@githolon/dsl 0.102.5 → 0.103.0

package/src/read_projection_namespace.ts

@@ -70,8 +70,8 @@ export const GLOBAL_READ_PROJECTION_AGGREGATE_IDS: ReadonlySet<string> = new Set
   // disclosure
   "Disclosure",
   // domain lifecycle (the law records themselves)
-  "PolicyBundle",
   "DomainInstallation",
+  "nomos_internal_CorrectionRecord_a91e73",
   "nomos_internal_ReleaseReceipt_6f0d3a",
   // encryption identity + scope (the operator-blind key machinery)
   "EncKey",

package/src/runtime_zod.ts

@@ -0,0 +1,44 @@
+// Runtime-only Zod surface for compiled intent plans.
+//
+// The public DSL deliberately exposes Zod's full `z` namespace for authoring and type inference.
+// Bundling that namespace, however, marks every Zod export live: all locales plus JSON-schema
+// import/export machinery enter every exact plan. The plan slicer rewrites only the runtime `z`
+// binding to this curated value; tenant source and TypeScript types continue to use the public API.
+
+import {
+  ZodIssueCode,
+  array,
+  boolean,
+  discriminatedUnion,
+  enum as zEnum,
+  lazy,
+  literal,
+  null as zNull,
+  number,
+  object,
+  record,
+  string,
+  toJSONSchema,
+  union,
+  unknown,
+  url,
+} from "zod/v4";
+
+export const z = Object.freeze({
+  ZodIssueCode,
+  array,
+  boolean,
+  discriminatedUnion,
+  enum: zEnum,
+  lazy,
+  literal,
+  null: zNull,
+  number,
+  object,
+  record,
+  string,
+  toJSONSchema,
+  union,
+  unknown,
+  url,
+});

package/src/secondary_ensure.ts

@@ -4,7 +4,7 @@
 // QuickJS engine}.  If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
 /**
- * SECONDARY-CREATE AUTO-DECLARE (the co2-dev id-mint-gate DX).
+ * SECONDARY-OUTPUT EFFECT CHECK + ENSURE SANCTION (the co2-dev id-mint-gate DX).
  *
  * A directive carries ONE referential marker for its PRIMARY aggregate (`.creates(A)` /
  * `.ensures(A)` / …). But a plan may ALSO introduce a SECOND aggregate at a caller-chosen
@@ -16,29 +16,77 @@
  * (an unsanctioned dev-chosen id can't be forged) but an opaque footgun for the author.
  *
  * This module closes the footgun WITHOUT weakening the gate: `composeDomainModule` PLAN-PROBES each
- * directive (the same probe machinery `codegen_proof.ts` uses), discovers the secondary types its
- * plan ensures, and — for any type NO directive in the domain already declares `.ensures()` for —
- * injects a NO-OP sanctioning `.ensures(Type)` directive (a {@link sanctioningEnsureDirective},
- * modelled on `nomosBirthRecordEnsure`). The manifest/USD then carries the `Ensure → Type`
- * declaration the id-mint gate reads, so the deterministic id is admitted. The synthesized directive
- * is DELIBERATELY USELESS TO DISPATCH (its plan writes nothing); its only load-bearing property is
- * its manifest presence.
+ * directive (the same probe machinery `codegen_proof.ts` uses) and first refuses any observed marked
+ * output absent from that directive's typed effect signature. An author must explicitly declare a
+ * secondary output with `.alsoEnsures(Type)` (or its marker-specific sibling). For a DECLARED secondary
+ * Ensure whose type has no primary Ensure declaration, it then injects a NO-OP sanctioning
+ * `.ensures(Type)` directive (a {@link sanctioningEnsureDirective}, modelled on
+ * `nomosBirthRecordEnsure`). The manifest/USD carries both the honest per-plan effect and the legacy
+ * id-mint sanction. The synthesized directive is deliberately useless to dispatch.
  *
  * ERA-SAFE: a domain whose plans do NO secondary ensures is returned untouched (byte-identical). A
  * domain that DOES gains the sanction — and such a domain could not have deployed before this without
  * the author hand-writing the declaration, so no already-shippable manifest hash silently drifts.
  *
- * BEST-EFFORT (graceful degradation): the probe runs each plan ONCE under a synthesized payload. A
- * plan that ensures CONDITIONALLY on a payload shape the synthesis didn't hit (or that can't be
- * probed) simply gets no auto-sanction — and the runtime id-mint gate refuses the ensure exactly as
- * before (no regression, no forged-id hole). Auto-declare only ever ADDS a sanction the author's own
- * plan already proves it intends; it never blocks a valid deploy.
+ * PROBE BOUNDARY: the probe runs each plan once under a synthesized lawful payload. Every observed
+ * mismatch is a compile error. A conditional branch not exercised by that sample still requires a
+ * future static effect analysis to prove exhaustively; the runtime id-mint gate remains fail-closed.
  */
 import { z } from "zod";
 import { directive } from "./directive.js";
 import type { Directive } from "./directive.js";
 import type { AggregateHandle } from "./aggregate.js";
-import { probeEnsuredTypes } from "./codegen_proof.js";
+import { probeEnsuredTypes, probePlanOps } from "./codegen_proof.js";
+
+const effectMethod = (marker: string): string => {
+  switch (marker) {
+    case "creates": return "alsoCreates";
+    case "ensures": return "alsoEnsures";
+    case "mutates": return "alsoMutates";
+    case "archives": return "alsoArchives";
+    default: return "alsoWrites";
+  }
+};
+
+/**
+ * Refuse a plan whose observable marked effects exceed its certified directive signature.
+ * TypeScript can prove that each individual field operation is lawful for its aggregate, but
+ * it cannot currently express "this function may write exactly these aggregate types". The
+ * compile probe closes that effect-system gap for every path it can execute: a secondary output
+ * must be named with `.alsoCreates/.alsoEnsures/.alsoMutates/.alsoArchives` on the directive that
+ * emits it. A domain-wide sanction is not a substitute for an honest per-plan signature.
+ */
+export function assertPlanEffectsDeclared(
+  directive: Directive<unknown>,
+  domain: string,
+): void {
+  if (directive.manifestOnly === true || directive.birthsChild === true) return;
+  const probed = probePlanOps(directive, `${domain}/${directive.id}`);
+  if (probed === undefined) return;
+
+  const declared = new Set<string>([`${directive.marker}:${directive.aggregateId}`]);
+  for (const output of directive.secondaryOutputs ?? []) {
+    declared.add(`${output.marker}:${output.aggregateId}`);
+  }
+
+  for (const op of probed.ops) {
+    const marker = (op as { marker?: unknown }).marker;
+    const aggregateType = op.aggregateType;
+    if (typeof marker !== "string" || typeof aggregateType !== "string") continue;
+    if (declared.has(`${marker}:${aggregateType}`)) continue;
+    const method = effectMethod(marker);
+    const markerLabel = marker === "creates" ? "Create"
+      : marker === "ensures" ? "Ensure"
+        : marker === "mutates" ? "Mutate"
+          : marker === "archives" ? "Archive"
+            : marker;
+    throw new Error(
+      `[effect signature] ${domain}/${directive.id}: the plan emits ${markerLabel} -> ${aggregateType}, ` +
+        `but that output is absent from the directive's typed law. Declare ` +
+        `.${method}(${aggregateType}) on this directive.`,
+    );
+  }
+}
 
 /** The synthesized directive id sanctioning `Ensure → <aggId>`. Derived purely from the aggregate id
  *  so recompiles are stable; non-id chars are flattened so the id stays route-safe. */
@@ -61,6 +109,10 @@ export function sanctioningEnsureDirective(agg: AggregateHandle): Directive<unkn
   // tenant action and must not appear in generated clients, applications, or
   // OpenAPI, irrespective of whether the aggregate itself is framework-owned.
   (dir as { businessBirthInternal?: true }).businessBirthInternal = true;
+  // This no-op is a certified manifest statement, not an action. Keeping that
+  // distinction explicit prevents the plan router from advertising a runtime
+  // selector that no source module can register.
+  (dir as { manifestOnly?: true }).manifestOnly = true;
   // FRAMEWORK-SHARED DEDUP (Dart codegen): when the sanctioned aggregate is a FRAMEWORK singleton
   // (e.g. RelationTuple — auto-ensured into EVERY relation-using domain), this directive is injected
   // per-domain but its payload class (`NomosEnsure_<Agg>Payload`, zero-field) is byte-identical across
@@ -86,6 +138,7 @@ export function discoverUnsanctionedEnsures(
   directives: readonly Directive<unknown>[],
   domain: string,
 ): string[] {
+  for (const directive of directives) assertPlanEffectsDeclared(directive, domain);
   // Types some directive already DECLARES as its primary `.ensures(...)` target — already sanctioned.
   const declared = new Set<string>();
   for (const d of directives) {

package/src/shape_compat.ts

@@ -126,7 +126,7 @@ function payloadFieldKind(spec: PayloadFieldSpec): string {
       return "json";
     case "wrapped":
       // typed-id (string wire) or unit (number wire) — the interface sees the WIRE kind.
-      return spec.dartType.endsWith("Id") ? "string" : "double";
+      return spec.wrappedScalarKind === "string" ? "string" : "double";
     case "ref":
       // NomosRef<T> is aggregate-typed in the client and remains a string id on the wire.
       return "string";

package/src/stable_id_identity_bridge.ts

@@ -0,0 +1,149 @@
+import {
+  LAW_FRAMEWORK_PARENT,
+  createLawIdentityReconciler,
+  type LawIdentityRegistry,
+} from "./law_identity.js";
+import type { InferredRename } from "./stable_ids.js";
+import type { StableAggregateId, StableFieldId, StableIds } from "./stable_ids_types.js";
+
+export interface StableIdentityAggregateInput {
+  readonly id: string;
+  readonly fields: readonly string[];
+  readonly global?: boolean;
+}
+
+/**
+ * Compatibility bridge for W4.1. The existing shape-aware continuity pass proposes
+ * carries; the generalized registry owns the final SIDs and durable tombstones. Later
+ * W4 work replaces those proposals with typed-graph/previous-USDA evidence.
+ */
+export function reconcileStableIdsWithIdentity(
+  source: LawIdentityRegistry,
+  domainName: string,
+  currentAggregates: readonly StableIdentityAggregateInput[],
+  proposed: StableIds,
+  inferred: readonly InferredRename[],
+): { registry: LawIdentityRegistry; continuity: StableIds } {
+  const identities = createLawIdentityReconciler(source);
+  let result = identities.reconcile({
+    kind: "domain",
+    labels: [domainName],
+    preferredSids: { [domainName]: proposed.domain },
+    // One config is only a slice of the project-wide domain namespace.
+    retireAbsent: false,
+  });
+  let registry = result.registry;
+  const domainKey = result.resolved[domainName]!;
+  const aggregateKeys: Record<string, string> = {};
+
+  const local = currentAggregates.filter((aggregate) => aggregate.global !== true);
+  const localResult = identities.reconcile({
+    kind: "aggregate",
+    parent: domainKey,
+    labels: local.map((aggregate) => aggregate.id),
+    carries: aggregateCarries(inferred, new Set(local.map((aggregate) => aggregate.id))),
+    preferredSids: preferredAggregateSids(local, proposed),
+  });
+  registry = localResult.registry;
+  Object.assign(aggregateKeys, localResult.resolved);
+
+  const framework = currentAggregates.filter((aggregate) => aggregate.global === true);
+  if (framework.length > 0) {
+    const frameworkResult = identities.reconcile({
+      kind: "aggregate",
+      parent: LAW_FRAMEWORK_PARENT,
+      labels: framework.map((aggregate) => aggregate.id),
+      preferredSids: preferredAggregateSids(framework, proposed),
+      // Framework declarations are shared by independently compiled packages.
+      retireAbsent: false,
+    });
+    registry = frameworkResult.registry;
+    Object.assign(aggregateKeys, frameworkResult.resolved);
+  }
+
+  const aggregateInputs = new Map(currentAggregates.map((aggregate) => [aggregate.id, aggregate]));
+  const aggregates: Record<string, StableAggregateId> = {};
+  for (const aggregateName of Object.keys(proposed.aggregates).sort(compareText)) {
+    const proposedAggregate = proposed.aggregates[aggregateName]!;
+    const aggregateInput = aggregateInputs.get(aggregateName);
+    if (aggregateInput === undefined) {
+      throw new Error(`NMS-ID-006 proposed aggregate '${aggregateName}' was not discovered`);
+    }
+    const aggregateKey = aggregateKeys[aggregateName];
+    if (aggregateKey === undefined) {
+      throw new Error(`NMS-ID-006 aggregate '${aggregateName}' has no reconciled identity`);
+    }
+    const fieldResult = identities.reconcile({
+      kind: "field",
+      parent: aggregateKey,
+      labels: aggregateInput.fields,
+      carries: fieldCarries(inferred, aggregateName),
+      preferredSids: Object.fromEntries(
+        Object.entries(proposedAggregate.fields).map(([label, field]) => [label, field.sid]),
+      ),
+    });
+    registry = fieldResult.registry;
+
+    const fields: Record<string, StableFieldId> = {};
+    for (const [fieldName, proposedField] of Object.entries(proposedAggregate.fields).sort(
+      ([a], [b]) => compareText(a, b),
+    )) {
+      const key = fieldResult.resolved[fieldName];
+      if (key === undefined) throw new Error(`NMS-ID-006 field '${aggregateName}.${fieldName}' has no identity`);
+      const identity = registry.entities[key]!;
+      fields[fieldName] = {
+        ...proposedField,
+        sid: identity.sid,
+        ...(identity.priorLabels === undefined ? {} : { was: [...identity.priorLabels] }),
+      };
+    }
+    const identity = registry.entities[aggregateKey]!;
+    aggregates[aggregateName] = {
+      sid: identity.sid,
+      ...(identity.priorLabels === undefined ? {} : { was: [...identity.priorLabels] }),
+      fields,
+    };
+  }
+
+  const finalRegistry = identities.finish();
+  return {
+    registry: finalRegistry,
+    continuity: {
+      v: 1,
+      domain: finalRegistry.entities[domainKey]!.sid,
+      aggregates,
+    },
+  };
+}
+
+function aggregateCarries(
+  inferred: readonly InferredRename[],
+  currentLocalLabels: ReadonlySet<string>,
+): { from: string; to: string }[] {
+  return inferred
+    .filter((rename) => !rename.what.includes(".") && currentLocalLabels.has(rename.to))
+    .map(({ from, to }) => ({ from, to }));
+}
+
+function fieldCarries(
+  inferred: readonly InferredRename[],
+  aggregateName: string,
+): { from: string; to: string }[] {
+  const prefix = `${aggregateName}.`;
+  return inferred
+    .filter((rename) => rename.what.startsWith(prefix))
+    .map(({ from, to }) => ({ from, to }));
+}
+
+function preferredAggregateSids(
+  aggregates: readonly StableIdentityAggregateInput[],
+  proposed: StableIds,
+): Record<string, string> {
+  return Object.fromEntries(
+    aggregates.map((aggregate) => [aggregate.id, proposed.aggregates[aggregate.id]!.sid]),
+  );
+}
+
+function compareText(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}

package/src/stable_id_lockfile.ts

@@ -1,5 +1,14 @@
 import type { StableAggregateId, StableFieldId, StableIds } from "./stable_ids_types.js";
 import type { WireSchema } from "./wire.js";
+import { mintGlobalAggregateSid } from "./stable_ids.js";
+import {
+  LAW_FRAMEWORK_PARENT,
+  emptyLawIdentityRegistry,
+  lawEntityKey,
+  validateLawIdentityRegistry,
+  type LawIdentityEntity,
+  type LawIdentityRegistry,
+} from "./law_identity.js";
 
 export interface StableIdLockDomain {
   stableIds: StableIds;
@@ -10,6 +19,8 @@ export interface StableIdLockDomain {
 export interface StableIdLockfile {
   v: 1;
   domains: Record<string, StableIdLockDomain>;
+  /** W4 compiler identity custody. Semantics remain exclusively in USDA. */
+  identity?: LawIdentityRegistry;
 }
 
 type CompactStableFieldId = Omit<StableFieldId, "contract" | "shape"> & {
@@ -31,6 +42,15 @@ interface CompactStableIdLockfile {
   domains: Record<string, { stableIds: CompactStableIds }>;
 }
 
+interface IdentityStableIdLockfile {
+  v: 3;
+  identity: LawIdentityRegistry;
+  /** Temporary W4 compatibility evidence; deleted once evolution traverses prior USDA. */
+  contracts: readonly (readonly [string, unknown])[];
+  /** Temporary aggregate/field compatibility view consumed by the v2 compiler path. */
+  domains: Record<string, { stableIds: CompactStableIds }>;
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -53,11 +73,22 @@ function sortedJson(value: unknown): unknown {
 export function parseStableIdLockfile(value: unknown): StableIdLockfile {
   if (!isRecord(value)) throw new Error("stable-id lock must be a JSON object");
   if (value.v === 1) return value as unknown as StableIdLockfile;
-  if (value.v !== 2 || !Array.isArray(value.contracts) || !isRecord(value.domains)) {
+  if (
+    (value.v !== 2 && value.v !== 3) ||
+    !Array.isArray(value.contracts) ||
+    !isRecord(value.domains)
+  ) {
     throw new Error("unsupported stable-id lock encoding");
   }
 
-  const compact = value as unknown as CompactStableIdLockfile;
+  let identity: LawIdentityRegistry | undefined;
+  if (value.v === 3) {
+    if (!isRecord(value.identity)) throw new Error("stable-id lock v3 identity is malformed");
+    identity = value.identity as unknown as LawIdentityRegistry;
+    validateLawIdentityRegistry(identity);
+  }
+
+  const compact = value as unknown as CompactStableIdLockfile | IdentityStableIdLockfile;
   const contracts = compact.contracts.map((entry, index) => {
     if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string") {
       throw new Error(`stable-id lock contract ${index} is malformed`);
@@ -98,7 +129,7 @@ export function parseStableIdLockfile(value: unknown): StableIdLockfile {
     };
   }
 
-  return { v: 1, domains };
+  return { v: 1, domains, ...(identity === undefined ? {} : { identity }) };
 }
 
 /**
@@ -107,6 +138,7 @@ export function parseStableIdLockfile(value: unknown): StableIdLockfile {
  * the contract table retains the full descriptor needed to prove safe widening.
  */
 export function serializeStableIdLockfile(lock: StableIdLockfile): string {
+  if (lock.identity !== undefined) validateLawIdentityRegistry(lock.identity);
   const contracts: [string, unknown][] = [];
   const contractIndexes = new Map<string, number>();
   const domains: CompactStableIdLockfile["domains"] = {};
@@ -138,7 +170,109 @@ export function serializeStableIdLockfile(lock: StableIdLockfile): string {
 
   // This is a machine-owned lockfile. Compact JSON is intentional: unlike generated
   // law and clients, it must be committed so identity survives a clean clone.
-  return JSON.stringify(
-    sortedJson({ v: 2, contracts, domains } satisfies CompactStableIdLockfile),
-  ) + "\n";
+  const encoded =
+    lock.identity === undefined
+      ? ({ v: 2, contracts, domains } satisfies CompactStableIdLockfile)
+      : ({ v: 3, identity: lock.identity, contracts, domains } satisfies IdentityStableIdLockfile);
+  return JSON.stringify(sortedJson(encoded)) + "\n";
+}
+
+/**
+ * One-time W4 import of the existing domain/aggregate/field SIDs. The legacy view has
+ * already forgotten removals, so only currently present entities can be imported;
+ * from this point onward the returned registry retains every retirement.
+ */
+export function identityRegistryFromStableIdLockfile(
+  lock: StableIdLockfile | undefined,
+): LawIdentityRegistry {
+  if (lock?.identity !== undefined) {
+    validateLawIdentityRegistry(lock.identity);
+    return lock.identity;
+  }
+  if (lock === undefined) return emptyLawIdentityRegistry();
+
+  const entities: Record<string, LawIdentityEntity> = {};
+  const aggregateOccurrences = new Map<string, number>();
+  for (const domain of Object.values(lock.domains)) {
+    for (const aggregate of Object.values(domain.stableIds.aggregates)) {
+      aggregateOccurrences.set(aggregate.sid, (aggregateOccurrences.get(aggregate.sid) ?? 0) + 1);
+    }
+  }
+
+  for (const [domainName, domain] of Object.entries(lock.domains).sort(([a], [b]) =>
+    compareText(a, b),
+  )) {
+    const domainKey = importIdentityEntity(entities, {
+      kind: "domain",
+      sid: domain.stableIds.domain,
+      label: domainName,
+      generation: 0,
+      status: "active",
+    });
+    for (const [aggregateName, aggregate] of Object.entries(domain.stableIds.aggregates).sort(
+      ([a], [b]) => compareText(a, b),
+    )) {
+      const parent =
+        (aggregateOccurrences.get(aggregate.sid) ?? 0) > 1 ||
+        aggregate.sid === mintGlobalAggregateSid(aggregateName)
+          ? LAW_FRAMEWORK_PARENT
+          : domainKey;
+      const aggregateKey = importIdentityEntity(entities, {
+        kind: "aggregate",
+        sid: aggregate.sid,
+        parent,
+        label: aggregateName,
+        ...(aggregate.was === undefined ? {} : { priorLabels: aggregate.was }),
+        generation: 0,
+        status: "active",
+      });
+      for (const [fieldName, field] of Object.entries(aggregate.fields).sort(([a], [b]) =>
+        compareText(a, b),
+      )) {
+        importIdentityEntity(entities, {
+          kind: "field",
+          sid: field.sid,
+          parent: aggregateKey,
+          label: fieldName,
+          ...(field.was === undefined ? {} : { priorLabels: field.was }),
+          generation: 0,
+          status: "active",
+        });
+      }
+    }
+  }
+
+  const registry: LawIdentityRegistry = {
+    v: 1,
+    entities: Object.fromEntries(Object.entries(entities).sort(([a], [b]) => compareText(a, b))),
+  };
+  validateLawIdentityRegistry(registry);
+  return registry;
+}
+
+function importIdentityEntity(
+  entities: Record<string, LawIdentityEntity>,
+  entity: LawIdentityEntity,
+): string {
+  const key = lawEntityKey(entity.kind, entity.sid);
+  const prior = entities[key];
+  if (prior === undefined) {
+    entities[key] = entity;
+    return key;
+  }
+  if (
+    prior.kind !== entity.kind ||
+    prior.parent !== entity.parent ||
+    prior.label !== entity.label ||
+    JSON.stringify(prior.priorLabels ?? []) !== JSON.stringify(entity.priorLabels ?? [])
+  ) {
+    throw new Error(
+      `NMS-ID-002 legacy SID ${key} aliases incompatible ${prior.kind} '${prior.label}' and ${entity.kind} '${entity.label}'`,
+    );
+  }
+  return key;
+}
+
+function compareText(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
 }

package/src/stable_ids.ts

@@ -46,7 +46,7 @@
  * projection reads it to fold old-era field/type labels into the current ones.
  *
  * BUILD-TIME ONLY (imports `node:crypto`): reached via `@githolon/dsl/stable-ids` /
- * `@githolon/dsl/manifest`, never the runtime barrel. The pure TYPE surface lives in
+ * `stable_ids_for_module.ts`, never the runtime barrel. The pure TYPE surface lives in
  * `stable_ids_types.ts` so the runtime type graph stays node-free.
  */
 import { createHash } from "node:crypto";