@githolon/dsl 0.101.3 → 0.101.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.101.3",
+  "version": "0.101.5",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -470,14 +470,13 @@ function authorityConformanceLegLines(
     `  const realFetch2 = globalThis.fetch;`,
     `  globalThis.fetch = (() => { throw new Error("OFFLINE PROOF VIOLATED: authority-conformance touched the network"); }) as typeof fetch;`,
     `  try {`,
-    `    // (a) SPY on offerDirective: capture what the generated client passes, re-encode the v2 envelope it`,
-    `    //     would produce (the one-encoder shape), decode it back, and assert security.actor IS the actor.`,
+    `    // (a) SPY on offerDirective: capture what the generated client passes WITHOUT admitting a synthetic`,
+    `    //     business write, re-encode the v2 envelope, and assert security.actor IS the actor.`,
     `    const ACTOR = "user:proof-conformance";`,
     `    let captured: { domain: string; directiveId: string; payload: unknown; opts?: { domainHash?: string; actor?: string } } | undefined;`,
-    `    const realOffer: typeof holon.offerDirective = holon.offerDirective.bind(holon);`,
     `    holon.offerDirective = (domain, directiveId, payload, opts) => {`,
     `      captured = { domain, directiveId, payload, opts };`,
-    `      return realOffer(domain, directiveId, payload, opts);`,
+    `      return Promise.resolve("0000000000000000000000000000000000000000");`,
     `    };`,
     `    try {`,
     `      await ${factory}(holon, { actor: ACTOR }).${leg.directiveId}(${payloadEntries});`,
@@ -2576,8 +2575,9 @@ export function legsForDomain(
  *  (gaps 1+3, co2 feedback), with its taxonomy (compile-valid | standalone-provable | child-birth-provable).
  *  A CHILD-ONLY law (no standalone create, installed only via a parent birth) is registered under its OWN
  *  domain key pointing at the parent birth that proves it. `githolon proof [--domain <key>]` resolves for
- *  every domain. The default is the first STANDALONE-provable domain (the live `.mts` lane needs one), else
- *  the first child-birth-provable, else the first compiled domain. */
+ *  every domain. The default is the first BUSINESS birth: that is the product surface `proof --live`
+ *  promises to exercise even when the same domain also exposes ordinary standalone creates. Otherwise use
+ *  the first standalone-provable domain, then the first child-birth-provable, then the first compiled domain. */
 export function proofLegsIndex(
   modules: readonly DomainModule[],
   packageInterface?: Readonly<Record<string, DomainInterface>>,
@@ -2608,9 +2608,10 @@ export function proofLegsIndex(
     }
   }
   if (order.length === 0) return null;
+  const businessBirthFirst = order.find((d) => domains[d]!.childBirth?.businessAggregateId !== undefined);
   const standaloneFirst = order.find((d) => (domains[d]!.legs ?? []).includes("standalone-provable"));
   const childBirthFirst = order.find((d) => (domains[d]!.legs ?? []).includes("child-birth-provable"));
-  const def = standaloneFirst ?? childBirthFirst ?? order[0]!;
+  const def = businessBirthFirst ?? standaloneFirst ?? childBirthFirst ?? order[0]!;
   return { default: def, domains };
 }
 
@@ -2625,7 +2626,7 @@ function v2IdentityAndCleanupPreamble(opts: TsProofOptions, hashConst: string, n
   void opts;
   void hashConst;
   return [
-    `// Nomos prepared this signed home and installed the package before entering generated application code.`,
+    `// Nomos prepared an isolated signed application workspace and installed the package before entering generated application code.`,
     `// The application proof supplies business facts only; identity/custody/law selection stay underneath.`,
     `const fail: (m: string) => never = (m) => { throw new Error(m); };`,
     `const ok = (m: string) => console.log("✓ " + m);`,
@@ -2636,9 +2637,9 @@ function v2IdentityAndCleanupPreamble(opts: TsProofOptions, hashConst: string, n
     `let runError: unknown = null;`,
     `try {`,
     ``,
-    `// ${n()}. the one managed entry: the logged-in user's durable Nomos home`,
+    `// ${n()}. the one managed entry: an isolated application beneath the logged-in user's durable Nomos home`,
     `if (process.env.NOMOS_PROOF_MANAGED !== "1" || !AUTHOR_SECRET) fail("run this cloud proof through: githolon proof --live");`,
-    `ok(\`Nomos home ready — \${WS}\`);`,
+    `ok(\`Nomos application ready — \${WS}\`);`,
   ];
 }
 
@@ -2987,12 +2988,14 @@ function generateBootstrapOnlyProof(
 }
 
 export function generateTsProof(modules: readonly DomainModule[], opts: TsProofOptions): string {
-  // PRIMARY-DOMAIN SELECTION: the live `.mts` drives a STANDALONE (ungated) create when the package has one
-  // (the full deploy → write → query → sync → cloud loop). Else a BIRTH package (`.births()`) drives the
-  // birth. Else a GATED-CREATE package — whose only creating write `.requires(R)` (co2's estate `createSite`)
-  // — drives the RELATION-BOOTSTRAP leg as its primary write: seed authority, THEN the gated create is
-  // admitted (never a naive first dispatch that the gate would refuse). Either way, the marker = the primary
-  // domain's FULL legs (so the offline runner + the index never describe different directives).
+  // PRIMARY-DOMAIN SELECTION: a declared BUSINESS birth is always first because `proof --live` promises the
+  // product's one `app.birth(facts)` surface, not a convenient auxiliary create from the same law. Without
+  // one, drive a STANDALONE ungated create; then a generic `.births()` child; then a bootstrap-provable gated
+  // create. Either way, the marker = the primary domain's FULL legs (so the offline runner + index agree).
+  const hasBusinessBirth = (m: DomainModule): boolean =>
+    (m.directives as Directive<unknown>[]).some(
+      (d) => (d as { businessBirth?: unknown }).businessBirth !== undefined,
+    );
   const hasStandaloneCreate = (m: DomainModule): boolean =>
     (m.directives as Directive<unknown>[]).some((d) => isStandaloneCreate(d));
   const hasBirth = (m: DomainModule): boolean => hasBirthDirective(m);
@@ -3006,7 +3009,7 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
       }) !== undefined;
     } catch { return false; }
   };
-  const mod = modules.find(hasStandaloneCreate) ?? modules.find(hasBirth) ?? modules.find(isBootstrapProvable);
+  const mod = modules.find(hasBusinessBirth) ?? modules.find(hasStandaloneCreate) ?? modules.find(hasBirth) ?? modules.find(isBootstrapProvable);
   if (mod === undefined) {
     // No provable creating write anywhere. If a GATED create exists but its authority can't be seeded, surface
     // the loud bootstrap diagnostic (never a false green); else the generic "add a .creates" remedy.
@@ -3027,6 +3030,12 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
   const primaryLegs = legsForDomain(mod, modules, opts.interface);
   const childBirth = primaryLegs.childBirth;
 
+  // A business-birth domain may also contain `addSite`-style standalone creates. Those are useful secondary
+  // verbs, but they must never steal the live acceptance proof from the one public application birth.
+  if (childBirth?.businessAggregateId !== undefined) {
+    return generateBirthOnlyProof(mod, modules, opts, primaryLegs);
+  }
+
   // The standalone-create lane needs an UNGATED create (isStandaloneCreate — never a gated/birth/attestation
   // create, which the gate would refuse dispatched with no seeded authority). Absent one, the primary write
   // is the birth leg (a `.births()` domain) or the relation-bootstrap leg (a gated-create domain).

package/src/compile_package_main.ts

@@ -2365,6 +2365,7 @@ async function main(): Promise<void> {
   // Exec the bin DIRECTLY (not via `node`): esbuild's postinstall replaces the
   // JS shim with the platform-native binary, which only an exec can run.
   const esbuildBin = path.join(path.dirname(esbuildPkgJson), esbuildBinRel ?? "bin/esbuild");
+  const esbuildMod = (await import(pathToFileURL(path.join(path.dirname(esbuildPkgJson), "lib", "main.js")).href)) as typeof import("esbuild");
 
   const canonicalizeEngineJavascript = (source: string): string => {
     // esbuild includes module labels derived from the package's install topology in
@@ -2391,7 +2392,6 @@ async function main(): Promise<void> {
     // package as the binary) so a resolve-plugin can stub zod's locale barrel to en-only —
     // the CLI binary has no plugin surface. Same bundle options + minify; deterministic
     // (pinned esbuild version, deterministic minifier).
-    const esbuildMod = (await import(pathToFileURL(path.join(path.dirname(esbuildPkgJson), "lib", "main.js")).href)) as typeof import("esbuild");
     const localeStripToEn = {
       name: "nomos-zod-locales-en-only",
       setup(build: import("esbuild").PluginBuild) {
@@ -2778,7 +2778,13 @@ async function main(): Promise<void> {
   // ── 5. the typed TS client (#10 — the web sibling of codegen_dart), with the
   //       deployed law's content hash baked in (emitted AFTER the package is hashed) ──
   const clientPath = path.join(outDir, `${cfg.name}.client.ts`);
-  writeFileSync(clientPath, generateTsClient(presentationDomainModules, { packageName: cfg.name, domainHash, interface: packageInterface, compat: nomosCompat }), "utf8");
+  const clientSource = generateTsClient(presentationDomainModules, { packageName: cfg.name, domainHash, interface: packageInterface, compat: nomosCompat });
+  try {
+    await esbuildMod.transform(clientSource, { loader: "ts", format: "esm", target: "es2020", logLevel: "silent" });
+  } catch (e) {
+    fail(`generated TypeScript client is not syntactically valid — this is a Nomos codegen bug: ${(e as Error).message}`);
+  }
+  writeFileSync(clientPath, clientSource, "utf8");
 
   // ── 6. the typed Dart frontend (opt-in; the Flutter sibling of step 5, emitted
   //       after the package hash like the TS client) ──

package/src/zod_lazy.ts

@@ -26,12 +26,22 @@ export function zodUnwrapLazy(zt: z.ZodTypeAny): z.ZodTypeAny {
 }
 
 const capFirst = (s: string): string => (s.length === 0 ? s : s[0]!.toUpperCase() + s.slice(1));
-const camelize = (s: string): string => s.replace(/[_\s-]+(\w)/g, (_m, c: string) => c.toUpperCase());
+
+/** Turn one structural path component into a valid TS/Dart identifier component.
+ * `*` is the record-value marker, not tenant vocabulary, so name it `Value`. */
+function typeNamePart(segment: string): string {
+  if (segment === "*") return "Value";
+  const words = segment.split(/[^A-Za-z0-9]+/).filter(Boolean);
+  const joined = words.map(capFirst).join("") || "Field";
+  return /^[A-Za-z]/.test(joined) ? joined : `N${joined}`;
+}
 
 /**
  * A PascalCase type name from a payload path (`saveTree.root` → `SaveTreeRoot`), array markers
- * dropped. The SAME base the TS and Dart recursive-type synthesizers use so a recursive type's
- * TS alias and Dart class agree in the common case.
+ * dropped and record wildcards named `Value` (`saveJson.data.*` → `SaveJsonDataValue`). The SAME
+ * base the TS and Dart recursive-type synthesizers use so a recursive type's TS alias and Dart
+ * class agree in the common case. Every segment is sanitized here because schema object keys may
+ * contain punctuation even though generated language identifiers may not.
  */
 export function recursiveTypeBaseName(path: string): string {
   return (
@@ -39,7 +49,7 @@ export function recursiveTypeBaseName(path: string): string {
       .replace(/\[\]/g, "")
       .split(/[.]/)
       .filter(Boolean)
-      .map((s) => capFirst(camelize(s)))
+      .map(typeNamePart)
       .join("") || "Recursive"
   );
 }