@githolon/dsl 0.100.6 → 0.101.1

package/src/framework/encryption_scope.ts

@@ -68,7 +68,7 @@ export const KeyScope = aggregate("KeyScope", {
   scope: t.string().merge(Lww),
   currentEpoch: t.int().merge(Lww),
   openedAt: t.string().merge(Lww),
-});
+}).public();
 export type KeyScopeHandle = typeof KeyScope;
 
 /**
@@ -84,7 +84,7 @@ export const WrappedKey = aggregate("WrappedKey", {
   recipientPubKey: t.string().merge(Lww), // base64 X25519 the wrap was sealed to
   hpkeEpk: t.string().merge(Lww), // base64 HPKE ephemeral public key
   ct: t.string().merge(Lww), // base64 sealed epoch secret
-});
+}).public();
 export type WrappedKeyHandle = typeof WrappedKey;
 
 /** One wrap entry in an `advanceKeyEpoch` payload (computed client-side). */
@@ -97,7 +97,7 @@ const wrapEntrySchema = z.object({
 export type WrapEntry = z.infer<typeof wrapEntrySchema>;
 
 /** Build the plan ops for one wrap — a deterministic-keyed WrappedKey record. */
-function writeWrap(scope: string, epoch: number, w: WrapEntry): PlannedOp[] {
+export function writeWrap(scope: string, epoch: number, w: WrapEntry): PlannedOp[] {
   const wk = instance(WrappedKey, wrappedKeyInstanceId(scope, epoch, w.recipientPrincipal));
   // The first op MATERIALIZES this new sibling bucket (`ensures` — a re-offer is idempotent);
   // the rest mutate it. Without the marker the referential gate rejects a set on an absent id.
@@ -111,6 +111,23 @@ function writeWrap(scope: string, epoch: number, w: WrapEntry): PlannedOp[] {
   ];
 }
 
+/** Framework composition primitive: advance one scope head and materialize the supplied wraps. */
+export function writeKeyEpoch(
+  scope: string,
+  epoch: number,
+  openedAt: string,
+  wraps: readonly WrapEntry[],
+): PlannedOp[] {
+  const ks = instance(KeyScope, keyScopeInstanceId(scope));
+  const ops: PlannedOp[] = [
+    withMarker(set(ks, "scope", scope), "ensures"),
+    set(ks, "currentEpoch", epoch),
+    set(ks, "openedAt", openedAt),
+  ];
+  for (const wrap of wraps) ops.push(...writeWrap(scope, epoch, wrap));
+  return ops;
+}
+
 /**
  * `advanceKeyEpoch` — open a new epoch for `scope` and FAN OUT the wraps to every
  * member, in ONE intent. `epoch` is the new epoch number; `wraps` are the
@@ -129,16 +146,7 @@ export const advanceKeyEpoch = directive("advanceKeyEpoch")
       wraps: z.array(wrapEntrySchema),
     }),
   )
-  .plan((p) => {
-    const ks = instance(KeyScope, keyScopeInstanceId(p.scope));
-    const ops: PlannedOp[] = [
-      withMarker(set(ks, "scope", p.scope), "ensures"), // upsert the scope head (first advance creates it)
-      set(ks, "currentEpoch", p.epoch),
-      set(ks, "openedAt", p.openedAt),
-    ];
-    for (const w of p.wraps) ops.push(...writeWrap(p.scope, p.epoch, w));
-    return ops;
-  });
+  .plan((p) => writeKeyEpoch(p.scope, p.epoch, p.openedAt, p.wraps));
 
 /**
  * `wrapKey` — write ONE wrap (the single-member handoff). Beyond its use as a primitive,

package/src/framework/era_certification.ts

@@ -33,7 +33,7 @@ export const EraCertification = aggregate("EraCertification", {
   reason: t.string().merge(Lww),
   /** The custodian's HLC at issue (audit). */
   certifiedAt: t.string().merge(Lww),
-});
+}).public();
 
 const eraCertPayload = z.object({
   /** The content-addressed id for the folded fact (`sha256(canonical artifact)` — caller-computed). */

package/src/framework/framework_aggregates.ts

@@ -43,6 +43,7 @@ import * as encryptionScope from "./encryption_scope.js";
 import * as genesis from "./genesis.js";
 import * as home from "./home.js";
 import * as identity from "./identity.js";
+import * as ownedCustody from "./owned_custody.js";
 import * as relations from "./relations.js";
 import * as repair from "./repair.js";
 import * as signingIdentity from "./signing_identity.js";
@@ -65,6 +66,7 @@ const FRAMEWORK_NAMESPACES: ReadonlyArray<Record<string, unknown>> = [
   genesis,
   home,
   identity,
+  ownedCustody,
   relations,
   repair,
   signingIdentity,

package/src/framework/genesis.ts

@@ -53,7 +53,7 @@ export const GenesisWarrant = aggregate("GenesisWarrant", {
   principal: t.string().merge(Lww), // the x-nomos-auth-verified owner, recorded at birth
   workspaceId: t.string().merge(Lww), // this workspace's unique self-id (the author-signature source binding)
   bornAt: t.string().merge(Lww), // ISO-8601, caller-stamped (determinism)
-});
+}).public();
 export type GenesisWarrantHandle = typeof GenesisWarrant;
 
 /** The framework PRIMITIVE plan: record the founding warrant (singleton). */

package/src/framework/home.ts

@@ -36,7 +36,7 @@ import { set, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { birth } from "../births.js";
 import { readFrameworkDeclared } from "../read.js";
-import { authProvider as authProviderQuery } from "./auth_provider_law.js";
+import { authProvider as authProviderQuery, seedAuthProvider } from "./auth_provider_law.js";
 import { workspaceInvariant, refAs } from "./workspace_invariant.js";
 import { identityRelations } from "./signing_identity.js";
 import { writeTuple } from "./relations.js";
@@ -81,7 +81,7 @@ export const HomeOwner = aggregate("HomeOwner", {
   homeName: t.string().merge(Lww),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
   bornAt: t.string().merge(Lww),
-});
+}).public();
 
 /**
  * THE HOME-OWNER RELATION (the ReBAC authority spine, co2 ask #1). The {@link HomeOwner} aggregate is the
@@ -185,7 +185,17 @@ export function homeNameOf(subject: string): string {
  * home).
  */
 export const HOME_LAW_DOMAIN = "home";
-export const birthHome = directive("birthHome")
+/**
+ * Build the private home-birth primitive for the domain key that carries the home law.
+ *
+ * Most framework-authored laws still use the historic public `home` key through
+ * {@link birthHome}. Business packages use an obscure compiler-owned key instead, so a
+ * tenant remains free to model a business concept called "home". The key is closed over
+ * here and written into every child-genesis step; it is never a tenant payload field.
+ */
+export function birthHomeForDomain(homeLawDomain: string) {
+  if (homeLawDomain.length === 0) throw new Error("birthHomeForDomain requires a non-empty home-law domain");
+  return directive("birthHome")
   .creates(HomeOwner) // the birth's law-declared touched type — the child's HomeOwner is what this offer seeds
   .payload(
     z.object({
@@ -262,7 +272,7 @@ export const birthHome = directive("birthHome")
       { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
       // SEED THE OWNER — the home is born OWNED; the homeNameBindsOwner invariant in the child's law proves
       // homeName == home-<sha256(owner)> at the child's own gate, so the slot can ONLY be its rightful owner's.
-      { domain: HOME_LAW_DOMAIN, directiveId: "seedHomeOwner", actor: founder, payload: { principal: p.owner, homeName, bornAt: p.bornAt } },
+      { domain: homeLawDomain, directiveId: "seedHomeOwner", actor: founder, payload: { principal: p.owner, homeName, bornAt: p.bornAt } },
       // ENROL THE OWNER'S DEVICE on the warrant-free prefix (when supplied) — enrollSigner self-binds to
       // ctx.principal() (the owner), so this binds `ownerKeyHash` as the owner's signer BEFORE the warrant
       // closes bootstrap. This is what makes the born home SIGNER-READY (able to sign + self-serve-birth its own
@@ -272,7 +282,7 @@ export const birthHome = directive("birthHome")
       // ladder: every seed runs UNSIGNED on the still-warrant-free prefix; the warrant closes it). ERA-SAFE: a
       // home born earlier (pre-feature law, no such step in its recipe) replays byte-identical — the era rule
       // rides the LAW hash, not this branch.
-      { domain: HOME_LAW_DOMAIN, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
+      { domain: homeLawDomain, directiveId: "enrollSigner", actor: founder, payload: { keyHash: p.ownerKeyHash, grantedBy: p.owner, grantedAt: 1, ...(verifiedVia !== undefined ? { verifiedVia } : {}) } },
     ];
     // AUTHPROVIDER INHERITANCE (default ON — see the payload doc): copy the parent's declared provider
     // (the up-front captured read above) AS DATA into the child genesis. The child owns the copy as its
@@ -282,8 +292,8 @@ export const birthHome = directive("birthHome")
       const issuer = str("issuer");
       if (issuer !== undefined) {
         genesisChain.push({
-          domain: HOME_LAW_DOMAIN,
-          directiveId: "setAuthProvider",
+          domain: homeLawDomain,
+          directiveId: "seedAuthProvider",
           actor: founder,
           payload: {
             issuer,
@@ -309,6 +319,9 @@ export const birthHome = directive("birthHome")
   })
   .reads(authProviderQuery) // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
   .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
+}
+
+export const birthHome = birthHomeForDomain(HOME_LAW_DOMAIN);
 
 /**
  * THE SHARED-WITH-ME INDEX (§5) — one record per cross-custody attestation delivered to this home holon:
@@ -330,7 +343,7 @@ export const SharedWithMe = aggregate("SharedWithMe", {
   /** PRUNED (forward-check fail-safe): set when the live `Check` on the asserter denies — the hint is
    *  dropped from the list but the audit row stays. `""` = live. */
   prunedAt: t.string().merge(Lww),
-});
+}).public();
 
 /**
  * `recordShare` — index a cross-custody share into the home holon's access list. AUTHORED on the home
@@ -418,7 +431,7 @@ export const BirthAttestation = aggregate("BirthAttestation", {
    *  home (`child`==self-id, `founder`==HomeOwner.principal, `verified`). It travels because it folds into
    *  the home's own genesis (seeded by the parent's offer-effect), so a peer holding only the home has it. */
   certChain: t.string().merge(Lww),
-});
+}).public();
 
 /** Audit read: this home's birth attestation (who attested it + the verified verdict). */
 export const birthAttestation = query("birthAttestation").key("child").returns(BirthAttestation);

package/src/framework/identity.ts

@@ -117,7 +117,7 @@ export const Actor = aggregate("Actor", {
   revokedDeviceKeyIds: t.set(t.string()).merge(AddWins),
   createdAt: t.string().merge(Lww), // ISO-8601; immutable-after-create (NOTE 1a)
   updatedAt: t.string().merge(Lww),
-});
+}).public();
 
 /**
  * The User aggregate — an actor's human-facing profile. Field shapes mirror the
@@ -138,7 +138,7 @@ export const User = aggregate("User", {
   profile: t.map(t.string()).merge(MapOf(Lww)),
   registeredAt: t.string().merge(Lww), // immutable-after-create (NOTE 1a)
   updatedAt: t.string().merge(Lww),
-});
+}).public();
 
 /**
  * The DeviceKey aggregate — a device-scoped key bound to an actor. "Each device
@@ -164,7 +164,7 @@ export const DeviceKey = aggregate("DeviceKey", {
   // Optional hint of last authorship by this key; NOT provenance (NOTE 1c). Not
   // folded at create — OPTIONAL.
   lastAuthoredAt: t.string().merge(Lww).optional(),
-});
+}).public();
 
 /**
  * The Organization aggregate — mirrors the Dart `CreateOrganization` shape. Org
@@ -195,7 +195,7 @@ export const Organization = aggregate("Organization", {
   createdBy: t.string().merge(Lww),
   createdAt: t.string().merge(Lww),
   updatedAt: t.string().merge(Lww),
-});
+}).public();
 
 /**
  * The PublicUser aggregate — the lightweight public-facing profile index (display
@@ -209,7 +209,7 @@ export const PublicUser = aggregate("PublicUser", {
   // `createPublicUser` folds photoUrl only when supplied — OPTIONAL (read-decode gap).
   photoUrl: t.string().merge(Lww).optional(),
   updatedAt: t.string().merge(Lww),
-});
+}).public();
 
 // ───────────────────────────── Directives ──────────────────────────────────
 

package/src/framework/impure_capability.ts

@@ -168,7 +168,7 @@ export function impureCapabilityAggregate<
   // GLOBAL (read-projection namespacing opt-out): the capability lane addresses the envelope
   // by its BARE declared id (`nomosCapabilities.aggregateId` → the obligation rows the holon
   // surfaces), so the envelope's type name must not be domain-qualified.
-  return aggregate(id, { ...IMPURE_CAPABILITY_ENVELOPE, ...params }, { global: true });
+  return aggregate(id, { ...IMPURE_CAPABILITY_ENVELOPE, ...params }, { global: true }).public();
 }
 
 /**
@@ -238,7 +238,7 @@ const deadLetterSchema = z.object({
  * handle; the envelope handle just types the envelope subset for `set()`).
  */
 function envelopeInstance(aggregateId: string, requestId: string) {
-  const envelopeHandle = aggregate(aggregateId, IMPURE_CAPABILITY_ENVELOPE, { global: true });
+  const envelopeHandle = aggregate(aggregateId, IMPURE_CAPABILITY_ENVELOPE, { global: true }).public();
   return instance(envelopeHandle, impureCapabilityInstanceId(requestId));
 }