@githolon/dsl 0.100.4 → 0.100.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.100.4",
+  "version": "0.100.5",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/birth_meter_ensure.ts

@@ -32,8 +32,13 @@ import {
 } from "./birth_meter.js";
 import {
   reclaimChild,
+  reclaimChildAsAdmin,
+  reclaimChildAsAdminRequiresRetired,
   reclaimChildRequiresRetired,
   retireChild,
+  retireChildAsAdmin,
+  retireChildAsAdminNotReclaimed,
+  retireChildAsAdminRequiresBirth,
   retireChildRequiresBirth,
   retireChildNotReclaimed,
 } from "./framework/birth_meter.js";
@@ -82,8 +87,19 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   if (!("BirthGrant" in out)) out["BirthGrant"] = presented(BirthGrant);
   if (!("retireChild" in out)) out["retireChild"] = presented(retireChild);
   if (!("reclaimChild" in out)) out["reclaimChild"] = presented(reclaimChild);
+  if (!("retireChildAsAdmin" in out)) out["retireChildAsAdmin"] = presented(retireChildAsAdmin);
+  if (!("reclaimChildAsAdmin" in out)) out["reclaimChildAsAdmin"] = presented(reclaimChildAsAdmin);
   if (!("reclaimChildRequiresRetired" in out)) out["reclaimChildRequiresRetired"] = reclaimChildRequiresRetired;
+  if (!("reclaimChildAsAdminRequiresRetired" in out)) {
+    out["reclaimChildAsAdminRequiresRetired"] = reclaimChildAsAdminRequiresRetired;
+  }
   if (!("retireChildRequiresBirth" in out)) out["retireChildRequiresBirth"] = retireChildRequiresBirth;
   if (!("retireChildNotReclaimed" in out)) out["retireChildNotReclaimed"] = retireChildNotReclaimed;
+  if (!("retireChildAsAdminRequiresBirth" in out)) {
+    out["retireChildAsAdminRequiresBirth"] = retireChildAsAdminRequiresBirth;
+  }
+  if (!("retireChildAsAdminNotReclaimed" in out)) {
+    out["retireChildAsAdminNotReclaimed"] = retireChildAsAdminNotReclaimed;
+  }
   return out as M;
 }

package/src/build_package.ts

@@ -82,7 +82,10 @@ import { assertIdOfLint } from "./idof_lint.js";
 import { assertSurfacedResolvers } from "./surfaced_lint.js";
 import { expandBusinessBirthExports } from "./business_birth.js";
 import {
+  reclaimChildAsAdminRequiresRetired,
   reclaimChildRequiresRetired,
+  retireChildAsAdminNotReclaimed,
+  retireChildAsAdminRequiresBirth,
   retireChildNotReclaimed,
   retireChildRequiresBirth,
 } from "./framework/birth_meter.js";
@@ -316,7 +319,14 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const workspaceInvariants = [...(spec.workspaceInvariants ?? [])];
   if (declaresBirth) {
     const haveInvariant = new Set(workspaceInvariants.map((w) => w.id));
-    for (const lifecycle of [reclaimChildRequiresRetired, retireChildNotReclaimed, retireChildRequiresBirth]) {
+    for (const lifecycle of [
+      reclaimChildRequiresRetired,
+      reclaimChildAsAdminRequiresRetired,
+      retireChildNotReclaimed,
+      retireChildAsAdminNotReclaimed,
+      retireChildRequiresBirth,
+      retireChildAsAdminRequiresBirth,
+    ]) {
       if (!haveInvariant.has(lifecycle.id)) workspaceInvariants.push(lifecycle);
     }
   }

package/src/framework/birth_meter.ts

@@ -86,6 +86,32 @@ export const retireChild = directive("retireChild")
     ];
   });
 
+/**
+ * The operator half of the same retirement action. This is deliberately a separate, framework-internal
+ * directive because the relation gate is structural: creator recovery and platform administration have
+ * different authority proofs even though the client presents one `retire` action and both write the same
+ * lifecycle fact. A broken creator key must never make a malformed child impossible to converge.
+ */
+export const retireChildAsAdmin = directive("retireChildAsAdmin")
+  .ensures(NomosChildLifecycle)
+  .payload(z.object({
+    child: z.string().min(1),
+    principal: z.string().min(1),
+    retiredBy: z.string().min(1),
+    retiredAt: z.number().int().nonnegative(),
+  }))
+  .plan((p) => {
+    const rec = instance(NomosChildLifecycle, childLifecycleId(p.child));
+    return [
+      set(rec, "child", p.child),
+      set(rec, "principal", p.principal),
+      set(rec, "status", "retired"),
+      set(rec, "retiredBy", p.retiredBy),
+      set(rec, "retiredAt", p.retiredAt),
+    ];
+  })
+  .requires("admin");
+
 export const reclaimChild = directive("reclaimChild")
   .ensures(NomosChildLifecycle)
   .payload(z.object({
@@ -102,6 +128,24 @@ export const reclaimChild = directive("reclaimChild")
     ];
   });
 
+/** Admin-gated recovery half of {@link reclaimChild}; hidden behind the client's one reclaim action. */
+export const reclaimChildAsAdmin = directive("reclaimChildAsAdmin")
+  .ensures(NomosChildLifecycle)
+  .payload(z.object({
+    child: z.string().min(1),
+    reclaimedBy: z.string().min(1),
+    reclaimedAt: z.number().int().nonnegative(),
+  }))
+  .plan((p) => {
+    const rec = instance(NomosChildLifecycle, childLifecycleId(p.child));
+    return [
+      set(rec, "status", "reclaimed"),
+      set(rec, "reclaimedBy", p.reclaimedBy),
+      set(rec, "reclaimedAt", p.reclaimedAt),
+    ];
+  })
+  .requires("admin");
+
 /** Reclaim is two-phase; a child must first be explicitly withdrawn. */
 export const reclaimChildRequiresRetired = workspaceInvariant("ReclaimChildRequiresRetired")
   .on("reclaimChild")
@@ -115,6 +159,18 @@ export const reclaimChildRequiresRetired = workspaceInvariant("ReclaimChildRequi
       : { reject: "reclaim-child-requires-retired" },
   );
 
+/** Operator recovery has the same two-phase law, without depending on the broken creator credential. */
+export const reclaimChildAsAdminRequiresRetired = workspaceInvariant("ReclaimChildAsAdminRequiresRetired")
+  .on("reclaimChildAsAdmin")
+  .reads((ctx) => [
+    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
+  ])
+  .assert(({ record }) =>
+    (record as { status?: string } | undefined)?.status === "retired"
+      ? { accept: true }
+      : { reject: "reclaim-child-requires-retired" },
+  );
+
 /** Reclaimed is permanent: retirement cannot move a child back out of the terminal state. */
 export const retireChildNotReclaimed = workspaceInvariant("RetireChildNotReclaimed")
   .on("retireChild")
@@ -127,6 +183,18 @@ export const retireChildNotReclaimed = workspaceInvariant("RetireChildNotReclaim
       : { accept: true },
   );
 
+/** Reclaimed is terminal for operator recovery too. */
+export const retireChildAsAdminNotReclaimed = workspaceInvariant("RetireChildAsAdminNotReclaimed")
+  .on("retireChildAsAdmin")
+  .reads((ctx) => [
+    refAs("record", "NomosChildLifecycle", "pre:" + childLifecycleId(String(ctx.intent.child ?? ""))),
+  ])
+  .assert(({ record }) =>
+    (record as { status?: string } | undefined)?.status === "reclaimed"
+      ? { reject: "reclaimed-child-is-terminal" }
+      : { accept: true },
+  );
+
 /** A lifecycle cannot mint authority for arbitrary custody: retirement must name its exact birth witness. */
 export const retireChildRequiresBirth = workspaceInvariant("RetireChildRequiresBirth")
   .on("retireChild")
@@ -143,6 +211,20 @@ export const retireChildRequiresBirth = workspaceInvariant("RetireChildRequiresB
       : { reject: "retire-child-requires-exact-birth-record" };
   });
 
+/** Admin recovery may act for the recorded creator, but still cannot invent or retarget custody. */
+export const retireChildAsAdminRequiresBirth = workspaceInvariant("RetireChildAsAdminRequiresBirth")
+  .on("retireChildAsAdmin")
+  .reads((ctx) => [
+    refAs("birth", "NomosBirthRecord", "pre:" + birthRecordId(String(ctx.intent.child ?? ""))),
+  ])
+  .assert(({ birth }, ctx) => {
+    const record = birth as { child?: string; principal?: string } | undefined;
+    const intent = ctx?.intent as { child?: string; principal?: string } | undefined;
+    return record?.child === intent?.child && record?.principal === intent?.principal
+      ? { accept: true }
+      : { reject: "retire-child-requires-exact-birth-record" };
+  });
+
 function sameLifecyclePrincipal(recorded: string | undefined, author: string | undefined): boolean {
   const normalize = (s: string | undefined): string => s?.startsWith("user:") ? s.slice(5) : (s ?? "");
   return normalize(recorded) !== "" && normalize(recorded) === normalize(author);

package/src/index.ts

@@ -477,10 +477,15 @@ export {
   seedBirthPolicy,
   grantBirthAllowance,
   retireChild,
+  retireChildAsAdmin,
   reclaimChild,
+  reclaimChildAsAdmin,
   reclaimChildRequiresRetired,
+  reclaimChildAsAdminRequiresRetired,
   retireChildRequiresBirth,
+  retireChildAsAdminRequiresBirth,
   retireChildNotReclaimed,
+  retireChildAsAdminNotReclaimed,
 } from "./framework/birth_meter.js";
 // THE PLATFORM FOUNDING-ADMIN BOOTSTRAP (the platform analog of seedHomeCreator) — a tenant-importable
 // factory that seats a tenant-named governance relation for a write-once, author-bound founder at genesis.