@githolon/dsl 0.107.4 → 0.108.1

package/src/wire_encode.ts

@@ -20,6 +20,8 @@
  * LATER coordinated migration — we target the current serde_json shape now.
  */
 import type { z } from "zod";
+import { voMetaOf } from "./value_object.js";
+import { OwnedCustodyValue, OwnedDeviceRequestValue } from "./framework/owned_custody_value.js";
 
 import { encodeDriver } from "./drivers.js";
 import { __qualifyAggregateType, __setDispatchDomain } from "./framework/relations.js";
@@ -40,6 +42,7 @@ import {
 } from "./aggregate.js";
 import { admitsNull, type Field, type EvidenceRefValue } from "./fields.js";
 import type { Directive, ReferentialMarker } from "./directive.js";
+import { isBusinessIntent } from "./intent.js";
 import type { PlannedOp, FieldOp } from "./ops.js";
 import { deterministicPorts, type Ports } from "./ctx.js";
 import type { PrincipalFacet } from "./principal_evidence.js";
@@ -174,6 +177,15 @@ function encodeKernelValue(field: Field | undefined, value: unknown, op?: FieldO
       },
     };
   }
+  // Framework-owned custody is a nominal kernel value. It uses the same authored value-object
+  // descriptor as generated TS/Dart clients, but never falls through to the tenant `Json` escape
+  // hatch merely because value objects currently share the DSL's wholesale-LWW field kind.
+  if (field?.kind === "json" && voMetaOf(field.zod)?.name === OwnedCustodyValue.name) {
+    return { OwnedCustody: OwnedCustodyValue.zod.parse(value) };
+  }
+  if (field?.kind === "json" && voMetaOf(field.zod)?.name === OwnedDeviceRequestValue.name) {
+    return { OwnedDeviceRequest: OwnedDeviceRequestValue.zod.parse(value) };
+  }
   // A `t.json()` leaf lowers to the FIRST-CLASS kernel `Value::Json` (RFC 8785 / JCS), NOT a
   // `Value::Str` holding JSON-shaped text. Checked BEFORE the scalar fallthroughs so EVERY json
   // value — object, array, string, number, boolean, null — commits as one consistent value kind
@@ -321,6 +333,7 @@ export function executeDirectiveToIntent<P>(
   agg: AggregateHandle,
   payload: NoInfer<P>,
   ctx: Ports,
+  encodeWorkspaceEffect?: (target: Directive<unknown>, payload: unknown, workspace: string) => Uint8Array,
 ): WireIntent {
   if (directive.aggregateId !== agg.id) {
     throw new Error(
@@ -373,7 +386,7 @@ export function executeDirectiveToIntent<P>(
     ctx,
     String(hlc.physical),
     typeof ownedKeySubject === "string" ? ownedKeySubject : undefined,
-    typeof ownedCustody === "string" ? ownedCustody : null,
+    ownedCustody === undefined ? null : OwnedCustodyValue.zod.parse(ownedCustody),
     preMintedRecords,
   );
   __resetReads();
@@ -405,6 +418,36 @@ export function executeDirectiveToIntent<P>(
     for (const b of births) meterOps.push(...planBirthRecordOps(b, subject, bornAt));
   }
   const planned = [...__drainAuthoring(), ...returned, ...meterOps];
+  const workspaceEffects = isBusinessIntent(directive)
+    ? directive.workspaceEffects.map((effect) => {
+        if (encodeWorkspaceEffect === undefined) {
+          throw new Error(
+            `Directive '${directive.id}' declares a workspace effect, but its compiled plan has no target-call encoder`,
+          );
+        }
+        const workspace = effect.destination.kind === "workspace"
+          ? effect.destination.address(parsed)
+          : "";
+        if (effect.destination.kind === "workspace" && workspace.trim().length === 0) {
+          throw new Error(`Directive '${directive.id}' produced an empty target workspace address`);
+        }
+        const targetPayload = effect.target.payloadSchema.parse(effect.payload(parsed));
+        return {
+          destination: effect.destination.kind === "workspace"
+            ? { workspace }
+            : effect.destination.kind === "verifiedParent"
+            ? { verifiedParent: true as const }
+            : { verifiedSource: true as const },
+          targetCallUsda: encodeWorkspaceEffect(
+            effect.target as Directive<unknown>,
+            targetPayload,
+            workspace,
+          ),
+        };
+      })
+    : [];
+  // Workspace-effect payload mappers are source law and may perform declared captured reads while
+  // constructing the target payload. Drain only after both local and cross-workspace consequences.
   const reads = __drainReads();
 
   // Partition the plan output: STRIKE ops route onto the intent's `strikes` channel
@@ -523,6 +566,7 @@ export function executeDirectiveToIntent<P>(
     ...(reads.length ? { reads } : {}),
     ...(endorse.length ? { endorse } : {}),
     ...(births.length ? { births } : {}),
+    ...(workspaceEffects.length ? { workspaceEffects } : {}),
   };
 }
 

package/src/workspace_sharing.ts

@@ -60,6 +60,32 @@ export interface WorkspaceSharingInvitationLaw {
   readonly pendingByRecipient: QueryDecl;
 }
 
+/** The one framework-owned invitation redemption payload. Individual business
+ * sharing policies choose the directive id and projection fields, but never a
+ * second wire shape. Compiler and host contracts are generated from this same
+ * schema. */
+export const workspaceSharingInvitationRedeemPayload = z.object({
+  orderId: z.string().min(1),
+  object: z.string().min(1),
+  relation: z.string().min(1),
+  invitationPublicKey: z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64"),
+  invitationSignature: z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64"),
+  invitationId: z.string().regex(/^nomos-invitation-[0-9a-f]{64}$/),
+  redeemedAt: z.string().min(1),
+});
+
+/** The private bearer material transported in an invitation URL fragment.
+ * This is canonical USDA, not a JSON web protocol. The literal is part of the
+ * typed framework schema so both generated clients refuse another generation. */
+export const WORKSPACE_SHARING_INVITATION_FORMAT = "nomos-invitation-v1" as const;
+
+export const workspaceSharingInvitationMaterialPayload = z.object({
+  format: z.literal(WORKSPACE_SHARING_INVITATION_FORMAT),
+  source: z.string().min(1),
+  secret: z.string().min(1),
+  publicKey: z.string().min(1),
+});
+
 /**
  * Fold the generated invitation law into the same export bag consumed by both
  * package composition and the executable engine registry. Keeping one seam is
@@ -189,19 +215,10 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
       .returns(options.orders),
     businessBirthInternal: true as const,
   };
-  const b64 = z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64");
   const redeem = nomosImplementationDetail({
     ...directive(redeemId)
       .mutates(options.orders)
-      .payload(z.object({
-        orderId: z.string().min(1),
-        object: z.string().min(1),
-        relation: z.string().min(1),
-        invitationPublicKey: b64,
-        invitationSignature: b64,
-        invitationId: z.string().regex(/^nomos-invitation-[0-9a-f]{64}$/),
-        redeemedAt: z.string().min(1),
-      }))
+      .payload(workspaceSharingInvitationRedeemPayload)
       .plan((facts, ctx) => {
         const principal = endorsementOf(ctx.principal().asAttribution())?.principal ?? "";
         const claim = instance(NomosInvitationClaim, facts.invitationId);