@githolon/dsl 0.102.4 → 0.103.0

package/src/law_identity.ts

@@ -0,0 +1,435 @@
+// NOMOS — Compiler-custodied identity for independently-lived law declarations.
+//
+// This registry is authoring custody, not law. It remembers only identity continuity;
+// every semantic opinion remains in USDA. Retired entries are deliberately retained so
+// deleting and later recreating the same label cannot resurrect the deleted entity.
+import { mintStableId } from "./stable_ids.js";
+
+export const LAW_ENTITY_KINDS = [
+  "domain",
+  "aggregate",
+  "field",
+  "intent",
+  "read",
+  "relation",
+  "policy",
+  "invariant",
+  "capability",
+  "flow",
+  "workspace-type",
+  "contract",
+  "type",
+  "object-type",
+] as const;
+
+export type LawEntityKind = (typeof LAW_ENTITY_KINDS)[number];
+export type LawIdentityStatus = "active" | "retired";
+
+export interface LawIdentityEntity {
+  readonly kind: LawEntityKind;
+  readonly sid: string;
+  /** Registry key of the stable owning entity, or a reserved compiler scope. */
+  readonly parent?: string;
+  readonly label: string;
+  readonly priorLabels?: readonly string[];
+  readonly generation: number;
+  readonly status: LawIdentityStatus;
+}
+
+export interface LawIdentityRegistry {
+  readonly v: 1;
+  readonly entities: Readonly<Record<string, LawIdentityEntity>>;
+}
+
+export interface LawIdentityCarry {
+  readonly from: string;
+  readonly to: string;
+}
+
+export interface ReconcileLawIdentityScopeInput {
+  readonly kind: LawEntityKind;
+  readonly parent?: string;
+  readonly labels: readonly string[];
+  /** Explicit, already-validated identity carries. Never inferred in this layer. */
+  readonly carries?: readonly LawIdentityCarry[];
+  /** Used only while importing an existing compiler-minted identity byte-for-byte. */
+  readonly preferredSids?: Readonly<Record<string, string>>;
+  /**
+   * Defaults to true. Set false only when this compile sees a non-exhaustive slice of
+   * a shared scope (currently project-root domains and framework declarations).
+   */
+  readonly retireAbsent?: boolean;
+}
+
+export interface ReconciledLawIdentityScope {
+  readonly registry: LawIdentityRegistry;
+  /** Current label to registry key. */
+  readonly resolved: Readonly<Record<string, string>>;
+  readonly carried: readonly { from: string; to: string; key: string }[];
+  readonly allocated: readonly { label: string; key: string; generation: number }[];
+  readonly retired: readonly string[];
+}
+
+/**
+ * A compile-scoped identity transaction. Large laws reconcile hundreds of sibling
+ * scopes; cloning, sorting and validating the complete registry after every field
+ * group made that linear work accidentally quadratic. The transaction owns one
+ * private mutable copy, while the public one-shot API below retains its immutable
+ * behaviour.
+ */
+export interface LawIdentityReconciler {
+  reconcile(input: ReconcileLawIdentityScopeInput): ReconciledLawIdentityScope;
+  finish(): LawIdentityRegistry;
+}
+
+const KIND_PREFIX: Readonly<Record<LawEntityKind, string>> = {
+  domain: "d",
+  aggregate: "a",
+  field: "f",
+  intent: "i",
+  read: "q",
+  relation: "r",
+  policy: "p",
+  invariant: "n",
+  capability: "k",
+  flow: "w",
+  "workspace-type": "x",
+  contract: "c",
+  type: "t",
+  "object-type": "o",
+};
+
+const SID_PATTERN = /^[0-9a-f]{16}$/u;
+
+/** Reserved owner for declarations supplied by the kernel/framework, not one tenant domain. */
+export const LAW_FRAMEWORK_PARENT = "@framework";
+
+export function emptyLawIdentityRegistry(): LawIdentityRegistry {
+  return { v: 1, entities: {} };
+}
+
+export function lawEntityKey(kind: LawEntityKind, sid: string): string {
+  if (!SID_PATTERN.test(sid)) {
+    throw new Error(`NMS-ID-001 invalid ${kind} SID '${sid}'`);
+  }
+  return `${KIND_PREFIX[kind]}_${sid}`;
+}
+
+/** Identity for a compiler-owned slot whose lifecycle is exactly its stable owner's. */
+export function mintOwnedLawSid(ownerSid: string, slotKind: string, slot: string): string {
+  assertSid(ownerSid, "owner");
+  assertToken(slotKind, "owned slot kind");
+  assertToken(slot, "owned slot");
+  return mintStableId(`law-owned:${ownerSid}:${slotKind}:${slot}`);
+}
+
+/** Identity for an anonymous structural node; any semantic change creates a new node. */
+export function mintStructuralLawSid(
+  ownerSid: string,
+  nodeKind: string,
+  canonicalValue: unknown,
+): string {
+  assertSid(ownerSid, "owner");
+  assertToken(nodeKind, "structural node kind");
+  return mintStableId(`law-structural:${ownerSid}:${nodeKind}:${canonicalStructuralValue(canonicalValue)}`);
+}
+
+/**
+ * Reconcile every currently declared label in one (kind, parent) namespace.
+ *
+ * Exact labels retain identity. Explicit carries retain identity and append label
+ * lineage. All other additions allocate a generation-safe SID; unmatched active
+ * declarations become durable tombstones, together with their owned descendants.
+ */
+export function reconcileLawIdentityScope(
+  source: LawIdentityRegistry,
+  input: ReconcileLawIdentityScopeInput,
+): ReconciledLawIdentityScope {
+  const reconciler = createLawIdentityReconciler(source);
+  const result = reconciler.reconcile(input);
+  return { ...result, registry: reconciler.finish() };
+}
+
+export function createLawIdentityReconciler(
+  source: LawIdentityRegistry,
+): LawIdentityReconciler {
+  validateLawIdentityRegistry(source);
+  const entities: Record<string, LawIdentityEntity> = cloneEntities(source.entities);
+  const registryView: LawIdentityRegistry = { v: 1, entities };
+  let finished: LawIdentityRegistry | undefined;
+
+  return {
+    reconcile(input): ReconciledLawIdentityScope {
+      if (finished !== undefined) throw new Error("NMS-ID-001 identity reconciler is already finished");
+      assertUsableParent(registryView, input.parent);
+
+      const labels = [...input.labels].sort(compareText);
+      assertUniqueNonEmpty(labels, `${input.kind} labels`);
+      const scopeEntries = Object.entries(entities).filter(
+        ([, entity]) =>
+          entity.kind === input.kind && entity.parent === input.parent && entity.status === "active",
+      );
+      const activeByLabel = new Map(scopeEntries.map(([key, entity]) => [entity.label, key] as const));
+      const requested = new Set(labels);
+      const carried: { from: string; to: string; key: string }[] = [];
+      const carriedFrom = new Set<string>();
+      const carriedTo = new Set<string>();
+
+      for (const carry of [...(input.carries ?? [])].sort((a, b) => compareText(a.to, b.to))) {
+    if (carry.from === carry.to) {
+      throw new Error(`NMS-ID-004 identity carry '${carry.from}' -> '${carry.to}' is not a rename`);
+    }
+    if (carriedFrom.has(carry.from) || carriedTo.has(carry.to)) {
+      throw new Error(`NMS-ID-004 duplicate identity carry involving '${carry.from}' or '${carry.to}'`);
+    }
+    const key = activeByLabel.get(carry.from);
+    if (key === undefined) {
+      throw new Error(
+        `NMS-ID-004 cannot carry missing active ${input.kind} '${carry.from}' in ${scopeName(input.parent)}`,
+      );
+    }
+    if (!requested.has(carry.to)) {
+      throw new Error(`NMS-ID-004 carry target '${carry.to}' is not a current ${input.kind} declaration`);
+    }
+    const occupied = activeByLabel.get(carry.to);
+    if (occupied !== undefined && occupied !== key) {
+      throw new Error(`NMS-ID-003 active ${input.kind} label '${carry.to}' already owns another SID`);
+    }
+    const entity = entities[key]!;
+    entities[key] = {
+      ...entity,
+      label: carry.to,
+      priorLabels: appendUnique(entity.priorLabels, carry.from),
+    };
+    activeByLabel.delete(carry.from);
+    activeByLabel.set(carry.to, key);
+    carriedFrom.add(carry.from);
+    carriedTo.add(carry.to);
+    carried.push({ ...carry, key });
+      }
+
+      const resolved: Record<string, string> = {};
+      const allocated: { label: string; key: string; generation: number }[] = [];
+      for (const label of labels) {
+    const existing = activeByLabel.get(label);
+    if (existing !== undefined) {
+      resolved[label] = existing;
+      continue;
+    }
+
+    const historic = Object.values(entities).filter(
+      (entity) =>
+        entity.kind === input.kind &&
+        entity.parent === input.parent &&
+        (entity.label === label || entity.priorLabels?.includes(label) === true),
+    );
+    const generation = historic.reduce((max, entity) => Math.max(max, entity.generation), -1) + 1;
+    const preferredSid = generation === 0 ? input.preferredSids?.[label] : undefined;
+    // A compatibility proposal may repeat a deterministic legacy SID whose former
+    // owner is now a tombstone (most visibly a field beneath a recreated aggregate).
+    // That is evidence to allocate afresh, never authority to reuse the old identity.
+    const preferredKey = preferredSid === undefined ? undefined : lawEntityKey(input.kind, preferredSid);
+    const preferredAvailable =
+      preferredSid !== undefined && preferredKey !== undefined && entities[preferredKey] === undefined;
+    const sid =
+      preferredAvailable
+        ? preferredSid
+        : mintStableId(
+            `law-entity:${input.kind}:${input.parent ?? "@root"}:${label}:generation:${generation}`,
+          );
+    const key = lawEntityKey(input.kind, sid);
+    if (entities[key] !== undefined) {
+      throw new Error(
+        `NMS-ID-002 SID collision: ${key} is already ${describeEntity(entities[key]!)}`,
+      );
+    }
+    entities[key] = {
+      kind: input.kind,
+      sid,
+      ...(input.parent === undefined ? {} : { parent: input.parent }),
+      label,
+      generation,
+      status: "active",
+    };
+    activeByLabel.set(label, key);
+    resolved[label] = key;
+    allocated.push({ label, key, generation });
+      }
+
+      const retired: string[] = [];
+      if (input.retireAbsent !== false) {
+    for (const [key, entity] of scopeEntries) {
+      if (carriedFrom.has(entity.label)) continue;
+      if (requested.has(entity.label)) continue;
+      if (entities[key]?.status === "active") {
+        entities[key] = { ...entities[key]!, status: "retired" };
+        retired.push(key);
+        retireDescendants(entities, key, retired);
+      }
+    }
+      }
+
+      return {
+        registry: registryView,
+        resolved: canonicalRecord(resolved),
+        carried,
+        allocated,
+        retired: [...retired].sort(compareText),
+      };
+    },
+    finish(): LawIdentityRegistry {
+      if (finished !== undefined) return finished;
+      finished = canonicalRegistry(entities);
+      validateLawIdentityRegistry(finished);
+      return finished;
+    },
+  };
+}
+
+export function validateLawIdentityRegistry(registry: LawIdentityRegistry): void {
+  if (registry.v !== 1 || registry.entities === null || typeof registry.entities !== "object") {
+    throw new Error("NMS-ID-001 invalid identity registry envelope");
+  }
+  const activeCoordinates = new Map<string, string>();
+  for (const [key, entity] of Object.entries(registry.entities)) {
+    if (!LAW_ENTITY_KINDS.includes(entity.kind)) {
+      throw new Error(`NMS-ID-001 ${key} has unknown entity kind`);
+    }
+    if (lawEntityKey(entity.kind, entity.sid) !== key) {
+      throw new Error(`NMS-ID-001 registry key '${key}' disagrees with ${entity.kind} SID '${entity.sid}'`);
+    }
+    if (entity.label.length === 0) throw new Error(`NMS-ID-001 ${key} has an empty label`);
+    if (!Number.isSafeInteger(entity.generation) || entity.generation < 0) {
+      throw new Error(`NMS-ID-001 ${key} has invalid generation '${entity.generation}'`);
+    }
+    if (entity.status !== "active" && entity.status !== "retired") {
+      throw new Error(`NMS-ID-001 ${key} has invalid status`);
+    }
+    if (entity.priorLabels !== undefined) {
+      assertUniqueNonEmpty([...entity.priorLabels], `${key} prior labels`);
+      if (entity.priorLabels.includes(entity.label)) {
+        throw new Error(`NMS-ID-001 ${key} repeats its current label in priorLabels`);
+      }
+    }
+    if (entity.parent !== undefined && entity.parent !== LAW_FRAMEWORK_PARENT) {
+      const parent = registry.entities[entity.parent];
+      if (parent === undefined) {
+        throw new Error(`NMS-ID-005 ${key} names missing parent '${entity.parent}'`);
+      }
+      if (entity.status === "active" && parent.status !== "active") {
+        throw new Error(`NMS-ID-005 active ${key} has retired parent '${entity.parent}'`);
+      }
+    }
+    if (entity.status === "active") {
+      const coordinate = `${entity.kind}\u0000${entity.parent ?? "@root"}\u0000${entity.label}`;
+      const prior = activeCoordinates.get(coordinate);
+      if (prior !== undefined) {
+        throw new Error(`NMS-ID-003 active label '${entity.label}' aliases ${prior} and ${key}`);
+      }
+      activeCoordinates.set(coordinate, key);
+    }
+  }
+}
+
+function assertUsableParent(registry: LawIdentityRegistry, parent: string | undefined): void {
+  if (parent === undefined || parent === LAW_FRAMEWORK_PARENT) return;
+  const entity = registry.entities[parent];
+  if (entity === undefined) throw new Error(`NMS-ID-005 missing identity parent '${parent}'`);
+  if (entity.status !== "active") throw new Error(`NMS-ID-005 identity parent '${parent}' is retired`);
+}
+
+function retireDescendants(
+  entities: Record<string, LawIdentityEntity>,
+  parent: string,
+  retired: string[],
+): void {
+  for (const [key, entity] of Object.entries(entities)) {
+    if (entity.parent !== parent || entity.status !== "active") continue;
+    entities[key] = { ...entity, status: "retired" };
+    retired.push(key);
+    retireDescendants(entities, key, retired);
+  }
+}
+
+function canonicalRegistry(entities: Record<string, LawIdentityEntity>): LawIdentityRegistry {
+  return { v: 1, entities: canonicalRecord(entities) };
+}
+
+function canonicalRecord<T>(record: Record<string, T>): Record<string, T> {
+  return Object.fromEntries(Object.entries(record).sort(([a], [b]) => compareText(a, b)));
+}
+
+function cloneEntities(
+  entities: Readonly<Record<string, LawIdentityEntity>>,
+): Record<string, LawIdentityEntity> {
+  return Object.fromEntries(
+    Object.entries(entities).map(([key, entity]) => [
+      key,
+      {
+        ...entity,
+        ...(entity.priorLabels === undefined ? {} : { priorLabels: [...entity.priorLabels] }),
+      },
+    ]),
+  );
+}
+
+function appendUnique(values: readonly string[] | undefined, value: string): readonly string[] {
+  return values?.includes(value) === true ? [...values] : [...(values ?? []), value];
+}
+
+function assertUniqueNonEmpty(values: readonly string[], description: string): void {
+  const seen = new Set<string>();
+  for (const value of values) {
+    if (value.length === 0) throw new Error(`NMS-ID-001 ${description} contain an empty label`);
+    if (seen.has(value)) throw new Error(`NMS-ID-003 ${description} contain duplicate '${value}'`);
+    seen.add(value);
+  }
+}
+
+function describeEntity(entity: LawIdentityEntity): string {
+  return `${entity.kind} '${entity.label}' under ${scopeName(entity.parent)}`;
+}
+
+function scopeName(parent: string | undefined): string {
+  return parent ?? "the project root";
+}
+
+function compareText(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+function assertSid(sid: string, description: string): void {
+  if (!SID_PATTERN.test(sid)) throw new Error(`NMS-ID-001 invalid ${description} SID '${sid}'`);
+}
+
+function assertToken(value: string, description: string): void {
+  if (value.length === 0 || /[\u0000\r\n]/u.test(value)) {
+    throw new Error(`NMS-ID-001 invalid ${description} '${value}'`);
+  }
+}
+
+function canonicalStructuralValue(value: unknown, seen = new Set<object>()): string {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("NMS-ID-001 structural identity contains a non-finite number");
+    return JSON.stringify(value);
+  }
+  if (typeof value !== "object") {
+    throw new Error(`NMS-ID-001 structural identity cannot contain '${typeof value}'`);
+  }
+  if (seen.has(value)) throw new Error("NMS-ID-001 structural identity contains a cycle");
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const encoded = `[${value.map((item) => canonicalStructuralValue(item, seen)).join(",")}]`;
+    seen.delete(value);
+    return encoded;
+  }
+  const record = value as Record<string, unknown>;
+  const encoded = `{${Object.keys(record)
+    .sort(compareText)
+    .map((key) => `${JSON.stringify(key)}:${canonicalStructuralValue(record[key], seen)}`)
+    .join(",")}}`;
+  seen.delete(value);
+  return encoded;
+}

package/src/law_value_type.ts

@@ -0,0 +1,230 @@
+import type { z } from "zod";
+import {
+  zodArrayElement,
+  zodDef,
+  zodEnumValues,
+  zodKind,
+  zodObjectShape,
+} from "./zod_introspection.js";
+
+export type LawLiteral = string | number | boolean | null;
+export type LawConstant = LawLiteral | readonly LawConstant[] | { readonly [key: string]: LawConstant };
+
+export type LawValueConstraint =
+  | { readonly kind: "min-length" | "max-length"; readonly value: number }
+  | { readonly kind: "pattern"; readonly value: string }
+  | { readonly kind: "format"; readonly value: string }
+  | { readonly kind: "minimum" | "maximum"; readonly value: number; readonly inclusive: boolean }
+  | { readonly kind: "multiple-of"; readonly value: number };
+
+export interface LawValueMember {
+  readonly name: string;
+  readonly required: boolean;
+  readonly value: LawValueType;
+}
+
+export type LawValueType =
+  | { readonly kind: "string" | "number" | "integer"; readonly constraints: readonly LawValueConstraint[] }
+  | { readonly kind: "boolean" | "null" | "unknown" }
+  | { readonly kind: "enum"; readonly values: readonly string[] }
+  | { readonly kind: "literal"; readonly value: LawLiteral }
+  | { readonly kind: "list"; readonly element: LawValueType }
+  | { readonly kind: "map"; readonly value: LawValueType }
+  | { readonly kind: "record"; readonly fields: readonly LawValueMember[] }
+  | { readonly kind: "sum"; readonly options: readonly LawValueType[] }
+  | { readonly kind: "nullable"; readonly value: LawValueType }
+  | { readonly kind: "default"; readonly value: LawValueType; readonly defaultValue: LawConstant }
+  | { readonly kind: "recursive"; readonly anchor: string; readonly value: LawValueType }
+  | { readonly kind: "recursive-ref"; readonly anchor: string };
+
+interface ZodCheck {
+  readonly check?: string;
+  readonly minimum?: number;
+  readonly maximum?: number;
+  readonly value?: number;
+  readonly inclusive?: boolean;
+  readonly format?: string;
+  readonly pattern?: RegExp;
+}
+
+interface ZodCheckCarrier {
+  readonly _zod?: { readonly def?: ZodCheck };
+  readonly def?: ZodCheck;
+  readonly _def?: ZodCheck;
+}
+
+interface ZodExtendedDef {
+  readonly innerType?: z.ZodTypeAny;
+  readonly options?: readonly z.ZodTypeAny[];
+  readonly valueType?: z.ZodTypeAny;
+  readonly keyType?: z.ZodTypeAny;
+  readonly getter?: () => z.ZodTypeAny;
+  readonly defaultValue?: unknown;
+  readonly checks?: readonly ZodCheckCarrier[];
+  readonly value?: unknown;
+  readonly values?: readonly unknown[] | Set<unknown>;
+}
+
+export function lowerLawValueType(schema: z.ZodTypeAny): LawValueType {
+  return lower(schema, "$", new Map());
+}
+
+function lower(
+  schema: z.ZodTypeAny,
+  path: string,
+  activeLazy: Map<z.ZodTypeAny, string>,
+): LawValueType {
+  const kind = zodKind(schema);
+  const def = zodDef(schema) as ZodExtendedDef;
+  switch (kind) {
+    case "string":
+      return { kind: "string", constraints: constraintsOf(def) };
+    case "number": {
+      const constraints = constraintsOf(def);
+      const integer = def.checks?.some((check) => checkDef(check).format === "safeint") === true;
+      return { kind: integer ? "integer" : "number", constraints };
+    }
+    case "boolean":
+      return { kind: "boolean" };
+    case "null":
+      return { kind: "null" };
+    case "unknown":
+    case "any":
+      return { kind: "unknown" };
+    case "enum":
+      return { kind: "enum", values: zodEnumValues(schema).sort(compareText) };
+    case "literal":
+      return { kind: "literal", value: literalOf(def, path) };
+    case "array":
+      return { kind: "list", element: lower(zodArrayElement(schema), `${path}[]`, activeLazy) };
+    case "record": {
+      if (def.valueType === undefined) fail(path, "record has no value type");
+      return { kind: "map", value: lower(def.valueType, `${path}.*`, activeLazy) };
+    }
+    case "object":
+      return {
+        kind: "record",
+        fields: Object.entries(zodObjectShape(schema))
+          .sort(([a], [b]) => compareText(a, b))
+          .map(([name, field]) => lowerMember(name, field, path, activeLazy)),
+      };
+    case "union":
+      return {
+        kind: "sum",
+        options: (def.options ?? []).map((option, index) =>
+          lower(option, `${path}|${index}`, activeLazy)),
+      };
+    case "optional": {
+      if (def.innerType === undefined) fail(path, "optional has no inner type");
+      return lower(def.innerType, path, activeLazy);
+    }
+    case "nullable": {
+      if (def.innerType === undefined) fail(path, "nullable has no inner type");
+      return { kind: "nullable", value: lower(def.innerType, path, activeLazy) };
+    }
+    case "default": {
+      if (def.innerType === undefined) fail(path, "default has no inner type");
+      return {
+        kind: "default",
+        value: lower(def.innerType, path, activeLazy),
+        defaultValue: constant(def.defaultValue, path, "default"),
+      };
+    }
+    case "lazy": {
+      const existing = activeLazy.get(schema);
+      if (existing !== undefined) return { kind: "recursive-ref", anchor: existing };
+      if (def.getter === undefined) fail(path, "lazy has no getter");
+      activeLazy.set(schema, path);
+      const value = lower(def.getter(), path, activeLazy);
+      activeLazy.delete(schema);
+      return { kind: "recursive", anchor: path, value };
+    }
+    default:
+      fail(path, `unsupported Zod type '${kind}'`);
+  }
+}
+
+function lowerMember(
+  name: string,
+  schema: z.ZodTypeAny,
+  parentPath: string,
+  activeLazy: Map<z.ZodTypeAny, string>,
+): LawValueMember {
+  let value = schema;
+  let required = true;
+  while (zodKind(value) === "optional") {
+    required = false;
+    const inner = zodDef(value).innerType;
+    if (inner === undefined) fail(`${parentPath}.${name}`, "optional has no inner type");
+    value = inner;
+  }
+  if (zodKind(value) === "default") required = false;
+  return {
+    name,
+    required,
+    value: lower(value, `${parentPath}.${name}`, activeLazy),
+  };
+}
+
+function constraintsOf(def: ZodExtendedDef): LawValueConstraint[] {
+  const constraints: LawValueConstraint[] = [];
+  for (const carrier of def.checks ?? []) {
+    const check = checkDef(carrier);
+    if (check.check === "min_length" && check.minimum !== undefined) {
+      constraints.push({ kind: "min-length", value: check.minimum });
+    } else if (check.check === "max_length" && check.maximum !== undefined) {
+      constraints.push({ kind: "max-length", value: check.maximum });
+    } else if (check.check === "string_format" && check.format !== undefined) {
+      if (check.format === "regex" && check.pattern !== undefined) {
+        constraints.push({ kind: "pattern", value: check.pattern.source });
+      } else {
+        constraints.push({ kind: "format", value: check.format });
+      }
+    } else if (check.check === "greater_than" && check.value !== undefined) {
+      constraints.push({ kind: "minimum", value: check.value, inclusive: check.inclusive === true });
+    } else if (check.check === "less_than" && check.value !== undefined) {
+      constraints.push({ kind: "maximum", value: check.value, inclusive: check.inclusive === true });
+    } else if (check.check === "multiple_of" && check.value !== undefined) {
+      constraints.push({ kind: "multiple-of", value: check.value });
+    }
+  }
+  return constraints.sort((a, b) => compareText(JSON.stringify(a), JSON.stringify(b)));
+}
+
+function checkDef(value: ZodCheckCarrier): ZodCheck {
+  return value._zod?.def ?? value.def ?? value._def ?? {};
+}
+
+function literalOf(def: ZodExtendedDef, path: string): LawLiteral {
+  const values = def.values instanceof Set ? [...def.values] : def.values;
+  return literal(def.value ?? values?.[0], path, "literal");
+}
+
+function literal(value: unknown, path: string, owner: string): LawLiteral {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  fail(path, `${owner} is not a finite JSON scalar`);
+}
+
+function constant(value: unknown, path: string, owner: string): LawConstant {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (Array.isArray(value)) return value.map((child, index) =>
+    constant(child, `${path}[${index}]`, owner));
+  if (typeof value === "object" && value !== null) {
+    const result: Record<string, LawConstant> = {};
+    for (const [key, child] of Object.entries(value).sort(([a], [b]) => compareText(a, b))) {
+      result[key] = constant(child, `${path}.${key}`, owner);
+    }
+    return result;
+  }
+  fail(path, `${owner} is not canonical data`);
+}
+
+function compareText(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+function fail(path: string, reason: string): never {
+  throw new Error(`NMS-GRAPH-002 payload type '${path}' ${reason}`);
+}