@githolon/dsl 0.100.6 → 0.101.1

package/src/birth_meter.ts

@@ -83,7 +83,7 @@ export const NomosBirthRecord = aggregate("NomosBirthRecord", {
   childGenesisHash: t.string().merge(Lww),
   /** Caller-stamped birth time from the payload (`bornAt`, else `requestedAt`) — the timestamp doctrine. */
   bornAt: t.string().merge(Lww),
-});
+}).public();
 
 /**
  * NomosChildLifecycle — additive lifecycle for a child witnessed by NomosBirthRecord. It is deliberately
@@ -98,7 +98,7 @@ export const NomosChildLifecycle = aggregate("NomosChildLifecycle", {
   retiredAt: t.int().merge(Lww),
   reclaimedBy: t.string().merge(Lww),
   reclaimedAt: t.int().merge(Lww),
-});
+}).public();
 
 /** BirthPolicy — the workspace's birth-allowance singleton (id `birth-policy:workspace`), the
  *  `CloudPolicy` shape one level down: the default max live births per subject in THIS workspace. */
@@ -110,7 +110,7 @@ export const BirthPolicy = aggregate("BirthPolicy", {
   setBy: t.string().merge(Lww),
   /** Caller-stamped (ISO or epoch-ms string) — the timestamp doctrine. */
   setAt: t.string().merge(Lww),
-});
+}).public();
 
 /** BirthGrant — a per-subject allowance override (id `birth-grant:<principal>`), the `QuotaGrant`
  *  shape: the LATEST grant (max grantedAt) for a subject is the allowance in force. */
@@ -123,7 +123,7 @@ export const BirthGrant = aggregate("BirthGrant", {
   grantedBy: t.string().merge(Lww),
   /** epoch-ms — the recency tiebreak (latest grant wins), caller-stamped. */
   grantedAt: t.int().merge(Lww),
-});
+}).public();
 
 // ── the meter's declared queries (the #58 captured-read recipes) ────────────────────────────────────
 

package/src/birth_meter_ensure.ts

@@ -59,7 +59,13 @@ import {
   signerDelegationByUser,
   signerObject,
 } from "./framework/signing_identity.js";
-import { AuthProvider, authProvider, setAuthProvider } from "./framework/auth_provider_law.js";
+import {
+  AuthProvider,
+  authProvider,
+  authProviderSeedBeforeWarrant,
+  seedAuthProvider,
+  setAuthProvider,
+} from "./framework/auth_provider_law.js";
 import { refAs, workspaceInvariant } from "./framework/workspace_invariant.js";
 
 /** Lightweight copy of the framework's founding-signer guard, kept here to avoid importing the whole
@@ -191,6 +197,8 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   internalize("__nomos_seedBirthAttestation", seedBirthAttestation);
   internalize("__nomos_birthAttestation", birthAttestation);
   internalize("__nomos_AuthProvider", AuthProvider);
+  internalize("__nomos_seedAuthProvider", seedAuthProvider);
+  reserve("__nomos_authProviderSeedBeforeWarrant", authProviderSeedBeforeWarrant);
   internalize("__nomos_setAuthProvider", setAuthProvider);
   internalize("__nomos_authProvider", authProvider);
   reserve("__nomos_founderSignerWriteOnce", bornFounderSignerWriteOnce);

package/src/births.ts

@@ -3,10 +3,10 @@
 // wasm32-wasip1 artifact {kernel · projection · embedded
 // QuickJS engine}.  If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
-import type { z } from "zod";
+import { z } from "zod";
 import type { AggregateHandle } from "./aggregate.js";
 import type { AggregateRef } from "./authoring.js";
-import type { Field } from "./fields.js";
+import type { Field, FieldValue } from "./fields.js";
 
 /**
  * THE BIRTH EFFECT — birth is an EXPLICIT, DECLARED kernel primitive (G3, the unix model).
@@ -75,19 +75,29 @@ export interface BusinessBirthDecl<
   readonly payloadSchema: z.ZodObject<z.ZodRawShape>;
   /** A stable business key the caller already knows (an estate reference, account number, etc.). */
   readonly key: (payload: P) => string;
-  /** Author the born thing's initial business facts. Nomos supplies the durable identity and lifecycle. */
+  /** The declared business fact used by {@link key}; retained for generated clients to pre-address custody. */
+  readonly keyField: string;
+  /** Framework-derived initial authoring. Tenant code marks aggregate fields `.fromBirth()` instead. */
   readonly plan: (root: AggregateRef<F>, payload: P) => unknown;
   /** Optional business noun used only to make the durable address readable. Defaults to the aggregate id. */
   readonly namespace?: string;
 }
 
-export interface BusinessBirthSpec<
-  P extends Record<string, unknown>,
-  F extends Record<string, Field>,
-> {
-  readonly payload: z.ZodType<P> & z.ZodObject<z.ZodRawShape>;
-  readonly key: (payload: P) => string;
-  readonly plan: (root: AggregateRef<F>, payload: P) => unknown;
+export type BirthFactKeys<F extends Record<string, Field>> = {
+  [K in keyof F]-?: F[K] extends { readonly isFromBirth: true } ? K : never;
+}[keyof F] & string;
+
+export type BirthStringFactKeys<F extends Record<string, Field>> = {
+  [K in BirthFactKeys<F>]: FieldValue<F[K]> extends string ? K : never;
+}[BirthFactKeys<F>] & string;
+
+export type BusinessBirthPayload<F extends Record<string, Field>> = {
+  readonly [K in BirthFactKeys<F>]: FieldValue<F[K]>;
+};
+
+export interface BusinessBirthSpec<F extends Record<string, Field>> {
+  /** One declared birth fact that gives this business life its stable address. */
+  readonly key: BirthStringFactKeys<F>;
   readonly namespace?: string;
 }
 
@@ -95,30 +105,51 @@ export interface BusinessBirthSpec<
  * declares `birth(Aggregate, spec)` and leaves the recipe, identity, and recovery machinery to Nomos. */
 export function birth(recipe: BirthRecipe): void;
 /** Declare that one business aggregate is given its own durable life. */
-export function birth<P extends Record<string, unknown>, F extends Record<string, Field>>(
+export function birth<F extends Record<string, Field>>(
   aggregate: AggregateHandle<string, F>,
-  spec: BusinessBirthSpec<P, F>,
-): BusinessBirthDecl<P, F>;
-export function birth<P extends Record<string, unknown>, F extends Record<string, Field>>(
+  spec: BusinessBirthSpec<F>,
+): BusinessBirthDecl<BusinessBirthPayload<F>, F>;
+export function birth<F extends Record<string, Field>>(
   recipeOrAggregate: BirthRecipe | AggregateHandle<string, F>,
-  spec?: BusinessBirthSpec<P, F>,
-): void | BusinessBirthDecl<P, F> {
+  spec?: BusinessBirthSpec<F>,
+): void | BusinessBirthDecl<BusinessBirthPayload<F>, F> {
   if (spec !== undefined) {
     const aggregate = recipeOrAggregate as AggregateHandle<string, F>;
     if (!aggregate || aggregate.__isAggregateHandle !== true) {
       throw new Error("birth(Aggregate, spec): the first argument must be an aggregate handle");
     }
-    if (!spec.payload || typeof (spec.payload as { safeParse?: unknown }).safeParse !== "function") {
-      throw new Error("birth(Aggregate, spec): spec.payload must be a z.object(...) schema");
+    const internalFields = new Set(aggregate.internalFields ?? []);
+    const facts = Object.entries(aggregate.fields as Record<string, Field>).filter(
+      ([name, field]) => field.isFromBirth === true && !internalFields.has(name),
+    );
+    if (facts.length === 0) {
+      throw new Error(
+        `birth(${aggregate.id}): no birth facts are declared — mark every required initial business field with .fromBirth()`,
+      );
+    }
+    const keyField = (aggregate.fields as Record<string, Field>)[spec.key];
+    if (keyField === undefined || keyField.isFromBirth !== true) {
+      throw new Error(`birth(${aggregate.id}): key '${String(spec.key)}' must be a declared .fromBirth() field`);
+    }
+    if (keyField.kind !== "string" && keyField.kind !== "enum" && keyField.kind !== "ref") {
+      throw new Error(
+        `birth(${aggregate.id}): key '${String(spec.key)}' must be a string-like business fact; got ${keyField.kind}`,
+      );
     }
+    const payloadSchema = z.object(Object.fromEntries(facts.map(([name, field]) => [name, field.zod])));
+    type Payload = BusinessBirthPayload<F>;
     return {
       __isBusinessBirth: true,
       aggregate,
-      payloadSchema: spec.payload,
-      key: spec.key,
-      plan: spec.plan,
+      payloadSchema,
+      key: (payload: Payload) => String(payload[spec.key]),
+      keyField: spec.key,
+      plan: (root: AggregateRef<F>, payload: Payload) => {
+        const writable = root as unknown as { set(field: string, value: unknown): unknown };
+        for (const [name] of facts) writable.set(name, payload[name as keyof Payload]);
+      },
       ...(spec.namespace !== undefined ? { namespace: spec.namespace } : {}),
-    };
+    } as BusinessBirthDecl<Payload, F>;
   }
   footprint.push(recipeOrAggregate as BirthRecipe);
 }

package/src/build_package.ts

@@ -69,7 +69,7 @@ import {
   type TrustSourceDecl,
   type TrustPolicyDecl,
 } from "./attested.js";
-import type { RelationTypeDecl } from "./relation_schema.js";
+import { isRelationTypeDecl, type RelationTypeDecl } from "./relation_schema.js";
 import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
 import { emitUsd } from "./usd.js";
@@ -81,7 +81,14 @@ import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
 import { assertIdOfLint } from "./idof_lint.js";
 import { assertSurfacedResolvers } from "./surfaced_lint.js";
+import {
+  applyConflictPoliciesToAggregates,
+  applyConflictPolicyResolvers,
+  conflictPoliciesOf,
+} from "./conflicts.js";
 import { expandBusinessBirthExports } from "./business_birth.js";
+import { withOwnedCustodyExports } from "./framework/owned_custody.js";
+import { withBusinessCorrectionExports } from "./framework/business_corrections.js";
 import {
   reclaimChildAsAdminRequiresRetired,
   reclaimChildRequiresRetired,
@@ -184,9 +191,13 @@ export interface DomainModuleSpec {
  * (an empty optional key must be ABSENT or every domain's canonical manifest hash drifts).
  */
 export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
+  const domain = spec.domain ?? spec.name;
+  const conflictPolicies = conflictPoliciesOf(spec.modules, domain);
   let merged: Mod = {};
   for (const m of spec.modules) merged = { ...merged, ...m };
   merged = expandBusinessBirthExports(merged, spec.domain ?? spec.name);
+  merged = withOwnedCustodyExports(merged);
+  merged = withBusinessCorrectionExports(merged);
   // `capability()` bundles expand into discoverable entries (the package plane's
   // merge point) — the quartet validation below then passes without re-exports.
   merged = expandCapabilityExports(merged);
@@ -211,7 +222,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
 
   const byId = new Map<string, AggregateHandle>();
   for (const a of [...aggregatesOf(merged), ...(spec.extraAggregates ?? [])]) byId.set(a.id, a);
-  const directives = directivesOf(merged);
+  const directives = applyConflictPolicyResolvers(directivesOf(merged), conflictPolicies);
   // RELATIONS AUTO-ENSURE + AUTO-COMPOSE (co2 recovery DX): a domain that USES relation law — declares a
   // relation schema, a `.requires(...)`-gated directive, or relate-family/signer directives ensuring
   // RelationTuple — needs the framework RelationTuple aggregate IN the schema on TWO counts: (1) the deploy
@@ -236,9 +247,20 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const declaresPrivateRead = [...byId.values()].some(
     (a) => (a as { visibility?: unknown }).visibility !== undefined,
   );
+  const declaresOwnedRead = [...byId.values()].some(
+    (a) => (a as { audience?: { kind?: unknown } }).audience?.kind === "owned",
+  );
   if (declaresPrivateRead) {
-    if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
-    if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
+    if (!byId.has(AuthProvider.id)) {
+      byId.set(AuthProvider.id, declaresOwnedRead
+        ? { ...AuthProvider, businessBirthInternal: true } as AggregateHandle
+        : AuthProvider);
+    }
+    if (!directives.some((d) => d.id === setAuthProvider.id)) {
+      directives.push(declaresOwnedRead
+        ? { ...setAuthProvider, businessBirthInternal: true } as Directive<any>
+        : setAuthProvider);
+    }
   }
   const usesRelations =
     declaresPrivateRead ||
@@ -246,7 +268,9 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     directives.some((d) => (d as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
     directives.some((d) => d.aggregateId === RelationTuple.id);
   if (usesRelations && !byId.has(RelationTuple.id)) {
-    byId.set(RelationTuple.id, RelationTuple);
+    byId.set(RelationTuple.id, declaresOwnedRead
+      ? { ...RelationTuple, businessBirthInternal: true } as AggregateHandle
+      : RelationTuple);
   }
   // BIRTH-METER AUTO-ENSURE (metered birth, slice A — the same "discoverable without re-exports"
   // courtesy as RelationTuple): a domain declaring ≥1 `.births()` directive gets the meter aggregates
@@ -296,7 +320,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     directives.push(dir);
     autoDeclaredEnsures.push(ty);
   }
-  const aggregates = [...byId.values()];
+  const aggregates = applyConflictPoliciesToAggregates(
+    [...byId.values()],
+    conflictPolicies,
+    domain,
+  );
   const directiveIds = new Set(directives.map((d) => d.id));
   for (const task of spec.impureCapabilities ?? []) {
     for (const directive of [task.obligation, task.complete, task.fail, task.block, task.deadLetter]) {
@@ -383,7 +411,14 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
       queries.push(internalDelegationQuery);
     }
   }
-  const relationTypes = [...(spec.relationTypes ?? [])];
+  const relationTypeByKey = new Map<string, RelationTypeDecl>();
+  for (const value of Object.values(merged)) {
+    if (isRelationTypeDecl(value)) relationTypeByKey.set(`${value.global === true ? "global" : "local"}:${value.type}`, value);
+  }
+  for (const value of spec.relationTypes ?? []) {
+    relationTypeByKey.set(`${value.global === true ? "global" : "local"}:${value.type}`, value);
+  }
+  const relationTypes = [...relationTypeByKey.values()];
   // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX — same idiom as the meter
   // queries above): a domain that declares relation law (a relation schema, a `.requires(...)` gated
   // directive, or relate-family/signer directives ensuring RelationTuple) gets the framework's
@@ -398,10 +433,14 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // Auth-provider auto-compose (sibling of the RelationTuple query carry): a private package gets the
   // `authProvider` read so the workspace can surface its declared verifier.
   if (declaresPrivateRead && !queries.some((q) => q.id === authProvider.id)) {
-    queries.push(authProvider);
+    queries.push(declaresOwnedRead
+      ? { ...authProvider, businessBirthInternal: true } as QueryDecl
+      : authProvider);
   }
   if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
-    queries.push(relationTuplesByObject);
+    queries.push(declaresOwnedRead
+      ? { ...relationTuplesByObject, businessBirthInternal: true } as QueryDecl
+      : relationTuplesByObject);
   }
   // FIRST-CLASS VALUE OBJECTS (value_object.ts): the deduped, sorted descriptors of every
   // named VO the domain's aggregates carry (transitive nested VOs included) — the input to
@@ -527,10 +566,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // closed is dissolved by construction. See `dsl/src/framework/signing_identity.ts::enrollSigner`.)
 
   // THE SURFACED-RESOLVER LINT (surfaced_lint.ts — the fail-closed teeth): every
-  // `.merge(Surfaced(...))` field must have EXACTLY ONE `.resolves()` directive, whose plan
+  // Surfaced field must have EXACTLY ONE designated merge directive, whose plan
   // provably set()s the field from a payload field. Returns the resolver bindings the typed
-  // `resolve…` helper codegen consumes. Compile-time only — no manifest/wire/hash effect;
-  // a Surfaced-free domain runs zero checks (byte-identical).
+  // chained conflict-reference codegen consumes AND the canonical manifest records as the
+  // hash-bearing conflictResolution contract. A Surfaced-free domain runs zero checks and is
+  // byte-identical; a resolver policy deliberately becomes part of business law.
   const surfacedResolvers = assertSurfacedResolvers(
     aggregates,
     directives,
@@ -547,8 +587,9 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     // ROLE SUGAR codegen metadata — NOT law (not hashed): drives the `canEdit<Agg>`/`canView<Agg>`
     // UI-hint helpers. Omit-when-empty (a role-free domain is byte-identical).
     ...(roles.length > 0 ? { roles } : {}),
-    // SURFACED RESOLVER BINDINGS — NOT law (not hashed, like `roles`): drives the generated
-    // typed `resolve…` helpers + the `pendingConflicts` accessor. Omit-when-empty (era rule).
+    // SURFACED RESOLVER BINDINGS — the aggregate/field/directive tuple is lowered into the
+    // hash-bearing manifest; payload-field tracing also drives generated typed references.
+    // Omit-when-empty because ordinary domains need no resolver metadata.
     ...(surfacedResolvers.length > 0 ? { surfacedResolvers } : {}),
     ...(queries.length > 0 ? { queries } : {}),
     ...(counts.length > 0 ? { counts } : {}),

package/src/business_birth.ts

@@ -1,6 +1,7 @@
 // NOMOS — one business birth at the tenant surface; compute-science mechanics lower here.
 
 import { z } from "zod";
+import { BUSINESS_BIRTH_SEED_PAYLOAD_FIELD } from "./aggregate.js";
 import { ensure } from "./authoring.js";
 import { directive, type Directive } from "./directive.js";
 import {
@@ -11,7 +12,13 @@ import {
   type ParentAttestedBirthMarker,
 } from "./births.js";
 import { readFrameworkDeclared } from "./read.js";
-import { AuthProvider, authProvider, setAuthProvider } from "./framework/auth_provider_law.js";
+import {
+  AuthProvider,
+  authProvider,
+  authProviderSeedBeforeWarrant,
+  seedAuthProvider,
+  setAuthProvider,
+} from "./framework/auth_provider_law.js";
 import {
   BirthGrant,
   BirthPolicy,
@@ -49,6 +56,7 @@ export interface BusinessBirthMetadata {
   readonly publicPayloadSchema: z.ZodObject<z.ZodRawShape>;
   readonly rootId: string;
   readonly namespace: string;
+  readonly keyField: string;
 }
 
 export interface BusinessBirthDirective extends Directive<Record<string, unknown>> {
@@ -68,7 +76,13 @@ function internalSurface<T extends object>(value: T): T & { readonly businessBir
   return { ...value, businessBirthInternal: true };
 }
 
-const INTERNAL_FIELDS = ["principal", "bornAt", "ownerKeyHash", "birthCert"] as const;
+const INTERNAL_FIELDS = [
+  "principal",
+  "bornAt",
+  "ownerKeyHash",
+  "birthCert",
+  BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
+] as const;
 const sha256Hex = z.string().regex(/^[0-9a-f]{64}$/);
 
 /**
@@ -107,16 +121,20 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
   const seedId = `nomosSeed${stem}`;
   const birthId = `nomosBirth${stem}`;
   const publicSchema = decl.payloadSchema as z.ZodObject<z.ZodRawShape>;
-  const internalSchema = publicSchema.extend({
+  const encryptedBirth = (decl.aggregate.encryptedFields?.length ?? 0) > 0;
+  const seedSchema = publicSchema.extend({
     principal: z.string().min(1),
     bornAt: z.string().min(1),
     ownerKeyHash: sha256Hex.optional(),
     birthCert: z.string().optional(),
   });
+  const parentSchema = seedSchema.extend({
+    ...(encryptedBirth ? { [BUSINESS_BIRTH_SEED_PAYLOAD_FIELD]: z.string().min(1) } : {}),
+  });
 
   const seedBase = directive(seedId)
     .ensures(decl.aggregate)
-    .payload(internalSchema)
+    .payload(seedSchema)
     .plan((p) => {
       decl.plan(ensure(decl.aggregate, rootId), p);
       return [];
@@ -128,10 +146,30 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
 
   const birthBase = directive(birthId)
     .creates(decl.aggregate)
-    .payload(internalSchema)
+    .payload(parentSchema)
     .plan((p) => {
       const founder = p.principal as string;
       const child = workspaceNameForKey(namespace, String(decl.key(p)));
+      const childPayload = { ...(p as Record<string, unknown>) };
+      if (encryptedBirth) {
+        const rawSeed = childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
+        if (typeof rawSeed !== "string") {
+          throw new Error(
+            `birth(${decl.aggregate.id}): Nomos did not carry the internally sealed genesis facts`,
+          );
+        }
+        let sealed: unknown;
+        try {
+          sealed = JSON.parse(rawSeed);
+        } catch {
+          throw new Error(`birth(${decl.aggregate.id}): the internally sealed genesis facts are malformed`);
+        }
+        if (sealed === null || typeof sealed !== "object" || Array.isArray(sealed)) {
+          throw new Error(`birth(${decl.aggregate.id}): the internally sealed genesis facts are malformed`);
+        }
+        Object.assign(childPayload, sealed as Record<string, unknown>);
+      }
+      delete childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
       const chain: Array<Record<string, unknown>> = [
         {
           domain: "bootstrap",
@@ -153,7 +191,7 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
           domain,
           directiveId: seedId,
           actor: founder,
-          payload: p,
+          payload: childPayload,
         },
       ];
 
@@ -184,7 +222,7 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
       if (apStr("issuer")) {
         chain.push({
           domain,
-          directiveId: "setAuthProvider",
+          directiveId: "seedAuthProvider",
           actor: founder,
           payload: {
             issuer: apStr("issuer"),
@@ -212,6 +250,7 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
     publicPayloadSchema: publicSchema,
     rootId,
     namespace,
+    keyField: decl.keyField,
   };
   const parent = { ...birthBase, businessBirth: metadata } as BusinessBirthDirective;
   return {
@@ -236,6 +275,8 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
     __nomos_enrollDelegation: internalDirective(enrollDelegation),
     __nomos_signerDelegationByUser: internalSurface(signerDelegationByUser),
     __nomos_AuthProvider: internalSurface(AuthProvider),
+    __nomos_seedAuthProvider: internalDirective(seedAuthProvider),
+    __nomos_authProviderSeedBeforeWarrant: internalSurface(authProviderSeedBeforeWarrant),
     __nomos_setAuthProvider: internalDirective(setAuthProvider),
     __nomos_authProvider: internalSurface(authProvider),
     // Obscure framework export keys minimize accidental tenant collisions. Stable law ids remain the real