@githolon/dsl 0.102.4 → 0.103.0

package/src/codegen_dart_scenario.ts

@@ -85,7 +85,7 @@ export function generateDartScenario(
   mod: DomainModule,
   clientPackage: string,
   testPackage: string,
-  deployFile: string,
+  lawUsdzFile: string,
   options: {
     readonly surfaceName?: string;
     readonly applicationFile?: string;
@@ -194,7 +194,7 @@ export function generateDartScenario(
     `    final person = signedInAs ?? ${testPerson}.named('test');`,
     `    final packageFiles = await _applicationPackages();`,
     `    final environment = await NomosTestHarness.ephemeral(`,
-    `      deployJsonPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
+    `      lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
     `      ownerSubject: person._principal,`,
     `      workspace: nmsInternalReceivingGroupNameOf(person._principal),`,
     `      nodeEntry: Platform.environment['NOMOS_NODE_ENTRY'],`,
@@ -223,13 +223,13 @@ export function generateDartScenario(
     `    final packageFiles = await _applicationPackages();`,
     `    final cloud = await NomosTestCloud.start(`,
     `      serverEntry: serverEntry, platform: applicationName,`,
-    `      deployJsonPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
+    `      lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
     `      onDiagnostic: Platform.environment['NOMOS_TEST_DIAGNOSTICS'] == '1' ? stderr.writeln : null,`,
     `    );`,
     `    late final NomosTestHarness environment;`,
     `    try {`,
     `      environment = await NomosTestHarness.cloudBound(`,
-    `        cloud: cloud, deployJsonPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
+    `        cloud: cloud, lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
     `        platformWorkspace: applicationName, subject: person._principal,`,
     `        nodeEntry: Platform.environment['NOMOS_NODE_ENTRY'],`,
     `        phaseTimeout: const Duration(minutes: 2),`,
@@ -314,13 +314,13 @@ export function generateDartScenario(
     `        final packageAsset = await asset.readAsString();`,
     `        final identity = RegExp(r'asset\\s+identifier\\s*=\\s*@nomos:package:([^:]+):[0-9a-f]{64}@').firstMatch(packageAsset);`,
     `        if (identity == null) throw StateError('Application reference is not a compiled Nomos package: \${asset.path}');`,
-    `        final deploy = File('\${asset.parent.path}\${Platform.pathSeparator}\${identity.group(1)!}.deploy.json');`,
-    `        if (!deploy.existsSync()) throw StateError('Application package has no deploy body: \${deploy.path}');`,
-    `        final prior = placements[deploy.path];`,
+    `        final law = File('\${asset.parent.path}\${Platform.pathSeparator}\${identity.group(1)!}.law.usdz');`,
+    `        if (!law.existsSync()) throw StateError('Application package has no law archive: \${law.path}');`,
+    `        final prior = placements[law.path];`,
     `        if (prior != null && prior != payload) {`,
-    `          throw StateError('The same package is both a serving reference and deferred payload: \${deploy.path}');`,
+    `          throw StateError('The same package is both a serving reference and deferred payload: \${law.path}');`,
     `        }`,
-    `        placements[deploy.path] = payload;`,
+    `        placements[law.path] = payload;`,
     `      }`,
     `      if (placements.isEmpty) throw StateError('The application stage contains no deployable Nomos packages.');`,
     `      final ordered = placements.entries.toList()`,
@@ -335,15 +335,15 @@ export function generateDartScenario(
     `      return files;`,
     `    }`,
     `    final assetKeys = [`,
-    `      'packages/${testPackage}/lib/src/generated/${deployFile}',`,
-    `      'lib/src/generated/${deployFile}',`,
+    `      'packages/${testPackage}/lib/src/generated/${lawUsdzFile}',`,
+    `      'lib/src/generated/${lawUsdzFile}',`,
     `    ];`,
     `    Object? lastError;`,
     `    for (final key in assetKeys) {`,
     `      try {`,
     `        final data = await rootBundle.load(key);`,
     `        final dir = await Directory.systemTemp.createTemp('nms-application-package-');`,
-    `        final file = File('\${dir.path}\${Platform.pathSeparator}${deployFile}');`,
+    `        final file = File('\${dir.path}\${Platform.pathSeparator}${lawUsdzFile}');`,
     `        await file.writeAsBytes(data.buffer.asUint8List(data.offsetInBytes, data.lengthInBytes), flush: true);`,
     `        return [file];`,
     `      } catch (error) {`,

package/src/codegen_proof.ts

@@ -45,7 +45,7 @@ import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js"
 import { finishCount } from "./count.js";
 import { clearDirectiveId } from "./clear_directive.js";
 import type { DomainInterface } from "./shape_compat.js";
-import { idOfMetaOf, idOfTargetKindOf, voMetaOf, voSample } from "./value_object.js";
+import { idOfMetaOf, idOfTargetKindOf, versionedRefOfMetaOf, voMetaOf, voSample } from "./value_object.js";
 import { mintedCreateField } from "./workspace_routing.js";
 import { deterministicPorts } from "./ctx.js";
 import { __setDispatchDomain, __setDispatchContext } from "./framework/relations.js";
@@ -209,6 +209,21 @@ function sampleOfZod(
   voIncludeOptional = false,
   visited: ReadonlySet<z.ZodTypeAny> = EMPTY_LAZY_VISITED,
 ): unknown {
+  const versioned = versionedRefOfMetaOf(zt);
+  if (versioned !== undefined) {
+    return {
+      pinned: {
+        workspace: "sample-version-workspace",
+        type: versioned.targetAggregateType,
+        id: "sample-pinned-version",
+      },
+      series: {
+        workspace: "sample-version-workspace",
+        type: versioned.seriesAggregateType,
+        id: "sample-version-series",
+      },
+    };
+  }
   // RECURSIVE `z.lazy` (a self-referencing tree/JSON payload): unwrap one level, tracking the
   // lazy object's IDENTITY on this descent. Re-entering the SAME lazy is a knot: sampling can go
   // no deeper. The common case terminates NATURALLY one level up (the recursive branch is an
@@ -398,11 +413,25 @@ function typedPayloadLiteral(
   payload: Readonly<Record<string, unknown>>,
   referenceFields: Readonly<Record<string, string>>,
   overrides: Readonly<Record<string, string>> = {},
+  optionalReferenceFields: ReadonlySet<string> = new Set(),
 ): string {
-  const keys = new Set([...Object.keys(payload), ...Object.keys(overrides)]);
+  const keys = new Set([
+    ...Object.keys(payload),
+    ...Object.keys(overrides),
+    ...optionalReferenceFields,
+  ]);
   const entries = [...keys].map((field) => {
-    const expression = overrides[field]
-      ?? (referenceFields[field] !== undefined ? `${proofRefGetter(referenceFields[field]!)}()` : JSON.stringify(payload[field]));
+    const override = overrides[field];
+    const referenceType = referenceFields[field];
+    const expression = override !== undefined
+      ? override
+      : referenceType !== undefined
+        ? optionalReferenceFields.has(field)
+          ? payload[field] === undefined
+            ? "NomosOptionalRef.absent()"
+            : `NomosOptionalRef.present(${proofRefGetter(referenceType)}())`
+          : `${proofRefGetter(referenceType)}()`
+        : JSON.stringify(payload[field]);
     return `${JSON.stringify(field)}: ${expression}`;
   });
   return `{ ${entries.join(", ")} }`;
@@ -728,17 +757,34 @@ export function probeEnsuredTypes(dir: Directive<unknown>, where: string): strin
   return [...out].sort();
 }
 
-/** The `status` of a `subjects` setEntry leaf (`writeTuple`/`removeTuple` lowers a JSON `{status, …}` leaf).
- *  `"active"` = a POSITIVE grant; `"revoked"` = a REVOKE. `undefined` ⇒ not a parseable subject leaf. */
-function subjectLeafStatus(op: FieldOp): string | undefined {
-  if (op.kind !== "setEntry" || op.field !== "subjects" || typeof op.value !== "string") return undefined;
+/** The typed relationship leaf produced by current law, with one legacy string decoder so proof
+ * discovery remains able to inspect packages compiled before `RelationshipSubject` became a kernel
+ * value. New plans never manufacture the string arm. */
+function subjectLeaf(op: FieldOp): Record<string, unknown> | undefined {
+  if (op.kind !== "setEntry" || op.field !== "subjects") return undefined;
+  const typed = op.kernelValue !== undefined && "RelationshipSubject" in op.kernelValue
+    ? op.kernelValue.RelationshipSubject
+    : op.value;
+  if (typeof typed === "object" && typed !== null && !Array.isArray(typed)) {
+    return typed as Record<string, unknown>;
+  }
+  if (typeof typed !== "string") return undefined;
   try {
-    return (JSON.parse(op.value) as { status?: unknown }).status as string | undefined;
+    const parsed = JSON.parse(typed) as unknown;
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown>
+      : undefined;
   } catch {
     return undefined;
   }
 }
 
+/** `"active"` = a POSITIVE grant; `"revoked"` = a REVOKE. */
+function subjectLeafStatus(op: FieldOp): string | undefined {
+  const status = subjectLeaf(op)?.status;
+  return typeof status === "string" ? status : undefined;
+}
+
 /**
  * The relations a directive's plan POSITIVELY GRANTS — judged PER RELATION-TUPLE (per `aggregateId`), never by
  * relation-name alone. Both a grant (`writeTuple`, `status:"active"`) AND a revoke (`removeTuple`,
@@ -813,10 +859,16 @@ function resolveGrantSubjectFields(
         const inner = m !== null ? fieldForValue(m[1]) : undefined;
         if (inner !== undefined) wrappedSubjectFields.add(inner);
       }
-      // grantedBy rides the JSON leaf value — scan the serialized leaf for any synthesized payload value.
-      if (typeof o.value === "string") {
+      // grantedBy rides the typed leaf value — match its string fields to synthesized payload values.
+      const leaf = subjectLeaf(o);
+      if (leaf !== undefined) {
         for (const [name, sv] of Object.entries(synth.value)) {
-          if (typeof sv === "string" && sv.length > 0 && name !== fieldForValue(o.entryKey) && o.value.includes(sv)) {
+          if (
+            typeof sv === "string" &&
+            sv.length > 0 &&
+            name !== fieldForValue(o.entryKey) &&
+            Object.values(leaf).some((value) => value === sv)
+          ) {
             grantedByFields.add(name);
           }
         }
@@ -1947,6 +1999,8 @@ export interface ChildBirthLeg {
    *  generated client. Present only for an encrypted `.owned()` business birth. */
   readonly businessEncryption?: {
     readonly scope: string;
+    readonly recordType: string;
+    readonly recordId: string;
     readonly namespace: string;
     readonly keyField: string;
     readonly fields: Readonly<Record<string, { readonly aggSid: string; readonly fieldSid: string }>>;
@@ -2101,7 +2155,7 @@ function validateGenesisSteps(
     const mod = modules.find((m) => (m.domain ?? m.name) === s.domain);
     if (mod === undefined) {
       issues.push(
-        `${at} (${s.domain}/${s.directiveId}) targets domain '${s.domain}', which is NOT composed in this package — add its module to nomos.package.mjs \`domains\` (the one-package pattern: the parent must fold the child law so the kernel can resolve its bytes by hash; see bench/scale/fixtures/estate-birth)`,
+        `${at} (${s.domain}/${s.directiveId}) targets domain '${s.domain}', which is NOT composed in this package — add its module to nomos.project.ts \`domains\` (the one-package pattern: the parent must fold the child law so the kernel can resolve its bytes by hash; see bench/scale/fixtures/estate-birth)`,
       );
       return;
     }
@@ -2381,9 +2435,9 @@ function discoverSingletonInstanceId(seedDir: Directive<unknown>, ownerMod?: Dom
 // ── the generator ─────────────────────────────────────────────────────────────────
 
 export interface TsProofOptions {
-  /** The package name (`nomos.package.mjs` `name`) — names the artifacts the proof loads. */
+  /** The package name (`nomos.project.ts` `name`) — names the artifacts the proof loads. */
   readonly packageName: string;
-  /** sha256 of the built `.package.usda` — checked against the deploy response. */
+  /** Content identity of the built typed USDA closure — checked against the install response. */
   readonly domainHash: string;
   /** Stable-id structural interface used to teach the offline harness the hidden owned-birth seal slots. */
   readonly interface?: Readonly<Record<string, DomainInterface>>;
@@ -2512,14 +2566,20 @@ function isStandaloneProofSafe(mod: DomainModule, directive: Directive<unknown>
     !(mod.workspaceInvariants ?? []).some((invariant) => invariant.on === directive!.id);
 }
 
-/** Prefer the business create which demonstrates the richest typed relationship journey. Its prerequisites
- * are generated automatically, so a join/create that consumes two NomosRefs is a better canonical example
- * than an isolated leaf create. Stable source order breaks ties. */
+/** Prefer the strictest business create, then the one which demonstrates the richest typed relationship
+ * journey. A capped aggregate is the stronger canonical proof: it exercises a workspace invariant and,
+ * when the same action is also an authority seed, preserves isolation between standalone and bootstrap
+ * legs. After that, a join/create consuming two NomosRefs is a better example than an isolated leaf create.
+ * Stable source order breaks ties. */
 function orderedStandaloneCreates(mod: DomainModule): Directive<unknown>[] {
+  const aggregates = new Map((mod.aggregates as AggregateHandle[]).map((aggregate) => [aggregate.id, aggregate]));
   return (mod.directives as Directive<unknown>[])
     .map((directive, index) => ({ directive, index }))
     .filter(({ directive }) => isStandaloneProofSafe(mod, directive))
     .sort((a, b) => {
+      const capA = aggregates.get(a.directive.aggregateId ?? "")?.cap;
+      const capB = aggregates.get(b.directive.aggregateId ?? "")?.cap;
+      if ((capA !== undefined) !== (capB !== undefined)) return capA !== undefined ? -1 : 1;
       const refsA = Object.keys(aggregateReferenceFields(a.directive.payloadSchema as z.ZodTypeAny)).length;
       const refsB = Object.keys(aggregateReferenceFields(b.directive.payloadSchema as z.ZodTypeAny)).length;
       return refsB - refsA || a.index - b.index;
@@ -2532,6 +2592,7 @@ interface ProofReferenceSeed {
   readonly aggregate: AggregateHandle;
   readonly payload: Record<string, unknown>;
   readonly referenceFields: Readonly<Record<string, string>>;
+  readonly optionalReferenceFields: readonly string[];
   readonly mintField?: string;
 }
 
@@ -2564,22 +2625,38 @@ function discoverProofReferenceSeeds(mod: DomainModule, target: Directive<unknow
     }
     const mintField = mintedCreateField(directive, aggregate);
     const referenceFields: Record<string, string> = { ...aggregateReferenceFields(directive.payloadSchema as z.ZodTypeAny) };
+    const optionalReferenceFields = optionalAggregateReferenceFields(
+      directive.payloadSchema as z.ZodTypeAny,
+    );
     if (mintField !== undefined) delete referenceFields[mintField];
-    for (const prerequisite of Object.values(referenceFields)) visitType(prerequisite);
+    const optionalReferenceSet = new Set(optionalReferenceFields);
+    for (const [field, prerequisite] of Object.entries(referenceFields)) {
+      if (!optionalReferenceSet.has(field)) visitType(prerequisite);
+    }
     const synth = synthesizeDirectivePayload(directive, `${domain}/${directive.id}`);
     const payload: Record<string, unknown> = { ...synth.value };
     if (mintField !== undefined) delete payload[mintField];
-    out.push({ directive, aggregate, payload, referenceFields, ...(mintField !== undefined ? { mintField } : {}) });
+    out.push({
+      directive,
+      aggregate,
+      payload,
+      referenceFields,
+      optionalReferenceFields,
+      ...(mintField !== undefined ? { mintField } : {}),
+    });
     visiting.delete(aggregateId);
     emitted.add(aggregateId);
   };
 
   const targetReferences = { ...aggregateReferenceFields(target.payloadSchema as z.ZodTypeAny) };
+  const targetOptionalReferences = new Set(
+    optionalAggregateReferenceFields(target.payloadSchema as z.ZodTypeAny),
+  );
   const targetAggregate = aggregates.find((aggregate) => aggregate.id === target.aggregateId);
   const targetMintField = targetAggregate === undefined ? undefined : mintedCreateField(target, targetAggregate);
   if (targetMintField !== undefined) delete targetReferences[targetMintField];
-  for (const aggregateId of Object.values(targetReferences)) {
-    visitType(aggregateId);
+  for (const [field, aggregateId] of Object.entries(targetReferences)) {
+    if (!targetOptionalReferences.has(field)) visitType(aggregateId);
   }
   return out;
 }
@@ -2728,6 +2805,11 @@ function attachBusinessEncryption(
       `${leg.parentDomain}/${leg.birthDirectiveId}: Nomos could not derive the hidden owned-birth custody map`,
     );
   }
+  if (leg.childSeedInstanceId === undefined) {
+    throw new Error(
+      `${leg.parentDomain}/${leg.birthDirectiveId}: Nomos could not derive the owned birth root identity`,
+    );
+  }
   const fields: Record<string, { aggSid: string; fieldSid: string }> = {};
   for (const field of aggregate.encryptedFields ?? []) {
     const slot = Object.entries(offeredAggregate.fields).find(([, candidate]) => candidate.label === field);
@@ -2742,6 +2824,10 @@ function attachBusinessEncryption(
     ...leg,
     businessEncryption: {
       scope: aggregate.visibility.requires,
+      recordType: isNamespacedAggregate(aggregate)
+        ? qualifyReadProjectionType(leg.childDomain, aggregate.id)
+        : aggregate.id,
+      recordId: leg.childSeedInstanceId,
       namespace,
       keyField,
       fields,
@@ -3132,6 +3218,7 @@ function generateSealedApplicationProof(
   mod: DomainModule,
   opts: TsProofOptions,
   primaryLegs: ProofLegs,
+  modules: readonly DomainModule[],
 ): string {
   const domain = mod.domain ?? mod.name;
   const applicationName = tsApplicationName(opts.packageName);
@@ -3141,9 +3228,22 @@ function generateSealedApplicationProof(
   const businessBirth = primaryLegs.childBirth?.businessAggregateId !== undefined
     ? primaryLegs.childBirth
     : undefined;
-  const businessBirthFollowup = businessBirth === undefined
+  const selectedBirthDirective = businessBirth === undefined
+    ? undefined
+    : (mod.applicationIntents ?? mod.directives).find(
+        (candidate) => candidate.id === businessBirth.birthDirectiveId,
+      ) as Directive<unknown> | undefined;
+  const applicationBirthMethod = businessBirth === undefined
+    ? undefined
+    : (selectedBirthDirective as { businessBirth?: unknown } | undefined)?.businessBirth !== undefined
+      ? isBusinessIntent(selectedBirthDirective!) ? selectedBirthDirective!.id : "birth"
+      : businessBirth.birthDirectiveId;
+  const bornModule = businessBirth === undefined
     ? undefined
-    : (mod.applicationIntents ?? mod.directives).flatMap((candidate) => {
+    : modules.find((candidate) => (candidate.domain ?? candidate.name) === businessBirth.childDomain);
+  const businessBirthFollowup = businessBirth === undefined || bornModule === undefined
+    ? undefined
+    : orderedStandaloneCreates(bornModule).flatMap((candidate) => {
         const directive = candidate as Directive<unknown>;
         if (
           (directive as { businessBirthInternal?: unknown }).businessBirthInternal === true ||
@@ -3153,7 +3253,9 @@ function generateSealedApplicationProof(
           typeof directive.aggregateId !== "string" ||
           Object.keys(aggregateReferenceFields(directive.payloadSchema as z.ZodTypeAny)).length > 0
         ) return [];
-        const target = (mod.aggregates as AggregateHandle[]).find((aggregate) => aggregate.id === directive.aggregateId);
+        const target = (bornModule.aggregates as AggregateHandle[]).find(
+          (aggregate) => aggregate.id === directive.aggregateId,
+        );
         if (target === undefined) return [];
         try {
           const synth = synthesizeDirectivePayload(directive, `${domain}/${directive.id}`);
@@ -3179,9 +3281,14 @@ function generateSealedApplicationProof(
     ...referenceSeeds.flatMap((seed) => Object.values(seed.referenceFields)),
     ...(action === undefined ? [] : Object.values(aggregateReferenceFields(action.payloadSchema as z.ZodTypeAny))),
   ])].filter((type) => /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(type)).sort();
+  const hasOptionalReferenceChoices = [
+    ...referenceSeeds.flatMap((seed) => seed.optionalReferenceFields),
+    ...(action === undefined ? [] : optionalAggregateReferenceFields(action.payloadSchema as z.ZodTypeAny)),
+  ].length > 0;
   const typeImports = referenceTypes.length > 0
     ? `, type NomosRef, ${referenceTypes.map((type) => `type ${type}`).join(", ")}`
     : "";
+  const optionalReferenceImport = hasOptionalReferenceChoices ? ", NomosOptionalRef" : "";
   const refDeclarations = referenceTypes.flatMap((type) => [
     `let ${proofRefSlot(type)}: NomosRef<${type}> | undefined;`,
     `const ${proofRefGetter(type)} = (): NomosRef<${type}> => ${proofRefSlot(type)} ?? fail(${JSON.stringify(`generated proof ordering error: NomosRef<${type}> is not available yet`)});`,
@@ -3191,20 +3298,24 @@ function generateSealedApplicationProof(
     `// Regenerated from the business law; do not edit or maintain a second client example.`,
     `// The local proof runner executes every deep framework leg without exposing it here.`,
     `// @nomos-proof-legs ${marker}`,
-    `import { ${opener}, sameRecord${typeImports} } from "./${opts.packageName}.client.mjs";`,
+    `import { ${opener}, sameRecord${optionalReferenceImport}${typeImports} } from "./${opts.packageName}.client.mjs";`,
     ``,
     `const fail: (message: string) => never = (message) => { throw new Error(message); };`,
     `const ok = (message: string) => console.log("✓ " + message);`,
     `if (process.env.NOMOS_PROOF_MANAGED !== "1") fail("run the live journey through: githolon proof --live");`,
-    `const cloud = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
+    `const cloud = (process.env.NOMOS_CLOUD || "https://nomos.cafe").replace(/\\/+$/, "");`,
     `const applicationName = process.env.NOMOS_APPLICATION || ${JSON.stringify(opts.packageName)};`,
+    `const proofUid = process.env.NOMOS_PROOF_SUBJECT || "";`,
+    `const proofPrincipal = proofUid ? "user:" + proofUid : "";`,
     `const signIn = async (request: { readonly deviceChallenge?: string } = {}) => {`,
-    `  if (!request.deviceChallenge) return process.env.NOMOS_AUTH_TOKEN || "";`,
-    `  const subject = process.env.NOMOS_PROOF_SUBJECT || "";`,
-    `  if (!subject) fail("the generated blank-user proof has no authority subject");`,
-    `  const response = await fetch(cloud + "/dev/mint-token", {`,
-    `    method: "POST", headers: { "content-type": "application/json" },`,
-    `    body: JSON.stringify({ sub: subject, nonce: request.deviceChallenge }),`,
+    `  const session = process.env.NOMOS_AUTH_TOKEN || "";`,
+    `  if (!request.deviceChallenge) return session;`,
+    `  if (!proofUid) fail("the generated blank-user proof has no authority subject");`,
+    `  const endpoint = process.env.NOMOS_DEVICE_TOKEN_ENDPOINT || "https://id.nomos.captainapp.co.uk/token";`,
+    `  const localTestIdp = endpoint.endsWith("/dev/mint-token");`,
+    `  const response = await fetch(endpoint, {`,
+    `    method: "POST", headers: { "content-type": "application/json", ...(session ? { authorization: "Bearer " + session } : {}) },`,
+    `    body: JSON.stringify(localTestIdp ? { sub: proofUid, nonce: request.deviceChallenge } : { nonce: request.deviceChallenge }),`,
     `  });`,
     `  const body = await response.json() as { token?: string; error?: string };`,
     `  if (!response.ok || !body.token) fail("the generated application could not attest its private device: " + (body.error || response.status));`,
@@ -3234,7 +3345,7 @@ function generateSealedApplicationProof(
     );
     out.push(
       `const facts = ${JSON.stringify(businessPayload)};`,
-      `const born = await application.birth(facts);`,
+      `const born = await application.${applicationBirthMethod!}(facts);`,
       `if (born === undefined) fail("business birth returned no child application");`,
       `await waitUntilSaved();`,
       `ok(${JSON.stringify(`birth(${businessBirth.businessAggregateId}) saved through the generated application`)});`,
@@ -3253,7 +3364,12 @@ function generateSealedApplicationProof(
     }
   } else if (action !== undefined && aggregate !== undefined) {
     for (const seed of referenceSeeds) {
-      const payload = typedPayloadLiteral(seed.payload, seed.referenceFields);
+      const payload = typedPayloadLiteral(
+        seed.payload,
+        seed.referenceFields,
+        {},
+        new Set(seed.optionalReferenceFields),
+      );
       const variable = `seed${proofTypeIdent(seed.aggregate.id)}`;
       out.push(
         `const ${variable}Result = await application.${seed.directive.id}(${payload});`,
@@ -3266,11 +3382,25 @@ function generateSealedApplicationProof(
     const mintField = mintedCreateField(action, aggregate);
     const payload = { ...synth.value };
     if (mintField !== undefined) delete payload[mintField];
-    const payloadLiteral = typedPayloadLiteral(payload, refs);
+    const optionalRefs = new Set(optionalAggregateReferenceFields(action.payloadSchema as z.ZodTypeAny));
+    const bornContext = primaryLegs.relationBootstrap?.bornContext;
+    const authorityPlaceholder = bornContext?.ownerField === undefined
+      ? undefined
+      : bornContext.birthPayload[bornContext.ownerField];
+    const authorityOverrides = typeof authorityPlaceholder !== "string"
+      ? {}
+      : Object.fromEntries(
+          Object.entries(payload)
+            .filter(([, value]) => value === authorityPlaceholder)
+            .map(([field]) => [field, "proofPrincipal"]),
+        );
+    const payloadLiteral = typedPayloadLiteral(payload, refs, authorityOverrides, optionalRefs);
     const nullArmLines = nullablePayloadFields(action.payloadSchema as z.ZodTypeAny).flatMap((field) => {
       const nullPayload = { ...payload, [field]: null };
+      const nullOverrides = { ...authorityOverrides };
+      delete nullOverrides[field];
       return [
-        `await application.${action.id}(${typedPayloadLiteral(nullPayload, refs)});`,
+        `await application.${action.id}(${typedPayloadLiteral(nullPayload, refs, nullOverrides, optionalRefs)});`,
         `ok(${JSON.stringify(`NULL-ARM PROOF — ${domain}/${action.id} accepted ${field}=null`)});`,
       ];
     });
@@ -3305,7 +3435,7 @@ function generateSealedApplicationProof(
       ...clearReadLines,
       `const reopened = await ${opener}({ cloud, application: applicationName, signIn });`,
       `const rows = await reopened.${generatedAggregateCollectionName(aggregate.id)}.all();`,
-      `if (!rows.some((row) => sameRecord(row.ref, created))) fail("a fresh generated application could not read the saved record");`,
+      `if (!rows.some((row) => sameRecord(row.ref, created))) fail("a fresh generated application could not read " + created.address + "; restored addresses: " + (rows.map((row) => row.ref.address).join(", ") || "(none)"));`,
       `ok("a fresh generated application read the saved record after synchronization");`,
     );
   } else {
@@ -3365,5 +3495,5 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
   // marker, and the index can never describe different directives. The primary domain's legs carry whichever
   // of standalone / child-birth / relation-bootstrap it has.
   const primaryLegs = legsForDomain(mod, modules, opts.interface);
-  return generateSealedApplicationProof(mod, opts, primaryLegs);
+  return generateSealedApplicationProof(mod, opts, primaryLegs, modules);
 }

package/src/codegen_provider_dart.ts

@@ -67,6 +67,12 @@ import {
  * fragile structural inference over the flattened directive list.
  */
 export interface ImpureCapabilityDecl {
+  /** Law-facing binding name used by the outbox/provider registry. */
+  readonly name?: string;
+  /** HTTPS offer endpoint; absent means obligations remain locally requested. */
+  readonly endpoint?: string;
+  /** Maintained requested-task read used by the executor scan lane. */
+  readonly tasks?: { readonly id: string };
   /** The task aggregate handle; `.id` is the wire type (e.g. `TranscribeVoiceNoteAggregate`). */
   readonly aggregate: { readonly id: string };
   /** The Obligation directive: `.creates`, payload = envelope ⊕ tenant params. */
@@ -184,7 +190,9 @@ function obligationFromJsonExpr(s: PayloadFieldSpec): string {
     }
     case "wrapped": {
       // typed-id class (String wire) or unit extension type (num wire): wrap the raw scalar.
-      const wrap = (v: string) => `${s.dartType}${s.dartType.endsWith("Id") ? `.fromRow(${v} as String)` : `((${v} as num).toDouble())`}`;
+      const wrap = (v: string) => s.wrappedScalarKind === "number"
+        ? `${s.dartType}((${v} as num).toDouble())`
+        : `${s.dartType}(${v} as String)`;
       return s.optional ? `${raw} == null ? null : ${wrap(raw)}` : wrap(raw);
     }
     case "ref": {
@@ -194,6 +202,14 @@ function obligationFromJsonExpr(s: PayloadFieldSpec): string {
         `NmsInternalNomosRefs.create<${target}>(workspace: '', type: '${wireType}', id: ${v} as String)`;
       return s.optional ? `${raw} == null ? null : ${wrap(raw)}` : wrap(raw);
     }
+    case "versionedRef": {
+      const target = s.versionedRefTarget as string;
+      const series = s.versionedRefSeries as string;
+      const currentField = JSON.stringify(s.versionedRefCurrentField);
+      const wrap = (v: string) =>
+        `() { final m = (${v} as Map).cast<String, Object?>(); return NmsInternalVersionedNomosRefs.create<${target}, ${series}>(pinned: NmsInternalNomosRefs.fromJson<${target}>(m['pinned']), series: NmsInternalNomosRefs.fromJson<${series}>(m['series']), currentField: ${currentField}); }()`;
+      return s.optional ? `${raw} == null ? null : ${wrap(raw)}` : wrap(raw);
+    }
     case "recipient": {
       const wrap = (v: string) => `NmsInternalInvitations.recipient<User>(${v} as String)`;
       return s.optional ? `${raw} == null ? null : ${wrap(raw)}` : wrap(raw);