@githolon/dsl 0.108.4 → 0.108.7

package/src/fields.ts

@@ -1079,9 +1079,8 @@ export const t = {
       { timestamp: true },
     ) as TimestampField<number>;
   },
-  /** A boolean flag (Lww). Stored as the kernel scalar `"true"`/`"false"` and decoded back to a real
-   *  JSON boolean on read — so a flag is `t.bool()`, not a 2-value `t.enum`. Counts/filters key on the
-   *  same string form. (Not encryptable — only Lww-class scalars are, and bool already is.) */
+  /** A first-class USDA boolean flag (Lww). It remains a boolean through authored law, kernel state,
+   *  canonical custody and generated reads; it is never lowered through a string or JSON value. */
   bool(): Field<boolean, "bool"> {
     return makeField("bool", z.boolean(), FirstWriterWins);
   },

package/src/framework/application_home.ts

@@ -10,6 +10,7 @@
 
 import type { AggregateHandle } from "../aggregate.js";
 import type { ApplicationHomeGenesis } from "../application_home_genesis.js";
+import type { WorkspaceRole } from "../births.js";
 import type { Directive } from "../directive.js";
 import type { QueryDecl } from "../query.js";
 import { APPLICATION_HOME_DOMAIN } from "./application_home_domain.js";
@@ -79,6 +80,7 @@ export function applicationHomePolicyLaw(
   maxChildWorkspacesPerUser: number,
   birthPolicyDomains: readonly string[],
   homeGenesis?: ApplicationHomeGenesis,
+  parentWorkspaceRoles: readonly WorkspaceRole[] = [],
 ) {
   return {
     __nomos_birthReceivingGroup: directive(
@@ -87,6 +89,7 @@ export function applicationHomePolicyLaw(
         maxChildWorkspacesPerUser,
         birthPolicyDomains,
         homeGenesis,
+        parentWorkspaceRoles,
       ),
     ),
   };

package/src/framework/auth_provider_law.ts

@@ -196,30 +196,7 @@ export type AuthProviderVerifyingConfiguration = Omit<
 /** Read the current provider through its three declared O(1) indexes and reconstruct the one nominal
  * configuration value used by child genesis and provider-epoch effects. */
 function readCurrentAuthProviderRows() {
-  try {
-    return readFrameworkDeclaredRows(authProvider, AuthProvider, { scope: "platform" });
-  } catch (error) {
-    // Law plans execute in the deterministic VM, not in the compiler's Node
-    // realm. Imported class identity therefore cannot be used as an
-    // `instanceof` discriminator here: the compiler may carry the property
-    // path without carrying a constructible host class. Zod's issue list is
-    // already the nominal failure disclosure we need; inspect that bounded
-    // shape without depending on host-realm prototype identity.
-    const issues = error !== null && typeof error === "object" &&
-      "issues" in error && Array.isArray(error.issues)
-      ? error.issues
-      : [];
-    if (issues.some((issue: unknown) =>
-      issue !== null && typeof issue === "object" &&
-      "code" in issue && issue.code === "unrecognized_keys" &&
-      "keys" in issue && Array.isArray(issue.keys) && issue.keys.includes("keys")
-    )) {
-      throw new Error(
-        "the AuthProvider still uses the historical serialized key field; migrate it to a typed keySet first",
-      );
-    }
-    throw error;
-  }
+  return readFrameworkDeclaredRows(authProvider, AuthProvider, { scope: "platform" });
 }
 
 type CurrentAuthProviderRow = ReturnType<typeof readCurrentAuthProviderRows>[number];
@@ -265,6 +242,9 @@ function readCurrentAuthProviderValue(): {
             )
             .map((certificate) => certificate.derBase64),
         }));
+  if (keyEpoch === undefined || keys.length === 0) {
+    throw new Error("the current AuthProvider has no typed verifying-key epoch");
+  }
   return {
     provider,
     verifying: {
@@ -373,10 +353,13 @@ export function writeAuthProviderKeySet(keySet: z.infer<typeof authProviderKeySe
   return ops;
 }
 
-export function writeAuthProviderConfiguration(p: AuthProviderConfiguration): PlannedOp[] {
+function writeAuthProviderConfigurationWithMarker(
+  p: AuthProviderConfiguration,
+  marker: "ensures" | "mutates",
+): PlannedOp[] {
   const ap = instance(AuthProvider, AUTH_PROVIDER_ID);
   return [
-    withMarker(set(ap, "scope", "platform"), "ensures"),
+    withMarker(set(ap, "scope", "platform"), marker),
     set(ap, "issuer", p.issuer),
     set(ap, "jwksUrl", p.jwksUrl),
     ...(p.audience ? [set(ap, "audience", p.audience)] : []),
@@ -400,10 +383,19 @@ export function writeAuthProviderConfiguration(p: AuthProviderConfiguration): Pl
   ];
 }
 
+/** Birth creates the singleton; maintenance requires the existing singleton. */
+export function writeAuthProviderConfiguration(p: AuthProviderConfiguration): PlannedOp[] {
+  return writeAuthProviderConfigurationWithMarker(p, "ensures");
+}
+
+export function updateAuthProviderConfiguration(p: AuthProviderConfiguration): PlannedOp[] {
+  return writeAuthProviderConfigurationWithMarker(p, "mutates");
+}
+
 export const setAuthProvider = directive("setAuthProvider")
-  .ensures(AuthProvider)
+  .mutates(AuthProvider)
   .payload(authProviderConfiguration)
-  .plan(writeAuthProviderConfiguration)
+  .plan(updateAuthProviderConfiguration)
   .alsoEnsuresMany(AuthProviderKey)
   .alsoEnsuresMany(AuthProviderCertificate)
   .requires("admin");

package/src/framework/genesis.ts

@@ -35,6 +35,11 @@ import { directive } from "../directive.js";
 import { set, type PlannedOp } from "../ops.js";
 import { RelationTuple, writeTuple } from "./relations.js";
 import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
+import {
+  ADMISSION_CHECKPOINT_PRINCIPAL,
+  SIGNER_RELATION,
+  signerObject,
+} from "./signing_identity.js";
 
 /**
  * Deterministic singleton id of the founding warrant — MUST equal
@@ -60,12 +65,31 @@ export const GenesisWarrant = aggregate("GenesisWarrant", {
 export type GenesisWarrantHandle = typeof GenesisWarrant;
 
 /** The framework PRIMITIVE plan: record the founding warrant (singleton). */
-export function writeGenesisWarrant(p: { principal: string; workspaceId: string; bornAt: string }): PlannedOp[] {
+export function writeGenesisWarrant(p: {
+  principal: string;
+  workspaceId: string;
+  bornAt: string;
+  admissionCheckpointSigners?: readonly {
+    keyHash: string;
+    validFromEpoch: number;
+  }[] | undefined;
+}): PlannedOp[] {
   const w = instance(GenesisWarrant, GENESIS_WARRANT_ID);
   return [
     set(w, "principal", p.principal),
     set(w, "workspaceId", p.workspaceId),
     set(w, "bornAt", p.bornAt),
+    ...(p.admissionCheckpointSigners ?? []).flatMap((signer) =>
+      writeTuple({
+        object: signerObject(ADMISSION_CHECKPOINT_PRINCIPAL),
+        relation: SIGNER_RELATION,
+        subject: `key:${signer.keyHash}`,
+        grantedBy: p.principal,
+        grantedAt: p.bornAt,
+        validFromEpoch: signer.validFromEpoch,
+        verifiedVia: "workspace-genesis",
+      })
+    ),
   ];
 }
 
@@ -95,6 +119,13 @@ export const seedGenesis = directive("seedGenesis")
       // here; this directive just writes the warrant it is given. Era: the regime is per-workspace, at genesis.
       workspaceId: z.string(),
       bornAt: z.string().min(1),
+      /** Public workload identities already enrolled by the verified parent. The kernel derives this
+       * list from folded parent law-state while assembling a child warrant; neither host nor tenant
+       * payload can nominate a key, and the corresponding secret never enters custody. */
+      admissionCheckpointSigners: z.array(z.object({
+        keyHash: z.string().regex(/^[0-9a-f]{64}$/),
+        validFromEpoch: z.number().int().nonnegative(),
+      }).strict()).optional(),
     }),
   )
   .plan((p) => [

package/src/framework/home.ts

@@ -33,7 +33,7 @@ import { directive } from "../directive.js";
 import { ensure } from "../authoring.js";
 import { set, withMarker, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
-import { birth } from "../births.js";
+import { birth, type WorkspaceRole } from "../births.js";
 import {
   authProvider as authProviderQuery,
   authProviderCertificates as authProviderCertificatesQuery,
@@ -42,8 +42,13 @@ import {
   seedAuthProvider,
 } from "./auth_provider_law.js";
 import { readRef, readSet, workspaceInvariant, refAs } from "./workspace_invariant.js";
-import { identityRelations } from "./signing_identity.js";
-import { RelationTuple, writeTuple } from "./relations.js";
+import {
+  identityRelations,
+} from "./signing_identity.js";
+import {
+  RelationTuple,
+  writeTuple,
+} from "./relations.js";
 import { relationType, self, user, selfObject } from "../relation_schema.js";
 import { requireParentAttestedBirth, type ParentAttestedBirthMarker } from "../births.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
@@ -123,12 +128,26 @@ export const DEFAULT_RECEIVING_GROUP_POLICY = {
   guardianQuorum: 1,
 } as const;
 
-function writeReceivingGroupPolicy(p: { setAt: string }): PlannedOp[] {
+/** The recovery authorities a receiving group may explicitly select. The default remains guardian
+ * quorum; an application must deliberately choose its attested parent identity provider. */
+export const RECEIVING_GROUP_RECOVERY_POLICIES = [
+  "guardian-quorum",
+  "platform-identity-provider",
+] as const;
+export const receivingGroupRecoveryPolicy = z.enum(RECEIVING_GROUP_RECOVERY_POLICIES);
+export type ReceivingGroupRecoveryPolicy = z.infer<typeof receivingGroupRecoveryPolicy>;
+export const PLATFORM_IDENTITY_PROVIDER_RECOVERY: ReceivingGroupRecoveryPolicy =
+  "platform-identity-provider";
+
+function writeReceivingGroupPolicy(p: {
+  setAt: string;
+  recovery?: ReceivingGroupRecoveryPolicy | undefined;
+}): PlannedOp[] {
   const policy = instance(ReceivingGroupPolicy, RECEIVING_GROUP_POLICY_ID);
   return [
     set(policy, "additionalDevice", DEFAULT_RECEIVING_GROUP_POLICY.additionalDevice),
     set(policy, "revocation", DEFAULT_RECEIVING_GROUP_POLICY.revocation),
-    set(policy, "recovery", DEFAULT_RECEIVING_GROUP_POLICY.recovery),
+    set(policy, "recovery", p.recovery ?? DEFAULT_RECEIVING_GROUP_POLICY.recovery),
     set(policy, "guardianQuorum", DEFAULT_RECEIVING_GROUP_POLICY.guardianQuorum),
     set(policy, "setAt", p.setAt),
   ];
@@ -137,7 +156,10 @@ function writeReceivingGroupPolicy(p: { setAt: string }): PlannedOp[] {
 /** Genesis-only default policy. Policy changes become a separate, guardian-aware ceremony. */
 export const seedReceivingGroupPolicy = directive("nomosInternalSeedReceivingGroupPolicy7c1f5e")
   .ensures(ReceivingGroupPolicy)
-  .payload(z.object({ setAt: z.string().min(1) }))
+  .payload(z.object({
+    setAt: z.string().min(1),
+    recovery: receivingGroupRecoveryPolicy.optional(),
+  }))
   .plan((p) => writeReceivingGroupPolicy(p));
 
 /**
@@ -306,6 +328,7 @@ export function birthReceivingGroupForDomain(
   maxChildWorkspacesPerUser: number,
   birthPolicyDomains: readonly string[],
   homeGenesis?: ApplicationHomeGenesis,
+  parentWorkspaceRoles: readonly WorkspaceRole[] = [],
 ) {
   if (groupLawDomain.length === 0) {
     throw new Error("birthReceivingGroupForDomain requires a non-empty receiving-group law domain");
@@ -438,12 +461,26 @@ export function birthReceivingGroupForDomain(
     // THE DECLARED BIRTH EFFECT (the unix model): the recipe rides the committed intent as a declared output
     // (captured_ports.births). The kernel — reading the `.births()` declaration off the law manifest — takes
     // the recipe and spawns + self-validates the child through the child's OWN gate (each step self-verifies).
-    birth({ workspace: groupName, genesisChain });
-    return [];
+    birth({
+      workspace: groupName,
+      genesisChain,
+      ...(parentWorkspaceRoles.length > 0 ? { parentWorkspaceRoles } : {}),
+    });
+    // Parent/child lineage is an ordinary global Zanzibar relation in parent custody. The exact child
+    // address comes from the same plan which births it, so neither the host nor the caller can redirect
+    // this seat. Application law can then authorize upward workspace effects with the ordinary relation.
+    return writeTuple({
+      object: "workspace:self",
+      relation: "child",
+      subject: `workspace:${groupName}`,
+      grantedBy: p.owner,
+      grantedAt: p.bornAt,
+    });
   })
   .reads(authProviderQuery) // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
   .reads(authProviderKeysQuery)
   .reads(authProviderCertificatesQuery)
+  .alsoEnsures(RelationTuple)
   .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
   return {
     ...birthDirective,

package/src/framework/signing_identity.ts

@@ -59,6 +59,7 @@ import {
   relationTupleInstanceId,
 } from "./relations.js";
 import { MODEL_LIFECYCLE_AUTHORITY } from "./domain_lifecycle.js";
+import { readFrameworkDeclaredRows } from "../read.js";
 
 /**
  * The framework `identity` relation schema — the `signer` relation, LEAF-ONLY
@@ -377,6 +378,19 @@ export const SignerDelegation = aggregate("SignerDelegation", {
 }).public();
 export type SignerDelegationHandle = typeof SignerDelegation;
 
+/** The bounded, typed disclosure a parent workspace may carry when its law recovers a child device.
+ * It deliberately excludes the historical certJson slot: current cross-workspace law consumes only
+ * the nominal certificate fields and the exact signer key subject admitted by the parent. */
+export const signerDelegationRecoveryEvidence = z.object({
+  user: z.string().min(1),
+  deviceKeySubject: z.string().regex(/^key:[0-9a-f]{64}$/),
+  enrolledAt: z.string().min(1),
+  certificate: birthCertificatePayload,
+}).strict();
+export type SignerDelegationRecoveryEvidence = z.infer<
+  typeof signerDelegationRecoveryEvidence
+>;
+
 /** The deterministic singleton id of a user's signer delegation (the kernel reads THIS id by-user). */
 export function signerDelegationInstanceId(user: string): string {
   return SIGNER_DELEGATION_PREFIX + user;
@@ -405,6 +419,25 @@ function writeDelegationCertificate(
   ];
 }
 
+/** Materialise the exact typed delegation disclosed by a parent during device
+ * recovery. Keeping this beside the canonical SignerDelegation definition and
+ * certificate writer gives application law one compositional write primitive;
+ * it does not need to mirror the certificate fields or serialize a document. */
+export function writeSignerDelegationRecoveryEvidence(
+  evidence: SignerDelegationRecoveryEvidence,
+): PlannedOp[] {
+  const delegation = instance(
+    SignerDelegation,
+    signerDelegationInstanceId(evidence.user),
+  );
+  return [
+    set(delegation, "user", evidence.user),
+    set(delegation, "deviceKey", evidence.deviceKeySubject),
+    set(delegation, "enrolledAt", evidence.enrolledAt),
+    ...writeDelegationCertificate(delegation, evidence.certificate),
+  ];
+}
+
 /**
  * `enrollFirstDevice` (architecture/keyless_verified_onboard.md) — THE KEYLESS VERIFIED FIRST-DEVICE
  * self-onboard. A brand-new principal (an IdP-verified user with NO enrolled signer key) bootstraps its
@@ -575,6 +608,51 @@ export const enrollDelegation = directive("enrollDelegation")
 /** Audit: a user's signer delegation (the enroll-once cert binding their device to the tenant lineage). */
 export const signerDelegationByUser = query("signerDelegationByUser").key("user").returns(SignerDelegation);
 
+/** Read exactly one current typed delegation through its declared O(1) index. Missing or incomplete
+ * typed certificate members fail closed; no legacy document is parsed or carried. */
+export function readSignerDelegationRecoveryEvidence(
+  user: string,
+): SignerDelegationRecoveryEvidence | undefined {
+  const rows = readFrameworkDeclaredRows(
+    signerDelegationByUser,
+    SignerDelegation,
+    { user },
+  );
+  if (rows.length === 0) return undefined;
+  if (rows.length !== 1) {
+    throw new Error(
+      `signerDelegationByUser('${user}') returned ${rows.length} rows; expected exactly one`,
+    );
+  }
+  const row = rows[0]!;
+  return signerDelegationRecoveryEvidence.parse({
+    user: row.user,
+    deviceKeySubject: row.deviceKey,
+    enrolledAt: row.enrolledAt,
+    certificate: {
+      child: row.certificateChild,
+      founder: row.certificateFounder,
+      verified: row.certificateVerified,
+      parentKey: row.certificateParentKey,
+      parentId: row.certificateParentId,
+      epoch: row.certificateEpoch,
+      signature: row.certificateSignature,
+      verifiedVia: row.certificateVerifiedVia,
+      idpToken: row.certificateIdpToken,
+      capturedClock: row.certificateCapturedClock,
+      ...(row.certificateAuthProviderIssuer === undefined
+        ? {}
+        : { authProviderIssuer: row.certificateAuthProviderIssuer }),
+      ...(row.certificateAuthProviderJwks === undefined
+        ? {}
+        : { authProviderJwks: row.certificateAuthProviderJwks }),
+      ...(row.certificateAuthProviderAudience === undefined
+        ? {}
+        : { authProviderAudience: row.certificateAuthProviderAudience }),
+    },
+  });
+}
+
 /** Audit: the signer tuples for an identity (the raw relation aggregate). */
 export const signerTuplesByObject = query("signerTuplesByObject")
   .key("object")

package/src/framework/workspaces.ts

@@ -76,7 +76,7 @@ import { query } from "../query.js";
 import { read } from "../read.js";
 import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
 import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from "./relations.js";
-import { relationType, self, user, key } from "../relation_schema.js";
+import { relationType, self, user, key, object } from "../relation_schema.js";
 import { WORKSPACE_ADMIN_RELATION } from "./governance_relations.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
 import { idOf } from "../value_object.js";
@@ -121,6 +121,8 @@ export { SignerDelegation, enrollDelegation, signerDelegationByUser } from "./si
 /** Canonical governance-law namespace. Genesis routes refer to this declaration, never a repeated
  * string literal, so renaming the module cannot silently strand part of the founding ceremony. */
 export const WORKSPACES_DOMAIN = "workspaces" as const;
+/** A workspace born directly by this workspace. The canonical birth plan seats this relation atomically. */
+export const WORKSPACE_CHILD_RELATION = "child" as const;
 
 // ── WORKSPACE SELF-IDENTITY (the law reads its OWN install-context) ──────────────────────────────────
 // The governance bundle runs on root AND every born platform. A workspace knows its ROLE via this
@@ -203,6 +205,12 @@ export const workspaceRelations = relationType("workspace")
   .relation("creator", { rewrite: self(), allow: [user(), key()] })
   .relation("platformCreator", { rewrite: self(), allow: [user(), key()] });
 
+/** Global holarchy edge kept separate so application packages can compose child authority without
+ * re-exporting the governance admin/creator surface into a tenant domain. */
+export const workspaceChildRelations = relationType("workspace")
+  .asGlobal()
+  .relation(WORKSPACE_CHILD_RELATION, { rewrite: self(), allow: [object("workspace")] });
+
 // --- vocabulary ----------------------------------------------------------------
 
 /** Where a workspace's holon runs: an edge DO or the dedicated 12GiB container. */

package/src/framework_call_dart_enums.ts

@@ -0,0 +1,33 @@
+import type { Directive } from "./directive.js";
+import { collectDartEnums } from "./codegen_dart.js";
+import { fixedFrameworkCallDefinitions } from "./framework_call_definitions.js";
+
+/**
+ * The Dart types for enums carried by pre-bind framework calls.
+ *
+ * The authored fixed-call directives remain the one schema authority.  This
+ * registry only gives their enum vocabularies stable Dart names and emits the
+ * corresponding declarations into the stable framework-call contract.  The
+ * per-application implementation consumes the same registry, so it can never
+ * invent an undeclared field-local fallback such as `RecoveryEnum`.
+ */
+export function collectFixedFrameworkDartEnums(): {
+  readonly dartTypes: Map<string, string>;
+  readonly decls: string[];
+} {
+  // Naming enums after the stable framework call kind keeps public Dart names
+  // independent of the directive's opaque wire id.  Only payload schemas are
+  // inspected from these aliases; no executable directive behaviour is copied.
+  const directives = fixedFrameworkCallDefinitions
+    .filter((definition) => definition.dartBirth === true)
+    .map((definition) => ({
+      ...definition.directive,
+      id: definition.kind,
+      // collectDartEnums uses aggregateId as the semantic owner when present.
+      // This compile-only alias deliberately names that owner after the stable
+      // framework call rather than the directive's internal storage aggregate.
+      aggregateId: definition.kind,
+    })) as Directive<any>[];
+
+  return collectDartEnums([], directives, "NmsFramework");
+}

package/src/framework_call_definitions.ts

@@ -7,7 +7,7 @@
 
 import type { Directive } from "./directive.js";
 import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
-import { setAuthProvider } from "./framework/auth_provider_law.js";
+import { seedAuthProvider, setAuthProvider } from "./framework/auth_provider_law.js";
 import { seedBirthPolicy } from "./framework/birth_meter.js";
 import { installDomain, promoteDomain, rollbackDomain, stageDomain } from "./framework/domain_lifecycle.js";
 import { seedGenesis } from "./framework/genesis.js";
@@ -17,13 +17,20 @@ import {
   seedReceivingGroup,
   seedReceivingGroupPolicy,
 } from "./framework/home.js";
-import { enrollDelegation, enrollFirstDevice, enrollSigner } from "./framework/signing_identity.js";
+import {
+  enrollAdmissionCheckpointSigner,
+  enrollDelegation,
+  enrollFirstDevice,
+  enrollSigner,
+} from "./framework/signing_identity.js";
 import { grantAdmin } from "./framework/workspaces.js";
 
 export interface FixedFrameworkCallDefinition {
   readonly group: "identity" | "governance" | "lifecycle" | "birth";
   readonly kind: string;
   readonly directive: Directive<any>;
+  /** Public command route when a framework effect is wrapped by a stable typed intent. */
+  readonly routeId?: string;
   /** Needed by the pre-bind Dart birth ceremony before an application exists. */
   readonly dartBirth?: true;
   /** A composed application-home law must contain this operation. */
@@ -39,6 +46,7 @@ const receivingGroupBirth = birthReceivingGroupForDomain(
 export const fixedFrameworkCallDefinitions: readonly FixedFrameworkCallDefinition[] = [
   { group: "identity", kind: "enrollFirstDevice", directive: enrollFirstDevice, dartBirth: true, requiredApplicationHome: true },
   { group: "identity", kind: "enrollSigner", directive: enrollSigner, dartBirth: true, requiredApplicationHome: true },
+  { group: "identity", kind: "enrollAdmissionCheckpointSigner", directive: enrollAdmissionCheckpointSigner, routeId: "enrollAdmissionCheckpointSigner", requiredApplicationHome: true },
   { group: "identity", kind: "setAuthProvider", directive: setAuthProvider, requiredApplicationHome: true },
   { group: "identity", kind: "birthReceivingGroup", directive: receivingGroupBirth, dartBirth: true, requiredApplicationHome: true },
   { group: "governance", kind: "grantAdmin", directive: grantAdmin },
@@ -47,6 +55,7 @@ export const fixedFrameworkCallDefinitions: readonly FixedFrameworkCallDefinitio
   { group: "lifecycle", kind: "promoteDomain", directive: promoteDomain },
   { group: "lifecycle", kind: "rollbackDomain", directive: rollbackDomain },
   { group: "birth", kind: "seedBirthPolicy", directive: seedBirthPolicy, dartBirth: true },
+  { group: "birth", kind: "seedAuthProvider", directive: seedAuthProvider, requiredApplicationHome: true },
   { group: "birth", kind: "enrollDelegation", directive: enrollDelegation, dartBirth: true },
   { group: "birth", kind: "seedBirthAttestation", directive: seedBirthAttestation, dartBirth: true },
   { group: "birth", kind: "seedGenesis", directive: seedGenesis, dartBirth: true },

package/src/index.ts

@@ -175,6 +175,9 @@ export {
   language,
   isBusinessIntent,
   isApplicationLanguage,
+  authenticatesWithEnrolledDevice,
+  repairsChildAuthenticationFor,
+  childAuthenticationRecoveryAggregateId,
   applicationLanguageOf,
   executableDirectivesForLanguage,
   assertApplicationLanguageCoversAuthoredDirectives,
@@ -320,6 +323,7 @@ export {
 export {
   birth,
   workspaceRole,
+  parentWorkspaceRoleRelations,
   workspaceNameForKey,
   WORKSPACE_NAME_SEP,
   birthKeyed,
@@ -526,10 +530,14 @@ export {
   // THE ENROLL-ONCE DELEGATION (the peer-sovereign root-of-trust) — the per-user tenant-signed cert the
   // kernel reads to assemble U's home cert chain at birth.
   SignerDelegation,
+  signerDelegationRecoveryEvidence,
   SIGNER_DELEGATION_PREFIX,
   signerDelegationInstanceId,
   enrollDelegation,
   signerDelegationByUser,
+  readSignerDelegationRecoveryEvidence,
+  writeSignerDelegationRecoveryEvidence,
+  type SignerDelegationRecoveryEvidence,
   type SignerDelegationHandle,
   type SignerEpochHandle,
   type SignerAuthority,
@@ -574,6 +582,10 @@ export {
   RECEIVING_GROUP_NAME_HASH_LEN,
   RECEIVING_GROUP_POLICY_ID,
   DEFAULT_RECEIVING_GROUP_POLICY,
+  RECEIVING_GROUP_RECOVERY_POLICIES,
+  receivingGroupRecoveryPolicy,
+  PLATFORM_IDENTITY_PROVIDER_RECOVERY,
+  type ReceivingGroupRecoveryPolicy,
   seedReceivingGroup,
   seedReceivingGroupPolicy,
   writeReceivingGroup,