@githolon/dsl 0.102.5 → 0.103.1

package/src/read_projection_composition.ts

@@ -1,117 +0,0 @@
-// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
-// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
-// wasm32-wasip1 artifact {kernel · SQLite projection · embedded QuickJS engine}.
-//
-// COMPILE-TIME DIVERGENCE GUARD for SHARED read-projection keys — the read-layer
-// sibling of `relation_composition.ts` (the scalpel).
-//
-// THE MODEL. The kernel's installed-read-manifest accumulator
-// (`wasm_git_holon.rs::ReadProjectionAccumulator`) UNIONS the CURRENT installed
-// `nomosReadProjection` fragments BY KEY — `aggregateFieldKinds` by aggregate TYPE,
-// `queries`/`counts`/`spatials`/`sums`/`mins`/`maxes`/`orderedReads` by declared `id`,
-// `deriveds`/`combineds` by `"<of>\0<id>"` — and (correctly, fail-closed) REFUSES a
-// CURRENT key declared twice with DIVERGENT shapes: "divergent read projection
-// declaration for key <k>". Superseded eras never feed the current read manifest.
-//
-// Read-projection NAMESPACING (`read_projection_namespace.ts`) makes a NON-GLOBAL
-// aggregate's keys domain-qualified, so tenant domains never share a key. What CAN
-// still share a key inside one package: GLOBAL framework aggregates declared by ≥2
-// domains (byte-identical by construction — same framework version — but a version
-// skew diverges), and same-named declared reads across domains. This guard turns the
-// current-runtime conflict into a precise COMPILE refusal: identical shared declarations
-// PASS (the kernel dedupes them), divergent ones REFUSE with the key and each domain's
-// shape. Validation only — a conflict-free package is returned untouched (era rule).
-
-import type { UsdLayer } from "./usd.js";
-import { domainOfLayerPath } from "./relation_composition.js";
-
-/** One shared-key divergence, gathered for the scalpel message. */
-interface ReadProjectionConflict {
-  /** The accumulator section (`aggregateFieldKinds`, `queries`, …). */
-  readonly section: string;
-  /** The colliding accumulator key (the kernel's exact key). */
-  readonly key: string;
-  /** Each contributing domain's declaration, in package (weak→strong) order. */
-  readonly opinions: { readonly domain: string; readonly shape: string }[];
-}
-
-function scalpelMessage(conflicts: readonly ReadProjectionConflict[]): string {
-  const lines: string[] = [
-    `Refusing to compose the package: shared read-projection key(s) carry DIVERGENT declarations ` +
-      `across domains — the current installed-read-manifest accumulator refuses exactly this at ` +
-      `SERVE time ("divergent read projection declaration for key …"). Superseded eras are ignored, ` +
-      `but genuinely current law must have one coherent read shape. Fail-closed compile refusal.`,
-    ``,
-  ];
-  for (const c of conflicts) {
-    lines.push(
-      `  read projection "${c.section}" key "${c.key.replace("\0", " · ")}" — ${c.opinions.length} divergent declarations:`,
-    );
-    const w = Math.max(...c.opinions.map((o) => o.domain.length));
-    for (const o of c.opinions) lines.push(`      · ${o.domain.padEnd(w)}  ${o.shape}`);
-  }
-  lines.push(
-    ``,
-    `Fix: give the shared key ONE canonical declaration (the domains must agree, byte-for-byte — ` +
-      `for a framework aggregate that means the SAME framework version in every domain), or make ` +
-      `the declarations DISTINCT (a non-global aggregate auto-qualifies by its owning domain; a ` +
-      `declared read can simply take a different id).`,
-  );
-  return lines.join("\n");
-}
-
-type Fragment = NonNullable<UsdLayer["nomosReadProjection"]>;
-
-/** The accumulator sections keyed by declared `id` (mirrors `merge_projection_array_by_id`). */
-const BY_ID_SECTIONS = ["queries", "counts", "spatials", "sums", "mins", "maxes", "orderedReads"] as const;
-/** The sections keyed by `"<of>\0<id>"` (mirrors `merge_projection_array_by_type_and_id`). */
-const BY_TYPE_AND_ID_SECTIONS = ["deriveds", "combineds"] as const;
-
-/**
- * Guard the package's layers against a shared-read-projection-key divergence — the EXACT key
- * semantics the kernel accumulator merges by. Identical shared declarations pass (dedupe);
- * divergent ones throw the scalpel. Deterministic (sorted keys/sections). Returns the layers
- * UNTOUCHED (validation only).
- *
- * @throws a scalpel `Error` naming the section, key, and each domain's declaration on divergence.
- */
-export function guardSharedReadProjectionKeys(layers: readonly UsdLayer[]): readonly UsdLayer[] {
-  // section → key → the contributing {domain, canonical JSON} opinions, in package order.
-  const seen = new Map<string, Map<string, { domain: string; shape: string }[]>>();
-  const note = (section: string, key: string, domain: string, value: unknown): void => {
-    const bySection = seen.get(section) ?? new Map<string, { domain: string; shape: string }[]>();
-    seen.set(section, bySection);
-    const arr = bySection.get(key) ?? [];
-    arr.push({ domain, shape: JSON.stringify(value) });
-    bySection.set(key, arr);
-  };
-
-  for (const layer of layers) {
-    const frag: Fragment | undefined = layer.nomosReadProjection;
-    if (frag === undefined) continue;
-    const domain = domainOfLayerPath(layer.path);
-    for (const [ty, schema] of Object.entries(frag.aggregateFieldKinds ?? {})) {
-      note("aggregateFieldKinds", ty, domain, schema);
-    }
-    const bag = frag as unknown as Record<string, readonly { id: string; of?: string }[] | undefined>;
-    for (const section of BY_ID_SECTIONS) {
-      for (const item of bag[section] ?? []) note(section, item.id, domain, item);
-    }
-    for (const section of BY_TYPE_AND_ID_SECTIONS) {
-      for (const item of bag[section] ?? []) note(section, `${item.of}\0${item.id}`, domain, item);
-    }
-  }
-
-  const conflicts: ReadProjectionConflict[] = [];
-  for (const section of [...seen.keys()].sort()) {
-    const bySection = seen.get(section)!;
-    for (const key of [...bySection.keys()].sort()) {
-      const opinions = bySection.get(key)!;
-      if (opinions.length < 2) continue;
-      const distinct = new Set(opinions.map((o) => o.shape));
-      if (distinct.size > 1) conflicts.push({ section, key, opinions });
-    }
-  }
-  if (conflicts.length > 0) throw new Error(scalpelMessage(conflicts));
-  return layers;
-}

package/src/read_projection_manifest.ts

@@ -1,115 +0,0 @@
-// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
-// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
-// wasm32-wasip1 artifact {kernel · SQLite projection · embedded QuickJS engine}.
-//
-// READ-PROJECTION NAMESPACING — the CANONICAL-MANIFEST label transform (the compile-side
-// rename). BUILD-TIME ONLY, split out of `read_projection_namespace.ts` deliberately: this
-// file types against `manifest.ts` (which imports `node:crypto`/`Buffer` for the domain
-// hash), and the classification/qualifier half is imported by PLATFORM-NEUTRAL engine
-// files (`engine_entry.ts`, `wire_encode.ts`, `framework/relations.ts`) that tenant
-// scaffolds typecheck WITHOUT `@types/node`. Keeping the manifest edge here (reached only
-// via `usd.ts`, the build lane) keeps the neutral type graph node-free — the same
-// build/runtime split `stable_ids.ts` vs `stable_ids_types.ts` ratified.
-
-import type { CanonicalManifest } from "./manifest.js";
-import type { StableIds, StableAggregateId } from "./stable_ids_types.js";
-import { qualifyReadProjectionType } from "./read_projection_namespace.js";
-
-/**
- * Qualify EVERY aggregate-type label a domain's canonical manifest carries — exactly as
- * if the author had renamed `Entry` → `<domainKey>__Entry` in source, which is the #58
- * rename the whole system already supports (sid identity unmoved; the projection folds
- * old-label rows onto the new label via the `was` lineage). Touches: aggregate ids,
- * directive targets, `queries[].returns`, every maintained read's `of` (counts / sums /
- * mins / maxes / spatials / deriveds / combineds / orderedReads), `combineds[].reads`
- * (a related aggregate TYPE — the cross-aggregate invalidation key), and the stable-ids
- * labels (the BARE name is APPENDED to the sid's `was` lineage so pre-namespacing rows
- * normalize onto the qualified label). Fields keep their bare labels (field names never
- * collide across types — the accumulator keys them under the type). Pure + deterministic;
- * with an empty `namespaced` set the manifest is returned UNTOUCHED (the era rule).
- */
-export function qualifyManifestAggregateLabels(
-  manifest: CanonicalManifest,
-  domainKey: string,
-  namespaced: ReadonlySet<string>,
-): CanonicalManifest {
-  if (namespaced.size === 0) return manifest;
-  const qa = (n: string): string => (namespaced.has(n) ? qualifyReadProjectionType(domainKey, n) : n);
-
-  const stableIds: StableIds | undefined =
-    manifest.stableIds === undefined
-      ? undefined
-      : {
-          ...manifest.stableIds,
-          aggregates: Object.fromEntries(
-            Object.entries(manifest.stableIds.aggregates).map(([name, rec]): [string, StableAggregateId] => {
-              if (!namespaced.has(name)) return [name, rec];
-              // The bare labels this sid's rows may carry: every prior bare label + the current
-              // bare name (pre-namespacing rows; the runtime stamp is qualified going forward).
-              const was = [...new Set([...(rec.was ?? []), name])];
-              return [qa(name), { ...rec, was }];
-            }),
-          ),
-        };
-
-  return {
-    ...manifest,
-    aggregates: manifest.aggregates.map((a) => (namespaced.has(a.id) ? { ...a, id: qa(a.id) } : a)),
-    // NB: `capturedReads[].returns` (the #58 read-gate spec the kernel derives against) MUST be
-    // qualified too — the projection stamps the QUALIFIED `__type` on every row, so a bare
-    // `returns` derives 0 rows at the one gate (the bug that broke captured_reads.test.mjs).
-    directives: manifest.directives.map((d) => ({
-      ...d,
-      ...(namespaced.has(d.target) ? { target: qa(d.target) } : {}),
-      ...(d.conflictResolution !== undefined && namespaced.has(d.conflictResolution.aggregate)
-        ? {
-            conflictResolution: {
-              ...d.conflictResolution,
-              aggregate: qa(d.conflictResolution.aggregate),
-            },
-          }
-        : {}),
-      ...(d.capturedReads !== undefined
-        ? {
-            capturedReads: d.capturedReads.map((r) =>
-              namespaced.has(r.returns) ? { ...r, returns: qa(r.returns) } : r,
-            ),
-          }
-        : {}),
-    })),
-    ...(stableIds !== undefined ? { stableIds } : {}),
-    ...(manifest.queries !== undefined
-      ? { queries: manifest.queries.map((q) => (namespaced.has(q.returns) ? { ...q, returns: qa(q.returns) } : q)) }
-      : {}),
-    ...(manifest.counts !== undefined
-      ? { counts: manifest.counts.map((c) => (namespaced.has(c.of) ? { ...c, of: qa(c.of) } : c)) }
-      : {}),
-    ...(manifest.sums !== undefined
-      ? { sums: manifest.sums.map((s) => (namespaced.has(s.of) ? { ...s, of: qa(s.of) } : s)) }
-      : {}),
-    ...(manifest.mins !== undefined
-      ? { mins: manifest.mins.map((e) => (namespaced.has(e.of) ? { ...e, of: qa(e.of) } : e)) }
-      : {}),
-    ...(manifest.maxes !== undefined
-      ? { maxes: manifest.maxes.map((e) => (namespaced.has(e.of) ? { ...e, of: qa(e.of) } : e)) }
-      : {}),
-    ...(manifest.spatials !== undefined
-      ? { spatials: manifest.spatials.map((s) => (namespaced.has(s.of) ? { ...s, of: qa(s.of) } : s)) }
-      : {}),
-    ...(manifest.deriveds !== undefined
-      ? { deriveds: manifest.deriveds.map((d) => (namespaced.has(d.of) ? { ...d, of: qa(d.of) } : d)) }
-      : {}),
-    ...(manifest.combineds !== undefined
-      ? {
-          combineds: manifest.combineds.map((c) => ({
-            ...c,
-            ...(namespaced.has(c.of) ? { of: qa(c.of) } : {}),
-            ...(namespaced.has(c.reads) ? { reads: qa(c.reads) } : {}),
-          })),
-        }
-      : {}),
-    ...(manifest.orderedReads !== undefined
-      ? { orderedReads: manifest.orderedReads.map((r) => (namespaced.has(r.of) ? { ...r, of: qa(r.of) } : r)) }
-      : {}),
-  };
-}

package/src/relation_composition.ts

@@ -1,286 +0,0 @@
-// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
-// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
-// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
-//
-// COMPILE-TIME USD-LAYER COMPOSITION for SHARED (global) relation types + the
-// fail-closed DIVERGENCE GUARD.
-//
-// THE MODEL. When a package bundles multiple domains, each domain lowers its own
-// `relationType` decls into its own `UsdLayer.nomosRelations`. A NON-global type is
-// auto-qualified by its owning domain (`estate` → `estate__workspace`), so two
-// domains that each declare the same bare type NEVER collide — their qualified ids
-// differ, and they stay separate layers. A `.asGlobal()` type (a kernel-coupled
-// framework type, e.g. governance/read-visibility `workspace`) stays a BARE shared
-// name, so MULTIPLE domains that each contribute to one global type land on the SAME
-// canonical id. That cross-domain merge USED to happen only at the KERNEL (runtime
-// `merge_layers`, a blunt per-type last-wins that SILENTLY DROPS the losing layer's
-// relations — the bug that broke co2's `createSite`). We move it to COMPILE time, in
-// TS, using USD's composition MODEL (LIVRPS sublayer strength):
-//
-//   * COMPOSE (deliverable #1): for each SHARED global type, UNION the relations
-//     across the contributing domains — a prim-set union, so EVERY domain's relations
-//     survive (nothing is dropped). The composed union is written back into every
-//     contributing layer so the downstream kernel merge (union OR last-wins) yields
-//     the full union regardless of its policy. This is idempotent and byte-stable.
-//
-//   * GUARD (deliverable #2): when two or more domains declare the SAME relation on a
-//     SHARED global type with DIVERGENT rewrites (co2's `workspace.admin`: `self()` in
-//     estate/platform vs `union(self, computed(creator))` in home), REFUSE AT COMPILE
-//     with a scalpel message naming the type, the relation, and each domain's rewrite.
-//     Single-owner relations and byte-identical agreeing opinions PASS (union). This
-//     turns the kernel's blunt `None` / "no-relation-schema" into a precise compile
-//     refusal — the era rule ("the law is the era") is preserved because a package with
-//     no shared global type composes to itself, byte-identical.
-//
-// SUBLAYER STRENGTH ORDER (documented, deliverable #1): the package's domain order is
-// WEAK → STRONG (Nomos module-fold notation — later wins), which maps onto USD
-// `subLayers` STRONGEST-FIRST by reversal (the same left-biased monoid, opposite list
-// notation — the convention `usd_layers.ts::layeredRootUsda` already records). For a
-// NON-divergent shared type the union is order-INDEPENDENT (every domain's opinion on a
-// given relation is identical, so which layer "wins" is immaterial); order matters ONLY
-// to the visualization flatten, never to the composed IR.
-
-import type { UsdLayer } from "./usd.js";
-
-/** A single relation's definition as it rides in `nomosRelations` (`{rewrite, allowed}`). */
-type RelDef = NonNullable<UsdLayer["nomosRelations"]>["types"][string]["relations"][string];
-/** One relation TYPE's spec (`{relations, caps?}`). */
-type RelSpec = NonNullable<UsdLayer["nomosRelations"]>["types"][string];
-
-/** Strip the `/Nomos/` prim-scope prefix to recover the owning domain key from a layer path. */
-export function domainOfLayerPath(path: string): string {
-  return path.startsWith("/Nomos/") ? path.slice("/Nomos/".length) : path;
-}
-
-/**
- * Render a rewrite AST to the author-facing surface syntax (`self()` / `computed(x)` /
- * `union(...)` / `via(t, c)` / …) — the readable form the scalpel message + the layered
- * `.usda` provenance attr carry. A `null`/absent rewrite is a pure-direct relation (`this`).
- */
-export function renderRewrite(rw: unknown): string {
-  if (rw === null || rw === undefined) return "this";
-  const r = rw as { kind?: string; [k: string]: unknown };
-  switch (r.kind) {
-    case "this":
-      return "self()";
-    case "computed":
-      return `computed(${String(r.relation)})`;
-    case "ttu":
-      return `${r.all ? "viaAll" : "via"}(${String(r.tupleset)}, ${String(r.computed)})`;
-    case "union":
-      return `union(${(r.children as unknown[]).map(renderRewrite).join(", ")})`;
-    case "intersection":
-      return `intersection(${(r.children as unknown[]).map(renderRewrite).join(", ")})`;
-    case "exclusion":
-      return `exclusion(${renderRewrite(r.base)}, ${renderRewrite(r.subtract)})`;
-    default:
-      return JSON.stringify(rw);
-  }
-}
-
-/** A per-relation divergence, gathered for the scalpel message. */
-interface RelationConflict {
-  readonly type: string;
-  readonly relation: string;
-  /** Each contributing domain's opinion, in package (weak→strong) order. */
-  readonly opinions: { readonly domain: string; readonly rewrite: string }[];
-}
-
-/** Format the accumulated divergences into the fail-closed refusal (mirrors `failclosed_check.py`). */
-function scalpelMessage(conflicts: readonly RelationConflict[]): string {
-  const lines: string[] = [
-    `Refusing to compose the package: shared relation type(s) carry DIVERGENT rewrites across ` +
-      `domains — the composed flatten would SILENTLY take the strongest layer's opinion (LIVRPS ` +
-      `last-wins), so this is a fail-closed compile refusal, not a silent pick.`,
-    ``,
-  ];
-  for (const c of conflicts) {
-    lines.push(`  relation type "${c.type}" relation "${c.relation}" — ${c.opinions.length} divergent opinions:`);
-    const w = Math.max(...c.opinions.map((o) => o.domain.length));
-    for (const o of c.opinions) lines.push(`      · ${o.domain.padEnd(w)}  ${o.rewrite}`);
-  }
-  lines.push(
-    ``,
-    `Fix: give the type ONE canonical definition of each divergent relation (the domains must ` +
-      `agree, byte-for-byte), or use DISTINCT / domain-qualified relation types (drop \`.asGlobal()\` ` +
-      `so each domain's type auto-qualifies and never shares an id).`,
-  );
-  return lines.join("\n");
-}
-
-/**
- * Compose the SHARED (global, bare-id) relation types across a package's layers — UNION the
- * relations per shared type, GUARD divergent rewrites fail-closed, and write the union back into
- * every contributing layer. Non-shared (single-owner / auto-qualified) types are untouched, so a
- * package with no shared global type returns byte-identical layers (the era rule). Deterministic:
- * sorted keys, sorted diagnostics.
- *
- * @throws a scalpel `Error` naming the type, relation, and each domain's rewrite on any divergence.
- */
-export function composeSharedRelationTypes(layers: readonly UsdLayer[]): UsdLayer[] {
-  // type id → the layers (domains) that contribute it, in package (weak→strong) order.
-  const contributors = new Map<string, { domain: string; spec: RelSpec }[]>();
-  for (const layer of layers) {
-    const rels = layer.nomosRelations;
-    if (rels === undefined) continue;
-    for (const [type, spec] of Object.entries(rels.types)) {
-      const arr = contributors.get(type) ?? [];
-      arr.push({ domain: domainOfLayerPath(layer.path), spec });
-      contributors.set(type, arr);
-    }
-  }
-
-  const composed = new Map<string, RelSpec>();
-  const conflicts: RelationConflict[] = [];
-  for (const type of [...contributors.keys()].sort()) {
-    const contribs = contributors.get(type)!;
-    // A type contributed by ONE domain is single-owner — nothing to compose (untouched).
-    if (contribs.length < 2) continue;
-
-    // caps must agree across the contributing domains (a divergent bound is a hard error).
-    let caps: RelSpec["caps"];
-    for (const c of contribs) {
-      if (c.spec.caps === undefined) continue;
-      if (caps === undefined) caps = c.spec.caps;
-      else if (caps.maxDepth !== c.spec.caps.maxDepth || caps.maxFanout !== c.spec.caps.maxFanout) {
-        throw new Error(
-          `Refusing to compose the package: shared relation type "${type}" is declared with ` +
-            `CONFLICTING caps across domains (${contribs.map((x) => x.domain).join(", ")}). Give the ` +
-            `type one canonical \`caps\`.`,
-        );
-      }
-    }
-
-    // Gather every domain's opinion on each relation (in package order).
-    const opinions = new Map<string, { domain: string; def: RelDef }[]>();
-    for (const c of contribs) {
-      for (const [rel, def] of Object.entries(c.spec.relations)) {
-        const arr = opinions.get(rel) ?? [];
-        arr.push({ domain: c.domain, def });
-        opinions.set(rel, arr);
-      }
-    }
-
-    const unioned: Record<string, RelDef> = {};
-    for (const rel of [...opinions.keys()].sort()) {
-      const ops = opinions.get(rel)!;
-      const distinct = new Set(ops.map((o) => JSON.stringify(o.def)));
-      if (distinct.size > 1) {
-        conflicts.push({
-          type,
-          relation: rel,
-          opinions: ops.map((o) => ({ domain: o.domain, rewrite: renderRewrite((o.def as { rewrite: unknown }).rewrite) })),
-        });
-      } else {
-        unioned[rel] = ops[0]!.def; // agreeing opinions / single-owner relation — keep it
-      }
-    }
-    // Sorted relation keys (byte-determinism against the per-layer emission).
-    const relations: Record<string, RelDef> = {};
-    for (const k of Object.keys(unioned).sort()) relations[k] = unioned[k]!;
-    composed.set(type, { relations, ...(caps !== undefined ? { caps } : {}) });
-  }
-
-  if (conflicts.length > 0) throw new Error(scalpelMessage(conflicts));
-  if (composed.size === 0) return [...layers]; // nothing shared — byte-identical (era rule)
-
-  // Write the composed union back into every contributing layer, keeping type keys sorted.
-  return layers.map((layer) => {
-    const rels = layer.nomosRelations;
-    if (rels === undefined) return layer;
-    let touched = false;
-    const merged: Record<string, RelSpec> = {};
-    for (const [type, spec] of Object.entries(rels.types)) {
-      const c = composed.get(type);
-      if (c !== undefined) {
-        merged[type] = c;
-        touched = true;
-      } else {
-        merged[type] = spec;
-      }
-    }
-    if (!touched) return layer;
-    const sorted: Record<string, RelSpec> = {};
-    for (const k of Object.keys(merged).sort()) sorted[k] = merged[k]!;
-    return { ...layer, nomosRelations: { v: 1 as const, types: sorted } };
-  });
-}
-
-// ── the REAL layered `.usda` emission (deliverable #3 — for usdview / usdcat --flatten) ──────────
-
-/** One domain's contribution to the layered relation emission: its bare-id relation types. */
-export interface RelationLayerInput {
-  readonly domain: string;
-  /** The domain's `nomosRelations.types` (UNCOMPOSED — the layers ARE the sublayers usdcat composes). */
-  readonly types: Record<string, RelSpec>;
-}
-
-/** `"a"` → escaped USDA string literal (minimal — relation/rewrite tokens are `[A-Za-z0-9_.,()]`). */
-function usda(s: string): string {
-  return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-
-/**
- * Emit ONE domain's relation opinions as a real `.usda` sublayer: `def "<Type>" { def "<relation>"
- * { custom string nomos:rewrite = "…"; custom string nomos:from = "<domain>" } }`. Structured so
- * `usdcat --flatten` composes the relation prims across sublayers (a stronger layer's `nomos:rewrite`
- * wins; the relation SET is the union). Deterministic: types + relations sorted.
- */
-export function emitRelationSublayerUsda(input: RelationLayerInput): string {
-  const lines: string[] = [`#usda 1.0`, `(`, `    doc = "Nomos relation layer — domain ${input.domain}"`, `)`, ``];
-  for (const type of Object.keys(input.types).sort()) {
-    lines.push(`def ${usda(type)}`, `{`);
-    const relations = input.types[type]!.relations;
-    for (const rel of Object.keys(relations).sort()) {
-      const def = relations[rel]! as { rewrite: unknown };
-      lines.push(
-        `    def ${usda(rel)}`,
-        `    {`,
-        `        custom string nomos:rewrite = ${usda(renderRewrite(def.rewrite))}`,
-        `        custom string nomos:from = ${usda(input.domain)}`,
-        `    }`,
-      );
-    }
-    lines.push(`}`, ``);
-  }
-  return lines.join("\n");
-}
-
-/** The result of {@link emitLayeredRelationUsda}: a root document + one sublayer file per domain. */
-export interface LayeredRelationEmit {
-  /** The root `.usda` (`subLayers = [...]`, STRONGEST-FIRST) that usdcat --flatten composes. */
-  readonly root: string;
-  /** Per-domain sublayer files (`name` is a bare filename; write beside the root). */
-  readonly files: { readonly name: string; readonly text: string }[];
-}
-
-/**
- * Emit a REAL layered relation `.usda` set: one sublayer per domain (its relation opinions as prims)
- * + a root with `subLayers` STRONGEST-FIRST, so `usdcat --flatten <root>` composes the package's
- * shared relation types. `inputs` are in package order (WEAK → STRONG); the root reverses them to
- * strongest-first (the documented convention). Deterministic (sorted within each layer, stable file
- * names). Additive build artifact — never feeds the package hash.
- */
-export function emitLayeredRelationUsda(inputs: readonly RelationLayerInput[], packageName: string): LayeredRelationEmit {
-  const safe = (s: string) => s.replace(/[^A-Za-z0-9._-]/g, "_");
-  const files = inputs.map((input) => ({
-    name: `${safe(input.domain)}.usda`,
-    text: emitRelationSublayerUsda(input),
-  }));
-  // subLayers is STRONGEST-FIRST → reverse the weak→strong package order.
-  const strongestFirst = [...files].reverse();
-  const root = [
-    `#usda 1.0`,
-    `(`,
-    `    doc = """Nomos relation-composition layers for package ${packageName}. subLayers are`,
-    `STRONGEST-FIRST (USD layer-stack order); the Nomos domain list composes weak→strong (later`,
-    `wins). \`usdcat --flatten\` composes the shared relation types; the compiler's TS composition`,
-    `(composeSharedRelationTypes) is the fail-closed guard layered on top."""`,
-    `    subLayers = [`,
-    ...strongestFirst.map((f, i) => `        @./${f.name}@${i < strongestFirst.length - 1 ? "," : ""}`),
-    `    ]`,
-    `)`,
-    ``,
-  ].join("\n");
-  return { root, files };
-}