@githolon/dsl 0.102.5 → 0.103.1

package/src/package_source_imports.ts

@@ -0,0 +1,71 @@
+// NOMOS — tenant law imports package contracts, never another package's private filesystem.
+
+import { readFileSync } from "node:fs";
+import ts from "typescript";
+
+export interface PrivatePackageImportViolation {
+  readonly file: string;
+  readonly line: number;
+  readonly column: number;
+  readonly specifier: string;
+}
+
+function privatePackageSpecifier(specifier: string): boolean {
+  const normalized = specifier.replaceAll("\\", "/");
+  return normalized.split("/").includes("node_modules")
+    || normalized.startsWith("@githolon/dsl/src/")
+    || normalized.startsWith("@githolon/dsl/runtime/");
+}
+
+/** Find imports which bypass a dependency's public package exports. */
+export function privatePackageImportViolations(
+  file: string,
+  source = readFileSync(file, "utf8"),
+): readonly PrivatePackageImportViolation[] {
+  const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
+  const violations: PrivatePackageImportViolation[] = [];
+  const record = (literal: ts.StringLiteralLike): void => {
+    if (!privatePackageSpecifier(literal.text)) return;
+    const position = sourceFile.getLineAndCharacterOfPosition(literal.getStart(sourceFile));
+    violations.push({
+      file,
+      line: position.line + 1,
+      column: position.character + 1,
+      specifier: literal.text,
+    });
+  };
+  const visit = (node: ts.Node): void => {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+      record(node.moduleSpecifier);
+    } else if (
+      ts.isExportDeclaration(node)
+      && node.moduleSpecifier !== undefined
+      && ts.isStringLiteralLike(node.moduleSpecifier)
+    ) {
+      record(node.moduleSpecifier);
+    } else if (
+      ts.isCallExpression(node)
+      && node.arguments.length === 1
+      && ts.isStringLiteralLike(node.arguments[0]!)
+      && (
+        node.expression.kind === ts.SyntaxKind.ImportKeyword
+        || (ts.isIdentifier(node.expression) && node.expression.text === "require")
+      )
+    ) {
+      record(node.arguments[0]!);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return violations;
+}
+
+export function assertPublicPackageImports(files: readonly string[]): void {
+  const violation = files.flatMap((file) => privatePackageImportViolations(file))[0];
+  if (violation === undefined) return;
+  throw new Error(
+    `${violation.file}:${violation.line}:${violation.column}: private package import `
+      + `'${violation.specifier}' bypasses the package contract; import the public package entrypoint `
+      + `or an exported subpath, and declare separately installed Nomos law in dependencies`,
+  );
+}

package/src/plan_source_slice.ts

@@ -0,0 +1,335 @@
+// Intent-addressed execution-plan slicing.
+//
+// TypeScript modules are the authoring surface, not the runtime unit. A large domain file may export
+// hundreds of independent offers; requiring that whole module in QuickJS makes the first small offer
+// initialize every unrelated schema and plan. This compiler pass follows TypeScript symbols from the
+// selected exports and presents esbuild with only their transitive package-local declarations.
+
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import type { Plugin } from "esbuild";
+
+export interface PlanSourceSliceTarget {
+  readonly modulePath: string;
+  readonly exportName: string;
+}
+
+const normalized = (file: string): string => {
+  const absolute = path.resolve(file);
+  return existsSync(absolute) ? realpathSync.native(absolute) : absolute;
+};
+
+const bindingIdentifiers = (name: ts.BindingName): ts.Identifier[] => {
+  if (ts.isIdentifier(name)) return [name];
+  return name.elements.flatMap((element) =>
+    ts.isOmittedExpression(element) ? [] : bindingIdentifiers(element.name));
+};
+
+export class PlanSourceSliceProgram {
+  readonly #program: ts.Program;
+  readonly #checker: ts.TypeChecker;
+  readonly #sliceRoots: readonly string[];
+
+  constructor(rootNames: readonly string[], sliceRoots: string | readonly string[]) {
+    const roots = typeof sliceRoots === "string" ? [sliceRoots] : sliceRoots;
+    this.#sliceRoots = roots.map((root) => normalized(root) + path.sep);
+    const configRoot = roots[0] ?? process.cwd();
+    const configPath = ts.findConfigFile(configRoot, existsSync, "tsconfig.json");
+    let options: ts.CompilerOptions = {
+      target: ts.ScriptTarget.ES2022,
+      module: ts.ModuleKind.ESNext,
+      moduleResolution: ts.ModuleResolutionKind.Bundler,
+      allowImportingTsExtensions: true,
+      skipLibCheck: true,
+    };
+    if (configPath !== undefined) {
+      const loaded = ts.readConfigFile(configPath, (file) => readFileSync(file, "utf8"));
+      if (loaded.error === undefined) {
+        options = {
+          ...ts.parseJsonConfigFileContent(loaded.config, ts.sys, path.dirname(configPath)).options,
+          noEmit: true,
+          allowImportingTsExtensions: true,
+        };
+      }
+    }
+    this.#program = ts.createProgram({ rootNames: rootNames.map(normalized), options });
+    this.#checker = this.#program.getTypeChecker();
+  }
+
+  exportPosition(target: PlanSourceSliceTarget): number | undefined {
+    const source = this.#program.getSourceFile(normalized(target.modulePath));
+    const module = source === undefined ? undefined : this.#checker.getSymbolAtLocation(source);
+    const symbol = module === undefined
+      ? undefined
+      : this.#checker.getExportsOfModule(module).find((candidate) => candidate.name === target.exportName);
+    const declaration = symbol?.declarations?.find((candidate) => candidate.getSourceFile() === source);
+    return declaration?.getStart(source);
+  }
+
+  /**
+   * Named runtime imports used by the authored program. The compiler uses this to construct the
+   * authenticated `require()` namespace from the exports plans can actually address, rather than
+   * evaluating every build-time export of a package in every QuickJS sandbox.
+   *
+   * `null` means the source used a namespace/default/side-effect import and therefore requires the
+   * complete module namespace. An absent module was not imported by the program at all.
+   */
+  externalRuntimeImports(
+    moduleIds: readonly string[],
+  ): ReadonlyMap<string, readonly string[] | null> {
+    const wanted = new Set(moduleIds);
+    const imports = new Map<string, Set<string> | null>();
+    const requireWholeModule = (id: string): void => {
+      imports.set(id, null);
+    };
+    const addNamed = (id: string, name: string): void => {
+      if (imports.get(id) === null) return;
+      const names = imports.get(id) ?? new Set<string>();
+      names.add(name);
+      imports.set(id, names);
+    };
+    for (const source of this.#program.getSourceFiles()) {
+      if (source.isDeclarationFile) continue;
+      for (const statement of source.statements) {
+        if (ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier)) {
+          const id = statement.moduleSpecifier.text;
+          if (!wanted.has(id)) continue;
+          const clause = statement.importClause;
+          if (clause === undefined) {
+            requireWholeModule(id);
+            continue;
+          }
+          if (clause.isTypeOnly) continue;
+          if (clause.name !== undefined) requireWholeModule(id);
+          const bindings = clause.namedBindings;
+          if (bindings === undefined) continue;
+          if (ts.isNamespaceImport(bindings)) {
+            requireWholeModule(id);
+            continue;
+          }
+          for (const element of bindings.elements) {
+            if (!element.isTypeOnly) addNamed(id, (element.propertyName ?? element.name).text);
+          }
+          continue;
+        }
+        if (
+          ts.isExportDeclaration(statement) && statement.moduleSpecifier !== undefined &&
+          ts.isStringLiteral(statement.moduleSpecifier)
+        ) {
+          const id = statement.moduleSpecifier.text;
+          if (!wanted.has(id) || statement.isTypeOnly) continue;
+          if (statement.exportClause === undefined || !ts.isNamedExports(statement.exportClause)) {
+            requireWholeModule(id);
+            continue;
+          }
+          for (const element of statement.exportClause.elements) {
+            if (!element.isTypeOnly) addNamed(id, (element.propertyName ?? element.name).text);
+          }
+        }
+      }
+    }
+    return new Map(
+      [...imports].map(([id, names]) => [
+        id,
+        names === null ? null : [...names].sort(),
+      ]),
+    );
+  }
+
+  plugin(targets: readonly PlanSourceSliceTarget[]): Plugin {
+    const retainedSymbols = new Set<ts.Symbol>();
+    const retainedDeclarations = new Set<ts.Declaration>();
+    const explicitTargetFiles = new Set(targets.map((target) => normalized(target.modulePath)));
+    const explicitTargetExports = new Map<string, Set<string>>();
+    for (const target of targets) {
+      const file = normalized(target.modulePath);
+      const names = explicitTargetExports.get(file) ?? new Set<string>();
+      names.add(target.exportName);
+      explicitTargetExports.set(file, names);
+    }
+    const insideSlice = (declaration: ts.Declaration): boolean => {
+      const file = normalized(declaration.getSourceFile().fileName);
+      return (explicitTargetFiles.has(file) || this.#sliceRoots.some((root) => file.startsWith(root))) &&
+        !file.includes(`${path.sep}node_modules${path.sep}`);
+    };
+    const markSymbol = (symbol: ts.Symbol | undefined): void => {
+      if (symbol === undefined || retainedSymbols.has(symbol)) return;
+      retainedSymbols.add(symbol);
+      if ((symbol.flags & ts.SymbolFlags.Alias) !== 0) {
+        try {
+          markSymbol(this.#checker.getAliasedSymbol(symbol));
+        } catch {
+          // An unresolved external package cannot contribute package-local declarations.
+        }
+      }
+      for (const declaration of symbol.declarations ?? []) {
+        if (!insideSlice(declaration) || retainedDeclarations.has(declaration)) continue;
+        retainedDeclarations.add(declaration);
+        const visit = (node: ts.Node): void => {
+          // `export { importedName }` has three symbols: the export alias, the local
+          // import binding, and the declaration in the imported module. Following only
+          // the alias jumps straight to the remote declaration and can therefore prune
+          // the local import that the emitted re-export still needs.
+          if (ts.isExportSpecifier(node)) {
+            markSymbol(this.#checker.getExportSpecifierLocalTargetSymbol(node));
+          }
+          if (ts.isIdentifier(node)) markSymbol(this.#checker.getSymbolAtLocation(node));
+          ts.forEachChild(node, visit);
+        };
+        ts.forEachChild(declaration, visit);
+      }
+    };
+
+    for (const target of targets) {
+      const file = normalized(target.modulePath);
+      const source = this.#program.getSourceFile(file);
+      const module = source === undefined ? undefined : this.#checker.getSymbolAtLocation(source);
+      const symbol = module === undefined
+        ? undefined
+        : this.#checker.getExportsOfModule(module).find((candidate) => candidate.name === target.exportName);
+      if (symbol === undefined) {
+        throw new Error(`cannot slice missing export '${target.exportName}' from ${target.modulePath}`);
+      }
+      markSymbol(symbol);
+      // TypeScript's module export symbol can point at the import alias rather than
+      // the authored `export { name }` specifier. Anchor both sides explicitly so
+      // the slicer retains the local binding as well as the public export.
+      for (const statement of source?.statements ?? []) {
+        if (!ts.isExportDeclaration(statement) ||
+          statement.exportClause === undefined ||
+          !ts.isNamedExports(statement.exportClause)) continue;
+        for (const element of statement.exportClause.elements) {
+          if (element.name.text === target.exportName) {
+            retainedDeclarations.add(element);
+            markSymbol(this.#checker.getExportSpecifierLocalTargetSymbol(element));
+          }
+        }
+      }
+    }
+
+    const hasRetainedSymbol = (symbol: ts.Symbol | undefined): boolean =>
+      symbol !== undefined && retainedSymbols.has(symbol);
+    const declarationIsRetained = (declaration: ts.Declaration): boolean => {
+      if (retainedDeclarations.has(declaration)) return true;
+      const name = (declaration as ts.NamedDeclaration).name;
+      if (name === undefined || !ts.isIdentifier(name)) return false;
+      return hasRetainedSymbol(this.#checker.getSymbolAtLocation(name));
+    };
+    const importBindingRetained = (identifier: ts.Identifier): boolean =>
+      hasRetainedSymbol(this.#checker.getSymbolAtLocation(identifier));
+
+    const sliceSource = (file: string): string | undefined => {
+      const absolute = normalized(file);
+      if (
+        (!explicitTargetFiles.has(absolute) && !this.#sliceRoots.some((root) => absolute.startsWith(root))) ||
+        absolute.includes(`${path.sep}node_modules${path.sep}`)
+      ) {
+        return undefined;
+      }
+      const source = this.#program.getSourceFile(absolute);
+      if (source === undefined || source.isDeclarationFile) return undefined;
+      const statements: ts.Statement[] = [];
+      for (const statement of source.statements) {
+        if (ts.isImportDeclaration(statement)) {
+          const clause = statement.importClause;
+          // Explicit side-effect imports retain their authored semantics.
+          if (clause === undefined) {
+            statements.push(statement);
+            continue;
+          }
+          const defaultImport = clause.name !== undefined && importBindingRetained(clause.name)
+            ? clause.name
+            : undefined;
+          let bindings: ts.NamedImportBindings | undefined;
+          if (clause.namedBindings !== undefined && ts.isNamespaceImport(clause.namedBindings)) {
+            if (importBindingRetained(clause.namedBindings.name)) bindings = clause.namedBindings;
+          } else if (clause.namedBindings !== undefined) {
+            const elements = clause.namedBindings.elements.filter((element) => importBindingRetained(element.name));
+            if (elements.length > 0) bindings = ts.factory.updateNamedImports(clause.namedBindings, elements);
+          }
+          if (defaultImport !== undefined || bindings !== undefined) {
+            statements.push(ts.factory.updateImportDeclaration(
+              statement,
+              statement.modifiers,
+              ts.factory.updateImportClause(clause, clause.isTypeOnly, defaultImport, bindings),
+              statement.moduleSpecifier,
+              statement.attributes,
+            ));
+          }
+          continue;
+        }
+        if (ts.isVariableStatement(statement)) {
+          const declarations = statement.declarationList.declarations.filter((declaration) =>
+            retainedDeclarations.has(declaration) ||
+            bindingIdentifiers(declaration.name).some((identifier) =>
+              hasRetainedSymbol(this.#checker.getSymbolAtLocation(identifier))));
+          if (declarations.length > 0) {
+            statements.push(ts.factory.updateVariableStatement(
+              statement,
+              statement.modifiers,
+              ts.factory.updateVariableDeclarationList(statement.declarationList, declarations),
+            ));
+          }
+          continue;
+        }
+        if (
+          ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) ||
+          ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement) ||
+          ts.isEnumDeclaration(statement) || ts.isModuleDeclaration(statement)
+        ) {
+          if (declarationIsRetained(statement)) statements.push(statement);
+          continue;
+        }
+        if (ts.isExportDeclaration(statement)) {
+          if (statement.exportClause === undefined) {
+            statements.push(statement);
+          } else if (ts.isNamedExports(statement.exportClause)) {
+            const elements = statement.exportClause.elements.filter((element) => {
+              const exported = this.#checker.getSymbolAtLocation(element.name);
+              const local = this.#checker.getExportSpecifierLocalTargetSymbol(element);
+              return explicitTargetExports.get(absolute)?.has(element.name.text) === true ||
+                retainedDeclarations.has(element) ||
+                hasRetainedSymbol(exported) || hasRetainedSymbol(local);
+            });
+            if (elements.length > 0) {
+              statements.push(ts.factory.updateExportDeclaration(
+                statement,
+                statement.modifiers,
+                statement.isTypeOnly,
+                ts.factory.updateNamedExports(statement.exportClause, elements),
+                statement.moduleSpecifier,
+                statement.attributes,
+              ));
+            }
+          }
+          continue;
+        }
+        if (ts.isExportAssignment(statement)) {
+          const symbol = this.#checker.getSymbolAtLocation(statement.expression);
+          if (hasRetainedSymbol(symbol)) statements.push(statement);
+          continue;
+        }
+        // A domain module should be declarative, but an explicit top-level statement is authored
+        // initialization and cannot be discarded merely for performance.
+        if (ts.isExpressionStatement(statement)) statements.push(statement);
+      }
+      return ts.createPrinter().printFile(ts.factory.updateSourceFile(source, statements));
+    };
+
+    return {
+      name: "nomos-intent-plan-slice",
+      setup(build) {
+        build.onLoad({ filter: /\.(?:[cm]?ts|tsx)$/ }, (args) => {
+          const contents = sliceSource(args.path);
+          if (contents === undefined) return undefined;
+          return {
+            contents,
+            loader: args.path.endsWith(".tsx") ? "tsx" : "ts",
+            resolveDir: path.dirname(args.path),
+          };
+        });
+      },
+    };
+  }
+}

package/src/point_guard.ts

@@ -0,0 +1,192 @@
+// NOMOS — typed point guards are canonical law, not tenant JavaScript.
+
+import type { AggregateHandle, FieldValue, StoredFields } from "./aggregate.js";
+import type { Field } from "./fields.js";
+
+export type PointGuardScalar = string | number | boolean;
+
+export interface PointGuardPathOperand {
+  readonly source: "row" | "payload";
+  readonly path: readonly string[];
+}
+
+export type PointGuardPredicate =
+  | { readonly kind: "exists" }
+  | { readonly kind: "absent" }
+  | { readonly kind: "present" | "missing"; readonly operand: PointGuardPathOperand }
+  | {
+      readonly kind: "compare";
+      readonly operator: "eq" | "ne";
+      readonly left: PointGuardPathOperand;
+      readonly right: PointGuardPathOperand | { readonly source: "literal"; readonly value: PointGuardScalar };
+    }
+  | { readonly kind: "all" | "any"; readonly terms: readonly PointGuardPredicate[] }
+  | { readonly kind: "not"; readonly term: PointGuardPredicate };
+
+/** The complete generic kernel-lowerable point guard carried by typed USDA. */
+export interface PointGuardSpec {
+  readonly aggregateId: string;
+  readonly binding: string;
+  readonly state: "pre" | "post";
+  readonly idPayloadPath: readonly string[];
+  readonly predicate: PointGuardPredicate;
+  readonly rejectCode: string;
+}
+
+export interface PointPath<T> extends PointGuardPathOperand {
+  field<K extends keyof NonNullable<T> & string>(key: K): PointPath<NonNullable<T>[K]>;
+}
+
+export interface PointRowPath<T> extends PointPath<T> {
+  field<K extends keyof NonNullable<T> & string>(key: K): PointRowPath<NonNullable<T>[K]>;
+  present(): PointGuardPredicate;
+  missing(): PointGuardPredicate;
+  eq(value: NonNullable<T> | PointPath<NonNullable<T>>): PointGuardPredicate;
+  ne(value: NonNullable<T> | PointPath<NonNullable<T>>): PointGuardPredicate;
+}
+
+export interface PointRow<F extends Record<string, Field>> {
+  exists(): PointGuardPredicate;
+  absent(): PointGuardPredicate;
+  field<K extends keyof StoredFields<F> & string>(key: K): PointRowPath<FieldValue<StoredFields<F>[K]>>;
+}
+
+export interface PointPayload<P> {
+  field<K extends keyof P & string>(key: K): PointPath<P[K]>;
+}
+
+export interface PointGuardContext<P, F extends Record<string, Field>> {
+  readonly row: PointRow<F>;
+  readonly intent: PointPayload<P>;
+  all(...terms: readonly PointGuardPredicate[]): PointGuardPredicate;
+  any(...terms: readonly PointGuardPredicate[]): PointGuardPredicate;
+  not(term: PointGuardPredicate): PointGuardPredicate;
+}
+
+export interface PointGuardDeclaration {
+  readonly id: PointPath<string>;
+  readonly holds: PointGuardPredicate;
+}
+
+function path<T>(source: "row" | "payload", parts: readonly string[]): PointPath<T> {
+  return {
+    source,
+    path: parts,
+    field(key) {
+      return path(source, [...parts, key]);
+    },
+  };
+}
+
+function rowPath<T>(parts: readonly string[]): PointRowPath<T> {
+  const base = path<T>("row", parts);
+  const compare = (
+    operator: "eq" | "ne",
+    value: NonNullable<T> | PointPath<NonNullable<T>>,
+  ): PointGuardPredicate => ({
+    kind: "compare",
+    operator,
+    left: base,
+    right: isPath(value)
+      ? value
+      : { source: "literal", value: scalar(value) },
+  });
+  return {
+    ...base,
+    field(key) {
+      return rowPath([...parts, key]);
+    },
+    eq(value) {
+      return compare("eq", value);
+    },
+    ne(value) {
+      return compare("ne", value);
+    },
+    present() {
+      return { kind: "present", operand: base };
+    },
+    missing() {
+      return { kind: "missing", operand: base };
+    },
+  };
+}
+
+function isPath(value: unknown): value is PointPath<unknown> {
+  return value !== null && typeof value === "object" &&
+    ((value as { source?: unknown }).source === "row" || (value as { source?: unknown }).source === "payload") &&
+    Array.isArray((value as { path?: unknown }).path);
+}
+
+function scalar(value: unknown): PointGuardScalar {
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isSafeInteger(value)) return value;
+  throw new Error("point precondition literals must be strings, booleans, or safe integers");
+}
+
+/** Build a typed point-guard AST by executing only this inert algebra builder. */
+export function buildPointGuard<P, F extends Record<string, Field>>(
+  aggregate: AggregateHandle<string, F>,
+  build: (ctx: PointGuardContext<P, F>) => PointGuardDeclaration,
+  rejectCode: string,
+): PointGuardSpec {
+  const declaration = build({
+    row: {
+      exists: () => ({ kind: "exists" }),
+      absent: () => ({ kind: "absent" }),
+      field: (key) => rowPath([key]),
+    },
+    intent: {
+      field: (key) => path("payload", [key]),
+    },
+    all: (...terms) => ({ kind: "all", terms }),
+    any: (...terms) => ({ kind: "any", terms }),
+    not: (term) => ({ kind: "not", term }),
+  });
+  if (declaration.id.source !== "payload" || declaration.id.path.length === 0) {
+    throw new Error("point precondition id must be a non-empty intent field path");
+  }
+  if (rejectCode.trim().length === 0) throw new Error("point precondition needs a non-empty reject code");
+  return {
+    aggregateId: aggregate.id,
+    binding: "target",
+    state: "pre",
+    idPayloadPath: declaration.id.path,
+    predicate: declaration.holds,
+    rejectCode,
+  };
+}
+
+function valueAt(value: unknown, parts: readonly string[]): unknown {
+  let current = value;
+  for (const part of parts) {
+    if (current === null || typeof current !== "object") return undefined;
+    current = (current as Record<string, unknown>)[part];
+  }
+  return current;
+}
+
+/** TypeScript twin used only by compile-time probes and the engine fallback. */
+export function evaluatePointGuard(
+  predicate: PointGuardPredicate,
+  row: Record<string, unknown> | undefined,
+  payload: unknown,
+): boolean {
+  switch (predicate.kind) {
+    case "exists": return row !== undefined && Object.keys(row).length > 0;
+    case "absent": return row === undefined || Object.keys(row).length === 0;
+    case "present": return valueAt(predicate.operand.source === "row" ? row : payload, predicate.operand.path) !== undefined;
+    case "missing": return valueAt(predicate.operand.source === "row" ? row : payload, predicate.operand.path) === undefined;
+    case "all": return predicate.terms.every((term) => evaluatePointGuard(term, row, payload));
+    case "any": return predicate.terms.some((term) => evaluatePointGuard(term, row, payload));
+    case "not": return !evaluatePointGuard(predicate.term, row, payload);
+    case "compare": {
+      const left = valueAt(row, predicate.left.path);
+      const right = predicate.right.source === "literal"
+        ? predicate.right.value
+        : valueAt(predicate.right.source === "row" ? row : payload, predicate.right.path);
+      if (left === undefined || right === undefined) return predicate.operator === "ne";
+      const equal = JSON.stringify(left) === JSON.stringify(right);
+      return predicate.operator === "eq" ? equal : !equal;
+    }
+  }
+}

package/src/precondition.ts

@@ -32,10 +32,13 @@
  */
 import type { Directive, PreconditionDescriptor } from "./directive.js";
 import {
+  nativeReadBindings,
+  readSet,
   refAs,
   type InvariantRef,
   type WorkspaceInvariantDecl,
 } from "./framework/workspace_invariant.js";
+import { evaluatePointGuard } from "./point_guard.js";
 
 /** The stable ref binding name the synthesized invariant resolves the target under. */
 const REF_NAME = "target";
@@ -74,17 +77,40 @@ export function synthesizePreconditionInvariants<P>(directive: Directive<P>): Wo
     const ordinal = seen.get(key) ?? 0;
     seen.set(key, ordinal + 1);
     const id = preconditionInvariantId(directive.id, desc, ordinal);
+    const readId = desc.readId ?? (desc.idPayloadPath === undefined
+      ? undefined
+      : {
+          source: "payload" as const,
+          path: desc.idPayloadPath,
+          prefix: "",
+          suffix: "",
+          optional: false,
+        });
+    const nativeReads = readId === undefined
+      ? undefined
+      : readSet({
+          binding: REF_NAME,
+          aggregate: desc.aggregateId,
+          state: "pre",
+          id: readId,
+        });
     return {
       id,
       on: directive.id,
-      reads: (ctx: { intent: Record<string, unknown> }): InvariantRef[] => [
-        // Preconditions judge the state the directive is attempting to extend.
-        // The gate's reserved `pre:` namespace resolves the committed pre-apply
-        // aggregate; an ordinary ref would resolve the directive's trial result
-        // and therefore make every successful create appear to be a duplicate.
-        refAs(REF_NAME, desc.aggregateId, `pre:${desc.idField(ctx.intent)}`),
-      ],
-      assert: (snapshots: Record<string, Record<string, unknown>>) => {
+      // A payload-key/point precondition is a typed USDA point read and therefore never
+      // enters QuickJS merely to construct `{aggregate,id}`. Callback selectors remain
+      // executable only long enough for the compiler to name them as migration debt.
+      reads: nativeReads ?? ((ctx: { intent: Record<string, unknown> }): InvariantRef[] => [
+          // Preconditions judge the state the directive is attempting to extend.
+          // The gate's reserved `pre:` namespace resolves the committed pre-apply
+          // aggregate; an ordinary ref would resolve the directive's trial result
+          // and therefore make every successful create appear to be a duplicate.
+          refAs(REF_NAME, desc.aggregateId, `pre:${desc.idField(ctx.intent)}`),
+        ]),
+      ...(nativeReads === undefined
+        ? {}
+        : { __nomosReadBindings: nativeReadBindings(nativeReads)! }),
+      assert: (snapshots: Record<string, Record<string, unknown>>, ctx) => {
         // Hosts historically represented an unresolved ref either by omitting
         // the key or by returning an empty projection. Treat both identically;
         // an admitted aggregate has at least one folded field after its atomic
@@ -96,10 +122,19 @@ export function synthesizePreconditionInvariants<P>(directive: Directive<P>): Wo
             desc.fieldNames.some((field) => Object.hasOwn(projected, field))
           ? projected
           : undefined;
-        return desc.predicate(row) ? { accept: true } : { reject: desc.rejectCode };
+        const holds = desc.pointGuard === undefined
+          ? desc.predicate(row)
+          : evaluatePointGuard(desc.pointGuard.predicate, row, ctx?.intent);
+        return holds ? { accept: true } : { reject: desc.rejectCode };
       },
       ...(desc.declassify !== undefined ? { declassify: desc.declassify } : {}),
       __nomosGenerated: "directive-precondition" as const,
+      ...(desc.pointGuard === undefined
+        ? {}
+        : {
+            __nomosEvaluator: "point-guard-v1" as const,
+            __nomosPointGuard: desc.pointGuard,
+          }),
       __isWorkspaceInvariant: true as const,
     };
   });