+    public stringLiteral(i?: number): StringLiteralContext[] | StringLiteralContext | null {
+        if (i === undefined) {
+            return this.getRuleContexts(StringLiteralContext);
+        }
+
+        return this.getRuleContext(i, StringLiteralContext);
+    }
+    public SEMI(): antlr.TerminalNode[];
+    public SEMI(i: number): antlr.TerminalNode | null;
+    public SEMI(i?: number): antlr.TerminalNode | null | antlr.TerminalNode[] {
+    	if (i === undefined) {
+    		return this.getTokens(QuixosLockParser.SEMI);
+    	} else {
+    		return this.getToken(QuixosLockParser.SEMI, i);
+    	}
+    }
+    public COMMIT(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.COMMIT, 0)!;
+    }
+    public RBRACE(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.RBRACE, 0)!;
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_sourceBlock;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitSourceBlock) {
+            return visitor.visitSourceBlock(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}
+
+
+export class IdentifierContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public IDENTIFIER(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.IDENTIFIER, 0)!;
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_identifier;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitIdentifier) {
+            return visitor.visitIdentifier(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}
+
+
+export class StringLiteralContext extends antlr.ParserRuleContext {
+    public constructor(parent: antlr.ParserRuleContext | null, invokingState: number) {
+        super(parent, invokingState);
+    }
+    public STRING_LITERAL(): antlr.TerminalNode {
+        return this.getToken(QuixosLockParser.STRING_LITERAL, 0)!;
+    }
+    public override get ruleIndex(): number {
+        return QuixosLockParser.RULE_stringLiteral;
+    }
+    public override accept<Result>(visitor: QuixosLockVisitor<Result>): Result | null {
+        if (visitor.visitStringLiteral) {
+            return visitor.visitStringLiteral(this);
+        } else {
+            return visitor.visitChildren(this);
+        }
+    }
+}

src/resource-lock/generated/QuixosLockVisitor.ts

@@ -0,0 +1,72 @@
+
+import { AbstractParseTreeVisitor } from "antlr4ng";
+
+
+import { DocumentContext } from "./QuixosLockParser.js";
+import { QuixosEntryContext } from "./QuixosLockParser.js";
+import { ResourceEntryContext } from "./QuixosLockParser.js";
+import { ImportEntryContext } from "./QuixosLockParser.js";
+import { ResourceKindContext } from "./QuixosLockParser.js";
+import { SourceBlockContext } from "./QuixosLockParser.js";
+import { IdentifierContext } from "./QuixosLockParser.js";
+import { StringLiteralContext } from "./QuixosLockParser.js";
+
+
+/**
+ * This interface defines a complete generic visitor for a parse tree produced
+ * by `QuixosLockParser`.
+ *
+ * @param <Result> The return type of the visit operation. Use `void` for
+ * operations with no return type.
+ */
+export class QuixosLockVisitor<Result> extends AbstractParseTreeVisitor<Result> {
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.document`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitDocument?: (ctx: DocumentContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.quixosEntry`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitQuixosEntry?: (ctx: QuixosEntryContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.resourceEntry`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitResourceEntry?: (ctx: ResourceEntryContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.importEntry`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitImportEntry?: (ctx: ImportEntryContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.resourceKind`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitResourceKind?: (ctx: ResourceKindContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.sourceBlock`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitSourceBlock?: (ctx: SourceBlockContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.identifier`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitIdentifier?: (ctx: IdentifierContext) => Result;
+    /**
+     * Visit a parse tree produced by `QuixosLockParser.stringLiteral`.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    visitStringLiteral?: (ctx: StringLiteralContext) => Result;
+}
+

src/resource-lock/index.ts

@@ -0,0 +1,3 @@
+export * from "./loader.js";
+export * from "./parser.js";
+export * from "./types.js";

src/resource-lock/loader.ts

@@ -0,0 +1,150 @@
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import {
+  parseQuixosLockDocument,
+  type QuixosLockDiagnostic,
+  type QuixosLockParseResult,
+} from "./parser.js";
+import type {
+  LockedResource,
+  QuixosLockDocument,
+  QuixosRepositoryLock,
+} from "./types.js";
+
+export type QuixosLockSourceReader = (relativePath: string) => Promise<string>;
+
+const diagnostic = (
+  code: string,
+  message: string,
+  fileName: string,
+  path?: string,
+): QuixosLockDiagnostic => ({
+  phase: "resolution",
+  code,
+  message,
+  fileName,
+  line: 1,
+  column: 0,
+  path,
+});
+
+export const resolveQuixosLock = async (
+  rootSource: string,
+  readSource: QuixosLockSourceReader,
+  rootFileName = "quixos.lock",
+): Promise<QuixosLockParseResult> => {
+  const root = parseQuixosLockDocument(rootSource, rootFileName);
+  if (!root.ok) return root;
+  if (root.document.kind !== "root") {
+    return {
+      ok: false,
+      diagnostics: [diagnostic(
+        "expected-root-lock",
+        "The entrypoint must be a root Quixos lock, not a fragment",
+        rootFileName,
+      )],
+    };
+  }
+
+  const diagnostics: QuixosLockDiagnostic[] = [];
+  const resources: LockedResource[] = [];
+  const sourceFiles = [rootFileName];
+  const visited = new Set<string>();
+  const active: string[] = [];
+
+  const addResources = (document: QuixosLockDocument, fileName: string) => {
+    for (const resource of document.resources) {
+      const duplicate = resources.find((entry) =>
+        entry.kind === resource.kind && entry.binding === resource.binding);
+      if (duplicate) {
+        diagnostics.push(diagnostic(
+          "duplicate-resource-binding",
+          `Duplicate ${resource.kind} binding ${resource.binding} across imported lock files`,
+          fileName,
+          `${resource.kind}.${resource.binding}`,
+        ));
+      } else {
+        resources.push(resource);
+      }
+    }
+  };
+
+  const visit = async (importPath: string) => {
+    if (active.includes(importPath)) {
+      diagnostics.push(diagnostic(
+        "import-cycle",
+        `Lock import cycle: ${[...active, importPath].join(" -> ")}`,
+        importPath,
+      ));
+      return;
+    }
+    if (visited.has(importPath)) return;
+    active.push(importPath);
+    let source: string;
+    try {
+      source = await readSource(importPath);
+    } catch (cause) {
+      diagnostics.push(diagnostic(
+        "import-read-failed",
+        `Could not read lock import ${importPath}: ${cause instanceof Error ? cause.message : String(cause)}`,
+        importPath,
+      ));
+      active.pop();
+      return;
+    }
+    const parsed = parseQuixosLockDocument(source, importPath);
+    if (!parsed.ok) {
+      diagnostics.push(...parsed.diagnostics);
+      active.pop();
+      return;
+    }
+    if (parsed.document.kind !== "fragment") {
+      diagnostics.push(diagnostic(
+        "imported-root-lock",
+        `Imported file ${importPath} must begin with "quixos-lock fragment"`,
+        importPath,
+      ));
+      active.pop();
+      return;
+    }
+    visited.add(importPath);
+    sourceFiles.push(importPath);
+    addResources(parsed.document, importPath);
+    for (const nested of parsed.document.imports) await visit(nested);
+    active.pop();
+  };
+
+  addResources(root.document, rootFileName);
+  for (const importPath of root.document.imports) await visit(importPath);
+  if (diagnostics.length) return { ok: false, diagnostics };
+  const lock: QuixosRepositoryLock = {
+    formatVersion: 1,
+    quixos: root.document.quixos,
+    resources,
+    sourceFiles,
+  };
+  return { ok: true, lock, diagnostics: [] };
+};
+
+export const loadQuixosLock = async (fileName: string): Promise<QuixosLockParseResult> => {
+  const absoluteRoot = path.resolve(fileName);
+  const repositoryRoot = path.dirname(absoluteRoot);
+  const rootName = path.basename(absoluteRoot);
+  const rootSource = await readFile(absoluteRoot, "utf8");
+  return await resolveQuixosLock(rootSource, async (relativePath) => {
+    let absoluteImport = repositoryRoot;
+    const segments = relativePath.split("/");
+    for (const [index, segment] of segments.entries()) {
+      absoluteImport = path.join(absoluteImport, segment);
+      const metadata = await lstat(absoluteImport);
+      if (metadata.isSymbolicLink()) {
+        throw new Error("imports must not traverse symbolic links");
+      }
+      const final = index === segments.length - 1;
+      if ((!final && !metadata.isDirectory()) || (final && !metadata.isFile())) {
+        throw new Error("imports must be ordinary files beneath ordinary directories");
+      }
+    }
+    return await readFile(absoluteImport, "utf8");
+  }, rootName);
+};

src/resource-lock/parser.ts

@@ -0,0 +1,381 @@
+import {
+  BaseErrorListener,
+  CharStream,
+  CommonTokenStream,
+  type ATNSimulator,
+  type RecognitionException,
+  type Recognizer,
+  type Token,
+} from "antlr4ng";
+import { QuixosLockLexer } from "./generated/QuixosLockLexer.js";
+import {
+  QuixosLockParser,
+  type SourceBlockContext,
+} from "./generated/QuixosLockParser.js";
+import type {
+  GitSource,
+  LockedResource,
+  QuixosLockDocument,
+  QuixosRepositoryLock,
+} from "./types.js";
+
+export type QuixosLockDiagnostic = {
+  phase: "syntax" | "validation" | "resolution";
+  code: string;
+  message: string;
+  fileName: string;
+  line: number;
+  column: number;
+  path?: string;
+};
+
+export type QuixosLockParseResult =
+  | { ok: true; lock: QuixosRepositoryLock; diagnostics: [] }
+  | { ok: false; diagnostics: QuixosLockDiagnostic[] };
+
+export type QuixosLockDocumentParseResult =
+  | { ok: true; document: QuixosLockDocument; diagnostics: [] }
+  | { ok: false; diagnostics: QuixosLockDiagnostic[] };
+
+class SyntaxErrorListener extends BaseErrorListener {
+  constructor(
+    private readonly fileName: string,
+    private readonly diagnostics: QuixosLockDiagnostic[],
+  ) {
+    super();
+  }
+
+  override syntaxError<S extends Token, T extends ATNSimulator>(
+    _recognizer: Recognizer<T>,
+    _offendingSymbol: S | null,
+    line: number,
+    column: number,
+    message: string,
+    _error: RecognitionException | null,
+  ): void {
+    this.diagnostics.push({
+      phase: "syntax",
+      code: "syntax-error",
+      message,
+      fileName: this.fileName,
+      line,
+      column,
+    });
+  }
+}
+
+const stringValue = (context: { getText(): string }): string =>
+  JSON.parse(context.getText()) as string;
+
+const lowerSource = (context: SourceBlockContext): GitSource => ({
+  resolver: "git",
+  repository: stringValue(context.stringLiteral(0)!),
+  commit: stringValue(context.stringLiteral(1)!).toLowerCase(),
+});
+
+const issue = (
+  diagnostics: QuixosLockDiagnostic[],
+  fileName: string,
+  code: string,
+  message: string,
+  path?: string,
+  line = 1,
+  column = 0,
+) => diagnostics.push({
+  phase: "validation",
+  code,
+  message,
+  fileName,
+  line,
+  column,
+  path,
+});
+
+const validateImport = (
+  importPath: string,
+  index: number,
+  fileName: string,
+  diagnostics: QuixosLockDiagnostic[],
+  line: number,
+  column: number,
+) => {
+  const path = `imports[${index}]`;
+  if (
+    !importPath
+    || importPath.startsWith("/")
+    || importPath.includes("\\")
+    || importPath.split("/").some((segment) => !segment || segment === "." || segment === "..")
+    || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(importPath)
+  ) {
+    issue(
+      diagnostics,
+      fileName,
+      "invalid-import-path",
+      `${path} must be a normalized relative path beneath the workspace repository root`,
+      path,
+      line,
+      column,
+    );
+  }
+};
+
+const validateSource = (
+  source: GitSource,
+  path: string,
+  fileName: string,
+  diagnostics: QuixosLockDiagnostic[],
+) => {
+  if (!/^([0-9a-f]{40}|[0-9a-f]{64})$/.test(source.commit)) {
+    issue(
+      diagnostics,
+      fileName,
+      "invalid-git-commit",
+      `${path}.commit must be a full 40- or 64-character Git object ID`,
+      `${path}.commit`,
+    );
+  }
+  let repository: URL;
+  try {
+    repository = new URL(source.repository);
+  } catch {
+    issue(
+      diagnostics,
+      fileName,
+      "invalid-git-repository",
+      `${path}.repository must be an absolute Git URL`,
+      `${path}.repository`,
+    );
+    return;
+  }
+  if (!["https:", "ssh:"].includes(repository.protocol)) {
+    issue(
+      diagnostics,
+      fileName,
+      "unsupported-git-transport",
+      `${path}.repository must use https:// or ssh://`,
+      `${path}.repository`,
+    );
+  }
+  if (repository.search || repository.hash) {
+    issue(
+      diagnostics,
+      fileName,
+      "decorated-git-repository",
+      `${path}.repository must be a base repository URL without a query or fragment`,
+      `${path}.repository`,
+    );
+  }
+  if (repository.password || (repository.protocol === "https:" && repository.username)) {
+    issue(
+      diagnostics,
+      fileName,
+      "embedded-git-credential",
+      `${path}.repository must not embed credentials`,
+      `${path}.repository`,
+    );
+  }
+};
+
+export const parseQuixosLockDocument = (
+  source: string,
+  fileName = "<memory>",
+): QuixosLockDocumentParseResult => {
+  const diagnostics: QuixosLockDiagnostic[] = [];
+  const listener = new SyntaxErrorListener(fileName, diagnostics);
+  const lexer = new QuixosLockLexer(CharStream.fromString(source));
+  lexer.removeErrorListeners();
+  lexer.addErrorListener(listener);
+  const parser = new QuixosLockParser(new CommonTokenStream(lexer));
+  parser.removeErrorListeners();
+  parser.addErrorListener(listener);
+  const tree = parser.document();
+  if (diagnostics.length > 0) return { ok: false, diagnostics };
+
+  const formatVersion = Number.parseInt(tree.INTEGER().getText(), 10);
+  if (formatVersion !== 1) {
+    issue(
+      diagnostics,
+      fileName,
+      "unsupported-lock-version",
+      `Unsupported Quixos lock format version ${formatVersion}`,
+      "formatVersion",
+    );
+  }
+
+  const fragment = Boolean(tree.FRAGMENT());
+  const quixosEntries = tree.quixosEntry();
+  let quixos: GitSource | undefined;
+  if (fragment && quixosEntries.length) {
+    issue(
+      diagnostics,
+      fileName,
+      "fragment-has-quixos-source",
+      "A lock fragment inherits the root document's Quixos source and must not redeclare it",
+      "quixos",
+    );
+  } else if (!fragment && quixosEntries.length !== 1) {
+    issue(
+      diagnostics,
+      fileName,
+      "root-quixos-source-count",
+      "A root lock document must contain exactly one Quixos source",
+      "quixos",
+    );
+  } else if (!fragment) {
+    quixos = lowerSource(quixosEntries[0]!.sourceBlock());
+    validateSource(quixos, "quixos", fileName, diagnostics);
+  }
+
+  const imports = tree.importEntry().map((context, index) => {
+    const importPath = stringValue(context.stringLiteral());
+    validateImport(
+      importPath,
+      index,
+      fileName,
+      diagnostics,
+      context.start?.line ?? 1,
+      context.start?.column ?? 0,
+    );
+    return importPath;
+  });
+  const repeatedImports = new Set<string>();
+  imports.forEach((importPath, index) => {
+    if (repeatedImports.has(importPath)) {
+      issue(
+        diagnostics,
+        fileName,
+        "duplicate-import",
+        `Duplicate lock import ${importPath}`,
+        `imports[${index}]`,
+      );
+    }
+    repeatedImports.add(importPath);
+  });
+
+  const resources: LockedResource[] = [];
+  const bindings = new Set<string>();
+  for (const [index, context] of tree.resourceEntry().entries()) {
+    const kind = context.resourceKind().INTERFACE() ? "interface" : "package";
+    const binding = context.identifier().getText();
+    const key = `${kind}\0${binding}`;
+    if (bindings.has(key)) {
+      issue(
+        diagnostics,
+        fileName,
+        "duplicate-resource-binding",
+        `Duplicate ${kind} binding ${binding}`,
+        `resources[${index}].binding`,
+      );
+    }
+    bindings.add(key);
+    const resource = { kind, binding, source: lowerSource(context.sourceBlock()) } as LockedResource;
+    validateSource(resource.source, `resources[${index}].source`, fileName, diagnostics);
+    resources.push(resource);
+  }
+
+  return diagnostics.length > 0
+    ? { ok: false, diagnostics }
+    : {
+        ok: true,
+        document: fragment
+          ? { kind: "fragment", formatVersion: 1, imports, resources }
+          : { kind: "root", formatVersion: 1, quixos: quixos!, imports, resources },
+        diagnostics: [],
+      };
+};
+
+export const parseQuixosLock = (
+  source: string,
+  fileName = "<memory>",
+): QuixosLockParseResult => {
+  const parsed = parseQuixosLockDocument(source, fileName);
+  if (!parsed.ok) return parsed;
+  if (parsed.document.kind === "fragment") {
+    return {
+      ok: false,
+      diagnostics: [{
+        phase: "validation",
+        code: "expected-root-lock",
+        message: "Expected a root Quixos lock, found a lock fragment",
+        fileName,
+        line: 1,
+        column: 0,
+      }],
+    };
+  }
+  if (parsed.document.imports.length) {
+    return {
+      ok: false,
+      diagnostics: [{
+        phase: "resolution",
+        code: "imports-require-file-resolution",
+        message: "This lock has imports and must be loaded from its repository rather than parsed as an isolated string",
+        fileName,
+        line: 1,
+        column: 0,
+      }],
+    };
+  }
+  return {
+    ok: true,
+    lock: {
+      formatVersion: 1,
+      quixos: parsed.document.quixos,
+      resources: parsed.document.resources,
+    },
+    diagnostics: [],
+  };
+};
+
+const quoted = (value: string) => JSON.stringify(value);
+
+const sourceLines = (source: GitSource, indentation: string): string[] => [
+  `${indentation}repository ${quoted(source.repository)};`,
+  `${indentation}commit ${quoted(source.commit.toLowerCase())};`,
+];
+
+export const formatQuixosLock = (lock: QuixosRepositoryLock): string => {
+  const lines = [
+    "quixos-lock version 1 {",
+    "  quixos source {",
+    ...sourceLines(lock.quixos, "    "),
+    "  }",
+  ];
+  for (const resource of lock.resources) {
+    lines.push(
+      "",
+      `  ${resource.kind} ${resource.binding} source {`,
+      ...sourceLines(resource.source, "    "),
+      "  }",
+    );
+  }
+  lines.push("}", "");
+  return lines.join("\n");
+};
+
+export const formatQuixosLockDocument = (document: QuixosLockDocument): string => {
+  const lines = [
+    `quixos-lock${document.kind === "fragment" ? " fragment" : ""} version 1 {`,
+  ];
+  if (document.kind === "root") {
+    lines.push(
+      "  quixos source {",
+      ...sourceLines(document.quixos, "    "),
+      "  }",
+    );
+  }
+  for (const importPath of document.imports) {
+    if (lines.length > 1) lines.push("");
+    lines.push(`  import ${quoted(importPath)};`);
+  }
+  for (const resource of document.resources) {
+    if (lines.length > 1) lines.push("");
+    lines.push(
+      `  ${resource.kind} ${resource.binding} source {`,
+      ...sourceLines(resource.source, "    "),
+      "  }",
+    );
+  }
+  lines.push("}", "");
+  return lines.join("\n");
+};

src/resource-lock/types.ts

@@ -0,0 +1,58 @@
+export type GitSource = {
+  resolver: "git";
+  repository: string;
+  commit: string;
+};
+
+export type LockedResourceKind = "interface" | "package";
+
+export type LockedResource = {
+  kind: LockedResourceKind;
+  binding: string;
+  source: GitSource;
+};
+
+export type QuixosLockRootDocument = {
+  kind: "root";
+  formatVersion: 1;
+  quixos: GitSource;
+  imports: string[];
+  resources: LockedResource[];
+};
+
+export type QuixosLockFragmentDocument = {
+  kind: "fragment";
+  formatVersion: 1;
+  imports: string[];
+  resources: LockedResource[];
+};
+
+export type QuixosLockDocument =
+  | QuixosLockRootDocument
+  | QuixosLockFragmentDocument;
+
+export type QuixosRepositoryLock = {
+  formatVersion: 1;
+  quixos: GitSource;
+  resources: LockedResource[];
+  sourceFiles?: string[];
+};
+
+export type NixGitInput = {
+  type: "git";
+  url: string;
+  ref: string;
+  rev: string;
+};
+
+export const RETENTION_TAG_PREFIX = "refs/tags/quixos-reachability/";
+
+export const retentionTagForCommit = (commit: string): string =>
+  `${RETENTION_TAG_PREFIX}${commit.toLowerCase()}`;
+
+export const nixGitInput = (source: GitSource): NixGitInput => ({
+  type: "git",
+  url: source.repository,
+  ref: retentionTagForCommit(source.commit),
+  rev: source.commit.toLowerCase(),
+});

test/capability-assembly.test.ts

@@ -0,0 +1,156 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  compileCapabilityResourceRepository,
+  compileWorkspaceRepository,
+} from "../src/capability-language/index.js";
+
+const quixosCommit = "1".repeat(40);
+const namedCommit = "2".repeat(40);
+const packageCommit = "3".repeat(40);
+
+const lock = (resources = "") => `quixos-lock version 1 {
+  quixos source {
+    repository "https://example.test/quixos.git";
+    commit "${quixosCommit}";
+  }
+  ${resources}
+}
+`;
+
+test("workspace assembly resolves resource-owned dependencies recursively", async (context) => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "quixos-assembly-"));
+  context.after(() => rm(directory, { recursive: true, force: true }));
+  const root = path.join(directory, "root");
+  const named = path.join(directory, "named");
+  const runtime = path.join(directory, "runtime");
+  await Promise.all([mkdir(root), mkdir(named), mkdir(runtime)]);
+  await writeFile(path.join(root, "quixos.lock"), lock(`package Runtime source {
+    repository "https://example.test/package-runtime.git";
+    commit "${packageCommit}";
+  }`));
+  await writeFile(path.join(root, "workspace.qx"), `workspace Test id "workspace:test" revision "workspace:test@1" commit "${"4".repeat(40)}" {
+    atom Subject id "atom:subject";
+    import package Runtime;
+  }
+`);
+  await writeFile(path.join(named, "quixos.lock"), lock());
+  await writeFile(path.join(named, "interface.qx"), `interface Named id "interface:named" revision "interface:named@1" {
+    value name id "member:named:name" : string {
+      get id "operation:named:name:get";
+    }
+  }
+`);
+  await writeFile(path.join(runtime, "quixos.lock"), lock(`interface Named source {
+    repository "https://example.test/interface-named.git";
+    commit "${namedCommit}";
+  }`));
+  await writeFile(path.join(runtime, "package.qx"), `import interface Named;
+package Runtime id "package:runtime" revision "package:runtime@1" {
+  function describe id "export:runtime:describe" : interface-ref<Named> -> string;
+}
+`);
+
+  const directories = new Map([
+    [`interface\0https://example.test/interface-named.git\0${namedCommit}`, named],
+    [`package\0https://example.test/package-runtime.git\0${packageCommit}`, runtime],
+  ]);
+  const result = await compileWorkspaceRepository({
+    rootDirectory: root,
+    resolveResource: async (source, kind) => {
+      const resolved = directories.get(`${kind}\0${source.repository}\0${source.commit}`);
+      if (!resolved) throw new Error(`Unexpected source ${source.repository}`);
+      return { directory: resolved };
+    },
+  });
+
+  assert.equal(result.resources.length, 2);
+  assert.deepEqual(
+    result.workspace.interfaceImports.map((entry) => entry.revisionId),
+    ["interface:named@1"],
+  );
+  assert.deepEqual(
+    result.workspace.packageImports.map((entry) => entry.revisionId),
+    ["package:runtime@1"],
+  );
+  assert.equal(result.directResources.size, 1);
+
+  const resource = await compileCapabilityResourceRepository({
+    rootDirectory: runtime,
+    kind: "package",
+    source: {
+      resolver: "git",
+      repository: "https://example.test/package-runtime.git",
+      commit: packageCommit,
+    },
+    resolveResource: async (source, kind) => {
+      const resolved = directories.get(`${kind}\0${source.repository}\0${source.commit}`);
+      if (!resolved) throw new Error(`Unexpected source ${source.repository}`);
+      return { directory: resolved };
+    },
+  });
+  assert.equal(resource.resource.kind, "package");
+  assert.equal(resource.resources.length, 2);
+  assert.equal(resource.directResources.size, 1);
+});
+
+test("resource manifests cannot hide lock dependencies", async (context) => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "quixos-assembly-mismatch-"));
+  context.after(() => rm(directory, { recursive: true, force: true }));
+  const root = path.join(directory, "root");
+  const runtime = path.join(directory, "runtime");
+  await Promise.all([mkdir(root), mkdir(runtime)]);
+  await writeFile(path.join(root, "quixos.lock"), lock(`package Runtime source {
+    repository "https://example.test/package-runtime.git";
+    commit "${packageCommit}";
+  }`));
+  await writeFile(path.join(root, "workspace.qx"), `workspace Test id "workspace:test" revision "workspace:test@1" commit "${"4".repeat(40)}" {
+    atom Subject id "atom:subject";
+    import package Runtime;
+  }
+`);
+  await writeFile(path.join(runtime, "quixos.lock"), lock());
+  await writeFile(path.join(runtime, "package.qx"), `import interface Hidden;
+package Runtime id "package:runtime" revision "package:runtime@1" { }
+`);
+
+  await assert.rejects(
+    compileWorkspaceRepository({
+      rootDirectory: root,
+      resolveResource: async () => ({ directory: runtime }),
+    }),
+    /No resolved interface is available for lock binding Hidden/,
+  );
+});
+
+test("workspace assembly must satisfy nominal external interfaces", async (context) => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "quixos-assembly-external-"));
+  context.after(() => rm(directory, { recursive: true, force: true }));
+  const root = path.join(directory, "root");
+  const runtime = path.join(directory, "runtime");
+  await Promise.all([mkdir(root), mkdir(runtime)]);
+  await writeFile(path.join(root, "quixos.lock"), lock(`package Runtime source {
+    repository "https://example.test/package-runtime.git";
+    commit "${packageCommit}";
+  }`));
+  await writeFile(path.join(root, "workspace.qx"), `workspace Test id "workspace:test" revision "workspace:test@1" commit "${"4".repeat(40)}" {
+    atom Subject id "atom:subject";
+    import package Runtime;
+  }
+`);
+  await writeFile(path.join(runtime, "quixos.lock"), lock());
+  await writeFile(path.join(runtime, "package.qx"), `external interface Named revision "interface:named@1";
+package Runtime id "package:runtime" revision "package:runtime@1" { }
+`);
+
+  await assert.rejects(
+    compileWorkspaceRepository({
+      rootDirectory: root,
+      resolveResource: async () => ({ directory: runtime }),
+    }),
+    /requires external interface Named \(interface:named@1\)/,
+  );
+});

test/capability-language.test.ts

@@ -0,0 +1,291 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { test } from "node:test";
+import {
+  compileCapabilityResourceSource,
+  compileCapabilitySource,
+} from "../src/capability-language/index.js";
+import {
+  capabilityFixtureSource,
+  capabilityResourceSources,
+  compileCapabilityFixture,
+  fixtureId,
+} from "./fixtures/capability-model.js";
+
+const compileWebStudioFixture = (packageTransform = (source: string) => source) => {
+  const fixture = (name: string) => readFileSync(
+    resolve(process.cwd(), "test/fixtures", name),
+    "utf8",
+  );
+  const react = compileCapabilityResourceSource(
+    fixture("react-component.interface.qx"),
+    {
+      source: {
+        repository: "https://repos.quixos.org/org-quixos-web-studio/interface-react-component.git",
+        commit: "2".repeat(40),
+      },
+    },
+  );
+  if (!react.ok || react.resource.kind !== "interface") {
+    throw new Error("ReactComponent fixture did not compile");
+  }
+  const named = compileCapabilityResourceSource(
+    fixture("named.interface.qx"),
+    {
+      source: {
+        repository: "https://repos.quixos.org/quixos-test/interface-named.git",
+        commit: "5".repeat(40),
+      },
+    },
+  );
+  if (!named.ok || named.resource.kind !== "interface") {
+    throw new Error("Named fixture did not compile");
+  }
+  const has = compileCapabilityResourceSource(
+    fixture("has-react-component.interface.qx"),
+    {
+      source: {
+        repository: "https://repos.quixos.org/org-quixos-web-studio/interface-has-react-component.git",
+        commit: "3".repeat(40),
+      },
+      environment: {
+        interfaces: new Map([["ReactComponent", react.resource.revision]]),
+        interfaceClosure: [react.resource.revision],
+      },
+    },
+  );
+  if (!has.ok || has.resource.kind !== "interface") {
+    throw new Error("HasReactComponent fixture did not compile");
+  }
+  const component = compileCapabilityResourceSource(
+    packageTransform(fixture("component-runtime.package.qx")),
+    {
+      source: {
+        repository: "https://repos.quixos.org/quixos-test/package-component-runtime.git",
+        commit: "4".repeat(40),
+      },
+      environment: {
+        interfaces: new Map([["Named", named.resource.revision]]),
+        interfaceClosure: [named.resource.revision],
+      },
+    },
+  );
+  if (!component.ok || component.resource.kind !== "package") {
+    throw new Error("ComponentRuntime fixture did not compile");
+  }
+  return compileCapabilitySource(
+    fixture("web-studio.capabilities.qx"),
+    "web-studio.capabilities.qx",
+    {
+      interfaces: new Map([
+        ["Named", named.resource.revision],
+        ["ReactComponent", react.resource.revision],
+        ["HasReactComponent", has.resource.revision],
+      ]),
+      packages: new Map([["ComponentRuntime", component.resource.revision]]),
+      interfaceClosure: [named.resource.revision, react.resource.revision, has.resource.revision],
+      packageClosure: [component.resource.revision],
+    },
+  );
+};
+
+test("ANTLR parses and validates a complete capability workspace", () => {
+  const result = compileCapabilityFixture();
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  assert.equal(result.workspace.workspaceId, fixtureId.workspace);
+  assert.equal(result.workspace.id, fixtureId.workspaceRevision);
+  assert.equal(result.workspace.interfaceImports.length, 3);
+  assert.equal(result.workspace.conformances.length, 4);
+  assert.equal("id" in result.workspace.conformances[0]!, false);
+});
+
+test("conformances do not accept authored IDs", () => {
+  const result = compileCapabilityFixture({
+    workspace: capabilityFixtureSource.replace(
+      "conform Project as Named {",
+      'conform Project as Named id "conformance:project:named" {',
+    ),
+  });
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) => entry.phase === "syntax"));
+});
+
+test("the v1 language has no implicit relationship materialization rule", () => {
+  const result = compileCapabilityFixture({
+    workspace: capabilityFixtureSource.replace(
+      /\n}\s*$/,
+      '\n  materialize ProjectOwner.owner if absent with Person;\n}\n',
+    ),
+  });
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) => entry.phase === "syntax"));
+});
+
+test("forward declarations make source order irrelevant", () => {
+  const source = capabilityFixtureSource
+    .replace(/  atom Project[^\n]*\n/, "")
+    .replace(/  atom Person[^\n]*\n/, "")
+    .replace(
+      /\n}\s*$/,
+      '\n  atom Project id "atom:project";\n  atom Person id "atom:person";\n}\n',
+    );
+  assert.equal(compileCapabilityFixture({ workspace: source }).ok, true);
+});
+
+test("interfaces can declare ordinary call operations", () => {
+  const workspace = capabilityFixtureSource.replace(
+    "bind summary.get to package TodoRuntime.summaryGet",
+    "bind summarize.call to package TodoRuntime.summaryGet",
+  );
+  const summary = capabilityResourceSources.summary.replace(
+    "  value summary id \"member:summary:summary\" : string {\n    get id \"operation:summary:summary:get\";\n  }",
+    "  operation summarize id \"member:summary:summarize\" : string -> string {\n    call id \"operation:summary:summarize\";\n  }",
+  );
+  const todo = capabilityResourceSources.todo.replace(
+    "operation summaryGet id \"export:todo-runtime:summary-get\" : unit -> string",
+    "operation summaryGet id \"export:todo-runtime:summary-get\" : string -> string",
+  );
+  const result = compileCapabilityFixture({ workspace, summary, todo });
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  const member = result.workspace.interfaceImports
+    .find((entry) => entry.displayName === "Summary")?.members[0];
+  assert.equal(member?.kind, "operation");
+});
+
+test("state defaults accept recursive JSON values", () => {
+  const source = capabilityFixtureSource.replace(
+    '    policy optimistic-register default "Untitled project";',
+    `    policy optimistic-register default "Untitled project";
+  shared state ProjectMetadata id "slot:project:metadata" on Project : message "example.Metadata"
+    policy optimistic-register default {"labels":["compiler","runtime"],"score":1.5,"enabled":true,"extra":null};`,
+  );
+  const result = compileCapabilityFixture({ workspace: source });
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  const metadata = result.workspace.sharedAttachments.find(
+    (entry) => entry.id === "slot:project:metadata",
+  );
+  assert.equal(metadata?.kind, "state");
+  if (metadata?.kind !== "state") return;
+  assert.deepEqual(metadata.defaultValue, {
+    labels: ["compiler", "runtime"],
+    score: 1.5,
+    enabled: true,
+    extra: null,
+  });
+});
+
+test("syntax errors retain source locations", () => {
+  const result = compileCapabilityFixture({
+    workspace: capabilityFixtureSource.replace("atom Project", "atom Project ???"),
+  });
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) =>
+    entry.phase === "syntax" && entry.line > 0
+  ));
+});
+
+test("unknown authoring names are lowering errors", () => {
+  const result = compileCapabilityFixture({
+    workspace: capabilityFixtureSource.replace(
+      "to state ProjectTitle.read",
+      "to state NotAState.read",
+    ),
+  });
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) =>
+    entry.phase === "lowering" &&
+    entry.code === "unknown-symbol" &&
+    entry.message.includes("NotAState")
+  ));
+});
+
+test("well-formed but invalid programs report semantic paths", () => {
+  const result = compileCapabilityFixture({
+    workspace: capabilityFixtureSource.replace(
+      "bind name.get to state ProjectTitle.read",
+      "bind name.get to state ProjectTitle.write",
+    ),
+  });
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  const diagnostic = result.diagnostics.find(
+    (entry) => entry.code === "invalid-state-binding",
+  );
+  assert.ok(diagnostic);
+  assert.equal(diagnostic.phase, "validation");
+  assert.ok(diagnostic.path?.includes("operationBindings"));
+});
+
+test("Web Studio sidecars declare lazy materialization and checked cross-object ports", () => {
+  const result = compileWebStudioFixture();
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+
+  const host = result.workspace.conformances.find((entry) =>
+    entry.atomId === "atom:project" &&
+    entry.interfaceRevisionId === "interface:org.quixos.web-studio.has-react-component@1"
+  );
+  assert.deepEqual(host?.relationshipMaterializations, [{
+    memberId: "member:org.quixos.web-studio.has-react-component:component",
+    constructorAtomId: "atom:project-component",
+    edgeTypeId: "edge:project:component",
+    constructedProjectionId: "projection:component:subject",
+  }]);
+
+  const component = result.workspace.conformances.find((entry) =>
+    entry.atomId === "atom:project-component"
+  );
+  const binding = component?.operationBindings[0]?.binding;
+  assert.equal(binding?.kind, "package");
+  if (binding?.kind !== "package") return;
+  assert.deepEqual(binding.dependencies[0]?.binding, {
+    kind: "interface",
+    interfaceRevisionId: "interface:named@1",
+    via: {
+      edgeTypeId: "edge:project:component",
+      projectionId: "projection:component:subject",
+    },
+  });
+});
+
+test("relationship materializers require a constructor from the host atom", () => {
+  const result = compileWebStudioFixture((source) => source.replace(
+    "constructs ProjectComponent : atom-ref<Project>;",
+    "constructs ProjectComponent : unit;",
+  ));
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) =>
+    entry.code === "invalid-relationship-materialization" &&
+    entry.message.includes("must accept")
+  ));
+});
+
+test("callable interface ports require a full source dependency, not a nominal reference", () => {
+  const result = compileCapabilityResourceSource(`
+external interface Named revision "interface:named@1";
+package Runtime id "package:runtime" revision "package:runtime@1" {
+  function readName id "export:runtime:read-name" : unit -> string requires {
+    interface named id "port:runtime:named" : Named;
+  };
+}
+`, {
+    source: {
+      repository: "https://repos.quixos.org/quixos-test/package-runtime.git",
+      commit: "6".repeat(40),
+    },
+  });
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) =>
+    entry.code === "nominal-interface-port" && entry.message.includes("import interface Named")
+  ));
+});

test/capability-model.test.ts

@@ -0,0 +1,253 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  compileWorkspaceRevision,
+  computeCapabilityClosure,
+  resolveOperationPlan,
+  validateWorkspaceRevision,
+  valueType,
+  type CapabilityValidationIssueCode,
+  type WorkspaceRevision,
+} from "../src/capability-model/index.js";
+import {
+  fixtureId,
+  makeValidCapabilityWorkspace,
+} from "./fixtures/capability-model.js";
+
+const expectIssue = (
+  workspace: WorkspaceRevision,
+  code: CapabilityValidationIssueCode,
+) => {
+  const issues = validateWorkspaceRevision(workspace);
+  assert.ok(
+    issues.some((entry) => entry.code === code),
+    `Expected ${code}, got:\n${issues
+      .map((entry) => `${entry.code} ${entry.path}: ${entry.message}`)
+      .join("\n")}`,
+  );
+  assert.equal(compileWorkspaceRevision(workspace).ok, false);
+};
+
+const conformance = (
+  workspace: WorkspaceRevision,
+  identity: Pick<(typeof workspace.conformances)[number], "atomId" | "interfaceRevisionId">,
+) => {
+  const result = workspace.conformances.find((entry) =>
+    entry.atomId === identity.atomId &&
+    entry.interfaceRevisionId === identity.interfaceRevisionId
+  );
+  assert.ok(
+    result,
+    `Missing fixture conformance ${identity.atomId} as ${identity.interfaceRevisionId}`,
+  );
+  return result;
+};
+
+test("the representative v1 workspace compiles to native and package plans", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  assert.deepEqual(validateWorkspaceRevision(workspace), []);
+  const compiled = compileWorkspaceRevision(workspace);
+  assert.equal(compiled.ok, true);
+  if (!compiled.ok) return;
+
+  const title = resolveOperationPlan(
+    compiled.plan,
+    fixtureId.project,
+    fixtureId.namedV1,
+    fixtureId.namedGet,
+  );
+  assert.equal(title?.kind, "state");
+  if (title?.kind === "state") {
+    assert.equal(title.binding.slotId, fixtureId.projectTitle);
+    assert.equal(title.binding.primitive, "read");
+    assert.deepEqual(title.attachment.owner, { kind: "workspace" });
+  }
+
+  const owner = resolveOperationPlan(
+    compiled.plan,
+    fixtureId.project,
+    fixtureId.ownedV1,
+    fixtureId.ownerResolve,
+  );
+  assert.equal(owner?.kind, "edge");
+  if (owner?.kind === "edge") {
+    assert.equal(owner.binding.edgeTypeId, fixtureId.projectOwner);
+    assert.deepEqual(owner.attachment.owner, {
+      kind: "conformance",
+      ...fixtureId.projectOwnedConformance,
+    });
+  }
+
+  const summary = resolveOperationPlan(
+    compiled.plan,
+    fixtureId.project,
+    fixtureId.summaryV1,
+    fixtureId.summaryGet,
+  );
+  assert.equal(summary?.kind, "package");
+  if (summary?.kind === "package") {
+    assert.equal(summary.packageRevision.revisionId, fixtureId.todoRuntimeV1);
+    assert.equal(summary.packageExport.id, fixtureId.summaryGetExport);
+    assert.deepEqual(
+      summary.dependencies.map((entry) => [entry.port.id, entry.binding.kind]),
+      [
+        [fixtureId.titlePort, "state"],
+        [fixtureId.namedPort, "interface"],
+        [fixtureId.personPort, "constructor"],
+      ],
+    );
+  }
+});
+
+test("the closure is an exact tree-shaking boundary", () => {
+  const result = compileWorkspaceRevision(makeValidCapabilityWorkspace());
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  const closure = computeCapabilityClosure(result.plan, [
+    { atomId: fixtureId.project, interfaceRevisionId: fixtureId.summaryV1 },
+  ]);
+  assert.deepEqual(closure.conformances, [
+    fixtureId.projectNamedConformance,
+    fixtureId.projectSummaryConformance,
+  ]);
+  assert.deepEqual(closure.packageRevisionIds, [fixtureId.todoRuntimeV1]);
+  assert.deepEqual(closure.attachmentIds, [fixtureId.projectTitle]);
+  assert.deepEqual(closure.constructorAtomIds, [fixtureId.person]);
+});
+
+test("compiled plans are snapshots, not mutable authoring state", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const result = compileWorkspaceRevision(workspace);
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  conformance(workspace, fixtureId.projectNamedConformance)
+    .operationBindings[0]!.binding = {
+      kind: "state",
+      slotId: fixtureId.personName,
+      primitive: "read",
+    };
+  const resolved = resolveOperationPlan(
+    result.plan,
+    fixtureId.project,
+    fixtureId.namedV1,
+    fixtureId.namedGet,
+  );
+  assert.equal(resolved?.kind, "state");
+  if (resolved?.kind === "state") {
+    assert.equal(resolved.binding.slotId, fixtureId.projectTitle);
+  }
+});
+
+test("a conformance binds every operation exactly once", () => {
+  const missing = makeValidCapabilityWorkspace();
+  conformance(missing, fixtureId.projectNamedConformance).operationBindings.pop();
+  expectIssue(missing, "missing-operation-binding");
+
+  const duplicate = makeValidCapabilityWorkspace();
+  const bindings = conformance(
+    duplicate,
+    fixtureId.projectNamedConformance,
+  ).operationBindings;
+  bindings.push(structuredClone(bindings[0]!));
+  expectIssue(duplicate, "duplicate-operation-binding");
+});
+
+test("private attachments are visible only to their owning conformance", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const binding = conformance(
+    workspace,
+    fixtureId.projectNamedConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(binding.kind, "state");
+  if (binding.kind !== "state") return;
+  binding.slotId = fixtureId.personName;
+  expectIssue(workspace, "private-attachment-access");
+});
+
+test("related-object dependency views cannot traverse another conformance's private edge", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const packageBinding = conformance(
+    workspace,
+    fixtureId.projectSummaryConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(packageBinding.kind, "package");
+  if (packageBinding.kind !== "package") return;
+  const named = packageBinding.dependencies.find(
+    (dependency) => dependency.portId === fixtureId.namedPort,
+  );
+  assert.ok(named && named.binding.kind === "interface");
+  named.binding.via = {
+    edgeTypeId: fixtureId.projectOwner,
+    projectionId: fixtureId.projectOwnerProjection,
+  };
+  expectIssue(workspace, "private-attachment-access");
+});
+
+test("native state and edge providers must match operation shape", () => {
+  const stateWorkspace = makeValidCapabilityWorkspace();
+  const state = conformance(
+    stateWorkspace,
+    fixtureId.projectNamedConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(state.kind, "state");
+  if (state.kind === "state") state.primitive = "write";
+  expectIssue(stateWorkspace, "invalid-state-binding");
+
+  const edgeWorkspace = makeValidCapabilityWorkspace();
+  const edge = conformance(
+    edgeWorkspace,
+    fixtureId.projectOwnedConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(edge.kind, "edge");
+  if (edge.kind === "edge") edge.primitive = "connect";
+  expectIssue(edgeWorkspace, "invalid-edge-binding");
+});
+
+test("package dependencies are complete, exact, and explicitly injected", () => {
+  const missing = makeValidCapabilityWorkspace();
+  const packageBinding = conformance(
+    missing,
+    fixtureId.projectSummaryConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(packageBinding.kind, "package");
+  if (packageBinding.kind === "package") packageBinding.dependencies.pop();
+  expectIssue(missing, "invalid-dependency-binding");
+
+  const wrongType = makeValidCapabilityWorkspace();
+  const summaryExport = wrongType.packageImports[0]!.exports.find(
+    (entry) => entry.id === fixtureId.summaryGetExport,
+  );
+  assert.ok(summaryExport);
+  summaryExport.dependencyPorts[0]!.requirement = {
+    kind: "state",
+    valueType: valueType.int32,
+    primitives: ["read"],
+  };
+  expectIssue(wrongType, "invalid-dependency-binding");
+});
+
+test("package receiver requirements cannot depend on themselves", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const summaryExport = workspace.packageImports[0]!.exports.find(
+    (entry) => entry.id === fixtureId.summaryGetExport,
+  );
+  assert.ok(summaryExport && summaryExport.kind === "operation");
+  summaryExport.receiverRequirement = {
+    kind: "all-interfaces",
+    interfaceRevisionIds: [fixtureId.summaryV1],
+  };
+  summaryExport.dependencyPorts = [];
+  const packageBinding = conformance(
+    workspace,
+    fixtureId.projectSummaryConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(packageBinding.kind, "package");
+  if (packageBinding.kind === "package") packageBinding.dependencies = [];
+  expectIssue(workspace, "cyclic-conformance-requirement");
+});
+
+test("constructors are statically checked", () => {
+  const badConstructor = makeValidCapabilityWorkspace();
+  badConstructor.constructors[0]!.exportId = fixtureId.summaryGetExport;
+  expectIssue(badConstructor, "invalid-constructor");
+});

test/fixtures/capability-model.ts

@@ -0,0 +1,194 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import {
+  capabilityId,
+  type WorkspaceRevision,
+} from "../../src/capability-model/index.js";
+import {
+  compileCapabilityResourceSource,
+  compileCapabilitySource,
+  type CapabilityImportEnvironment,
+} from "../../src/capability-language/index.js";
+import type {
+  InterfaceRevision,
+  PackageRevision,
+} from "../../src/capability-model/index.js";
+
+export const fixtureId = {
+  workspace: capabilityId.workspace("workspace:todo"),
+  workspaceRevision: capabilityId.workspaceRevision("workspace:todo@1"),
+  project: capabilityId.atom("atom:project"),
+  person: capabilityId.atom("atom:person"),
+  namedV1: capabilityId.interfaceRevision("interface:named@1"),
+  ownedV1: capabilityId.interfaceRevision("interface:owned@1"),
+  summaryV1: capabilityId.interfaceRevision("interface:summary@1"),
+  namedGet: capabilityId.operation("operation:named:name:get"),
+  namedSet: capabilityId.operation("operation:named:name:set"),
+  ownerResolve: capabilityId.operation("operation:owned:owner:resolve"),
+  summaryGet: capabilityId.operation("operation:summary:summary:get"),
+  projectTitle: capabilityId.slot("slot:project:title"),
+  personName: capabilityId.slot("slot:person:name"),
+  projectOwner: capabilityId.edgeType("edge:project:owner"),
+  projectOwnerProjection: capabilityId.edgeProjection(
+    "projection:project-owner:owner",
+  ),
+  projectNamedConformance: {
+    atomId: capabilityId.atom("atom:project"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:named@1"),
+  },
+  personNamedConformance: {
+    atomId: capabilityId.atom("atom:person"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:named@1"),
+  },
+  projectOwnedConformance: {
+    atomId: capabilityId.atom("atom:project"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:owned@1"),
+  },
+  projectSummaryConformance: {
+    atomId: capabilityId.atom("atom:project"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:summary@1"),
+  },
+  todoRuntimeV1: capabilityId.packageRevision("package:todo-runtime@1"),
+  summaryGetExport: capabilityId.packageExport(
+    "export:todo-runtime:summary-get",
+  ),
+  createPersonExport: capabilityId.packageExport(
+    "export:todo-runtime:create-person",
+  ),
+  titlePort: capabilityId.dependencyPort("port:summary:title"),
+  namedPort: capabilityId.dependencyPort("port:summary:named"),
+  personPort: capabilityId.dependencyPort("port:summary:person"),
+} as const;
+
+export const capabilityFixturePath = resolve(
+  process.cwd(),
+  "test/fixtures/todo.capabilities.qx",
+);
+
+export const capabilityFixtureSource = readFileSync(
+  capabilityFixturePath,
+  "utf8",
+);
+
+const resourceSource = (name: string) => readFileSync(
+  resolve(process.cwd(), "test/fixtures", name),
+  "utf8",
+);
+
+export const capabilityResourceSources = {
+  named: resourceSource("named.interface.qx"),
+  owned: resourceSource("owned.interface.qx"),
+  summary: resourceSource("summary.interface.qx"),
+  todo: resourceSource("todo.package.qx"),
+} as const;
+
+const source = (repository: string, commit: string) => ({ repository, commit });
+
+const interfaceRevision = (
+  resource: { kind: "interface"; revision: InterfaceRevision } |
+    { kind: "package"; revision: PackageRevision },
+) => {
+  if (resource.kind !== "interface") throw new Error("Expected interface fixture");
+  return resource.revision;
+};
+
+const packageRevision = (
+  resource: { kind: "interface"; revision: InterfaceRevision } |
+    { kind: "package"; revision: PackageRevision },
+) => {
+  if (resource.kind !== "package") throw new Error("Expected package fixture");
+  return resource.revision;
+};
+
+export const compileCapabilityFixture = (overrides: Partial<{
+  workspace: string;
+  named: string;
+  owned: string;
+  summary: string;
+  todo: string;
+}> = {}) => {
+  const named = compileCapabilityResourceSource(
+    overrides.named ?? capabilityResourceSources.named,
+    {
+      source: source(
+        "https://repos.quixos.org/quixos-todo/interface-named.git",
+        "2".repeat(40),
+      ),
+      fileName: "named.interface.qx",
+    },
+  );
+  if (!named.ok) return named;
+  const namedRevision = interfaceRevision(named.resource);
+  const namedEnvironment: CapabilityImportEnvironment = {
+    interfaces: new Map([["Named", namedRevision]]),
+    interfaceClosure: [namedRevision],
+  };
+  const owned = compileCapabilityResourceSource(
+    overrides.owned ?? capabilityResourceSources.owned,
+    {
+      source: source(
+        "https://repos.quixos.org/quixos-todo/interface-owned.git",
+        "3".repeat(40),
+      ),
+      fileName: "owned.interface.qx",
+      environment: namedEnvironment,
+    },
+  );
+  if (!owned.ok) return owned;
+  const ownedRevision = interfaceRevision(owned.resource);
+  const summary = compileCapabilityResourceSource(
+    overrides.summary ?? capabilityResourceSources.summary,
+    {
+      source: source(
+        "https://repos.quixos.org/quixos-todo/interface-summary.git",
+        "4".repeat(40),
+      ),
+      fileName: "summary.interface.qx",
+    },
+  );
+  if (!summary.ok) return summary;
+  const summaryRevision = interfaceRevision(summary.resource);
+  const todo = compileCapabilityResourceSource(
+    overrides.todo ?? capabilityResourceSources.todo,
+    {
+      source: source(
+        "https://repos.quixos.org/quixos-todo/package-todo-runtime.git",
+        "5".repeat(40),
+      ),
+      fileName: "todo.package.qx",
+      environment: namedEnvironment,
+    },
+  );
+  if (!todo.ok) return todo;
+  const todoRevision = packageRevision(todo.resource);
+  return compileCapabilitySource(
+    overrides.workspace ?? capabilityFixtureSource,
+    capabilityFixturePath,
+    {
+      interfaces: new Map([
+        ["Named", namedRevision],
+        ["Owned", ownedRevision],
+        ["Summary", summaryRevision],
+      ]),
+      packages: new Map([["TodoRuntime", todoRevision]]),
+      interfaceClosure: [
+        namedRevision,
+        ownedRevision,
+        summaryRevision,
+      ],
+      packageClosure: [todoRevision],
+    },
+  );
+};
+
+export const makeValidCapabilityWorkspace = (): WorkspaceRevision => {
+  const result = compileCapabilityFixture();
+  if (!result.ok) {
+    throw new Error(
+      result.diagnostics
+        .map((entry) => `${entry.phase}/${entry.code}: ${entry.message}`)
+        .join("\n"),
+    );
+  }
+  return structuredClone(result.workspace);
+};

test/fixtures/component-runtime.package.qx

@@ -0,0 +1,10 @@
+import interface Named;
+external atom Project id "atom:project";
+external atom ProjectComponent id "atom:project-component";
+
+package ComponentRuntime id "package:component-runtime" revision "package:component-runtime@1" {
+  constructor createComponent id "export:component-runtime:create-component" constructs ProjectComponent : atom-ref<Project>;
+  operation propsGet id "export:component-runtime:props-get" : unit -> string mode call receiver atom ProjectComponent requires {
+    interface project id "port:component:project" : Named;
+  };
+}

test/fixtures/has-react-component.interface.qx

@@ -0,0 +1,7 @@
+import interface ReactComponent;
+
+interface HasReactComponent id "interface:org.quixos.web-studio.has-react-component" revision "interface:org.quixos.web-studio.has-react-component@1" {
+  relation component id "member:org.quixos.web-studio.has-react-component:component" : optional-one interface ReactComponent {
+    resolve id "operation:org.quixos.web-studio.has-react-component:component:resolve";
+  }
+}

test/fixtures/named.interface.qx

@@ -0,0 +1,7 @@
+interface Named id "interface:named" revision "interface:named@1" {
+  value name id "member:named:name" : string {
+    get id "operation:named:name:get";
+    set id "operation:named:name:set";
+    watch start id "operation:named:name:watch-start" stop id "operation:named:name:watch-stop";
+  }
+}

test/fixtures/owned.interface.qx

@@ -0,0 +1,10 @@
+import interface Named;
+
+interface Owned id "interface:owned" revision "interface:owned@1" {
+  relation owner id "member:owned:owner" : exactly-one interface Named {
+    resolve id "operation:owned:owner:resolve";
+    connect id "operation:owned:owner:connect";
+    disconnect id "operation:owned:owner:disconnect";
+    watch start id "operation:owned:owner:watch-start" stop id "operation:owned:owner:watch-stop";
+  }
+}

test/fixtures/react-component.interface.qx

@@ -0,0 +1,5 @@
+interface ReactComponent id "interface:org.quixos.web-studio.react-component" revision "interface:org.quixos.web-studio.react-component@1" {
+  value props id "member:org.quixos.web-studio.react-component:props" : string {
+    get id "operation:org.quixos.web-studio.react-component:props:get";
+  }
+}

test/fixtures/summary.interface.qx

@@ -0,0 +1,5 @@
+interface Summary id "interface:summary" revision "interface:summary@1" {
+  value summary id "member:summary:summary" : string {
+    get id "operation:summary:summary:get";
+  }
+}

test/fixtures/todo.capabilities.qx

@@ -0,0 +1,50 @@
+workspace Todo id "workspace:todo" revision "workspace:todo@1" commit "1111111111111111111111111111111111111111" {
+  atom Project id "atom:project" doc "A project containing work.";
+  atom Person id "atom:person";
+
+  import interface Named;
+  import interface Owned;
+  import interface Summary;
+  import package TodoRuntime;
+
+  shared state ProjectTitle id "slot:project:title" on Project : string
+    policy optimistic-register default "Untitled project";
+
+  conform Project as Named {
+    bind name.get to state ProjectTitle.read;
+    bind name.set to state ProjectTitle.write;
+    bind name.watch-start to state ProjectTitle.watch-start;
+    bind name.watch-stop to state ProjectTitle.watch-stop;
+  }
+
+  conform Person as Named {
+    private state PersonName id "slot:person:name" on Person : string
+      policy optimistic-register default "Anonymous";
+    bind name.get to state PersonName.read;
+    bind name.set to state PersonName.write;
+    bind name.watch-start to state PersonName.watch-start;
+    bind name.watch-stop to state PersonName.watch-stop;
+  }
+
+  conform Project as Owned {
+    private edge ProjectOwner id "edge:project:owner" {
+      atom Project projection owner id "projection:project-owner:owner" exactly-one;
+      interface Named projection ownedProjects id "projection:project-owner:owned-projects" many;
+    }
+    bind owner.resolve to edge ProjectOwner.owner.resolve;
+    bind owner.connect to edge ProjectOwner.owner.connect;
+    bind owner.disconnect to edge ProjectOwner.owner.disconnect;
+    bind owner.watch-start to edge ProjectOwner.owner.watch-start;
+    bind owner.watch-stop to edge ProjectOwner.owner.watch-stop;
+  }
+
+  conform Project as Summary {
+    bind summary.get to package TodoRuntime.summaryGet with {
+      title to state ProjectTitle;
+      named to interface Named;
+      person to constructor Person;
+    };
+  }
+
+  constructor Person to TodoRuntime.createPerson;
+}

test/fixtures/todo.package.qx

@@ -0,0 +1,12 @@
+import interface Named;
+external atom Person id "atom:person";
+
+package TodoRuntime id "package:todo-runtime" revision "package:todo-runtime@1" {
+  operation summaryGet id "export:todo-runtime:summary-get" : unit -> string
+    mode call receiver interfaces [Named] requires {
+      state title id "port:summary:title" : string [read];
+      interface named id "port:summary:named" : Named;
+      constructor person id "port:summary:person" : Person;
+    };
+  constructor createPerson id "export:todo-runtime:create-person" constructs Person : unit;
+}

test/fixtures/web-studio.capabilities.qx

@@ -0,0 +1,35 @@
+workspace WebStudioFixture id "workspace:web-studio-fixture" revision "workspace:web-studio-fixture@1" commit "1111111111111111111111111111111111111111" {
+  atom Project id "atom:project";
+  atom ProjectComponent id "atom:project-component";
+
+  import interface Named;
+  import interface ReactComponent;
+  import interface HasReactComponent;
+  import package ComponentRuntime;
+
+  shared state ProjectName id "slot:project:name" on Project : string
+    policy optimistic-register default "Untitled project";
+  shared edge ProjectComponentEdge id "edge:project:component" {
+    atom ProjectComponent projection subject id "projection:component:subject" exactly-one;
+    atom Project projection component id "projection:project:component" optional-one;
+  }
+
+  conform Project as Named {
+    bind name.get to state ProjectName.read;
+    bind name.set to state ProjectName.write;
+    bind name.watch-start to state ProjectName.watch-start;
+    bind name.watch-stop to state ProjectName.watch-stop;
+  }
+
+  conform Project as HasReactComponent {
+    bind component.resolve to edge ProjectComponentEdge.component.resolve;
+    materialize component if absent using constructor ProjectComponent via edge ProjectComponentEdge.subject;
+  }
+  conform ProjectComponent as ReactComponent {
+    bind props.get to package ComponentRuntime.propsGet with {
+      project to interface Named via edge ProjectComponentEdge.subject;
+    };
+  }
+
+  constructor ProjectComponent to ComponentRuntime.createComponent;
+}

test/resource-lock.test.ts

@@ -0,0 +1,250 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  formatQuixosLock,
+  formatQuixosLockDocument,
+  loadQuixosLock,
+  nixGitInput,
+  parseQuixosLock,
+  parseQuixosLockDocument,
+  resolveQuixosLock,
+  retentionTagForCommit,
+} from "../src/resource-lock/index.js";
+
+const quixosCommit = "1".repeat(40);
+const namedCommit = "2".repeat(40);
+const packageCommit = "3".repeat(64);
+const fixture = `quixos-lock version 1 {
+  quixos source {
+    repository "https://gitea.example/quixos/quixos.git";
+    commit "${quixosCommit}";
+  }
+
+  interface Named source {
+    repository "https://repos.example/alice/interface-named.git";
+    commit "${namedCommit}";
+  }
+
+  package TodoRuntime source {
+    repository "ssh://git@repos.example/alice/package-todo-runtime.git";
+    commit "${packageCommit}";
+  }
+}
+`;
+
+test("parses and canonically formats a Git-only repository lock", () => {
+  const parsed = parseQuixosLock(fixture, "quixos.lock");
+  assert.equal(parsed.ok, true);
+  if (!parsed.ok) return;
+  assert.equal(parsed.lock.formatVersion, 1);
+  assert.equal(parsed.lock.quixos.commit, quixosCommit);
+  assert.deepEqual(
+    parsed.lock.resources.map(({ kind, binding }) => ({ kind, binding })),
+    [
+      { kind: "interface", binding: "Named" },
+      { kind: "package", binding: "TodoRuntime" },
+    ],
+  );
+  assert.deepEqual(parseQuixosLock(formatQuixosLock(parsed.lock)), {
+    ok: true,
+    lock: parsed.lock,
+    diagnostics: [],
+  });
+});
+
+test("derives immutable retention and Nix inputs without storing extra identity", () => {
+  const source = {
+    resolver: "git" as const,
+    repository: "https://repos.example/alice/interface-named.git",
+    commit: namedCommit,
+  };
+  const ref = `refs/tags/quixos-reachability/${namedCommit}`;
+  assert.equal(retentionTagForCommit(namedCommit.toUpperCase()), ref);
+  assert.deepEqual(nixGitInput(source), {
+    type: "git",
+    url: source.repository,
+    ref,
+    rev: namedCommit,
+  });
+});
+
+test("rejects mutable revisions, embedded credentials, and duplicate bindings", () => {
+  const parsed = parseQuixosLock(`quixos-lock version 1 {
+    quixos source {
+      repository "https://user:secret@example/quixos.git";
+      commit "main";
+    }
+    interface Named source {
+      repository "file:///tmp/named";
+      commit "${namedCommit}";
+    }
+    interface Named source {
+      repository "https://repos.example/named.git?ref=main";
+      commit "${namedCommit}";
+    }
+  }`);
+  assert.equal(parsed.ok, false);
+  if (parsed.ok) return;
+  assert.deepEqual(
+    new Set(parsed.diagnostics.map((entry) => entry.code)),
+    new Set([
+      "invalid-git-commit",
+      "embedded-git-credential",
+      "unsupported-git-transport",
+      "decorated-git-repository",
+      "duplicate-resource-binding",
+    ]),
+  );
+});
+
+test("resolves root-relative lock fragments into one deterministic resource closure", async () => {
+  const root = `quixos-lock version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+    import "locks/web-studio.lock";
+    import "locks/domain.lock";
+    package RootRuntime source {
+      repository "https://repos.example/alice/package-root.git";
+      commit "${packageCommit}";
+    }
+  }`;
+  const sources = new Map([
+    ["locks/web-studio.lock", `quixos-lock fragment version 1 {
+      import "locks/shared.lock";
+      interface Placeable source {
+        repository "https://repos.example/alice/interface-placeable.git";
+        commit "${namedCommit}";
+      }
+    }`],
+    ["locks/shared.lock", `quixos-lock fragment version 1 {
+      interface Named source {
+        repository "https://repos.example/alice/interface-named.git";
+        commit "${namedCommit}";
+      }
+    }`],
+    ["locks/domain.lock", `quixos-lock fragment version 1 {
+      package TodoRuntime source {
+        repository "https://repos.example/alice/package-todo.git";
+        commit "${packageCommit}";
+      }
+    }`],
+  ]);
+  const result = await resolveQuixosLock(root, async (relativePath) => {
+    const source = sources.get(relativePath);
+    if (!source) throw new Error("missing fixture");
+    return source;
+  });
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  assert.deepEqual(result.lock.sourceFiles, [
+    "quixos.lock",
+    "locks/web-studio.lock",
+    "locks/shared.lock",
+    "locks/domain.lock",
+  ]);
+  assert.deepEqual(result.lock.resources.map(({ kind, binding }) => ({ kind, binding })), [
+    { kind: "package", binding: "RootRuntime" },
+    { kind: "interface", binding: "Placeable" },
+    { kind: "interface", binding: "Named" },
+    { kind: "package", binding: "TodoRuntime" },
+  ]);
+});
+
+test("lock fragments format canonically and cannot redeclare the Quixos source", () => {
+  const document = {
+    kind: "fragment" as const,
+    formatVersion: 1 as const,
+    imports: ["locks/shared.lock"],
+    resources: [{
+      kind: "interface" as const,
+      binding: "Named",
+      source: {
+        resolver: "git" as const,
+        repository: "https://repos.example/alice/interface-named.git",
+        commit: namedCommit,
+      },
+    }],
+  };
+  assert.deepEqual(parseQuixosLockDocument(formatQuixosLockDocument(document)), {
+    ok: true,
+    document,
+    diagnostics: [],
+  });
+  const invalid = parseQuixosLockDocument(`quixos-lock fragment version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+  }`, "bad.lock");
+  assert.equal(invalid.ok, false);
+  if (!invalid.ok) assert.equal(invalid.diagnostics[0]?.code, "fragment-has-quixos-source");
+});
+
+test("lock imports reject traversal, cycles, root documents, and cross-file binding collisions", async () => {
+  const invalidPath = parseQuixosLockDocument(`quixos-lock fragment version 1 {
+    import "../outside.lock";
+  }`, "bad-path.lock");
+  assert.equal(invalidPath.ok, false);
+  if (!invalidPath.ok) assert.equal(invalidPath.diagnostics[0]?.code, "invalid-import-path");
+
+  const root = `quixos-lock version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+    import "a.lock";
+    import "root-again.lock";
+    interface Named source {
+      repository "https://repos.example/alice/interface-named.git";
+      commit "${namedCommit}";
+    }
+  }`;
+  const sources = new Map([
+    ["a.lock", `quixos-lock fragment version 1 {
+      import "b.lock";
+      interface Named source {
+        repository "https://repos.example/alice/interface-named-copy.git";
+        commit "${namedCommit}";
+      }
+    }`],
+    ["b.lock", `quixos-lock fragment version 1 { import "a.lock"; }`],
+    ["root-again.lock", root],
+  ]);
+  const result = await resolveQuixosLock(root, async (relativePath) => sources.get(relativePath) ?? "");
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.deepEqual(new Set(result.diagnostics.map(({ code }) => code)), new Set([
+      "duplicate-resource-binding",
+      "import-cycle",
+      "imported-root-lock",
+    ]));
+  }
+});
+
+test("file loading rejects a symlink in any import path component", async (context) => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "quixos-lock-test-"));
+  context.after(() => rm(directory, { recursive: true, force: true }));
+  const outside = path.join(directory, "outside");
+  await mkdir(outside);
+  await writeFile(path.join(outside, "fragment.lock"), "quixos-lock fragment version 1 {}\n");
+  await symlink(outside, path.join(directory, "linked"), "dir");
+  await writeFile(path.join(directory, "quixos.lock"), `quixos-lock version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+    import "linked/fragment.lock";
+  }`);
+
+  const result = await loadQuixosLock(path.join(directory, "quixos.lock"));
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.equal(result.diagnostics[0]?.code, "import-read-failed");
+    assert.match(result.diagnostics[0]?.message ?? "", /symbolic links/);
+  }
+});

tsconfig.build.json

@@ -7,5 +7,6 @@
     "outDir": "dist",
     "rootDir": ".",
     "sourceMap": true
-  }
+  },
+  "include": ["src/**/*.ts"]
 }

tsconfig.json

@@ -14,6 +14,6 @@
     "verbatimModuleSyntax": true,
     "types": ["node"]
   },
-  "include": ["src/**/*.ts"],
+  "include": ["src/**/*.ts", "test/**/*.ts"],
   "exclude": ["node_modules", "dist"]
 }

tsconfig.test.json

@@ -0,0 +1,12 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "allowImportingTsExtensions": false,
+    "declaration": false,
+    "noEmit": false,
+    "outDir": "dist",
+    "rootDir": ".",
+    "sourceMap": true
+  },
+  "include": ["src/**/*.ts", "test/**/*.ts"]
+}

yarn-project.nix

@@ -0,0 +1,188 @@
+# This file is generated by running "yarn install" inside your project.
+# Manual changes might be lost - proceed with caution!
+
+{ lib, stdenv, nodejs, git, cacert, fetchurl, writeShellScript, writeShellScriptBin }:
+{ src, overrideAttrs ? null, ... } @ args:
+
+let
+
+  yarnBin = fetchurl {
+    url = "https://repo.yarnpkg.com/4.18.0/packages/yarnpkg-cli/bin/yarn.js";
+    hash = "sha512-/Lhxb+fNDuzhQf/Bi5IZOp35IEwbqDGJwoiDUiP8C75kr0c7qw1emSen2utcryuwfrJ4fMkzjKBA6hJfKh8vfg==";
+  };
+
+  cacheFolder = ".yarn/cache";
+  lockfile = ./yarn.lock;
+
+  # Call overrideAttrs on a derivation if a function is provided.
+  optionalOverride = fn: drv:
+    if fn == null then drv else drv.overrideAttrs fn;
+
+  # Simple stub that provides the global yarn command.
+  yarn = writeShellScriptBin "yarn" ''
+    exec '${nodejs}/bin/node' '${yarnBin}' "$@"
+  '';
+
+  # Common attributes between Yarn derivations.
+  drvCommon = {
+    # Make sure the build uses the right Node.js version everywhere.
+    buildInputs = [ nodejs yarn ];
+    # All dependencies should already be cached.
+    yarn_enable_network = "0";
+    # Tell node-gyp to use the provided Node.js headers for native code builds.
+    npm_config_nodedir = nodejs;
+  };
+
+  # Comman variables that we set in a Nix build, but not in a Nix shell.
+  buildVars = ''
+    # Make Yarn produce friendlier logging for automated builds.
+    export CI=1
+    # Tell node-pre-gyp to never fetch binaries / always build from source.
+    export npm_config_build_from_source=true
+  '';
+
+  # Create derivations for fetching dependencies.
+  cacheDrvs = let
+  in lib.mapAttrs (locator: { filename, hash }: stdenv.mkDerivation {
+    name = lib.strings.sanitizeDerivationName locator;
+    buildInputs = [ yarn git cacert ];
+    buildCommand = ''
+      cd '${src}'
+      ${buildVars}
+      HOME="$TMP" yarn_enable_global_cache=false yarn_cache_folder="$TMP" \
+        yarn nixify fetch ${lib.escapeShellArg locator}
+      # Because we change the cache dir, Yarn may generate a different name.
+      mv "$TMP/$(sed 's/-[^-]*\.[^-]*$//' <<< "$outputFilename")"-* $out
+    '';
+    outputFilename = filename;
+    outputHash = hash;
+  }) cacheEntries;
+
+  # Create a shell snippet to copy dependencies from a list of derivations.
+  mkCacheBuilderForDrvs = drvs:
+    writeShellScript "collect-yarn-cache" (lib.concatMapStrings (drv: ''
+      cp --reflink=auto ${drv} '${drv.outputFilename}'
+    '') drvs);
+
+  # Main project derivation.
+  project = stdenv.mkDerivation (drvCommon // {
+    inherit src;
+    name = "@quixos/quixos-protocol";
+
+    configurePhase = ''
+      ${buildVars}
+
+      # Copy over the Yarn cache.
+      rm -fr '${cacheFolder}'
+      mkdir -p '${cacheFolder}'
+      pushd '${cacheFolder}' > /dev/null
+      source ${mkCacheBuilderForDrvs (lib.attrValues cacheDrvs)}
+      popd > /dev/null
+
+      # Yarn may need a writable home directory.
+      export yarn_global_folder="$TMP"
+
+      # Ensure global cache is disabled. Cache must be part of our output.
+      touch .yarnrc.yml
+      sed -i -e '/^enableGlobalCache/d' .yarnrc.yml
+      echo 'enableGlobalCache: false' >> .yarnrc.yml
+
+      # Some node-gyp calls may call out to npm, which could fail due to an
+      # read-only home dir.
+      export HOME="$TMP"
+
+      # running preConfigure after the cache is populated allows for
+      # preConfigure to contain substituteInPlace for dependencies as well as the
+      # main project. This is necessary for native bindings that maybe have
+      # hardcoded values.
+      runHook preConfigure
+
+      # Run normal Yarn install to complete dependency installation.
+      yarn install --immutable --immutable-cache
+
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      # Move the package contents to the output directory.
+      if grep -q '"workspaces"' package.json; then
+        # We can't use `yarn pack` in a workspace setup, because it only
+        # packages the outer workspace.
+        mkdir -p "$out/libexec"
+        mv $PWD "$out/libexec/$name"
+      else
+        # - If the package.json has a `files` field, only files matching those patterns are copied
+        # - Otherwise all files are copied.
+        yarn pack --out package.tgz
+        mkdir -p "$out/libexec/$name"
+        tar xzf package.tgz --directory "$out/libexec/$name" --strip-components=1
+
+        cp --reflink=auto .yarnrc* "$out/libexec/$name"
+        cp --reflink=auto ${lockfile} "$out/libexec/$name/yarn.lock"
+        cp --reflink=auto --recursive .yarn "$out/libexec/$name"
+
+        # Copy the Yarn linker output into the package.
+        cp --reflink=auto --recursive node_modules "$out/libexec/$name"
+      fi
+
+      cd "$out/libexec/$name"
+
+      # Invoke a plugin internal command to setup binaries.
+      mkdir -p "$out/bin"
+      yarn nixify install-bin $out/bin
+
+      # A package with node_modules doesn't need the cache
+      yarn cache clean
+
+      runHook postInstall
+    '';
+
+    passthru = {
+      inherit nodejs;
+      yarn-freestanding = yarn;
+      yarn = writeShellScriptBin "yarn" ''
+        exec '${yarn}/bin/yarn' --cwd '${overriddenProject}/libexec/${overriddenProject.name}' "$@"
+      '';
+    };
+  });
+
+  overriddenProject = optionalOverride overrideAttrs project;
+
+cacheEntries = {
+"@bufbuild/protobuf@npm:2.14.1" = { filename = "@bufbuild-protobuf-npm-2.14.1-78e9ea56a2-3f913aca03.zip"; hash = "sha512-P5E6ygPfhBnEsh2ADqVNf2yDalND5l1vaGJ57DVmxJB3KZOO8vlKXifZLo0/StzW4CcRi6Kbp2TSHhxjfN3HAg=="; };
+"@bufbuild/protoc-gen-es@npm:2.14.1" = { filename = "@bufbuild-protoc-gen-es-npm-2.14.1-230b1181a2-79f9fad1d5.zip"; hash = "sha512-efn60dVmXaptZUmyh4oPY/6/rbGHuFNAg/vrI4Ydwizz6mmmYKEvD45Ps8AtJO6ALxcYRBVt5C+0sXEuOgZ1aQ=="; };
+"@bufbuild/protoplugin@npm:2.14.1" = { filename = "@bufbuild-protoplugin-npm-2.14.1-ca1a20a987-6a727aa5a8.zip"; hash = "sha512-anJ6pahI4FA13tkPUOE65Sx3NXutalhHalbU/3ANyBPKxmTgzDC1IBNU5cFY6//rANyDUxbWaqLDhKLp2qXf4w=="; };
+"@types/node@npm:24.13.3" = { filename = "@types-node-npm-24.13.3-b512a0bbeb-a5bc08f49b.zip"; hash = "sha512-pbwI9JuVgdzcqQ4CzXcZejx5mECAdmSULlzVFhpVPU0q6AZPfjKUQQ10jX0Ji1wYSL5/pQwG8pxBk6sWvk5Z6w=="; };
+"@typescript/typescript-linux-arm64@npm:7.0.2" = { filename = "@typescript-typescript-linux-arm64-npm-7.0.2-9cacfc53a0-10c0.zip"; hash = "sha512-s4c7nGT/lQIw6x0IfrL0b3ECy/D0g7UoDLdiIWJoM6EGXk5N/dmXdxUdA8Cr3hV/3nO2BYKTQ6Ai8/zGhiSQ3A=="; };
+"@typescript/typescript-linux-x64@npm:7.0.2" = { filename = "@typescript-typescript-linux-x64-npm-7.0.2-8dd7ff8d24-10c0.zip"; hash = "sha512-k9EUK5CZ3OOPnyslp8SAAonHJpnpPmlaulppI/NmFyCzNs3UN/TLPUkyQia3KIxgbyTzKoXI5L5fl8Uj9bJ7Cg=="; };
+"@typescript/vfs@npm:1.6.4" = { filename = "@typescript-vfs-npm-1.6.4-78935c9d3e-acb9de42f2.zip"; hash = "sha512-rLneQvI/2j9149eQC6EG7zI6L0588OSpTbtFfibTU8pjuzUZPtGjL8hzPzrlkJlhKykLBr1iIWlIYb65v7YvYg=="; };
+"antlr-ng@npm:1.0.10" = { filename = "antlr-ng-npm-1.0.10-840fe729e4-0893eda0fd.zip"; hash = "sha512-CJPtoP3M4dMpwYykUaxo7zdA+pOnISq5cq66bDNyLJvnL1dqN5cakOTnJSu6241VnAiH8yWPr+pZtJlsb+9P6g=="; };
+"antlr4ng@npm:3.0.15" = { filename = "antlr4ng-npm-3.0.15-58a4d495ba-75421480b9.zip"; hash = "sha512-dUIUgLmWAcCuF0HkFHuF4k6egiNuw1TFH75QsthdcTeJRAW0dIk5xH5yCAC9GcChkAa49o+14Bg2xxf6vaaLXA=="; };
+"antlr4ng@npm:3.0.16" = { filename = "antlr4ng-npm-3.0.16-c4e3e7474c-01b51d1d73.zip"; hash = "sha512-AbUdHXPKEvIt/Pcjuj12n0ewLDJhi8cp470iczT6FUoKQLFrDj0fJF+ldWv067uU3rKWoj1z8FLckL5qLEd9EQ=="; };
+"base64-js@npm:1.5.1" = { filename = "base64-js-npm-1.5.1-b2f7275641-f23823513b.zip"; hash = "sha512-8jgjUTtjFzoAEDD65PLavig7manTJK3jrT0UjiGBNGdvHuhWjId8157BxTFY3PLSulJ6l8YGYYkoupndkwECvw=="; };
+"commander@npm:13.1.0" = { filename = "commander-npm-13.1.0-bdbbfaaf9d-7b8c5544bb.zip"; hash = "sha512-e4xVRLunBPvoS3yrLgQ9+FhtXBFKTFtgf4OuUGBwiUDtC1vVg4z4zidTnN4mXBy9Wc48jGsBftPuyJQ+OkFRZA=="; };
+"debug@npm:4.4.3" = { filename = "debug-npm-4.4.3-0105c6123a-d79136ec6c.zip"; hash = "sha512-15E27GyD7L79D2pVk9pqnJHsTX3cS1TIg9bnHsmsy19noaXpbQCjKBlrW1yG02XpjYo6cIVqrxa057GYXmf1pg=="; };
+"fast-printf@npm:1.6.10" = { filename = "fast-printf-npm-1.6.10-c05cca9b81-630cccbef8.zip"; hash = "sha512-YwzMvvg0mm7q2plYyTkenRS1vZUn3SjZ5+nylbAGxkDdyo/CRwz/VepcbJLKUwSIu62/fCT0hSrYw02RVdqddQ=="; };
+"he@npm:1.2.0" = { filename = "he-npm-1.2.0-3b73a2ff07-a27d478bef.zip"; hash = "sha512-on1Hi+/jyBkvAGzdBjmmZ5iXnfpuISXGrFgqGaXr/sYq2D6DguYDYXDYc/RuRTan55W/i5W/fCR/TMCCXMyMFw=="; };
+"luxon@npm:3.5.0" = { filename = "luxon-npm-3.5.0-92bb977f7f-335789bba9.zip"; hash = "sha512-M1eJu6lQd9uDHvmYlO2t6yMCOz6yE3obVqzQ0pAIK2kc95MUPWnjC8Bp7JXwtJ82QZ9I6VHGgBTxn/4SBF40lA=="; };
+"ms@npm:2.1.3" = { filename = "ms-npm-2.1.3-81ff3cfac1-d924b57e73.zip"; hash = "sha512-2SS1fnMSs7Y60h/Fs9wK9eeNYaH8fPtUV+2vJjJr9ivlMHzIf/toYu8cKzOwIzzbXU8BxMlYzA1mCUi2Wih6SA=="; };
+"pako@npm:0.2.9" = { filename = "pako-npm-0.2.9-c88ac0d326-79c1806ebc.zip"; hash = "sha512-ecGAbrzzJbYK5Znk1yJ8LjRte4Kdwg9c8kzvB8k0B53DphxbPIJ4ovehkMSmE+ND6hHlMC2+JS79EXEt9LawQQ=="; };
+"stringtemplate4ts@npm:1.0.9" = { filename = "stringtemplate4ts-npm-1.0.9-df48ae4223-c5f46367d0.zip"; hash = "sha512-xfRjZ9A3XBp8ryC4YZCEL0rv+1Q9dosicN/TxeQsTc9JkBwCp7BowI6MREDAKiApCFlOvO2+0PXolHA9I/VMAg=="; };
+"tiny-inflate@npm:1.0.3" = { filename = "tiny-inflate-npm-1.0.3-a7419a5c65-fab6875372.zip"; hash = "sha512-+raHU3JU9uxEyaLogASP5w2jVCq6KPc82j50yVyr80KjOTcvKmwDLjIjJPAazMA8omwEuiutmz64zz7pm7p/mw=="; };
+"typescript@npm:5.4.5" = { filename = "typescript-npm-5.4.5-8568a42232-2954022ada.zip"; hash = "sha512-KVQCKto0D9PWqeK45TT2XVfJLV85iaJjdUp4q6VJ9+ZSmswZIZE1YKS4FsRtzn30pNKfnxGj3A1CE7t20EMlHg=="; };
+"typescript@npm:7.0.2" = { filename = "typescript-npm-7.0.2-0bde2bcec5-3dcee51ec8.zip"; hash = "sha512-Pc7lHsjDMkkjJbzb999ItmZodR8SfmIq59QbbHFusZGEQkpF4U93UPUPNAIyOItp5ih4WRVfBqXOLfdvEssxzw=="; };
+"typescript@patch:typescript@npm%3A5.4.5#optional!builtin<compat/typescript>::version=5.4.5&hash=5adc0c" = { filename = "typescript-patch-6e159bfddb-db2ad2a16c.zip"; hash = "sha512-2yrSoWyoKfUEJ+6x2hVeekXlmO7HsIbYtOi6ROWiNfdY5gbWgcZpkiMNP8O4mVhl5f0LIqLJVIbQsyAPgwcuyQ=="; };
+"typescript@patch:typescript@npm%3A7.0.2#optional!builtin<compat/typescript>::version=7.0.2&hash=3bafbf" = { filename = "typescript-patch-4859cbaf66-6b3cdc369c.zip"; hash = "sha512-azzcNpzYKdRuAHNOpkIz7oRBnCglrY/kCJFa3ed6vO1LeiQB9+7VF9VKek9dHBhpdTy5kBjfHCFZx2HZ8zSDpg=="; };
+"undici-types@npm:7.18.2" = { filename = "undici-types-npm-7.18.2-3e6d69d829-85a7918911.zip"; hash = "sha512-haeRiRE6I4lZ16ZHNo5PfFVZw6QE69uPxEiBRc6UJvzYIlKoRKMCeY38Djfm+xeP9IHtA7xMr2NMV1fZ70NSHQ=="; };
+"unicode-properties@npm:1.4.1" = { filename = "unicode-properties-npm-1.4.1-122054452f-1d140b7945.zip"; hash = "sha512-HRQLeUVmT7DvU96VUXCCHgd7lJ7vN3xuSQWQLwfjOQOScb+ioAXk9MYHSwgNNCC0hsUtyQXhH5JJSaBNH7R//Q=="; };
+"unicode-trie@npm:2.0.0" = { filename = "unicode-trie-npm-2.0.0-54e0a4dd52-2422368645.zip"; hash = "sha512-JCI2hkUknzFWQKHJ6VBgRqp3OPycXVnhXCB83W7GYQHDWwufddw6wo/nvhmq8e/ImLvqB0+h6OKV73Nq63kEuw=="; };
+};
+
+in overriddenProject

yarn.lock

@@ -0,0 +1,522 @@
+# This file is generated by running "yarn install" inside your project.
+# Manual changes might be lost - proceed with caution!
+
+__metadata:
+  version: 10
+  cacheKey: 10c0
+
+"@bufbuild/protobuf@npm:2.14.1, @bufbuild/protobuf@npm:^2.12.1":
+  version: 2.14.1
+  resolution: "@bufbuild/protobuf@npm:2.14.1"
+  checksum: 10c0/3f913aca03df8419c4b21d800ea54d7f6c836a5343e65d6f686279ec3566c4907729938ef2f94a5e27d92e8d3f4adcd6e027118ba29ba764d21e1c637cddc702
+  languageName: node
+  linkType: hard
+
+"@bufbuild/protoc-gen-es@npm:^2.12.1":
+  version: 2.14.1
+  resolution: "@bufbuild/protoc-gen-es@npm:2.14.1"
+  dependencies:
+    "@bufbuild/protobuf": "npm:2.14.1"
+    "@bufbuild/protoplugin": "npm:2.14.1"
+  peerDependencies:
+    "@bufbuild/protobuf": 2.14.1
+  peerDependenciesMeta:
+    "@bufbuild/protobuf":
+      optional: true
+  bin:
+    protoc-gen-es: bin/protoc-gen-es
+  checksum: 10c0/79f9fad1d5665daa6d6549b2878a0f63febfadb187b8534083fbeb23861dc22cf3ea69a660a12f0f8e4fb3c02d24ee802f171844156de42fb4b1712e3a067569
+  languageName: node
+  linkType: hard
+
+"@bufbuild/protoplugin@npm:2.14.1":
+  version: 2.14.1
+  resolution: "@bufbuild/protoplugin@npm:2.14.1"
+  dependencies:
+    "@bufbuild/protobuf": "npm:2.14.1"
+    "@typescript/vfs": "npm:^1.6.2"
+    typescript: "npm:5.4.5"
+  checksum: 10c0/6a727aa5a848e05035ded90f50e13ae52c77357bad6a58476a56d4ff700dc813cac664e0cc30b5201354e5c158ebffeb00dc835316d66aa2c384a2e9daa5dfe3
+  languageName: node
+  linkType: hard
+
+"@quixos/quixos-protocol@workspace:.":
+  version: 0.0.0-use.local
+  resolution: "@quixos/quixos-protocol@workspace:."
+  dependencies:
+    "@bufbuild/protobuf": "npm:^2.12.1"
+    "@bufbuild/protoc-gen-es": "npm:^2.12.1"
+    "@types/node": "npm:^24"
+    antlr-ng: "npm:^1.0.10"
+    antlr4ng: "npm:^3.0.16"
+    typescript: "npm:^7.0.2"
+  bin:
+    quixos-capability-compile: dist/src/capability-language/cli.js
+    quixos-descriptor-check: dist/src/descriptor-check.js
+    quixos-lock-check: dist/src/resource-lock/cli.js
+    quixos-resource-compile: dist/src/capability-language/resource-cli.js
+    quixos-workspace-compile: dist/src/capability-language/workspace-cli.js
+  languageName: unknown
+  linkType: soft
+
+"@types/node@npm:^24":
+  version: 24.13.3
+  resolution: "@types/node@npm:24.13.3"
+  dependencies:
+    undici-types: "npm:~7.18.0"
+  checksum: 10c0/a5bc08f49b9581dcdca90e02cd77197a3c799840807664942e5cd5161a553d4d2ae8064f7e3294410d748d7d098b5c1848be7fa50c06f29c4193ab16be4e59eb
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-aix-ppc64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-aix-ppc64@npm:7.0.2"
+  conditions: os=aix & cpu=ppc64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-darwin-arm64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-darwin-arm64@npm:7.0.2"
+  conditions: os=darwin & cpu=arm64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-darwin-x64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-darwin-x64@npm:7.0.2"
+  conditions: os=darwin & cpu=x64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-freebsd-arm64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-freebsd-arm64@npm:7.0.2"
+  conditions: os=freebsd & cpu=arm64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-freebsd-x64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-freebsd-x64@npm:7.0.2"
+  conditions: os=freebsd & cpu=x64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-arm64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-arm64@npm:7.0.2"
+  conditions: os=linux & cpu=arm64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-arm@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-arm@npm:7.0.2"
+  conditions: os=linux & cpu=arm
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-loong64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-loong64@npm:7.0.2"
+  conditions: os=linux & cpu=loong64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-mips64el@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-mips64el@npm:7.0.2"
+  conditions: os=linux & cpu=mips64el
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-ppc64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-ppc64@npm:7.0.2"
+  conditions: os=linux & cpu=ppc64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-riscv64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-riscv64@npm:7.0.2"
+  conditions: os=linux & cpu=riscv64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-s390x@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-s390x@npm:7.0.2"
+  conditions: os=linux & cpu=s390x
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-linux-x64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-linux-x64@npm:7.0.2"
+  conditions: os=linux & cpu=x64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-netbsd-arm64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-netbsd-arm64@npm:7.0.2"
+  conditions: os=netbsd & cpu=arm64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-netbsd-x64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-netbsd-x64@npm:7.0.2"
+  conditions: os=netbsd & cpu=x64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-openbsd-arm64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-openbsd-arm64@npm:7.0.2"
+  conditions: os=openbsd & cpu=arm64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-openbsd-x64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-openbsd-x64@npm:7.0.2"
+  conditions: os=openbsd & cpu=x64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-sunos-x64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-sunos-x64@npm:7.0.2"
+  conditions: os=sunos & cpu=x64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-win32-arm64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-win32-arm64@npm:7.0.2"
+  conditions: os=win32 & cpu=arm64
+  languageName: node
+  linkType: hard
+
+"@typescript/typescript-win32-x64@npm:7.0.2":
+  version: 7.0.2
+  resolution: "@typescript/typescript-win32-x64@npm:7.0.2"
+  conditions: os=win32 & cpu=x64
+  languageName: node
+  linkType: hard
+
+"@typescript/vfs@npm:^1.6.2":
+  version: 1.6.4
+  resolution: "@typescript/vfs@npm:1.6.4"
+  dependencies:
+    debug: "npm:^4.4.3"
+  peerDependencies:
+    typescript: "*"
+  checksum: 10c0/acb9de42f23fda3f75e3d7900ba106ef323a2f4e7cf0e4a94dbb457e26d353ca63bb35193ed1a32fc8733f3ae59099612b290b06bd6221694861beb9bfb62f62
+  languageName: node
+  linkType: hard
+
+"antlr-ng@npm:^1.0.10":
+  version: 1.0.10
+  resolution: "antlr-ng@npm:1.0.10"
+  dependencies:
+    antlr4ng: "npm:3.0.16"
+    commander: "npm:13.1.0"
+    stringtemplate4ts: "npm:1.0.9"
+    unicode-properties: "npm:1.4.1"
+  bin:
+    antlr-ng: dist/cli/runner.js
+    grun: dist/cli/TestRig.js
+    interpreter: dist/cli/Interpreter.js
+    testrig: dist/cli/TestRig.js
+  checksum: 10c0/0893eda0fdcce1d329c18ca451ac68ef3740fa93a7212ab972aeba6c33722c9be72f576a37971a90e4e7252bbadb8d559c0887f3258fafea59b4996c6fef4fea
+  languageName: node
+  linkType: hard
+
+"antlr4ng@npm:3.0.15":
+  version: 3.0.15
+  resolution: "antlr4ng@npm:3.0.15"
+  checksum: 10c0/75421480b99601c0ae1741e4147b85e24e9e82236ec354c51fbe50b2d85d7137894405b4748939c47e720800bd19c0a19006b8f68fb5e01836c717fabda68b5c
+  languageName: node
+  linkType: hard
+
+"antlr4ng@npm:3.0.16, antlr4ng@npm:^3.0.16":
+  version: 3.0.16
+  resolution: "antlr4ng@npm:3.0.16"
+  checksum: 10c0/01b51d1d73ca12f22dfcf723ba3d769f47b02c32618bc729e3bd227334fa154a0a40b16b0e3d1f245fa5756bf4ebbb94deb296a23d73f052dc90be6a2c477d11
+  languageName: node
+  linkType: hard
+
+"base64-js@npm:^1.3.0":
+  version: 1.5.1
+  resolution: "base64-js@npm:1.5.1"
+  checksum: 10c0/f23823513b63173a001030fae4f2dabe283b99a9d324ade3ad3d148e218134676f1ee8568c877cd79ec1c53158dcf2d2ba527a97c606618928ba99dd930102bf
+  languageName: node
+  linkType: hard
+
+"commander@npm:13.1.0":
+  version: 13.1.0
+  resolution: "commander@npm:13.1.0"
+  checksum: 10c0/7b8c5544bba704fbe84b7cab2e043df8586d5c114a4c5b607f83ae5060708940ed0b5bd5838cf8ce27539cde265c1cbd59ce3c8c6b017ed3eec8943e3a415164
+  languageName: node
+  linkType: hard
+
+"debug@npm:^4.4.3":
+  version: 4.4.3
+  resolution: "debug@npm:4.4.3"
+  dependencies:
+    ms: "npm:^2.1.3"
+  peerDependenciesMeta:
+    supports-color:
+      optional: true
+  checksum: 10c0/d79136ec6c83ecbefd0f6a5593da6a9c91ec4d7ddc4b54c883d6e71ec9accb5f67a1a5e96d00a328196b5b5c86d365e98d8a3a70856aaf16b4e7b1985e67f5a6
+  languageName: node
+  linkType: hard
+
+"fast-printf@npm:1.6.10":
+  version: 1.6.10
+  resolution: "fast-printf@npm:1.6.10"
+  checksum: 10c0/630cccbef8349a6eeada9958c9391e9d14b5bd9527dd28d9e7e9f295b006c640ddca8fc2470cff55ea5c6c92ca530488bbadbf7c24f4852ad8c34d9155da9d75
+  languageName: node
+  linkType: hard
+
+"he@npm:1.2.0":
+  version: 1.2.0
+  resolution: "he@npm:1.2.0"
+  bin:
+    he: bin/he
+  checksum: 10c0/a27d478befe3c8192f006cdd0639a66798979dfa6e2125c6ac582a19a5ebfec62ad83e8382e6036170d873f46e4536a7e795bf8b95bf7c247f4cc0825ccc8c17
+  languageName: node
+  linkType: hard
+
+"luxon@npm:3.5.0":
+  version: 3.5.0
+  resolution: "luxon@npm:3.5.0"
+  checksum: 10c0/335789bba95077db831ef99894edadeb23023b3eb2137a1b56acd0d290082b691cf793143d69e30bc069ec95f0b49f36419f48e951c68014f19ffe12045e3494
+  languageName: node
+  linkType: hard
+
+"ms@npm:^2.1.3":
+  version: 2.1.3
+  resolution: "ms@npm:2.1.3"
+  checksum: 10c0/d924b57e7312b3b63ad21fc5b3dc0af5e78d61a1fc7cfb5457edaf26326bf62be5307cc87ffb6862ef1c2b33b0233cdb5d4f01c4c958cc0d660948b65a287a48
+  languageName: node
+  linkType: hard
+
+"pako@npm:^0.2.5":
+  version: 0.2.9
+  resolution: "pako@npm:0.2.9"
+  checksum: 10c0/79c1806ebcf325b60ae599e4d7227c2e346d7b829dc20f5cf24cef07c934079dc3a61c5b3c8278a2f7a190c4a613e343ea11e5302dbe252efd11712df4b6b041
+  languageName: node
+  linkType: hard
+
+"stringtemplate4ts@npm:1.0.9":
+  version: 1.0.9
+  resolution: "stringtemplate4ts@npm:1.0.9"
+  dependencies:
+    antlr4ng: "npm:3.0.15"
+    fast-printf: "npm:1.6.10"
+    he: "npm:1.2.0"
+    luxon: "npm:3.5.0"
+  checksum: 10c0/c5f46367d0375c1a7caf20b86190842f4aeffb543d768b2270dfd3c5e42c4dcf49901c02a7b068c08e8c4440c02a202908594ebcedbed0f5e894703d23f54c02
+  languageName: node
+  linkType: hard
+
+"tiny-inflate@npm:^1.0.0":
+  version: 1.0.3
+  resolution: "tiny-inflate@npm:1.0.3"
+  checksum: 10c0/fab687537254f6ec44c9a2e880048fe70da3542aba28f73cda3e74c95cabf342a339372f2a6c032e322324f01accc03ca26c04ba2bad9b3eb8cf3ee99bba7f9b
+  languageName: node
+  linkType: hard
+
+"typescript@npm:5.4.5":
+  version: 5.4.5
+  resolution: "typescript@npm:5.4.5"
+  bin:
+    tsc: bin/tsc
+    tsserver: bin/tsserver
+  checksum: 10c0/2954022ada340fd3d6a9e2b8e534f65d57c92d5f3989a263754a78aba549f7e6529acc1921913560a4b816c46dce7df4a4d29f9f11a3dc0d4213bb76d043251e
+  languageName: node
+  linkType: hard
+
+"typescript@npm:^7.0.2":
+  version: 7.0.2
+  resolution: "typescript@npm:7.0.2"
+  dependencies:
+    "@typescript/typescript-aix-ppc64": "npm:7.0.2"
+    "@typescript/typescript-darwin-arm64": "npm:7.0.2"
+    "@typescript/typescript-darwin-x64": "npm:7.0.2"
+    "@typescript/typescript-freebsd-arm64": "npm:7.0.2"
+    "@typescript/typescript-freebsd-x64": "npm:7.0.2"
+    "@typescript/typescript-linux-arm": "npm:7.0.2"
+    "@typescript/typescript-linux-arm64": "npm:7.0.2"
+    "@typescript/typescript-linux-loong64": "npm:7.0.2"
+    "@typescript/typescript-linux-mips64el": "npm:7.0.2"
+    "@typescript/typescript-linux-ppc64": "npm:7.0.2"
+    "@typescript/typescript-linux-riscv64": "npm:7.0.2"
+    "@typescript/typescript-linux-s390x": "npm:7.0.2"
+    "@typescript/typescript-linux-x64": "npm:7.0.2"
+    "@typescript/typescript-netbsd-arm64": "npm:7.0.2"
+    "@typescript/typescript-netbsd-x64": "npm:7.0.2"
+    "@typescript/typescript-openbsd-arm64": "npm:7.0.2"
+    "@typescript/typescript-openbsd-x64": "npm:7.0.2"
+    "@typescript/typescript-sunos-x64": "npm:7.0.2"
+    "@typescript/typescript-win32-arm64": "npm:7.0.2"
+    "@typescript/typescript-win32-x64": "npm:7.0.2"
+  dependenciesMeta:
+    "@typescript/typescript-aix-ppc64":
+      optional: true
+    "@typescript/typescript-darwin-arm64":
+      optional: true
+    "@typescript/typescript-darwin-x64":
+      optional: true
+    "@typescript/typescript-freebsd-arm64":
+      optional: true
+    "@typescript/typescript-freebsd-x64":
+      optional: true
+    "@typescript/typescript-linux-arm":
+      optional: true
+    "@typescript/typescript-linux-arm64":
+      optional: true
+    "@typescript/typescript-linux-loong64":
+      optional: true
+    "@typescript/typescript-linux-mips64el":
+      optional: true
+    "@typescript/typescript-linux-ppc64":
+      optional: true
+    "@typescript/typescript-linux-riscv64":
+      optional: true
+    "@typescript/typescript-linux-s390x":
+      optional: true
+    "@typescript/typescript-linux-x64":
+      optional: true
+    "@typescript/typescript-netbsd-arm64":
+      optional: true
+    "@typescript/typescript-netbsd-x64":
+      optional: true
+    "@typescript/typescript-openbsd-arm64":
+      optional: true
+    "@typescript/typescript-openbsd-x64":
+      optional: true
+    "@typescript/typescript-sunos-x64":
+      optional: true
+    "@typescript/typescript-win32-arm64":
+      optional: true
+    "@typescript/typescript-win32-x64":
+      optional: true
+  bin:
+    tsc: bin/tsc
+  checksum: 10c0/3dcee51ec8c332492325bcdbf7df48b66668751f127e622ae7d41b6c716eb19184424a45e14f7750f50f340232388b69e6287859155f06a5ce2df76f12cb31cf
+  languageName: node
+  linkType: hard
+
+"typescript@patch:typescript@npm%3A5.4.5#optional!builtin<compat/typescript>":
+  version: 5.4.5
+  resolution: "typescript@patch:typescript@npm%3A5.4.5#optional!builtin<compat/typescript>::version=5.4.5&hash=5adc0c"
+  bin:
+    tsc: bin/tsc
+    tsserver: bin/tsserver
+  checksum: 10c0/db2ad2a16ca829f50427eeb1da155e7a45e598eec7b086d8b4e8ba44e5a235f758e606d681c66992230d3fc3b8995865e5fd0b22a2c95486d0b3200f83072ec9
+  languageName: node
+  linkType: hard
+
+"typescript@patch:typescript@npm%3A^7.0.2#optional!builtin<compat/typescript>":
+  version: 7.0.2
+  resolution: "typescript@patch:typescript@npm%3A7.0.2#optional!builtin<compat/typescript>::version=7.0.2&hash=3bafbf"
+  dependencies:
+    "@typescript/typescript-aix-ppc64": "npm:7.0.2"
+    "@typescript/typescript-darwin-arm64": "npm:7.0.2"
+    "@typescript/typescript-darwin-x64": "npm:7.0.2"
+    "@typescript/typescript-freebsd-arm64": "npm:7.0.2"
+    "@typescript/typescript-freebsd-x64": "npm:7.0.2"
+    "@typescript/typescript-linux-arm": "npm:7.0.2"
+    "@typescript/typescript-linux-arm64": "npm:7.0.2"
+    "@typescript/typescript-linux-loong64": "npm:7.0.2"
+    "@typescript/typescript-linux-mips64el": "npm:7.0.2"
+    "@typescript/typescript-linux-ppc64": "npm:7.0.2"
+    "@typescript/typescript-linux-riscv64": "npm:7.0.2"
+    "@typescript/typescript-linux-s390x": "npm:7.0.2"
+    "@typescript/typescript-linux-x64": "npm:7.0.2"
+    "@typescript/typescript-netbsd-arm64": "npm:7.0.2"
+    "@typescript/typescript-netbsd-x64": "npm:7.0.2"
+    "@typescript/typescript-openbsd-arm64": "npm:7.0.2"
+    "@typescript/typescript-openbsd-x64": "npm:7.0.2"
+    "@typescript/typescript-sunos-x64": "npm:7.0.2"
+    "@typescript/typescript-win32-arm64": "npm:7.0.2"
+    "@typescript/typescript-win32-x64": "npm:7.0.2"
+  dependenciesMeta:
+    "@typescript/typescript-aix-ppc64":
+      optional: true
+    "@typescript/typescript-darwin-arm64":
+      optional: true
+    "@typescript/typescript-darwin-x64":
+      optional: true
+    "@typescript/typescript-freebsd-arm64":
+      optional: true
+    "@typescript/typescript-freebsd-x64":
+      optional: true
+    "@typescript/typescript-linux-arm":
+      optional: true
+    "@typescript/typescript-linux-arm64":
+      optional: true
+    "@typescript/typescript-linux-loong64":
+      optional: true
+    "@typescript/typescript-linux-mips64el":
+      optional: true
+    "@typescript/typescript-linux-ppc64":
+      optional: true
+    "@typescript/typescript-linux-riscv64":
+      optional: true
+    "@typescript/typescript-linux-s390x":
+      optional: true
+    "@typescript/typescript-linux-x64":
+      optional: true
+    "@typescript/typescript-netbsd-arm64":
+      optional: true
+    "@typescript/typescript-netbsd-x64":
+      optional: true
+    "@typescript/typescript-openbsd-arm64":
+      optional: true
+    "@typescript/typescript-openbsd-x64":
+      optional: true
+    "@typescript/typescript-sunos-x64":
+      optional: true
+    "@typescript/typescript-win32-arm64":
+      optional: true
+    "@typescript/typescript-win32-x64":
+      optional: true
+  bin:
+    tsc: bin/tsc
+  checksum: 10c0/6b3cdc369cd829d46e00734ea64233ee84419c2825ad8fe408915adde77abced4b7a2401f7eed517d54a7a4f5d1c1869753cb99018df1c2159c761d9f33483a6
+  languageName: node
+  linkType: hard
+
+"undici-types@npm:~7.18.0":
+  version: 7.18.2
+  resolution: "undici-types@npm:7.18.2"
+  checksum: 10c0/85a79189113a238959d7a647368e4f7c5559c3a404ebdb8fc4488145ce9426fcd82252a844a302798dfc0e37e6fb178ff481ed03bc4caf634c5757d9ef43521d
+  languageName: node
+  linkType: hard
+
+"unicode-properties@npm:1.4.1":
+  version: 1.4.1
+  resolution: "unicode-properties@npm:1.4.1"
+  dependencies:
+    base64-js: "npm:^1.3.0"
+    unicode-trie: "npm:^2.0.0"
+  checksum: 10c0/1d140b7945664fb0ef53de955170821e077b949eef377c6e4905902f07e339039271bfa2a005e4f4c6074b080d3420b486c52dc905e11f924949a04d1fb47ffd
+  languageName: node
+  linkType: hard
+
+"unicode-trie@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "unicode-trie@npm:2.0.0"
+  dependencies:
+    pako: "npm:^0.2.5"
+    tiny-inflate: "npm:^1.0.0"
+  checksum: 10c0/2422368645249f315640a1c9e9506046aa7738fc9c5d59e15c207cdd6ec66101c35b0b9f75dc3ac28fe7be19aaf1efc898bbea074fa1e8e295ef736aeb7904bb
+  languageName: node
+  linkType: hard