@githolon/dsl 0.107.4 → 0.108.1

package/src/law_value_type.ts

@@ -1,5 +1,16 @@
 import type { z } from "zod";
 import { enumTypeNameOf } from "./enum_type.js";
+import { isGitObjectIdSchema, isSha256DigestSchema } from "./fields.js";
+import { recipientMetaOf } from "./recipient.js";
+import {
+  NOMOS_UNIT_BRAND,
+  brandedIdMetaOf,
+  idOfMetaOf,
+  idOfTargetKindOf,
+  refOfMetaOf,
+  versionedRefOfMetaOf,
+  voMetaOf,
+} from "./value_object.js";
 import {
   zodArrayElement,
   zodDef,
@@ -24,7 +35,33 @@ export interface LawValueMember {
   readonly value: LawValueType;
 }
 
-export type LawValueType =
+/**
+ * Nominal meaning carried by an otherwise structural value.
+ *
+ * These markers are lowered from the authored DSL once, into the transient law
+ * graph. Language generators must consume these markers instead of consulting
+ * Zod brands independently. They are semantic type facts, not host API or
+ * presentation metadata.
+ */
+export type LawValueSemantic =
+  | { readonly kind: "sha256-digest" | "git-object-id" }
+  | { readonly kind: "branded-id" | "unit" | "value-object"; readonly name: string }
+  | { readonly kind: "recipient"; readonly subject: "User" }
+  | {
+      readonly kind: "id-reference" | "address-reference";
+      readonly target: string;
+      readonly targetKind: "aggregate" | "contract";
+    }
+  | {
+      readonly kind: "versioned-reference";
+      readonly target: string;
+      readonly targetKind: "aggregate" | "contract";
+      readonly series: string;
+      readonly seriesKind: "aggregate" | "contract";
+      readonly currentField: string;
+    };
+
+type LawValueShape =
   | { readonly kind: "string" | "number" | "integer"; readonly constraints: readonly LawValueConstraint[] }
   | { readonly kind: "boolean" | "null" | "unknown" }
   | { readonly kind: "enum"; readonly values: readonly string[]; readonly name?: string }
@@ -38,6 +75,8 @@ export type LawValueType =
   | { readonly kind: "recursive"; readonly anchor: string; readonly value: LawValueType }
   | { readonly kind: "recursive-ref"; readonly anchor: string };
 
+export type LawValueType = LawValueShape & { readonly semantic?: LawValueSemantic };
+
 interface ZodCheck {
   readonly check?: string;
   readonly minimum?: number;
@@ -77,65 +116,72 @@ function lower(
 ): LawValueType {
   const kind = zodKind(schema);
   const def = zodDef(schema) as ZodExtendedDef;
+  // Omission/null wrappers are structural. Their contained value owns the
+  // nominal marker, so generators can unwrap them without duplicating meaning.
+  const semantic = kind === "optional" || kind === "default" || kind === "nullable"
+    ? undefined
+    : semanticOf(schema);
+  const finish = (value: LawValueShape): LawValueType =>
+    semantic === undefined ? value : { ...value, semantic };
   switch (kind) {
     case "string":
-      return { kind: "string", constraints: constraintsOf(def) };
+      return finish({ kind: "string", constraints: constraintsOf(def) });
     case "number": {
       const constraints = constraintsOf(def);
       const integer = def.checks?.some((check) => checkDef(check).format === "safeint") === true;
-      return { kind: integer ? "integer" : "number", constraints };
+      return finish({ kind: integer ? "integer" : "number", constraints });
     }
     case "boolean":
-      return { kind: "boolean" };
+      return finish({ kind: "boolean" });
     case "null":
-      return { kind: "null" };
+      return finish({ kind: "null" });
     case "unknown":
     case "any":
-      return { kind: "unknown" };
+      return finish({ kind: "unknown" });
     case "enum": {
       const name = enumTypeNameOf(schema);
-      return {
+      return finish({
         kind: "enum",
         values: zodEnumValues(schema).sort(compareText),
         ...(name === undefined ? {} : { name }),
-      };
+      });
     }
     case "literal":
-      return { kind: "literal", value: literalOf(def, path) };
+      return finish({ kind: "literal", value: literalOf(def, path) });
     case "array":
-      return { kind: "list", element: lower(zodArrayElement(schema), `${path}[]`, activeLazy) };
+      return finish({ kind: "list", element: lower(zodArrayElement(schema), `${path}[]`, activeLazy) });
     case "record": {
       if (def.valueType === undefined) fail(path, "record has no value type");
-      return { kind: "map", value: lower(def.valueType, `${path}.*`, activeLazy) };
+      return finish({ kind: "map", value: lower(def.valueType, `${path}.*`, activeLazy) });
     }
     case "object":
-      return {
+      return finish({
         kind: "record",
         fields: Object.entries(zodObjectShape(schema))
           .sort(([a], [b]) => compareText(a, b))
           .map(([name, field]) => lowerMember(name, field, path, activeLazy)),
-      };
+      });
     case "union":
-      return {
+      return finish({
         kind: "sum",
         options: (def.options ?? []).map((option, index) =>
           lower(option, `${path}|${index}`, activeLazy)),
-      };
+      });
     case "optional": {
       if (def.innerType === undefined) fail(path, "optional has no inner type");
       return lower(def.innerType, path, activeLazy);
     }
     case "nullable": {
       if (def.innerType === undefined) fail(path, "nullable has no inner type");
-      return { kind: "nullable", value: lower(def.innerType, path, activeLazy) };
+      return finish({ kind: "nullable", value: lower(def.innerType, path, activeLazy) });
     }
     case "default": {
       if (def.innerType === undefined) fail(path, "default has no inner type");
-      return {
+      return finish({
         kind: "default",
         value: lower(def.innerType, path, activeLazy),
         defaultValue: constant(def.defaultValue, path, "default"),
-      };
+      });
     }
     case "lazy": {
       const existing = activeLazy.get(schema);
@@ -144,13 +190,54 @@ function lower(
       activeLazy.set(schema, path);
       const value = lower(def.getter(), path, activeLazy);
       activeLazy.delete(schema);
-      return { kind: "recursive", anchor: path, value };
+      return finish({ kind: "recursive", anchor: path, value });
     }
     default:
       fail(path, `unsupported Zod type '${kind}'`);
   }
 }
 
+function semanticOf(schema: z.ZodTypeAny): LawValueSemantic | undefined {
+  if (isSha256DigestSchema(schema)) return { kind: "sha256-digest" };
+  if (isGitObjectIdSchema(schema)) return { kind: "git-object-id" };
+  const addressed = refOfMetaOf(schema);
+  if (addressed !== undefined) {
+    return {
+      kind: "address-reference",
+      target: addressed.aggregateType,
+      targetKind: addressed.targetKind,
+    };
+  }
+  const versioned = versionedRefOfMetaOf(schema);
+  if (versioned !== undefined) {
+    return {
+      kind: "versioned-reference",
+      target: versioned.targetAggregateType,
+      targetKind: versioned.targetKind,
+      series: versioned.seriesAggregateType,
+      seriesKind: versioned.seriesKind,
+      currentField: versioned.currentField,
+    };
+  }
+  const recipient = recipientMetaOf(schema);
+  if (recipient !== undefined) return { kind: "recipient", subject: recipient };
+  const target = idOfMetaOf(schema);
+  if (target !== undefined) {
+    return {
+      kind: "id-reference",
+      target,
+      targetKind: idOfTargetKindOf(schema) ?? "aggregate",
+    };
+  }
+  const brand = brandedIdMetaOf(schema);
+  if (brand !== undefined) return { kind: "branded-id", name: brand };
+  const unit = (schema as unknown as Record<symbol, unknown>)[NOMOS_UNIT_BRAND];
+  if (typeof unit === "string") return { kind: "unit", name: unit };
+  const valueObject = voMetaOf(schema);
+  if (valueObject !== undefined) return { kind: "value-object", name: valueObject.name };
+  return undefined;
+}
+
 function lowerMember(
   name: string,
   schema: z.ZodTypeAny,

package/src/read.ts

@@ -17,6 +17,9 @@
  * it read to justify them. The dev never sees `nomos.read` — they call typed DSL queries; the library
  * routes them here. (See `docs/aggregate_lifecycle_and_relations.md`.)
  */
+import { z } from "zod";
+import type { AggregateHandle, ReadModelRow, StoredFields } from "./aggregate.js";
+import type { Field } from "./fields.js";
 import type { QueryDecl } from "./query.js";
 import type { WireRead, WireReadAttestation } from "./wire.js";
 import { NomosSourceFrontier, sourceFrontierId, __trustFor, __isMonotoneForeignQuery, __ensure } from "./attested_core.js";
@@ -103,6 +106,50 @@ export function readFrameworkDeclared<T = unknown>(queryId: string, args: Record
   return result;
 }
 
+type ProjectionShape<F extends Record<string, Field>> = {
+  [K in keyof F]: z.ZodOptional<F[K]["zod"]>;
+};
+
+/**
+ * Decode one framework query's standard projected rows from the SAME aggregate field declarations
+ * that authored its law. The only type assertion is at the TypeScript `Object.fromEntries` seam:
+ * every runtime member is still obtained from `Field.zod`, so there is no second field-name/type list
+ * and no unvalidated object crosses into a framework plan.
+ *
+ * Historical captured reads may contain either the current `{ type, id, data }` projection envelope
+ * or the earlier flat data row. Both pass through the identical derived schema before being returned.
+ */
+export function readFrameworkDeclaredRows<
+  const Id extends string,
+  F extends Record<string, Field>,
+>(
+  query: QueryDecl,
+  aggregate: AggregateHandle<Id, F>,
+  args: Record<string, string>,
+): Array<ReadModelRow<F>> {
+  if (query.returns !== aggregate.id) {
+    throw new Error(
+      `framework read('${query.id}') declares '${query.returns}', not '${aggregate.id}'`,
+    );
+  }
+  const fields: Readonly<Record<string, Field>> = aggregate.fields;
+  const shape = Object.fromEntries(
+    Object.entries(fields).map(([name, field]) => [name, field.zod.optional()]),
+  ) as ProjectionShape<StoredFields<F>>;
+  const data = z.object(shape).strict() as z.ZodType<ReadModelRow<F>>;
+  // Recognize the envelope before validating its data. If the payload is malformed, validation must
+  // report the actual aggregate field (for example a historical `keys` member), not fall through and
+  // misdiagnose the envelope's `type`/`id` metadata as flat-row fields.
+  const envelope = z.object({ data: z.unknown() }).passthrough();
+  const row = z.union([envelope, z.unknown()])
+    .transform((value) => {
+      const wrapped = envelope.safeParse(value);
+      return wrapped.success ? wrapped.data.data : value;
+    })
+    .pipe(data);
+  return z.array(row).parse(readFrameworkDeclared(query.id, args));
+}
+
 function readForeign<T = unknown>(query: QueryDecl | { id: string }, args: Record<string, string>, from: string): T {
   // ── THE FOREIGN (attested cross-workspace) LANE (slice B — attested_reads_design.md §4.1).
   // The port answers the `{rows, attestation}` wrapper: at AUTHOR the kernel verified the

package/src/read_projection_namespace.ts

@@ -108,6 +108,13 @@ export const GLOBAL_READ_PROJECTION_AGGREGATE_IDS: ReadonlySet<string> = new Set
   "PlatformGrant",
   "CapabilityBinding",
   "AuthProvider",
+  // The kernel reconstructs the active verifier by the framework-owned aggregate
+  // ids/prefixes, and child law copies the same typed rows across domain boundaries.
+  // Namespacing these two types made identical framework queries domain-local:
+  // bootstrap wrote application-home.AuthProviderKey while a tenant Home birth
+  // read home.AuthProviderKey, silently dropping every verifier key.
+  "AuthProviderKey",
+  "AuthProviderCertificate",
   "HostnameClaim",
   // governance postures (managed / sovereign) — the tenant-owned posture singleton + consent facts
   "GovernancePosture",

package/src/shape_compat.ts

@@ -23,7 +23,8 @@
 // is reported precisely).
 
 import { z } from "zod";
-import { introspectPayload, type DomainModule, type PayloadFieldSpec } from "./codegen_dart.js";
+import type { DomainModule } from "./codegen_dart.js";
+import { lowerLawValueType, type LawValueType } from "./law_value_type.js";
 import type { StableIds } from "./stable_ids_types.js";
 import type { Field } from "./fields.js";
 import { isBusinessIntent } from "./intent.js";
@@ -113,46 +114,40 @@ export interface CompatVerdict {
   readonly incompatible: string[];
 }
 
-/** Normalize a directive payload field to a language-neutral kind from its introspected
- *  spec (the SAME `introspectPayload` the Dart/TS clients are generated from, so both
- *  sides of a comparison speak one vocabulary). */
-function payloadFieldKind(spec: PayloadFieldSpec): string {
-  switch (spec.toJson) {
+/** Normalize the canonical language-neutral DSL value graph to the compatibility
+ * vocabulary. Language generators are projections of this graph, never authorities
+ * for it. */
+function payloadFieldKind(value: LawValueType): string {
+  switch (value.kind) {
     case "enum":
       return "enum";
-    case "strList":
-      return "set";
-    case "json":
-      return "json";
-    case "wrapped":
-      // typed-id (string wire) or unit (number wire) — the interface sees the WIRE kind.
-      return spec.wrappedScalarKind === "string" ? "string" : "double";
-    case "ref":
-      // NomosRef<T> is aggregate-typed in the client and remains a string id on the wire.
-      return "string";
-    case "addressRef":
-      // A workspace-qualified NomosRef<T> preserves its complete address object.
-      return "json";
-    case "recipient":
-      // Recipient<User> is nominal in clients and an opaque delivery address on the law wire.
+    case "string":
       return "string";
-    case "vo":
-    case "voList":
-      // Interface kinds stay at the base lane for now (the remaining parity work in dart_codegen_parity.md
-      // upgrades these to a first-class "vo" kind) — a VO IS a json leaf structurally.
+    case "integer":
+      return "int";
+    case "number":
+      return "double";
+    case "boolean":
+      return "bool";
+    case "literal":
+      return typeof value.value === "boolean"
+        ? "bool"
+        : typeof value.value === "number"
+          ? Number.isInteger(value.value) ? "int" : "double"
+          : typeof value.value === "string" ? "string" : "json";
+    case "list":
+      return value.element.kind === "string" ? "set" : "json";
+    case "nullable":
+    case "default":
+    case "recursive":
+      return payloadFieldKind(value.value);
+    case "map":
+    case "record":
+    case "sum":
+    case "null":
+    case "unknown":
+    case "recursive-ref":
       return "json";
-    case "scalar":
-    default:
-      switch (spec.dartType) {
-        case "int":
-          return "int";
-        case "double":
-          return "double";
-        case "bool":
-          return "bool";
-        default:
-          return "string";
-      }
   }
 }
 
@@ -198,8 +193,12 @@ export function domainInterface(mod: DomainModule, stableIds?: StableIds): Domai
     const fieldEntries: Array<[string, PayloadFieldShape]> = [];
     const schema = d.businessBirth?.publicPayloadSchema ?? d.payloadSchema;
     if (schema && typeof schema === "object") {
-      for (const spec of introspectPayload(schema as z.ZodTypeAny, enumTypes)) {
-        fieldEntries.push([spec.name, { kind: payloadFieldKind(spec), optional: !!spec.optional }]);
+      const payload = lowerLawValueType(schema as z.ZodTypeAny);
+      if (payload.kind !== "record") {
+        throw new Error(`directive '${d.id}' payload must lower to a typed record`);
+      }
+      for (const field of payload.fields) {
+        fieldEntries.push([field.name, { kind: payloadFieldKind(field.value), optional: !field.required }]);
       }
     }
     dirEntries.push([
@@ -213,16 +212,19 @@ export function domainInterface(mod: DomainModule, stableIds?: StableIds): Domai
   for (const agg of (mod.aggregates ?? []) as Array<{
     id: string;
     fields: Record<string, Field>;
-    internalFields?: readonly string[];
   }>) {
     if (isInternal(agg)) continue;
     const label = agg.id;
     const sa = stableIds?.aggregates?.[label];
     const aggSid = sa?.sid ?? label;
     const fieldEntries: Array<[string, { kind: string; label: string }]> = [];
-    const internal = new Set(agg.internalFields ?? []);
     for (const [fname, f] of Object.entries(agg.fields ?? {})) {
-      if (!f || f.kind === "hasMany" || internal.has(fname)) continue;
+      // This is the workspace's complete structural offer and the input to law-evolution
+      // checking, so framework-managed stored fields belong here too. Only the generated
+      // client's view hides them, in publicClientInterface below. Filtering them at both
+      // seams makes an unchanged private field look deleted when the current offer is
+      // compared with the committed identity ledger.
+      if (!f || f.kind === "hasMany") continue;
       const fsid = sa?.fields?.[fname]?.sid ?? fname;
       const kind = sa?.fields?.[fname]?.kind ?? aggFieldReadKind(f);
       fieldEntries.push([fsid, { kind, label: fname }]);

package/src/stable_ids.ts

@@ -92,6 +92,16 @@ export interface InferredRename {
   readonly sid: string;
 }
 
+/** One authored retirement from the immediately preceding model. Retirement is
+ * semantic evidence that a disappearance is intentional, so it must take
+ * precedence over the shape heuristic used only to infer otherwise-silent
+ * renames. */
+export interface StableIdRetirement {
+  readonly kind: "aggregate" | "field";
+  readonly aggregate: string;
+  readonly field?: string;
+}
+
 /**
  * Derive the stable-id CONTINUITY for one domain from its PRIOR manifest's stableIds
  * (the chain/build holds v's sids) against the CURRENT compile's names.
@@ -120,12 +130,29 @@ export function deriveStableIdContinuity(
   /** The prior canonical manifest's aggregate schemas (keyed by PRIOR name) — when
    * supplied, tightens the field-pair rule to same-driver only. */
   priorSchemas?: Record<string, WireSchema>,
+  /** Explicit candidate-law retirements. Their exact prior SIDs are excluded from
+   * heuristic rename inference; a same-shaped replacement therefore mints its own
+   * identity while an undeclared, genuine rename still carries continuity. */
+  retirements: readonly StableIdRetirement[] = [],
 ): { continuity: StableIds; inferred: InferredRename[] } {
   const inferred: InferredRename[] = [];
   const domainSid = prior?.domain ?? mintDomainSid(domainName);
 
   const priorAggs = prior?.aggregates ?? {};
   const currentNames = new Set(currentAggregates.map((a) => a.id));
+  const explicitlyRetiredSids = new Set<string>();
+  for (const retirement of retirements) {
+    const priorAggregate = priorAggs[retirement.aggregate];
+    if (priorAggregate === undefined) continue;
+    if (retirement.kind === "aggregate") {
+      explicitlyRetiredSids.add(priorAggregate.sid);
+      continue;
+    }
+    const priorField = retirement.field === undefined
+      ? undefined
+      : priorAggregate.fields[retirement.field];
+    if (priorField !== undefined) explicitlyRetiredSids.add(priorField.sid);
+  }
 
   // Pass 1 — name matches.
   const resolved: Record<
@@ -151,7 +178,11 @@ export function deriveStableIdContinuity(
   // Pass 2 — the unambiguous aggregate pair (one disappeared, one appeared, same shape).
   const disappeared = Object.keys(priorAggs).filter((n) => !currentNames.has(n));
   const appeared = currentAggregates.filter((a) => resolved[a.id] === undefined);
-  if (disappeared.length === 1 && appeared.length === 1) {
+  if (
+    disappeared.length === 1 &&
+    appeared.length === 1 &&
+    !explicitlyRetiredSids.has(priorAggs[disappeared[0]!]!.sid)
+  ) {
     const oldName = disappeared[0]!;
     const oldAgg = priorAggs[oldName]!;
     const newAgg = appeared[0]!;
@@ -192,7 +223,11 @@ export function deriveStableIdContinuity(
     }
     const fDisappeared = Object.keys(priorFields).filter((n) => !fieldNames.includes(n));
     const fAppeared = fieldNames.filter((n) => fields[n] === undefined);
-    if (fDisappeared.length === 1 && fAppeared.length >= 1) {
+    if (
+      fDisappeared.length === 1 &&
+      fAppeared.length >= 1 &&
+      !explicitlyRetiredSids.has(priorFields[fDisappeared[0]!]!.sid)
+    ) {
       const oldF = fDisappeared[0]!;
       // Shape gate for a field rename: the DRIVER (merge law) AND the KIND (read
       // type) must be unchanged — a rename is a LABEL move. Among the appeared

package/src/test_call_usda.ts

@@ -0,0 +1,83 @@
+import type { DomainModule } from "./codegen_dart.js";
+import { identityRegistryFromModel, type CompilerIdentityModel } from "./identity_model.js";
+import { discoverLawGraph } from "./law_graph.js";
+import { compileSparseLawGraphUsda } from "./law_graph_usda.js";
+import { stableIdsForModule } from "./stable_ids_for_module.js";
+import { collectValueObjectDescriptors } from "./value_object.js";
+
+/** Build the same canonical graph/path input the package compiler supplies to
+ * the generated-client encoders. Tests must not resurrect a dictionary fallback
+ * merely to exercise a lower-level generator directly. */
+function callUsdaForTestIdentity(
+  module: DomainModule,
+  identityModel?: CompilerIdentityModel,
+  closureModules: readonly DomainModule[] = [module],
+) {
+  // A low-level generator fixture does not compose the framework birth-grant
+  // query that the package compiler supplies.  Keep these tests honest about
+  // the call shape without pretending that unrelated framework reads are part
+  // of the tenant domain under test.
+  const normalize = (candidate: DomainModule): DomainModule => ({
+    ...candidate,
+    aggregates: candidate.aggregates.map((aggregate) =>
+      aggregate.audience === undefined
+        ? { ...aggregate, audience: { kind: "public" as const } }
+        : aggregate),
+    valueObjects: collectValueObjectDescriptors(candidate.aggregates),
+    directives: candidate.directives.map((directive) => ({
+      ...directive,
+      ...((directive as { birthsChild?: boolean }).birthsChild === true
+        ? { declaredQueryReads: [] }
+        : {}),
+    })),
+  });
+  const byName = new Map(
+    [module, ...closureModules].map((candidate) => [candidate.name, normalize(candidate)]),
+  );
+  const graphModules = [...byName.values()];
+  const stableIdsByName = new Map(
+    graphModules.map((candidate) => [candidate.name, stableIdsForModule(candidate)]),
+  );
+  const registry = identityRegistryFromModel(identityModel ?? ({
+    v: 1,
+    domains: Object.fromEntries(
+      graphModules.map((candidate) => [
+        candidate.name,
+        { stableIds: stableIdsByName.get(candidate.name)! },
+      ]),
+    ),
+  } satisfies CompilerIdentityModel));
+  const graphs = graphModules.map((candidate) => discoverLawGraph(
+    candidate,
+    stableIdsByName.get(candidate.name)!,
+    registry,
+  ).graph);
+  const graph = graphs.find((candidate) => candidate.domain.entity.label === module.name);
+  if (graph === undefined) throw new Error(`test law graph '${module.name}' was not composed`);
+  const rendered = compileSparseLawGraphUsda(
+    graph,
+    `/${module.name}.law.usda`,
+    graphs,
+  );
+  return { graph, paths: rendered.paths };
+}
+
+export function callUsdaForTest(module: DomainModule) {
+  return callUsdaForTestIdentity(module);
+}
+
+export function callUsdaForTestWithClosure(
+  module: DomainModule,
+  closureModules: readonly DomainModule[],
+) {
+  return callUsdaForTestIdentity(module, undefined, closureModules);
+}
+
+/** Use the compiler's committed/evolved identity ledger when a runtime regression must author
+ * against an already compiled fixture rather than a first-generation synthetic model. */
+export function callUsdaForTestWithIdentity(
+  module: DomainModule,
+  identityModel: CompilerIdentityModel,
+) {
+  return callUsdaForTestIdentity(module, identityModel);
+}

package/src/wire.ts

@@ -55,9 +55,11 @@ export type WireValue =
         revokedAt?: string;
         validFromEpoch?: number;
         verifiedVia?: string;
-        ownedCustody?: string;
+        ownedCustody?: WireOwnedCustody;
       };
     }
+  | { OwnedCustody: WireOwnedCustody }
+  | { OwnedDeviceRequest: WireOwnedDeviceRequest }
   | { Evidence: WireEvidenceRef }
   // First-class canonical JSON (RFC 8785 / JCS) — the committed form of a `t.json()` leaf. The
   // value rides INLINE (`{Json: <any json>}`), not as a string-of-JSON; the kernel canonicalises
@@ -69,6 +71,25 @@ export type WireValue =
   | { Position: string }
   | { TwoPhaseSet: { adds: string[]; removes: string[] } };
 
+export interface WireOwnedDeviceRequest {
+  v: number;
+  workspace: string;
+  principal: string;
+  scope: string;
+  signingPublic: string;
+  wrappingPublic: string;
+  signature: string;
+}
+
+export interface WireOwnedCustody {
+  v: number;
+  request: WireOwnedDeviceRequest;
+  hpkeEpk: string;
+  ct: string;
+  keyCommitment: string;
+  principalWrappingPublic: string;
+}
+
 /** `EvidenceRef { hash: ContentHash, media_type, byte_length, storage_class }` — the
  * kernel serde shape. `ContentHash(String)` serializes transparently as a bare string
  * (a newtype struct), and `StorageClass` as a bare unit-variant string. */
@@ -166,7 +187,20 @@ export interface WireIntent {
    * child's OWN gate. A verify-input WITNESS (rides the carried `captured_ports`, never the events nor the
    * OID). OMITTED when empty so a birth-free intent is byte-identical to before this existed (the era rule).
    */
-  births?: { workspace: string; genesisChain: unknown }[];
+  births?: {
+    workspace: string;
+    genesisChain: unknown;
+    parentWorkspaceRoles?: readonly import("./births.js").WorkspaceRole[];
+  }[];
+  /** Exact target calls authored by source law. The OpenUSD bytes come from a compiler-generated
+   * encoder for the target Directive object; no public operation string or generic payload crosses. */
+  workspaceEffects?: {
+    destination:
+      | { readonly workspace: string }
+      | { readonly verifiedParent: true }
+      | { readonly verifiedSource: true };
+    targetCallUsda: Uint8Array;
+  }[];
 }
 
 /**