@githolon/dsl 0.102.5 → 0.103.1

package/src/aggregate.ts

@@ -270,6 +270,9 @@ export interface AggregateHandle<
    * aggregate is `visibility: requires(cap)` (the scope) and its driver is Lww-class.
    */
   readonly encryptedFields?: string[];
+  /** ZD6 (encrypted_merge_model.md): the `.blindIndexed()` subset of {@link encryptedFields} —
+   *  these fields carry edge-indexable equality tokens (`bidx`); the gate enforces presence. */
+  readonly blindIndexedFields?: string[];
   /**
    * ATTRIBUTED READS (architecture/field_provenance.md) — the STORED field names whose
    * folded values keep AUTHOR PROVENANCE (`.attributed()` per field, or the aggregate
@@ -408,6 +411,20 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
       }
     }
   }
+  // ZD6 BLIND INDEXES (encrypted_merge_model.md): `.blindIndexed()` is only meaningful on an
+  // `.encrypted()` field — a plaintext field is indexed directly; a blind index on it would be
+  // a pointless (and confusing) second index. LOUD at compile, per the doctrine.
+  const blindIndexedFields = Object.entries(stored)
+    .filter(([, f]) => (f as Field).isBlindIndexed === true)
+    .map(([name]) => name)
+    .sort();
+  for (const name of blindIndexedFields) {
+    if (!encryptedFields.includes(name)) {
+      throw new Error(
+        `aggregate '${id}': field '${name}' is .blindIndexed() but not .encrypted() — a blind index serves equality lookups over SEALED values; a plaintext field is indexable directly (declare a query on it instead)`,
+      );
+    }
+  }
   // SURFACED MERGE CONFLICTS (architecture/surfaced_merge_conflict.md): `.merge(Surfaced(inner))`
   // is v1-scoped to scalar fields — the pending set holds competing business versions until a
   // resolver produces one merged result. The factory already refuses a non-scalar INNER; this refuses the
@@ -545,6 +562,7 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
     ...(opts?.cap !== undefined ? { cap: opts.cap } : {}),
     ...(opts?.global === true ? { global: true } : {}),
     ...(encryptedFields.length > 0 ? { encryptedFields } : {}),
+    ...(blindIndexedFields.length > 0 ? { blindIndexedFields } : {}),
     ...(attributedFields.length > 0 ? { attributedFields } : {}),
     ...(metaFields.length > 0 ? { metaFields } : {}),
   };

package/src/application_composition.ts

@@ -1,11 +1,10 @@
 // NOMOS — OpenUSD is the application/package IR. JavaScript config is authoring input only.
 
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
-import { usdaString, usdaStringArray } from "./usd_layers.js";
+import { usdaString, usdaStringArray } from "./usda_text.js";
 
 export type PartKind = "component" | "assembly" | "group";
 
@@ -51,7 +50,7 @@ export interface ApplicationDeploymentPackage {
   readonly packageName: string;
   readonly sourceIdentity: string;
   readonly assetPath: string;
-  readonly deployPath: string;
+  readonly lawUsdzPath: string;
 }
 
 export interface ApplicationDeploymentPlan {
@@ -361,36 +360,11 @@ export function applicationDeploymentPlan(stagePath: string): ApplicationDeploym
     }
     const packageName = identity[1]!;
     const sourceIdentity = identity[2]!;
-    const deployPath = path.join(path.dirname(use.assetPath), `${packageName}.deploy.json`);
-    if (!existsSync(deployPath)) {
-      throw new Error(`package '${packageName}' has no sibling deploy body: ${deployPath} (compile the package first)`);
+    const lawUsdzPath = path.join(path.dirname(use.assetPath), `${packageName}.law.usdz`);
+    if (!existsSync(lawUsdzPath)) {
+      throw new Error(`package '${packageName}' has no canonical sibling law archive: ${lawUsdzPath} (compile the package first)`);
     }
-    let body: {
-      summary?: { package?: unknown; sourceIdentity?: unknown; domainHash?: unknown };
-      packageUsda?: unknown;
-    };
-    try {
-      body = JSON.parse(readFileSync(deployPath, "utf8")) as typeof body;
-    } catch (error) {
-      throw new Error(`package '${packageName}' deploy body is not valid JSON: ${(error as Error).message}`);
-    }
-    if (body.summary?.package !== packageName) {
-      throw new Error(`package asset '${use.assetPath}' names '${packageName}', but '${deployPath}' does not`);
-    }
-    if (body.summary?.sourceIdentity !== sourceIdentity) {
-      throw new Error(
-        `package '${packageName}' asset/deploy skew: source identity ${sourceIdentity.slice(0, 12)}… does not match ` +
-          `${String(body.summary?.sourceIdentity ?? "missing").slice(0, 12)}…; recompile the package and application together`,
-      );
-    }
-    if (typeof body.packageUsda !== "string" || body.packageUsda.length === 0) {
-      throw new Error(`package '${packageName}' deploy body has no packageUsda`);
-    }
-    const lawHash = createHash("sha256").update(Buffer.from(body.packageUsda, "utf8")).digest("hex");
-    if (body.summary?.domainHash !== lawHash) {
-      throw new Error(`package '${packageName}' deploy body is internally stale (packageUsda hash does not match its summary)`);
-    }
-    return { ...use, packageName, sourceIdentity, deployPath };
+    return { ...use, packageName, sourceIdentity, lawUsdzPath };
   });
   packages.sort((a, b) => Number(a.placement === "payload") - Number(b.placement === "payload"));
   return { application, stagePath, packages };

package/src/attested_core.ts

@@ -140,10 +140,13 @@ export interface FromPayloadRef {
   readonly __nomosFromPayload: true;
 }
 
-/** Name the PAYLOAD FIELD whose value routes a dynamic attested read (see {@link FromPayloadRef}). */
+/** Name the payload value whose workspace routes a dynamic attested read.
+ * A dotted path may select a compiled reference component, e.g.
+ * `fromPayload("publication.pinned.workspace")`; the path is law metadata,
+ * never a caller-provided selector. */
 export function fromPayload(field: string): FromPayloadRef {
-  if (typeof field !== "string" || field.length === 0) {
-    throw new Error(`fromPayload(): the payload field name must be a non-empty string`);
+  if (typeof field !== "string" || !/^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$/.test(field)) {
+    throw new Error(`fromPayload(): pass a payload field or dotted compiled-reference path`);
   }
   return { payloadField: field, __nomosFromPayload: true };
 }

package/src/birth_meter.ts

@@ -332,6 +332,7 @@ export function synthesizeBirthQuotaInvariants(directive: {
         if (!reads.some((r) => r.queryId === birthRecordsByPrincipal.id)) return { accept: true };
         return birthQuotaVerdict(reads, birthMeterSubject(ctx?.intent ?? {}));
       },
+      __nomosEvaluator: "birth-quota-v1" as const,
       __isWorkspaceInvariant: true as const,
     },
   ];

package/src/birth_meter_ensure.ts

@@ -87,6 +87,14 @@ const bornFounderSignerWriteOnce = workspaceInvariant("FounderSignerWriteOnce")
       : { reject: "founding-signer-already-enrolled" };
   });
 
+// This is fixed Nomos bootstrap algebra, not tenant-authored policy. The typed USDA declaration
+// selects the versioned kernel evaluator so every door can apply the same rule directly over the
+// folded tuple instead of booting a tenant report sandbox during every child genesis.
+const nativeBornFounderSignerWriteOnce = {
+  ...bornFounderSignerWriteOnce,
+  __nomosEvaluator: "founder-signer-write-once-v1" as const,
+};
+
 /**
  * The sanctioning declaration — an `ensures(NomosBirthRecord)` directive whose plan emits ZERO ops.
  * Its only load-bearing property is its manifest/USD presence (marker `Ensure`, target
@@ -107,6 +115,12 @@ export const nomosBirthRecordEnsure = directive("nomosBirthRecordEnsure")
  * overwritten (a law composing the framework governance surface keeps its own bindings).
  */
 export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M): M {
+  const exportedDirectiveIds = new Set(Object.values(mod).flatMap((value) =>
+    value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string"
+      ? [(value as { id: string }).id]
+      : []));
+  const governsBirth =
+    exportedDirectiveIds.has("setBirthPolicy") || exportedDirectiveIds.has("grantBirthAllowance");
   const declaresBirth = Object.values(mod).some(
     (v) =>
       v !== null &&
@@ -124,7 +138,7 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
       (v as { id?: unknown }).id === "seedBirthAttestation" &&
       typeof (v as Directive<unknown>).plan === "function",
   );
-  if (!declaresBirth && !acceptsBirth) return mod;
+  if (!declaresBirth && !acceptsBirth && !governsBirth) return mod;
   const out: Record<string, unknown> = { ...mod };
   const internal = <T extends object>(v: T): T => ({ ...v, businessBirthInternal: true }) as T;
   const hasOwn = (key: string): boolean => Object.prototype.hasOwnProperty.call(out, key);
@@ -184,6 +198,11 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
     }
     if (!found) out[key] = internal(canonical);
   };
+  if (governsBirth && !declaresBirth && !acceptsBirth) {
+    if (exportedDirectiveIds.has("setBirthPolicy")) internalize("__nomos_BirthPolicy", BirthPolicy);
+    if (exportedDirectiveIds.has("grantBirthAllowance")) internalize("__nomos_BirthGrant", BirthGrant);
+    return out as M;
+  }
   // THE BORN-WORKSPACE CORE: the kernel appends enrollSigner -> attestation -> warrant to every valid birth.
   // Carry the law needed to judge that internal step in every possible child, plus the write-once guard that
   // keeps the founding lane a genesis primitive. These declarations are certified but never tenant-facing.
@@ -201,7 +220,14 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   reserve("__nomos_authProviderSeedBeforeWarrant", authProviderSeedBeforeWarrant);
   internalize("__nomos_setAuthProvider", setAuthProvider);
   internalize("__nomos_authProvider", authProvider);
-  reserve("__nomos_founderSignerWriteOnce", bornFounderSignerWriteOnce);
+  reserve("__nomos_founderSignerWriteOnce", nativeBornFounderSignerWriteOnce);
+  // A tenant may deliberately expose the framework governance directives on a platform workspace.
+  // Their target schemas are part of that workspace's executable law even when it never births a child;
+  // make the directives self-contained instead of requiring a second, undocumented aggregate re-export.
+  if (governsBirth) {
+    if (exportedDirectiveIds.has("setBirthPolicy")) internalize("__nomos_BirthPolicy", BirthPolicy);
+    if (exportedDirectiveIds.has("grantBirthAllowance")) internalize("__nomos_BirthGrant", BirthGrant);
+  }
   if (!declaresBirth) return out as M;
   // Birth lifecycle is Nomos machinery for every birth-capable law. It remains certified/routable law,
   // but no generated tenant API gets a second maintenance lane beside business `birth(...)`.

package/src/births.ts

@@ -26,7 +26,7 @@ import type { Field, FieldValue } from "./fields.js";
  */
 
 /** ONE birth recipe the plan produced — the child's genesis chain (the `buildGenesisChain` JSON array of
- *  `{domain, directiveId, payload, actor[, domainPackageB64, domainHash]}` steps). Carried verbatim onto the
+ *  `{domain, directiveId, payload, actor[, domainHash]}` steps). Carried verbatim onto the
  *  intent's birth effect; the kernel folds it through the child's own gate (each step self-verifies). */
 export interface BirthRecipe {
   /** The child workspace name the parent asked to birth (lineage + the child's `:ws` segment). */