@dynamicalsystems/idl 0.9.0 → 0.11.0

package/src/core/google-identity.v1.ts

@@ -0,0 +1,42 @@
+// dsg.core.google-identity/1
+// Owner: dsg-kernel. A verified Google identity, as the kernel sees it:
+// the Google account number is the only identity key and the email
+// address is a display label. The kernel carries googleSubject in the
+// shape "accounts.google.com:<digits>" and never compares email for
+// identity after the claim.
+//
+// This profile ships beside dsg.core.identity-binding/1, which remains
+// the frozen shape of the detached personal-key binding path. The real
+// authority is Google-attested, so a separate profile names what a
+// verified identity looks like on the wire today.
+//
+// googleSubject is required, email is optional. hostedDomain is set
+// when the verified token carries the hd claim; absent is its own
+// meaning, not the same as a missing value. audience is the client id
+// the token was minted for and is required.
+import { type Static, Type } from "@sinclair/typebox";
+import { closed, NonEmptyString, type ProfileEntry } from "../primitives.js";
+
+export const GOOGLE_IDENTITY_PROFILE = "dsg.core.google-identity/1" as const;
+export const GOOGLE_SIGN_IN_ISSUER = "https://accounts.google.com" as const;
+
+const GoogleAccountSubject = Type.String({
+  pattern: "^accounts\\.google\\.com:[0-9]+$",
+});
+
+const GoogleIdentitySchemaValue = closed({
+  profile: Type.Literal(GOOGLE_IDENTITY_PROFILE),
+  issuer: Type.Literal(GOOGLE_SIGN_IN_ISSUER),
+  googleSubject: GoogleAccountSubject,
+  audience: NonEmptyString,
+  hostedDomain: Type.Optional(NonEmptyString),
+  email: Type.Optional(NonEmptyString),
+});
+export const GoogleIdentitySchema: typeof GoogleIdentitySchemaValue = GoogleIdentitySchemaValue;
+export type GoogleIdentity = Static<typeof GoogleIdentitySchema>;
+
+export const googleIdentityV1: ProfileEntry = {
+  literal: GOOGLE_IDENTITY_PROFILE,
+  rootDocument: "googleIdentity",
+  documents: { googleIdentity: GoogleIdentitySchema },
+};

package/src/core/identity-binding.v1.ts

@@ -21,6 +21,6 @@ export type IdentityBinding = Static<typeof IdentityBindingSchema>;
 
 export const identityBindingV1: ProfileEntry = {
   literal: IDENTITY_BINDING_PROFILE,
-  rootShape: "binding",
-  shapes: { binding: IdentityBindingSchema },
+  rootDocument: "binding",
+  documents: { binding: IdentityBindingSchema },
 };

package/src/core/refusal.v1.ts

@@ -40,6 +40,6 @@ export type Refusal = Static<typeof RefusalSchema>;
 
 export const refusalV1: ProfileEntry = {
   literal: REFUSAL_PROFILE,
-  rootShape: "refusal",
-  shapes: { refusal: RefusalSchema },
+  rootDocument: "refusal",
+  documents: { refusal: RefusalSchema },
 };

package/src/core/refusal.v2.ts

@@ -3,6 +3,14 @@
 // requires: a validator that cannot answer fails closed and says so, and a
 // human confirmation outside its window is its own refusal, not a generic
 // expiry. /1 is frozen; this ships beside it.
+//
+// `stage` and `correlationId` are optional additions (2026-09-11): the
+// system has not shipped, so this profile amends in place rather than
+// spawning a /3 for two backward-compatible optional fields. An existing
+// non-proxy refusal carries neither. A proxy hop (dsg-run-console) always
+// sends both: `stage: "proxy"` names which hop answered, `correlationId`
+// is the proxy's own request id, replacing the `X-DSG-Refusal-Stage` /
+// `X-Request-ID` header detour with in-body fields the same schema covers.
 import { type Static, Type } from "@sinclair/typebox";
 import { closed, NonEmptyString, type ProfileEntry } from "../primitives.js";
 
@@ -32,16 +40,27 @@ const RefusalCodeV2SchemaValue = Type.Union([
 export const RefusalCodeV2Schema: typeof RefusalCodeV2SchemaValue = RefusalCodeV2SchemaValue;
 export type RefusalCodeV2 = Static<typeof RefusalCodeV2Schema>;
 
+const RefusalStageV2SchemaValue = Type.Union([
+  Type.Literal("proxy"),
+  Type.Literal("provider"),
+  Type.Literal("identity_read"),
+  Type.Literal("plane"),
+]);
+export const RefusalStageV2Schema: typeof RefusalStageV2SchemaValue = RefusalStageV2SchemaValue;
+export type RefusalStageV2 = Static<typeof RefusalStageV2Schema>;
+
 const RefusalV2SchemaValue = closed({
   profile: Type.Literal(REFUSAL_V2_PROFILE),
   code: RefusalCodeV2Schema,
   sentence: NonEmptyString,
+  stage: Type.Optional(RefusalStageV2Schema),
+  correlationId: Type.Optional(NonEmptyString),
 });
 export const RefusalV2Schema: typeof RefusalV2SchemaValue = RefusalV2SchemaValue;
 export type RefusalV2 = Static<typeof RefusalV2Schema>;
 
 export const refusalV2: ProfileEntry = {
   literal: REFUSAL_V2_PROFILE,
-  rootShape: "refusal",
-  shapes: { refusal: RefusalV2Schema },
+  rootDocument: "refusal",
+  documents: { refusal: RefusalV2Schema },
 };

package/src/core/refusal.v3.ts

@@ -0,0 +1,50 @@
+// Normalized organization refusal. HTTP adapters preserve code as their
+// reason field; their transport envelopes are documented separately.
+// Dependency outages are not verdicts about a person.
+import { type Static, Type } from "@sinclair/typebox";
+import { closed, NonEmptyString, type ProfileEntry } from "../primitives.js";
+
+export const REFUSAL_V3_PROFILE = "dsg.core.refusal/3" as const;
+
+const RefusalCodeV3SchemaValue = Type.Union([
+  Type.Literal("organization_absent"),
+  Type.Literal("organization_exists"),
+  Type.Literal("domain_mismatch"),
+  Type.Literal("suspended"),
+  Type.Literal("organization_disabled"),
+  Type.Literal("claims_missing"),
+  Type.Literal("not_qualified"),
+  Type.Literal("subject_conflict"),
+]);
+export const RefusalCodeV3Schema: typeof RefusalCodeV3SchemaValue = RefusalCodeV3SchemaValue;
+export type RefusalCodeV3 = Static<typeof RefusalCodeV3Schema>;
+
+const RefusalStageV3SchemaValue = Type.Union([
+  Type.Literal("proxy"),
+  Type.Literal("provider"),
+  Type.Literal("identity_read"),
+  Type.Literal("plane"),
+  Type.Literal("console"),
+  Type.Literal("kernel"),
+  Type.Literal("record"),
+  Type.Literal("claim"),
+]);
+export const RefusalStageV3Schema: typeof RefusalStageV3SchemaValue = RefusalStageV3SchemaValue;
+export type RefusalStageV3 = Static<typeof RefusalStageV3Schema>;
+
+const RefusalV3SchemaValue = closed({
+  profile: Type.Literal(REFUSAL_V3_PROFILE),
+  code: RefusalCodeV3Schema,
+  sentence: NonEmptyString,
+  stage: Type.Optional(RefusalStageV3Schema),
+  correlationId: Type.Optional(NonEmptyString),
+  detail: Type.Optional(NonEmptyString),
+});
+export const RefusalV3Schema: typeof RefusalV3SchemaValue = RefusalV3SchemaValue;
+export type RefusalV3 = Static<typeof RefusalV3Schema>;
+
+export const refusalV3: ProfileEntry = {
+  literal: REFUSAL_V3_PROFILE,
+  rootDocument: "refusal",
+  documents: { refusal: RefusalV3Schema },
+};

package/src/index.ts

@@ -131,13 +131,27 @@ export {
 export type { RunSummary, RunSummaryDecision } from "./run/run-summary.v1.js";
 export { REFUSAL_PROFILE, RefusalCodeSchema, RefusalSchema } from "./core/refusal.v1.js";
 export type { Refusal, RefusalCode } from "./core/refusal.v1.js";
-export { REFUSAL_V2_PROFILE, RefusalCodeV2Schema, RefusalV2Schema } from "./core/refusal.v2.js";
-export type { RefusalCodeV2, RefusalV2 } from "./core/refusal.v2.js";
 export {
+  REFUSAL_V2_PROFILE,
+  RefusalCodeV2Schema,
+  RefusalStageV2Schema,
+  RefusalV2Schema,
+} from "./core/refusal.v2.js";
+export type { RefusalCodeV2, RefusalStageV2, RefusalV2 } from "./core/refusal.v2.js";
+export {
+  GOOGLE_IDENTITY_PROFILE,
   GOOGLE_SIGN_IN_ISSUER,
-  IDENTITY_BINDING_PROFILE,
-  IdentityBindingSchema,
-} from "./core/identity-binding.v1.js";
+  GoogleIdentitySchema,
+} from "./core/google-identity.v1.js";
+export type { GoogleIdentity } from "./core/google-identity.v1.js";
+export {
+  REFUSAL_V3_PROFILE,
+  RefusalCodeV3Schema,
+  RefusalStageV3Schema,
+  RefusalV3Schema,
+} from "./core/refusal.v3.js";
+export type { RefusalCodeV3, RefusalStageV3, RefusalV3 } from "./core/refusal.v3.js";
+export { IDENTITY_BINDING_PROFILE, IdentityBindingSchema } from "./core/identity-binding.v1.js";
 export type { IdentityBinding } from "./core/identity-binding.v1.js";
 
 import type { ProfileEntry } from "./primitives.js";
@@ -149,6 +163,8 @@ import { decisionV1 } from "./run/decision.v1.js";
 import { runSummaryV1 } from "./run/run-summary.v1.js";
 import { refusalV1 } from "./core/refusal.v1.js";
 import { refusalV2 } from "./core/refusal.v2.js";
+import { refusalV3 } from "./core/refusal.v3.js";
+import { googleIdentityV1 } from "./core/google-identity.v1.js";
 import { identityBindingV1 } from "./core/identity-binding.v1.js";
 import { signedLawV1 } from "./infra/signed-law.v1.js";
 import { resourceDescriptorV1 } from "./infra/resource-descriptor.v1.js";
@@ -157,12 +173,11 @@ import { revocationsV1 } from "./registry/revocations.v1.js";
 import { bootstrapV1 } from "./kernel/bootstrap.v1.js";
 import { ordinaryAuthorityV1 } from "./kernel/ordinary-authority.v1.js";
 import { standingOrderActivationV1 } from "./kernel/standing-order-activation.v1.js";
-
 /** Every profile this version of the package defines, keyed by literal.
  * Profile modules are added here as they are extracted; the rules test
  * and the schema emitter walk this registry, so a module that is not
  * registered does not exist. */
-export const PROFILES: Readonly<Record<string, ProfileEntry>> = {
+export const PROFILES = {
   [dispatchConsumeV1.literal]: dispatchConsumeV1,
   [operationV1.literal]: operationV1,
   [eventV1.literal]: eventV1,
@@ -171,6 +186,8 @@ export const PROFILES: Readonly<Record<string, ProfileEntry>> = {
   [runSummaryV1.literal]: runSummaryV1,
   [refusalV1.literal]: refusalV1,
   [refusalV2.literal]: refusalV2,
+  [refusalV3.literal]: refusalV3,
+  [googleIdentityV1.literal]: googleIdentityV1,
   [identityBindingV1.literal]: identityBindingV1,
   [signedLawV1.literal]: signedLawV1,
   [resourceDescriptorV1.literal]: resourceDescriptorV1,
@@ -179,4 +196,4 @@ export const PROFILES: Readonly<Record<string, ProfileEntry>> = {
   [bootstrapV1.literal]: bootstrapV1,
   [ordinaryAuthorityV1.literal]: ordinaryAuthorityV1,
   [standingOrderActivationV1.literal]: standingOrderActivationV1,
-};
+} satisfies Readonly<Record<string, ProfileEntry>>;

package/src/infra/adoption-fact.v1.ts

@@ -42,6 +42,6 @@ export type AdoptionFact = Static<typeof AdoptionFactSchema>;
 
 export const adoptionFactV1: ProfileEntry = {
   literal: ADOPTION_FACT_PROFILE,
-  rootShape: "fact",
-  shapes: { fact: AdoptionFactSchema },
+  rootDocument: "fact",
+  documents: { fact: AdoptionFactSchema },
 };

package/src/infra/resource-descriptor.v1.ts

@@ -53,6 +53,6 @@ export const resourceDescriptorV1: ProfileEntry = {
   literal: RESOURCE_DESCRIPTOR_PROFILE,
   literalNote:
     "carried as kind (unversioned) plus schemaVersion on the document; the /1 literal is the version marker signed-law pins",
-  rootShape: "descriptor",
-  shapes: { descriptor: ResourceDescriptorSchema },
+  rootDocument: "descriptor",
+  documents: { descriptor: ResourceDescriptorSchema },
 };

package/src/infra/signed-law.v1.ts

@@ -273,5 +273,5 @@ export const signedLawV1: ProfileEntry = {
   literal: SIGNED_LAW_PROFILE,
   literalNote:
     "carried as the domain member of the canonical signature input, not as a bundle field",
-  shapes: { bundle: SignedLawBundleSchema },
+  documents: { bundle: SignedLawBundleSchema },
 };

package/src/kernel/bootstrap.v1.ts

@@ -64,5 +64,5 @@ export type SignedBootstrapIntent = Static<typeof SignedBootstrapIntentSchema>;
 
 export const bootstrapV1: ProfileEntry = {
   literal: BOOTSTRAP_PROFILE,
-  shapes: { intent: BootstrapIntentSchema, signed: SignedBootstrapIntentSchema },
+  documents: { intent: BootstrapIntentSchema, signed: SignedBootstrapIntentSchema },
 };

package/src/kernel/dispatch-consume.v1.ts

@@ -106,7 +106,7 @@ export type DispatchRefusal = Static<typeof DispatchRefusalSchema>;
 
 export const dispatchConsumeV1: ProfileEntry = {
   literal: DISPATCH_CONSUME_PROFILE,
-  shapes: {
+  documents: {
     request: DispatchConsumeRequestSchema,
     lease: DispatchLeaseSchema,
     refusal: DispatchRefusalSchema,

package/src/kernel/ordinary-authority.v1.ts

@@ -48,6 +48,6 @@ export type OrdinaryAuthority = Static<typeof OrdinaryAuthoritySchema>;
 
 export const ordinaryAuthorityV1: ProfileEntry = {
   literal: ORDINARY_AUTHORITY_PROFILE,
-  rootShape: "authority",
-  shapes: { authority: OrdinaryAuthoritySchema },
+  rootDocument: "authority",
+  documents: { authority: OrdinaryAuthoritySchema },
 };

package/src/kernel/standing-order-activation.v1.ts

@@ -63,8 +63,8 @@ export type SignedStandingOrderActivation = Static<typeof SignedStandingOrderAct
 
 export const standingOrderActivationV1: ProfileEntry = {
   literal: STANDING_ORDER_ACTIVATION_PROFILE,
-  rootShape: "event",
-  shapes: {
+  rootDocument: "event",
+  documents: {
     activation: StandingOrderActivationSchema,
     signed: SignedStandingOrderActivationSchema,
     event: StandingOrderActivationEventSchema,

package/src/primitives.ts

@@ -46,12 +46,12 @@ export const PersonReference = closed({
  * "lease", "refusal"); vectors address a shape as "<literal>#<shape>". */
 export type ProfileEntry = {
   readonly literal: `dsg.${string}.${string}/${number}`;
-  readonly shapes: Readonly<Record<string, TSchema>>;
+  readonly documents: Readonly<Record<string, TSchema>>;
   /** Set ONLY when the wire cannot carry the literal as a field of any
    * shape (a frozen /1); names exactly where the literal lives instead. */
   readonly literalNote?: string;
   /** Names the shape non-TS consumers validate a whole document against;
    * the emitted JSON Schema gains a root $ref to it. Only meaningful for
    * profiles with a single document root. */
-  readonly rootShape?: string;
+  readonly rootDocument?: string;
 };

package/src/registry/revocations.v1.ts

@@ -83,5 +83,5 @@ export type RevocationPointer = Static<typeof RevocationPointerSchema>;
 
 export const revocationsV1: ProfileEntry = {
   literal: REVOCATIONS_PROFILE,
-  shapes: { snapshot: RevocationSchema, pointer: RevocationPointerSchema },
+  documents: { snapshot: RevocationSchema, pointer: RevocationPointerSchema },
 };

package/src/run/decision.v1.ts

@@ -22,6 +22,6 @@ export type RunDecision = Static<typeof RunDecisionSchema>;
 
 export const decisionV1: ProfileEntry = {
   literal: DECISION_PROFILE,
-  rootShape: "decision",
-  shapes: { decision: RunDecisionSchema },
+  rootDocument: "decision",
+  documents: { decision: RunDecisionSchema },
 };

package/src/run/event.v1.ts

@@ -90,6 +90,6 @@ export type EventStreamSeal = Static<typeof EventStreamSealSchema>;
 
 export const eventV1: ProfileEntry = {
   literal: EVENT_PROFILE,
-  rootShape: "event",
-  shapes: { event: EventSchema, streamSeal: EventStreamSealSchema },
+  rootDocument: "event",
+  documents: { event: EventSchema, streamSeal: EventStreamSealSchema },
 };

package/src/run/operation.v1.ts

@@ -150,7 +150,7 @@ export type OperationStatus = Readback;
 
 export const operationV1: ProfileEntry = {
   literal: OPERATION_PROFILE,
-  shapes: {
+  documents: {
     request: OperationRequestSchema,
     accepted: AcceptedSchema,
     readback: ReadbackSchema,

package/src/run/request.v1.ts

@@ -45,6 +45,6 @@ export type RunRequest = Static<typeof RunRequestSchema>;
 
 export const requestV1: ProfileEntry = {
   literal: REQUEST_PROFILE,
-  rootShape: "request",
-  shapes: { request: RunRequestSchema },
+  rootDocument: "request",
+  documents: { request: RunRequestSchema },
 };

package/src/run/run-summary.v1.ts

@@ -37,6 +37,6 @@ export type RunSummary = Static<typeof RunSummarySchema>;
 
 export const runSummaryV1: ProfileEntry = {
   literal: RUN_SUMMARY_PROFILE,
-  rootShape: "summary",
-  shapes: { summary: RunSummarySchema },
+  rootDocument: "summary",
+  documents: { summary: RunSummarySchema },
 };