@githolon/dsl 0.102.4 → 0.103.0

package/src/evolve_preview.ts

@@ -7,7 +7,7 @@
  * THE EVOLVE PREVIEW — `githolon check --against <prior>` (architecture/author_time_gate.md,
  * the `--against` row of check slice 3). The evolve gate is the kernel's #58 diff-by-stable-id
  * (executor/src/law58.rs::evolve_violation): a RENAME (same sid, new label) admits silently; a
- * true REMOVAL / merge-driver change refuses TYPED unless the deploy JSON carries a
+ * true REMOVAL / merge-driver change refuses TYPED unless the installation offer carries a
  * `dispositions` acknowledgement. A changed BUSINESS VALUE CONTRACT is stricter: it needs
  * deterministic `.evolvesFrom(...)` coverage and cannot be waived by an acknowledgement.
  *
@@ -34,9 +34,10 @@ import type { Finding } from "./law_check.js";
 import type { DirectivePayloadShape, DomainInterface } from "./shape_compat.js";
 import { domainInterface } from "./shape_compat.js";
 import type { StableIds } from "./stable_ids_types.js";
+import type { StableIdLockfile } from "./stable_id_lockfile.js";
+export type { StableIdLockfile } from "./stable_id_lockfile.js";
 import type { DomainModule } from "./codegen_dart.js";
 import type { WireSchema } from "./wire.js";
-import { parseUsdaDocument } from "./usd_layers.js";
 
 // ── the normalized law shape both sides of the diff speak ──────────────────────────
 
@@ -70,7 +71,7 @@ export interface EvolveDomain {
 /** A whole package's evolve surface, keyed by DOMAIN KEY. */
 export type EvolveLaw = Record<string, EvolveDomain>;
 
-/** The dispositions fragment the deploy JSON carries to admit destructive evolves (the exact
+/** The dispositions fragment the installDomain offer carries to admit destructive evolves (the exact
  *  shape executor/src/law58.rs::dispositions_from_payload parses). */
 export interface EvolveDispositionsJson {
   retired?: string[];
@@ -92,7 +93,7 @@ function aggregatesFromStableIds(
   for (const [aggLabel, a] of Object.entries(stableIds.aggregates)) {
     const fields: EvolveAggregate["fields"] = {};
     for (const [fLabel, f] of Object.entries(a.fields ?? {})) {
-      const driver = schemas?.[aggLabel]?.[fLabel];
+      const driver = f.driver ?? schemas?.[aggLabel]?.[fLabel];
       fields[f.sid] = {
         sid: f.sid,
         label: fLabel,
@@ -110,7 +111,7 @@ function aggregatesFromStableIds(
   return out;
 }
 
-/** Build an EvolveDomain from a DomainInterface (deploy.json's `interface`) — its aggregates are
+/** Build an EvolveDomain from a diagnostic DomainInterface — its aggregates are
  *  already sid-keyed with kinds+labels, its directives carry payload shapes. Drivers are absent
  *  from an interface (it exposes only read kinds), so a driver-only retype is not seen from an
  *  interface alone — the lockfile lane (aggregatesFromStableIds + schemas) carries them. */
@@ -130,78 +131,29 @@ function evolveDomainFromInterface(iface: DomainInterface): EvolveDomain {
   };
 }
 
-/** The committed `nomos.stable-ids.json` lockfile shape (compile_package_main writes it). */
-export interface StableIdLockfile {
-  v: 1;
-  domains: Record<string, { stableIds: StableIds; schemas?: Record<string, WireSchema> }>;
-}
-
-/** A deploy.json body (the subset this preview reads): the per-domain interface + the package
- *  bytes (for the embedded stable-ids/driver schemas when no lockfile rides alongside). */
-export interface DeployJson {
-  interface?: Record<string, DomainInterface>;
-  packageUsda?: string;
-}
-
-/** Reconstruct the effective law directly from a native `.package.usda` stage. */
-export function usdJsonFromPackage(bundle: string): unknown | undefined {
-  try {
-    return parseUsdaDocument(bundle);
-  } catch {
-    return undefined;
-  }
-}
-
-/** Per-domain-key { stableIds, schemas } parsed out of a package's embedded USD-IR (mirrors
- *  executor/src/law58.rs::stable_ids_from_usd + the aggregate-prim schema harvest). */
-export function stableIdsFromUsd(
-  usd: unknown,
-): Record<string, { stableIds: StableIds; schemas: Record<string, WireSchema> }> {
-  const out: Record<string, { stableIds: StableIds; schemas: Record<string, WireSchema> }> = {};
-  const layers = (usd as { layers?: unknown[] })?.layers;
-  if (!Array.isArray(layers)) return out;
-  for (const layer of layers) {
-    const l = layer as {
-      path?: string;
-      nomosStableIds?: StableIds;
-      prims?: Array<{ kind?: string; type?: string; schema?: Record<string, unknown> }>;
-    };
-    const path = typeof l.path === "string" ? l.path : "";
-    const key = path.startsWith("/Nomos/") ? path.slice("/Nomos/".length) : "";
-    if (key === "" || l.nomosStableIds === undefined) continue;
-    const schemas: Record<string, WireSchema> = {};
-    for (const prim of l.prims ?? []) {
-      if (prim.kind === "aggregate" && typeof prim.type === "string" && prim.schema) {
-        schemas[prim.type] = prim.schema as WireSchema;
-      }
-    }
-    out[key] = { stableIds: l.nomosStableIds, schemas };
-  }
-  return out;
-}
-
-/** Build an EvolveLaw from a deploy.json body: interface for directive payloads + sid-keyed read
- *  shapes, and the embedded package USD-IR for the driver schemas (so a driver-only retype is
- *  seen from a deploy.json alone). */
-export function evolveLawFromDeployJson(deploy: DeployJson): EvolveLaw {
+/** Build an EvolveLaw from compiler diagnostic sidecars. The interface supplies directive and
+ * read shapes; the stable-id lock supplies identity, drivers and value-contract evolution. Neither
+ * is deployable law: canonical law remains the composed, logically named USDA closure interpreted
+ * by the kernel; `.law.usdz` is only its lossless one-file transport envelope. */
+export function evolveLawFromInterface(
+  ifaces: Record<string, DomainInterface>,
+  lock?: StableIdLockfile,
+): EvolveLaw {
   const law: EvolveLaw = {};
-  const ifaces = deploy.interface ?? {};
-  const usd = deploy.packageUsda !== undefined ? usdJsonFromPackage(deploy.packageUsda) : undefined;
-  const fromUsd = usd !== undefined ? stableIdsFromUsd(usd) : {};
   for (const [key, iface] of Object.entries(ifaces)) {
     const dom = evolveDomainFromInterface(iface);
-    // Augment fields with drivers off the package USD-IR schemas (interface carries none).
-    const usdDom = fromUsd[key];
-    if (usdDom !== undefined) {
+    const locked = lock?.domains[key] ?? lock?.domains[iface.domain];
+    const stableIds = locked?.stableIds;
+    if (stableIds !== undefined) {
       for (const agg of Object.values(dom.aggregates)) {
-        const stableAggregate = Object.values(usdDom.stableIds.aggregates)
+        const stableAggregate = Object.values(stableIds.aggregates)
           .find((candidate) => candidate.sid === agg.sid);
         const stableFields = new Map(
           Object.values(stableAggregate?.fields ?? {})
             .map((field) => [field.sid, field] as const),
         );
-        const schema = usdDom.schemas[agg.label]
-          ?? Object.entries(usdDom.schemas).find(([type]) => type.endsWith(`.${agg.label}`))?.[1];
+        const schema = locked?.schemas?.[agg.label]
+          ?? Object.entries(locked?.schemas ?? {}).find(([type]) => type.endsWith(`.${agg.label}`))?.[1];
         for (const f of Object.values(agg.fields)) {
           const driver = schema?.[f.label];
           if (driver !== undefined) (f as { driver?: string }).driver = JSON.stringify(driver);
@@ -216,10 +168,14 @@ export function evolveLawFromDeployJson(deploy: DeployJson): EvolveLaw {
     }
     law[key] = dom;
   }
-  // A deploy.json with NO interface (older builds) still yields aggregate identity from the USD.
-  for (const [key, sd] of Object.entries(fromUsd)) {
+  // A lockfile without a sibling interface still supports aggregate/field identity checks.
+  for (const [key, locked] of Object.entries(lock?.domains ?? {})) {
     if (law[key] !== undefined) continue;
-    law[key] = { domainSid: sd.stableIds.domain, aggregates: aggregatesFromStableIds(sd.stableIds, sd.schemas), directives: {} };
+    law[key] = {
+      domainSid: locked.stableIds?.domain,
+      aggregates: aggregatesFromStableIds(locked.stableIds, locked.schemas),
+      directives: {},
+    };
   }
   return law;
 }
@@ -254,13 +210,19 @@ export function currentEvolveLaw(
     const stableIds = locked?.stableIds;
     const iface = domainInterface(mod, stableIds);
     const dom = evolveDomainFromInterface(iface);
-    // Fold drivers from the lockfile schemas (interface has none).
-    if (locked?.schemas !== undefined) {
+    // Fold drivers from the stable fields. Verbose v1 locks may also carry the
+    // older aggregate-schema copy; compact v2 locks deliberately omit it.
+    if (stableIds !== undefined) {
       for (const agg of Object.values(dom.aggregates)) {
-        const schema = locked.schemas[agg.label];
-        if (schema === undefined) continue;
+        const stableAggregate = Object.values(stableIds.aggregates).find(
+          (candidate) => candidate.sid === agg.sid,
+        );
+        const schema = locked?.schemas?.[agg.label];
         for (const f of Object.values(agg.fields)) {
-          const driver = schema[f.label];
+          const stableField = Object.values(stableAggregate?.fields ?? {}).find(
+            (candidate) => candidate.sid === f.sid,
+          );
+          const driver = stableField?.driver ?? schema?.[f.label];
           if (driver !== undefined) (f as { driver?: string }).driver = JSON.stringify(driver);
         }
       }
@@ -273,7 +235,7 @@ export function currentEvolveLaw(
 // ── the diff ────────────────────────────────────────────────────────────────────────
 
 /** The full preview result: the findings AND the merged dispositions the destructive findings
- *  demand, keyed by DOMAIN KEY (exactly the object a deploy JSON carries per installDomain). */
+ *  demand, keyed by DOMAIN KEY (the object carried by an installDomain offer). */
 export interface EvolveDiffResult {
   readonly findings: Finding[];
   /** domain key → the dispositions fragment that makes THIS domain's destructive evolves admit. */
@@ -335,7 +297,7 @@ function diffDomain(
         domain,
         level: "refuse",
         what: `aggregate '${oldAgg.label}' (stable id ${sid}) is REMOVED — the evolve gate will refuse without a disposition`,
-        fix: `paste into your deploy JSON: "dispositions": { "retired": ["${sid}"] }`,
+        fix: `include in the installation offer: "dispositions": { "retired": ["${sid}"] }`,
       });
       continue;
     }
@@ -357,7 +319,7 @@ function diffDomain(
           domain,
           level: "refuse",
           what: `field '${oldAgg.label}.${oldF.label}' (stable id ${fSid}) is REMOVED — the evolve gate will refuse without a disposition`,
-          fix: `paste into your deploy JSON: "dispositions": { "retired": ["${fSid}"] }`,
+          fix: `include in the installation offer: "dispositions": { "retired": ["${fSid}"] }`,
         });
         continue;
       }
@@ -394,7 +356,7 @@ function diffDomain(
           domain,
           level: "refuse",
           what: `field '${oldAgg.label}.${oldF.label}' (stable id ${fSid}) is RETYPED in place (${how}) — the evolve gate will refuse without a disposition`,
-          fix: `paste into your deploy JSON: "dispositions": { "retyped": { "${fSid}": "<why goes here>" } } — or add a NEW field instead`,
+          fix: `include in the installation offer: "dispositions": { "retyped": { "${fSid}": "<why goes here>" } } — or add a NEW field instead`,
         });
       }
     }
@@ -490,7 +452,7 @@ export function evolveDiff(prior: EvolveLaw, current: EvolveLaw): EvolveDiffResu
           domain,
           level: "refuse",
           what: `domain '${domain}' aggregate '${agg.label}' (stable id ${sid}) disappears — the current build no longer carries domain '${domain}'`,
-          fix: `restore the domain, or (a true removal) redeploy with "dispositions": { "retired": ["${sid}"] }`,
+          fix: `restore the domain, or include "dispositions": { "retired": ["${sid}"] } in the replacement installation offer`,
         });
       }
       continue;

package/src/extremum.ts

@@ -28,7 +28,7 @@
  * VALIDATION RULE (manifest-load, not type-level): the `valueField` parameter MUST be
  * an `int`-kind field of the `of`-aggregate. The DSL type system cannot enforce this
  * at the `min/max(id, valueField)` call site (the aggregate is not yet known), but
- * `AggregateSchemas::parse` (readmodel/src/manifest.rs) performs a no-fallback reject
+ * typed USDA projection-law admission performs a no-fallback reject
  * if the field is absent or non-int on the declared aggregate.
  *
  * ORDER-SENSITIVE GUARDRAIL: min/max expose NO `.first`/`.take`/`.orderBy`. min/max

package/src/fields.ts

@@ -142,6 +142,74 @@ export interface EvidenceRefValue {
   storageClass: "git" | "external";
 }
 
+/** One portable address inside Nomos custody. This is identity and routing, never authority. */
+export interface NomosRefValue {
+  readonly workspace: string;
+  readonly type: string;
+  readonly id: string;
+}
+
+/** An immutable version pin plus the stable series whose law names the current version. */
+export interface VersionedNomosRefValue {
+  readonly pinned: NomosRefValue;
+  readonly series: NomosRefValue;
+}
+
+/** A SHA-256 digest encoded as exactly 64 lowercase hexadecimal characters.
+ *
+ * This is nominal at author/client compile time and remains a plain string on the
+ * wire. Construct values through {@link sha256Digest}; never cast a string into it.
+ */
+export type Sha256Digest = string & { readonly __nomosSha256Digest: unique symbol };
+
+/** Codegen marker for the semantic SHA-256 string type. The marker is deliberately
+ * non-enumerable: Zod remains the runtime/admission schema, while emitters recover
+ * the stronger client type without adding a parallel manifest representation. */
+export const NOMOS_SHA256_DIGEST_BRAND: unique symbol = Symbol.for("nomos.sha256Digest");
+
+const SHA256_DIGEST_RE = /^[0-9a-f]{64}$/;
+
+/** Declare and validate a lowercase hexadecimal SHA-256 digest payload value. */
+export function sha256Digest(): z.ZodType<Sha256Digest> {
+  const schema = z.string().regex(SHA256_DIGEST_RE, "expected a lowercase hexadecimal SHA-256 digest");
+  Object.defineProperty(schema, NOMOS_SHA256_DIGEST_BRAND, { value: true, enumerable: false });
+  return schema as unknown as z.ZodType<Sha256Digest>;
+}
+
+/** Recover the SHA-256 semantic marker through omission/null wrappers. */
+export function isSha256DigestSchema(schema: z.ZodTypeAny): boolean {
+  let current: z.ZodTypeAny | undefined = schema;
+  for (let hops = 0; current !== undefined && hops < 16; hops++) {
+    if ((current as unknown as Record<symbol, unknown>)[NOMOS_SHA256_DIGEST_BRAND] === true) {
+      return true;
+    }
+    const raw = current as unknown as {
+      _def?: { type?: unknown; innerType?: z.ZodTypeAny };
+      def?: { type?: unknown; innerType?: z.ZodTypeAny };
+    };
+    const def = raw._def ?? raw.def;
+    const kind = def?.type;
+    const name = (current as unknown as { _def?: { typeName?: string } })._def?.typeName;
+    if (kind !== "optional" && kind !== "default" && kind !== "nullable" &&
+        name !== "ZodOptional" && name !== "ZodDefault" && name !== "ZodNullable") {
+      return false;
+    }
+    current = def?.innerType;
+  }
+  return false;
+}
+
+export const nomosRefValueSchema: z.ZodType<NomosRefValue> = z.object({
+  workspace: z.string().min(1),
+  type: z.string().min(1),
+  id: z.string().min(1),
+}).strict();
+
+export const versionedNomosRefValueSchema: z.ZodType<VersionedNomosRefValue> = z.object({
+  pinned: nomosRefValueSchema,
+  series: nomosRefValueSchema,
+}).strict();
+
 /** The Zod schema for an authored `EvidenceRefValue` — the single source of truth. */
 export const evidenceRefSchema: z.ZodType<EvidenceRefValue> = z.object({
   hash: z.string(),
@@ -174,6 +242,8 @@ export type ValueObjectFieldDescriptor =
   | {
       readonly type: "string";
       readonly brand?: string;
+      /** A framework semantic string whose generated client type validates its canonical spelling. */
+      readonly digest?: "sha256";
       readonly idOf?: string;
       /** Present only for an `idOf(recordContract(...))` target. Aggregate is the default. */
       readonly idOfContract?: true;
@@ -285,6 +355,9 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
    *  absent the clear lane is ungated (and `law_check` WARNs if sibling writes ARE gated). Compose/codegen
    *  metadata — the REAL law is the generated directive's `requiresRelationGate` (hashed there, not here). */
   readonly clearRequires?: string;
+  /** Static Zanzibar object paired with `clearRequires`. Non-workspace clear lanes must state this so
+   *  generated directives cannot silently fall back to the wrong authorization namespace. */
+  readonly clearRequiresObject?: string;
   /** For `t.ref` cross-workspace edges: the foreign workspace id, if any. */
   readonly refWorkspace?: string;
   /**
@@ -306,6 +379,21 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
      *  the target's concrete implementation. */
     readonly targetIsContract?: boolean;
   };
+  /** First-class atomic custody address. Kept in the reference kind so query/read routing remains a ref. */
+  readonly nomosRef?: {
+    readonly targetAggregateId: string;
+    readonly targetIsContract?: boolean;
+  };
+  /** Immutable publication pin + stable series, with the current pointer selected by compiled law. */
+  readonly versionedForeignRef?: {
+    readonly targetAggregateId: string;
+    readonly targetIsContract?: boolean;
+    readonly seriesAggregateId: string;
+    readonly seriesIsContract?: boolean;
+    readonly currentField: string;
+    /** Owning domain for cross-domain target, series and current-field law references. */
+    readonly targetDomain?: string;
+  };
   /** For `t.ref` (the target) AND `t.hasMany` (the child type): the related aggregate's wire id. */
   readonly refAggregateId?: string;
   /** For `t.hasMany(Child).via(backref)`: the back-reference field NAME on the child. Virtual. */
@@ -399,6 +487,8 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
    * Flag named `isMeta` — the `meta()` METHOD sets it, mirroring `encrypted()`/`optional()`.
    */
   readonly isMeta?: true;
+  /** ZD6 — this encrypted field carries a blind-index equality token (the `blindIndexed()` METHOD sets it). */
+  readonly isBlindIndexed?: true;
   /**
    * THE INTEGRITY/CONFIDENTIALITY FACET (security_model.md — the endorse model). Set by the
    * `authorityField`/`attributionField`/`standingField`/`secretField`/`publicField` wrappers (or the
@@ -418,6 +508,15 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
   withFacet<Fa extends FieldFacet>(facet: Fa): Field<T, K> & { readonly facet: Fa };
   /** Mark this field's value ENCRYPTED (sets {@link Field.isEncrypted}). Chainable + non-destructive. */
   encrypted(): Field<T, K>;
+  /**
+   * ZD6 BLIND INDEX (encrypted_merge_model.md — the CipherSweet pattern): opt THIS encrypted field
+   * into EDGE-SERVED EQUALITY lookups. The sealing client attaches a scope-key-derived HMAC token
+   * (`bidx`) beside the ciphertext; key holders compute the same token query-side; the operator can
+   * observe equality/frequency among the opted-in rows but can never invert a token. Requires
+   * `.encrypted()` (aggregate() refuses otherwise) — a DELIBERATE, DECLARED equality leak, rotated
+   * with the scope epoch. Sets {@link Field.isBlindIndexed}.
+   */
+  blindIndexed(): Field<T, K>;
   /** Keep AUTHOR PROVENANCE beside this field's folded value (sets {@link Field.isAttributed}) —
    *  `<field>Provenance` accessors are generated on the read models. Lww-class scalars only. */
   attributed(): Field<T, K>;
@@ -441,7 +540,7 @@ export interface Field<T = unknown, K extends FieldKind = FieldKind> {
   withNull(semantic: NullSemantic, reason?: string): Field<T, K>;
   /** INTERNAL (`t.clearable` calls this): mark this field EXPLICIT-CLEARABLE (sets {@link Field.isClearable}
    *  + optional {@link Field.clearRequires}). Threaded through merge/optional like every other flag. */
-  clearable(requires?: string): Field<T, K> & { readonly isClearable: true };
+  clearable(requires?: string, object?: string): Field<T, K> & { readonly isClearable: true };
   /** Declare how values authored by an earlier field contract become this field's current
    * business value. With no function, the compiler proves identity widening. With a function,
    * the source must be finite (enum/boolean/literal union), so Nomos can exhaustively compile
@@ -458,6 +557,14 @@ function makeField<T, K extends FieldKind = FieldKind>(
   extra: {
     refWorkspace?: string;
     foreignRef?: { workspaceField: string; targetAggregateId: string; targetDomain?: string; targetIsContract?: boolean };
+    nomosRef?: { targetAggregateId: string; targetIsContract?: boolean };
+    versionedForeignRef?: {
+      targetAggregateId: string;
+      targetIsContract?: boolean;
+      seriesAggregateId: string;
+      seriesIsContract?: boolean;
+      currentField: string;
+    };
     refAggregateId?: string;
     /** LAZY target resolution — `t.ref(() => Agg)` / `t.hasMany(() => Agg)`. Breaks a BIDIRECTIONAL
      *  declaration cycle (a Parent's `hasMany(Child)` ⇄ a Child's `ref(Parent)`): the thunk is stored and
@@ -473,6 +580,7 @@ function makeField<T, K extends FieldKind = FieldKind>(
     valueObject?: ValueObjectFieldMeta;
     mapValueVo?: ValueObjectFieldMeta;
     encrypted?: true;
+    blindIndexed?: true;
     attributed?: true;
     meta?: true;
     facet?: FieldFacet;
@@ -480,6 +588,7 @@ function makeField<T, K extends FieldKind = FieldKind>(
     nullReason?: string;
     isClearable?: true;
     clearRequires?: string;
+    clearRequiresObject?: string;
     evolutions?: readonly FieldEvolutionDeclaration[];
   } = {},
 ): Field<T, K> {
@@ -493,12 +602,15 @@ function makeField<T, K extends FieldKind = FieldKind>(
     ...(extra.refWorkspace !== undefined ? { refWorkspace: extra.refWorkspace } : {}),
     ...(extra.refAggregateId !== undefined ? { refAggregateId: extra.refAggregateId } : {}),
     ...(extra.foreignRef !== undefined ? { foreignRef: extra.foreignRef } : {}),
+    ...(extra.nomosRef !== undefined ? { nomosRef: extra.nomosRef } : {}),
+    ...(extra.versionedForeignRef !== undefined ? { versionedForeignRef: extra.versionedForeignRef } : {}),
     ...(extra.viaField !== undefined ? { viaField: extra.viaField } : {}),
     ...(extra.mapValueKind !== undefined ? { mapValueKind: extra.mapValueKind } : {}),
     ...(extra.jsonShape !== undefined ? { jsonShape: extra.jsonShape } : {}),
     ...(extra.valueObject !== undefined ? { valueObject: extra.valueObject } : {}),
     ...(extra.mapValueVo !== undefined ? { mapValueVo: extra.mapValueVo } : {}),
     ...(extra.encrypted ? { isEncrypted: true as const } : {}),
+    ...(extra.blindIndexed ? { isBlindIndexed: true as const } : {}),
     ...(extra.attributed ? { isAttributed: true as const } : {}),
     ...(extra.meta ? { isMeta: true as const } : {}),
     ...(extra.fromBirth ? { isFromBirth: true as const } : {}),
@@ -506,6 +618,7 @@ function makeField<T, K extends FieldKind = FieldKind>(
     ...(extra.nullReason !== undefined ? { nullReason: extra.nullReason } : {}),
     ...(extra.isClearable ? { isClearable: true as const } : {}),
     ...(extra.clearRequires !== undefined ? { clearRequires: extra.clearRequires } : {}),
+    ...(extra.clearRequiresObject !== undefined ? { clearRequiresObject: extra.clearRequiresObject } : {}),
     ...(extra.evolutions !== undefined && extra.evolutions.length > 0
       ? { evolutions: extra.evolutions }
       : {}),
@@ -549,11 +662,12 @@ function makeField<T, K extends FieldKind = FieldKind>(
         ...(reason !== undefined ? { nullReason: reason } : {}),
       });
     },
-    clearable(requires?: string): Field<T, K> & { readonly isClearable: true } {
+    clearable(requires?: string, object?: string): Field<T, K> & { readonly isClearable: true } {
       return makeField<T, K>(kind, zod, driver, {
         ...extra,
         isClearable: true,
         ...(requires !== undefined ? { clearRequires: requires } : {}),
+        ...(object !== undefined ? { clearRequiresObject: object } : {}),
       }) as Field<T, K> & { readonly isClearable: true };
     },
     evolvesFrom<From>(source: Field<From>, project?: (value: From) => T): Field<T, K> {
@@ -600,6 +714,11 @@ function makeField<T, K extends FieldKind = FieldKind>(
       // `nomosEncryption` era key, built by aggregate()/manifest, is what carries the fact.
       return makeField<T, K>(kind, zod, driver, { ...extra, encrypted: true });
     },
+    blindIndexed(): Field<T, K> {
+      // ZD6 — carried through merge/optional like encrypted(); aggregate() enforces the
+      // encrypted-only rule (a plaintext field needs no blind index — index it directly).
+      return makeField<T, K>(kind, zod, driver, { ...extra, blindIndexed: true });
+    },
     attributed(): Field<T, K> {
       // Carry the flag through merge/optional (extra is threaded), so `.merge(Lww).attributed()`
       // and `.attributed().merge(Lww)` agree. aggregate() validates Lww-class eligibility and
@@ -771,6 +890,11 @@ export const t = {
     }
     return makeField("string", schema, FirstWriterWins);
   },
+  /** A SHA-256 digest with one canonical wire spelling: 64 lowercase hex characters.
+   * Generated clients surface [Sha256Digest], not a bare string. */
+  sha256Digest(): Field<Sha256Digest, "string"> {
+    return makeField<Sha256Digest, "string">("string", sha256Digest(), FirstWriterWins);
+  },
   int(rules: IntRules = {}): Field<number, "int"> {
     for (const [name, value] of [["minimum", rules.minimum], ["maximum", rules.maximum]] as const) {
       if (value !== undefined && !Number.isSafeInteger(value)) {
@@ -904,10 +1028,13 @@ export const t = {
    */
   clearable<T, K extends FieldKind>(
     field: Field<T, K>,
-    opts?: { requires?: string },
+    opts?: { requires?: string; object?: string },
   ): Field<T, K> & { readonly isClearable: true } {
     assertNullEligible(field, "clearable");
-    return field.clearable(opts?.requires);
+    if (opts?.object !== undefined && opts.requires === undefined) {
+      throw new Error("t.clearable(..., { object }) also requires an authorization relation");
+    }
+    return field.clearable(opts?.requires, opts?.object);
   },
   /**
    * `t.nullable(field, { reason })` — null IS a real domain value on this field (`architecture/
@@ -977,6 +1104,58 @@ export const t = {
       },
     });
   },
+  /** A first-class, atomic portable custody address. Unlike legacy `foreignRef`, there is no sibling
+   * workspace field which can tear under merge; workspace, aggregate type and id are one Lww value. */
+  nomosRef(
+    target: AggregateHandle<string, Record<string, Field>> | ContractHandle,
+  ): Field<NomosRefValue, "ref"> {
+    const isContract = (target as { __isContract?: unknown }).__isContract === true;
+    return makeField<NomosRefValue, "ref">("ref", nomosRefValueSchema, FirstWriterWins, {
+      refAggregateId: target.id,
+      nomosRef: {
+        targetAggregateId: target.id,
+        ...(isContract ? { targetIsContract: true } : {}),
+      },
+    });
+  },
+  /** A version pin whose freshness is checked against one law-declared current pointer on a stable series.
+   * The declaration fails immediately if `series.current` is not an atomic ref to `target`. */
+  versionedForeignRef(opts: {
+    target: AggregateHandle<string, Record<string, Field>> | ContractHandle;
+    series: AggregateHandle<string, Record<string, Field>> | ContractHandle;
+    current: string;
+    domain?: string;
+  }): Field<VersionedNomosRefValue, "ref"> {
+    const current = (opts.series.fields as Record<string, Field>)[opts.current];
+    if (current === undefined) {
+      throw new Error(
+        `t.versionedForeignRef: series '${opts.series.id}' has no current field '${opts.current}'`,
+      );
+    }
+    if (current.nomosRef?.targetAggregateId !== opts.target.id) {
+      throw new Error(
+        `t.versionedForeignRef: '${opts.series.id}.${opts.current}' must be ` +
+          `t.nomosRef(${opts.target.id}); it is the O(1) current pointer used for freshness`,
+      );
+    }
+    const targetIsContract = (opts.target as { __isContract?: unknown }).__isContract === true;
+    const seriesIsContract = (opts.series as { __isContract?: unknown }).__isContract === true;
+    return makeField<VersionedNomosRefValue, "ref">(
+      "ref",
+      versionedNomosRefValueSchema,
+      FirstWriterWins,
+      {
+        versionedForeignRef: {
+          targetAggregateId: opts.target.id,
+          ...(targetIsContract ? { targetIsContract: true } : {}),
+          seriesAggregateId: opts.series.id,
+          ...(seriesIsContract ? { seriesIsContract: true } : {}),
+          currentField: opts.current,
+          ...(opts.domain === undefined ? {} : { targetDomain: opts.domain }),
+        },
+      },
+    );
+  },
   /**
    * A 1:N INVERSE relation — the read side of a `t.ref` on the child (`aggregate_lifecycle_and_relations.md`).
    * `t.hasMany(Child).via("parent")` on a Parent declares "the Children whose `parent` ref points here".

package/src/flow_gate.ts

@@ -15,7 +15,11 @@
 // Integrity (who may WRITE) is gated natively at admission by `.requires(relation)`;
 // the integrity-flow dual + rule 4 (secret-correlated refusal) + `declassify` + the
 // `nomosFlowGate` era key are the next slices.
-import type { CanonicalManifest } from "./manifest.js";
+import type { DomainModule } from "./codegen_dart.js";
+import { finishCount } from "./count.js";
+import { existsAsCount } from "./exists.js";
+import { finishExtremum } from "./extremum.js";
+import { finishSum } from "./sum.js";
 import type { CanonicalPred } from "./predicate.js";
 
 /** A read projection, read structurally — every read kind (query / count / sum / extremum /
@@ -32,6 +36,26 @@ type Projection = {
   readonly where?: CanonicalPred;
 };
 
+/** The finite facts the information-flow proof consumes. A canonical manifest satisfies this
+ * structurally for legacy callers; the production compiler derives it straight from typed declarations. */
+export interface FlowLaw {
+  readonly aggregates: readonly {
+    readonly id: string;
+    readonly encryptedFields?: readonly string[];
+    readonly requiresRead?: string;
+  }[];
+  readonly directives: readonly {
+    readonly id: string;
+    readonly capturedReads?: readonly { readonly queryId: string; readonly returns: string }[];
+  }[];
+  readonly queries?: readonly Projection[];
+  readonly counts?: readonly Projection[];
+  readonly sums?: readonly Projection[];
+  readonly mins?: readonly Projection[];
+  readonly maxes?: readonly Projection[];
+  readonly orderedReads?: readonly Projection[];
+}
+
 /** The raw module bits rule 4 needs that the canonical manifest strips (the executable
  *  invariant `.reads` + the declassify waivers). Read structurally — no coupling to DomainModule. */
 type FlowModule = {
@@ -82,7 +106,7 @@ function predFields(p: CanonicalPred | undefined): string[] {
  * {@link FlowGateError} on the first violation (a typed compile error). Pure over
  * manifest IR — no side effects, no AST.
  */
-export function assertFlowGate(m: CanonicalManifest, mod?: FlowModule): void {
+export function assertFlowGate(m: FlowLaw, mod?: FlowModule): void {
   // ── RULE 1 — NO ENCRYPT-THEN-INDEX ──────────────────────────────────────────
   // A field that is .encrypted() (operator-blind ciphertext) MUST NOT appear in any
   // read's group-by / key / value / where over its own type: grouping/indexing/
@@ -233,3 +257,52 @@ export function assertFlowGate(m: CanonicalManifest, mod?: FlowModule): void {
     }
   }
 }
+
+/**
+ * Production compiler entry: prove information flow directly from the live typed declarations.
+ * This deliberately does not build, serialize or hash the retired canonical JSON manifest.
+ */
+export function assertFlowGateModule(mod: DomainModule): void {
+  const counts = [
+    ...(mod.counts ?? []).map(finishCount),
+    ...(mod.exists_ ?? []).map(existsAsCount),
+  ];
+  const facts: FlowLaw = {
+    aggregates: mod.aggregates.map((aggregate) => ({
+      id: aggregate.id,
+      ...(aggregate.encryptedFields === undefined ? {} : { encryptedFields: aggregate.encryptedFields }),
+      ...(aggregate.visibility === undefined ? {} : { requiresRead: aggregate.visibility.requires }),
+    })),
+    directives: mod.directives.map((directive) => ({
+      id: directive.id,
+      ...((directive.declaredQueryReads ?? []).length === 0
+        ? {}
+        : {
+            capturedReads: (directive.declaredQueryReads ?? []).map((read) => ({
+              queryId: read.id,
+              returns: read.returns,
+            })),
+          }),
+    })),
+    ...(mod.queries === undefined ? {} : { queries: mod.queries }),
+    ...(counts.length === 0 ? {} : { counts }),
+    ...(mod.sums === undefined
+      ? {}
+      : {
+          sums: mod.sums.map((raw) => {
+            const sum = finishSum(raw);
+            return {
+              id: sum.id,
+              of: sum.of,
+              valueField: sum.sumField,
+              ...(sum.by === undefined ? {} : { by: sum.by }),
+              ...(sum.where === undefined ? {} : { where: sum.where }),
+            };
+          }),
+        }),
+    ...(mod.mins === undefined ? {} : { mins: mod.mins.map(finishExtremum) }),
+    ...(mod.maxes === undefined ? {} : { maxes: mod.maxes.map(finishExtremum) }),
+    ...(mod.orderedReads === undefined ? {} : { orderedReads: mod.orderedReads }),
+  };
+  assertFlowGate(facts, mod);
+}

package/src/framework/application_home.ts

@@ -38,6 +38,7 @@ import {
   seedBirthAttestation,
   seedReceivingGroup,
   seedReceivingGroupPolicy,
+  sharedByObject,
   sharedByWorkspace,
 } from "./home.js";
 import { RelationTuple, relationTuplesByObject } from "./relations.js";
@@ -86,6 +87,7 @@ export const __nomos_SharedWithMe = aggregate(SharedWithMe);
 export const __nomos_recordShare = directive(recordShare);
 export const __nomos_pruneShare = directive(pruneShare);
 export const __nomos_sharedByWorkspace = query(sharedByWorkspace);
+export const __nomos_sharedByObject = query(sharedByObject);
 
 // Warrant, provenance, signer seating, recovery and verifier state.
 export const __nomos_GenesisWarrant = aggregate(GenesisWarrant);