@githolon/dsl 0.102.4 → 0.103.0

package/src/build_package.ts

@@ -8,7 +8,7 @@
 /**
  * THE GENERIC PACKAGE BUILD SURFACE — `@githolon/dsl/build-package` (#M4).
  *
- * BUILD-TIME ONLY (imports `node:crypto` via `./manifest.js`): reached via the
+ * BUILD-TIME ONLY (imports `node:crypto` for derived artifact digests): reached via the
  * `@githolon/dsl/build-package` subpath, NEVER the runtime barrel — the engine bundle
  * must stay node-builtin-free (esbuild `--platform=neutral`).
  *
@@ -19,37 +19,26 @@
  *     15-positional-parameter `module(...)` helper (dedupe by wire id, the
  *     impure-capability directive check, default read-models, and the
  *     HASH-LOAD-BEARING omit-when-empty key discipline).
- *   * `buildReadManifest(modules)` — the read-projection descriptor (aggregateFieldKinds +
- *     query/count/spatial/derived/combined routing). Field KINDS, not drivers. NO LONGER WRITTEN to
- *     `build/` (the old `domain_manifests.json` sidecar was a local diagnostic the contract ignored); the
- *     read routing lives in the package OpenAPI now. Kept as a function for callers that want the value.
- *   * `buildIdentity(modules)` — the per-domain IDENTITY emit + admits_domain_hash registry (#193/#136),
- *     hoisted from `emit_identity.ts` (palette-gap domains recorded-and-excluded). The admission identity
- *     is carried in the package USD IR + the committed `nomos.stable-ids.json` lockfile; the old
- *     `domain_identity_*.json` sidecars (and `writeIdentity`) are REMOVED. The per-domain hash is surfaced
- *     in the compile summary.
- *   * `emitUsdJsonForModules(modules)` — the one-line USD-IR emit every
- *     `emit_*_usd_json.ts` wrapped (`emitUsd` over `/Nomos/<domain>` layers).
+ * Projection routes and admission identity are deliberately absent from this surface: both now
+ * come from the typed USDA law graph. The retired JSON read/identity manifest builders were
+ * removed so tenant tooling cannot accidentally create a second law representation.
  */
 import { createHash } from "node:crypto";
-import { mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { z } from "zod";
 
 import type { AggregateHandle } from "./aggregate.js";
 import type { Directive } from "./directive.js";
 import type { DomainModule, PermissionVocabulary, DartImport } from "./codegen_dart.js";
-import { finishCount, type AnyCount, type CountDecl } from "./count.js";
+import type { AnyCount } from "./count.js";
 import type { QueryDecl } from "./query.js";
 import type { SpatialDecl } from "./spatial.js";
-import { finishSum, type AnySum } from "./sum.js";
-import { finishExtremum, type AnyExtremum } from "./extremum.js";
+import type { AnySum } from "./sum.js";
+import type { AnyExtremum } from "./extremum.js";
 import type { DerivedDecl } from "./derived.js";
 import type { CombinedDecl } from "./combined.js";
 import type { ImpureCapabilityDecl } from "./codegen_provider_dart.js";
 import type { WorkspaceTypeDecl } from "./workspace_type.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
+import { withWorkspaceSharingInvitationExports } from "./workspace_sharing.js";
 import {
   applicationLanguageOf,
   assertApplicationLanguageCoversAuthoredDirectives,
@@ -67,6 +56,7 @@ import { withClearDirectives } from "./clear_directive.js";
 import { expandRoleExports, rolesOf } from "./role.js";
 import {
   withAttestedReadExports,
+  NomosSourceFrontier,
   isTrustSourceDecl,
   isTrustPolicyDecl,
   type TrustSourceDecl,
@@ -77,15 +67,14 @@ import {
   mergeRelationTypeDeclarations,
   type RelationTypeDecl,
 } from "./relation_schema.js";
-import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
-import { emitUsd } from "./usd.js";
 import { expandCapabilityExports } from "./capability_exports.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
 import { signerDelegationByUser } from "./framework/signing_identity.js";
 import { AuthProvider, setAuthProvider, authProvider } from "./framework/workspaces.js";
 import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
+import { probeEnsuredTypes, probePlanOps } from "./codegen_proof.js";
 import { assertIdOfLint } from "./idof_lint.js";
 import { assertSurfacedResolvers } from "./surfaced_lint.js";
 import {
@@ -191,6 +180,12 @@ export interface DomainModuleSpec {
   readonly dartImports?: readonly DartImport[];
   readonly dartRefImports?: DomainModule["dartRefImports"];
   readonly permissionVocabulary?: PermissionVocabulary;
+  /**
+   * Layer-emission only: the caller is composing one authored file from a domain that has already
+   * passed the Surfaced resolver lint as a complete multi-file domain. Cross-file aggregate and
+   * resolver declarations are intentionally incomplete in an individual OpenUSD layer.
+   */
+  readonly deferCrossModuleSurfacedLint?: boolean;
 }
 
 /**
@@ -212,6 +207,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
       directivesOf(merged),
       domain,
     );
+    merged = withWorkspaceSharingInvitationExports(merged, applicationLanguage.workspaceSharing);
   }
   merged = expandBusinessBirthExports(merged, spec.domain ?? spec.name);
   merged = withOwnedCustodyExports(merged);
@@ -245,6 +241,31 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     byId.set(policy.invitationLaw.claim.id, policy.invitationLaw.claim);
   }
   const discoveredDirectives = directivesOf(merged);
+  // A directive builder already possessed the typed aggregate handle. Retain that compiler link so
+  // re-exporting a lawful directive is self-contained: its local target schema joins the domain without
+  // a second magic re-export. A cross-workspace birth remains a dependency edge, not a copied child schema.
+  for (const directive of discoveredDirectives) {
+    if (directive.birthsChild !== true && directive.aggregate !== undefined) {
+      const prior = byId.get(directive.aggregate.id);
+      byId.set(
+        directive.aggregate.id,
+        (prior as { businessBirthInternal?: unknown } | undefined)?.businessBirthInternal === true
+          ? { ...directive.aggregate, businessBirthInternal: true } as AggregateHandle
+          : directive.aggregate,
+      );
+    }
+    for (const output of directive.secondaryOutputs ?? []) {
+      if (output.aggregate !== undefined) {
+        const prior = byId.get(output.aggregate.id);
+        byId.set(
+          output.aggregate.id,
+          (prior as { businessBirthInternal?: unknown } | undefined)?.businessBirthInternal === true
+            ? { ...output.aggregate, businessBirthInternal: true } as AggregateHandle
+            : output.aggregate,
+        );
+      }
+    }
+  }
   const directives = applyConflictPolicyResolvers(
     applicationLanguage === undefined
       ? discoveredDirectives
@@ -286,6 +307,114 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const declaresOwnedRead = [...byId.values()].some(
     (a) => (a as { audience?: { kind?: unknown } }).audience?.kind === "owned",
   );
+  // BUSINESS-BIRTH INITIALISER EFFECT SIGNATURE: `birth(A, { initialise })`
+  // lowers to a private `nomosSeedA` directive. The tenant writes the
+  // initializer, but never receives that generated directive and therefore
+  // cannot honestly append `.alsoEnsures(B)` to it. Capture the initializer's
+  // observed typed effects into the compiler-owned seed before applying the
+  // same closed-effect check used for ordinary, tenant-authored directives.
+  for (let index = 0; index < directives.length; index += 1) {
+    const candidate = directives[index]!;
+    if (candidate.businessBirthSeed !== true) continue;
+    const where = `${spec.domain ?? spec.name}/${candidate.id}`;
+    const probed = probePlanOps(candidate, where);
+    if (probed === undefined) {
+      throw new Error(
+        `[business birth effects] ${where}: Nomos could not analyse the generated birth initializer. ` +
+          "Supply a lawful .example(...) for any cross-field payload constraints; the child seed " +
+          "will not be emitted with an incomplete effect signature.",
+      );
+    }
+    const declared = new Set<string>([
+      `${candidate.marker}:${candidate.aggregateId}`,
+      ...(candidate.secondaryOutputs ?? []).map(
+        (output) => `${output.marker}:${output.aggregateId}`,
+      ),
+    ]);
+    const additions: NonNullable<Directive<unknown>["secondaryOutputs"]>[number][] = [];
+    for (const op of probed.ops) {
+      const marker = op.marker;
+      const aggregateId = op.aggregateType;
+      if (marker === undefined || aggregateId === undefined) continue;
+      const key = `${marker}:${aggregateId}`;
+      if (declared.has(key)) continue;
+      const aggregate = byId.get(aggregateId);
+      if (aggregate === undefined) {
+        throw new Error(
+          `[business birth effects] ${where}: the initializer writes ${marker} -> ${aggregateId}, ` +
+            "but that aggregate is not part of the domain. Export its aggregate declaration so the " +
+            "generated child law can carry its schema.",
+        );
+      }
+      declared.add(key);
+      additions.push({ marker, aggregateId, aggregate });
+    }
+    if (additions.length > 0) {
+      directives[index] = {
+        ...candidate,
+        secondaryOutputs: [...(candidate.secondaryOutputs ?? []), ...additions],
+      };
+    }
+  }
+  // OWNED CREATE/ENSURE EFFECT SIGNATURE: `create(Owned)` / `ensure(Owned, id)` deliberately seats the
+  // verified creator on the framework RelationTuple in the SAME plan. That consequence is Nomos-generated,
+  // so the tenant must not know to spell `.alsoEnsures(RelationTuple)` themselves; make the transformed law
+  // state the hidden effect honestly before the generic effect checker probes it.
+  for (let index = 0; index < directives.length; index += 1) {
+    const candidate = directives[index]!;
+    const target = byId.get(candidate.aggregateId);
+    const ownsTarget = target?.audience?.kind === "owned";
+    const birthsOwnedRecord = candidate.marker === "creates" || candidate.marker === "ensures";
+    const alreadyDeclared = (candidate.secondaryOutputs ?? []).some(
+      (output) => output.marker === "ensures" && output.aggregateId === RelationTuple.id,
+    );
+    if (ownsTarget && birthsOwnedRecord && !alreadyDeclared) {
+      directives[index] = {
+        ...candidate,
+        secondaryOutputs: [
+          ...(candidate.secondaryOutputs ?? []),
+          { marker: "ensures", aggregateId: RelationTuple.id, aggregate: RelationTuple },
+        ],
+      };
+    }
+  }
+  // `writeTuple(...)` and attested foreign reads have deterministic framework bookkeeping
+  // effects visible in the plan but intentionally hidden from tenant business types. Infer
+  // only those framework effects into the signature before the closed-effect checker runs.
+  // Arbitrary tenant aggregates remain explicit `.alsoEnsures(...)` declarations.
+  const inferredFrameworkEnsures = new Map<string, AggregateHandle>([
+    [RelationTuple.id, RelationTuple as AggregateHandle],
+    [NomosSourceFrontier.id, NomosSourceFrontier as AggregateHandle],
+  ]);
+  for (let index = 0; index < directives.length; index += 1) {
+    const candidate = directives[index]!;
+    if (candidate.birthsChild === true || candidate.manifestOnly === true) continue;
+    const probedEnsures = probeEnsuredTypes(
+      candidate,
+      `${spec.domain ?? spec.name}/${candidate.id}`,
+    );
+    const additions: AggregateHandle[] = [];
+    for (const aggregateId of new Set(probedEnsures)) {
+      const aggregate = inferredFrameworkEnsures.get(aggregateId);
+      if (aggregate === undefined) continue;
+      if ((candidate.secondaryOutputs ?? []).some(
+        (output) => output.marker === "ensures" && output.aggregateId === aggregate.id,
+      )) continue;
+      additions.push(aggregate);
+    }
+    if (additions.length === 0) continue;
+    directives[index] = {
+      ...candidate,
+      secondaryOutputs: [
+        ...(candidate.secondaryOutputs ?? []),
+        ...additions.map((aggregate) => ({
+          marker: "ensures" as const,
+          aggregateId: aggregate.id,
+          aggregate,
+        })),
+      ],
+    };
+  }
   if (declaresPrivateRead) {
     if (!byId.has(AuthProvider.id)) {
       byId.set(AuthProvider.id, declaresOwnedRead
@@ -490,17 +619,17 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
       ? { ...relationTuplesByObject, businessBirthInternal: true } as QueryDecl
       : relationTuplesByObject);
   }
-  // FIRST-CLASS VALUE OBJECTS (value_object.ts): the deduped, sorted descriptors of every
-  // named VO the domain's aggregates carry (transitive nested VOs included) — the input to
-  // the additive `nomosValueObjects` USD key. Omit-when-empty (era rule): a VO-free domain's
-  // module — and thus its USD/package bytes — is byte-identical to before VOs existed.
-  const valueObjects = collectValueObjectDescriptors(aggregates);
   // DOMAIN CONTRACTS (domain_contracts.md): the public DTO shapes this domain declares, discovered by
   // shape across the merged module list. Deduped by id (later-wins), sorted for byte-determinism. Omit-
   // when-empty (era rule): a contract-free domain's module/USD/package bytes are byte-identical.
   const contractById = new Map<string, import("./contract.js").ContractHandle>();
   for (const c of contractsOf(merged)) contractById.set(c.id, c);
   const contracts = [...contractById.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  // FIRST-CLASS VALUE OBJECTS (value_object.ts): close over both stored aggregates and public
+  // contracts. A contract may be the only local owner of a named value object (especially a
+  // cross-domain publication DTO); collecting aggregates alone left a dangling type reference in
+  // the canonical law graph. Transitive nested VOs remain included by the descriptor collector.
+  const valueObjects = collectValueObjectDescriptors([...aggregates, ...contracts]);
   // SPATIAL × VO PAIRING (fail at build, not at fold): a spatial index over a VO-typed field
   // must index a GEO value object (an RFC 7946 geometry — the R*Tree's bbox source). A
   // structural VO (e.g. a PostalAddress) has no geometry to index. Non-VO fields (a
@@ -619,11 +748,13 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // chained conflict-reference codegen consumes AND the canonical manifest records as the
   // hash-bearing conflictResolution contract. A Surfaced-free domain runs zero checks and is
   // byte-identical; a resolver policy deliberately becomes part of business law.
-  const surfacedResolvers = assertSurfacedResolvers(
-    aggregates,
-    directives,
-    spec.domain ?? spec.name,
-  );
+  const surfacedResolvers = spec.deferCrossModuleSurfacedLint
+    ? []
+    : assertSurfacedResolvers(
+        aggregates,
+        directives,
+        spec.domain ?? spec.name,
+      );
   const publicApplicationIntents = applicationLanguage === undefined
     ? undefined
     : [
@@ -696,513 +827,6 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   };
 }
 
-// ─────────────────────────────────────────────────────────────────────────────────
-// buildReadManifest — domain_manifests.json (hoisted from emit_manifests.ts)
-// ─────────────────────────────────────────────────────────────────────────────────
-
-/** One field's read-projection descriptor: the leaf kind (+ a map's value kind). */
-export interface FieldKindDescriptor {
-  kind: string;
-  mapValueKind?: string;
-}
-export type AggregateSchema = Record<string, FieldKindDescriptor>;
-export type AggregateFieldKinds = Record<string, AggregateSchema>;
-
-export interface QueryKeyField {
-  field: string;
-  kind: string;
-}
-export interface QueryDescriptor {
-  id: string;
-  key: QueryKeyField[];
-  returns: string;
-}
-export interface CountDescriptor {
-  id: string;
-  of: string;
-  by: string | null;
-  /** The canonical predicate (`WirePred` in the Rust parser — `{kind:"eq"|"ne"|"and"|"or",…}`).
-   *  OMITTED entirely when the count declares none: predicate-free read manifests stay
-   *  byte-identical (the Rust side reads it `#[serde(rename = "where", default)]`). */
-  where?: unknown;
-}
-export interface SpatialDescriptor {
-  id: string;
-  of: string;
-  on: string;
-}
-export interface ProjectionReturnDescriptor {
-  type: string;
-  nullable: boolean;
-  jsonSchema: unknown;
-}
-export interface DerivedDescriptor {
-  id: string;
-  of: string;
-  returns: ProjectionReturnDescriptor;
-}
-export interface CombinedDescriptor {
-  id: string;
-  of: string;
-  refField: string;
-  reads: string;
-  returns: ProjectionReturnDescriptor;
-}
-
-/** One maintained-sum descriptor (the projection's `WireSum` shape — note `field`). */
-export interface SumDescriptor {
-  id: string;
-  of: string;
-  field: string;
-  by: string | null;
-  /** The canonical predicate — same omit-when-absent discipline as {@link CountDescriptor}. */
-  where?: unknown;
-}
-
-/** One min/max read-manifest descriptor — the Rust `WireExtremum` shape (#47): identical
- *  to {@link SumDescriptor}; the KIND is implicit in which array it rides (`mins` vs `maxes`). */
-export interface ExtremumDescriptor {
-  id: string;
-  of: string;
-  field: string;
-  by: string | null;
-  where?: unknown;
-}
-
-/** The combined read-manifest artifact (the EXACT wire shape the Rust read engine parses). */
-export interface ReadManifest {
-  aggregateFieldKinds: AggregateFieldKinds;
-  queries: QueryDescriptor[];
-  counts: CountDescriptor[];
-  spatials: SpatialDescriptor[];
-  deriveds: DerivedDescriptor[];
-  combineds: CombinedDescriptor[];
-  /** OMITTED when no domain declares a sum (read manifests predating sums stay byte-identical). */
-  sums?: SumDescriptor[];
-  /** OMITTED when no domain declares a min/max (extremum-free read manifests stay byte-identical). */
-  mins?: ExtremumDescriptor[];
-  maxes?: ExtremumDescriptor[];
-}
-
-type ZodLike = {
-  _def?: { type?: string; innerType?: ZodLike };
-  def?: { type?: string; innerType?: ZodLike };
-};
-
-function zodDef(zt: ZodLike): NonNullable<ZodLike["_def"]> {
-  return zt._def ?? zt.def ?? {};
-}
-
-function zodTypeName(zt: ZodLike): string {
-  return zodDef(zt).type ?? "unknown";
-}
-
-function describeProjectionReturn(schema: z.ZodTypeAny): ProjectionReturnDescriptor {
-  let cur = schema as unknown as ZodLike;
-  let nullable = false;
-  while (
-    zodTypeName(cur) === "optional" ||
-    zodTypeName(cur) === "default" ||
-    zodTypeName(cur) === "nullable"
-  ) {
-    nullable = true;
-    const inner = zodDef(cur).innerType;
-    if (inner === undefined) break;
-    cur = inner;
-  }
-  return {
-    type: zodTypeName(cur),
-    nullable,
-    jsonSchema: z.toJSONSchema(schema),
-  };
-}
-
-/** Capture one aggregate's field KINDS straight off the DSL `Field` objects. */
-function schemaOf(agg: AggregateHandle): AggregateSchema {
-  const fields: AggregateSchema = {};
-  // STORED fields only — virtual `t.hasMany` inverses are partitioned into `agg.hasMany`.
-  for (const [name, field] of Object.entries(agg.fields)) {
-    const descriptor: FieldKindDescriptor = { kind: field.kind };
-    if (field.mapValueKind !== undefined) descriptor.mapValueKind = field.mapValueKind;
-    fields[name] = descriptor;
-  }
-  return fields;
-}
-
-/** Stable JSON for an aggregate schema, to detect a genuine cross-domain divergence. */
-function stable(schema: AggregateSchema): string {
-  const sorted: AggregateSchema = {};
-  for (const k of Object.keys(schema).sort()) sorted[k] = schema[k]!;
-  return JSON.stringify(sorted);
-}
-
-/**
- * Resolve the routing KIND of one query KEY FIELD against the returns-type's field
- * schema. NO FALLBACK: an undeclared key field is a declaration bug — THROW.
- */
-function keyFieldKind(
-  byType: AggregateFieldKinds,
-  queryId: string,
-  returns: string,
-  keyField: string,
-): string {
-  const schema = byType[returns];
-  if (schema === undefined) {
-    throw new Error(
-      `build-package: query '${queryId}' returns '${returns}', which has no field ` +
-        `schema — the returns handle must be an aggregate emitted into the manifest.`,
-    );
-  }
-  // A dotted key indexes a sub-value of a top-level JSON leaf; kind off the leading field.
-  const lookup = keyField.includes(".") ? keyField.split(".")[0]! : keyField;
-  const descriptor = schema[lookup];
-  if (descriptor === undefined) {
-    throw new Error(
-      `build-package: query '${queryId}' is keyed on '${keyField}' (field '${lookup}'), ` +
-        `which '${returns}' does not declare — a query cannot index an undefined field.`,
-    );
-  }
-  return descriptor.kind;
-}
-
-function describeQuery(byType: AggregateFieldKinds, q: QueryDecl): QueryDescriptor {
-  return {
-    id: q.id,
-    key: q.key.map((field) => ({
-      field,
-      kind: keyFieldKind(byType, q.id, q.returns, field),
-    })),
-    returns: q.returns,
-  };
-}
-
-function describeCount(byType: AggregateFieldKinds, c: CountDecl): CountDescriptor {
-  if (byType[c.of] === undefined) {
-    throw new Error(
-      `build-package: count '${c.id}' tallies '${c.of}', which has no field schema — ` +
-        `the of-type must be an aggregate emitted into the manifest.`,
-    );
-  }
-  // `where` rides to the projection (WireCount parses it) — OMITTED when absent, so
-  // predicate-free read manifests keep their exact pre-slice-4 bytes.
-  return { id: c.id, of: c.of, by: c.by ?? null, ...(c.where !== undefined ? { where: c.where } : {}) };
-}
-
-function describeSpatial(byType: AggregateFieldKinds, s: SpatialDecl): SpatialDescriptor {
-  const schema = byType[s.of];
-  if (schema === undefined) {
-    throw new Error(
-      `build-package: spatial '${s.id}' covers '${s.of}', which has no field schema — ` +
-        `the of-type must be an aggregate emitted into the manifest.`,
-    );
-  }
-  if (schema[s.on] === undefined) {
-    throw new Error(
-      `build-package: spatial '${s.id}' indexes geometry field '${s.on}' on '${s.of}', ` +
-        `which '${s.of}' does not declare — the geometry field must exist (no fallback).`,
-    );
-  }
-  return { id: s.id, of: s.of, on: s.on };
-}
-
-function describeDerived(byType: AggregateFieldKinds, d: DerivedDecl): DerivedDescriptor {
-  if (byType[d.of] === undefined) {
-    throw new Error(
-      `build-package: derived '${d.id}' derives from '${d.of}', which has no field ` +
-        `schema — the of-type must be an aggregate emitted into the manifest.`,
-    );
-  }
-  return { id: d.id, of: d.of, returns: describeProjectionReturn(d.returns) };
-}
-
-function describeCombined(byType: AggregateFieldKinds, c: CombinedDecl): CombinedDescriptor {
-  if (byType[c.of] === undefined) {
-    throw new Error(
-      `build-package: combined '${c.id}' lives on '${c.of}', which has no field ` +
-        `schema — the of-type must be an aggregate emitted into the manifest.`,
-    );
-  }
-  if (byType[c.reads] === undefined) {
-    throw new Error(
-      `build-package: combined '${c.id}' reads '${c.reads}', which has no field ` +
-        `schema — the queried type must be an aggregate emitted into the manifest.`,
-    );
-  }
-  return {
-    id: c.id,
-    of: c.of,
-    refField: c.refField,
-    reads: c.reads,
-    returns: describeProjectionReturn(c.returns),
-  };
-}
-
-/**
- * Build the single combined READ manifest for the modules (`domain_manifests.json`).
- * Hoisted VERBATIM-in-behaviour from `emit_manifests.ts` `buildManifests` — sorted
- * keys/arrays for byte-stability, divergence detection across domains, NO-FALLBACK
- * throws on undeclared of-types (the Rust parse would reject them anyway, loudly,
- * and break ALL reads for the workspace — fail at build instead).
- */
-export function buildReadManifest(modules: readonly DomainModule[]): ReadManifest {
-  const byType: AggregateFieldKinds = {};
-  for (const mod of modules) {
-    for (const agg of mod.aggregates as AggregateHandle[]) {
-      const schema = schemaOf(agg);
-      const existing = byType[agg.id];
-      if (existing !== undefined && stable(existing) !== stable(schema)) {
-        throw new Error(
-          `build-package: aggregate '${agg.id}' has DIVERGENT field schemas across ` +
-            `domains — the read projection cannot have two shapes for one wire type. ` +
-            `Reconcile the aggregate definition.`,
-        );
-      }
-      byType[agg.id] = schema;
-    }
-  }
-  const sorted: AggregateFieldKinds = {};
-  for (const k of Object.keys(byType).sort()) sorted[k] = byType[k]!;
-
-  const byId = new Map<string, QueryDescriptor>();
-  for (const mod of modules) {
-    for (const q of mod.queries ?? []) {
-      const descriptor = describeQuery(sorted, q);
-      const existing = byId.get(q.id);
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(descriptor)) {
-        throw new Error(
-          `build-package: query id '${q.id}' is declared with DIVERGENT routing across ` +
-            `domains — one id cannot map to two routes. Reconcile the query declaration.`,
-        );
-      }
-      byId.set(q.id, descriptor);
-    }
-  }
-  const queries = [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));
-
-  const countsById = new Map<string, CountDescriptor>();
-  for (const mod of modules) {
-    for (const raw of mod.counts ?? []) {
-      const c = finishCount(raw);
-      const descriptor = describeCount(sorted, c);
-      const existing = countsById.get(c.id);
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(descriptor)) {
-        throw new Error(
-          `build-package: count id '${c.id}' is declared with DIVERGENT maintenance across ` +
-            `domains — one id cannot map to two counters. Reconcile the count declaration.`,
-        );
-      }
-      countsById.set(c.id, descriptor);
-    }
-  }
-  const counts = [...countsById.values()].sort((a, b) => a.id.localeCompare(b.id));
-
-  // Maintained SUMS (sharding slice 3 routes the derived `nomosEstateSummary` through
-  // here; tenant sums ride the same lane). The projection's `WireSum` names the summed
-  // field `field`. Omitted entirely when none — sum-free read manifests stay byte-identical.
-  const sumsById = new Map<string, SumDescriptor>();
-  for (const mod of modules) {
-    for (const raw of mod.sums ?? []) {
-      const s = finishSum(raw);
-      if (sorted[s.of] === undefined) {
-        throw new Error(
-          `build-package: sum '${s.id}' tallies '${s.of}', which has no field schema — ` +
-            `the of-type must be an aggregate emitted into the manifest.`,
-        );
-      }
-      const descriptor: SumDescriptor = { id: s.id, of: s.of, field: s.sumField, by: s.by ?? null, ...(s.where !== undefined ? { where: s.where } : {}) };
-      const existing = sumsById.get(s.id);
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(descriptor)) {
-        throw new Error(
-          `build-package: sum id '${s.id}' is declared with DIVERGENT maintenance across ` +
-            `domains — one id cannot map to two totals. Reconcile the sum declaration.`,
-        );
-      }
-      sumsById.set(s.id, descriptor);
-    }
-  }
-  const sums = [...sumsById.values()].sort((a, b) => a.id.localeCompare(b.id));
-
-  // Maintained MIN/MAX reads (#47 — the extremum RPC's manifest half): the SAME lane
-  // as sums, two arrays (the kind is implicit in which array a descriptor rides —
-  // the Rust `WireExtremum` has parsed them since the read-engine slice). Omitted
-  // entirely when none — extremum-free read manifests stay byte-identical.
-  const lowerExtrema = (key: "mins" | "maxes"): ExtremumDescriptor[] => {
-    const byId = new Map<string, ExtremumDescriptor>();
-    for (const mod of modules) {
-      for (const raw of mod[key] ?? []) {
-        const e = finishExtremum(raw);
-        if (sorted[e.of] === undefined) {
-          throw new Error(
-            `build-package: ${key === "mins" ? "min" : "max"} '${e.id}' reads '${e.of}', which has no field schema — ` +
-              `the of-type must be an aggregate emitted into the manifest.`,
-          );
-        }
-        const descriptor: ExtremumDescriptor = { id: e.id, of: e.of, field: e.valueField, by: e.by ?? null, ...(e.where !== undefined ? { where: e.where } : {}) };
-        const existing = byId.get(e.id);
-        if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(descriptor)) {
-          throw new Error(
-            `build-package: ${key === "mins" ? "min" : "max"} id '${e.id}' is declared with DIVERGENT ` +
-              `maintenance across domains — one id cannot map to two extrema. Reconcile the declaration.`,
-          );
-        }
-        byId.set(e.id, descriptor);
-      }
-    }
-    return [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));
-  };
-  const mins = lowerExtrema("mins");
-  const maxes = lowerExtrema("maxes");
-
-  const spatialsById = new Map<string, SpatialDescriptor>();
-  for (const mod of modules) {
-    for (const s of mod.spatials ?? []) {
-      const descriptor = describeSpatial(sorted, s);
-      const existing = spatialsById.get(s.id);
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(descriptor)) {
-        throw new Error(
-          `build-package: spatial id '${s.id}' is declared with DIVERGENT maintenance across ` +
-            `domains — one id cannot map to two indexes. Reconcile the spatial declaration.`,
-        );
-      }
-      spatialsById.set(s.id, descriptor);
-    }
-  }
-  const spatials = [...spatialsById.values()].sort((a, b) => a.id.localeCompare(b.id));
-
-  const derivedsByNamespaceAndId = new Map<string, DerivedDescriptor>();
-  for (const mod of modules) {
-    for (const d of mod.deriveds ?? []) {
-      const descriptor = describeDerived(sorted, d);
-      const key = `${descriptor.of}\u0000${descriptor.id}`;
-      const existing = derivedsByNamespaceAndId.get(key);
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(descriptor)) {
-        throw new Error(
-          `build-package: derived field '${descriptor.of}.${descriptor.id}' is declared ` +
-            `with DIVERGENT projection across domains. Reconcile the declaration.`,
-        );
-      }
-      derivedsByNamespaceAndId.set(key, descriptor);
-    }
-  }
-  const deriveds = [...derivedsByNamespaceAndId.values()].sort(
-    (a, b) => a.of.localeCompare(b.of) || a.id.localeCompare(b.id),
-  );
-
-  const combinedsByNamespaceAndId = new Map<string, CombinedDescriptor>();
-  for (const mod of modules) {
-    for (const c of mod.combineds ?? []) {
-      const descriptor = describeCombined(sorted, c);
-      const key = `${descriptor.of}\u0000${descriptor.id}`;
-      const existing = combinedsByNamespaceAndId.get(key);
-      if (existing !== undefined && JSON.stringify(existing) !== JSON.stringify(descriptor)) {
-        throw new Error(
-          `build-package: combined field '${descriptor.of}.${descriptor.id}' is declared ` +
-            `with DIVERGENT projection across domains. Reconcile the declaration.`,
-        );
-      }
-      combinedsByNamespaceAndId.set(key, descriptor);
-    }
-  }
-  const combineds = [...combinedsByNamespaceAndId.values()].sort(
-    (a, b) => a.of.localeCompare(b.of) || a.id.localeCompare(b.id),
-  );
-
-  return {
-    aggregateFieldKinds: sorted,
-    queries,
-    counts,
-    spatials,
-    deriveds,
-    combineds,
-    ...(sums.length > 0 ? { sums } : {}),
-    ...(mins.length > 0 ? { mins } : {}),
-    ...(maxes.length > 0 ? { maxes } : {}),
-  };
-}
-
-// ─────────────────────────────────────────────────────────────────────────────────
-// buildIdentity / writeIdentity — the IDENTITY artifacts (hoisted from emit_identity.ts)
-// ─────────────────────────────────────────────────────────────────────────────────
-
-/** One domain that could not produce a canonical identity, with the reason recorded. */
-export interface ExcludedDomain {
-  readonly domain: string;
-  readonly reason: string;
-}
-
-/** The result of emitting the identity manifest over a set of domain modules. */
-export interface IdentityEmit {
-  /** `{domain: canonicalManifestString}` — the gate's NOMOS_DOMAIN_MANIFEST shape. */
-  readonly manifests: Record<string, string>;
-  /** `{domain: sha256(canonicalManifest)}` — the certified hash registry. */
-  readonly hashes: Record<string, string>;
-  /** Domains OMITTED because they have no canonical identity (palette gap), recorded. */
-  readonly excluded: ExcludedDomain[];
-}
-
-/**
- * Build the identity manifest + hashes. A domain whose canonical manifest THROWS (a
- * palette-only driver the kernel cannot lower) is RECORDED in `excluded` and omitted —
- * never fabricated. The cross-language anchor (`sha256(bytes) === domainHash`) is
- * asserted for every EMITTED domain; an anchor failure is a hard error.
- */
-export function buildIdentity(modules: readonly DomainModule[]): IdentityEmit {
-  const manifests: Record<string, string> = {};
-  const hashes: Record<string, string> = {};
-  const excluded: ExcludedDomain[] = [];
-
-  for (const mod of [...modules].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
-    let bytes: Buffer;
-    let hash: string;
-    try {
-      bytes = emitManifestBytes(mod);
-      hash = domainHash(mod);
-    } catch (e) {
-      // No canonical identity under the current kernel palette — record, do not fabricate.
-      excluded.push({ domain: mod.name, reason: (e as Error).message });
-      continue;
-    }
-    const fileHash = createHash("sha256").update(bytes).digest("hex");
-    if (fileHash !== hash) {
-      throw new Error(
-        `build-package: ${mod.name} manifest-byte sha256 ${fileHash} != domainHash ${hash} — ` +
-          `the identity anchor is broken (the gate would reject these bytes).`,
-      );
-    }
-    manifests[mod.name] = bytes.toString("utf8");
-    hashes[mod.name] = hash;
-  }
-
-  if (Object.keys(manifests).length === 0) {
-    throw new Error(
-      "build-package: produced NO domain identities — refusing to emit an empty registry.",
-    );
-  }
-  return { manifests, hashes, excluded };
-}
-
-// writeIdentity (the domain_identity_*.json sidecars) — REMOVED. The admission identity is carried in the
-// package USD IR + the committed nomos.stable-ids.json lockfile; the deploy/runtime contract never read the
-// sidecars (they were local diagnostics that only confused /build consumers). `buildIdentity` stays — its
-// per-domain hash is surfaced in the compile summary.
-
-// ─────────────────────────────────────────────────────────────────────────────────
-// The canonical USD-IR emit
-// ─────────────────────────────────────────────────────────────────────────────────
-
-/**
- * The USD-IR JSON for a package's modules: `emitUsd` over `/Nomos/<domain>` layers,
- * `JSON.stringify`'d EXACTLY like every `emit_*_usd_json.ts` (single line, insertion
- * order — `emitUsd`'s sorted layers/prims are what make it reproducible; do NOT
- * canonicalize or pretty-print, the package hash rides on these bytes).
- */
-export function emitUsdJsonForModules(modules: readonly DomainModule[]): string {
-  const doc = emitUsd(
-    modules.map((mod) => ({ path: `/Nomos/${mod.domain ?? mod.name}`, module: mod })),
-  );
-  return JSON.stringify(doc);
-}
-
 /** sha256 hex over a UTF-8 string — the deploy identity (`policy:{hash}`). */
 export function sha256HexUtf8(text: string): string {
   return createHash("sha256").update(Buffer.from(text, "utf8")).digest("hex");