@githolon/dsl 0.103.7 → 0.103.9

package/src/codegen_dart_application.ts

@@ -284,7 +284,7 @@ function dartActionOutputs(
   const fields = new Set<string>();
   return outputs.map((output) => {
     const dartType = concreteClassName(output.aggregateId);
-    const field = member(dartType);
+    const field = member(output.many ? plural(dartType) : dartType);
     if (fields.has(field)) {
       throw new Error(
         `Dart application result for '${directive.id}' has two aggregate consequences named '${field}'; ` +
@@ -1140,7 +1140,11 @@ export function generateDartApplication(
           `  Future<${targetApplication}> _nmsOpenReference(NomosRef<${rootType}> reference) {`,
           `    final workspace = NmsInternalNomosRefs.workspace(reference);`,
           `    final existing = _nmsApplications[workspace];`,
-          `    if (existing != null) return existing;`,
+          `    if (existing != null) {`,
+          `      return NmsInternalApplicationHost.nmsInternalAwaitReferencedApplication(`,
+          `        workspace: workspace, opening: existing,`,
+          `      );`,
+          `    }`,
           `    late final Future<${targetApplication}> opened;`,
           `    opened = (() async {`,
           `      try {`,
@@ -1153,7 +1157,9 @@ export function generateDartApplication(
           `      }`,
           `    })();`,
           `    _nmsApplications[workspace] = opened;`,
-          `    return opened;`,
+          `    return NmsInternalApplicationHost.nmsInternalAwaitReferencedApplication(`,
+          `      workspace: workspace, opening: opened,`,
+          `    );`,
           `  }`,
           ``,
           `  /// Open the workspace named by a typed ${rootType} custody reference.`,
@@ -2080,7 +2086,7 @@ export function generateDartApplication(
           `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
           `    ApplicationModelChange? onModelChange,`,
           `    ValueChanged<NomosApplicationStartupState>? onStartupStateChanged,`,
-          `    Duration startupTimeout = const Duration(seconds: 45),`,
+          `    Duration startupTimeout = const Duration(minutes: 3),`,
           `  }) => NmsInternalApplicationHost.home<${application}>(`,
           `    key: key, cloud: cloud, application: application, signIn: signIn,`,
           `    bind: nomosInternalBind${application}, builder: builder,`,

package/src/codegen_proof.ts

@@ -3338,7 +3338,14 @@ function generateSealedApplicationProof(
     `  if (!response.ok || !body.token) fail("the generated application could not attest its private device: " + (body.error || response.status));`,
     `  return body.token;`,
     `};`,
-    `const application = await ${opener}({ cloud, application: applicationName, signIn });`,
+    `const performanceEnabled = process.env.NOMOS_PROOF_PERFORMANCE === "1";`,
+    `const reportPerformance = performanceEnabled`,
+    `  ? (sample: { readonly operation: string; readonly name: string; readonly durationMs: number; readonly domain?: string; readonly directive?: string }) =>`,
+    `      console.error("[nomos-application-performance] " + JSON.stringify(sample))`,
+    `  : undefined;`,
+    `const coldOpenStarted = performance.now();`,
+    `const application = await ${opener}({ cloud, application: applicationName, signIn, onPerformance: reportPerformance });`,
+    `if (reportPerformance) reportPerformance({ operation: "open", name: "generated application ready (cold)", durationMs: performance.now() - coldOpenStarted });`,
     `ok("opened the generated ${applicationName}; identity, custody, recovery and sync stay inside Nomos");`,
     `const waitUntilSaved = async (): Promise<void> => {`,
     `  const current = await application.currentStatus();`,
@@ -3467,6 +3474,15 @@ function generateSealedApplicationProof(
     `const _proofDisposable = application as unknown as { [Symbol.asyncDispose]?: () => Promise<void> };`,
     `const _proofDispose = _proofDisposable[Symbol.asyncDispose];`,
     `if (_proofDispose) await Promise.race([_proofDispose(), new Promise<void>((resolve) => setTimeout(resolve, 1_000))]);`,
+    `if (performanceEnabled) {`,
+    `  const warmOpenStarted = performance.now();`,
+    `  const warmApplication = await ${opener}({ cloud, application: applicationName, signIn, onPerformance: reportPerformance });`,
+    `  reportPerformance?.({ operation: "open", name: "generated application ready (warm)", durationMs: performance.now() - warmOpenStarted });`,
+    `  const warmStatus = await warmApplication.currentStatus();`,
+    `  if (warmStatus.phase === "attention") fail(warmStatus.message ?? "the warm application needs attention");`,
+    `  const warmDisposable = warmApplication as unknown as { [Symbol.asyncDispose]?: () => Promise<void> };`,
+    `  if (warmDisposable[Symbol.asyncDispose]) await Promise.race([warmDisposable[Symbol.asyncDispose]!(), new Promise<void>((resolve) => setTimeout(resolve, 1_000))]);`,
+    `}`,
     `process.exit(0);`,
     ``,
   );

package/src/codegen_ts.ts

@@ -3920,6 +3920,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ),
       `type _${applicationName}Business = ${applicationType};`,
       `export type ${applicationName}Status = _NomosApplicationStatus;`,
+      `export interface ${applicationName}PerformanceSample {`,
+      `  readonly operation: "open" | "offer" | "birth" | "read" | "sync" | "maintenance";`,
+      `  readonly name: string; readonly durationMs: number; readonly domain?: string; readonly directive?: string;`,
+      `}`,
       `export type ${applicationName} = _${applicationName}Business & _NomosApplicationParticipant & _NomosApplicationLifecycle & _NomosApplicationModelLifecycle${hasInvitations ? " & _NomosApplicationInvitations" : ""};`,
       `export interface ${applicationName}OpenOptions {`,
       `  /** Nomos Cloud serving this deployed application. Configure it once at the app boundary. */`,
@@ -3928,6 +3932,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  readonly application: string;`,
       `  /** Return the signed-in authority credential; when supplied, bind its opaque device challenge. */`,
       `  readonly signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>;`,
+      `  /** Typed timings for developer tooling; Nomos routing, credentials and Git custody remain private. */`,
+      `  readonly onPerformance?: (sample: ${applicationName}PerformanceSample) => void;`,
       `}`,
       `function _nomosPublicDomain<T extends Record<string, unknown>>(domain: T): _NomosPublicDomain<T> {`,
       `  const application: Record<string, unknown> = {};`,
@@ -4055,7 +4061,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ` *  or parallel cache around it. Nomos owns offline custody and synchronization. */`,
       `export function ${applicationOpener}(options: ${applicationName}OpenOptions): Promise<${applicationName}> {`,
       `  return nomosInternalOpenGeneratedApplication(`,
-      `    { cloud: options.cloud, application: options.application, signIn: options.signIn, lawHash: ${hashConst} },`,
+      `    { cloud: options.cloud, application: options.application, signIn: options.signIn, onPerformance: options.onPerformance, lawHash: ${hashConst} },`,
       `    (holon, user) => _nomosBind${applicationName}(holon as NomosHolon, user),`,
       `  );`,
       `}`,

package/src/compile_package_main.ts

@@ -197,6 +197,10 @@ const DSL_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
  * here so a generated offer can never silently fall back to initializing the whole tenant domain.
  */
 const BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES: Readonly<Record<string, PlanSourceSliceTarget>> = {
+  seedBirthPolicy: {
+    modulePath: path.join(DSL_DIR, "src", "framework", "birth_meter.ts"),
+    exportName: "seedBirthPolicy",
+  },
   enrollSigner: {
     modulePath: path.join(DSL_DIR, "src", "framework", "signing_identity.ts"),
     exportName: "enrollSigner",
@@ -1642,12 +1646,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.8.3";
+const NOMOS_TYPES_DEP = "^0.8.4";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.6";
-const NOMOS_FLUTTER_DEP = "^0.63.9";
+const NOMOS_CLIENT_DEP = "^0.64.8";
+const NOMOS_FLUTTER_DEP = "^0.63.11";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1917,14 +1921,25 @@ function generatedPackageApplication(
     `  /// Prove, adopt or restore the package law against this workspace's exact history.`,
     `  ${rootMember.prefix}.NomosModel get model => ${rootMember.member}.model;`,
     ``,
-    `  /// Current durability and convergence across this business application.`,
-    `  ApplicationStatus get currentStatus => NmsInternalApplicationHost.currentApplicationStatus(_nmsSession);`,
+    `  /// Current durability and convergence for the receiving-group workspace.`,
+    `  /// A slow or offline sibling never makes this workspace's readiness ambiguous.`,
+    `  ApplicationStatus get currentStatus => NmsInternalApplicationHost.currentStatus(_nmsSession);`,
     ``,
-    `  /// React whenever this application saves, receives work, goes offline or needs attention.`,
-    `  Stream<ApplicationStatus> watchStatus() => NmsInternalApplicationHost.watchApplicationStatus(_nmsSession);`,
+    `  /// React whenever this receiving group saves, receives work, goes offline or needs attention.`,
+    `  Stream<ApplicationStatus> watchStatus() => NmsInternalApplicationHost.watchStatus(_nmsSession);`,
     ``,
-    `  /// Wait until accepted local work is in shared custody and this application has caught up.`,
+    `  /// Wait until this receiving group's accepted work is in custody and caught up.`,
     `  Future<void> whenCurrent({Duration timeout = const Duration(minutes: 2)}) =>`,
+    `      NmsInternalApplicationHost.whenCurrent(_nmsSession, timeout: timeout);`,
+    ``,
+    `  /// Aggregate posture across every child currently owned by this generated application.`,
+    `  ApplicationStatus get applicationStatus => NmsInternalApplicationHost.currentApplicationStatus(_nmsSession);`,
+    ``,
+    `  /// React to aggregate posture across every generated child currently in this application plane.`,
+    `  Stream<ApplicationStatus> watchApplicationStatus() => NmsInternalApplicationHost.watchApplicationStatus(_nmsSession);`,
+    ``,
+    `  /// Explicitly wait for every generated child currently owned by this application.`,
+    `  Future<void> whenApplicationCurrent({Duration timeout = const Duration(minutes: 2)}) =>`,
     `      NmsInternalApplicationHost.whenApplicationCurrent(_nmsSession, timeout: timeout);`,
     ...(hasInvitations
       ? [
@@ -1973,7 +1988,7 @@ function generatedPackageApplication(
     `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
     `    ApplicationModelChange? onModelChange,`,
     `    ValueChanged<NomosApplicationStartupState>? onStartupStateChanged,`,
-    `    Duration startupTimeout = const Duration(seconds: 45),`,
+    `    Duration startupTimeout = const Duration(minutes: 3),`,
     `  }) => NmsInternalApplicationHost.home<${application}>(`,
     `    key: key, cloud: cloud, application: application, signIn: signIn,`,
     `    bind: nomosInternalBind${application}, builder: builder,`,
@@ -2544,7 +2559,8 @@ function emitDartPackages(
     "library;",
     "",
     `export 'package:${packages.types}/${genRel}/${businessSharedFile}';`,
-    `export 'package:nomos_flutter/src/generated_application_host.dart' show ApplicationModelApproval, ApplicationModelDecision, ApplicationModelPolicy, ApplicationModelReview;`,
+    `export 'package:nomos_flutter/src/generated_application_host.dart' show ApplicationModelApproval, ApplicationModelDecision, ApplicationModelPolicy, ApplicationModelReview, NomosApplicationStartupPhase, NomosApplicationStartupState, NomosApplicationStartupTimeout, NomosWorkspaceOpenTimeout;`,
+    `export 'package:nomos_types/nomos_types.dart' show CustodyError, CustodyPhase, CustodySource, NomosRecommendedAction;`,
     ...tenantTypesExportKeys
       .map((file) => {
         const names = tenantDartExportNames(typesSources.get(file) ?? "");
@@ -5161,7 +5177,7 @@ async function main(): Promise<void> {
   const temporaryDeclarationPath = temporaryClientPath.replace(/\.ts$/, ".d.ts");
   const runtimeTypesSource = [
     `export declare function nomosInternalOpenGeneratedApplication<T extends object>(`,
-    `  options: { cloud: string; application: string; signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>; lawHash: string },`,
+    `  options: { cloud: string; application: string; signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>; onPerformance?: (sample: { readonly operation: "open" | "offer" | "birth" | "read" | "sync" | "maintenance"; readonly name: string; readonly durationMs: number; readonly domain?: string; readonly directive?: string }) => void; lawHash: string },`,
     `  bind: (holon: unknown, user: { readonly identityId: string; readonly identityAddress: string }) => T,`,
     `): Promise<T & {`,
     `  currentStatus(): Promise<any>;`,

package/src/framework/domain_lifecycle.ts

@@ -294,10 +294,12 @@ export const stageDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Stage)
   })
   .requires(MODEL_LIFECYCLE_AUTHORITY);
 
-/** Make a staged package current. The package bytes are already committed; the kernel
- *  re-loads them from prefix state and runs the evolve gate on this phase transition.
- *  The prior version stays Active by default so gradual-rollout clients can still have
- *  their declared era checked; the newer activation stamp alone makes this law current. */
+/** Make a staged or retained Active package current. The package bytes are already
+ *  committed; the kernel re-loads them from prefix state and runs the evolve gate on
+ *  this governed transition. Prior versions stay Active by default so gradual-rollout
+ *  clients can still have their declared era checked; the newer activation stamp alone
+ *  makes this law current. Re-promoting a shadowed Active package is therefore the lawful,
+ *  history-proved inverse of a later package taking its domain keys. */
 export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
   .mutates(DomainInstallation)
   .payload(z.object({

package/src/intent.ts

@@ -9,6 +9,7 @@
 import type { z } from "zod";
 
 import type {
+  BusinessSourceTrust,
   Directive,
   PreconditionDescriptor,
   ReferentialMarker,
@@ -233,11 +234,38 @@ function unsupportedKernelGate(directive: Directive<any>): string | undefined {
   if (directive.delegatedRoleGate !== undefined) return "delegated authority";
   if (directive.firstDeviceEnrollGate !== undefined) return "first-device enrollment";
   if (directive.certifiesEraGate !== undefined) return "era certification";
-  if (directive.businessSourceTrust !== undefined) return "source-trust preflight";
   if ((directive.businessRecordInputs?.length ?? 0) > 0) return "record-input binding";
   return undefined;
 }
 
+function remapBusinessSourceTrust<I>(
+  step: IntentStep<I, any>,
+  trust: BusinessSourceTrust,
+): BusinessSourceTrust {
+  const field = (privatePath: string): string => {
+    const mapped = remapStepPayloadPath(step, privatePath.split("."));
+    if (mapped === undefined || mapped.length === 0) {
+      throw new Error(
+        `compound intent cannot remap source-trust field '${privatePath}' from '${step.directive.id}'`,
+      );
+    }
+    return mapped.join(".");
+  };
+  return {
+    viaDirectiveId: trust.viaDirectiveId,
+    fromPayload: field(trust.fromPayload),
+    queryId: trust.queryId,
+    queryArgs: Object.fromEntries(
+      Object.entries(trust.queryArgs).map(([target, source]) => [target, field(source)]),
+    ),
+    copy: Object.fromEntries(
+      Object.entries(trust.copy).map(([target, source]) => [target, field(source)]),
+    ),
+    genesisField: trust.genesisField,
+    keyHashesField: trust.keyHashesField,
+  };
+}
+
 const dedupeBy = <T>(values: readonly T[], key: (value: T) => string): T[] => {
   const out: T[] = [];
   const seen = new Set<string>();
@@ -333,24 +361,44 @@ class IntentBuilder<I> {
 
     const primary = this.steps.find((step) => step.directive.birthsChild !== true)?.directive
       ?? this.steps[0]!.directive;
-    const outputs: SecondaryOutput[] = [];
-    for (const [index, step] of this.steps.entries()) {
+    const allOutputs: SecondaryOutput[] = [];
+    for (const step of this.steps) {
       const candidate = step.directive;
-      if (
-        candidate.birthsChild !== true &&
-        candidate !== primary &&
-        !(candidate.aggregateId === primary.aggregateId && candidate.marker === primary.marker)
-      ) {
-        outputs.push({ aggregateId: candidate.aggregateId, marker: candidate.marker });
+      if (candidate.birthsChild !== true) {
+        allOutputs.push({
+          aggregateId: candidate.aggregateId,
+          marker: candidate.marker,
+          ...(candidate.outputCardinality === "many" ? { many: true } : {}),
+          ...(candidate.outputCardinality === "optional" ? { optional: true } : {}),
+        });
+        allOutputs.push(...(candidate.secondaryOutputs ?? []));
       }
-      if (candidate.birthsChild !== true) outputs.push(...(candidate.secondaryOutputs ?? []));
     }
-    const secondaryOutputs = dedupeBy(
-      outputs.filter(
-        (output) => !(output.aggregateId === primary.aggregateId && output.marker === primary.marker),
-      ),
-      (output) => `${output.marker}\0${output.aggregateId}`,
+    const outputGroups = new Map<string, SecondaryOutput[]>();
+    for (const output of allOutputs) {
+      const key = `${output.marker}\0${output.aggregateId}`;
+      outputGroups.set(key, [...(outputGroups.get(key) ?? []), output]);
+    }
+    const composedOutput = (group: readonly SecondaryOutput[]): SecondaryOutput => ({
+      aggregateId: group[0]!.aggregateId,
+      marker: group[0]!.marker,
+      ...(group.length > 1 || group.some((output) => output.many === true)
+        ? { many: true }
+        : group[0]!.optional === true
+        ? { optional: true }
+        : {}),
+    });
+    const primaryOutput = composedOutput(
+      outputGroups.get(`${primary.marker}\0${primary.aggregateId}`) ?? [{
+        aggregateId: primary.aggregateId,
+        marker: primary.marker,
+      }],
     );
+    const secondaryOutputs = [...outputGroups.values()]
+      .map(composedOutput)
+      .filter(
+        (output) => !(output.aggregateId === primary.aggregateId && output.marker === primary.marker),
+      );
     const inferredReturns = [
       primary.aggregateId,
       ...secondaryOutputs.map((output) => output.aggregateId),
@@ -421,6 +469,16 @@ class IntentBuilder<I> {
       }
     }
     const relationGate = oneStaticRelationGate(this.steps);
+    const sourceTrusts = this.steps.flatMap((step) =>
+      step.directive.businessSourceTrust === undefined
+        ? []
+        : [remapBusinessSourceTrust(step, step.directive.businessSourceTrust)],
+    );
+    if (sourceTrusts.length > 1) {
+      throw new Error(
+        `intent('${this.id}') composes more than one source-trust preflight — split the business action by source`,
+      );
+    }
     const steps = [...this.steps];
     const plan = (facts: I, ctx: Ports): PlannedOp[] => {
       const returned: PlannedOp[] = [];
@@ -455,8 +513,10 @@ class IntentBuilder<I> {
       // engine cannot rebuild its aggregate registry entry and silently drops
       // compound intents that also birth a child.
       ...(primary.aggregate === undefined ? {} : { aggregate: primary.aggregate }),
-      ...(primary.outputCardinality !== undefined
-        ? { outputCardinality: primary.outputCardinality }
+      ...(primaryOutput.many === true
+        ? { outputCardinality: "many" as const }
+        : primaryOutput.optional === true
+        ? { outputCardinality: "optional" as const }
         : {}),
       ...(secondaryOutputs.length > 0 ? { secondaryOutputs } : {}),
       payloadSchema: (birthSteps[0]?.directive.payloadSchema ?? this.contractDeclaration.accepts) as unknown as z.ZodType<I>,
@@ -475,6 +535,9 @@ class IntentBuilder<I> {
       ].sort(),
       ...(preconditions.length > 0 ? { preconditions } : {}),
       ...(relationGate !== undefined ? { requiresRelationGate: relationGate } : {}),
+      ...(sourceTrusts[0] === undefined
+        ? {}
+        : { businessSourceTrust: sourceTrusts[0] }),
       ...(businessBirth === undefined
         ? {}
         : {