@githolon/dsl 0.101.4 → 0.101.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.101.4",
+  "version": "0.101.6",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -470,14 +470,13 @@ function authorityConformanceLegLines(
     `  const realFetch2 = globalThis.fetch;`,
     `  globalThis.fetch = (() => { throw new Error("OFFLINE PROOF VIOLATED: authority-conformance touched the network"); }) as typeof fetch;`,
     `  try {`,
-    `    // (a) SPY on offerDirective: capture what the generated client passes, re-encode the v2 envelope it`,
-    `    //     would produce (the one-encoder shape), decode it back, and assert security.actor IS the actor.`,
+    `    // (a) SPY on offerDirective: capture what the generated client passes WITHOUT admitting a synthetic`,
+    `    //     business write, re-encode the v2 envelope, and assert security.actor IS the actor.`,
     `    const ACTOR = "user:proof-conformance";`,
     `    let captured: { domain: string; directiveId: string; payload: unknown; opts?: { domainHash?: string; actor?: string } } | undefined;`,
-    `    const realOffer: typeof holon.offerDirective = holon.offerDirective.bind(holon);`,
     `    holon.offerDirective = (domain, directiveId, payload, opts) => {`,
     `      captured = { domain, directiveId, payload, opts };`,
-    `      return realOffer(domain, directiveId, payload, opts);`,
+    `      return Promise.resolve("0000000000000000000000000000000000000000");`,
     `    };`,
     `    try {`,
     `      await ${factory}(holon, { actor: ACTOR }).${leg.directiveId}(${payloadEntries});`,
@@ -2576,8 +2575,9 @@ export function legsForDomain(
  *  (gaps 1+3, co2 feedback), with its taxonomy (compile-valid | standalone-provable | child-birth-provable).
  *  A CHILD-ONLY law (no standalone create, installed only via a parent birth) is registered under its OWN
  *  domain key pointing at the parent birth that proves it. `githolon proof [--domain <key>]` resolves for
- *  every domain. The default is the first STANDALONE-provable domain (the live `.mts` lane needs one), else
- *  the first child-birth-provable, else the first compiled domain. */
+ *  every domain. The default is the first BUSINESS birth: that is the product surface `proof --live`
+ *  promises to exercise even when the same domain also exposes ordinary standalone creates. Otherwise use
+ *  the first standalone-provable domain, then the first child-birth-provable, then the first compiled domain. */
 export function proofLegsIndex(
   modules: readonly DomainModule[],
   packageInterface?: Readonly<Record<string, DomainInterface>>,
@@ -2608,9 +2608,10 @@ export function proofLegsIndex(
     }
   }
   if (order.length === 0) return null;
+  const businessBirthFirst = order.find((d) => domains[d]!.childBirth?.businessAggregateId !== undefined);
   const standaloneFirst = order.find((d) => (domains[d]!.legs ?? []).includes("standalone-provable"));
   const childBirthFirst = order.find((d) => (domains[d]!.legs ?? []).includes("child-birth-provable"));
-  const def = standaloneFirst ?? childBirthFirst ?? order[0]!;
+  const def = businessBirthFirst ?? standaloneFirst ?? childBirthFirst ?? order[0]!;
   return { default: def, domains };
 }
 
@@ -2625,7 +2626,7 @@ function v2IdentityAndCleanupPreamble(opts: TsProofOptions, hashConst: string, n
   void opts;
   void hashConst;
   return [
-    `// Nomos prepared this signed home and installed the package before entering generated application code.`,
+    `// Nomos prepared an isolated signed application workspace and installed the package before entering generated application code.`,
     `// The application proof supplies business facts only; identity/custody/law selection stay underneath.`,
     `const fail: (m: string) => never = (m) => { throw new Error(m); };`,
     `const ok = (m: string) => console.log("✓ " + m);`,
@@ -2636,9 +2637,9 @@ function v2IdentityAndCleanupPreamble(opts: TsProofOptions, hashConst: string, n
     `let runError: unknown = null;`,
     `try {`,
     ``,
-    `// ${n()}. the one managed entry: the logged-in user's durable Nomos home`,
+    `// ${n()}. the one managed entry: an isolated application beneath the logged-in user's durable Nomos home`,
     `if (process.env.NOMOS_PROOF_MANAGED !== "1" || !AUTHOR_SECRET) fail("run this cloud proof through: githolon proof --live");`,
-    `ok(\`Nomos home ready — \${WS}\`);`,
+    `ok(\`Nomos application ready — \${WS}\`);`,
   ];
 }
 
@@ -2987,12 +2988,14 @@ function generateBootstrapOnlyProof(
 }
 
 export function generateTsProof(modules: readonly DomainModule[], opts: TsProofOptions): string {
-  // PRIMARY-DOMAIN SELECTION: the live `.mts` drives a STANDALONE (ungated) create when the package has one
-  // (the full deploy → write → query → sync → cloud loop). Else a BIRTH package (`.births()`) drives the
-  // birth. Else a GATED-CREATE package — whose only creating write `.requires(R)` (co2's estate `createSite`)
-  // — drives the RELATION-BOOTSTRAP leg as its primary write: seed authority, THEN the gated create is
-  // admitted (never a naive first dispatch that the gate would refuse). Either way, the marker = the primary
-  // domain's FULL legs (so the offline runner + the index never describe different directives).
+  // PRIMARY-DOMAIN SELECTION: a declared BUSINESS birth is always first because `proof --live` promises the
+  // product's one `app.birth(facts)` surface, not a convenient auxiliary create from the same law. Without
+  // one, drive a STANDALONE ungated create; then a generic `.births()` child; then a bootstrap-provable gated
+  // create. Either way, the marker = the primary domain's FULL legs (so the offline runner + index agree).
+  const hasBusinessBirth = (m: DomainModule): boolean =>
+    (m.directives as Directive<unknown>[]).some(
+      (d) => (d as { businessBirth?: unknown }).businessBirth !== undefined,
+    );
   const hasStandaloneCreate = (m: DomainModule): boolean =>
     (m.directives as Directive<unknown>[]).some((d) => isStandaloneCreate(d));
   const hasBirth = (m: DomainModule): boolean => hasBirthDirective(m);
@@ -3006,7 +3009,7 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
       }) !== undefined;
     } catch { return false; }
   };
-  const mod = modules.find(hasStandaloneCreate) ?? modules.find(hasBirth) ?? modules.find(isBootstrapProvable);
+  const mod = modules.find(hasBusinessBirth) ?? modules.find(hasStandaloneCreate) ?? modules.find(hasBirth) ?? modules.find(isBootstrapProvable);
   if (mod === undefined) {
     // No provable creating write anywhere. If a GATED create exists but its authority can't be seeded, surface
     // the loud bootstrap diagnostic (never a false green); else the generic "add a .creates" remedy.
@@ -3027,6 +3030,12 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
   const primaryLegs = legsForDomain(mod, modules, opts.interface);
   const childBirth = primaryLegs.childBirth;
 
+  // A business-birth domain may also contain `addSite`-style standalone creates. Those are useful secondary
+  // verbs, but they must never steal the live acceptance proof from the one public application birth.
+  if (childBirth?.businessAggregateId !== undefined) {
+    return generateBirthOnlyProof(mod, modules, opts, primaryLegs);
+  }
+
   // The standalone-create lane needs an UNGATED create (isStandaloneCreate — never a gated/birth/attestation
   // create, which the gate would refuse dispatched with no seeded authority). Absent one, the primary write
   // is the birth leg (a `.births()` domain) or the relation-bootstrap leg (a gated-create domain).