@githolon/dsl 0.108.3 → 0.108.6

package/src/application_topology.ts

@@ -8,11 +8,17 @@ type TopologyDirective = DomainModule["directives"][number] & {
   readonly birthsChild?: unknown;
   readonly businessBirth?: BusinessBirthMetadata;
   readonly businessBirthInternal?: unknown;
+  readonly workspaceEffects?: readonly {
+    readonly target: unknown;
+    readonly destination: { readonly kind?: unknown };
+  }[];
 };
 
 export interface ApplicationTopology {
   /** Co-resident business domains bound to the application workspace. */
   readonly rootDomains: readonly string[];
+  /** Verified ancestor domains that are addressed remotely and never opened on the device plane. */
+  readonly remoteDomains: readonly string[];
   /** Deterministic primary facet for generated narration/scenarios; not a storage-topology choice. */
   readonly homeDomain: string;
   readonly homeModule: DomainModule;
@@ -21,10 +27,10 @@ export interface ApplicationTopology {
 const domainOf = (module: DomainModule): string => module.domain ?? module.name;
 
 const publicLanguageOf = (module: DomainModule): readonly TopologyDirective[] =>
-  (module.applicationIntents ?? module.directives)
-    .filter((directive) =>
-      (directive as TopologyDirective).businessBirthInternal !== true,
-    ) as readonly TopologyDirective[];
+  (module.applicationIntents ?? module.directives).filter(
+    (directive) =>
+      (directive as TopologyDirective).businessBirthInternal !== true
+  ) as readonly TopologyDirective[];
 
 /**
  * Resolve which business domains run together in the application workspace.
@@ -32,13 +38,15 @@ const publicLanguageOf = (module: DomainModule): readonly TopologyDirective[] =>
  * This is deliberately inferred from business law rather than configured as a framework topology knob:
  *
  * Domains are vocabulary, not storage partitions. They are co-resident by default. A declared
- * cross-domain business birth is the evidence that its target belongs in a child workspace.
+ * cross-domain business birth is the evidence that its target belongs in a child workspace; a
+ * verified-parent effect is the equally explicit evidence that its target belongs in an ancestor
+ * workspace and must not be bound into the participant's receiving group.
  *
  * The primary domain is only a deterministic generated-surface/narration choice: an explicit receiving-group
  * language wins, then a literal `home`, then declaration order. It does not move the other root domains.
  */
 export function resolveApplicationTopology(
-  modules: readonly DomainModule[],
+  modules: readonly DomainModule[]
 ): ApplicationTopology {
   if (modules.length === 0) {
     throw new Error("generated application topology has no business domains");
@@ -49,7 +57,7 @@ export function resolveApplicationTopology(
     const domain = domainOf(module);
     if (byDomain.has(domain)) {
       throw new Error(
-        `generated application topology contains domain '${domain}' more than once`,
+        `generated application topology contains domain '${domain}' more than once`
       );
     }
     byDomain.set(domain, module);
@@ -58,26 +66,35 @@ export function resolveApplicationTopology(
   if (modules.length === 1) {
     const homeModule = modules[0]!;
     const homeDomain = domainOf(homeModule);
-    return { rootDomains: [homeDomain], homeDomain, homeModule };
+    return {
+      rootDomains: [homeDomain],
+      remoteDomains: [],
+      homeDomain,
+      homeModule,
+    };
   }
 
   const declaredReceivingGroups = modules.filter((module) =>
-    publicLanguageOf(module).some((directive) =>
-      directive.id === "nomosInternalBirthReceivingGroup7c1f5e" &&
-      directive.birthsChild === true &&
-      directive.aggregateId === "NomosInternalReceivingGroup7c1f5e",
-    ),
+    module.directives.some(
+      (directive) =>
+        directive.id === "nomosInternalBirthReceivingGroup7c1f5e" &&
+        directive.birthsChild === true &&
+        directive.aggregateId === "NomosInternalReceivingGroup7c1f5e"
+    )
   );
   if (declaredReceivingGroups.length > 1) {
     throw new Error(
       `generated application topology has more than one receiving-group domain: ${declaredReceivingGroups
         .map(domainOf)
         .sort()
-        .join(", ")}. An accountable participant gets one receiving group; keep one group birth language.`,
+        .join(
+          ", "
+        )}. An accountable participant gets one receiving group; keep one group birth language.`
     );
   }
 
   const aggregateOwners = new Map<string, Set<string>>();
+  const directiveOwners = new Map<object, string>();
   for (const module of modules) {
     const domain = domainOf(module);
     for (const aggregate of module.aggregates) {
@@ -85,11 +102,65 @@ export function resolveApplicationTopology(
       owners.add(domain);
       aggregateOwners.set(aggregate.id, owners);
     }
+    for (const directive of module.directives) {
+      directiveOwners.set(directive as object, domain);
+    }
   }
 
   const targetedByAnotherDomain = new Set<string>();
+  const remoteAncestorDomains = new Set<string>();
+  const parentsByDomain = new Map<string, Set<string>>();
   const childrenByDomain = new Map<string, Set<string>>();
   const birthSources = new Set<string>();
+
+  // Establish the participant's remote ancestors before interpreting births. An ancestor may
+  // lawfully commission the participant workspace (Platform -> Home), but that global lineage
+  // must not make the participant's own Home disappear from its receiving-group application.
+  // Descendant births authored by a co-resident domain (Home -> Estate) still place their targets
+  // outside the receiving group below.
+  for (const module of modules) {
+    const source = domainOf(module);
+    for (const directive of publicLanguageOf(module)) {
+      for (const effect of directive.workspaceEffects ?? []) {
+        if (effect.destination.kind !== "verifiedParent") continue;
+        const target = directiveOwners.get(effect.target as object);
+        if (target !== undefined && target !== source) {
+          const parents = parentsByDomain.get(source) ?? new Set<string>();
+          parents.add(target);
+          parentsByDomain.set(source, parents);
+        }
+      }
+    }
+  }
+
+  // Follow the receiving group's own verified-parent chain. A descendant also points back to this
+  // group, but that makes the group its parent—not an ancestor that should be removed from the app.
+  const receivingGroupModule = declaredReceivingGroups[0];
+  const participantDomain = receivingGroupModule
+    ? domainOf(receivingGroupModule)
+    : byDomain.has("home")
+    ? "home"
+    : undefined;
+  if (participantDomain !== undefined) {
+    const pending = [participantDomain];
+    const seen = new Set(pending);
+    while (pending.length > 0) {
+      const source = pending.pop()!;
+      for (const parent of parentsByDomain.get(source) ?? []) {
+        if (seen.has(parent)) continue;
+        seen.add(parent);
+        remoteAncestorDomains.add(parent);
+        pending.push(parent);
+      }
+    }
+  } else {
+    // Packages without an explicit receiving group retain the conservative interpretation: a
+    // verified-parent target cannot be silently opened in the same workspace as its requester.
+    for (const parents of parentsByDomain.values()) {
+      for (const parent of parents) remoteAncestorDomains.add(parent);
+    }
+  }
+
   for (const module of modules) {
     const source = domainOf(module);
     for (const directive of publicLanguageOf(module)) {
@@ -99,13 +170,15 @@ export function resolveApplicationTopology(
       if (owners === undefined || owners.size !== 1) {
         throw new Error(
           `generated application topology cannot locate the one domain owning born aggregate ` +
-            `'${aggregateId}' from '${source}/${directive.id}'`,
+            `'${aggregateId}' from '${source}/${directive.id}'`
         );
       }
       const target = [...owners][0]!;
       birthSources.add(source);
       if (target !== source) {
-        targetedByAnotherDomain.add(target);
+        if (!remoteAncestorDomains.has(source)) {
+          targetedByAnotherDomain.add(target);
+        }
         const children = childrenByDomain.get(source) ?? new Set<string>();
         children.add(target);
         childrenByDomain.set(source, children);
@@ -118,34 +191,53 @@ export function resolveApplicationTopology(
   const walk = (domain: string, path: readonly string[]): void => {
     if (visiting.has(domain)) {
       throw new Error(
-        `generated application topology contains a cross-workspace birth cycle: ${[...path, domain].join(" -> ")}`,
+        `generated application topology contains a cross-workspace birth cycle: ${[
+          ...path,
+          domain,
+        ].join(" -> ")}`
       );
     }
     if (visited.has(domain)) return;
     visiting.add(domain);
-    for (const child of childrenByDomain.get(domain) ?? []) walk(child, [...path, domain]);
+    for (const child of childrenByDomain.get(domain) ?? [])
+      walk(child, [...path, domain]);
     visiting.delete(domain);
     visited.add(domain);
   };
   for (const domain of byDomain.keys()) walk(domain, []);
 
-  const rootModules = modules.filter((module) => !targetedByAnotherDomain.has(domainOf(module)));
+  const rootModules = modules.filter((module) => {
+    const domain = domainOf(module);
+    return (
+      !targetedByAnotherDomain.has(domain) && !remoteAncestorDomains.has(domain)
+    );
+  });
   const rootDomains = rootModules.map(domainOf);
   if (rootDomains.length === 0) {
     throw new Error(
-      "Nomos cannot determine an application workspace because every business domain is born by another domain.",
+      "Nomos cannot determine an application workspace because every business domain is born by another domain."
     );
   }
 
-  const receivingGroupModule = declaredReceivingGroups[0];
-  if (receivingGroupModule !== undefined && !rootModules.includes(receivingGroupModule)) {
+  if (
+    receivingGroupModule !== undefined &&
+    !rootModules.includes(receivingGroupModule)
+  ) {
     throw new Error(
-      `generated application topology places its receiving-group domain '${domainOf(receivingGroupModule)}' inside a child workspace`,
+      `generated application topology places its receiving-group domain '${domainOf(
+        receivingGroupModule
+      )}' inside a child workspace`
     );
   }
-  const homeModule = receivingGroupModule
-    ?? rootModules.find((module) => domainOf(module) === "home")
-    ?? rootModules.find((module) => birthSources.has(domainOf(module)))
-    ?? rootModules[0]!;
-  return { rootDomains, homeDomain: domainOf(homeModule), homeModule };
+  const homeModule =
+    receivingGroupModule ??
+    rootModules.find((module) => domainOf(module) === "home") ??
+    rootModules.find((module) => birthSources.has(domainOf(module))) ??
+    rootModules[0]!;
+  return {
+    rootDomains,
+    remoteDomains: [...remoteAncestorDomains],
+    homeDomain: domainOf(homeModule),
+    homeModule,
+  };
 }

package/src/births.ts

@@ -8,6 +8,12 @@ import type { AggregateHandle } from "./aggregate.js";
 import type { AggregateRef } from "./authoring.js";
 import type { Ports } from "./ctx.js";
 import type { Field, FieldValue, NomosRefValue } from "./fields.js";
+import {
+  object,
+  relationType,
+  self,
+  type RelationTypeBuilder,
+} from "./relation_schema.js";
 
 /**
  * THE BIRTH EFFECT — birth is an EXPLICIT, DECLARED kernel primitive (G3, the unix model).
@@ -49,6 +55,27 @@ export function workspaceRole<const Name extends string>(name: Name): Name & Wor
   return name as Name & WorkspaceRole;
 }
 
+/** Declare target-owned roles which a born workspace may grant to its verified immediate parent.
+ * The matching relation is necessarily on Nomos's canonical global `workspace` object and accepts
+ * only another nominal workspace subject. Keeping this shape behind the branded WorkspaceRole API
+ * prevents a local namespaced lookalike from making a correctly attested parent impossible to admit. */
+export function parentWorkspaceRoleRelations(
+  ...roles: readonly WorkspaceRole[]
+): RelationTypeBuilder {
+  const unique = [...new Set(roles)];
+  if (unique.length !== roles.length) {
+    throw new Error("parentWorkspaceRoleRelations repeats a workspace role");
+  }
+  const relations = relationType("workspace").asGlobal();
+  for (const role of unique) {
+    relations.relation(role, {
+      rewrite: self(),
+      allow: [object("workspace")],
+    });
+  }
+  return relations;
+}
+
 // ── the per-dispatch birth footprint — library state drained by `executeDirectiveToIntent` (mirrors the
 //    captured-read footprint in read.ts; internal to the directive runtime, never a sandbox side channel). ──
 let footprint: BirthRecipe[] = [];

package/src/codegen_call_usda.ts

@@ -397,8 +397,11 @@ export function emitTsCallUsdaEncoder(
         const literal = node.expression.value;
         if (typeof literal === "string") {
           out.push(`_nmsRoutingCandidates.push(${JSON.stringify(literal)});`);
-          begin("NomosStringValue");
-          out.push(`_nmsUsdaString(${outName}, ${depth + 1}, "string", "nomos:value", ${JSON.stringify(literal)});`);
+          // String literals are singleton enum members in the law graph. The kernel's
+          // canonical authoring path therefore lowers them as USDA tokens, exactly like
+          // ordinary enums, rather than as unconstrained strings.
+          begin("NomosTokenValue");
+          out.push(`_nmsUsdaString(${outName}, ${depth + 1}, "token", "nomos:value", ${JSON.stringify(literal)});`);
         } else if (typeof literal === "boolean") {
           begin("NomosBoolValue");
           out.push(`_nmsUsdaScalar(${outName}, ${depth + 1}, "bool", "nomos:value", ${literal ? '"true"' : '"false"'});`);
@@ -806,8 +809,10 @@ export function emitDartCallUsdaEncoder(
       case "literal": {
         const literal = node.expression.value;
         if (typeof literal === "string") {
-          begin("NomosStringValue");
-          out.push(`_nmsUsdaString(${outName}, ${depth + 1}, 'string', 'nomos:value', ${dartString(literal)});`);
+          // Keep Dart's authored graph identical to the kernel's canonical lowering:
+          // string literals are singleton enum members and therefore USDA tokens.
+          begin("NomosTokenValue");
+          out.push(`_nmsUsdaString(${outName}, ${depth + 1}, 'token', 'nomos:value', ${dartString(literal)});`);
         } else if (typeof literal === "boolean") {
           begin("NomosBoolValue");
           out.push(`_nmsUsdaScalar(${outName}, ${depth + 1}, 'bool', 'nomos:value', '${literal ? "true" : "false"}');`);

package/src/codegen_dart_application.ts

@@ -28,6 +28,7 @@ import {
 } from "./codegen_dart.js";
 import {
   dartClientClassName,
+  dartInternalChildAuthenticationRecoveryMethod,
   dartInternalSourceTrustMethod,
   dartInternalWorkspaceSharingReceiptMethod,
 } from "./codegen_dart_client.js";
@@ -43,7 +44,10 @@ import {
   isFrameworkDirective,
   isFrameworkQuery,
 } from "./framework/framework_aggregates.js";
-import { isBusinessIntent } from "./intent.js";
+import {
+  childAuthenticationRecoveryAggregateId,
+  isBusinessIntent,
+} from "./intent.js";
 import { contractTypeName } from "./contract.js";
 import { admitsNull } from "./null_meta.js";
 import type {
@@ -203,7 +207,7 @@ function sharingReceiptPayload(
   policy: WorkspaceSharingPolicy,
   receipt: WorkspaceSharingReceipt,
   refused: boolean,
-  enumDartTypes: ReadonlyMap<string, string>,
+  enumDartTypes: ReadonlyMap<string, string>
 ): string[] {
   const fields = introspectPayload(
     receipt.records.payloadSchema as z.ZodTypeAny,
@@ -236,9 +240,8 @@ function sharingReceiptPayload(
       );
     }
     const raw = sharingOrderValue(policy, sourceName);
-    const expression = source.kind === "enum"
-      ? `${target.dartType}.fromWire(${raw}.wire)`
-      : raw;
+    const expression =
+      source.kind === "enum" ? `${target.dartType}.fromWire(${raw}.wire)` : raw;
     return [`            ${member(target.name)}: ${expression},`];
   });
 }
@@ -335,9 +338,7 @@ function dartConflictPublicClassNames(mod: DomainModule): string[] {
     ) {
       names.add(`${aggregateName}${cap(camel(binding.field))}Conflict`);
       names.add(
-        `${aggregateName}${cap(
-          camel(binding.field)
-        )}ConflictEvolutionRequired`
+        `${aggregateName}${cap(camel(binding.field))}ConflictEvolutionRequired`
       );
     }
   }
@@ -601,6 +602,21 @@ export function generateDartApplication(
         .businessBirthInternal !== true &&
       !isFrameworkDirective(directive)
   );
+  const childAuthenticationRecoveryByAggregate = new Map<
+    string,
+    AnyDirective
+  >();
+  for (const directive of directives) {
+    if (!isBusinessIntent(directive)) continue;
+    const aggregateId = childAuthenticationRecoveryAggregateId(directive);
+    if (aggregateId === undefined) continue;
+    if (childAuthenticationRecoveryByAggregate.has(aggregateId)) {
+      throw new Error(
+        `generated application '${domain}' has more than one child authentication recovery action for '${aggregateId}'`
+      );
+    }
+    childAuthenticationRecoveryByAggregate.set(aggregateId, directive);
+  }
   const actionReferenceChecks = (directive: AnyDirective): string[] => {
     let specs: ReturnType<typeof introspectPayload>;
     try {
@@ -747,11 +763,12 @@ export function generateDartApplication(
     if (trust === undefined) {
       return { prelude: [], call };
     }
-    const copiedEntries = Object.entries(trust.copy)
-      .sort(([a], [b]) => a.localeCompare(b))
+    const copiedEntries = Object.entries(trust.copy).sort(([a], [b]) =>
+      a.localeCompare(b)
+    );
     const copied = copiedEntries.map(
-        ([target, field]) => `        ${member(target)}: ${factValue(field)},`
-      );
+      ([target, field]) => `        ${member(target)}: ${factValue(field)},`
+    );
     const trustDirective = (mod.directives as AnyDirective[]).find(
       (candidate) => candidate.id === trust.viaDirectiveId
     );
@@ -775,7 +792,9 @@ export function generateDartApplication(
     if (missingRequired.length > 0) {
       throw new Error(
         `Dart source-trust codegen: '${directive.id}' cannot construct '${trust.viaDirectiveId}'; ` +
-          `missing required typed field(s): ${missingRequired.map((field) => field.name).join(", ")}`
+          `missing required typed field(s): ${missingRequired
+            .map((field) => field.name)
+            .join(", ")}`
       );
     }
     const omittedOptionals = trustFields
@@ -785,22 +804,70 @@ export function generateDartApplication(
       (field) => field.name === trust.keyHashesField
     )?.dartType;
     const keyElementType = keyHashesType?.match(/^List<(.+)>$/)?.[1] ?? "Never";
+    const satisfactionQuery =
+      trust.satisfiedByQueryId === undefined
+        ? undefined
+        : (mod.queries as QueryDecl[]).find(
+            (query) => query.id === trust.satisfiedByQueryId
+          );
+    if (
+      trust.satisfiedByQueryId !== undefined &&
+      satisfactionQuery === undefined
+    ) {
+      throw new Error(
+        `Dart source-trust codegen: '${directive.id}' names missing satisfaction query '${trust.satisfiedByQueryId}'`
+      );
+    }
+    if (
+      satisfactionQuery !== undefined &&
+      satisfactionQuery.returns !== trustDirective.aggregateId
+    ) {
+      throw new Error(
+        `Dart source-trust codegen: '${directive.id}' satisfaction query '${satisfactionQuery.id}' returns '${satisfactionQuery.returns}', not trust aggregate '${trustDirective.aggregateId}'`
+      );
+    }
+    const satisfactionArgs = trust.satisfiedByQueryArgs ?? {};
+    if (
+      satisfactionQuery !== undefined &&
+      (satisfactionQuery.key.some(
+        (key) => satisfactionArgs[key] === undefined
+      ) ||
+        Object.keys(satisfactionArgs).some(
+          (key) => !satisfactionQuery.key.includes(key)
+        ))
+    ) {
+      throw new Error(
+        `Dart source-trust codegen: '${directive.id}' satisfaction query '${
+          satisfactionQuery.id
+        }' needs exactly keys ${satisfactionQuery.key.join(", ")}`
+      );
+    }
+    // A declared satisfaction query means trust is already a typed law fact.
+    // The kernel's foreign-read policy evaluates that fact while admitting the
+    // business offer. Do not create a second, client-side read-then-auto-grant
+    // authority ceremony.
+    if (satisfactionQuery !== undefined) {
+      return { prelude: [], call };
+    }
+    const trustIndent = "    ";
     return {
       prelude: [
-        `    final sourceGenesis = await _client.bridge.nomosWorkspaceGenesis(${factValue(
+        `${trustIndent}final sourceGenesis = await _client.bridge.nomosWorkspaceGenesis(${factValue(
           trust.fromPayload
         )});`,
-        `    await _client.${dartInternalSourceTrustMethod(
+        `${trustIndent}await _client.${dartInternalSourceTrustMethod(
           trust.viaDirectiveId
         )}((`,
         ...copied,
         ...omittedOptionals,
-        `        ${member(trust.genesisField)}: sourceGenesis,`,
+        `${trustIndent}    ${member(trust.genesisField)}: sourceGenesis,`,
         // Custody-native v2 proves the sibling by genesis + authenticated Git position and has no
         // signing key. Never fabricate a v1 attestor identity; an operator must explicitly enroll
         // real keys before a signed v1 read can pass.
-        `        ${member(trust.keyHashesField)}: const <${keyElementType}>[],`,
-        `      ));`,
+        `${trustIndent}    ${member(
+          trust.keyHashesField
+        )}: const <${keyElementType}>[],`,
+        `${trustIndent}  ));`,
       ],
       call,
     };
@@ -1029,6 +1096,8 @@ export function generateDartApplication(
             : concreteClassName(rootAggregate.id)
         )
       );
+      const childAuthenticationRecovery =
+        childAuthenticationRecoveryByAggregate.get(birth.aggregateId);
       if (targetFile !== mod.name) {
         addSibling(`${targetFile}.application.dart`, targetApplication);
         addSibling(`${targetFile}.application.dart`, opener);
@@ -1087,7 +1156,16 @@ export function generateDartApplication(
           `    late final Future<${targetApplication}> opened;`,
           `    opened = (() async {`,
           `      try {`,
-          `        return await ${opener}(_client.bridge, reference, _client.actor);`,
+          `        return await ${opener}(`,
+          `          _client.bridge, reference, _client.actor,`,
+          ...(childAuthenticationRecovery === undefined
+            ? []
+            : [
+                `          recoverAuthentication: () => _client.${dartInternalChildAuthenticationRecoveryMethod(
+                  birth.aggregateId
+                )}(workspace),`,
+              ]),
+          `        );`,
           `      } catch (_) {`,
           `        if (identical(_nmsApplications[workspace], opened)) {`,
           `          _nmsApplications.remove(workspace);`,
@@ -1121,6 +1199,22 @@ export function generateDartApplication(
           `    ),`,
           `  );`,
           ``,
+          `  /// Current kernel-owned progress while [open] prepares this workspace.`,
+          `  ApplicationWorkspaceOpenProgress? openProgress(String key) =>`,
+          `      NomosApplicationObservability.workspaceOpenProgress(`,
+          `        deriveWorkspaceName(${JSON.stringify(
+            birth.namespace
+          )}, key),`,
+          `      );`,
+          ``,
+          `  /// Kernel-owned progress updates while [open] prepares this workspace.`,
+          `  Stream<ApplicationWorkspaceOpenProgress> watchOpenProgress(String key) =>`,
+          `      NomosApplicationObservability.watchWorkspaceOpenProgress(`,
+          `        deriveWorkspaceName(${JSON.stringify(
+            birth.namespace
+          )}, key),`,
+          `      );`,
+          ``,
         ]);
         addCollectionMember(birth.aggregateId, "mine", [
           `  /// The ${birth.aggregateId} lives founded by the signed-in person.`,
@@ -1291,9 +1385,10 @@ export function generateDartApplication(
     const payload = dartActionInputClassName(directive);
     const payloadSpecs = introspectPayload(
       directive.payloadSchema as z.ZodTypeAny,
-      new Map(),
+      new Map()
     );
-    const emptyPayload = directive.targetBinding === undefined && payloadSpecs.length === 0;
+    const emptyPayload =
+      directive.targetBinding === undefined && payloadSpecs.length === 0;
     const targetOnly =
       directive.targetBinding !== undefined &&
       payloadSpecs.every(
@@ -1302,19 +1397,19 @@ export function generateDartApplication(
           spec.name === directive.businessPrincipalField
       ) &&
       (directive.businessRecordInputs?.length ?? 0) === 0;
-    const targetParameter =
-      emptyPayload
-        ? ""
-        : directive.targetBinding === undefined
-        ? `${payload} facts`
-        : targetOnly
-        ? `NomosRef<${concreteClassName(
-            directive.targetBinding.aggregateId
-          )}> target`
-        : `NomosRef<${concreteClassName(
-            directive.targetBinding.aggregateId
-          )}> target, ${payload} facts`;
-    const factsPrelude = targetOnly || emptyPayload ? [`    const facts = ${payload}();`] : [];
+    const targetParameter = emptyPayload
+      ? ""
+      : directive.targetBinding === undefined
+      ? `${payload} facts`
+      : targetOnly
+      ? `NomosRef<${concreteClassName(
+          directive.targetBinding.aggregateId
+        )}> target`
+      : `NomosRef<${concreteClassName(
+          directive.targetBinding.aggregateId
+        )}> target, ${payload} facts`;
+    const factsPrelude =
+      targetOnly || emptyPayload ? [`    const facts = ${payload}();`] : [];
     const referenceChecks = actionReferenceChecks(directive);
     const outputs = dartActionOutputs(directive, mod.aggregates);
     const resultClass = dartActionResultClassName(directive.id);
@@ -1995,6 +2090,10 @@ export function generateDartApplication(
             tenantRoot
               ? "ApplicationModelChange, NomosApplicationStartupState, "
               : ""
+          }${
+            usesWorkspaceName
+              ? "ApplicationWorkspaceOpenProgress, NomosApplicationObservability, "
+              : ""
           }NmsInternalApplicationUserBinding${
             opts.flutterHost === true || sharingPolicies.length > 0
               ? ", NmsInternalApplicationHost"
@@ -2227,11 +2326,13 @@ export function generateDartApplication(
     `}`,
     ``,
     `Future<${application}> nomosInternalOpen${application}<TAggregate>(`,
-    `    NomosBridge bridge, NomosRef<TAggregate> reference, String? actor) async {`,
+    `    NomosBridge bridge, NomosRef<TAggregate> reference, String? actor,`,
+    `    {Future<void> Function()? recoverAuthentication}) async {`,
     ...(opts.flutterHost === true
       ? [
           `  return NmsInternalApplicationHost.nmsInternalOpenReferencedApplication<${application}>(`,
           `    parent: bridge,`,
+          `    workspace: NmsInternalNomosRefs.workspace(reference),`,
           `    open: () async {`,
         ]
       : []),
@@ -2239,8 +2340,12 @@ export function generateDartApplication(
       ? [
           `  final signedIn = actor?.trim() ?? '';`,
           `  if (signedIn.isEmpty) throw StateError('Nomos could not identify the signed-in application user.');`,
+          `  final client = await ${client}.open(`,
+          `    bridge, ref: reference, actor: signedIn,`,
+          `    recoverAuthentication: recoverAuthentication,`,
+          `  );`,
           `  final application = ${application}._(`,
-          `    await ${client}.open(bridge, ref: reference, actor: signedIn),`,
+          `    client,`,
           `    NmsInternalUsers.create(`,
           `      identityId: nmsInternalReceivingGroupNameOf(signedIn),`,
           `      identityAddress: 'nomos-identity:\${Uri.encodeComponent(nmsInternalReceivingGroupNameOf(signedIn))}',`,
@@ -2248,7 +2353,11 @@ export function generateDartApplication(
           `  );`,
         ]
       : [
-          `  final application = ${application}._(await ${client}.open(bridge, ref: reference, actor: actor));`,
+          `  final client = await ${client}.open(`,
+          `    bridge, ref: reference, actor: actor,`,
+          `    recoverAuthentication: recoverAuthentication,`,
+          `  );`,
+          `  final application = ${application}._(client);`,
         ]),
     ...(sharingPolicies.length > 0
       ? [`  await application._nmsStartWorkspaceSharing();`]