@githolon/dsl 0.108.0 → 0.108.1

package/src/authoring.ts

@@ -36,6 +36,7 @@ import type { PrincipalEvidence } from "./principal_evidence.js";
 import type { Ports } from "./ctx.js";
 import { __qualifyAggregateType, writeTuple } from "./framework/relations.js";
 import { __registerEnsure } from "./attested_core.js";
+import { OWNED_CUSTODY_PROBE, type OwnedCustody } from "./framework/owned_custody_value.js";
 
 // ── the per-dispatch authoring sink — library state the engine never sees (NOT a side channel out of
 //    the sandbox; it is internal to the directive runtime, drained synchronously by `executeDirectiveToIntent`). ──
@@ -45,7 +46,7 @@ let authoringContext: {
   principalRaw: string;
   stamp: string;
   ownedKeySubject: string;
-  ownedCustody?: string;
+  ownedCustody?: OwnedCustody;
   preMintedRecords: { type: string; id: string }[];
 } | undefined;
 /** Clear the sink before a plan runs (called by `executeDirectiveToIntent`). */
@@ -53,7 +54,7 @@ export function __resetAuthoring(
   ctx?: Partial<Pick<Ports, "principal">>,
   stamp = "0",
   ownedKeySubject = `key:${"0".repeat(64)}`,
-  ownedCustody: string | null = "{\"nomosProbe\":true}",
+  ownedCustody: OwnedCustody | null = OWNED_CUSTODY_PROBE,
   preMintedRecords: readonly { type: string; id: string }[] = [],
 ): void {
   sink = [];

package/src/births.ts

@@ -33,6 +33,20 @@ export interface BirthRecipe {
   readonly workspace: string;
   /** The genesis chain: the ordered steps the child runs through its OWN gate to validate itself from intent 0. */
   readonly genesisChain: unknown;
+  /** Target-owned roles granted at genesis to the cryptographically verified immediate parent workspace.
+   * Values are law constants; the kernel supplies the parent workspace id after verifying the birth. */
+  readonly parentWorkspaceRoles?: readonly WorkspaceRole[];
+}
+
+declare const WORKSPACE_ROLE: unique symbol;
+export type WorkspaceRole = string & { readonly [WORKSPACE_ROLE]: true };
+
+/** Name a target relation that a born workspace will grant to its verified immediate parent. */
+export function workspaceRole<const Name extends string>(name: Name): Name & WorkspaceRole {
+  if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(name)) {
+    throw new Error(`workspaceRole: '${name}' is not a valid relation name`);
+  }
+  return name as Name & WorkspaceRole;
 }
 
 // ── the per-dispatch birth footprint — library state drained by `executeDirectiveToIntent` (mirrors the
@@ -89,6 +103,7 @@ export interface BusinessBirthDecl<
   readonly founderScope: string;
   /** Explicit policy inherited by the BORN workspace. Zero declares a leaf workspace. */
   readonly maxChildWorkspacesPerUser: number;
+  readonly parentWorkspaceRoles: readonly WorkspaceRole[];
   /** @internal Compiler-derived namespaces installed into the born workspace. The declaration owns
    * the value; this list only repeats that value wherever the composed law requires its own state. */
   __nomosBirthPolicyDomains?: readonly string[];
@@ -127,6 +142,10 @@ export interface BusinessBirthSpec<F extends Record<string, Field>> {
   readonly children: {
     readonly maxWorkspacesPerUser: number;
   };
+  /** Roles the born workspace grants to the verified immediate parent workspace at genesis. */
+  readonly parentWorkspace?: {
+    readonly roles: readonly WorkspaceRole[];
+  };
   /** Additional atomic business initialization which belongs to the same birth. */
   readonly initialise?: (
     root: AggregateRef<F>,
@@ -194,6 +213,7 @@ export function birth<F extends Record<string, Field>>(
           "zero declares a leaf workspace and Nomos has no compiled fallback",
       );
     }
+    const parentWorkspaceRoles = [...new Set(spec.parentWorkspace?.roles ?? [])].sort();
     type Payload = BusinessBirthPayload<F>;
     const aggregateNoun = aggregate.id
       .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
@@ -221,6 +241,7 @@ export function birth<F extends Record<string, Field>>(
       founderRoles,
       founderScope,
       maxChildWorkspacesPerUser,
+      parentWorkspaceRoles,
       ...(spec.namespace !== undefined ? { namespace: spec.namespace } : {}),
     };
     const inDomain = (domain: string): BusinessBirthDecl<Payload, F> => {

package/src/build_package.ts

@@ -574,6 +574,36 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const queryById = new Map<string, QueryDecl>();
   for (const query of spec.queries ?? []) queryById.set(query.id, query);
   const queries = [...queryById.values()];
+  // A directive's `.reads(query)` retains the complete typed declaration. It is
+  // executable law, even when the query is intentionally absent from the
+  // tenant's presentation exports. Keep the named composer equivalent to the
+  // package compiler: seat each captured read once and mark compiler-carried
+  // declarations private rather than making test/client code invent a second
+  // query list.
+  for (const directive of directives) {
+    for (const declared of directive.declaredQueryReads ?? []) {
+      const existing = queryById.get(declared.id);
+      if (existing !== undefined) {
+        if (
+          existing.returns !== declared.returns ||
+          JSON.stringify(existing.key) !== JSON.stringify(declared.key)
+        ) {
+          throw new Error(
+            `domain '${domain}': captured read '${declared.id}' has conflicting declarations ` +
+              `(exported ${existing.returns}[${existing.key.join(",")}], directive ` +
+              `${directive.id} ${declared.returns}[${declared.key.join(",")}])`,
+          );
+        }
+        continue;
+      }
+      const internal = {
+        ...declared,
+        businessBirthInternal: true as const,
+      } as QueryDecl;
+      queries.push(internal);
+      queryById.set(internal.id, internal);
+    }
+  }
   for (const policy of applicationLanguage?.workspaceSharing ?? []) {
     if (!queries.some((candidate) => candidate.id === policy.invitationLaw.pendingByRecipient.id)) {
       queries.push(policy.invitationLaw.pendingByRecipient);

package/src/business_birth.ts

@@ -1,7 +1,14 @@
 // NOMOS — one business birth at the tenant surface; compute-science mechanics lower here.
 
 import { z } from "zod";
-import { BUSINESS_BIRTH_SEED_PAYLOAD_FIELD, OWNED_READ_RELATION } from "./aggregate.js";
+import {
+  BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
+  OWNED_CUSTODY_PAYLOAD_FIELD,
+  OWNED_KEY_PAYLOAD_FIELD,
+  OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
+  OWNED_READ_RELATION,
+} from "./aggregate.js";
+import { OwnedCustodyValue } from "./framework/owned_custody_value.js";
 import { ensure } from "./authoring.js";
 import { directive, type Directive } from "./directive.js";
 import {
@@ -11,12 +18,14 @@ import {
   type BusinessBirthDecl,
   type ParentAttestedBirthMarker,
 } from "./births.js";
-import { readFrameworkDeclared } from "./read.js";
 import type { Field } from "./fields.js";
 import {
   AuthProvider,
   authProvider,
+  authProviderCertificates,
+  authProviderKeys,
   authProviderSeedBeforeWarrant,
+  readAuthProviderVerifyingConfiguration,
   seedAuthProvider,
   setAuthProvider,
 } from "./framework/auth_provider_law.js";
@@ -90,6 +99,7 @@ export interface BusinessBirthMetadata {
   /** Private proof/lowering policy; omitted from every generated tenant payload. */
   readonly founderRoles: readonly string[];
   readonly founderScope: string;
+  readonly parentWorkspaceRoles: readonly import("./births.js").WorkspaceRole[];
 }
 
 export interface BusinessBirthDirective
@@ -179,8 +189,15 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     principal: z.string().min(1),
     bornAt: z.string().min(1),
   });
+  const seedCarrierSchema = seedSchema.extend({
+    [OWNED_KEY_PAYLOAD_FIELD]: z.string().min(1).optional(),
+    [OWNED_CUSTODY_PAYLOAD_FIELD]: OwnedCustodyValue.zod.optional(),
+    [OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD]: z
+      .array(z.object({ type: z.string().min(1), id: z.string().min(1) }))
+      .optional(),
+  });
   const parentSchema = seedSchema.extend({
-    ...(encryptedBirth ? { [BUSINESS_BIRTH_SEED_PAYLOAD_FIELD]: z.string().min(1) } : {}),
+    ...(encryptedBirth ? { [BUSINESS_BIRTH_SEED_PAYLOAD_FIELD]: seedCarrierSchema } : {}),
   });
 
   const seedBase = directive(seedId)
@@ -240,22 +257,13 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
       const child = workspaceNameForKey(namespace, String(decl.key(p as P)));
       const childPayload = { ...(p as Record<string, unknown>) };
       if (encryptedBirth) {
-        const rawSeed = childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
-        if (typeof rawSeed !== "string") {
+        const sealedSeed = childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
+        if (sealedSeed === null || typeof sealedSeed !== "object" || Array.isArray(sealedSeed)) {
           throw new Error(
             `birth(${decl.aggregate.id}): Nomos did not carry the internally sealed genesis facts`,
           );
         }
-        let sealed: unknown;
-        try {
-          sealed = JSON.parse(rawSeed);
-        } catch {
-          throw new Error(`birth(${decl.aggregate.id}): the internally sealed genesis facts are malformed`);
-        }
-        if (sealed === null || typeof sealed !== "object" || Array.isArray(sealed)) {
-          throw new Error(`birth(${decl.aggregate.id}): the internally sealed genesis facts are malformed`);
-        }
-        Object.assign(childPayload, sealed as Record<string, unknown>);
+        Object.assign(childPayload, sealedSeed as Record<string, unknown>);
       }
       delete childPayload[BUSINESS_BIRTH_SEED_PAYLOAD_FIELD];
       const chain: Array<Record<string, unknown>> = [
@@ -287,39 +295,32 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
         },
       ];
 
-      const apRows = readFrameworkDeclared<Array<Record<string, unknown>>>("authProvider", { scope: "platform" });
-      const apRaw = Array.isArray(apRows) && apRows.length > 0 ? apRows[0] : undefined;
-      const ap = (apRaw && typeof apRaw === "object" && typeof (apRaw as { data?: unknown }).data === "object"
-        ? (apRaw as { data: Record<string, unknown> }).data
-        : apRaw) as Record<string, unknown> | undefined;
-      const apStr = (k: string): string | undefined => {
-        const v = ap?.[k];
-        return typeof v === "string" && v.length > 0 ? v : undefined;
-      };
-      if (apStr("issuer")) {
+      const inheritedProvider = readAuthProviderVerifyingConfiguration();
+      if (inheritedProvider !== undefined) {
         chain.push({
           domain,
           directiveId: "seedAuthProvider",
           actor: founder,
           payload: {
-            issuer: apStr("issuer"),
-            jwksUrl: apStr("jwksUrl") ?? apStr("issuer"),
-            ...(apStr("keys") ? { keys: apStr("keys") } : {}),
-            ...(apStr("audience") ? { audience: apStr("audience") } : {}),
-            ...(apStr("principalClaim") ? { principalClaim: apStr("principalClaim") } : {}),
-            ...(apStr("rootCert") ? { rootCert: apStr("rootCert") } : {}),
-            ...(apStr("deviceBindingClaim") ? { deviceBindingClaim: apStr("deviceBindingClaim") } : {}),
-            ...(apStr("requireDeviceBinding") ? { requireDeviceBinding: apStr("requireDeviceBinding") } : {}),
-            label: apStr("label") ?? "inherited-from-parent",
+            ...inheritedProvider,
+            label: "inherited-from-parent",
             setBy: founder,
             setAt: 1,
           },
         });
       }
-      birth({ workspace: child, genesisChain: chain });
+      birth({
+        workspace: child,
+        genesisChain: chain,
+        ...(decl.parentWorkspaceRoles.length > 0
+          ? { parentWorkspaceRoles: decl.parentWorkspaceRoles }
+          : {}),
+      });
       return [];
     })
     .reads(authProvider)
+    .reads(authProviderKeys)
+    .reads(authProviderCertificates)
     .births();
 
   const metadata: BusinessBirthMetadata = {
@@ -340,6 +341,7 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     ],
     founderRoles: decl.founderRoles,
     founderScope: decl.founderScope,
+    parentWorkspaceRoles: decl.parentWorkspaceRoles,
   };
   const parent = {
     ...birthBase,
@@ -376,6 +378,8 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
     __nomos_authProviderSeedBeforeWarrant: internalSurface(authProviderSeedBeforeWarrant),
     __nomos_setAuthProvider: internalDirective(setAuthProvider),
     __nomos_authProvider: internalSurface(authProvider),
+    __nomos_authProviderKeys: internalSurface(authProviderKeys),
+    __nomos_authProviderCertificates: internalSurface(authProviderCertificates),
     // Obscure framework export keys minimize accidental tenant collisions. Stable law ids remain the real
     // identity; the generic composition seam rejects a tenant-owned declaration with any of those ids.
     __nomos_NomosBirthRecord: internalSurface(NomosBirthRecord),