@githolon/dsl 0.101.6 → 0.102.1

package/src/contract.ts

@@ -7,7 +7,7 @@
 // aggregate's domainHash moves only when its OWN fields change. Contracts ride the IR as ADDITIVE metadata
 // (like value objects — era-safe, omit-when-empty) and are stable-id tracked for evolution.
 //
-//   const CatalogueListingContract = contract("CatalogueListing", { listingId: t.string(), name: t.string() });
+//   const CatalogueListingContract = recordContract("CatalogueListing", { listingId: t.string(), name: t.string() });
 //   const CatalogueListing = aggregate("CatalogueListing", { listingId: t.string().merge(Lww), … })
 //     .implements(CatalogueListingContract);                 // ← compile-checked: the aggregate SATISFIES the shape
 //   const EstateAsset = aggregate("EstateAsset", {
@@ -39,21 +39,27 @@ export function isContractHandle(x: unknown): x is ContractHandle {
   return typeof x === "object" && x !== null && (x as { __isContract?: unknown }).__isContract === true;
 }
 
+/** The generated public type name for a contract. Contract ids are already public business names;
+ *  preserve an explicit `...Contract` suffix rather than producing `...ContractContract`. */
+export function contractTypeName(id: string): string {
+  return id.endsWith("Contract") ? id : `${id}Contract`;
+}
+
 /**
  * Declare a domain CONTRACT — a named public shape. Reuse the `t.*` field builders for the fields (the merge
  * driver is irrelevant — a contract is a shape). Export it; a concrete aggregate `.implements(...)` it, and
  * other domains reference it via `t.ref` / `t.foreignRef`. Purely additive: a package with no contract emits
  * byte-identically to before.
  */
-export function contract<const Id extends string, const F extends Record<string, ContractField>>(
+export function recordContract<const Id extends string, const F extends Record<string, ContractField>>(
   id: Id,
   fields: F,
 ): ContractHandle<Id, F> {
   if (typeof id !== "string" || id.length === 0) {
-    throw new Error("contract(id, fields): the id must be a non-empty string (the stable public name).");
+    throw new Error("recordContract(id, fields): the id must be a non-empty string (the stable public name).");
   }
   if (typeof fields !== "object" || fields === null || Object.keys(fields).length === 0) {
-    throw new Error(`contract('${id}'): declare at least one field (a contract is a public shape).`);
+    throw new Error(`recordContract('${id}'): declare at least one field (a record contract is a public shape).`);
   }
   return { id, fields, __isContract: true };
 }

package/src/dart_barrel_guard.ts

@@ -27,7 +27,7 @@ export interface BarrelExportedFile {
   readonly src: string;
 }
 
-/** Declared PUBLIC top-level type/typedef names in a Dart source (class/enum/mixin/extension type/typedef).
+/** Declared PUBLIC top-level type/typedef/named-extension names in a Dart source.
  *  Private (`_`-prefixed) names never leak through an `export`, so they cannot collide — excluded. */
 export function publicDartDeclarations(src: string): Set<string> {
   const names = new Set<string>();
@@ -39,6 +39,10 @@ export function publicDartDeclarations(src: string): Set<string> {
   for (let m = re.exec(src); m !== null; m = re.exec(src)) {
     if (!m[1]!.startsWith("_")) names.add(m[1]!);
   }
+  const extension = /^extension\s+([A-Za-z][A-Za-z0-9_]*)\s+(?:<[^\n>]+>\s+)?on\s+/gm;
+  for (let m = extension.exec(src); m !== null; m = extension.exec(src)) {
+    if (!m[1]!.startsWith("_")) names.add(m[1]!);
+  }
   return names;
 }
 

package/src/describe_model.ts

@@ -145,7 +145,7 @@ const publicAggregates = (mod: DomainModule): AggregateHandle[] =>
   );
 
 const publicDirectives = (mod: DomainModule): Directive<unknown>[] =>
-  (mod.directives as Directive<unknown>[]).filter((directive) =>
+  ((mod.applicationIntents ?? mod.directives) as Directive<unknown>[]).filter((directive) =>
     directive.framework !== true
       && (directive as { businessBirthInternal?: unknown }).businessBirthInternal !== true
   );
@@ -181,7 +181,11 @@ const aggregateItem = (domain: string, aggregate: AggregateHandle): NomosDescrib
   };
 };
 
-const actionItem = (domain: string, directive: Directive<unknown>): NomosDescribeItemModel => {
+const actionItem = (
+  domain: string,
+  directive: Directive<unknown>,
+  publicAggregateIds: ReadonlySet<string>,
+): NomosDescribeItemModel => {
   const businessBirth = businessBirthOf(directive);
   const actionId = businessBirth === undefined ? directive.id : "birth";
   const actionLabel = businessBirth === undefined
@@ -190,7 +194,7 @@ const actionItem = (domain: string, directive: Directive<unknown>): NomosDescrib
   const outputs = [
     { effect: directive.marker, type: directive.aggregateId },
     ...(directive.secondaryOutputs ?? []).map((output) => ({ effect: output.marker, type: output.aggregateId })),
-  ];
+  ].filter((output) => publicAggregateIds.has(output.type));
   const effectVerb = (marker: string): string => ({
     creates: "create",
     mutates: "change",
@@ -207,7 +211,7 @@ const actionItem = (domain: string, directive: Directive<unknown>): NomosDescrib
     id: `${domain}.${actionId}`,
     label: actionLabel,
     summary: businessBirth === undefined
-      ? directive.description ?? `${actionLabel} will ${effect}.`
+      ? directive.description ?? (effect === "" ? `${actionLabel} changes the business.` : `${actionLabel} will ${effect}.`)
       : `${actionLabel} will ${effect}.`,
     details: {
       domain,
@@ -407,7 +411,11 @@ export function buildNomosDescribeModel(
   });
   const questions = modules.flatMap(questionItems);
   const nouns = aggregates.map(({ domain, aggregate }) => aggregateItem(domain, aggregate));
-  const verbs = actions.map(({ domain, directive }) => actionItem(domain, directive));
+  const publicByDomain = new Map(modules.map((mod) => [
+    mod.domain ?? mod.name,
+    new Set(publicAggregates(mod).map((aggregate) => aggregate.id)),
+  ]));
+  const verbs = actions.map(({ domain, directive }) => actionItem(domain, directive, publicByDomain.get(domain) ?? new Set()));
   const rules = modules.flatMap(ruleItems);
   const domainCount = new Set(modules.map((mod) => mod.domain ?? mod.name)).size;
 

package/src/directive.ts

@@ -17,6 +17,7 @@
  */
 import type { z } from "zod";
 import type { AggregateHandle, ReadModelRow } from "./aggregate.js";
+import { isRuntimeLaw } from "./authoring_context.js";
 import type { Field } from "./fields.js";
 import type { PlannedOp } from "./ops.js";
 import type { Ports } from "./ctx.js";
@@ -24,6 +25,7 @@ import type { RelationDecl } from "./relation.js";
 import type { QueryDecl } from "./query.js";
 import { normalizeActivity, type ActivityInput, type ActivityDescriptor } from "./activity.js";
 import { BIRTH_METER_QUERIES } from "./birth_meter.js";
+import { zodDef, zodKind, zodObjectShape } from "./zod_introspection.js";
 import {
   isFromPayloadRef,
   isTrustPolicyDecl,
@@ -56,6 +58,8 @@ export type ReferentialMarker = "creates" | "mutates" | "ensures" | "archives";
 export interface PreconditionDescriptor {
   /** The guarded aggregate's TYPE id (the ref type the synthesized invariant resolves). */
   readonly aggregateId: string;
+  /** Stored business fields used to distinguish an unresolved metadata shell from a real row. */
+  readonly fieldNames: readonly string[];
   /** Pure payload → target instance id (no clock, no IO — re-derived identically on every peer). */
   readonly idField: (payload: unknown) => string;
   /** The fixed-predicate specialization, or `predicate` for the general `.where` form. */
@@ -86,6 +90,43 @@ export interface PreconditionDescriptor {
 export interface SecondaryOutput {
   readonly marker: ReferentialMarker;
   readonly aggregateId: string;
+  /** This action may affect more than one record of this aggregate type. */
+  readonly many?: true;
+}
+
+/**
+ * Frontend-only application shaping for a foreign reference carried by a
+ * directive payload. Tenant code supplies the referenced business record;
+ * generated client state privately supplies its workspace locator and wire id.
+ * This does not change the law or its replayed payload shape.
+ */
+export interface BusinessRecordInput {
+  /** Payload id field, which must also be a foreignRef field on the target aggregate. */
+  readonly field: string;
+  /** Optional business argument name; defaults to the id field without its `Id` suffix. */
+  readonly as?: string;
+}
+
+/**
+ * Application-only composition for a business action whose law performs a
+ * dynamic attested read. The generated stateful client first obtains the
+ * source's signed answer, privately seats its identity through an internal
+ * directive, then submits the business action carrying that attestation.
+ */
+export interface BusinessSourceTrust {
+  /** Hidden law directive that records the accepted source identity. */
+  readonly viaDirectiveId: string;
+  /** Payload field routing the dynamic source read. */
+  readonly fromPayload: string;
+  /** Source query to attest. */
+  readonly queryId: string;
+  /** Source-query argument -> business payload field. */
+  readonly queryArgs: Readonly<Record<string, string>>;
+  /** Hidden trust payload field -> business payload field. */
+  readonly copy: Readonly<Record<string, string>>;
+  /** Hidden trust payload fields populated from the signed envelope. */
+  readonly genesisField: string;
+  readonly keyHashesField: string;
 }
 
 export interface Directive<P = unknown> {
@@ -101,7 +142,26 @@ export interface Directive<P = unknown> {
    */
   readonly secondaryOutputs?: readonly SecondaryOutput[];
   readonly payloadSchema: z.ZodType<P>;
+  /**
+   * One lawful sample of this directive's complete payload. Proof generation
+   * and author-time checks prefer it when constraints span several fields and
+   * therefore cannot be inferred from the individual Zod leaves. Validated at
+   * declaration time; non-law tooling metadata, omitted when undeclared.
+   */
+  readonly payloadExample?: Readonly<P>;
   readonly plan: (payload: P, ctx: Ports) => PlannedOp[];
+  /** Application-only typed-record inputs. Omitted from canonical law output. */
+  readonly businessRecordInputs?: readonly BusinessRecordInput[];
+  /** Application-only source-trust composition. Omitted from canonical law. */
+  readonly businessSourceTrust?: BusinessSourceTrust;
+  /** Application-only identity binding. The generated application removes this
+   * field from tenant input and fills it from its verified signed-in principal. */
+  readonly businessPrincipalField?: string;
+  /**
+   * Signed framework or lowering law retained by Nomos but omitted from tenant
+   * application APIs. Set only through `nomosImplementationDetail(...)`.
+   */
+  readonly businessBirthInternal?: true;
   /**
    * FRAMEWORK-SHARED brand (Dart-codegen hygiene). Set (by `framework/framework_aggregates.ts`) ONLY on
    * the framework-owned directive singletons declared in `dsl/src/framework/` (the relate/signer/enroll
@@ -353,6 +413,38 @@ export interface Directive<P = unknown> {
  * each `plan` — the kernel resolves it WITHIN the one shared `admit` gate.
  */
 export interface RequirableDirective<P> extends Directive<P> {
+  /**
+   * Supply one lawful payload for proof/check synthesis when the schema has
+   * cross-field refinements. The value is validated immediately against this
+   * directive's payload schema and is never sent unless a generated proof uses
+   * it. Returns a new immutable directive.
+   */
+  example(payload: P): RequirableDirective<P>;
+  /** Bind one payload field to the generated application's verified principal.
+   * The field remains signed law and may be checked by invariants, but disappears
+   * from tenant payload types so applications cannot claim to be another person. */
+  fromCurrentPrincipal(field: string): RequirableDirective<P>;
+  /**
+   * Replace a payload foreign-reference locator with the referenced business
+   * record on generated application surfaces. The target aggregate's
+   * `foreignRef({ workspace: ... })` declaration supplies the paired workspace
+   * field; generated client state supplies its value privately.
+   */
+  fromRecord(field: string, opts?: { as?: string }): RequirableDirective<P>;
+  /**
+   * Keep dynamic-source identity, key hashing and attestation carriage inside
+   * the generated application action. [via] remains signed law but must be
+   * wrapped in `nomosImplementationDetail(...)` at its export site.
+   */
+  trustsSource(opts: {
+    via: Directive<any>;
+    fromPayload: string;
+    query: { id: string };
+    queryArgs: Readonly<Record<string, string>>;
+    copy?: Readonly<Record<string, string>>;
+    genesisField?: string;
+    keyHashesField?: string;
+  }): RequirableDirective<P>;
   /**
    * MULTI-OUTPUT: declare an ADDITIONAL aggregate this directive writes (beyond its primary marker target),
    * so generated docs/proof/client metadata name every output ("writes A + B") instead of one by convention.
@@ -361,8 +453,11 @@ export interface RequirableDirective<P> extends Directive<P> {
    * kernel folds by the plan's ops regardless — this is descriptive law metadata, not a write-restriction.
    */
   alsoWrites(aggregate: AggregateHandle, marker: ReferentialMarker): RequirableDirective<P>;
+  alsoWritesMany(aggregate: AggregateHandle, marker: ReferentialMarker): RequirableDirective<P>;
   alsoEnsures(aggregate: AggregateHandle): RequirableDirective<P>;
   alsoCreates(aggregate: AggregateHandle): RequirableDirective<P>;
+  alsoEnsuresMany(aggregate: AggregateHandle): RequirableDirective<P>;
+  alsoCreatesMany(aggregate: AggregateHandle): RequirableDirective<P>;
   alsoMutates(aggregate: AggregateHandle): RequirableDirective<P>;
   alsoArchives(aggregate: AggregateHandle): RequirableDirective<P>;
   /**
@@ -618,6 +713,7 @@ class DirectivePlanStep<Id extends string, P> {
     return this.with(
       {
         aggregateId: this.aggregate.id,
+        fieldNames: Object.keys(this.aggregate.fields).sort(),
         idField,
         kind: "absent",
         predicate: (row) => row === undefined,
@@ -639,6 +735,7 @@ class DirectivePlanStep<Id extends string, P> {
   ): DirectivePlanStep<Id, P> {
     return this.with({
       aggregateId: aggregate.id,
+      fieldNames: Object.keys(aggregate.fields).sort(),
       idField: idFn as (payload: unknown) => string,
       kind: "exists",
       predicate: (row) => row !== undefined,
@@ -661,6 +758,7 @@ class DirectivePlanStep<Id extends string, P> {
   ): DirectivePlanStep<Id, P> {
     return this.with({
       aggregateId: aggregate.id,
+      fieldNames: Object.keys(aggregate.fields).sort(),
       idField: idFn as (payload: unknown) => string,
       kind: "predicate",
       predicate: predicate as (row: Record<string, unknown> | undefined) => boolean,
@@ -758,20 +856,148 @@ export function recordObject(
  * declaration site reads `directive(id)…plan(fn).requires("cap", p => […])`.
  */
 function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
-  const alsoWrites = (aggregate: AggregateHandle, marker: ReferentialMarker): RequirableDirective<P> => {
+  const alsoWrites = (
+    aggregate: AggregateHandle,
+    marker: ReferentialMarker,
+    many = false,
+  ): RequirableDirective<P> => {
     // Dedup by (marker, aggregateId) + the primary target — declaring the same output twice is a no-op, and
     // re-declaring the primary aggregate is ignored (it is already the marker target). Sorted at emit time.
-    const next: SecondaryOutput = { marker, aggregateId: aggregate.id };
+    const next: SecondaryOutput = {
+      marker,
+      aggregateId: aggregate.id,
+      ...(many ? { many: true as const } : {}),
+    };
     const isPrimary = aggregate.id === base.aggregateId;
-    const already = (base.secondaryOutputs ?? []).some((s) => s.marker === marker && s.aggregateId === aggregate.id);
-    if (isPrimary || already) return makeRequirable(base);
+    const existing = (base.secondaryOutputs ?? []).find(
+      (s) => s.marker === marker && s.aggregateId === aggregate.id,
+    );
+    if (isPrimary || (existing !== undefined && (!many || existing.many === true))) {
+      return makeRequirable(base);
+    }
+    if (existing !== undefined) {
+      return makeRequirable({
+        ...base,
+        secondaryOutputs: (base.secondaryOutputs ?? []).map((output) =>
+          output === existing ? next : output,
+        ),
+      });
+    }
     return makeRequirable({ ...base, secondaryOutputs: [...(base.secondaryOutputs ?? []), next] });
   };
   return {
     ...base,
+    example(payload: P): RequirableDirective<P> {
+      if (isRuntimeLaw()) {
+        // The Node authoring pass already proved this example. Executable law retains it as proof
+        // metadata but does not rerun host-shaped Zod checks when a lazy domain is first forced.
+        return makeRequirable({ ...base, payloadExample: payload });
+      }
+      const parsed = base.payloadSchema.safeParse(payload);
+      if (!parsed.success) throw new Error(
+        `directive('${base.id}').example(...) must satisfy its payload schema: ${parsed.error.message}`,
+      );
+      return makeRequirable({ ...base, payloadExample: parsed.data });
+    },
+    fromCurrentPrincipal(field: string): RequirableDirective<P> {
+      const name = field.trim();
+      if (name.length === 0) {
+        throw new Error("directive.fromCurrentPrincipal(field): field must be a non-empty payload field name");
+      }
+      if (zodKind(base.payloadSchema) !== "object") {
+        throw new Error(
+          `directive('${base.id}').fromCurrentPrincipal('${name}') needs an object payload schema`,
+        );
+      }
+      const principalSchema = zodObjectShape(base.payloadSchema)[name];
+      if (principalSchema === undefined) {
+        throw new Error(
+          `directive('${base.id}').fromCurrentPrincipal('${name}') names no payload field`,
+        );
+      }
+      let principalValue = principalSchema;
+      while (zodKind(principalValue) === "optional" || zodKind(principalValue) === "default") {
+        principalValue = zodDef(principalValue).innerType!;
+      }
+      if (zodKind(principalValue) !== "string") {
+        throw new Error(
+          `directive('${base.id}').fromCurrentPrincipal('${name}') must bind a string payload field`,
+        );
+      }
+      if (base.businessPrincipalField !== undefined && base.businessPrincipalField !== name) {
+        throw new Error(
+          `directive('${base.id}').fromCurrentPrincipal(...) may bind only one identity field`,
+        );
+      }
+      return makeRequirable({ ...base, businessPrincipalField: name });
+    },
+    fromRecord(field: string, opts?: { as?: string }): RequirableDirective<P> {
+      if (typeof field !== "string" || field.length === 0) {
+        throw new Error("directive.fromRecord(field): field must be a non-empty payload field name");
+      }
+      const prior = base.businessRecordInputs ?? [];
+      const next: BusinessRecordInput = {
+        field,
+        ...(opts?.as === undefined ? {} : { as: opts.as }),
+      };
+      return makeRequirable({
+        ...base,
+        businessRecordInputs: [...prior.filter((candidate) => candidate.field !== field), next],
+      });
+    },
+    trustsSource(opts): RequirableDirective<P> {
+      if (base.businessSourceTrust !== undefined) {
+        throw new Error(
+          `directive('${base.id}').trustsSource(...) may be declared only once`,
+        );
+      }
+      const fromPayload = opts.fromPayload.trim();
+      if (fromPayload.length === 0 || opts.query.id.trim().length === 0) {
+        throw new Error(
+          `directive('${base.id}').trustsSource(...) needs a source payload field and query`,
+        );
+      }
+      const matchingRead = (base.declaredForeignReads ?? []).some(
+        (edge) =>
+          !("from" in edge) &&
+          edge.fromPayload === fromPayload &&
+          edge.queryId === opts.query.id,
+      );
+      if (!matchingRead) {
+        throw new Error(
+          `directive('${base.id}').trustsSource(...) must follow its matching dynamic .readsFrom(...) declaration`,
+        );
+      }
+      const via = opts.via as Directive<unknown> & {
+        businessBirthInternal?: unknown;
+      };
+      if (via.businessBirthInternal !== true) {
+        throw new Error(
+          `directive('${base.id}').trustsSource(...): the trust directive must be wrapped in nomosImplementationDetail(...) so tenant code cannot call it`,
+        );
+      }
+      return makeRequirable({
+        ...base,
+        businessSourceTrust: {
+          viaDirectiveId: via.id,
+          fromPayload,
+          queryId: opts.query.id,
+          queryArgs: { ...opts.queryArgs },
+          copy: { ...(opts.copy ?? {}) },
+          genesisField: opts.genesisField ?? "sourceGenesis",
+          keyHashesField: opts.keyHashesField ?? "sourceKeyHashes",
+        },
+      });
+    },
     alsoWrites,
+    alsoWritesMany: (aggregate: AggregateHandle, marker: ReferentialMarker) =>
+      alsoWrites(aggregate, marker, true),
     alsoEnsures: (aggregate: AggregateHandle) => alsoWrites(aggregate, "ensures"),
     alsoCreates: (aggregate: AggregateHandle) => alsoWrites(aggregate, "creates"),
+    alsoEnsuresMany: (aggregate: AggregateHandle) =>
+      alsoWrites(aggregate, "ensures", true),
+    alsoCreatesMany: (aggregate: AggregateHandle) =>
+      alsoWrites(aggregate, "creates", true),
     alsoMutates: (aggregate: AggregateHandle) => alsoWrites(aggregate, "mutates"),
     alsoArchives: (aggregate: AggregateHandle) => alsoWrites(aggregate, "archives"),
     requires(
@@ -925,7 +1151,9 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
         entry = { queryId: query.id, from: source };
       }
       const canon = (e: ForeignReadEdge): string =>
-        "from" in e ? `0${e.from}${e.queryId}` : `1${e.policy}${e.fromPayload}${e.queryId}`;
+        "from" in e
+          ? `0\\0${e.from}\\0${e.queryId}`
+          : `1\\0${e.policy}\\0${e.fromPayload}\\0${e.queryId}`;
       const prior = base.declaredForeignReads ?? [];
       const byKey = new Map<string, ForeignReadEdge>(prior.map((e) => [canon(e), e]));
       byKey.set(canon(entry), entry);
@@ -1009,3 +1237,14 @@ function makeRequirable<P>(base: Directive<P>): RequirableDirective<P> {
 export function directive<const Id extends string>(id: Id): DirectiveMarkerStep<Id> {
   return new DirectiveMarkerStep(id);
 }
+
+/**
+ * Keep a signed-law declaration available to Nomos while omitting it from every
+ * generated tenant API. This is deliberately namespaced and explicit: it is for
+ * framework lowering and temporary migration law, never a second application lane.
+ */
+export function nomosImplementationDetail<T extends object>(
+  declaration: T,
+): T & { readonly businessBirthInternal: true } {
+  return { ...declaration, businessBirthInternal: true };
+}

package/src/engine_entry.ts

@@ -57,7 +57,7 @@ import { RelationTuple, __setDispatchContext } from "./framework/relations.js";
 import { BIRTH_METER_AGGREGATES } from "./birth_meter.js";
 import { AuthProvider as FrameworkAuthProvider, setAuthProvider as frameworkSetAuthProvider } from "./framework/auth_provider_law.js";
 import { namespacedAggregateIds, qualifyReadProjectionType, READ_PROJECTION_DELIMITER } from "./read_projection_namespace.js";
-import { isRelationTypeDecl } from "./relation_schema.js";
+import { discoverRelationTypeDeclarations } from "./relation_schema.js";
 import { synthesizePreconditionInvariants } from "./precondition.js";
 import { synthesizeBirthQuotaInvariants } from "./birth_meter.js";
 import { withBirthMeterExports } from "./birth_meter_ensure.js";
@@ -80,9 +80,16 @@ import type { CombinedDecl } from "./combined.js";
 import type { InvariantBody, InvariantEvidence, InvariantVerdict } from "./relation.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 import type { QueryRow } from "./report.js";
-import { expandBusinessBirthExports } from "./business_birth.js";
+import { expandBusinessBirthExports, isBusinessBirthDirective } from "./business_birth.js";
 import { withOwnedCustodyExports } from "./framework/owned_custody.js";
 import { withBusinessCorrectionExports } from "./framework/business_corrections.js";
+import { withClearDirectives } from "./clear_directive.js";
+import {
+  applicationLanguageOf,
+  assertApplicationLanguageCoversAuthoredDirectives,
+  executableDirectivesForLanguage,
+  remapWorkspaceInvariantsForLanguage,
+} from "./intent.js";
 
 /** One bundled domain module: a bag of named exports the entry scans by SHAPE. */
 export type DomainModuleExports = Record<string, unknown>;
@@ -250,6 +257,14 @@ function combinedsOf(mod: DomainModuleExports): CombinedDecl[] {
 function mergeModules(mods: readonly DomainModuleExports[], domain: string): DomainModuleExports {
   let merged: DomainModuleExports = {};
   for (const m of mods) merged = { ...merged, ...m };
+  const applicationLanguage = applicationLanguageOf([merged], domain);
+  if (applicationLanguage !== undefined) {
+    assertApplicationLanguageCoversAuthoredDirectives(
+      applicationLanguage,
+      [...directivesOf(merged).values()],
+      domain,
+    );
+  }
   merged = expandBusinessBirthExports(merged, domain);
   merged = withOwnedCustodyExports(merged);
   merged = withBusinessCorrectionExports(merged);
@@ -261,7 +276,11 @@ function mergeModules(mods: readonly DomainModuleExports[], domain: string): Dom
   // the registry + `describe()` see the exact surface the composed manifest carries.
   // ROLE SUGAR: lift every `role(...).emit()` into its grant/revoke/seed directives at the SAME
   // engine merge point so the registry dispatches them (the compiler saw them via the same expander).
-  return expandRoleExports(withAttestedReadExports(withBirthMeterExports(expandCapabilityExports(merged)))) as DomainModuleExports;
+  return expandRoleExports(
+    withClearDirectives(
+      withAttestedReadExports(withBirthMeterExports(expandCapabilityExports(merged))),
+    ),
+  ) as DomainModuleExports;
 }
 
 /**
@@ -298,11 +317,16 @@ interface DomainSlice {
 }
 
 /** Build one domain's slice from its merged module exports (the original scans). */
-function buildDomainSlice(mod: DomainModuleExports): DomainSlice {
+function buildDomainSlice(mod: DomainModuleExports, domain: string): DomainSlice {
   // ── directiveId → {directive, agg} ────────────────────────────────────────────
   const registry = new Map<string, RegistryEntry>();
   const aggs = aggregatesOf(mod);
-  const dirs = directivesOf(mod);
+  const applicationLanguage = applicationLanguageOf([mod], domain);
+  const discoveredDirectives = [...directivesOf(mod).values()];
+  const executableDirectives = applicationLanguage === undefined
+    ? discoveredDirectives
+    : executableDirectivesForLanguage(applicationLanguage, discoveredDirectives, domain);
+  const dirs = new Map(executableDirectives.map((directive) => [directive.id, directive]));
   // RELATIONS AUTO-ENSURE (mirror of composeDomainModule): a relate-family directive `.ensures(RelationTuple)`
   // needs the framework aggregate registered for DISPATCH too — without it the directive is silently dropped
   // below. Inject iff a directive targets it and the dev didn't already export the handle.
@@ -398,6 +422,7 @@ function buildDomainSlice(mod: DomainModuleExports): DomainSlice {
 
   // ── workspace-invariant id → declaration — from the SAME exports (#266, by shape) ──
   const wsInvariants = new Map<string, WorkspaceInvariantDecl>();
+  const declaredWorkspaceInvariants: WorkspaceInvariantDecl[] = [];
   for (const v of Object.values(mod)) {
     if (
       v &&
@@ -413,9 +438,14 @@ function buildDomainSlice(mod: DomainModuleExports): DomainSlice {
             `body — the gate would have nothing to evaluate (docs/workspace_invariant.md).`,
         );
       }
-      wsInvariants.set(w.id, w);
+      declaredWorkspaceInvariants.push(w);
     }
   }
+  for (const w of applicationLanguage === undefined
+    ? declaredWorkspaceInvariants
+    : remapWorkspaceInvariantsForLanguage(declaredWorkspaceInvariants, applicationLanguage)) {
+    wsInvariants.set(w.id, w);
+  }
   // ── DESUGARED write-path preconditions (`.requiresExisting`/`.creates(Agg,idFn)`/`.where`) ──
   // The synthesized workspace invariants are NOT module exports (they are generated from the directive
   // markers), so the export-scan above never sees them. Synthesize them here — from the SAME discovered
@@ -438,8 +468,8 @@ function buildDomainSlice(mod: DomainModuleExports): DomainSlice {
   // objects stay bare; the synthesized read-visibility `workspace` caps are never authored relationTypes,
   // so they are absent here too (their bare grants stay bare — the read gate hardcodes `workspace:self`).
   const qualifiableRelations = new Set<string>();
-  for (const v of Object.values(mod)) {
-    if (!isRelationTypeDecl(v) || v.global === true) continue;
+  for (const v of discoverRelationTypeDeclarations(mod)) {
+    if (v.global === true) continue;
     for (const rel of v.relations.keys()) qualifiableRelations.add(`${v.type}#${rel}`);
   }
 
@@ -471,7 +501,7 @@ export function collectEngineRouting(
     if (!list.includes(domainName)) list.push(domainName);
   };
   for (const [domainName, mods] of Object.entries(domains)) {
-    const slice = buildDomainSlice(mergeModules(mods, domainName));
+    const slice = buildDomainSlice(mergeModules(mods, domainName), domainName);
     // Type-keyed dispatches arrive with the ROW's type — QUALIFIED for a namespaced aggregate (the
     // runtime `__type` stamp), bare for a global one / a pre-namespacing row. Route BOTH keys so
     // either era resolves to the declaring domain (the slice lookup strips the qualifier back off).
@@ -557,7 +587,7 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
     const sources = config.domains[domainName];
     if (sources === undefined) return undefined;
     const forced = sources.map((m) => (typeof m === "function" ? m() : m));
-    const slice = buildDomainSlice(mergeModules(forced, domainName));
+    const slice = buildDomainSlice(mergeModules(forced, domainName), domainName);
     sliceCache.set(domainName, slice);
     return slice;
   }
@@ -933,8 +963,8 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
 
   /**
    * THE SELF-DESCRIBE VERB (G1) — the lump's OWN OpenAPI, derived from the SAME modules it
-   * dispatches. The kernel runs this over the FOLDED law (the lump IS `nomos:executable:
-   * javascriptHex` in the package USDA in custody), so the workspace's API surface is a pure,
+   * dispatches. The kernel selects the content-addressed describe plan from the native USD
+   * package in custody, so the workspace's API surface is a pure,
    * deterministic function of installed law — NOT a host-staged blob. Its public `paths` reproduce
    * the `<name>.openapi.json` the compiler wrote; describe also carries a private, law-derived
    * framework routing manifest which the host consumes internally and never publishes.
@@ -951,7 +981,19 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
       // Aggregates dedup by wire id + RelationTuple auto-ensure (the compose contract) — openapi
       // reads aggregates only for the hasMany inverse indexes, so this matches composeDomainModule.
       const byId = aggregatesOf(merged);
-      const directives = [...directivesOf(merged).values()];
+      const discoveredDirectives = [...directivesOf(merged).values()];
+      const applicationLanguage = applicationLanguageOf([merged], domainName);
+      const directives = applicationLanguage === undefined
+        ? discoveredDirectives
+        : executableDirectivesForLanguage(applicationLanguage, discoveredDirectives, domainName);
+      const applicationIntents = applicationLanguage === undefined
+        ? undefined
+        : [
+            ...applicationLanguage.intents,
+            ...directives.filter((directive) =>
+              isBusinessBirthDirective(directive) &&
+              !applicationLanguage.intents.some((intent) => intent.id === directive.id)),
+          ];
       if (!byId.has(RelationTuple.id) && directives.some((d) => d.aggregateId === RelationTuple.id)) {
         byId.set(RelationTuple.id, RelationTuple);
       }
@@ -961,6 +1003,7 @@ export function registerEngine(config: EngineEntryConfig): RegisteredEngine {
         domain: domainName,
         aggregates: [...byId.values()],
         directives,
+        ...(applicationIntents === undefined ? {} : { applicationIntents }),
         ...(decls.queries && decls.queries.length > 0 ? { queries: [...decls.queries] } : {}),
         ...(decls.counts && decls.counts.length > 0 ? { counts: [...decls.counts] } : {}),
         ...(decls.sums && decls.sums.length > 0 ? { sums: [...decls.sums] } : {}),

package/src/engine_javascript.ts

@@ -0,0 +1,31 @@
+/**
+ * Canonicalise esbuild's non-semantic install-topology noise before the executable law is hashed.
+ *
+ * A workspace dependency is labelled `../../dsl/src/...`; the same published dependency is labelled
+ * `node_modules/@githolon/dsl/src/...`. Esbuild can also leave either one or two newlines after its
+ * `"use strict"` prologue. None of those bytes describe business law, so they must not give the same
+ * law two identities.
+ *
+ * Replacements are deliberately restricted to esbuild's generated comment/function labels. Tenant
+ * strings and executable imports remain byte-significant.
+ */
+export function canonicalizeEngineJavascript(source: string): string {
+  const body = source
+    .replace(/\r\n?/g, "\n")
+    .replace(/^[ \t]*"use strict";[ \t]*(?:\n|$)/gm, "")
+    .replace(/^(\s*\/\/ )(?:(?:\.\.\/)+dsl\/src\/|node_modules\/@githolon\/dsl\/src\/)/gm, "$1@githolon/dsl/src/")
+    .replace(/"(?:(?:\.\.\/)+dsl\/src\/|node_modules\/@githolon\/dsl\/src\/)([^"]+)"\(\) \{/g, '"@githolon/dsl/src/$1"() {')
+    .replace(/^(\s*\/\/ )(?:(?:\.\.\/)+node_modules\/zod\/|node_modules\/zod\/)/gm, "$1zod/")
+    .replace(/"(?:(?:\.\.\/)+node_modules\/zod\/|node_modules\/zod\/)([^"]+)"\(\) \{/g, '"zod/$1"() {')
+    .replace(/\n[ \t]*\n/g, "\n")
+    .trim();
+  return `"use strict";\n${body}\n`;
+}
+
+/** Remove the same install-topology label from the sealed generated application bundle. */
+export function canonicalizeGeneratedClientJavascript(source: string): string {
+  return source.replace(
+    /^(\s*\/\/ )(?:(?:\.\.\/)+dsl\/runtime\/|node_modules\/@githolon\/dsl\/runtime\/)/gm,
+    "$1@githolon/dsl/runtime/",
+  );
+}