@githolon/dsl 0.108.6 → 0.110.0

package/src/intent.ts

@@ -20,6 +20,11 @@ import type { PlannedOp } from "./ops.js";
 import type { Field } from "./fields.js";
 import type { AggregateHandle } from "./aggregate.js";
 import type { QueryDecl } from "./query.js";
+import {
+  enrolledDeviceAuthentication,
+  MemberAuthenticationKind,
+  type MemberAuthentication,
+} from "./member_authentication.js";
 import type {
   InvariantReadBinding,
   InvariantReadId,
@@ -53,12 +58,47 @@ export interface IntentStep<I = unknown, P = unknown> {
  * the target workspace address; the nominal target directive and payload type remain sealed by the
  * compiled source graph and its generated USDA encoder. */
 export interface WorkspaceEffectStep<I = unknown, P = unknown> {
+  /** A source-local name for an effect that later consequences depend on. */
+  readonly key?: string;
+  /** Named predecessors from this same atomic consequence set, in declaration order. */
+  readonly after?: readonly string[];
   readonly target: Directive<P>;
   readonly destination:
-    | { readonly kind: "workspace"; readonly address: (facts: I) => string }
+    | { readonly kind: "workspace"; readonly address: (facts: I, ctx: Ports) => string }
     | { readonly kind: "verifiedParent" }
     | { readonly kind: "verifiedSource" };
-  readonly payload: (facts: I) => P;
+  readonly payload: (facts: I, ctx: Ports) => P;
+  /** Conditional correspondence is still captured source law, not host routing. */
+  readonly when?: (facts: I, ctx: Ports) => boolean;
+}
+
+/** Validate the source-local dependency graph independently of payloads and host state. */
+export function validateWorkspaceEffectDependencies(
+  effects: readonly Pick<WorkspaceEffectStep, "key" | "after">[],
+): void {
+  const preceding = new Set<string>();
+  for (const effect of effects) {
+    if (effect.after !== undefined && !Array.isArray(effect.after)) {
+      throw new Error("Workspace effect dependencies must be an array of earlier effect names");
+    }
+    if (effect.key !== undefined && (
+      typeof effect.key !== "string" || effect.key.trim().length === 0 ||
+      effect.key !== effect.key.trim() || preceding.has(effect.key)
+    )) {
+      throw new Error("Workspace effect keys must be non-empty, unique names without surrounding whitespace");
+    }
+    const seen = new Set<string>();
+    for (const key of effect.after ?? []) {
+      if (!preceding.has(key)) {
+        throw new Error(`Workspace effect dependency '${key}' must name an earlier effect in the same atomic intent`);
+      }
+      if (seen.has(key)) {
+        throw new Error(`Workspace effect dependency '${key}' is repeated`);
+      }
+      seen.add(key);
+    }
+    if (effect.key !== undefined) preceding.add(effect.key);
+  }
 }
 
 const PAYLOAD_TRACE_PATH = Symbol("nomos.intent.payload-trace-path");
@@ -210,9 +250,6 @@ export interface BusinessIntent<I = unknown> extends Directive<I> {
   ) => void;
   readonly steps: readonly IntentStep<I, any>[];
   readonly workspaceEffects: readonly WorkspaceEffectStep<I, any>[];
-  /** Law-selected proof for this exact public offer. Omitted means the ordinary session proof
-   * posture. Tenant callers never choose this at invocation time. */
-  readonly offerAuthenticationProof?: "enrolledDevice";
   /** Compiler-visible application lifecycle declaration. When opening a child of this aggregate
    * type proves that its verifier/signer posture is stale, the generated parent application may
    * invoke this exact nominal action on the already-authenticated parent. The action itself remains
@@ -234,7 +271,7 @@ export function authenticatesWithEnrolledDevice<I>(
 ): BusinessIntent<I> {
   return Object.freeze({
     ...action,
-    offerAuthenticationProof: "enrolledDevice" as const,
+    authentication: enrolledDeviceAuthentication(),
   });
 }
 
@@ -248,14 +285,30 @@ export function repairsChildAuthenticationFor<I>(
   child: AggregateHandle,
   action: BusinessIntent<I>
 ): BusinessIntent<I> {
-  if (action.offerAuthenticationProof !== "enrolledDevice") {
+  assertRepairsChildAuthentication(action, `repairsChildAuthenticationFor(${child.id})`);
+  return Object.freeze({
+    ...action,
+    [CHILD_AUTHENTICATION_RECOVERY]: child.id,
+  });
+}
+
+/** THE CHILD-AUTHENTICATION REPAIR GATE — the shape every repair must have, whether a tenant marks its
+ * own action per child kind ({@link repairsChildAuthenticationFor}) or the framework composes the one
+ * workspace-parameterised repair (`framework/child_authentication.ts`): the parent's enrolled device
+ * proves the author, the action writes nothing locally, and every effect addresses the exact child
+ * workspace named by its typed input. */
+export function assertRepairsChildAuthentication<I>(
+  action: BusinessIntent<I>,
+  gate: string
+): void {
+  if (action.authentication?.kind !== MemberAuthenticationKind.EnrolledDevice) {
     throw new Error(
-      `repairsChildAuthenticationFor(${child.id}): '${action.id}' must authenticate with the parent's enrolled device`
+      `${gate}: '${action.id}' must authenticate with the parent's enrolled device`
     );
   }
   if (action.steps.length !== 0 || action.workspaceEffects.length === 0) {
     throw new Error(
-      `repairsChildAuthenticationFor(${child.id}): '${action.id}' must emit at least one child effect and make no parent-local write`
+      `${gate}: '${action.id}' must emit at least one child effect and make no parent-local write`
     );
   }
   if (
@@ -264,13 +317,9 @@ export function repairsChildAuthenticationFor<I>(
     )
   ) {
     throw new Error(
-      `repairsChildAuthenticationFor(${child.id}): '${action.id}' must address the exact child workspace from its typed input`
+      `${gate}: '${action.id}' must address the exact child workspace from its typed input`
     );
   }
-  return Object.freeze({
-    ...action,
-    [CHILD_AUTHENTICATION_RECOVERY]: child.id,
-  });
 }
 
 /** Internal compiler projection of {@link repairsChildAuthenticationFor}. */
@@ -339,6 +388,47 @@ function oneStaticRelationGate<I>(
   return gates[0];
 }
 
+const authenticationIdentity = (authentication: MemberAuthentication): string =>
+  authentication.kind === MemberAuthenticationKind.SelectedProvider
+    ? stable({
+        kind: authentication.kind,
+        providerKind: authentication.provider.kind,
+        scope: authentication.provider.scope,
+        identitySha256:
+          authentication.provider.kind === "legacySelected"
+            ? authentication.provider.identitySha256
+            : undefined,
+      })
+    : stable({ kind: authentication.kind });
+
+/** The one authentication a business intent carries: its own, or the single one its steps declare. */
+function oneAuthentication<I>(
+  id: string,
+  own: MemberAuthentication | undefined,
+  steps: readonly IntentStep<I, any>[]
+): MemberAuthentication | undefined {
+  // Only a provider selection (D7/D22) is inherited. An enrolled-device proof stays an explicit
+  // intent-level choice (`authenticatesWithEnrolledDevice`), exactly as before, so no existing law's
+  // published members change.
+  const declared = steps
+    .map((step) => (step.directive as { authentication?: MemberAuthentication }).authentication)
+    .filter((authentication): authentication is MemberAuthentication =>
+      authentication?.kind === MemberAuthenticationKind.SelectedProvider);
+  const identities = new Set(declared.map(authenticationIdentity));
+  if (identities.size > 1) {
+    throw new Error(
+      `intent('${id}') composes directives that authenticate with different providers — one member has one provider`
+    );
+  }
+  if (own !== undefined && declared.length > 0 && !identities.has(authenticationIdentity(own))) {
+    // e.g. an enrolled-device intent over a provider-selected directive: two different proofs.
+    throw new Error(
+      `intent('${id}') declares an authentication that differs from its directives'`
+    );
+  }
+  return own ?? declared[0];
+}
+
 function unsupportedKernelGate(directive: Directive<any>): string | undefined {
   if (directive.attestationAuthorizedGate !== undefined)
     return "attestation authorization";
@@ -428,7 +518,10 @@ function composePrimaryConsequenceOp(
     ...(directive.marker === "ensures" && op.aggregateType === undefined
       ? { aggregateType: directive.aggregateId }
       : {}),
-    marker: directive.marker,
+    // An op the plan marked explicitly (`withMarker`) keeps its marker: a `.creates` directive that also
+    // supersedes an existing row of its own type (declared `.alsoMutates`) must lower that row as a Mutate,
+    // or the referential gate refuses it as a create of an id that already exists.
+    marker: op.marker ?? directive.marker,
   };
 }
 
@@ -446,7 +539,7 @@ class IntentBuilder<I> {
     private readonly intentRelationGate?: NonNullable<
       Directive["requiresRelationGate"]
     >,
-    private readonly offerAuthenticationProof?: "enrolledDevice",
+    private readonly authentication?: MemberAuthentication,
     private readonly acceptsVerifiedBirthParentRecovery = false
   ) {}
 
@@ -473,7 +566,7 @@ class IntentBuilder<I> {
       this.intentReads,
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -484,10 +577,13 @@ class IntentBuilder<I> {
   directsWorkspace<P>(
     target: Directive<P>,
     effect: {
+      readonly key?: string;
+      readonly after?: readonly string[];
       readonly workspace: (facts: I) => string;
       readonly payload: (facts: I) => P;
     }
   ): IntentBuilder<I> {
+    validateWorkspaceEffectDependencies([...this.workspaceEffects, effect]);
     if (
       isBusinessIntent(target) &&
       target.acceptsWorkspaceEffectGate !== true
@@ -506,12 +602,14 @@ class IntentBuilder<I> {
           target,
           destination: { kind: "workspace", address: effect.workspace },
           payload: effect.payload,
+          ...(effect.key !== undefined ? { key: effect.key } : {}),
+          ...(effect.after !== undefined ? { after: [...effect.after] } : {}),
         },
       ],
       this.intentReads,
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -546,7 +644,7 @@ class IntentBuilder<I> {
       this.intentReads,
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -582,7 +680,7 @@ class IntentBuilder<I> {
       this.intentReads,
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -598,7 +696,7 @@ class IntentBuilder<I> {
       this.intentReads,
       true,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -615,7 +713,7 @@ class IntentBuilder<I> {
       this.intentReads,
       true,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       true
     );
   }
@@ -632,7 +730,7 @@ class IntentBuilder<I> {
       this.intentReads,
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
-      "enrolledDevice",
+      enrolledDeviceAuthentication(),
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -664,7 +762,7 @@ class IntentBuilder<I> {
       this.intentReads,
       this.acceptsWorkspaceEffects,
       gate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -688,7 +786,7 @@ class IntentBuilder<I> {
       [...byKey.values()],
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
@@ -707,13 +805,14 @@ class IntentBuilder<I> {
       this.intentReads,
       this.acceptsWorkspaceEffects,
       this.intentRelationGate,
-      this.offerAuthenticationProof,
+      this.authentication,
       this.acceptsVerifiedBirthParentRecovery
     );
   }
 
   /** Finish the intent and lower its directive graph to one atomic offer. */
   atomically(): BusinessIntent<I> {
+    validateWorkspaceEffectDependencies(this.workspaceEffects);
     if (this.steps.length === 0 && this.workspaceEffects.length === 0) {
       throw new Error(
         `intent('${this.id}') needs at least one directed consequence`
@@ -897,6 +996,18 @@ class IntentBuilder<I> {
       }
     }
     const inheritedRelationGate = oneStaticRelationGate(this.steps);
+    // D7/D22 — authentication is declared per directive; the business intent that publishes a
+    // directive IS the routable member the kernel judges, so it carries its steps' one provider (and
+    // a sovereign self-certification marker) rather than silently dropping them.
+    const authentication = oneAuthentication(this.id, this.authentication, this.steps);
+    const selfCertifying = this.steps.some(
+      (step) => step.directive.selfCertifyingPrincipalGate === true
+    );
+    if (selfCertifying && (this.steps.length !== 1 || this.workspaceEffects.length > 0)) {
+      throw new Error(
+        `intent('${this.id}') composes a sovereign self-certification; it must be the intent's only effect`
+      );
+    }
     if (
       this.intentRelationGate !== undefined &&
       inheritedRelationGate !== undefined &&
@@ -968,10 +1079,10 @@ class IntentBuilder<I> {
       },
       marker: primary.marker as ReferentialMarker,
       aggregateId: primary.aggregateId,
-      // Keep the typed local target on the lowered public intent. A narrow
-      // runtime plan may retain only this intent export; without the handle the
-      // engine cannot rebuild its aggregate registry entry and silently drops
-      // compound intents that also birth a child.
+      // Keep the typed target on the executable intent. A narrow runtime plan
+      // may retain only this intent export and needs the handle to register the
+      // route. Package composition separately excludes a pure workspace
+      // effect's remote target from the source domain's generated record types.
       ...(primary.aggregate === undefined
         ? {}
         : { aggregate: primary.aggregate }),
@@ -986,9 +1097,8 @@ class IntentBuilder<I> {
       plan,
       steps,
       workspaceEffects: this.workspaceEffects,
-      ...(this.offerAuthenticationProof === undefined
-        ? {}
-        : { offerAuthenticationProof: this.offerAuthenticationProof }),
+      ...(authentication === undefined ? {} : { authentication }),
+      ...(selfCertifying ? { selfCertifyingPrincipalGate: true as const } : {}),
       ...(this.acceptsWorkspaceEffects
         ? { acceptsWorkspaceEffectGate: true as const }
         : {}),
@@ -1044,7 +1154,10 @@ class IntentBuilder<I> {
 }
 
 class IntentContractStep {
-  constructor(private readonly id: string) {}
+  private readonly id: string;
+  constructor(id: string) {
+    this.id = id;
+  }
 
   /**
    * Publish one existing effect as a business intent without repeating its
@@ -1254,7 +1367,7 @@ export function executableDirectivesForLanguage(
         `domain '${domain}' intent '${candidate.id}' collides with a different directive — rename one of them`
       );
     }
-    if (isBusinessIntent(candidate) && published === undefined) {
+    if (isBusinessIntent(candidate) && published === undefined && candidate.businessBirthInternal !== true) {
       throw new Error(
         `domain '${domain}' exports intent '${candidate.id}' outside its declared language — add it to language('${domain}', [...]) or remove it`
       );
@@ -1262,11 +1375,34 @@ export function executableDirectivesForLanguage(
   }
 
   const remaining = discovered.filter(
-    (candidate) => !privateIds.has(candidate.id) && !isBusinessIntent(candidate)
+    (candidate) => !privateIds.has(candidate.id) && !publicById.has(candidate.id)
+      && (!isBusinessIntent(candidate) || candidate.businessBirthInternal === true)
   );
   return [...remaining, ...language.intents];
 }
 
+/**
+ * The command name admitted at the public offer boundary.
+ *
+ * Most executable declarations keep their authored id. A bare `birth(A)` is
+ * lowered to a private, aggregate-specific directive so replay can retain the
+ * exact implementation, while every generated application exposes the single
+ * stable verb `birth`. A wider authored business intent keeps its own name even
+ * when one of its private consequences is a birth.
+ *
+ * Law description, generated clients and the executable registry must all call
+ * this function. Re-deriving the rule at those boundaries creates a route that
+ * type-checks but cannot dispatch.
+ */
+export function publicOfferRoute(directive: Directive<any>): string {
+  const businessBirth = (
+    directive as Directive<any> & { readonly businessBirth?: unknown }
+  ).businessBirth;
+  return businessBirth === undefined || isBusinessIntent(directive)
+    ? directive.id
+    : "birth";
+}
+
 /**
  * Refuse a half-migrated source module. Once a domain declares its language,
  * every authored directive export must either be a published intent or one of
@@ -1284,20 +1420,12 @@ export function assertApplicationLanguageCoversAuthoredDirectives(
       candidate.steps.map((step) => step.directive.id)
     )
   );
-  const sharingReceiptIds = new Set(
-    language.workspaceSharing.flatMap((policy) =>
-      [...policy.delivered, ...policy.refused].map(
-        (receipt) => receipt.records.id
-      )
-    )
-  );
   const uncovered = authored
     .filter(
       (directive) =>
         directive.businessBirthInternal !== true &&
         !publicIds.has(directive.id) &&
-        !privateIds.has(directive.id) &&
-        !sharingReceiptIds.has(directive.id)
+        !privateIds.has(directive.id)
     )
     .map((directive) => directive.id)
     .sort();

package/src/law_check.ts

@@ -142,7 +142,7 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
       returned = dir.plan(tracked as never, deterministicPorts({ physical: 1, replica: 1, principal: "principal:probe" }));
       const drained: PlannedOp[] = [...__drainAuthoring(), ...(Array.isArray(returned) ? returned : [])];
       ops = drained.filter((o): o is FieldOp => (o as { kind?: string }).kind !== "strike");
-      if (isBusinessIntent(dir)) {
+      if (dir.workspaceEffects) {
         for (const effect of dir.workspaceEffects) {
           // These two mappers are source law just as surely as the local plan. Run them against
           // the same tracking payload so route/payload fields are not falsely diagnosed as dead.
@@ -150,10 +150,11 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
           // turn a successful local plan into a plan-return warning, but reads reached before the
           // refusal are still drained and checked below.
           try {
-            if (effect.destination.kind === "workspace") {
-              effect.destination.address(tracked as never);
+            const ports = deterministicPorts({ physical: 1, replica: 1, principal: "principal:probe" });
+            if (effect.when?.(tracked as never, ports) ?? true) {
+              if (effect.destination.kind === "workspace") effect.destination.address(tracked as never, ports);
+              effect.payload(tracked as never, ports);
             }
-            effect.payload(tracked as never);
           } catch {
             // Inconclusive mapper branch on the synthesized fixture; runtime/generator proof remains.
           }
@@ -1029,7 +1030,7 @@ function invariantFindings(mod: DomainModule, aggById: ReadonlyMap<string, Aggre
     const snap = synthesizeSnapshot(agg, `${domain}/${agg.id}#invariant`);
     if (snap === undefined) continue; // unsynthesizable — proven by hand, not by check
     try {
-      withBirthProbeGlobals(() => agg.invariant!(snap));
+      withBirthProbeGlobals(() => agg.invariant!(snap, null));
     } catch (e) {
       out.push({
         domain,
@@ -1232,6 +1233,8 @@ function attestedReadFindings(mod: DomainModule): Finding[] {
   // (b) unpopulatable trust set — a policy allow-list no directive writes.
   const writtenTypes = new Set(directives.map((d) => (d as { aggregateId?: string }).aggregateId).filter(Boolean) as string[]);
   for (const pol of mod.trustPolicies ?? []) {
+    if (pol.authorizationOnly === true) continue;
+    if (pol.allowListType === undefined) continue;
     if (!writtenTypes.has(pol.allowListType)) {
       findings.push({
         domain,