@githolon/dsl 0.102.5 → 0.103.0

package/src/framework/workspace_invariant.ts

@@ -35,6 +35,8 @@
  * workspace scan / projection read / ambient "current world" read — only the declared refs.
  */
 
+import type { PointGuardSpec } from "../point_guard.js";
+
 /** A TYPED verdict — identical shape to the aggregate invariant (the engine parses both). */
 export type WorkspaceInvariantVerdict = { accept: true } | { reject: string };
 
@@ -51,6 +53,240 @@ export interface InvariantRef {
   readonly id: string;
 }
 
+/** A native point-read recipe. This is authored in TypeScript, custodied as typed USDA, and
+ * interpreted by Rust. It is data, not an executable JavaScript read selector. */
+export type InvariantReadTransform = "none" | "row-key" | "stable-id";
+
+export type InvariantReadIdPart =
+  | { readonly source: "literal"; readonly value: string }
+  | { readonly source: "payload" | "item"; readonly path: readonly string[]; readonly transform: InvariantReadTransform };
+
+export type InvariantReadId =
+  | { readonly source: "literal"; readonly value: string }
+  | {
+      readonly source: "payload";
+      readonly path: readonly string[];
+      readonly prefix: string;
+      readonly suffix: string;
+      readonly optional: boolean;
+    }
+  | { readonly source: "template"; readonly parts: readonly InvariantReadIdPart[]; readonly optional: boolean };
+
+export interface InvariantReadBinding {
+  readonly binding: string;
+  readonly aggregate: string;
+  readonly state: "pre" | "post";
+  readonly eachPayloadPath?: readonly string[];
+  readonly id: InvariantReadId;
+}
+
+function readPath(path: string | readonly string[]): readonly string[] {
+  return typeof path === "string" ? path.split(".").filter(Boolean) : [...path];
+}
+
+export function idLiteral(value: string): InvariantReadIdPart {
+  return { source: "literal", value };
+}
+
+export function idPayload(
+  path: string | readonly string[],
+  transform: InvariantReadTransform = "none",
+): InvariantReadIdPart {
+  return { source: "payload", path: readPath(path), transform };
+}
+
+export function idItem(
+  path: string | readonly string[] = [],
+  transform: InvariantReadTransform = "none",
+): InvariantReadIdPart {
+  return { source: "item", path: readPath(path), transform };
+}
+
+export function idTemplate(
+  ...parts: readonly (InvariantReadIdPart | string)[]
+): readonly InvariantReadIdPart[] {
+  return parts.map((part) => typeof part === "string" ? idLiteral(part) : part);
+}
+
+const NATIVE_READ_SET = Symbol.for("nomos.workspaceInvariant.nativeReadSet.v1");
+
+type NativeReadSet = WorkspaceInvariantReads & {
+  readonly [NATIVE_READ_SET]: readonly InvariantReadBinding[];
+};
+
+function aggregateName(aggregate: { readonly id: string } | string): string {
+  return typeof aggregate === "string" ? aggregate : aggregate.id;
+}
+
+/** Begin one typed, bounded aggregate read. Prefer an aggregate handle; strings remain available
+ * for framework composition where the declaration is intentionally late-bound. */
+export function readRef(
+  binding: string,
+  aggregate: { readonly id: string } | string,
+): {
+  at(id: string): InvariantReadBinding;
+  fromPayload(path: string | readonly string[], options?: { readonly prefix?: string; readonly suffix?: string }): InvariantReadBinding;
+  fromOptionalPayload(path: string | readonly string[], options?: { readonly prefix?: string; readonly suffix?: string }): InvariantReadBinding;
+  fromTemplate(parts: readonly InvariantReadIdPart[], options?: { readonly optional?: boolean }): InvariantReadBinding;
+  forEach(
+    path: string | readonly string[],
+    parts: readonly InvariantReadIdPart[],
+    options?: { readonly optional?: boolean },
+  ): InvariantReadBinding;
+  pre(): ReturnType<typeof readRef>;
+  post(): ReturnType<typeof readRef>;
+} {
+  const build = (state: "pre" | "post") => ({
+    at(id: string): InvariantReadBinding {
+      return { binding, aggregate: aggregateName(aggregate), state, id: { source: "literal", value: id } };
+    },
+    fromPayload(
+      path: string | readonly string[],
+      options: { readonly prefix?: string; readonly suffix?: string } = {},
+    ): InvariantReadBinding {
+      return {
+        binding,
+        aggregate: aggregateName(aggregate),
+        state,
+        id: {
+          source: "payload",
+          path: readPath(path),
+          prefix: options.prefix ?? "",
+          suffix: options.suffix ?? "",
+          optional: false,
+        },
+      };
+    },
+    fromOptionalPayload(
+      path: string | readonly string[],
+      options: { readonly prefix?: string; readonly suffix?: string } = {},
+    ): InvariantReadBinding {
+      const binding = build(state).fromPayload(path, options);
+      if (binding.id.source !== "payload") return binding;
+      return { ...binding, id: { ...binding.id, optional: true } };
+    },
+    fromTemplate(
+      parts: readonly InvariantReadIdPart[],
+      options: { readonly optional?: boolean } = {},
+    ): InvariantReadBinding {
+      return {
+        binding,
+        aggregate: aggregateName(aggregate),
+        state,
+        id: { source: "template", parts: [...parts], optional: options.optional ?? false },
+      };
+    },
+    forEach(
+      path: string | readonly string[],
+      parts: readonly InvariantReadIdPart[],
+      options: { readonly optional?: boolean } = {},
+    ): InvariantReadBinding {
+      return {
+        ...build(state).fromTemplate(parts, options),
+        eachPayloadPath: readPath(path),
+      };
+    },
+    pre: () => build("pre"),
+    post: () => build("post"),
+  });
+  return build("post");
+}
+
+function valueAtPath(value: unknown, path: readonly string[]): unknown {
+  let current = value;
+  for (const part of path) {
+    if (current === null || typeof current !== "object") return undefined;
+    current = (current as Record<string, unknown>)[part];
+  }
+  return current;
+}
+
+function transformReadPart(value: string, transform: InvariantReadTransform): string {
+  if (transform === "row-key") {
+    return value.replace(/%/g, "%25").replace(/_/g, "%5F").replace(/\|/g, "%7C");
+  }
+  if (transform === "stable-id") return value.replace(/[^A-Za-z0-9.@/-]/g, "-");
+  return value;
+}
+
+function resolveTemplate(
+  parts: readonly InvariantReadIdPart[],
+  intent: Record<string, unknown>,
+  item: unknown,
+): string | undefined {
+  let result = "";
+  for (const part of parts) {
+    if (part.source === "literal") {
+      result += part.value;
+      continue;
+    }
+    const value = valueAtPath(part.source === "payload" ? intent : item, part.path);
+    if (value === undefined || value === null) return undefined;
+    if (typeof value !== "string" && typeof value !== "number") return undefined;
+    result += transformReadPart(String(value), part.transform);
+  }
+  return result;
+}
+
+/** Resolve a typed read-id expression for authoring-time probes and precondition planning.
+ * Runtime admission evaluates the custodied twin directly in Rust. */
+export function resolveInvariantReadId(
+  id: InvariantReadId,
+  intent: Record<string, unknown>,
+  item?: unknown,
+): string | undefined {
+  if (id.source === "literal") return id.value;
+  if (id.source === "payload") {
+    const value = valueAtPath(intent, id.path);
+    if (value === undefined || value === null || value === "") return id.optional ? undefined : "";
+    if (typeof value !== "string" && typeof value !== "number") return id.optional ? undefined : "";
+    return `${id.prefix}${String(value)}${id.suffix}`;
+  }
+  return resolveTemplate(id.parts, intent, item);
+}
+
+/** Declare a bounded set of generic point reads. The returned callable keeps authoring-time tests
+ * ergonomic, while the non-enumerable metadata is what the compiler lowers into USDA. */
+export function readSet(...bindings: readonly InvariantReadBinding[]): WorkspaceInvariantReads {
+  const selector = ((ctx: { intent: Record<string, unknown> }) => {
+    const refs: InvariantRef[] = [];
+    for (const binding of bindings) {
+      const repeated = binding.eachPayloadPath === undefined
+        ? [undefined]
+        : valueAtPath(ctx.intent, binding.eachPayloadPath);
+      if (!Array.isArray(repeated)) {
+        if (binding.eachPayloadPath !== undefined && binding.id.source === "template" && binding.id.optional) continue;
+        if (binding.eachPayloadPath !== undefined) continue;
+      }
+      const items: readonly unknown[] = Array.isArray(repeated) ? repeated : [undefined];
+      for (let index = 0; index < items.length; index += 1) {
+      let id = resolveInvariantReadId(binding.id, ctx.intent, items[index]);
+      if (id === undefined && binding.id.source !== "literal" && binding.id.optional) continue;
+      id ??= "";
+      refs.push({
+        name: binding.eachPayloadPath === undefined ? binding.binding : `${binding.binding}${index}`,
+        aggregate: binding.aggregate,
+        id: binding.state === "pre" ? `pre:${id}` : id,
+      });
+      }
+    }
+    return refs;
+  }) as NativeReadSet;
+  Object.defineProperty(selector, NATIVE_READ_SET, {
+    value: bindings.map((binding) => ({ ...binding })),
+    enumerable: false,
+    writable: false,
+  });
+  return selector;
+}
+
+/** Compiler-only access to a native read set. Ordinary callbacks deliberately return undefined. */
+export function nativeReadBindings(
+  reads: WorkspaceInvariantReads,
+): readonly InvariantReadBinding[] | undefined {
+  return (reads as Partial<NativeReadSet>)[NATIVE_READ_SET];
+}
+
 /** `inventory.Item` → `item`; `layout.FloorPlan` → `floorPlan` (short segment, first-lower). */
 function deriveName(aggregateType: string): string {
   const short = aggregateType.includes(".")
@@ -140,6 +376,8 @@ export interface WorkspaceInvariantDecl {
   readonly on: string;
   /** The executable declared read-set — ships in the engine bundle, NOT the manifest. */
   readonly reads: WorkspaceInvariantReads;
+  /** Typed generic read recipes lowered into USDA. Absent only for not-yet-migrated callbacks. */
+  readonly __nomosReadBindings?: readonly InvariantReadBinding[];
   /** The executable predicate — ships in the engine bundle, NOT the manifest. */
   readonly assert: WorkspaceInvariantAssert;
   /**
@@ -150,6 +388,11 @@ export interface WorkspaceInvariantDecl {
    * a secret-correlated refusal.
    */
   readonly declassify?: string;
+  /** Framework-owned evaluator whose complete semantics are part of the named kernel ABI.
+   * Tenant-authored invariants omit this and execute their sealed USDA plan. */
+  readonly __nomosEvaluator?: "birth-quota-v1" | "founder-signer-write-once-v1" | "point-guard-v1";
+  /** Typed point-state law consumed directly by the kernel when evaluator is `point-guard-v1`. */
+  readonly __nomosPointGuard?: PointGuardSpec;
   /** Framework-only provenance used to keep compiler errors on the tenant-authored surface. */
   readonly __nomosGenerated?: "directive-precondition";
   /** Brand so a plain object is never mistaken for a declaration. */
@@ -173,10 +416,12 @@ export function workspaceInvariant(id: string): {
 } {
   const finish = (directiveId: string, reads: WorkspaceInvariantReads, declassify: string | undefined) => ({
     assert(assert: WorkspaceInvariantAssert): WorkspaceInvariantDecl {
+      const readBindings = nativeReadBindings(reads);
       return {
         id,
         on: directiveId,
         reads,
+        ...(readBindings === undefined ? {} : { __nomosReadBindings: readBindings }),
         assert,
         ...(declassify !== undefined ? { declassify } : {}),
         __isWorkspaceInvariant: true as const,

package/src/framework/workspaces.ts

@@ -74,7 +74,7 @@ import { t } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
 import { read } from "../read.js";
-import { workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
+import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
 import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from "./relations.js";
 import { relationType, self, user, key } from "../relation_schema.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
@@ -143,7 +143,7 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
   // NEVER match the bare runtime id ⇒ the gate stays silently INERT (the #266 side-door bug,
   // 2026-06-15). Bare matches — exactly the convention the sharding invariants already fire under.
   .on("ensureWorkspaceSelf")
-  .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  .reads(readSet(readRef("self", WorkspaceSelf).pre().at(WORKSPACE_SELF_ID)))
   // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`). At genesis name + role
   // were always co-written, so an existing born workspace has `name` ⇒ behaviour preserved; a fresh one has
   // neither ⇒ first set admitted.
@@ -542,15 +542,14 @@ export function buildGenesisChain(p: {
   rebornFrom?: string;
 }): string {
   const founder = "user:" + p.principal;
-  // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT law the order names — bytes are NOT in
-  // the recipe (the kernel resolves them by hash from its own custody when it folds the birth, never the
-  // host). `domainHash` names the law; `domainPackageB64` stays empty here (the kernel supplies bytes-by-hash
-  // for the in-chain install). Two layers, matching the genesis bootstrap: bootstrap controller, then law.
+  // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT typed USDA closures the order names.
+  // Bytes are NOT in the recipe; the kernel resolves each identity from its own custody when it folds the
+  // birth. Two layers, matching the genesis bootstrap: bootstrap controller, then law.
   const installSteps =
     p.frameworkHash && p.lawHash
       ? [
-          { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
-          { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
+          { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash },
+          { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash },
         ]
       : [];
   // THE LINEAGE-AUTHORIZATION BINDING (proof-friendly): the child's birthCloud records who authorized it, so
@@ -800,7 +799,8 @@ export const birthCloud = directive("birthCloud")
     // the born marker; `role` is no longer written (vestigial node-class — see WorkspaceSelf).
     ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("name", p.name);
     return [];
-  });
+  })
+  .alsoEnsures(WorkspaceSelf);
 
 /**
  * provisionWorkspace — the worker's RETURN RECEIPT: authored AFTER it physically
@@ -917,9 +917,7 @@ export const retireOwnWorkspace = directive("retireOwnWorkspace")
  *  so the read manifest is unchanged (era-/evolve-safe). */
 export const retireOwnOnly = workspaceInvariant("RetireOwnOnly")
   .on("retireOwnWorkspace")
-  .reads((ctx) => [
-    refAs("target", "CloudWorkspace", "pre:" + String((ctx?.intent ?? {}).workspaceId ?? "")),
-  ])
+  .reads(readSet(readRef("target", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert((refs, ctx) => {
     const target = (refs as { target?: { principal?: string; createdBy?: string } }).target;
     // The captured, VERIFIED author rides as a SUBJECT (`user:<uid>`); the record's creator fields
@@ -1031,9 +1029,7 @@ export const rebirthWorkspace = directive("rebirthWorkspace")
  */
 export const rebirthNotRoot = workspaceInvariant("RebirthNotRoot")
   .on("rebirthWorkspace")
-  .reads((ctx) => [
-    refAs("target", "CloudWorkspace", "pre:" + String((ctx?.intent ?? {}).workspaceId ?? "")),
-  ])
+  .reads(readSet(readRef("target", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert((refs) => {
     const target = (refs as { target?: { name?: string } }).target;
     return target?.name === "root"
@@ -1051,9 +1047,7 @@ export const rebirthNotRoot = workspaceInvariant("RebirthNotRoot")
  */
 export const rebirthRetainsLineage = workspaceInvariant("RebirthRetainsLineage")
   .on("rebirthWorkspace")
-  .reads((ctx) => [
-    refAs("target", "CloudWorkspace", "pre:" + String((ctx?.intent ?? {}).workspaceId ?? "")),
-  ])
+  .reads(readSet(readRef("target", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert((refs, ctx) => {
     const target = (refs as { target?: { parent?: string } }).target;
     const claimed = (ctx?.intent as { parent?: string } | undefined)?.parent;
@@ -1788,7 +1782,7 @@ export { RelationTuple };
  *  owner-rebind the host session-lane used to refuse — is rejected. */
 export const genesisWarrantWriteOnce = workspaceInvariant("GenesisWarrantWriteOnce")
   .on("seedGenesis")
-  .reads(() => [refAs("warrant", "GenesisWarrant", "pre:" + GENESIS_WARRANT_ID)])
+  .reads(readSet(readRef("warrant", "GenesisWarrant").pre().at(GENESIS_WARRANT_ID)))
   .assert(({ warrant }, ctx) => {
     const cur = warrant as { principal?: string; workspaceId?: string } | undefined;
     if (!cur?.principal) return { accept: true }; // virgin — genesis may seed the founding warrant
@@ -1823,7 +1817,7 @@ export const founderSignerWriteOnce = workspaceInvariant("FounderSignerWriteOnce
  *  WorkspaceSelf.role exists. Genesis births on a role-less chain; materialize births each child once. */
 export const birthCloudOnce = workspaceInvariant("BirthCloudOnce")
   .on("birthCloud")
-  .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  .reads(readSet(readRef("self", WorkspaceSelf).pre().at(WORKSPACE_SELF_ID)))
   // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`) — a workspace is born once.
   .assert(({ self }) =>
     (self as { name?: string })?.name ? { reject: "cloud-already-born" } : { accept: true },
@@ -1837,7 +1831,7 @@ export const birthCloudOnce = workspaceInvariant("BirthCloudOnce")
  *  rest. (Worker authors ownerGrantHash=foundingAdminHash for platforms, sha256(freshSecret) for plain.) */
 export const provisionReceiptGuard = workspaceInvariant("ProvisionReceiptGuard")
   .on("provisionWorkspace")
-  .reads((ctx) => [refAs("ws", "CloudWorkspace", "pre:" + String((ctx.intent ?? {}).workspaceId ?? ""))])
+  .reads(readSet(readRef("ws", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert(({ ws }, ctx) => {
     const rec = ws as { status?: string; foundingAdminHash?: string } | undefined;
     if (!rec || rec.status !== "requested") return { reject: "provision-requires-requested-workspace" };
@@ -1856,7 +1850,7 @@ export const provisionReceiptGuard = workspaceInvariant("ProvisionReceiptGuard")
  *  refuses reclaiming itself; this guards children.) */
 export const reclaimRequiresRetired = workspaceInvariant("ReclaimRequiresRetired")
   .on("reclaimWorkspace")
-  .reads((ctx) => [refAs("ws", "CloudWorkspace", "pre:" + String((ctx.intent ?? {}).workspaceId ?? ""))])
+  .reads(readSet(readRef("ws", CloudWorkspace).pre().fromPayload("workspaceId")))
   .assert(({ ws }) => {
     const rec = ws as { status?: string } | undefined;
     return rec?.status === "retired" ? { accept: true } : { reject: "reclaim-requires-retired" };
@@ -1915,11 +1909,11 @@ function creationPostureVerdict(
   return { reject: "creation.invalid-posture" };
 }
 
-const creationPostureReads = () => [
-  refAs("policy", "CloudPolicy", CREATION_POLICY_ID),
-  refAs("creators", "RelationTuple", CREATOR_TUPLE_ID),
-  refAs("admins", "RelationTuple", ADMIN_TUPLE_ID),
-];
+const creationPostureReads = readSet(
+  readRef("policy", CloudPolicy).at(CREATION_POLICY_ID),
+  readRef("creators", RelationTuple).at(CREATOR_TUPLE_ID),
+  readRef("admins", RelationTuple).at(ADMIN_TUPLE_ID),
+);
 
 /** Compatibility create: open/unset ⇒ proven author; invite ⇒ creator; closed ⇒ admin. */
 export const creationPostureCreate = workspaceInvariant("CreationPostureCreate")
@@ -1961,7 +1955,7 @@ export const workspaceQuotaCreate = workspaceInvariant("WorkspaceQuota")
   .on("createWorkspace")
   // The snapshot ref-set is EMPTY — the count comes from the captured reads (ctx.reads), which the standard
   // ref-resolution cannot produce (it resolves single instances by id, never an enumeration).
-  .reads(() => [])
+  .reads(readSet())
   .assert((_snapshots, ctx) =>
     quotaVerdict(ctx?.reads ?? [], String((ctx?.intent ?? {}).principal ?? "")),
   );
@@ -1969,7 +1963,7 @@ export const workspaceQuotaCreate = workspaceInvariant("WorkspaceQuota")
 /** birthChild: the SAME count quota (a leaf or platform birth draws on the principal's allowance). */
 export const workspaceQuotaBirth = workspaceInvariant("WorkspaceQuotaBirth")
   .on("birthChild")
-  .reads(() => [])
+  .reads(readSet())
   .assert((_snapshots, ctx) =>
     quotaVerdict(ctx?.reads ?? [], String((ctx?.intent ?? {}).principal ?? "")),
   );

package/src/index.ts

@@ -9,6 +9,14 @@
 // ONE import for a domain file: `z` (payload schemas) rides along with the DSL, so
 // authors never juggle a separate zod dependency (or risk a second zod instance).
 export { z } from "zod";
+export {
+  definePackage,
+  validateNomosPackageConfig,
+  type NomosPackageConfig,
+  type NomosPackageDefinition,
+  type NomosPackageDomainConfig,
+} from "./package_config.js";
+export type { RuntimePackageDependency } from "./package_dependencies.js";
 export {
   aggregate,
   instance,
@@ -41,6 +49,10 @@ export {
   jsonWithNullSchema,
   type EvidenceRefValue,
   evidenceRefSchema,
+  type Sha256Digest,
+  sha256Digest,
+  isSha256DigestSchema,
+  NOMOS_SHA256_DIGEST_BRAND,
   // FIELD FACETS (the endorse model — security_model.md): authority/standing/attribution gate
   // set() acceptance of PrincipalEvidence; secret/public are the confidentiality lattice.
   authorityField,
@@ -61,11 +73,15 @@ export {
   idOf,
   idOfMetaOf,
   idOfTargetKindOf,
+  versionedRefOf,
+  versionedRefOfMetaOf,
   brandedId,
   brandedIdMetaOf,
   voMetaOf,
   voSample,
   NOMOS_VO_BRAND,
+  NOMOS_VERSIONED_REF_BRAND,
+  type VersionedRefOfMeta,
   geo,
   type ValueObject,
   type ValueObjectValue,
@@ -478,6 +494,7 @@ export {
   recordShare,
   pruneShare,
   sharedByWorkspace,
+  sharedByObject,
   ReceivingGroup,
   ReceivingGroupPolicy,
   RECEIVING_GROUP_ID,
@@ -594,9 +611,7 @@ export {
 } from "./framework/capability.js";
 export {
   DOMAIN_INSTALLATION_PHASES,
-  PolicyBundle,
   DomainInstallation,
-  policyAggregateId,
   domainInstallationAggregateId,
   installDomain,
   stageDomain,
@@ -623,8 +638,18 @@ export {
 } from "./framework/repair.js";
 export {
   workspaceInvariant,
+  readRef,
+  readSet,
+  idItem,
+  idLiteral,
+  idPayload,
+  idTemplate,
   ref,
   refAs,
+  type InvariantReadBinding,
+  type InvariantReadId,
+  type InvariantReadIdPart,
+  type InvariantReadTransform,
   type WorkspaceInvariantDecl,
   type WorkspaceInvariantVerdict,
   type WorkspaceInvariantReads,
@@ -729,7 +754,10 @@ export {
   type InvariantEvidence,
   type InvariantVerdict,
 } from "./relation.js";
-export { generateDartDomain, type DomainModule } from "./codegen_dart.js";
+// Build-time generators live on explicit package subpaths. Keep the structural type available to
+// authoring tools, but never pull generator implementations into the runtime namespace evaluated by
+// every kernel sandbox.
+export type { DomainModule } from "./codegen_dart.js";
 // SHAPE COMPATIBILITY (#72) — the structural contract a client negotiates with a workspace
 // by, instead of the law hash. Pure + deterministic; the editor/CI mirror imports these.
 export {
@@ -744,28 +772,20 @@ export {
 // turned on by the `--emit-dot` compiler flag). Pure `DomainModule -> string`, deterministic;
 // NOT part of the domain identity. Barrel-safe (no node:* imports), so the engine bundle can
 // import this barrel unaffected.
-export { emitDomainDot, type DotOptions } from "./codegen_dot.js";
+export type { DotOptions } from "./codegen_dot.js";
 // The OPTIONAL OpenUSD `.usda` emitter — a COMPILED DOMAIN as a navigable USD stage (aggregates →
 // Sphere prims, directives → Cube prims carrying their `plan` lump, the creates/mutates/ref flow →
 // BasisCurves). The abstract LAW structure as a maths object (holon-maths projection), NOT the org-data
 // twin. Sibling of `emitDomainDot`: pure `DomainModule -> string`, deterministic, NOT part of the
 // domain identity; barrel-safe (no node:* imports). Open the output in usdview / any USD tool.
-export { emitDomainUsda, type UsdaOptions } from "./codegen_usda.js";
+export type { UsdaOptions } from "./codegen_usda.js";
 // The PROVIDER SDK codegen (symmetric twin of the peer payload classes). `emitProviderSdk`
 // is invoked INSIDE `generateDartDomain` for a module's `impureCapabilities`; the type is exported
 // so the emit script can type its `impureCapabilities` list. A `impureCapability(...)` factory return value
 // satisfies `ImpureCapabilityDecl` structurally.
-export {
-  emitProviderSdk,
-  emitProviderTask,
-  taskBaseName,
-  type ImpureCapabilityDecl,
-} from "./codegen_provider_dart.js";
-// NOTE: the canonical-manifest / domain-hash API (`./manifest.js`) is a BUILD-TIME
-// concern that imports `node:crypto`. It is DELIBERATELY NOT re-exported from this
-// barrel: the deterministic engine bundle (`golden/domain_nomos.js`) imports this
-// barrel, and esbuild `--platform=neutral` cannot resolve `node:crypto`. Build-time
-// consumers import it via the `@githolon/dsl/manifest` subpath instead.
+export type { ImpureCapabilityDecl } from "./codegen_provider_dart.js";
+// Canonical law is emitted as typed USDA. The retired canonical-JSON manifest helper has
+// been removed from both this barrel and the package exports.
 export { encodeKernelSchema, executeDirectiveToIntent, encodeRefMode, intentIdFromHlc } from "./wire_encode.js";
 export type {
   WireEvent,