@githolon/dsl 0.108.6 → 0.108.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.108.6",
+  "version": "0.108.7",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/src/compile_package_main.ts

@@ -5372,6 +5372,68 @@ async function main(): Promise<void> {
     typedLawPathsByName.set(domain, compiledLayer.paths);
   }
 
+  // Some exact directives are deliberately private implementation details: they must not appear in
+  // the tenant's generated client, but typed application-law edges can still require the kernel to
+  // execute them. Preserve that distinction here. The exact Directive object and its one configured
+  // export are the authority; neither a string operation registry nor a host-selected adapter is
+  // allowed to make a private directive executable.
+  const retainExactExecutableDirective = (
+    edge: string,
+    declaredDomain: string | undefined,
+    directive: Parameters<typeof synthesizePreconditionInvariants>[0],
+  ) => {
+    const matches = directiveExportSources.filter(
+      (candidate) => candidate.directive === directive,
+    );
+    if (matches.length !== 1) {
+      fail(
+        `${edge} targets '${declaredDomain === undefined ? directive.id : `${declaredDomain}/${directive.id}`}', ` +
+          `but that exact Directive object is ` +
+          `exported by ${matches.length} configured law modules; export it once`,
+      );
+    }
+    const target = matches[0]!;
+    if (declaredDomain !== undefined && target.domainKey !== declaredDomain) {
+      fail(
+        `${edge} declares '${declaredDomain}/${directive.id}', but the exact Directive export belongs ` +
+          `to domain '${target.domainKey}'`,
+      );
+    }
+    const targetIds = executableDirectiveIdsByDomain.get(target.domainKey) ?? [];
+    if (!targetIds.includes(directive.id)) {
+      executableDirectiveIdsByDomain.set(
+        target.domainKey,
+        [...targetIds, directive.id].sort(),
+      );
+    }
+    const targetDirectives = new Map(
+      executableDirectivesByDomain.get(target.domainKey) ?? [],
+    );
+    targetDirectives.set(directive.id, directive);
+    executableDirectivesByDomain.set(target.domainKey, targetDirectives);
+    const targetExports = new Map(
+      offerSourceExportsByDomain.get(target.domainKey) ?? [],
+    );
+    targetExports.set(directive.id, {
+      modulePath: target.modulePath,
+      exportName: target.exportName,
+      aggregateId: directive.aggregateId,
+    });
+    offerSourceExportsByDomain.set(target.domainKey, targetExports);
+    return target;
+  };
+
+  // Application-home genesis is ordinary typed law. Every declared founding step therefore needs
+  // the same exact executable route as a cross-workspace consequence, even when the directive is a
+  // private implementation detail with no public intent pointing at it.
+  for (const step of cfg.application?.homeGenesis?.steps ?? []) {
+    retainExactExecutableDirective(
+      "application home genesis",
+      step.domain,
+      step.directive,
+    );
+  }
+
   // Cross-workspace effects retain the exact target Directive object in the typed application
   // language. Resolve that object back to its configured export once, then generate its nominal
   // USDA encoder from the target's own canonical graph. Runtime law receives no schema descriptor,
@@ -5400,16 +5462,11 @@ async function main(): Promise<void> {
           );
         }
         const source = sourceMatches[0]!;
-        const matches = directiveExportSources.filter(
-          (candidate) => candidate.directive === effect.target
+        const target = retainExactExecutableDirective(
+          `workspace effect '${sourceDomain}/${directive.id}'`,
+          undefined,
+          effect.target,
         );
-        if (matches.length !== 1) {
-          fail(
-            `workspace effect '${sourceDomain}/${directive.id}' targets '${effect.target.id}', but that exact ` +
-              `Directive object is exported by ${matches.length} configured law modules; export it once`
-          );
-        }
-        const target = matches[0]!;
         const graph = typedLawGraphs.get(target.graphName);
         const paths = typedLawPathsByName.get(target.graphName);
         if (graph === undefined || paths === undefined) {
@@ -5417,33 +5474,6 @@ async function main(): Promise<void> {
             `workspace effect target '${target.graphName}/${effect.target.id}' has no canonical law graph`
           );
         }
-        // `repliesWorkspace(...)` deliberately targets a private accepted directive: callers must not
-        // receive a public API for the machine-only consequence, but the target still needs an exact
-        // authenticated execution route. Application-language closure removes private consequences
-        // from `module.directives`; restore only targets reached by a typed cross-workspace edge. The
-        // exact Directive object and configured export above are the authority—no operation string or
-        // host-selected adapter is introduced.
-        const targetIds = executableDirectiveIdsByDomain.get(target.domainKey) ?? [];
-        if (!targetIds.includes(effect.target.id)) {
-          executableDirectiveIdsByDomain.set(
-            target.domainKey,
-            [...targetIds, effect.target.id].sort(),
-          );
-        }
-        const targetDirectives = new Map(
-          executableDirectivesByDomain.get(target.domainKey) ?? [],
-        );
-        targetDirectives.set(effect.target.id, effect.target);
-        executableDirectivesByDomain.set(target.domainKey, targetDirectives);
-        const targetExports = new Map(
-          offerSourceExportsByDomain.get(target.domainKey) ?? [],
-        );
-        targetExports.set(effect.target.id, {
-          modulePath: target.modulePath,
-          exportName: target.exportName,
-          aggregateId: effect.target.aggregateId,
-        });
-        offerSourceExportsByDomain.set(target.domainKey, targetExports);
         const generated = emitTsCallUsdaEncoder(
           graph,
           paths,