@githolon/dsl 0.100.6 → 0.101.0

package/src/framework/workspaces.ts

@@ -121,7 +121,7 @@ export const WorkspaceSelf = aggregate("WorkspaceSelf", {
   // for era-safety (old records carry it); slated for removal with `kind` in one #58 disposition pass.
   role: t.enum(WORKSPACE_ROLES).merge(Lww),
   name: t.string().merge(Lww),
-});
+}).public();
 // The one-off SELF-IDENTITY backfill for an already-born workspace (root predates WorkspaceSelf). UNGATED
 // by the admin gate — it must run BEFORE the admin tuple/gate are live — but WRITE-ONCE (the invariant
 // below refuses a re-set once the self-record exists), so a race or a malicious re-set cannot freeze
@@ -342,7 +342,7 @@ export const CloudWorkspace = aggregate("CloudWorkspace", {
    *  (the default). Set at birth ({@link birthChild}/{@link createWorkspace} `posture` payload). Additive/
    *  era-safe (optional Lww). */
   governancePosture: t.enum(GOVERNANCE_POSTURES).merge(Lww).optional(),
-});
+}).public();
 
 // AdminGrant / CreationGrant aggregates: DELETED (full-native Zanzibar). Admin/creation authority is
 // now a NATIVE RELATION TUPLE — `workspace:self#admin@key:<keyHash>` / `…#creator@key:<keyHash>` —
@@ -379,7 +379,7 @@ export const CloudPolicy = aggregate("CloudPolicy", {
   setBy: t.string().merge(Lww),
   /** Epoch-ms the policy was last set (caller-stamped). */
   setAt: t.int().merge(Lww),
-});
+}).public();
 
 /**
  * QuotaGrant — a granted quota request: one principal's workspace allowance,
@@ -396,7 +396,7 @@ export const QuotaGrant = aggregate("QuotaGrant", {
   grantedBy: t.string().merge(Lww),
   /** Epoch-ms the grant was authored (caller-stamped). */
   grantedAt: t.int().merge(Lww),
-});
+}).public();
 
 /**
  * PlatformGrant — legacy audit surface for platform invites. Platform creation now rides
@@ -414,7 +414,7 @@ export const PlatformGrant = aggregate("PlatformGrant", {
   grantedAt: t.int().merge(Lww),
   /** `active` | `revoked`. */
   status: t.enum(GRANT_STATUSES).merge(Lww),
-});
+}).public();
 
 /**
  * CapabilityBinding — A FACT ABOUT AUTHORITY, never authority itself (the
@@ -455,7 +455,7 @@ export const CapabilityBinding = aggregate("CapabilityBinding", {
   boundAt: t.int().merge(Lww),
   /** `active` | `revoked` — the law's kill switch for the credential's USE. */
   status: t.enum(GRANT_STATUSES).merge(Lww),
-});
+}).public();
 
 // --- workspace directives ---------------------------------------------------------
 
@@ -1099,7 +1099,7 @@ export const GovernancePosture = aggregate("GovernancePosture", {
   setBy: t.string().merge(Lww),
   /** Epoch-ms it was last set (caller-stamped). */
   setAt: t.int().merge(Lww),
-});
+}).public();
 
 /**
  * RebirthConsent — the tenant's OWN consent to a rebirth, folded in the tenant's OWN chain (the two-key
@@ -1119,7 +1119,7 @@ export const RebirthConsent = aggregate("RebirthConsent", {
   consentedAt: t.int().merge(Lww),
   /** OPTIONAL epoch-ms expiry; absent = until superseded. Expired ⇒ the custody act treats it as absent. */
   expiresAt: t.int().merge(Lww).optional(),
-});
+}).public();
 
 /** Shared plan body for the three posture setters — ensures the singleton to `posture`. */
 function setPosturePlan(posture: (typeof GOVERNANCE_POSTURES)[number], reason: string, setBy: string, at: number) {
@@ -1352,7 +1352,14 @@ export const setPlatformPool = directive("setPlatformPool")
 // THE AUTHPROVIDER LAW SURFACE moved to ./auth_provider_law.js (a LEAF module the engine entry +
 // birthHome inheritance import without dragging this whole graph into every lump). Re-exported
 // here verbatim — the public surface and the law bytes are unchanged.
-export { AUTH_PROVIDER_ID, AuthProvider, setAuthProvider, authProvider } from "./auth_provider_law.js";
+export {
+  AUTH_PROVIDER_ID,
+  AuthProvider,
+  seedAuthProvider,
+  authProviderSeedBeforeWarrant,
+  setAuthProvider,
+  authProvider,
+} from "./auth_provider_law.js";
 import { AUTH_PROVIDER_ID, AuthProvider, setAuthProvider, authProvider } from "./auth_provider_law.js";
 
 /**
@@ -1399,7 +1406,7 @@ export const HostnameClaim = aggregate("HostnameClaim", {
   claimedAt: t.int().merge(Lww),
   /** `active` | `released`. */
   status: t.enum(["active", "released"]).merge(Lww),
-});
+}).public();
 
 /** claimHostname — bind a hostname to a platform (worker-authored after the edge accepts it). */
 export const claimHostname = directive("claimHostname")

package/src/generated_client_names.ts

@@ -0,0 +1,39 @@
+// Public generated-client concepts are part of the product language. If tenant
+// language lands on the same emitted member, fail loudly: obscurity reduces
+// accidental framework collisions, but it must never decide one silently.
+
+type Named = { readonly id?: unknown };
+type ClientDomain = {
+  readonly domain?: string;
+  readonly name: string;
+  readonly directives?: readonly Named[];
+  readonly queries?: readonly Named[];
+  readonly counts?: readonly Named[];
+  readonly sums?: readonly Named[];
+  readonly spatials?: readonly Named[];
+};
+
+const camel = (value: string): string =>
+  value.replace(/[_\s-]+(\w)/g, (_match, letter: string) => letter.toUpperCase());
+
+/** Refuse tenant callables that would overwrite the generated `model` adoption concept. */
+export function assertModelClientMemberAvailable(mod: ClientDomain): void {
+  const domain = mod.domain ?? mod.name;
+  const surfaces: readonly [string, readonly Named[]][] = [
+    ["action", mod.directives ?? []],
+    ["question", mod.queries ?? []],
+    ["count", mod.counts ?? []],
+    ["sum", mod.sums ?? []],
+    ["spatial question", mod.spatials ?? []],
+  ];
+  for (const [kind, entries] of surfaces) {
+    for (const entry of entries) {
+      if (typeof entry.id !== "string" || camel(entry.id) !== "model") continue;
+      throw new Error(
+        `Nomos generated client concept 'model' is already taken, but business ${kind} ` +
+        `'${entry.id}' in domain '${domain}' would use the same name. Sorry mate: Nomos will not ` +
+        `silently reinterpret either concept; rename the business ${kind}.`,
+      );
+    }
+  }
+}

package/src/index.ts

@@ -32,6 +32,9 @@ export {
   type FieldKind,
   type JsonValue,
   type NullSemantic,
+  type FieldEvolutionDeclaration,
+  type StringRules,
+  type IntRules,
   NULL_ADMITTING,
   admitsNull,
   jsonNoNullSchema,
@@ -84,6 +87,7 @@ export {
   type FieldFacet,
 } from "./principal_evidence.js";
 export {
+  FirstWriterWins,
   Lww,
   LwwCausal,
   LwwBy,
@@ -98,6 +102,14 @@ export {
   type Driver,
   type DriverKind,
 } from "./drivers.js";
+export {
+  conflicts,
+  firstWriterWins,
+  latestWriterWins,
+  manual,
+  type ConflictPolicy,
+  type ConflictRule,
+} from "./conflicts.js";
 export {
   set,
   clear,
@@ -223,6 +235,9 @@ export {
   type GenesisChainOrBuilder,
   type BusinessBirthDecl,
   type BusinessBirthSpec,
+  type BusinessBirthPayload,
+  type BirthFactKeys,
+  type BirthStringFactKeys,
 } from "./births.js";
 // THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain): a home/child law exports
 // `requireParentAttestedBirth` to declare it requires a parent-attested-birth cert chain (the
@@ -424,6 +439,8 @@ export {
 export {
   AUTH_PROVIDER_ID,
   AuthProvider,
+  seedAuthProvider,
+  authProviderSeedBeforeWarrant,
   setAuthProvider,
   authProvider,
 } from "./framework/auth_provider_law.js";
@@ -548,6 +565,9 @@ export {
   policyAggregateId,
   domainInstallationAggregateId,
   installDomain,
+  stageDomain,
+  promoteDomain,
+  rollbackDomain,
   type DomainInstallationPhase,
 } from "./framework/domain_lifecycle.js";
 export {
@@ -661,21 +681,6 @@ export {
   type RoleMeta,
 } from "./role.js";
 export { csv, csvRows } from "./report/csv.js";
-// CertifiedRead — the DECLARED write-path read surface (survival Constraint 5;
-// `certified_read.md`). A directive declares profiled reads via `.readsCertified({ name:
-// certifiedRead("id").sql("…", {…}) })`; the SQL is compiled through the SQL-profile-v0 enforcer
-// at declaration (an under-specified read is refused at COMPILE), the declared `query_id`s land
-// in the certified manifest, and the gate derives the required-read set (the vacuous-pass close).
-export {
-  certifiedRead,
-  sqlProfileV0Check,
-  ProfileError,
-  SQL_PROFILE_VERSION,
-  BANNED_FUNCTIONS,
-  type CertifiedReadDecl,
-  type CertifiedReadOpts,
-  type ProfileViolation,
-} from "./certified_read.js";
 // The cross-workspace `relation` declaration (`cross_workspace.md` §2). A TARGET directive
 // declares the relation a cross-workspace PR is adjudicated against via
 // `.declaresRelation(relation("Id").endpoints(src,tgt).proposes(directive, evidenceRead))`;

package/src/kernel_capabilities.ts

@@ -44,7 +44,11 @@ export type KernelFeature =
   /** Null as an opt-in named capability (`admitsNull()`). */
   | "nullSemantics"
   /** Dynamic attested reads under a trustPolicy allowList. */
-  | "attestedReads";
+  | "attestedReads"
+  /** Law-declared immutable pending-conflict snapshots (compare-and-set merge refs). */
+  | "conflictSnapshots"
+  /** `.owned()` automatic owner stamp, atomic per-record seat, and framework-custodied epoch-0 key. */
+  | "ownedAudience";
 
 /** The USD-IR era key each derived-from-law capability rides on, for the requirement
  *  derivation below (a package that emits the era key needs the capability). */
@@ -60,6 +64,8 @@ export const ERA_KEY_TO_FEATURE: Readonly<Record<string, KernelFeature>> = {
 /** A minimal shape of a compiled domain module — enough to derive its kernel needs. */
 export interface FeatureProbeModule {
   readonly queries?: readonly QueryDecl[];
+  readonly surfacedResolvers?: readonly unknown[];
+  readonly aggregates?: readonly { audience?: { kind?: string } }[];
   /** The domain's USD-IR layer (the era keys ride here). Optional — shape-derived
    *  features (compoundKeys) work without it. */
   readonly layer?: Record<string, unknown>;
@@ -77,6 +83,10 @@ export function requiredKernelFeatures(modules: readonly FeatureProbeModule[]):
     for (const q of m.queries ?? []) {
       if (Array.isArray(q.key) && q.key.length > 1) needs.add("compoundKeys");
     }
+    if ((m.surfacedResolvers?.length ?? 0) > 0) needs.add("conflictSnapshots");
+    if ((m.aggregates ?? []).some((aggregate) => aggregate.audience?.kind === "owned")) {
+      needs.add("ownedAudience");
+    }
     if (m.layer) {
       for (const [eraKey, feature] of Object.entries(ERA_KEY_TO_FEATURE)) {
         if (m.layer[eraKey] !== undefined) needs.add(feature);
@@ -118,6 +128,20 @@ export interface KernelRegistryEntry extends KernelStamp {
 }
 
 export const KERNEL_CAPABILITY_REGISTRY: readonly KernelRegistryEntry[] = [
+  {
+    prefix: "f50d0cc5",
+    version: "kernel-f50d0cc5",
+    note: "current local production build",
+    features: [
+      "compoundKeys",
+      "capturedReads",
+      "invariantGate",
+      "surfacedMerge",
+      "fieldProvenance",
+      "nullSemantics",
+      "attestedReads",
+    ],
+  },
   {
     prefix: "846c6bf8",
     version: "kernel-846c6bf8",

package/src/law_check.ts

@@ -27,7 +27,7 @@
  */
 import { z } from "zod";
 
-import type { AggregateHandle } from "./aggregate.js";
+import { BUSINESS_BIRTH_SEED_PAYLOAD_FIELD, type AggregateHandle } from "./aggregate.js";
 import type { Directive } from "./directive.js";
 import type { DomainModule } from "./codegen_dart.js";
 import { admitsNull, type Field, type ValueObjectDescriptor, type ValueObjectFieldDescriptor } from "./fields.js";
@@ -101,6 +101,9 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
   // filled with a fixed ISO stamp (the client stamps them at dispatch; the plan may read them here).
   const probePayload: Record<string, unknown> = { ...synth.value };
   for (const f of synth.autoStamped) probePayload[f] = "2026-01-01T00:00:00Z";
+  if ((dir as { businessBirth?: unknown }).businessBirth !== undefined) {
+    probePayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD] = "{}";
+  }
 
   const shapeKeys = new Set(Object.keys(safeShape(dir.payloadSchema as z.ZodTypeAny)));
   const readFields = new Set<string>();