@githolon/dsl 0.101.5 → 0.102.0

package/src/build_package.ts

@@ -28,9 +28,6 @@
  *     is carried in the package USD IR + the committed `nomos.stable-ids.json` lockfile; the old
  *     `domain_identity_*.json` sidecars (and `writeIdentity`) are REMOVED. The per-domain hash is surfaced
  *     in the compile summary.
- *   * `packageUsda(usdJson, javascript)` — the `.package.usda` envelope, byte-exact
- *     to `build_nomos.mjs` `packageUsda()` == Rust `domain_package_from_js`
- *     (deterministic-rquickjs/src/domain_package.rs).
  *   * `emitUsdJsonForModules(modules)` — the one-line USD-IR emit every
  *     `emit_*_usd_json.ts` wrapped (`emitUsd` over `/Nomos/<domain>` layers).
  */
@@ -53,6 +50,12 @@ import type { CombinedDecl } from "./combined.js";
 import type { ImpureCapabilityDecl } from "./codegen_provider_dart.js";
 import type { WorkspaceTypeDecl } from "./workspace_type.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
+import {
+  applicationLanguageOf,
+  assertApplicationLanguageCoversAuthoredDirectives,
+  executableDirectivesForLanguage,
+  remapWorkspaceInvariantsForLanguage,
+} from "./intent.js";
 import { synthesizePreconditionInvariants } from "./precondition.js";
 import {
   BIRTH_METER_AGGREGATES,
@@ -69,7 +72,11 @@ import {
   type TrustSourceDecl,
   type TrustPolicyDecl,
 } from "./attested.js";
-import { isRelationTypeDecl, type RelationTypeDecl } from "./relation_schema.js";
+import {
+  discoverRelationTypeDeclarations,
+  mergeRelationTypeDeclarations,
+  type RelationTypeDecl,
+} from "./relation_schema.js";
 import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
 import { emitUsd } from "./usd.js";
@@ -86,7 +93,10 @@ import {
   applyConflictPolicyResolvers,
   conflictPoliciesOf,
 } from "./conflicts.js";
-import { expandBusinessBirthExports } from "./business_birth.js";
+import {
+  expandBusinessBirthExports,
+  isBusinessBirthDirective,
+} from "./business_birth.js";
 import { withOwnedCustodyExports } from "./framework/owned_custody.js";
 import { withBusinessCorrectionExports } from "./framework/business_corrections.js";
 import {
@@ -120,7 +130,7 @@ export function aggregatesOf(mod: Mod): AggregateHandle[] {
   return out;
 }
 
-/** Collect every exported `contract(...)` handle (`__isContract` duck-type). */
+/** Collect every exported `recordContract(...)` handle (`__isContract` duck-type). */
 export function contractsOf(mod: Mod): import("./contract.js").ContractHandle[] {
   const out: import("./contract.js").ContractHandle[] = [];
   for (const v of Object.values(mod)) {
@@ -193,8 +203,16 @@ export interface DomainModuleSpec {
 export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const domain = spec.domain ?? spec.name;
   const conflictPolicies = conflictPoliciesOf(spec.modules, domain);
+  const applicationLanguage = applicationLanguageOf(spec.modules, domain);
   let merged: Mod = {};
   for (const m of spec.modules) merged = { ...merged, ...m };
+  if (applicationLanguage !== undefined) {
+    assertApplicationLanguageCoversAuthoredDirectives(
+      applicationLanguage,
+      directivesOf(merged),
+      domain,
+    );
+  }
   merged = expandBusinessBirthExports(merged, spec.domain ?? spec.name);
   merged = withOwnedCustodyExports(merged);
   merged = withBusinessCorrectionExports(merged);
@@ -219,10 +237,28 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // discovered it off the same expansion). Role-free domains are byte-identical (era rule).
   merged = expandRoleExports(merged);
   const roles = rolesOf(merged);
+  const exportedRelationTypes = discoverRelationTypeDeclarations(merged);
 
   const byId = new Map<string, AggregateHandle>();
   for (const a of [...aggregatesOf(merged), ...(spec.extraAggregates ?? [])]) byId.set(a.id, a);
-  const directives = applyConflictPolicyResolvers(directivesOf(merged), conflictPolicies);
+  for (const policy of applicationLanguage?.workspaceSharing ?? []) {
+    byId.set(policy.invitationLaw.claim.id, policy.invitationLaw.claim);
+  }
+  const discoveredDirectives = directivesOf(merged);
+  const directives = applyConflictPolicyResolvers(
+    applicationLanguage === undefined
+      ? discoveredDirectives
+      : executableDirectivesForLanguage(applicationLanguage, discoveredDirectives, domain),
+    conflictPolicies,
+  );
+  // Invitations are ordinary, replayed law hidden behind the generated application. Each sharing
+  // policy contributes one possession-proof redemption directive; it is injected after the tenant
+  // language has been closed so it cannot become a second public lane.
+  for (const policy of applicationLanguage?.workspaceSharing ?? []) {
+    if (!directives.some((candidate) => candidate.id === policy.invitationLaw.redeem.id)) {
+      directives.push(policy.invitationLaw.redeem);
+    }
+  }
   // RELATIONS AUTO-ENSURE + AUTO-COMPOSE (co2 recovery DX): a domain that USES relation law — declares a
   // relation schema, a `.requires(...)`-gated directive, or relate-family/signer directives ensuring
   // RelationTuple — needs the framework RelationTuple aggregate IN the schema on TWO counts: (1) the deploy
@@ -264,6 +300,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   }
   const usesRelations =
     declaresPrivateRead ||
+    exportedRelationTypes.length > 0 ||
     (spec.relationTypes ?? []).length > 0 ||
     directives.some((d) => (d as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
     directives.some((d) => d.aggregateId === RelationTuple.id);
@@ -343,6 +380,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const queryById = new Map<string, QueryDecl>();
   for (const query of spec.queries ?? []) queryById.set(query.id, query);
   const queries = [...queryById.values()];
+  for (const policy of applicationLanguage?.workspaceSharing ?? []) {
+    if (!queries.some((candidate) => candidate.id === policy.invitationLaw.pendingByRecipient.id)) {
+      queries.push(policy.invitationLaw.pendingByRecipient);
+    }
+  }
   const counts = [...(spec.counts ?? [])];
   const spatials = [...(spec.spatials ?? [])];
   const deriveds = [...(spec.deriveds ?? [])];
@@ -368,7 +410,17 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   for (const invariant of spec.workspaceInvariants ?? []) {
     workspaceInvariantById.set(invariant.id, invariant);
   }
-  const workspaceInvariants = [...workspaceInvariantById.values()];
+  const workspaceInvariants = applicationLanguage === undefined
+    ? [...workspaceInvariantById.values()]
+    : remapWorkspaceInvariantsForLanguage(
+        [...workspaceInvariantById.values()],
+        applicationLanguage,
+      );
+  for (const policy of applicationLanguage?.workspaceSharing ?? []) {
+    if (!workspaceInvariants.some((candidate) => candidate.id === policy.invitationLaw.gate.id)) {
+      workspaceInvariants.push(policy.invitationLaw.gate);
+    }
+  }
   if (declaresBirth) {
     const haveInvariant = new Set(workspaceInvariants.map((w) => w.id));
     for (const lifecycle of [
@@ -411,14 +463,10 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
       queries.push(internalDelegationQuery);
     }
   }
-  const relationTypeByKey = new Map<string, RelationTypeDecl>();
-  for (const value of Object.values(merged)) {
-    if (isRelationTypeDecl(value)) relationTypeByKey.set(`${value.global === true ? "global" : "local"}:${value.type}`, value);
-  }
-  for (const value of spec.relationTypes ?? []) {
-    relationTypeByKey.set(`${value.global === true ? "global" : "local"}:${value.type}`, value);
-  }
-  const relationTypes = [...relationTypeByKey.values()];
+  const relationTypes = mergeRelationTypeDeclarations([
+    ...exportedRelationTypes,
+    ...(spec.relationTypes ?? []),
+  ]);
   // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX — same idiom as the meter
   // queries above): a domain that declares relation law (a relation schema, a `.requires(...)` gated
   // directive, or relate-family/signer directives ensuring RelationTuple) gets the framework's
@@ -576,12 +624,26 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     directives,
     spec.domain ?? spec.name,
   );
+  const publicApplicationIntents = applicationLanguage === undefined
+    ? undefined
+    : [
+        ...applicationLanguage.intents,
+        ...directives.filter((directive) =>
+          isBusinessBirthDirective(directive) &&
+          !applicationLanguage.intents.some((intent) => intent.id === directive.id)),
+      ];
 
   return {
     name: spec.name,
     domain: spec.domain ?? spec.name,
     aggregates,
     directives,
+    ...(publicApplicationIntents !== undefined
+      ? { applicationIntents: publicApplicationIntents }
+      : {}),
+    ...(applicationLanguage !== undefined && applicationLanguage.workspaceSharing.length > 0
+      ? { applicationWorkspaceSharing: [...applicationLanguage.workspaceSharing] }
+      : {}),
     // Diagnostic metadata for the compile summary — NOT law (not hashed). Omit-when-empty.
     ...(autoDeclaredEnsures.length > 0 ? { autoDeclaredEnsures } : {}),
     // ROLE SUGAR codegen metadata — NOT law (not hashed): drives the `canEdit<Agg>`/`canView<Agg>`
@@ -1125,63 +1187,9 @@ export function buildIdentity(modules: readonly DomainModule[]): IdentityEmit {
 // per-domain hash is surfaced in the compile summary.
 
 // ─────────────────────────────────────────────────────────────────────────────────
-// The .package.usda envelope + the USD-IR emit
+// The canonical USD-IR emit
 // ─────────────────────────────────────────────────────────────────────────────────
 
-/** The package format marker the kernel checks (domain_package.rs / build_nomos.mjs). */
-export const NOMOS_DOMAIN_PACKAGE_FORMAT = "nomos.openusd-ir-package.v1";
-
-/** Lowercase hex of the UTF-8 bytes (== build_nomos.mjs `hexUtf8` == Rust `hex_encode`). */
-export function hexUtf8(text: string): string {
-  return Buffer.from(text, "utf8").toString("hex");
-}
-
-/**
- * The `.package.usda` envelope — BYTE-EXACT to `build_nomos.mjs` `packageUsda()` and
- * Rust `domain_package_from_js` (deterministic-rquickjs/src/domain_package.rs:11-33).
- * The kernel's acceptance is substring-based field extraction over this template; the
- * domainHash the deploy names is sha256 over the WHOLE returned string (trailing
- * newline included) exactly as committed.
- */
-export function packageUsda(usdJson: string, javascript: string, opts: { compact?: boolean } = {}): string {
-  // THE COMPACT ERA (opt-in, 2026-07-04): base64 blob fields (`*B64`, 1.33× text) instead of hex
-  // (2×). Requires every consumer to carry the decode arm (kernel domain_package.rs extract_blob +
-  // the JS parsers) — shipped ahead of this emit, so `compact: true` is the tenant's explicit
-  // choice once their stack is current. Hex stays the default emit until a future major; hex
-  // packages parse FOREVER (the era rule). sha256(the returned string) is the domainHash either
-  // way — a compact recompile is ONE named hash move (batched with minify + locale-strip).
-  if (opts.compact) {
-    return `#usda 1.0
-(
-    customData = {
-        string nomos:format = "${NOMOS_DOMAIN_PACKAGE_FORMAT}"
-    }
-)
-
-def "NomosDomainPackage"
-{
-    custom string nomos:usdJsonB64 = "${Buffer.from(usdJson, "utf8").toString("base64")}"
-    custom string nomos:executable:language = "javascript"
-    custom string nomos:executable:javascriptB64 = "${Buffer.from(javascript, "utf8").toString("base64")}"
-}
-`;
-  }
-  return `#usda 1.0
-(
-    customData = {
-        string nomos:format = "${NOMOS_DOMAIN_PACKAGE_FORMAT}"
-    }
-)
-
-def "NomosDomainPackage"
-{
-    custom string nomos:usdJsonHex = "${hexUtf8(usdJson)}"
-    custom string nomos:executable:language = "javascript"
-    custom string nomos:executable:javascriptHex = "${hexUtf8(javascript)}"
-}
-`;
-}
-
 /**
  * The USD-IR JSON for a package's modules: `emitUsd` over `/Nomos/<domain>` layers,
  * `JSON.stringify`'d EXACTLY like every `emit_*_usd_json.ts` (single line, insertion

package/src/business_birth.ts

@@ -1,7 +1,7 @@
 // NOMOS — one business birth at the tenant surface; compute-science mechanics lower here.
 
 import { z } from "zod";
-import { BUSINESS_BIRTH_SEED_PAYLOAD_FIELD } from "./aggregate.js";
+import { BUSINESS_BIRTH_SEED_PAYLOAD_FIELD, OWNED_READ_RELATION } from "./aggregate.js";
 import { ensure } from "./authoring.js";
 import { directive, type Directive } from "./directive.js";
 import {
@@ -12,6 +12,7 @@ import {
   type ParentAttestedBirthMarker,
 } from "./births.js";
 import { readFrameworkDeclared } from "./read.js";
+import type { Field } from "./fields.js";
 import {
   AuthProvider,
   authProvider,
@@ -38,7 +39,7 @@ import {
   birthAttestation,
   seedBirthAttestation,
 } from "./framework/home.js";
-import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { RelationTuple, relationTuplesByObject, writeTuple } from "./framework/relations.js";
 import {
   SignerDelegation,
   enrollDelegation,
@@ -57,6 +58,9 @@ export interface BusinessBirthMetadata {
   readonly rootId: string;
   readonly namespace: string;
   readonly keyField: string;
+  /** Private proof/lowering policy; omitted from every generated tenant payload. */
+  readonly founderRoles: readonly string[];
+  readonly founderScope: string;
 }
 
 export interface BusinessBirthDirective extends Directive<Record<string, unknown>> {
@@ -104,7 +108,16 @@ function businessBirthsOf(mod: Record<string, unknown>): BusinessBirthDecl[] {
   );
 }
 
-function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unknown> {
+// A declared birth remains reusable as framework law, but once a wider business
+// intent composes it there must not also be a generated direct-birth lane. That
+// second lane could skip the intent's parent-workspace consequences and let two
+// apparently valid tenant APIs create observably different worlds.
+const applicationIntentOnlyBirths = new WeakSet<object>();
+
+function lowerOne<P extends Record<string, unknown>, F extends Record<string, Field>>(
+  decl: BusinessBirthDecl<P, F>,
+  domain: string,
+): Record<string, unknown> {
   const fields = (decl.payloadSchema as z.ZodObject<z.ZodRawShape>).shape;
   for (const field of INTERNAL_FIELDS) {
     if (Object.prototype.hasOwnProperty.call(fields, field)) {
@@ -116,8 +129,11 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
   }
 
   const stem = decl.aggregate.id.replace(/[^A-Za-z0-9]/g, "");
-  const namespace = (decl.namespace ?? decl.aggregate.id).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-  const rootId = `${namespace}:self`;
+  const aggregateNoun = decl.aggregate.id.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  const namespace = (decl.namespace ?? aggregateNoun).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  // Record identity follows the aggregate noun; workspace addressing follows the optional business
+  // namespace. Changing a URL/name must never silently change which aggregate row is the root.
+  const rootId = `${aggregateNoun}:self`;
   const seedId = `nomosSeed${stem}`;
   const birthId = `nomosBirth${stem}`;
   const publicSchema = decl.payloadSchema as z.ZodObject<z.ZodRawShape>;
@@ -135,9 +151,42 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
   const seedBase = directive(seedId)
     .ensures(decl.aggregate)
     .payload(seedSchema)
-    .plan((p) => {
-      decl.plan(ensure(decl.aggregate, rootId), p);
-      return [];
+    .plan((p, ctx) => {
+      const businessOps = decl.plan(ensure(decl.aggregate, rootId), p as P, ctx);
+      const founder = p.principal as string;
+      const grantedAt = p.bornAt as string;
+      return [
+        ...(Array.isArray(businessOps) ? businessOps : []),
+        // Every born workspace is operable from intent zero. This is framework administration, not a
+        // tenant role, and therefore never appears in the generated application surface.
+        ...writeTuple({
+          object: "workspace:self",
+          relation: "admin",
+          subject: founder,
+          grantedBy: founder,
+          grantedAt,
+        }),
+        ...(decl.aggregate.audience?.kind === "owned"
+          ? writeTuple({
+              object: "workspace:self",
+              relation: OWNED_READ_RELATION,
+              subject: founder,
+              grantedBy: founder,
+              grantedAt,
+            })
+          : []),
+        // Business ownership remains explicit policy. The tenant names roles; Nomos owns subjects,
+        // provenance, tuple mechanics and the atomic genesis ordering underneath them.
+        ...decl.founderRoles.flatMap((relation) =>
+          writeTuple({
+            object: `${decl.founderScope}:self`,
+            relation,
+            subject: founder,
+            grantedBy: founder,
+            grantedAt,
+          }),
+        ),
+      ];
     });
   const seed = {
     ...seedBase,
@@ -149,7 +198,7 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
     .payload(parentSchema)
     .plan((p) => {
       const founder = p.principal as string;
-      const child = workspaceNameForKey(namespace, String(decl.key(p)));
+      const child = workspaceNameForKey(namespace, String(decl.key(p as P)));
       const childPayload = { ...(p as Record<string, unknown>) };
       if (encryptedBirth) {
         const rawSeed = childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
@@ -251,8 +300,14 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
     rootId,
     namespace,
     keyField: decl.keyField,
+    founderRoles: decl.founderRoles,
+    founderScope: decl.founderScope,
   };
-  const parent = { ...birthBase, businessBirth: metadata } as BusinessBirthDirective;
+  const parent = {
+    ...birthBase,
+    businessBirth: metadata,
+    ...(applicationIntentOnlyBirths.has(decl) ? { businessBirthInternal: true } : {}),
+  } as BusinessBirthDirective;
   return {
     [`__nomos_${birthId}`]: parent,
     [`__nomos_${seedId}`]: seed,
@@ -295,6 +350,34 @@ function lowerOne(decl: BusinessBirthDecl, domain: string): Record<string, unkno
   };
 }
 
+/**
+ * Lower a declared business birth for use as one consequence of a wider business intent.
+ * The child recipe remains private; the outer intent carries the birth gate and can add
+ * same-workspace business consequences atomically.
+ */
+export function businessBirthConsequence<
+  P extends Record<string, unknown>,
+  F extends Record<string, Field>,
+>(
+  decl: BusinessBirthDecl<P, F>,
+): BusinessBirthDirective {
+  if (decl.domain === undefined) {
+    throw new Error(
+      `birth(${decl.aggregate.id}) is composed by another intent, so name its owning domain once with ` +
+        `.inDomain("...")`,
+    );
+  }
+  applicationIntentOnlyBirths.add(decl);
+  const lowered = Object.values(lowerOne(decl, decl.domain)).find(
+    (value): value is BusinessBirthDirective =>
+      !!value && typeof value === "object" && (value as { businessBirth?: unknown }).businessBirth !== undefined,
+  );
+  if (lowered === undefined) {
+    throw new Error(`birth(${decl.aggregate.id}): Nomos could not lower the declared business birth`);
+  }
+  return lowered;
+}
+
 /** Lower the one tenant-facing birth declaration into ordinary, gate-visible framework directives. */
 export function expandBusinessBirthExports<M extends Record<string, unknown>>(
   mod: M,

package/src/clear_directive.ts

@@ -29,6 +29,7 @@ import { directive, type Directive, type RequirableDirective } from "./directive
 import { instance, type AggregateHandle } from "./aggregate.js";
 import { clear } from "./ops.js";
 import type { Field } from "./fields.js";
+import { idOf } from "./value_object.js";
 
 /** Capitalize the first character (the clear-directive id joins `clear` + AggId + Field). */
 function cap(s: string): string {
@@ -51,9 +52,10 @@ export function clearDirectiveId(aggregateId: string, field: string): string {
  * `clearRequires`.
  */
 export function makeClearDirective(agg: AggregateHandle, field: string, requires?: string): Directive<unknown> {
+  const payloadId = idOf(agg);
   const built = directive(clearDirectiveId(agg.id, field))
     .mutates(agg)
-    .payload(z.object({ id: z.string().min(1), clearedAt: z.string() }))
+    .payload(z.object({ id: payloadId, clearedAt: z.string() }))
     .plan((p: { id: string; clearedAt: string }) => [clear(instance(agg, p.id), field as never)])
     .doc(
       `Explicitly clears the '${field}' field of a ${agg.id} (writes an explicit null — the declared clearable lane).`,