@githolon/dsl 0.104.1 → 0.105.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.104.1",
+  "version": "0.105.0",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/src/build_provenance.ts

@@ -0,0 +1,132 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded
+// QuickJS engine} on V8 + WASI-shim, byte-identical everywhere.  V8 = portability; the one
+// wasm = determinism.  No native, no wasmtime, no 2nd artifact, no domain-JS on bare V8.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * build_provenance.ts — the compile states what it produced as an IN-TOTO ATTESTATION,
+ * not as prose a regex has to mine.
+ *
+ * ── Why ──────────────────────────────────────────────────────────────────────
+ * `<name>.summary.txt` is written for humans and then parsed by machines. The release
+ * test reaches into it with `RegExp(r'law \(domainHash\): ([0-9a-f]{64})')`; a preflight
+ * does the same. Reword the line and the regex silently yields null — a gate that fails
+ * OPEN. That is the same defect class the kernel removed this era: one fact, two
+ * representations, and the derived copy drifts. (Two model-policy files disagreeing cost
+ * a release build the day this was written.)
+ *
+ * ── The giant ────────────────────────────────────────────────────────────────
+ * A compile output is BUILD PROVENANCE: *this artifact, with this digest, was produced
+ * by this builder from these inputs*. That has a specified shape already —
+ * in-toto Statement v1 (`https://in-toto.io/Statement/v1`) carrying a SLSA Provenance v1
+ * predicate (`https://slsa.dev/provenance/v1`). Existing verifiers understand it; agents
+ * do not have to learn a Nomos dialect to read it; and it is the natural carrier for a
+ * signature later (wrap in DSSE, sign with the same device keys the ledger already uses).
+ *
+ * NOTE ON JSON: in-toto statements are JSON *by specification*. Emitting JSON because a
+ * standard mandates it is the opposite of inventing a bespoke format — the objection this
+ * file answers was never "JSON", it was "a dialect only we can read".
+ *
+ * The prose summary stays: humans should keep reading a summary. What changes is that
+ * machines stop parsing it — both are projections of the same in-memory facts, so they
+ * cannot disagree.
+ */
+
+/** One artifact this compile produced, named by digest. */
+export interface ProvenanceSubject {
+  readonly name: string;
+  readonly digest: { readonly sha256: string };
+}
+
+export interface BuildProvenanceInput {
+  /** Package name from the project config. */
+  readonly packageName: string;
+  /** `sha256(package bytes)` — the composed typed USDA closure identity. */
+  readonly domainHash: string;
+  /** The transports the domainHash addresses (law archive, package asset, …). */
+  readonly artifacts: readonly { readonly name: string; readonly sha256?: string }[];
+  /** Per-domain compiled surface, already computed for the summary. */
+  readonly domains: readonly {
+    readonly domain: string;
+    readonly identityHash?: string;
+    readonly aggregates: readonly string[];
+    readonly directives: readonly string[];
+    readonly queries: readonly string[];
+    readonly counts: readonly string[];
+    readonly sums: readonly string[];
+  }[];
+  /** Compiler identity, so a consumer can tell which toolchain produced this. */
+  readonly builder: { readonly id: string; readonly version: string };
+  /** Source law modules, by feature — the external parameters of the build. */
+  readonly sourceModules?: readonly string[];
+}
+
+/**
+ * Build the in-toto Statement. PURE — takes facts, returns the document, writes nothing,
+ * reads no clock. A timestamp would make two compiles of identical inputs produce
+ * different bytes, which would defeat the point: this document is itself reproducible,
+ * so it can be compared across machines exactly like the artifact it describes.
+ */
+export function buildProvenanceStatement(input: BuildProvenanceInput): Record<string, unknown> {
+  const subject: ProvenanceSubject[] = [
+    // The law closure identity is THE subject: `sha256(package bytes) = domainHash`.
+    { name: `${input.packageName}.law`, digest: { sha256: input.domainHash } },
+    ...input.artifacts
+      .filter((a): a is { name: string; sha256: string } => typeof a.sha256 === "string")
+      .map((a) => ({ name: a.name, digest: { sha256: a.sha256 } })),
+  ];
+
+  return {
+    _type: "https://in-toto.io/Statement/v1",
+    subject,
+    predicateType: "https://slsa.dev/provenance/v1",
+    predicate: {
+      buildDefinition: {
+        buildType: "https://nomos.cafe/buildtypes/domain-package/v1",
+        externalParameters: {
+          packageName: input.packageName,
+          ...(input.sourceModules === undefined
+            ? {}
+            : { sourceModules: [...input.sourceModules].sort() }),
+        },
+        // What the compile RESOLVED — the surface each domain actually exposes. A
+        // consumer diffing two provenances sees the law's shape change without
+        // parsing USDA or prose.
+        resolvedDependencies: input.domains.map((d) => ({
+          uri: `nomos:domain/${d.domain}`,
+          ...(d.identityHash === undefined ? {} : { digest: { sha256: d.identityHash } }),
+          annotations: {
+            aggregates: [...d.aggregates].sort(),
+            directives: [...d.directives].sort(),
+            queries: [...d.queries].sort(),
+            counts: [...d.counts].sort(),
+            sums: [...d.sums].sort(),
+          },
+        })),
+      },
+      runDetails: {
+        builder: { id: input.builder.id, version: { githolon: input.builder.version } },
+        // No startedOn/finishedOn: see the note above on reproducibility.
+        metadata: { invocationId: input.domainHash },
+      },
+    },
+  };
+}
+
+/** Canonical bytes: sorted keys, 2-space indent, trailing newline. Byte-stable. */
+export function renderProvenance(statement: Record<string, unknown>): string {
+  const sortKeys = (value: unknown): unknown => {
+    if (Array.isArray(value)) return value.map(sortKeys);
+    if (value !== null && typeof value === "object") {
+      return Object.fromEntries(
+        Object.keys(value as Record<string, unknown>)
+          .sort()
+          .map((k) => [k, sortKeys((value as Record<string, unknown>)[k])]),
+      );
+    }
+    return value;
+  };
+  return `${JSON.stringify(sortKeys(statement), null, 2)}\n`;
+}

package/src/compile_package_main.ts

@@ -185,6 +185,7 @@ import {
 import { assertUsdaRelationshipIntegrity } from "./usda_relationship_integrity.js";
 import { assertPublicPackageImports } from "./package_source_imports.js";
 import { assertPackageFeatureTopology } from "./package_feature_topology.js";
+import { buildProvenanceStatement, renderProvenance } from "./build_provenance.js";
 import { packageDependencyUsageFindings } from "./package_dependency_usage.js";
 import {
   PlanSourceSliceProgram,
@@ -1653,7 +1654,7 @@ const NOMOS_TYPES_DEP = "^0.8.5";
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
 const NOMOS_CLIENT_DEP = "^0.64.17";
-const NOMOS_FLUTTER_DEP = "^0.63.25";
+const NOMOS_FLUTTER_DEP = "^0.63.26";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -5214,6 +5215,35 @@ async function main(): Promise<void> {
   ].join("\n");
   writeFileSync(path.join(outDir, `${cfg.name}.summary.txt`), summaryTxt, "utf8");
 
+  // THE MACHINE-READABLE TWIN. The prose above is for humans; everything that reads a
+  // compile result programmatically should read this instead of mining the summary with
+  // a regex (a gate that fails OPEN the moment the wording changes). Both are projections
+  // of the SAME in-memory facts, so they cannot disagree. In-toto Statement v1 + SLSA
+  // Provenance v1 — a specified shape with existing verifiers, not a Nomos dialect.
+  const provenance = buildProvenanceStatement({
+    packageName: cfg.name,
+    domainHash,
+    artifacts: [
+      { name: path.basename(lawUsdzPath) },
+      ...(packageAssetPath === undefined ? [] : [{ name: path.basename(packageAssetPath) }]),
+    ],
+    domains: summary.domains.map((d) => ({
+      domain: d.domain,
+      ...(d.identityHash === undefined ? {} : { identityHash: d.identityHash }),
+      aggregates: d.aggregates,
+      directives: d.directives,
+      queries: d.queries,
+      counts: d.counts,
+      sums: d.sums,
+    })),
+    builder: { id: "https://github.com/Captain-App/nomos2", version: dslVersion },
+  });
+  writeFileSync(
+    path.join(outDir, `${cfg.name}.provenance.json`),
+    renderProvenance(provenance),
+    "utf8",
+  );
+
   // ── 5. the typed TS client (#10 — the web sibling of codegen_dart), with the
   //       deployed law's content hash baked in (emitted AFTER the package is hashed) ──
   const clientPath = path.join(outDir, `${cfg.name}.client.mjs`);