@githolon/dsl 0.108.6 → 0.110.0

package/src/workspace_sharing.ts

@@ -1,13 +1,13 @@
 // Durable, framework-owned delivery of a business application's access record.
 //
-// The domain records what should be shared and the business receipts that close
-// that order. Generated stateful clients perform and retry the cross-workspace
-// delivery. Tenant application code never sees a bridge, signer, home index, or
-// delivery protocol.
+// The domain records the grant, or a pending bearer invitation. Source law publishes
+// an exact workspace effect with the admitted
+// grant; Peer Office's correspondence desk delivers and retries it. Generated
+// clients do not own delivery, signer state or a second grant lifecycle.
 
 import { aggregate, instance, type AggregateHandle } from "./aggregate.js";
 import { directive, nomosImplementationDetail, type Directive } from "./directive.js";
-import type { BusinessIntent } from "./intent.js";
+import { intent, type BusinessIntent } from "./intent.js";
 import { query, type QueryDecl } from "./query.js";
 import { z } from "zod";
 import { set, withMarker } from "./ops.js";
@@ -15,6 +15,9 @@ import { t } from "./fields.js";
 import { Lww } from "./drivers.js";
 import { endorsementOf } from "./principal_evidence.js";
 import { RelationTuple, writeTuple } from "./framework/relations.js";
+import { publishesWorkspaceAccess, recordReceivedWorkspaceAccess, type WorkspaceAccessPublication, type WorkspaceAccessChange } from "./framework/workspace_access.js";
+import type { Ports } from "./ctx.js";
+import { receivingGroupNameOf } from "./framework/receiving_group.js";
 import {
   readRef,
   readSet,
@@ -25,20 +28,6 @@ import {
 import { recipientMetaOf } from "./recipient.js";
 import { zodKind, zodObjectShape } from "./zod_introspection.js";
 
-export type WorkspaceSharingPresence = "present" | "absent";
-
-export interface WorkspaceSharingWhen {
-  readonly field: string;
-  readonly is: WorkspaceSharingPresence;
-}
-
-export interface WorkspaceSharingReceipt {
-  readonly when?: WorkspaceSharingWhen;
-  /** Receipt payload field -> durable order field, when the business names differ. */
-  readonly payload?: Readonly<Record<string, string>>;
-  readonly records: Directive<any>;
-}
-
 export interface WorkspaceSharingPolicy {
   readonly orders: AggregateHandle;
   readonly initiatedBy: readonly BusinessIntent<any>[];
@@ -47,8 +36,6 @@ export interface WorkspaceSharingPolicy {
   readonly person: string;
   readonly role: string;
   readonly scope: string;
-  readonly delivered: readonly WorkspaceSharingReceipt[];
-  readonly refused: readonly WorkspaceSharingReceipt[];
   /** Generated law behind `Invitation<User>`; never exported to tenant code. */
   readonly invitationLaw: WorkspaceSharingInvitationLaw;
 }
@@ -73,6 +60,10 @@ export const workspaceSharingInvitationRedeemPayload = z.object({
   invitationId: z.string().regex(/^nomos-invitation-[0-9a-f]{64}$/),
   redeemedAt: z.string().min(1),
 });
+/** The framework supplies this recipient from verified identity, never the URL. */
+export const workspaceSharingRedemptionFacts = workspaceSharingInvitationRedeemPayload.extend({
+  recipient: z.string().regex(/^user:[A-Za-z0-9][A-Za-z0-9_.-]*$/),
+});
 
 /** The private bearer material transported in an invitation URL fragment.
  * This is canonical USDA, not a JSON web protocol. The literal is part of the
@@ -120,16 +111,21 @@ const NomosInvitationClaim = {
 
 export interface WorkspaceSharingOptions {
   readonly orders: AggregateHandle;
-  /** Business actions after which the generated application owns delivery. */
+  /** Business actions which create a grant or an unclaimed invitation. */
   readonly initiatedBy: readonly BusinessIntent<any>[];
-  /** An indexed, single-key query whose value selects pending delivery orders. */
+  /** An indexed, single-key query whose value selects unredeemed invitations. */
   readonly pending: QueryDecl;
   readonly pendingValue?: string;
   readonly person: string;
   readonly role: string;
   readonly scope: string;
-  readonly delivered: readonly WorkspaceSharingReceipt[];
-  readonly refused: readonly WorkspaceSharingReceipt[];
+  readonly accessReceiver?: Directive<WorkspaceAccessPublication>;
+  /** Local permission object, when the invitation's public discovery scope differs. */
+  readonly authorityObject?: string;
+  /** Ordinary local business consequences of a successful possession proof.
+   * They are part of the SAME redeem offer, never a delivery callback. */
+  readonly redeemed?: Directive<z.infer<typeof workspaceSharingRedemptionFacts>>;
+  readonly receivedAccess?: (facts: z.infer<typeof workspaceSharingRedemptionFacts>, ctx: Ports) => WorkspaceAccessChange;
 }
 
 const requireOrderField = (orders: AggregateHandle, field: string, purpose: string): void => {
@@ -142,11 +138,10 @@ const requireOrderField = (orders: AggregateHandle, field: string, purpose: stri
 
 /**
  * Declare one durable business sharing policy. The order aggregate is ordinary
- * domain state; delivery and retry are generated framework behaviour.
+ * domain state; the ordinary Peer Office correspondence desk owns delivery and retry.
  *
- * This is the canonical access-delivery lane. Model the pending order and its
- * delivered/refused business receipts here; never call a bridge from application
- * code or mirror pending delivery in UI state.
+ * Redemption commits source authority and its addressed Home offer atomically.
+ * No delivery callback grants access, and generated clients have no delivery loop.
  *
  * @example
  * language("estate", intents, {
@@ -157,12 +152,14 @@ const requireOrderField = (orders: AggregateHandle, field: string, purpose: stri
  *     person: "subject",
  *     role: "relation",
  *     scope: "object",
- *     delivered: [{ records: recordEstateAccessDelivered }],
- *     refused: [{ records: recordEstateAccessRefused }],
+ *     redeemed: recordEstateInvitationRedemption,
  *   })],
  * })
  */
 export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSharingPolicy {
+  if ("delivered" in options || "refused" in options) {
+    throw new Error("workspaceSharing delivery callbacks were removed: access is committed in the source offer; Peer Office delivers correspondence. Use redeemed for local redemption consequences.");
+  }
   const { orders, pending } = options;
   if (pending.returns !== orders.id) {
     throw new Error(
@@ -193,19 +190,6 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
   requireOrderField(orders, options.person, "person");
   requireOrderField(orders, options.role, "role");
   requireOrderField(orders, options.scope, "scope");
-  if (options.delivered.length === 0 || options.refused.length === 0) {
-    throw new Error(
-      `workspaceSharing(${orders.id}): both delivered and refused business receipts are required`,
-    );
-  }
-  for (const receipt of [...options.delivered, ...options.refused]) {
-    if (receipt.when !== undefined) {
-      requireOrderField(orders, receipt.when.field, "receipt condition");
-    }
-    for (const [target, source] of Object.entries(receipt.payload ?? {})) {
-      requireOrderField(orders, source, `receipt payload '${target}'`);
-    }
-  }
   const pendingValue = options.pendingValue ?? "pending";
   const stem = options.orders.id.replace(/[^A-Za-z0-9]/g, "");
   const redeemId = `nomosInternalRedeem${stem}Invitation7c1f5e`;
@@ -215,8 +199,8 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
       .returns(options.orders),
     businessBirthInternal: true as const,
   };
-  const redeem = nomosImplementationDetail({
-    ...directive(redeemId)
+  const redeemEffect = nomosImplementationDetail({
+    ...directive(options.redeemed === undefined ? redeemId : `${redeemId}Effect`)
       .mutates(options.orders)
       .payload(workspaceSharingInvitationRedeemPayload)
       .plan((facts, ctx) => {
@@ -224,7 +208,7 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
         const claim = instance(NomosInvitationClaim, facts.invitationId);
         return [
           ...writeTuple({
-            object: facts.object,
+            object: options.authorityObject ?? facts.object,
             relation: facts.relation,
             subject: ctx.principal().asAuthoritySubject(
               "redeem a possession-proven, single-use business invitation",
@@ -243,6 +227,26 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
     // Possession proof is verified by NomosInvitationGate and intentionally never persisted.
     nomosInvariantConsumedPayloadFields: ["invitationSignature"] as const,
   });
+  const recipientFacts = (facts: z.infer<typeof workspaceSharingInvitationRedeemPayload>, ctx: Ports) => ({
+    ...facts, recipient: endorsementOf(ctx.principal().asAuthoritySubject("possession-proven invitation recipient"))?.principal ?? "",
+  });
+  const businessRedemption = options.redeemed;
+  if ((businessRedemption?.workspaceEffects?.length ?? 0) !== 0) {
+    throw new Error("workspaceSharing.redeemed must describe local consequences; Home correspondence is supplied by the sharing policy");
+  }
+  const localRedemption = businessRedemption === undefined ? redeemEffect : {
+    ...nomosImplementationDetail(intent(redeemId)
+      .contract({ accepts: workspaceSharingInvitationRedeemPayload })
+      .directs(redeemEffect, facts => facts)
+      .directs<z.infer<typeof workspaceSharingInvitationRedeemPayload>>({ ...businessRedemption, workspaceEffects: [], payloadSchema: workspaceSharingInvitationRedeemPayload,
+        plan: (facts, ctx) => businessRedemption.plan(recipientFacts(facts, ctx), ctx) }, facts => facts).atomically()),
+    nomosInvariantConsumedPayloadFields: ["invitationSignature"] as const,
+  };
+  const access = options.receivedAccess;
+  const redeem = publishesWorkspaceAccess(localRedemption, access === undefined ? ((facts, ctx) => ({
+    recipient: endorsementOf(ctx.principal().asAttribution())?.principal ?? "",
+    object: facts.object, relation: facts.relation, active: true,
+  })) : (facts, ctx) => access(recipientFacts(facts, ctx), ctx), receivingGroupNameOf, options.accessReceiver ?? recordReceivedWorkspaceAccess);
   const gate = workspaceInvariant(`NomosInvitationGate:${options.orders.id}`)
     .on(redeemId)
     .reads(readSet(
@@ -305,8 +309,6 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
   return Object.freeze({
     ...options,
     pendingValue,
-    delivered: Object.freeze([...options.delivered]),
-    refused: Object.freeze([...options.refused]),
     invitationLaw,
   });
 }

package/src/zod_introspection.ts

@@ -61,6 +61,8 @@ const SUBJECT_SAMPLES: readonly string[] = [
   `key:${"0".repeat(64)}`,
   "Type:00000000-0000-0000-0000-000000000000",
   "0".repeat(64),
+  // A console principal (D22 framework scope), for payloads that name exactly one.
+  "console:00000000-0000-0000-0000-000000000000",
 ];
 const STRING_SAMPLES: readonly string[] = [
   "sample", "{}", "en", "en-GB", "AA", "A1", "a", "1", "2026-01", "2026-01-01",

package/compat_package.mjs

@@ -1,46 +0,0 @@
-#!/usr/bin/env node
-// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
-// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
-// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
-// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
-
-// `githolon compat` launcher — the twin of `compile_package.mjs`: resolve `tsx`
-// (the caller's, else the DSL's own dependency) and run `src/compat_package_main.ts`
-// under it (the main dynamically imports the caller's TS domain modules, which
-// needs the tsx ESM loader). Resolution goes through Node's resolver (createRequire),
-// NOT node_modules/.bin paths — hoisted/workspace installs put the bin shims elsewhere.
-import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-const DSL_DIR = path.dirname(fileURLToPath(import.meta.url));
-const MAIN = path.join(DSL_DIR, "src", "compat_package_main.ts");
-
-function resolvePkgDir(name, fromDir) {
-  try {
-    const req = createRequire(pathToFileURL(path.join(fromDir, "noop.js")));
-    return path.dirname(req.resolve(`${name}/package.json`));
-  } catch {
-    return undefined;
-  }
-}
-
-const tsxDir = resolvePkgDir("tsx", process.cwd()) ?? resolvePkgDir("tsx", DSL_DIR);
-if (!tsxDir) {
-  console.error("githolon compat: tsx not found — reinstall @githolon/dsl (tsx is one of its dependencies)");
-  process.exit(1);
-}
-const tsxPkg = JSON.parse(readFileSync(path.join(tsxDir, "package.json"), "utf8"));
-const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.tsx;
-const tsxCli = path.join(tsxDir, tsxBinRel ?? "dist/cli.mjs");
-
-try {
-  execFileSync(process.execPath, [tsxCli, MAIN, ...process.argv.slice(2)], {
-    stdio: "inherit",
-    cwd: process.cwd(),
-  });
-} catch (e) {
-  process.exit(e.status ?? 1);
-}

package/dart/lib/src/home.dart

@@ -1,15 +0,0 @@
-@internal
-library;
-
-import 'package:meta/meta.dart' show internal;
-
-import 'dart:convert';
-
-import 'package:crypto/crypto.dart';
-
-/// Compiler/runtime-only receiving-group address. Generated application hosts call this; tenant code does
-/// not choose or persist framework workspace names.
-String nmsInternalReceivingGroupNameOf(String principal) {
-  final hex = sha256.convert(utf8.encode(principal)).toString();
-  return 'nomos-rg-${hex.substring(0, 40)}';
-}