@githolon/dsl 0.108.4 → 0.108.6

package/src/intent.ts

@@ -40,6 +40,9 @@ import {
 
 const INTENT_BRAND = "__nomos_business_intent_v1" as const;
 const LANGUAGE_BRAND = "__nomos_application_language_v1" as const;
+const CHILD_AUTHENTICATION_RECOVERY = Symbol(
+  "nomos.child-authentication-recovery"
+);
 
 export interface IntentStep<I = unknown, P = unknown> {
   readonly directive: Directive<P>;
@@ -77,9 +80,15 @@ function payloadTrace(path: readonly string[] = []): PayloadTrace {
     get(_target, property) {
       if (property === PAYLOAD_TRACE_PATH) return path;
       if (property === "then") return undefined;
-      if (property === Symbol.toPrimitive || property === "toString" || property === "valueOf") {
+      if (
+        property === Symbol.toPrimitive ||
+        property === "toString" ||
+        property === "valueOf"
+      ) {
         return () => {
-          throw new Error("computed application-language payload field is not a direct path");
+          throw new Error(
+            "computed application-language payload field is not a direct path"
+          );
         };
       }
       return payloadTrace([...path, String(property)]);
@@ -96,7 +105,10 @@ function tracedPath(value: unknown): readonly string[] | undefined {
 function valueAtPath(value: unknown, path: readonly string[]): unknown {
   let current = value;
   for (const part of path) {
-    if (current === null || (typeof current !== "object" && typeof current !== "function")) {
+    if (
+      current === null ||
+      (typeof current !== "object" && typeof current !== "function")
+    ) {
       return undefined;
     }
     current = (current as Record<string, unknown>)[part];
@@ -106,14 +118,14 @@ function valueAtPath(value: unknown, path: readonly string[]): unknown {
 
 function remapPayloadPath(
   mapped: unknown,
-  privatePath: readonly string[],
+  privatePath: readonly string[]
 ): readonly string[] | undefined {
   return tracedPath(valueAtPath(mapped, privatePath));
 }
 
 function remapStepPayloadPath(
   step: IntentStep<any, any>,
-  privatePath: readonly string[],
+  privatePath: readonly string[]
 ): readonly string[] | undefined {
   try {
     return remapPayloadPath(step.payload(payloadTrace()), privatePath);
@@ -124,14 +136,17 @@ function remapStepPayloadPath(
 
 function remapReadPart(
   part: InvariantReadIdPart,
-  mapped: unknown,
+  mapped: unknown
 ): InvariantReadIdPart | undefined {
   if (part.source !== "payload") return part;
   const path = remapPayloadPath(mapped, part.path);
   return path === undefined ? undefined : { ...part, path };
 }
 
-function remapReadId(id: InvariantReadId, mapped: unknown): InvariantReadId | undefined {
+function remapReadId(
+  id: InvariantReadId,
+  mapped: unknown
+): InvariantReadId | undefined {
   if (id.source === "literal") return id;
   if (id.source === "payload") {
     const path = remapPayloadPath(mapped, id.path);
@@ -150,12 +165,14 @@ function remapReadId(id: InvariantReadId, mapped: unknown): InvariantReadId | un
  * Returns undefined unless every payload dependency is structurally proven. */
 function remapNativeReads(
   reads: readonly InvariantReadBinding[],
-  step: IntentStep<any, any>,
+  step: IntentStep<any, any>
 ): readonly InvariantReadBinding[] | undefined {
-  const needsPayload = reads.some((read) =>
-    read.eachPayloadPath !== undefined ||
-    read.id.source === "payload" ||
-    (read.id.source === "template" && read.id.parts.some((part) => part.source === "payload"))
+  const needsPayload = reads.some(
+    (read) =>
+      read.eachPayloadPath !== undefined ||
+      read.id.source === "payload" ||
+      (read.id.source === "template" &&
+        read.id.parts.some((part) => part.source === "payload"))
   );
   if (!needsPayload) return reads;
 
@@ -168,10 +185,12 @@ function remapNativeReads(
 
   const out: InvariantReadBinding[] = [];
   for (const read of reads) {
-    const eachPayloadPath = read.eachPayloadPath === undefined
-      ? undefined
-      : remapPayloadPath(mapped, read.eachPayloadPath);
-    if (read.eachPayloadPath !== undefined && eachPayloadPath === undefined) return undefined;
+    const eachPayloadPath =
+      read.eachPayloadPath === undefined
+        ? undefined
+        : remapPayloadPath(mapped, read.eachPayloadPath);
+    if (read.eachPayloadPath !== undefined && eachPayloadPath === undefined)
+      return undefined;
 
     const id = remapReadId(read.id, mapped);
     if (id === undefined) return undefined;
@@ -186,16 +205,81 @@ function remapNativeReads(
 
 export interface BusinessIntent<I = unknown> extends Directive<I> {
   readonly [INTENT_BRAND]: true;
-  readonly [BUSINESS_BIRTH_POLICY_BINDING]?: (domains: readonly string[]) => void;
+  readonly [BUSINESS_BIRTH_POLICY_BINDING]?: (
+    domains: readonly string[]
+  ) => void;
   readonly steps: readonly IntentStep<I, any>[];
   readonly workspaceEffects: readonly WorkspaceEffectStep<I, any>[];
   /** Law-selected proof for this exact public offer. Omitted means the ordinary session proof
    * posture. Tenant callers never choose this at invocation time. */
   readonly offerAuthenticationProof?: "enrolledDevice";
+  /** Compiler-visible application lifecycle declaration. When opening a child of this aggregate
+   * type proves that its verifier/signer posture is stale, the generated parent application may
+   * invoke this exact nominal action on the already-authenticated parent. The action itself remains
+   * ordinary tenant law and the child independently authorizes the resulting workspace effect. */
+  readonly [CHILD_AUTHENTICATION_RECOVERY]?: string;
   /** The complete public business boundary. Runtime lowering still uses Directive.payloadSchema privately. */
   readonly contract: IntentContract<I>;
 }
 
+/** Select the already-enrolled device proof for a finished one-effect intent.
+ *
+ * `intent(...).performs(...)` deliberately returns the finished nominal action
+ * so the effect's complete framework metadata is preserved. This companion is
+ * the finished-action equivalent of `IntentBuilder.authenticatesWithEnrolledDevice()`;
+ * the compiler records the same exact per-intent proof requirement either way.
+ */
+export function authenticatesWithEnrolledDevice<I>(
+  action: BusinessIntent<I>
+): BusinessIntent<I> {
+  return Object.freeze({
+    ...action,
+    offerAuthenticationProof: "enrolledDevice" as const,
+  });
+}
+
+/** Mark one parent-law action as the typed recovery operation for children rooted at [child].
+ *
+ * This does not grant authority or create a generic host callback. It only lets generated application
+ * code connect a failed child-open posture to an exact, nominal parent action which already has its own
+ * enrolled-device proof and emits one law-authored effect to that child.
+ */
+export function repairsChildAuthenticationFor<I>(
+  child: AggregateHandle,
+  action: BusinessIntent<I>
+): BusinessIntent<I> {
+  if (action.offerAuthenticationProof !== "enrolledDevice") {
+    throw new Error(
+      `repairsChildAuthenticationFor(${child.id}): '${action.id}' must authenticate with the parent's enrolled device`
+    );
+  }
+  if (action.steps.length !== 0 || action.workspaceEffects.length === 0) {
+    throw new Error(
+      `repairsChildAuthenticationFor(${child.id}): '${action.id}' must emit at least one child effect and make no parent-local write`
+    );
+  }
+  if (
+    action.workspaceEffects.some(
+      (effect) => effect.destination.kind !== "workspace"
+    )
+  ) {
+    throw new Error(
+      `repairsChildAuthenticationFor(${child.id}): '${action.id}' must address the exact child workspace from its typed input`
+    );
+  }
+  return Object.freeze({
+    ...action,
+    [CHILD_AUTHENTICATION_RECOVERY]: child.id,
+  });
+}
+
+/** Internal compiler projection of {@link repairsChildAuthenticationFor}. */
+export function childAuthenticationRecoveryAggregateId(
+  action: BusinessIntent<unknown>
+): string | undefined {
+  return action[CHILD_AUTHENTICATION_RECOVERY];
+}
+
 /** The public promise of one business action. Outputs are inferred from its composed consequences unless
  * the author names them explicitly, in which case the compiler verifies the promise exactly. */
 export interface IntentContract<I = unknown> {
@@ -231,43 +315,51 @@ const stable = (value: unknown): string => {
     .join(",")}}`;
 };
 
-function oneStaticRelationGate<I>(steps: readonly IntentStep<I, any>[]): Directive["requiresRelationGate"] {
+function oneStaticRelationGate<I>(
+  steps: readonly IntentStep<I, any>[]
+): Directive["requiresRelationGate"] {
   const gates = steps
     .map((step) => step.directive.requiresRelationGate)
-    .filter((gate): gate is NonNullable<Directive["requiresRelationGate"]> => gate !== undefined);
+    .filter(
+      (gate): gate is NonNullable<Directive["requiresRelationGate"]> =>
+        gate !== undefined
+    );
   if (gates.length === 0) return undefined;
   if (gates.some((gate) => gate.objectFrom !== undefined)) {
     throw new Error(
-      "compound intent cannot yet remap a per-record access gate — bind that gate on the intent itself",
+      "compound intent cannot yet remap a per-record access gate — bind that gate on the intent itself"
     );
   }
   const first = stable(gates[0]);
   if (gates.some((gate) => stable(gate) !== first)) {
     throw new Error(
-      "compound intent directives require different access gates — declare one jointly satisfiable intent gate",
+      "compound intent directives require different access gates — declare one jointly satisfiable intent gate"
     );
   }
   return gates[0];
 }
 
 function unsupportedKernelGate(directive: Directive<any>): string | undefined {
-  if (directive.attestationAuthorizedGate !== undefined) return "attestation authorization";
+  if (directive.attestationAuthorizedGate !== undefined)
+    return "attestation authorization";
   if (directive.delegatedRoleGate !== undefined) return "delegated authority";
-  if (directive.firstDeviceEnrollGate !== undefined) return "first-device enrollment";
+  if (directive.firstDeviceEnrollGate !== undefined)
+    return "first-device enrollment";
   if (directive.certifiesEraGate !== undefined) return "era certification";
-  if ((directive.businessRecordInputs?.length ?? 0) > 0) return "record-input binding";
+  if ((directive.businessRecordInputs?.length ?? 0) > 0)
+    return "record-input binding";
   return undefined;
 }
 
 function remapBusinessSourceTrust<I>(
   step: IntentStep<I, any>,
-  trust: BusinessSourceTrust,
+  trust: BusinessSourceTrust
 ): BusinessSourceTrust {
   const field = (privatePath: string): string => {
     const mapped = remapStepPayloadPath(step, privatePath.split("."));
     if (mapped === undefined || mapped.length === 0) {
       throw new Error(
-        `compound intent cannot remap source-trust field '${privatePath}' from '${step.directive.id}'`,
+        `compound intent cannot remap source-trust field '${privatePath}' from '${step.directive.id}'`
       );
     }
     return mapped.join(".");
@@ -277,13 +369,29 @@ function remapBusinessSourceTrust<I>(
     fromPayload: field(trust.fromPayload),
     queryId: trust.queryId,
     queryArgs: Object.fromEntries(
-      Object.entries(trust.queryArgs).map(([target, source]) => [target, field(source)]),
+      Object.entries(trust.queryArgs).map(([target, source]) => [
+        target,
+        field(source),
+      ])
     ),
     copy: Object.fromEntries(
-      Object.entries(trust.copy).map(([target, source]) => [target, field(source)]),
+      Object.entries(trust.copy).map(([target, source]) => [
+        target,
+        field(source),
+      ])
     ),
     genesisField: trust.genesisField,
     keyHashesField: trust.keyHashesField,
+    ...(trust.satisfiedByQueryId === undefined
+      ? {}
+      : {
+          satisfiedByQueryId: trust.satisfiedByQueryId,
+          satisfiedByQueryArgs: Object.fromEntries(
+            Object.entries(trust.satisfiedByQueryArgs ?? {}).map(
+              ([target, source]) => [target, field(source)]
+            )
+          ),
+        }),
   };
 }
 
@@ -307,12 +415,13 @@ const dedupeBy = <T>(values: readonly T[], key: (value: T) => string): T[] => {
  */
 function composePrimaryConsequenceOp(
   directive: Directive<any>,
-  op: PlannedOp,
+  op: PlannedOp
 ): PlannedOp {
   if (op.kind === "strike") return op;
-  const targetsPrimary = op.aggregateType !== undefined
-    ? op.aggregateType === directive.aggregateId
-    : op.aggregateId === directive.aggregateId;
+  const targetsPrimary =
+    op.aggregateType !== undefined
+      ? op.aggregateType === directive.aggregateId
+      : op.aggregateId === directive.aggregateId;
   if (!targetsPrimary) return op;
   return {
     ...op,
@@ -328,25 +437,45 @@ class IntentBuilder<I> {
     private readonly id: string,
     private readonly contractDeclaration: IntentContractDeclaration<I>,
     private readonly steps: readonly IntentStep<I, any>[] = [],
-    private readonly workspaceEffects: readonly WorkspaceEffectStep<I, any>[] = [],
+    private readonly workspaceEffects: readonly WorkspaceEffectStep<
+      I,
+      any
+    >[] = [],
     private readonly intentReads: readonly (string | QueryDecl)[] = [],
     private readonly acceptsWorkspaceEffects = false,
-    private readonly intentRelationGate?: NonNullable<Directive["requiresRelationGate"]>,
+    private readonly intentRelationGate?: NonNullable<
+      Directive["requiresRelationGate"]
+    >,
     private readonly offerAuthenticationProof?: "enrolledDevice",
+    private readonly acceptsVerifiedBirthParentRecovery = false
   ) {}
 
   /** Add one private directive consequence to this business intent. */
-  directs<P>(directive: Directive<P>, payload: (facts: I) => P): IntentBuilder<I> {
+  directs<P>(
+    directive: Directive<P>,
+    payload: (facts: I) => P
+  ): IntentBuilder<I> {
     if (isBusinessIntent(directive)) {
-      throw new Error(`intent('${this.id}') cannot direct another intent — compose its private directives instead`);
+      throw new Error(
+        `intent('${this.id}') cannot direct another intent — compose its private directives instead`
+      );
     }
     if (directive.birthsChild === true) {
-      throw new Error(`intent('${this.id}') composes a declared birth with .births(...), never a raw birth directive`);
+      throw new Error(
+        `intent('${this.id}') composes a declared birth with .births(...), never a raw birth directive`
+      );
     }
-    return new IntentBuilder(this.id, this.contractDeclaration, [
-      ...this.steps,
-      { directive, payload },
-    ], this.workspaceEffects, this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      [...this.steps, { directive, payload }],
+      this.workspaceEffects,
+      this.intentReads,
+      this.acceptsWorkspaceEffects,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
+    );
   }
 
   /** Author one exact nominal call into another workspace. The caller chooses only the target
@@ -354,21 +483,37 @@ class IntentBuilder<I> {
    * the compiler bind its stable USDA identity; no operation string or host-selected mapping exists. */
   directsWorkspace<P>(
     target: Directive<P>,
-    effect: { readonly workspace: (facts: I) => string; readonly payload: (facts: I) => P },
+    effect: {
+      readonly workspace: (facts: I) => string;
+      readonly payload: (facts: I) => P;
+    }
   ): IntentBuilder<I> {
-    if (isBusinessIntent(target) && target.acceptsWorkspaceEffectGate !== true) {
+    if (
+      isBusinessIntent(target) &&
+      target.acceptsWorkspaceEffectGate !== true
+    ) {
       throw new Error(
-        `intent('${this.id}') workspace effect may target a public intent only when target law explicitly accepts workspace effects`,
+        `intent('${this.id}') workspace effect may target a public intent only when target law explicitly accepts workspace effects`
       );
     }
-    return new IntentBuilder(this.id, this.contractDeclaration, this.steps, [
-      ...this.workspaceEffects,
-      {
-        target,
-        destination: { kind: "workspace", address: effect.workspace },
-        payload: effect.payload,
-      },
-    ], this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      [
+        ...this.workspaceEffects,
+        {
+          target,
+          destination: { kind: "workspace", address: effect.workspace },
+          payload: effect.payload,
+        },
+      ],
+      this.intentReads,
+      this.acceptsWorkspaceEffects,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
+    );
   }
 
   /** Send an exact nominal request to this workspace's verified immediate parent. The route is
@@ -376,21 +521,34 @@ class IntentBuilder<I> {
    * enters the public payload or the JavaScript execution boundary. */
   directsParentWorkspace<P>(
     target: Directive<P>,
-    effect: { readonly payload: (facts: I) => P },
+    effect: { readonly payload: (facts: I) => P }
   ): IntentBuilder<I> {
-    if (isBusinessIntent(target) && target.acceptsWorkspaceEffectGate !== true) {
+    if (
+      isBusinessIntent(target) &&
+      target.acceptsWorkspaceEffectGate !== true
+    ) {
       throw new Error(
-        `intent('${this.id}') parent request may target a public intent only when target law explicitly accepts workspace effects`,
+        `intent('${this.id}') parent request may target a public intent only when target law explicitly accepts workspace effects`
       );
     }
-    return new IntentBuilder(this.id, this.contractDeclaration, this.steps, [
-      ...this.workspaceEffects,
-      {
-        target,
-        destination: { kind: "verifiedParent" },
-        payload: effect.payload,
-      },
-    ], this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      [
+        ...this.workspaceEffects,
+        {
+          target,
+          destination: { kind: "verifiedParent" },
+          payload: effect.payload,
+        },
+      ],
+      this.intentReads,
+      this.acceptsWorkspaceEffects,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
+    );
   }
 
   /** Reply to the exact workspace whose carried effect invoked this intent. The destination is
@@ -399,21 +557,34 @@ class IntentBuilder<I> {
    * still authorizes the verified workspace actor through its ordinary relation gate. */
   repliesWorkspace<P>(
     target: Directive<P>,
-    effect: { readonly payload: (facts: I) => P },
+    effect: { readonly payload: (facts: I) => P }
   ): IntentBuilder<I> {
-    if (isBusinessIntent(target)) {
+    if (
+      isBusinessIntent(target) &&
+      target.acceptsWorkspaceEffectGate !== true
+    ) {
       throw new Error(
-        `intent('${this.id}') workspace reply must target a private accepted directive, not another public intent`,
+        `intent('${this.id}') workspace reply may target a public intent only when target law explicitly accepts workspace effects`
       );
     }
-    return new IntentBuilder(this.id, this.contractDeclaration, this.steps, [
-      ...this.workspaceEffects,
-      {
-        target,
-        destination: { kind: "verifiedSource" },
-        payload: effect.payload,
-      },
-    ], this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      [
+        ...this.workspaceEffects,
+        {
+          target,
+          destination: { kind: "verifiedSource" },
+          payload: effect.payload,
+        },
+      ],
+      this.intentReads,
+      this.acceptsWorkspaceEffects,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
+    );
   }
 
   /** Admit this public request only through the cross-workspace effect door. Authority remains the
@@ -428,6 +599,24 @@ class IntentBuilder<I> {
       true,
       this.intentRelationGate,
       this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
+    );
+  }
+
+  /** Recovery-only cross-workspace door for an existing child whose ordinary parent relation may not
+   * be seated yet. The certified manifest selects this exact intent; admission then requires the
+   * carried K_root-rooted workspace actor to equal the target's persisted birth parent. */
+  acceptsVerifiedBirthParentRecoveryEffect(): IntentBuilder<I> {
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      this.steps,
+      this.workspaceEffects,
+      this.intentReads,
+      true,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+      true
     );
   }
 
@@ -444,6 +633,7 @@ class IntentBuilder<I> {
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
       "enrolledDevice",
+      this.acceptsVerifiedBirthParentRecovery
     );
   }
 
@@ -451,12 +641,20 @@ class IntentBuilder<I> {
    * a pure request/reply action that has no local storage consequence on which to hang a gate. */
   requires(
     relation: string,
-    options: { readonly object: "workspace:self" } = { object: "workspace:self" },
+    options: { readonly object: "workspace:self" } = {
+      object: "workspace:self",
+    }
   ): IntentBuilder<I> {
-    if (!relation.trim()) throw new Error(`intent('${this.id}') requires a non-empty relation`);
+    if (!relation.trim())
+      throw new Error(`intent('${this.id}') requires a non-empty relation`);
     const gate = { relation, object: options.object };
-    if (this.intentRelationGate !== undefined && stable(this.intentRelationGate) !== stable(gate)) {
-      throw new Error(`intent('${this.id}') already has a different authorization gate`);
+    if (
+      this.intentRelationGate !== undefined &&
+      stable(this.intentRelationGate) !== stable(gate)
+    ) {
+      throw new Error(
+        `intent('${this.id}') already has a different authorization gate`
+      );
     }
     return new IntentBuilder(
       this.id,
@@ -467,6 +665,7 @@ class IntentBuilder<I> {
       this.acceptsWorkspaceEffects,
       gate,
       this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
     );
   }
 
@@ -476,7 +675,10 @@ class IntentBuilder<I> {
   reads(...reads: readonly (string | QueryDecl)[]): IntentBuilder<I> {
     const byKey = new Map<string, string | QueryDecl>();
     for (const read of [...this.intentReads, ...reads]) {
-      byKey.set(typeof read === "string" ? `ref:${read}` : `query:${read.id}`, read);
+      byKey.set(
+        typeof read === "string" ? `ref:${read}` : `query:${read.id}`,
+        read
+      );
     }
     return new IntentBuilder(
       this.id,
@@ -487,48 +689,69 @@ class IntentBuilder<I> {
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
       this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
     );
   }
 
   /** Add one declared child birth as a consequence; Nomos owns the private genesis recipe. */
   births<P extends Record<string, unknown>, F extends Record<string, Field>>(
     declaration: BusinessBirthDecl<P, F>,
-    payload: (facts: I) => P,
+    payload: (facts: I) => P
   ): IntentBuilder<I> {
     const directive = businessBirthConsequence(declaration);
-    return new IntentBuilder(this.id, this.contractDeclaration, [
-      ...this.steps,
-      { directive, payload },
-    ], this.workspaceEffects, this.intentReads, this.acceptsWorkspaceEffects, this.intentRelationGate, this.offerAuthenticationProof);
+    return new IntentBuilder(
+      this.id,
+      this.contractDeclaration,
+      [...this.steps, { directive, payload }],
+      this.workspaceEffects,
+      this.intentReads,
+      this.acceptsWorkspaceEffects,
+      this.intentRelationGate,
+      this.offerAuthenticationProof,
+      this.acceptsVerifiedBirthParentRecovery
+    );
   }
 
   /** Finish the intent and lower its directive graph to one atomic offer. */
   atomically(): BusinessIntent<I> {
     if (this.steps.length === 0 && this.workspaceEffects.length === 0) {
-      throw new Error(`intent('${this.id}') needs at least one directed consequence`);
+      throw new Error(
+        `intent('${this.id}') needs at least one directed consequence`
+      );
     }
     const duplicate = this.steps.find(
-      (step, index) => this.steps.findIndex((candidate) => candidate.directive.id === step.directive.id) !== index,
+      (step, index) =>
+        this.steps.findIndex(
+          (candidate) => candidate.directive.id === step.directive.id
+        ) !== index
     );
     if (duplicate !== undefined) {
-      throw new Error(`intent('${this.id}') directs '${duplicate.directive.id}' more than once`);
+      throw new Error(
+        `intent('${this.id}') directs '${duplicate.directive.id}' more than once`
+      );
     }
-    const birthSteps = this.steps.filter((step) => step.directive.birthsChild === true);
+    const birthSteps = this.steps.filter(
+      (step) => step.directive.birthsChild === true
+    );
     if (birthSteps.length > 1) {
-      throw new Error(`intent('${this.id}') cannot birth more than one durable life atomically`);
+      throw new Error(
+        `intent('${this.id}') cannot birth more than one durable life atomically`
+      );
     }
     for (const step of this.steps) {
       const unsupported = unsupportedKernelGate(step.directive);
       if (unsupported !== undefined) {
         throw new Error(
-          `intent('${this.id}') cannot compose '${step.directive.id}' yet: ${unsupported} needs intent-level lowering`,
+          `intent('${this.id}') cannot compose '${step.directive.id}' yet: ${unsupported} needs intent-level lowering`
         );
       }
     }
 
-    const primary = this.steps.find((step) => step.directive.birthsChild !== true)?.directive
-      ?? this.steps[0]?.directive
-      ?? this.workspaceEffects[0]!.target;
+    const primary =
+      this.steps.find((step) => step.directive.birthsChild !== true)
+        ?.directive ??
+      this.steps[0]?.directive ??
+      this.workspaceEffects[0]!.target;
     const allOutputs: SecondaryOutput[] = [];
     for (const step of this.steps) {
       const candidate = step.directive;
@@ -537,7 +760,9 @@ class IntentBuilder<I> {
           aggregateId: candidate.aggregateId,
           marker: candidate.marker,
           ...(candidate.outputCardinality === "many" ? { many: true } : {}),
-          ...(candidate.outputCardinality === "optional" ? { optional: true } : {}),
+          ...(candidate.outputCardinality === "optional"
+            ? { optional: true }
+            : {}),
         });
         allOutputs.push(...(candidate.secondaryOutputs ?? []));
       }
@@ -547,7 +772,9 @@ class IntentBuilder<I> {
       const key = `${output.marker}\0${output.aggregateId}`;
       outputGroups.set(key, [...(outputGroups.get(key) ?? []), output]);
     }
-    const composedOutput = (group: readonly SecondaryOutput[]): SecondaryOutput => ({
+    const composedOutput = (
+      group: readonly SecondaryOutput[]
+    ): SecondaryOutput => ({
       aggregateId: group[0]!.aggregateId,
       marker: group[0]!.marker,
       ...(group.length > 1 || group.some((output) => output.many === true)
@@ -556,35 +783,48 @@ class IntentBuilder<I> {
         ? { optional: true }
         : {}),
     });
-    const primaryOutput = this.steps.length === 0
-      ? undefined
-      : composedOutput(
-          outputGroups.get(`${primary.marker}\0${primary.aggregateId}`) ?? [{
-            aggregateId: primary.aggregateId,
-            marker: primary.marker,
-          }],
-        );
+    const primaryOutput =
+      this.steps.length === 0
+        ? undefined
+        : composedOutput(
+            outputGroups.get(`${primary.marker}\0${primary.aggregateId}`) ?? [
+              {
+                aggregateId: primary.aggregateId,
+                marker: primary.marker,
+              },
+            ]
+          );
     const secondaryOutputs = [...outputGroups.values()]
       .map(composedOutput)
       .filter(
-        (output) => !(output.aggregateId === primary.aggregateId && output.marker === primary.marker),
+        (output) =>
+          !(
+            output.aggregateId === primary.aggregateId &&
+            output.marker === primary.marker
+          )
       );
     const inferredReturns = [
       ...(primaryOutput === undefined ? [] : [primary.aggregateId]),
       ...secondaryOutputs.map((output) => output.aggregateId),
       ...birthSteps.flatMap((step) => {
-        const aggregateId = (step.directive as BusinessBirthDirective).businessBirth?.aggregateId;
+        const aggregateId = (step.directive as BusinessBirthDirective)
+          .businessBirth?.aggregateId;
         return aggregateId === undefined ? [] : [aggregateId];
       }),
     ].filter((value, index, values) => values.indexOf(value) === index);
-    const declaredReturns = this.contractDeclaration.returns?.map((aggregate) => aggregate.id);
+    const declaredReturns = this.contractDeclaration.returns?.map(
+      (aggregate) => aggregate.id
+    );
     if (
       declaredReturns !== undefined &&
-      stable([...new Set(declaredReturns)].sort()) !== stable([...inferredReturns].sort())
+      stable([...new Set(declaredReturns)].sort()) !==
+        stable([...inferredReturns].sort())
     ) {
       throw new Error(
-        `intent('${this.id}') contract returns ${declaredReturns.join(", ") || "nothing"}, but its ` +
-          `consequences affect ${inferredReturns.join(", ") || "nothing"}`,
+        `intent('${this.id}') contract returns ${
+          declaredReturns.join(", ") || "nothing"
+        }, but its ` +
+          `consequences affect ${inferredReturns.join(", ") || "nothing"}`
       );
     }
 
@@ -595,15 +835,16 @@ class IntentBuilder<I> {
           readId: privateReadId,
           ...rest
         } = condition;
-        const publicIdPayloadPath = privateIdPayloadPath === undefined
-          ? undefined
-          : remapStepPayloadPath(step, privateIdPayloadPath);
+        const publicIdPayloadPath =
+          privateIdPayloadPath === undefined
+            ? undefined
+            : remapStepPayloadPath(step, privateIdPayloadPath);
         let publicReadId: InvariantReadId | undefined;
         if (privateReadId !== undefined) {
           try {
             publicReadId = remapReadId(
               privateReadId,
-              step.payload(payloadTrace() as unknown as I),
+              step.payload(payloadTrace() as unknown as I)
             );
           } catch {
             publicReadId = undefined;
@@ -611,32 +852,43 @@ class IntentBuilder<I> {
         }
         return {
           ...rest,
-          ...(publicIdPayloadPath === undefined ? {} : { idPayloadPath: publicIdPayloadPath }),
+          ...(publicIdPayloadPath === undefined
+            ? {}
+            : { idPayloadPath: publicIdPayloadPath }),
           ...(publicReadId === undefined ? {} : { readId: publicReadId }),
-          idField: (facts: unknown) => condition.idField(step.payload(facts as I)),
+          idField: (facts: unknown) =>
+            condition.idField(step.payload(facts as I)),
         };
-      }),
+      })
     );
     const intentQueryReads = this.intentReads.filter(
-      (read): read is QueryDecl => typeof read !== "string",
+      (read): read is QueryDecl => typeof read !== "string"
     );
     const intentRefReads = this.intentReads.filter(
-      (read): read is string => typeof read === "string",
+      (read): read is string => typeof read === "string"
     );
     const queryReads = dedupeBy(
-      [...intentQueryReads, ...this.steps.flatMap((step) => step.directive.declaredQueryReads ?? [])],
-      (query) => query.id,
+      [
+        ...intentQueryReads,
+        ...this.steps.flatMap(
+          (step) => step.directive.declaredQueryReads ?? []
+        ),
+      ],
+      (query) => query.id
     );
     const foreignReads = dedupeBy(
       this.steps.flatMap((step) => step.directive.declaredForeignReads ?? []),
-      (read) => stable(read),
+      (read) => stable(read)
     );
     const emits: Record<string, { max?: number }> = {};
     for (const step of this.steps) {
-      for (const [event, declaration] of Object.entries(step.directive.declaredEmits)) {
+      for (const [event, declaration] of Object.entries(
+        step.directive.declaredEmits
+      )) {
         const prior = emits[event];
         if (prior === undefined) {
-          emits[event] = declaration.max === undefined ? {} : { max: declaration.max };
+          emits[event] =
+            declaration.max === undefined ? {} : { max: declaration.max };
         } else if (prior.max === undefined || declaration.max === undefined) {
           emits[event] = {};
         } else {
@@ -650,26 +902,31 @@ class IntentBuilder<I> {
       inheritedRelationGate !== undefined &&
       stable(this.intentRelationGate) !== stable(inheritedRelationGate)
     ) {
-      throw new Error(`intent('${this.id}') has conflicting intent and consequence authorization gates`);
+      throw new Error(
+        `intent('${this.id}') has conflicting intent and consequence authorization gates`
+      );
     }
     const relationGate = this.intentRelationGate ?? inheritedRelationGate;
     if (
       this.acceptsWorkspaceEffects &&
-      (relationGate === undefined || relationGate.object !== "workspace:self" || relationGate.objectFrom !== undefined)
+      !this.acceptsVerifiedBirthParentRecovery &&
+      (relationGate === undefined ||
+        relationGate.object !== "workspace:self" ||
+        relationGate.objectFrom !== undefined)
     ) {
       throw new Error(
         `intent('${this.id}') .acceptsWorkspaceEffect() requires one static ` +
-          `.requires(relation, { object: "workspace:self" }) consequence gate`,
+          `.requires(relation, { object: "workspace:self" }) consequence gate`
       );
     }
     const sourceTrusts = this.steps.flatMap((step) =>
       step.directive.businessSourceTrust === undefined
         ? []
-        : [remapBusinessSourceTrust(step, step.directive.businessSourceTrust)],
+        : [remapBusinessSourceTrust(step, step.directive.businessSourceTrust)]
     );
     if (sourceTrusts.length > 1) {
       throw new Error(
-        `intent('${this.id}') composes more than one source-trust preflight — split the business action by source`,
+        `intent('${this.id}') composes more than one source-trust preflight — split the business action by source`
       );
     }
     const steps = [...this.steps];
@@ -680,19 +937,26 @@ class IntentBuilder<I> {
         const result = step.directive.plan(mapped, ctx);
         if (!Array.isArray(result)) {
           throw new Error(
-            `intent '${this.id}' consequence '${step.directive.id}' did not return an operation array`,
+            `intent '${this.id}' consequence '${step.directive.id}' did not return an operation array`
           );
         }
-        returned.push(...result.map((op) => composePrimaryConsequenceOp(step.directive, op)));
+        returned.push(
+          ...result.map((op) => composePrimaryConsequenceOp(step.directive, op))
+        );
       }
       return returned;
     };
 
-    const businessBirth = (birthSteps[0]?.directive as BusinessBirthDirective | undefined)?.businessBirth;
-    const bindBusinessBirthPolicy =
-      (birthSteps[0]?.directive as BusinessBirthDirective | undefined)?.[BUSINESS_BIRTH_POLICY_BINDING];
+    const businessBirth = (
+      birthSteps[0]?.directive as BusinessBirthDirective | undefined
+    )?.businessBirth;
+    const bindBusinessBirthPolicy = (
+      birthSteps[0]?.directive as BusinessBirthDirective | undefined
+    )?.[BUSINESS_BIRTH_POLICY_BINDING];
     const carriedCapabilities = [
-      ...new Set(this.steps.flatMap((step) => capabilityDeclarationsOf(step.directive))),
+      ...new Set(
+        this.steps.flatMap((step) => capabilityDeclarationsOf(step.directive))
+      ),
     ];
     return {
       [INTENT_BRAND]: true,
@@ -708,21 +972,29 @@ class IntentBuilder<I> {
       // runtime plan may retain only this intent export; without the handle the
       // engine cannot rebuild its aggregate registry entry and silently drops
       // compound intents that also birth a child.
-      ...(primary.aggregate === undefined ? {} : { aggregate: primary.aggregate }),
+      ...(primary.aggregate === undefined
+        ? {}
+        : { aggregate: primary.aggregate }),
       ...(primaryOutput?.many === true
         ? { outputCardinality: "many" as const }
         : primaryOutput?.optional === true
         ? { outputCardinality: "optional" as const }
         : {}),
       ...(secondaryOutputs.length > 0 ? { secondaryOutputs } : {}),
-      payloadSchema: (birthSteps[0]?.directive.payloadSchema ?? this.contractDeclaration.accepts) as unknown as z.ZodType<I>,
+      payloadSchema: (birthSteps[0]?.directive.payloadSchema ??
+        this.contractDeclaration.accepts) as unknown as z.ZodType<I>,
       plan,
       steps,
       workspaceEffects: this.workspaceEffects,
       ...(this.offerAuthenticationProof === undefined
         ? {}
         : { offerAuthenticationProof: this.offerAuthenticationProof }),
-      ...(this.acceptsWorkspaceEffects ? { acceptsWorkspaceEffectGate: true as const } : {}),
+      ...(this.acceptsWorkspaceEffects
+        ? { acceptsWorkspaceEffectGate: true as const }
+        : {}),
+      ...(this.acceptsVerifiedBirthParentRecovery
+        ? { acceptsVerifiedBirthParentRecoveryGate: true as const }
+        : {}),
       declaredReads: [
         ...new Set([
           ...intentRefReads,
@@ -730,17 +1002,23 @@ class IntentBuilder<I> {
         ]),
       ].sort(),
       ...(queryReads.length > 0 ? { declaredQueryReads: queryReads } : {}),
-      ...(foreignReads.length > 0 ? { declaredForeignReads: foreignReads } : {}),
+      ...(foreignReads.length > 0
+        ? { declaredForeignReads: foreignReads }
+        : {}),
       declaredEmits: emits,
       declaredRelations: dedupeBy(
         this.steps.flatMap((step) => step.directive.declaredRelations),
-        (relation) => stable(relation),
+        (relation) => stable(relation)
       ),
       declaredHostCapabilities: [
-        ...new Set(this.steps.flatMap((step) => step.directive.declaredHostCapabilities)),
+        ...new Set(
+          this.steps.flatMap((step) => step.directive.declaredHostCapabilities)
+        ),
       ].sort(),
       ...(preconditions.length > 0 ? { preconditions } : {}),
-      ...(relationGate !== undefined ? { requiresRelationGate: relationGate } : {}),
+      ...(relationGate !== undefined
+        ? { requiresRelationGate: relationGate }
+        : {}),
       ...(sourceTrusts[0] === undefined
         ? {}
         : { businessSourceTrust: sourceTrusts[0] }),
@@ -775,9 +1053,14 @@ class IntentContractStep {
    */
   performs<P>(effect: Directive<P>): BusinessIntent<P> {
     if (isBusinessIntent(effect)) {
-      throw new Error(`intent('${this.id}').performs(...) expects a private directive effect, not an intent`);
+      throw new Error(
+        `intent('${this.id}').performs(...) expects a private directive effect, not an intent`
+      );
     }
-    const step: IntentStep<P, P> = { directive: effect, payload: (facts) => facts };
+    const step: IntentStep<P, P> = {
+      directive: effect,
+      payload: (facts) => facts,
+    };
     // A one-effect publication does not need to synthesize or approximate any
     // kernel policy. Preserve the effect's complete metadata (birth, access,
     // custody, recovery, preconditions, activity...) and change only the public
@@ -789,33 +1072,48 @@ class IntentContractStep {
       id: this.id,
       contract: {
         accepts: effect.payloadSchema,
-        returns: Object.freeze([
-          effect.aggregateId,
-          ...(effect.secondaryOutputs ?? []).map((output) => output.aggregateId),
-        ].filter((value, index, values) => values.indexOf(value) === index)),
+        returns: Object.freeze(
+          [
+            effect.aggregateId,
+            ...(effect.secondaryOutputs ?? []).map(
+              (output) => output.aggregateId
+            ),
+          ].filter((value, index, values) => values.indexOf(value) === index)
+        ),
         refuses: Object.freeze([]),
       },
       steps: [step],
       workspaceEffects: [],
-      plan: (facts, ctx) => effect
-        .plan(effect.payloadSchema.parse(facts), ctx)
-        .map((op) => composePrimaryConsequenceOp(effect, op)),
+      plan: (facts, ctx) =>
+        effect
+          .plan(effect.payloadSchema.parse(facts), ctx)
+          .map((op) => composePrimaryConsequenceOp(effect, op)),
     };
   }
 
   /** Begin an intent from one declared business birth without repeating its payload schema. */
   births<P extends Record<string, unknown>, F extends Record<string, Field>>(
-    declaration: BusinessBirthDecl<P, F>,
+    declaration: BusinessBirthDecl<P, F>
   ): IntentBuilder<P> {
-    return new IntentBuilder<P>(this.id, { accepts: declaration.payloadSchema as z.ZodType<P> }, [
-      { directive: businessBirthConsequence(declaration), payload: (facts) => facts },
-    ]);
+    return new IntentBuilder<P>(
+      this.id,
+      { accepts: declaration.payloadSchema as z.ZodType<P> },
+      [
+        {
+          directive: businessBirthConsequence(declaration),
+          payload: (facts) => facts,
+        },
+      ]
+    );
   }
 
   contract<S extends z.ZodTypeAny>(
-    declaration: IntentContractDeclaration<z.infer<S>> & { readonly accepts: S },
+    declaration: IntentContractDeclaration<z.infer<S>> & { readonly accepts: S }
   ): IntentBuilder<z.infer<S>> {
-    return new IntentBuilder(this.id, declaration as IntentContractDeclaration<z.infer<S>>);
+    return new IntentBuilder(
+      this.id,
+      declaration as IntentContractDeclaration<z.infer<S>>
+    );
   }
 }
 
@@ -823,7 +1121,9 @@ class IntentContractStep {
 export function intent<const Id extends string>(id: Id): IntentContractStep {
   if (id.trim().length === 0) throw new Error("intent id must not be empty");
   if (id.startsWith("_nms")) {
-    throw new Error(`intent id '${id}' uses Nomos's reserved internal prefix '_nms'`);
+    throw new Error(
+      `intent id '${id}' uses Nomos's reserved internal prefix '_nms'`
+    );
   }
   return new IntentContractStep(id);
 }
@@ -840,16 +1140,21 @@ export function isBusinessIntent(value: unknown): value is BusinessIntent<any> {
 export function language(
   domain: string,
   intents: readonly BusinessIntent<any>[],
-  options: ApplicationLanguageOptions = {},
+  options: ApplicationLanguageOptions = {}
 ): ApplicationLanguage {
-  if (domain.trim().length === 0) throw new Error("language domain must not be empty");
+  if (domain.trim().length === 0)
+    throw new Error("language domain must not be empty");
   const seen = new Set<string>();
   for (const candidate of intents) {
     if (!isBusinessIntent(candidate)) {
-      throw new Error(`language('${domain}') accepts finished intent(...).atomically() declarations only`);
+      throw new Error(
+        `language('${domain}') accepts finished intent(...).atomically() declarations only`
+      );
     }
     if (seen.has(candidate.id)) {
-      throw new Error(`language('${domain}') publishes intent '${candidate.id}' more than once`);
+      throw new Error(
+        `language('${domain}') publishes intent '${candidate.id}' more than once`
+      );
     }
     seen.add(candidate.id);
   }
@@ -858,7 +1163,7 @@ export function language(
     for (const initiator of policy.initiatedBy) {
       if (!intents.some((candidate) => candidate.id === initiator.id)) {
         throw new Error(
-          `language('${domain}') workspaceSharing(${policy.orders.id}) initiator '${initiator.id}' is not a public business action`,
+          `language('${domain}') workspaceSharing(${policy.orders.id}) initiator '${initiator.id}' is not a public business action`
         );
       }
     }
@@ -871,7 +1176,9 @@ export function language(
   };
 }
 
-export function isApplicationLanguage(value: unknown): value is ApplicationLanguage {
+export function isApplicationLanguage(
+  value: unknown
+): value is ApplicationLanguage {
   return (
     value !== null &&
     typeof value === "object" &&
@@ -881,7 +1188,7 @@ export function isApplicationLanguage(value: unknown): value is ApplicationLangu
 
 export function applicationLanguageOf(
   modules: readonly Record<string, unknown>[],
-  domain: string,
+  domain: string
 ): ApplicationLanguage | undefined {
   const found: ApplicationLanguage[] = [];
   for (const mod of modules) {
@@ -891,12 +1198,14 @@ export function applicationLanguageOf(
   }
   const unique = [...new Set(found)];
   if (unique.length > 1) {
-    throw new Error(`domain '${domain}' exports more than one application language`);
+    throw new Error(
+      `domain '${domain}' exports more than one application language`
+    );
   }
   const language = unique[0];
   if (language !== undefined && language.domain !== domain) {
     throw new Error(
-      `domain '${domain}' exports language('${language.domain}') — the language name must match its domain`,
+      `domain '${domain}' exports language('${language.domain}') — the language name must match its domain`
     );
   }
   return language;
@@ -910,17 +1219,21 @@ export function applicationLanguageOf(
 export function executableDirectivesForLanguage(
   language: ApplicationLanguage,
   discovered: readonly Directive<any>[],
-  domain: string,
+  domain: string
 ): Directive<any>[] {
-  const publicById = new Map(language.intents.map((candidate) => [candidate.id, candidate]));
+  const publicById = new Map(
+    language.intents.map((candidate) => [candidate.id, candidate])
+  );
   const privateIds = new Set(
-    language.intents.flatMap((candidate) => candidate.steps.map((step) => step.directive.id)),
+    language.intents.flatMap((candidate) =>
+      candidate.steps.map((step) => step.directive.id)
+    )
   );
 
   for (const candidate of language.intents) {
     if (privateIds.has(candidate.id)) {
       throw new Error(
-        `domain '${domain}' publishes intent '${candidate.id}' with the same name as one of its private directives`,
+        `domain '${domain}' publishes intent '${candidate.id}' with the same name as one of its private directives`
       );
     }
   }
@@ -933,22 +1246,23 @@ export function executableDirectivesForLanguage(
       candidate.marker === published.marker &&
       candidate.steps.length === published.steps.length &&
       candidate.steps.every(
-        (step, index) => step.directive.id === published.steps[index]?.directive.id,
+        (step, index) =>
+          step.directive.id === published.steps[index]?.directive.id
       );
     if (published !== undefined && candidate !== published && !sameLowering) {
       throw new Error(
-        `domain '${domain}' intent '${candidate.id}' collides with a different directive — rename one of them`,
+        `domain '${domain}' intent '${candidate.id}' collides with a different directive — rename one of them`
       );
     }
     if (isBusinessIntent(candidate) && published === undefined) {
       throw new Error(
-        `domain '${domain}' exports intent '${candidate.id}' outside its declared language — add it to language('${domain}', [...]) or remove it`,
+        `domain '${domain}' exports intent '${candidate.id}' outside its declared language — add it to language('${domain}', [...]) or remove it`
       );
     }
   }
 
   const remaining = discovered.filter(
-    (candidate) => !privateIds.has(candidate.id) && !isBusinessIntent(candidate),
+    (candidate) => !privateIds.has(candidate.id) && !isBusinessIntent(candidate)
   );
   return [...remaining, ...language.intents];
 }
@@ -962,16 +1276,20 @@ export function executableDirectivesForLanguage(
 export function assertApplicationLanguageCoversAuthoredDirectives(
   language: ApplicationLanguage,
   authored: readonly Directive<any>[],
-  domain: string,
+  domain: string
 ): void {
   const publicIds = new Set(language.intents.map((candidate) => candidate.id));
   const privateIds = new Set(
-    language.intents.flatMap((candidate) => candidate.steps.map((step) => step.directive.id)),
+    language.intents.flatMap((candidate) =>
+      candidate.steps.map((step) => step.directive.id)
+    )
   );
   const sharingReceiptIds = new Set(
     language.workspaceSharing.flatMap((policy) =>
-      [...policy.delivered, ...policy.refused].map((receipt) => receipt.records.id)
-    ),
+      [...policy.delivered, ...policy.refused].map(
+        (receipt) => receipt.records.id
+      )
+    )
   );
   const uncovered = authored
     .filter(
@@ -979,15 +1297,17 @@ export function assertApplicationLanguageCoversAuthoredDirectives(
         directive.businessBirthInternal !== true &&
         !publicIds.has(directive.id) &&
         !privateIds.has(directive.id) &&
-        !sharingReceiptIds.has(directive.id),
+        !sharingReceiptIds.has(directive.id)
     )
     .map((directive) => directive.id)
     .sort();
   if (uncovered.length > 0) {
     throw new Error(
       `domain '${domain}' declares language('${domain}', [...]) but still exports routable directive ` +
-        `${uncovered.map((id) => `'${id}'`).join(", ")} outside it — publish business intents for ` +
-        `those actions or make their effects private`,
+        `${uncovered
+          .map((id) => `'${id}'`)
+          .join(", ")} outside it — publish business intents for ` +
+        `those actions or make their effects private`
     );
   }
 }
@@ -995,36 +1315,43 @@ export function assertApplicationLanguageCoversAuthoredDirectives(
 /** Carry a private directive's invariant onto every public intent that uses it. */
 export function remapWorkspaceInvariantsForLanguage(
   invariants: readonly WorkspaceInvariantDecl[],
-  language: ApplicationLanguage,
+  language: ApplicationLanguage
 ): WorkspaceInvariantDecl[] {
   const out: WorkspaceInvariantDecl[] = [];
   for (const invariant of invariants) {
     const uses = language.intents.flatMap((candidate) =>
       candidate.steps
         .filter((step) => step.directive.id === invariant.on)
-        .map((step) => ({ intent: candidate, step })),
+        .map((step) => ({ intent: candidate, step }))
     );
     if (uses.length === 0) {
       out.push(invariant);
       continue;
     }
     for (const use of uses) {
-      const mapFacts = (facts: Record<string, unknown>): Record<string, unknown> => {
+      const mapFacts = (
+        facts: Record<string, unknown>
+      ): Record<string, unknown> => {
         const mapped = use.step.payload(facts);
         const parsed = use.step.directive.payloadSchema.safeParse(mapped);
         // The flow/security compiler probes invariant read-sets with empty
         // placeholder facts. That probe must remain total even when the real
         // business payload requires non-empty values. Runtime intent planning
         // still validates every mapped consequence before it can commit.
-        return (parsed.success ? parsed.data : mapped) as Record<string, unknown>;
+        return (parsed.success ? parsed.data : mapped) as Record<
+          string,
+          unknown
+        >;
       };
       // Never carry a private payload path blindly onto a public intent. Prove the
       // mapping structurally with inert path values; otherwise leave the selector
       // compiler-visible so the native-only gate can name the exact unmapped law.
-      const remappedNativeReads = invariant.__nomosReadBindings === undefined
-        ? undefined
-        : remapNativeReads(invariant.__nomosReadBindings, use.step);
-      const { __nomosReadBindings: _privateReads, ...withoutPrivateReads } = invariant;
+      const remappedNativeReads =
+        invariant.__nomosReadBindings === undefined
+          ? undefined
+          : remapNativeReads(invariant.__nomosReadBindings, use.step);
+      const { __nomosReadBindings: _privateReads, ...withoutPrivateReads } =
+        invariant;
       out.push({
         ...withoutPrivateReads,
         id: `${use.intent.id}__${invariant.id}`,
@@ -1032,11 +1359,15 @@ export function remapWorkspaceInvariantsForLanguage(
         ...(remappedNativeReads === undefined
           ? {}
           : { __nomosReadBindings: remappedNativeReads }),
-        reads: (ctx) => invariant.reads({ ...ctx, intent: mapFacts(ctx.intent) }),
-        assert: (snapshots, ctx) => invariant.assert(
-          snapshots,
-          ctx === undefined ? undefined : { ...ctx, intent: mapFacts(ctx.intent) },
-        ),
+        reads: (ctx) =>
+          invariant.reads({ ...ctx, intent: mapFacts(ctx.intent) }),
+        assert: (snapshots, ctx) =>
+          invariant.assert(
+            snapshots,
+            ctx === undefined
+              ? undefined
+              : { ...ctx, intent: mapFacts(ctx.intent) }
+          ),
       });
     }
   }