@githolon/dsl 0.105.5 → 0.105.7

package/src/framework/owned_custody.ts

@@ -2,11 +2,11 @@
 // Tenant code sees only generated `devices.request()` / `devices.approve(request)`.
 
 import { z } from "zod";
-import { OWNED_KEY_RELATION, OWNED_READ_RELATION, aggregate, instance, ownedKeyObject, type AggregateHandle } from "../aggregate.js";
+import { OWNED_KEY_RELATION, OWNED_PRINCIPAL_OBJECT_TYPE, OWNED_READ_RELATION, aggregate, instance, ownedKeyObject, type AggregateHandle } from "../aggregate.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { endorsementOf } from "../principal_evidence.js";
-import { isRelationTypeDecl } from "../relation_schema.js";
+import { isRelationTypeDecl, key, relationType, self, user } from "../relation_schema.js";
 import { t } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
@@ -19,6 +19,7 @@ import {
   writeWrap,
 } from "./encryption_scope.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
+import { BirthAttestation, seedBirthAttestation } from "./home.js";
 import { RelationTuple, __qualifyAggregateType, removeTuple, writeTuple } from "./relations.js";
 import { SIGNER_RELATION, enrollSigner, signerObject, identityRelations } from "./signing_identity.js";
 import { impureCapability, impureCapabilityAggregate } from "./impure_capability.js";
@@ -27,6 +28,10 @@ import { impureCapability, impureCapabilityAggregate } from "./impure_capability
 export const OWNED_DEVICE_APPROVAL_DIRECTIVE = "nomos_internal_approve_owned_device_7c1f5e";
 export const OWNED_INITIALIZE_DIRECTIVE = "nomos_internal_initialize_owned_identity_7c1f5e";
 export const OWNED_RECOVERY_RELATION = "nomos_internal_owned_recovery_principal_7c1f5e";
+export const ownedCustodyRelations = relationType(OWNED_PRINCIPAL_OBJECT_TYPE)
+  .asGlobal()
+  .relation(OWNED_KEY_RELATION, { rewrite: self(), allow: [key()] })
+  .relation(OWNED_RECOVERY_RELATION, { rewrite: self(), allow: [user()] });
 export const OWNED_RECOVERY_PROTECT_DIRECTIVE = "nomos_internal_protect_owned_identity_7c1f5e";
 export const OWNED_RECOVERY_REQUEST_DIRECTIVE = "nomos_internal_request_owned_recovery_7c1f5e";
 export const OWNED_RECOVERY_COMPLETE_DIRECTIVE = "nomos_internal_complete_owned_recovery_7c1f5e";
@@ -109,7 +114,33 @@ const ownedRecoveryLifecycle = impureCapability({
   writeReceipt: (id, r) => [
     set(instance(OwnedRecoveryOrder, id), "ownedCustody", r.ownedCustody as string),
   ],
+  // This is intentionally unaddressed: opening the designated principal's ordinary generated
+  // client is the provider. Declaring the capability still matters because every durable Order must
+  // have one typed provider contract; the kernel may then retain the sealed obligation locally until
+  // that principal opens the workspace, rather than inventing an untyped host work description.
+  capability: "nomos.owned-recovery",
 });
+const hiddenRecoveryLifecycle = {
+  aggregate: hidden(OwnedRecoveryOrder),
+  obligation: hidden(ownedRecoveryLifecycle.obligation),
+  complete: hidden(ownedRecoveryLifecycle.complete),
+  fail: hidden(ownedRecoveryLifecycle.fail),
+  block: hidden(ownedRecoveryLifecycle.block),
+  deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
+};
+const ownedRecoveryCapability = {
+  ...ownedRecoveryLifecycle,
+  // Capability expansion deliberately re-seats the lifecycle quartet after application-language
+  // closure. Carry the private declarations there too; pointing back at the raw impure-capability
+  // declarations silently reintroduced framework verbs into proof selection and generated names.
+  aggregate: hiddenRecoveryLifecycle.aggregate,
+  obligation: hiddenRecoveryLifecycle.obligation,
+  complete: hiddenRecoveryLifecycle.complete,
+  fail: hiddenRecoveryLifecycle.fail,
+  block: hiddenRecoveryLifecycle.block,
+  deadLetter: hiddenRecoveryLifecycle.deadLetter,
+  __isCapabilityDecl: true as const,
+};
 
 export const ownedRecoveryOrdersByRecoveryPrincipal = query("nomosOwnedRecoveryOrdersByRecoveryPrincipal")
   .key("recoveryPrincipal")
@@ -157,7 +188,7 @@ const protectOwnedIdentity = Object.assign(
     .alsoEnsures(RelationTuple)
     .alsoEnsures(KeyScope)
     .alsoEnsures(WrappedKey),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
 const acceptOwnedRecovery = Object.assign(
@@ -181,18 +212,9 @@ const acceptOwnedRecovery = Object.assign(
         ownedCustody: p.ownedCustody,
       });
     }),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
-const hiddenRecoveryLifecycle = {
-  aggregate: hidden(OwnedRecoveryOrder),
-  obligation: hidden(ownedRecoveryLifecycle.obligation),
-  complete: hidden(ownedRecoveryLifecycle.complete),
-  fail: hidden(ownedRecoveryLifecycle.fail),
-  block: hidden(ownedRecoveryLifecycle.block),
-  deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
-};
-
 export type OwnedRecordAction = "share" | "unshare" | "transfer";
 
 /** One collision-resistant framework id per aggregate/action. Tenant code never sees these ids. */
@@ -256,6 +278,7 @@ const approval = directive(OWNED_DEVICE_APPROVAL_DIRECTIVE)
 /** Branded internal so ordinary directive codegen never exposes its cryptographic payload. */
 export const approveOwnedDevice = Object.assign(approval, {
   businessBirthInternal: true as const,
+  ownedAuthoringInternal: true as const,
 });
 
 /** Establish this principal's shared owned-data root before another principal shares to them. */
@@ -281,7 +304,7 @@ const initializeOwnedIdentity = Object.assign(
         ownedCustody: p.ownedCustody,
       });
     }),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
 function recordScope(aggregate: AggregateHandle, recordId: string): string {
@@ -295,7 +318,10 @@ function recordObject(aggregate: AggregateHandle, recordId: string): string {
 function ownedRecordActionDirectives(aggregate: AggregateHandle) {
   const share = Object.assign(
     directive(ownedRecordActionDirectiveId("share", aggregate.id))
-      .ensures(WrappedKey)
+      // The owned business record is the semantic target. Relation tuples and wraps are framework
+      // effects of sharing it; making a wrap the primary target causes authenticated law to describe
+      // this as a key action and the kernel correctly refuses `share(record, person)`.
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         peer: principal,
@@ -313,13 +339,14 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         }),
         ...p.wraps.flatMap((entry) => writeWrap(recordScope(aggregate, p.recordId), entry.epoch, entry)),
       ])
-      .alsoEnsures(RelationTuple),
-    { businessBirthInternal: true as const },
+      .alsoEnsures(RelationTuple)
+      .alsoEnsuresMany(WrappedKey),
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   const unshare = Object.assign(
     directive(ownedRecordActionDirectiveId("unshare", aggregate.id))
-      .ensures(KeyScope)
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         peer: principal,
@@ -340,14 +367,15 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         ...writeKeyEpoch(recordScope(aggregate, p.recordId), p.epoch, p.changedAt, p.wraps),
       ])
       .alsoEnsures(RelationTuple)
+      .alsoEnsures(KeyScope)
       .alsoEnsuresMany(WrappedKey),
-    { businessBirthInternal: true as const },
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   const ownerField = aggregate.audience?.kind === "owned" ? aggregate.audience.ownerField : "";
   const transfer = Object.assign(
     directive(ownedRecordActionDirectiveId("transfer", aggregate.id))
-      .ensures(KeyScope)
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         newOwner: principal,
@@ -383,9 +411,9 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         return ops;
       })
       .alsoEnsuresMany(RelationTuple)
-      .alsoMutates(aggregate)
+      .alsoEnsures(KeyScope)
       .alsoEnsuresMany(WrappedKey),
-    { businessBirthInternal: true as const },
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   return { share, unshare, transfer };
@@ -393,8 +421,11 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
 
 const APPROVAL_EXPORT = "__nomos_owned_device_approval_7c1f5e";
 const IDENTITY_EXPORT = "__nomos_owned_identity_relations_7c1f5e";
+const CUSTODY_RELATIONS_EXPORT = "__nomos_owned_custody_relations_7c1f5e";
 const WARRANT_EXPORT = "__nomos_owned_genesis_warrant_7c1f5e";
 const SEED_EXPORT = "__nomos_owned_seed_genesis_7c1f5e";
+const BIRTH_ATTESTATION_EXPORT = "__nomos_owned_birth_attestation_7c1f5e";
+const BIRTH_ATTESTATION_SEED_EXPORT = "__nomos_owned_seed_birth_attestation_7c1f5e";
 const ENROLL_EXPORT = "__nomos_owned_enroll_signer_7c1f5e";
 const INITIALIZE_EXPORT = "__nomos_owned_initialize_identity_7c1f5e";
 const KEY_SCOPE_EXPORT = "__nomos_owned_key_scope_7c1f5e";
@@ -411,11 +442,15 @@ const RECOVERY_FAIL_EXPORT = "__nomos_owned_recovery_fail_7c1f5e";
 const RECOVERY_BLOCK_EXPORT = "__nomos_owned_recovery_block_7c1f5e";
 const RECOVERY_DEAD_LETTER_EXPORT = "__nomos_owned_recovery_dead_letter_7c1f5e";
 const RECOVERY_QUERY_EXPORT = "__nomos_owned_recovery_query_7c1f5e";
+const RECOVERY_CAPABILITY_EXPORT = "__nomos_owned_recovery_capability_7c1f5e";
 
 const ownedGenesisWarrant = hidden(GenesisWarrant);
 const ownedSeedGenesis = hidden(seedGenesis);
+const ownedBirthAttestation = hidden(BirthAttestation);
+const ownedSeedBirthAttestation = hidden(seedBirthAttestation);
 const ownedEnrollSigner = hidden(enrollSigner);
 const ownedIdentityRelations = hidden(identityRelations);
+const ownedCustodyRelationLaw = hidden(ownedCustodyRelations);
 
 /**
  * The published CLI bundles its compiler while a tenant module imports declarations from the separately
@@ -476,6 +511,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [RECOVERY_BLOCK_EXPORT, hiddenRecoveryLifecycle.block],
     [RECOVERY_DEAD_LETTER_EXPORT, hiddenRecoveryLifecycle.deadLetter],
     [RECOVERY_QUERY_EXPORT, hidden(ownedRecoveryOrdersByRecoveryPrincipal)],
+    [RECOVERY_CAPABILITY_EXPORT, hidden(ownedRecoveryCapability)],
   ] as const;
 
   // These names are deliberately obscure, not magical. A tenant can still reach one accidentally or
@@ -489,6 +525,10 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
       && !sameFrameworkDeclaration(mod[IDENTITY_EXPORT], ownedIdentityRelations)) {
     reservedCollision(IDENTITY_EXPORT);
   }
+  if (Object.prototype.hasOwnProperty.call(mod, CUSTODY_RELATIONS_EXPORT)
+      && !sameFrameworkDeclaration(mod[CUSTODY_RELATIONS_EXPORT], ownedCustodyRelationLaw)) {
+    reservedCollision(CUSTODY_RELATIONS_EXPORT);
+  }
   for (const [key, generated] of recoveryInjections) {
     if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
       reservedCollision(key);
@@ -497,6 +537,8 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
   for (const [key, generated] of [
     [WARRANT_EXPORT, ownedGenesisWarrant],
     [SEED_EXPORT, ownedSeedGenesis],
+    [BIRTH_ATTESTATION_EXPORT, ownedBirthAttestation],
+    [BIRTH_ATTESTATION_SEED_EXPORT, ownedSeedBirthAttestation],
     [ENROLL_EXPORT, ownedEnrollSigner],
   ] as const) {
     if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
@@ -526,6 +568,8 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     for (const [framework, generated] of [
       [GenesisWarrant, ownedGenesisWarrant],
       [seedGenesis, ownedSeedGenesis],
+      [BirthAttestation, ownedBirthAttestation],
+      [seedBirthAttestation, ownedSeedBirthAttestation],
       [enrollSigner, ownedEnrollSigner],
     ] as const) {
       if (
@@ -546,6 +590,14 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     ) {
       reservedCollision(`global relation type '${identityRelations.type}'`);
     }
+    if (
+      !sameFrameworkDeclaration(value, ownedCustodyRelationLaw)
+      && isRelationTypeDecl(value)
+      && value.global === true
+      && value.type === ownedCustodyRelations.type
+    ) {
+      reservedCollision(`global relation type '${ownedCustodyRelations.type}'`);
+    }
     if (value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string") {
       const id = (value as { id: string }).id;
       const generated = actions.flatMap((entry) => [entry.share, entry.unshare, entry.transfer]);
@@ -560,6 +612,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [APPROVAL_EXPORT]: approveOwnedDevice,
     [INITIALIZE_EXPORT]: initializeOwnedIdentity,
     [IDENTITY_EXPORT]: ownedIdentityRelations,
+    [CUSTODY_RELATIONS_EXPORT]: ownedCustodyRelationLaw,
     [KEY_SCOPE_EXPORT]: hidden(KeyScope),
     [WRAPPED_KEY_EXPORT]: hidden(WrappedKey),
     [KEY_SCOPE_QUERY_EXPORT]: hidden(keyScopeByScope),
@@ -574,11 +627,14 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [RECOVERY_BLOCK_EXPORT]: hiddenRecoveryLifecycle.block,
     [RECOVERY_DEAD_LETTER_EXPORT]: hiddenRecoveryLifecycle.deadLetter,
     [RECOVERY_QUERY_EXPORT]: hidden(ownedRecoveryOrdersByRecoveryPrincipal),
+    [RECOVERY_CAPABILITY_EXPORT]: hidden(ownedRecoveryCapability),
     // A local law test starts from an empty root, while production business state is normally born into a
     // warranted child. Keep the same lawful bootstrap machinery available in both cases, but framework-only:
     // the harness can seat its test identity and warrant the root without adding a tenant-facing lane.
     [WARRANT_EXPORT]: ownedGenesisWarrant,
     [SEED_EXPORT]: ownedSeedGenesis,
+    [BIRTH_ATTESTATION_EXPORT]: ownedBirthAttestation,
+    [BIRTH_ATTESTATION_SEED_EXPORT]: ownedSeedBirthAttestation,
     [ENROLL_EXPORT]: ownedEnrollSigner,
   };
   for (const { aggregate, share, unshare, transfer } of actions) {

package/src/identity_model.ts

@@ -0,0 +1,123 @@
+import type { StableIds } from "./stable_ids_types.js";
+import type { WireSchema } from "./wire.js";
+import { mintGlobalAggregateSid } from "./stable_ids.js";
+import {
+  LAW_FRAMEWORK_PARENT,
+  emptyLawIdentityRegistry,
+  lawEntityKey,
+  validateLawIdentityRegistry,
+  type LawIdentityEntity,
+  type LawIdentityRegistry,
+} from "./law_identity.js";
+
+export interface CompilerIdentityDomain {
+  stableIds: StableIds;
+  schemas?: Record<string, WireSchema>;
+}
+
+/** The materialized lock shape consumed inside the compiler and authoring tools. */
+export interface CompilerIdentityModel {
+  v: 1;
+  domains: Record<string, CompilerIdentityDomain>;
+  /** Compiler-owned entity identity, including retirements. Semantics remain exclusively in USDA. */
+  identity?: LawIdentityRegistry;
+}
+
+/**
+ * Derive the compiler entity registry from domain/aggregate/field SIDs when a first-generation
+ * identity layer has no explicit registry yet. Once present, that registry retains every retirement.
+ */
+export function identityRegistryFromModel(
+  model: CompilerIdentityModel | undefined,
+): LawIdentityRegistry {
+  if (model?.identity !== undefined) {
+    validateLawIdentityRegistry(model.identity);
+    return model.identity;
+  }
+  if (model === undefined) return emptyLawIdentityRegistry();
+
+  const entities: Record<string, LawIdentityEntity> = {};
+  const aggregateOccurrences = new Map<string, number>();
+  for (const domain of Object.values(model.domains)) {
+    for (const aggregate of Object.values(domain.stableIds.aggregates)) {
+      aggregateOccurrences.set(aggregate.sid, (aggregateOccurrences.get(aggregate.sid) ?? 0) + 1);
+    }
+  }
+
+  for (const [domainName, domain] of Object.entries(model.domains).sort(([a], [b]) =>
+    compareText(a, b),
+  )) {
+    const domainKey = importIdentityEntity(entities, {
+      kind: "domain",
+      sid: domain.stableIds.domain,
+      label: domainName,
+      generation: 0,
+      status: "active",
+    });
+    for (const [aggregateName, aggregate] of Object.entries(domain.stableIds.aggregates).sort(
+      ([a], [b]) => compareText(a, b),
+    )) {
+      const parent =
+        (aggregateOccurrences.get(aggregate.sid) ?? 0) > 1 ||
+        aggregate.sid === mintGlobalAggregateSid(aggregateName)
+          ? LAW_FRAMEWORK_PARENT
+          : domainKey;
+      const aggregateKey = importIdentityEntity(entities, {
+        kind: "aggregate",
+        sid: aggregate.sid,
+        parent,
+        label: aggregateName,
+        ...(aggregate.was === undefined ? {} : { priorLabels: aggregate.was }),
+        generation: 0,
+        status: "active",
+      });
+      for (const [fieldName, field] of Object.entries(aggregate.fields).sort(([a], [b]) =>
+        compareText(a, b),
+      )) {
+        importIdentityEntity(entities, {
+          kind: "field",
+          sid: field.sid,
+          parent: aggregateKey,
+          label: fieldName,
+          ...(field.was === undefined ? {} : { priorLabels: field.was }),
+          generation: 0,
+          status: "active",
+        });
+      }
+    }
+  }
+
+  const registry: LawIdentityRegistry = {
+    v: 1,
+    entities: Object.fromEntries(Object.entries(entities).sort(([a], [b]) => compareText(a, b))),
+  };
+  validateLawIdentityRegistry(registry);
+  return registry;
+}
+
+function importIdentityEntity(
+  entities: Record<string, LawIdentityEntity>,
+  entity: LawIdentityEntity,
+): string {
+  const key = lawEntityKey(entity.kind, entity.sid);
+  const prior = entities[key];
+  if (prior === undefined) {
+    entities[key] = entity;
+    return key;
+  }
+  if (
+    prior.kind !== entity.kind ||
+    prior.parent !== entity.parent ||
+    prior.label !== entity.label ||
+    JSON.stringify(prior.priorLabels ?? []) !== JSON.stringify(entity.priorLabels ?? [])
+  ) {
+    throw new Error(
+      `NMS-ID-002 legacy SID ${key} aliases incompatible ${prior.kind} '${prior.label}' and ${entity.kind} '${entity.label}'`,
+    );
+  }
+  return key;
+}
+
+function compareText(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}