@githolon/dsl 0.108.7 → 0.110.1

package/src/codegen_dart_framework_calls.ts

@@ -5,21 +5,48 @@ import type { DomainModule } from "./codegen_dart.js";
 import { dartMemberName, introspectPayload } from "./codegen_dart.js";
 import type { PayloadFieldSpec } from "./codegen_dart.js";
 import {
-  DART_CALL_USDA_PRELUDE,
-  emitDartCallUsdaEncoder,
-  type DartCallUsdaFieldAccess,
-} from "./codegen_call_usda.js";
+  DART_CALL_PROTO_PRELUDE,
+  emitDartCallProtoEncoder,
+  type DartCallProtoFieldAccess,
+} from "./codegen_call_proto.js";
 import type { LawGraph } from "./law_graph.js";
 import { isBusinessIntent } from "./intent.js";
+import { MemberAuthenticationKind } from "./member_authentication.js";
 import { fixedFrameworkCallDefinitions } from "./framework_call_definitions.js";
 import { collectFixedFrameworkDartEnums } from "./framework_call_dart_enums.js";
 import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
+import { RECOVER_RECEIVING_GROUP_DEVICE_ID as FRAMEWORK_RECOVERY_DOOR_ID } from "./framework/receiving_group_recovery.js";
+import { REPAIR_CHILD_AUTHENTICATION_ID as FRAMEWORK_CHILD_REPAIR_ID } from "./framework/child_authentication.js";
+import {
+  PARENT_MODEL_AUTHORITY_SEAT_AGGREGATE,
+  PARENT_MODEL_AUTHORITY_SEAT_ID,
+  SEAT_MODEL_AUTHORITY_ID as FRAMEWORK_MODEL_AUTHORITY_SEAT_ID,
+} from "./framework/model_authority_repair.js";
 import { workspaceSharingInvitationRedeemPayload } from "./workspace_sharing.js";
 import { zodArrayElement, zodDef, zodObjectShape } from "./zod_introspection.js";
 
 type AnyDirective = Directive<unknown>;
 
-const frameworkFieldAccess = (field: PayloadFieldSpec): DartCallUsdaFieldAccess => {
+/** Resolve the authored effect behind a public business intent. Application
+ * languages intentionally expose only nominal intents in `module.directives`,
+ * while fixed framework-call encoders must derive their payload from the exact
+ * private effect composed by that intent. */
+const authoredDirective = (
+  module: DomainModule,
+  directiveId: string,
+): AnyDirective | undefined =>
+  (module.directives as AnyDirective[]).find(
+    (candidate) => candidate.id === directiveId,
+  ) ??
+  (module.applicationIntents ?? [])
+    .flatMap((candidate) =>
+      isBusinessIntent(candidate)
+        ? candidate.steps.map((step) => step.directive as AnyDirective)
+        : [],
+    )
+    .find((candidate) => candidate.id === directiveId);
+
+const frameworkFieldAccess = (field: PayloadFieldSpec): DartCallProtoFieldAccess => {
   const member = `payload.${dartMemberName(field.name)}`;
   if (field.nullAdmits === true) return { value: member, slot: true };
   const value = field.optional ? `${member}!` : member;
@@ -45,6 +72,12 @@ const frameworkFieldAccess = (field: PayloadFieldSpec): DartCallUsdaFieldAccess
   }
 };
 
+/** The exact Dart type `introspectPayload` derives for `inheritedModelAuthorityEvidence.holders`. The
+ * hand-written `NmsModelAuthorityHolder` typedef in `application_framework_calls.dart` is structurally
+ * this type; asserting it here means a schema change breaks the COMPILER, never the app. */
+const MODEL_AUTHORITY_HOLDERS_DART_TYPE =
+  "List<({String principal, List<({String deviceKeySubject, String grantedAt, String? verifiedVia, int? validFromEpoch})> signers})>";
+
 const FIXED_CALLS = fixedFrameworkCallDefinitions
   .filter((definition) => definition.dartBirth === true)
   .map((definition) => ({ kind: definition.kind, directive: definition.directive.id }));
@@ -100,20 +133,62 @@ export interface DartFrameworkCallLaw {
   readonly paths: ReadonlyMap<string, string>;
 }
 
+/** Exact fixed framework effects for which this composed law emits Dart calls.
+ * The operation-schema compiler consumes this selector instead of maintaining
+ * a second list of framework payloads. */
+export function dartFrameworkOperationDirectiveIds(
+  law: DartFrameworkCallLaw,
+): readonly string[] {
+  const fixed = FIXED_CALLS.filter((definition) =>
+    law.graph.nodes.some((node) =>
+      node.kind === "intent" &&
+      (node.entity.label === definition.directive ||
+        node.publicRoute === definition.directive),
+    ),
+  ).map((definition) => definition.directive);
+  // The declared receiving-group recovery door is bound exactly like a fixed framework call (below),
+  // so its payload needs the same host transport contract: without this entry the generated encoder
+  // names a `Payload_…` message the operation proto never carries.
+  const declaresFrameworkDoor = law.graph.nodes.some((node) =>
+    node.kind === "intent" && node.entity.label === FRAMEWORK_RECOVERY_DOOR_ID);
+  // The framework child-authentication repair (composed whenever the package births children) is bound
+  // the same way, so its `{workspace, user, deviceKeySubject?}` payload rides the operation transport.
+  const declaresChildRepair = law.graph.nodes.some((node) =>
+    node.kind === "intent" && node.entity.label === FRAMEWORK_CHILD_REPAIR_ID);
+  // The model-authority self-seat (composed on the same era rule) is bound the same way, so its
+  // holder-set payload rides the operation transport.
+  const declaresModelAuthorityPull = law.graph.nodes.some((node) =>
+    node.kind === "intent" && node.entity.label === FRAMEWORK_MODEL_AUTHORITY_SEAT_ID);
+  return [
+    ...fixed,
+    ...(declaresFrameworkDoor ? [FRAMEWORK_RECOVERY_DOOR_ID] : []),
+    ...(declaresChildRepair ? [FRAMEWORK_CHILD_REPAIR_ID] : []),
+    ...(declaresModelAuthorityPull ? [FRAMEWORK_MODEL_AUTHORITY_SEAT_ID] : []),
+  ];
+}
+
 /** Emit the pre-bind framework call factory from the exact composed law graph.
  * The output contains no schemas or dynamic values: every field access and USDA
  * relationship is expanded by the compiler. */
 export function generateDartApplicationFrameworkCalls(
   laws: readonly DartFrameworkCallLaw[],
+  descriptor: {
+    /** The compiled law package identity — the descriptor's own closure, `currentLaw[<application-home domain>]`. */
+    readonly lawSha256: string;
+  },
 ): string | undefined {
+  if (!/^[0-9a-f]{64}$/.test(descriptor.lawSha256)) {
+    throw new Error(
+      `Dart framework call codegen: the application birth contract needs the compiled law package sha256 identity, not '${descriptor.lawSha256}'`,
+    );
+  }
   const frameworkEnumDartTypes = collectFixedFrameworkDartEnums().dartTypes;
   const fixedEmitted = FIXED_CALLS.flatMap((definition) => laws.flatMap((law) => {
     const declares = law.graph.nodes.some((node) =>
       node.kind === "intent" &&
       (node.entity.label === definition.directive || node.publicRoute === definition.directive));
     if (!declares) return [];
-    const directive = (law.module.directives as AnyDirective[]).find((candidate) =>
-      candidate.id === definition.directive);
+    const directive = authoredDirective(law.module, definition.directive);
     if (directive === undefined) {
       throw new Error(
         `Dart framework call codegen: '${law.graph.domain.entity.label}/${definition.directive}' has no authored directive`,
@@ -128,11 +203,11 @@ export function generateDartApplicationFrameworkCalls(
       : `${field.dartType}${field.optional ? "?" : ""}`;
     const payloadType = `({${fields.map((field) =>
       `${parameterType(field)} ${dartMemberName(field.name)}`).join(", ")}})`;
-    const access = new Map<string, DartCallUsdaFieldAccess>(fields.map((field) => [
+    const access = new Map<string, DartCallProtoFieldAccess>(fields.map((field) => [
       field.name,
       frameworkFieldAccess(field),
     ]));
-    const encoder = emitDartCallUsdaEncoder(
+    const encoder = emitDartCallProtoEncoder(
       law.graph,
       law.paths,
       law.graph.domain.entity.label,
@@ -151,11 +226,11 @@ export function generateDartApplicationFrameworkCalls(
         : `${field.dartType}${field.optional ? "?" : ""}`;
       const payloadType = `({${fields.map((field) =>
         `${parameterType(field)} ${dartMemberName(field.name)}`).join(", ")}})`;
-      const access = new Map<string, DartCallUsdaFieldAccess>(fields.map((field) => [
+    const access = new Map<string, DartCallProtoFieldAccess>(fields.map((field) => [
         field.name,
         frameworkFieldAccess(field),
       ]));
-      const encoder = emitDartCallUsdaEncoder(
+      const encoder = emitDartCallProtoEncoder(
         law.graph,
         law.paths,
         law.graph.domain.entity.label,
@@ -181,11 +256,146 @@ export function generateDartApplicationFrameworkCalls(
   // verifier epoch); every target must independently declare the narrow recovery door.
   // The host never chooses an operation name and the compiler refuses an ambiguous or
   // differently-shaped candidate.
+  // THE DECLARED DOOR BINDS FIRST. When the application declared its receiving-group recovery posture,
+  // the framework composed `nomosInternalRecoverReceivingGroupDevice7c1f5e` into the application-home
+  // domain; it is presentation-internal, so it is never a public application intent and the structural
+  // search below cannot see it. Bind it exactly like a fixed framework call (by id, from the composed
+  // graph). A tenant-authored door beside it is refused: one application has one recovery route.
+  const frameworkDoor = laws.flatMap((law) => {
+    const declares = law.graph.nodes.some((node) =>
+      node.kind === "intent" && node.entity.label === FRAMEWORK_RECOVERY_DOOR_ID);
+    if (!declares) return [];
+    const directive = authoredDirective(law.module, FRAMEWORK_RECOVERY_DOOR_ID);
+    if (directive === undefined) {
+      throw new Error(
+        `Dart framework call codegen: '${law.graph.domain.entity.label}/${FRAMEWORK_RECOVERY_DOOR_ID}' has no authored directive`,
+      );
+    }
+    const fields = introspectPayload(directive.payloadSchema as z.ZodTypeAny, new Map());
+    const payloadType = fields.length === 1 ? `({String user})` : `({String user, String? deviceKeySubject})`;
+    const access = new Map<string, DartCallProtoFieldAccess>(fields.map((field) => [
+      field.name, frameworkFieldAccess(field),
+    ]));
+    const encoder = emitDartCallProtoEncoder(
+      law.graph, law.paths, law.graph.domain.entity.label, FRAMEWORK_RECOVERY_DOOR_ID, payloadType, access,
+    );
+    return [{
+      kind: "recoverExistingReceivingGroupDevice",
+      directive: FRAMEWORK_RECOVERY_DOOR_ID,
+      domain: law.graph.domain.entity.label,
+      fields,
+      payloadType,
+      encoder,
+      routeByDirective: false as const,
+    }];
+  });
+  // THE CHILD-AUTHENTICATION REPAIR IS FRAMEWORK LAW (receiving_group_lifecycle.md cut 1 item 3): when the
+  // package births children the application-home domain composes `nomosInternalRepairChildAuthentication7c1f5e`,
+  // the ONE parent action that repairs a child refusing this device's key, addressed by workspace. It is
+  // presentation-internal, so it is bound here by id exactly like the recovery door; the Reception's repair
+  // lane calls it and no tenant ever routes a child kind by name.
+  const frameworkChildRepair = laws.flatMap((law) => {
+    const declares = law.graph.nodes.some((node) =>
+      node.kind === "intent" && node.entity.label === FRAMEWORK_CHILD_REPAIR_ID);
+    if (!declares) return [];
+    const directive = authoredDirective(law.module, FRAMEWORK_CHILD_REPAIR_ID);
+    if (directive === undefined) {
+      throw new Error(
+        `Dart framework call codegen: '${law.graph.domain.entity.label}/${FRAMEWORK_CHILD_REPAIR_ID}' has no authored directive`,
+      );
+    }
+    const fields = introspectPayload(directive.payloadSchema as z.ZodTypeAny, new Map());
+    const expected: readonly [string, boolean][] = [["workspace", false], ["user", false], ["deviceKeySubject", true]];
+    if (
+      fields.length !== expected.length ||
+      fields.some((field, index) =>
+        field.name !== expected[index]![0] || field.optional !== expected[index]![1] ||
+        field.dartType !== "String" || field.shape !== "scalar" || field.nullAdmits === true)
+    ) {
+      throw new Error(
+        `Dart framework call codegen: the framework child-authentication repair '${FRAMEWORK_CHILD_REPAIR_ID}' must accept { workspace: string, user: string, deviceKeySubject?: string }`,
+      );
+    }
+    const payloadType = `({String workspace, String user, String? deviceKeySubject})`;
+    const access = new Map<string, DartCallProtoFieldAccess>(fields.map((field) => [
+      field.name, frameworkFieldAccess(field),
+    ]));
+    const encoder = emitDartCallProtoEncoder(
+      law.graph, law.paths, law.graph.domain.entity.label, FRAMEWORK_CHILD_REPAIR_ID, payloadType, access,
+    );
+    return [{
+      kind: "repairChildAuthentication",
+      directive: FRAMEWORK_CHILD_REPAIR_ID,
+      domain: law.graph.domain.entity.label,
+      fields,
+      payloadType,
+      encoder,
+      routeByDirective: false as const,
+    }];
+  });
+  if (frameworkChildRepair.length > 1) {
+    throw new Error(
+      `Dart framework call codegen: the framework child-authentication repair is composed into ${frameworkChildRepair.length} domains; exactly one is allowed`,
+    );
+  }
+  // THE MODEL-AUTHORITY SELF-HEAL IS FRAMEWORK LAW (parent_directed_model_transition.md, the third door):
+  // when the package births children the application-home domain composes
+  // `nomosInternalPullParentModelAuthority7c1f5e`, the ONE child-side action that asks this workspace's own
+  // verified parent for the model-lifecycle authority it should have been born holding. Bound here by id
+  // exactly like the child repair; the Reception offers it and no tenant passes a parameter for it.
+  const frameworkModelAuthorityPull = laws.flatMap((law) => {
+    const declares = law.graph.nodes.some((node) =>
+      node.kind === "intent" && node.entity.label === FRAMEWORK_MODEL_AUTHORITY_SEAT_ID);
+    if (!declares) return [];
+    const directive = authoredDirective(law.module, FRAMEWORK_MODEL_AUTHORITY_SEAT_ID);
+    if (directive === undefined) {
+      throw new Error(
+        `Dart framework call codegen: '${law.graph.domain.entity.label}/${FRAMEWORK_MODEL_AUTHORITY_SEAT_ID}' has no authored directive`,
+      );
+    }
+    const fields = introspectPayload(directive.payloadSchema as z.ZodTypeAny, new Map());
+    const expected: readonly [string, string, string][] = [
+      ["holders", "recordList", MODEL_AUTHORITY_HOLDERS_DART_TYPE],
+      ["seatedAt", "scalar", "String"],
+    ];
+    if (
+      fields.length !== expected.length ||
+      fields.some((field, index) =>
+        field.name !== expected[index]![0] || field.shape !== expected[index]![1] ||
+        field.dartType !== expected[index]![2] || field.optional !== false || field.nullAdmits === true)
+    ) {
+      throw new Error(
+        `Dart framework call codegen: the framework model-authority self-seat '${FRAMEWORK_MODEL_AUTHORITY_SEAT_ID}' must accept { holders: [{ principal, signers: [...] }], seatedAt: string }`,
+      );
+    }
+    const payloadType =
+      `({${MODEL_AUTHORITY_HOLDERS_DART_TYPE} holders, String seatedAt})`;
+    const access = new Map<string, DartCallProtoFieldAccess>(fields.map((field) => [
+      field.name, frameworkFieldAccess(field),
+    ]));
+    const encoder = emitDartCallProtoEncoder(
+      law.graph, law.paths, law.graph.domain.entity.label, FRAMEWORK_MODEL_AUTHORITY_SEAT_ID, payloadType, access,
+    );
+    return [{
+      kind: "seatParentModelAuthority",
+      directive: FRAMEWORK_MODEL_AUTHORITY_SEAT_ID,
+      domain: law.graph.domain.entity.label,
+      fields,
+      payloadType,
+      encoder,
+      routeByDirective: false as const,
+    }];
+  });
+  if (frameworkModelAuthorityPull.length > 1) {
+    throw new Error(
+      `Dart framework call codegen: the framework model-authority self-heal is composed into ${frameworkModelAuthorityPull.length} domains; exactly one is allowed`,
+    );
+  }
   const recoveryCandidates = laws.flatMap((law) =>
     (law.module.applicationIntents ?? []).flatMap((candidate) => {
       if (
         !isBusinessIntent(candidate) ||
-        candidate.offerAuthenticationProof !== "enrolledDevice" ||
+        candidate.authentication?.kind !== MemberAuthenticationKind.EnrolledDevice ||
         candidate.steps.length !== 0 ||
         candidate.workspaceEffects.length === 0 ||
         !candidate.workspaceEffects.every(
@@ -194,23 +404,25 @@ export function generateDartApplicationFrameworkCalls(
       ) return [];
       const fields = introspectPayload(candidate.contract.accepts, new Map());
       if (
-        fields.length !== 1 ||
+        (fields.length !== 1 && fields.length !== 2) ||
         fields[0]!.name !== "user" ||
         fields[0]!.dartType !== "String" ||
         fields[0]!.shape !== "scalar" ||
         fields[0]!.optional ||
-        fields[0]!.nullAdmits === true
+        fields[0]!.nullAdmits === true ||
+        (fields.length === 2 && (fields[1]!.name !== "deviceKeySubject" ||
+          fields[1]!.dartType !== "String" || fields[1]!.shape !== "scalar" ||
+          !fields[1]!.optional))
       ) {
         throw new Error(
-          `Dart framework call codegen: existing receiving-group recovery intent '${candidate.id}' must accept exactly { user: string }`,
+          `Dart framework call codegen: existing receiving-group recovery intent '${candidate.id}' must accept { user: string, deviceKeySubject?: string }`,
         );
       }
-      const payloadType = `({String user})`;
-      const access = new Map<string, DartCallUsdaFieldAccess>([[
-        "user",
-        { value: "payload.user" },
-      ]]);
-      const encoder = emitDartCallUsdaEncoder(
+      const payloadType = fields.length === 1 ? `({String user})` : `({String user, String? deviceKeySubject})`;
+      const access = new Map<string, DartCallProtoFieldAccess>(fields.map((field) => [
+        field.name, frameworkFieldAccess(field),
+      ]));
+      const encoder = emitDartCallProtoEncoder(
         law.graph,
         law.paths,
         law.graph.domain.entity.label,
@@ -228,12 +440,26 @@ export function generateDartApplicationFrameworkCalls(
         routeByDirective: false as const,
       }];
     }));
+  if (frameworkDoor.length > 0 && recoveryCandidates.length > 0) {
+    throw new Error(
+      `Dart framework call codegen: the application declared its receiving-group recovery posture (the framework composed ` +
+        `'${FRAMEWORK_RECOVERY_DOOR_ID}') and still authors its own recovery intent '${recoveryCandidates[0]!.directive}'; ` +
+        `delete the tenant door — one application has one recovery route`,
+    );
+  }
   if (recoveryCandidates.length > 1) {
     throw new Error(
       `Dart framework call codegen: application composes ${recoveryCandidates.length} existing receiving-group recovery intents; exactly one is allowed`,
     );
   }
-  const emitted = [...fixedEmitted, ...invitationEmitted, ...recoveryCandidates];
+  const recoveryDoors = frameworkDoor.length > 0 ? frameworkDoor : recoveryCandidates;
+  const emitted = [
+    ...fixedEmitted,
+    ...invitationEmitted,
+    ...recoveryDoors,
+    ...frameworkChildRepair,
+    ...frameworkModelAuthorityPull,
+  ];
   if (emitted.length === 0) return undefined;
 
   const certificateEntry = emitted.find((entry) =>
@@ -251,8 +477,12 @@ export function generateDartApplicationFrameworkCalls(
         if (certificateEntry === undefined || certificateField === undefined) {
           throw new Error("Dart framework call codegen: cannot locate the BirthCertificate law record");
         }
-        const directive = (laws.find((law) => law.graph.domain.entity.label === certificateEntry.domain)?.module.directives as AnyDirective[] | undefined)
-          ?.find((candidate) => candidate.id === certificateEntry.directive);
+        const certificateLaw = laws.find(
+          (law) => law.graph.domain.entity.label === certificateEntry.domain,
+        );
+        const directive = certificateLaw === undefined
+          ? undefined
+          : authoredDirective(certificateLaw.module, certificateEntry.directive);
         if (directive === undefined) {
           throw new Error("Dart framework call codegen: cannot locate the BirthCertificate directive");
         }
@@ -288,6 +518,8 @@ export function generateDartApplicationFrameworkCalls(
       .filter((definition) => definition.dartBirth === true)
       .map((definition) => definition.kind),
     "recoverExistingReceivingGroupDevice",
+    "repairChildAuthentication",
+    "seatParentModelAuthority",
     "redeemInvitation",
   ])].flatMap((kind) => {
     const alternatives = emitted.filter((entry) => entry.kind === kind);
@@ -295,15 +527,46 @@ export function generateDartApplicationFrameworkCalls(
       (kind === "recoverExistingReceivingGroupDevice"
         ? [{ name: "user", dartType: "String", shape: "scalar", optional: false } satisfies PayloadFieldSpec]
         : invitationContractFields);
+    if (kind === "seatParentModelAuthority") {
+      const seat = alternatives[0];
+      return [
+        `  @override`,
+        `  NmsGeneratedCall seatParentModelAuthority({required List<NmsModelAuthorityHolder> holders, required String seatedAt}) {`,
+        ...(seat === undefined
+          ? [`    throw StateError("The compiled application has no framework model-authority self-seat law (it births no children).");`]
+          : [
+              `    final payload = (holders: holders, seatedAt: seatedAt);`,
+              `    return ${seat.encoder.functionName}(payload);`,
+            ]),
+        `  }`,
+        ``,
+      ];
+    }
+    if (kind === "repairChildAuthentication") {
+      const repair = alternatives[0];
+      return [
+        `  @override`,
+        `  NmsGeneratedCall repairChildAuthentication({required String workspace, required String user, String? deviceKeySubject}) {`,
+        ...(repair === undefined
+          ? [`    throw StateError("The compiled application has no framework child-authentication repair law (it births no children).");`]
+          : [
+              `    final payload = (workspace: workspace, user: user, deviceKeySubject: deviceKeySubject);`,
+              `    return ${repair.encoder.functionName}(payload);`,
+            ]),
+        `  }`,
+        ``,
+      ];
+    }
     if (kind === "recoverExistingReceivingGroupDevice") {
       const recovery = alternatives[0];
       return [
         `  @override`,
-        `  NmsGeneratedCall recoverExistingReceivingGroupDevice({required String user}) {`,
+        `  NmsGeneratedCall recoverExistingReceivingGroupDevice({required String user, String? deviceKeySubject}) {`,
         ...(recovery === undefined
           ? [`    throw StateError("The compiled application has no existing receiving-group device recovery law.");`]
           : [
-              `    final payload = (user: user,);`,
+              recovery.fields.length === 1 ? `    final payload = (user: user,);` :
+                `    final payload = (user: user, deviceKeySubject: deviceKeySubject);`,
               `    return ${recovery.encoder.functionName}(payload);`,
             ]),
         `  }`,
@@ -326,14 +589,23 @@ export function generateDartApplicationFrameworkCalls(
       ...(routeByDirective ? [`    required String directive,`] : []),
       ...signature,
       `  }) {`,
-      `    final payload = (`,
-      ...payload,
-      `    );`,
-      `    return switch (${routeByDirective ? "'$domain/$directive'" : "domain"}) {`,
-      ...alternatives.map((entry) =>
-        `      ${JSON.stringify(routeByDirective ? `${entry.domain}/${entry.directive}` : entry.domain)} => ${entry.encoder.functionName}(payload),`),
-      `      _ => throw StateError("The compiled application has no '${kind}' call in domain '$domain'."),`,
-      `    };`,
+      // With no alternative the switch is only its unreachable default, so binding the payload
+      // would leave a dead local — `dart analyze` reports unused_local_variable and exits
+      // non-zero on the generated package. Refuse the same way the three fixed methods above do.
+      ...(alternatives.length === 0
+        ? [
+            `    throw StateError("The compiled application has no '${kind}' call in domain '$domain'.");`,
+          ]
+        : [
+            `    final payload = (`,
+            ...payload,
+            `    );`,
+            `    return switch (${routeByDirective ? "'$domain/$directive'" : "domain"}) {`,
+            ...alternatives.map((entry) =>
+              `      ${JSON.stringify(routeByDirective ? `${entry.domain}/${entry.directive}` : entry.domain)} => ${entry.encoder.functionName}(payload),`),
+            `      _ => throw StateError("The compiled application has no '${kind}' call in domain '$domain'."),`,
+            `    };`,
+          ]),
       `  }`,
       ``,
     ];
@@ -343,14 +615,16 @@ export function generateDartApplicationFrameworkCalls(
     `// AUTO-GENERATED by nomos-compile — pre-bind framework calls for this exact application law.`,
     `// No host authority or payload schema lives here. Do not edit.`,
     `// ignore_for_file: invalid_use_of_internal_member, unused_element, unused_import, unused_shown_name`,
-    `import 'dart:convert' show base64Encode, utf8;`,
+    `import 'dart:convert' show base64Encode;`,
     `import 'dart:typed_data' show Uint8List;`,
-    `import 'package:nomos_types/nomos_kernel_protocol.dart' show BirthCertificate;`,
+    `import 'package:fixnum/fixnum.dart' show Int64;`,
+    `import 'operation_payloads.pb.dart' as _nmsop;`,
+    `import 'package:nomos_types/nomos_kernel_protocol.dart' show ApplicationBirthContract, BirthCertificate;`,
     `import 'package:nomos_types/nomos_types.dart' show NomosSlot, Sha256Digest;`,
     `import 'package:nomos_client/src/application_framework_calls.dart';`,
     `import 'package:nomos_client/src/generated_call.dart';`,
     ``,
-    ...DART_CALL_USDA_PRELUDE,
+    ...DART_CALL_PROTO_PRELUDE,
     ...(certificateRecordType === undefined
       ? []
       : [
@@ -365,6 +639,15 @@ export function generateDartApplicationFrameworkCalls(
     `  const _NmsCompiledApplicationFrameworkCalls();`,
     `  @override`,
     `  String get applicationHomeDomain => ${JSON.stringify(APPLICATION_HOME_DOMAIN)};`,
+    `  @override`,
+    `  String get applicationAuthorityDomain => ${JSON.stringify(recoveryDoors[0]?.domain ?? APPLICATION_HOME_DOMAIN)};`,
+    `  @override`,
+    `  String get parentModelAuthoritySeatAggregate => ${JSON.stringify(PARENT_MODEL_AUTHORITY_SEAT_AGGREGATE)};`,
+    `  @override`,
+    `  String get parentModelAuthoritySeatId => ${JSON.stringify(PARENT_MODEL_AUTHORITY_SEAT_ID)};`,
+    `  @override`,
+    `  ApplicationBirthContract get applicationBirthContract =>`,
+    `      ApplicationBirthContract(lawSha256: ${JSON.stringify(descriptor.lawSha256)});`,
     ``,
     ...methods,
     `}`,

package/src/codegen_dart_indexed_variant.ts

@@ -0,0 +1,159 @@
+import type { IndexedVariant } from "./indexed_variant.js";
+import { dartMemberName, dartTypeOfVoField, unionArmClassName } from "./codegen_dart.js";
+
+/** Stateless, generated proof of a runtime field/value relationship. Constructors
+ * remain library-private: callers narrow the binding and receive only its edit API.
+ */
+export function emitDartIndexedVariant(d: IndexedVariant): string {
+  const n = d.name;
+  const v = d.value.name;
+  const entries = Object.entries(d.cases).sort(([a], [b]) => a.localeCompare(b));
+  const armClass = (arm: string) => unionArmClassName(v, arm);
+  const caseClass = (kind: string) => unionArmClassName(n, kind);
+  const kindsByArm = new Map<string, string[]>();
+  for (const [kind, arm] of entries) kindsByArm.set(arm, [...(kindsByArm.get(arm) ?? []), kind]);
+  const classes = entries.map(([kind, arm]) => {
+    const shape = d.value.descriptor.union![arm]!;
+    const fields = "ref" in shape
+      ? [{ member: "value", type: shape.ref, optional: false }]
+      : Object.entries(shape.fields).filter(([, f]) => f.type !== "literal").map(([key, f]) => ({
+        member: dartMemberName(key),
+        type: dartTypeOfVoField(f, armClass(arm), key) + (f.optional && !f.nullable ? "?" : ""),
+        optional: f.optional === true,
+      }));
+    const args = fields.length === 1
+      ? `${fields[0]!.type} value`
+      : fields.length === 0 ? "" : `{${fields.map((f) => `${f.optional ? "" : "required "}${f.type} ${f.member}`).join(", ")}}`;
+    const construct = "ref" in shape ? `${armClass(arm)}(value)`
+      : `${armClass(arm)}(${fields.map((f) => `${f.member}: ${fields.length === 1 ? "value" : f.member}`).join(", ")})`;
+    return `final class ${caseClass(kind)} extends ${n}Editable {
+  final ${armClass(arm)}? value;
+  const ${caseClass(kind)}._(String id, String? definitionVersion, this.value) : super._('${kind}', id, definitionVersion);
+  ${n}Edit edit(${args}) => ${n}Edit._(id, kind, definitionVersion, ${construct});
+}`;
+  });
+  const decodeCases = entries.map(([kind, arm]) => {
+    const shape = d.value.descriptor.union![arm]!;
+    const keys = "ref" in shape ? ["value"] : Object.keys(shape.fields).filter((key) => shape.fields[key]!.type !== "literal");
+    return `      '${kind}' => ${armClass(arm)}.fromProjected(${keys.length === 1
+      ? `{'type': '${arm}', '${keys[0]}': input}`
+      : `{'type': '${arm}', ...(input as Map).cast<String, Object?>()}`}),`;
+  });
+  return `/// Runtime narrowing for the declared ${n} discriminator/value relationship.
+sealed class ${n}Binding {
+  final String id;
+  final String kind;
+  final String? definitionVersion;
+  const ${n}Binding._(this.id, this.kind, this.definitionVersion);
+
+  /// Recover a definition kind only when the declared relationship is unambiguous.
+  static String? kindOf(${v}? value) => switch (value) {
+${[...kindsByArm].filter(([, kinds]) => kinds.length === 1).map(([arm, kinds]) => `    ${armClass(arm)}() => '${kinds[0]}',`).join("\n")}
+    _ => null,
+  };
+
+  static ${n}Binding resolve({required String id, required String kind, ${v}? value, String? definitionVersion}) {
+    switch (kind) {
+${entries.map(([kind, arm]) => `      case '${kind}':
+        if (value != null && value is! ${armClass(arm)}) {
+          return ${n}ShapeMismatch._(id, kind, definitionVersion, value);
+        }
+        return ${caseClass(kind)}._(id, definitionVersion, value as ${armClass(arm)}?);`).join("\n")}
+      default:
+        return ${n}Unsupported._(id, kind, definitionVersion);
+    }
+  }
+}
+
+sealed class ${n}Editable extends ${n}Binding {
+  const ${n}Editable._(String kind, String id, String? definitionVersion) : super._(id, kind, definitionVersion);
+  ${n}Edit clear() => ${n}Edit._(id, kind, definitionVersion, null);
+}
+
+${classes.join("\n\n")}
+
+sealed class ${n}Rejection extends ${n}Binding implements Exception {
+  const ${n}Rejection._(super.id, super.kind, super.definitionVersion) : super._();
+  String get message;
+  @override
+  String toString() => message;
+}
+
+final class ${n}Unsupported extends ${n}Rejection {
+  const ${n}Unsupported._(super.id, super.kind, super.definitionVersion) : super._();
+  @override
+  String get message => 'Unsupported ${n} kind: $kind';
+}
+
+final class ${n}ShapeMismatch extends ${n}Rejection {
+  final ${v} value;
+  const ${n}ShapeMismatch._(super.id, super.kind, super.definitionVersion, this.value) : super._();
+  @override
+  String get message => '${n} $id has a value incompatible with $kind';
+}
+
+final class ${n}DefinitionChanged extends ${n}Rejection {
+  const ${n}DefinitionChanged._(super.id, super.kind, super.definitionVersion) : super._();
+  @override
+  String get message => '${n} $id changed; reopen its editor';
+}
+
+final class ${n}InvalidInput extends ${n}Rejection {
+  const ${n}InvalidInput._(super.id, super.kind, super.definitionVersion) : super._();
+  @override
+  String get message => 'Invalid input for ${n} $id ($kind)';
+}
+
+/// An edit can only be constructed by a narrowed field or the checked JSON boundary.
+final class ${n}Edit {
+  final String id;
+  final String kind;
+  final String? definitionVersion;
+  final ${v}? _value;
+  ${n}Edit._(this.id, this.kind, this.definitionVersion, ${v}? value)
+      : _value = value == null ? null : ${v}.fromProjected(_${n}Snapshot(value.toJson()) as Map<String, Object?>);
+  // Copy at both boundaries: mutable nested collections cannot change an already-created edit.
+  ${v}? get value => _value == null ? null : ${v}.fromProjected(_${n}Snapshot(_value.toJson()) as Map<String, Object?>);
+
+  /// Recheck the current definition immediately before submitting. No I/O.
+  ${n}Rejection? rejectionFor(${n}Binding current) {
+    if (current is ${n}Rejection) return current;
+    if (current.id != id || current.kind != kind || current.definitionVersion != definitionVersion) {
+      return ${n}DefinitionChanged._(id, kind, definitionVersion);
+    }
+    return null;
+  }
+
+  /// Only for untyped external input (JSON/actions). UI code uses the narrowed edit method.
+  static ${n}Edit decode(${n}Binding field, Object? input) {
+    if (field is ${n}Rejection) throw field;
+    if (input == null) return (field as ${n}Editable).clear();
+    try {
+      final ${v} value;
+      if (input is ${v}) {
+        value = input;
+      } else if (input is Map && input.containsKey('type')) {
+        value = ${v}.fromProjected(input.cast<String, Object?>());
+      } else {
+        value = switch (field.kind) {
+${decodeCases.join("\n")}
+          _ => throw ${n}Unsupported._(field.id, field.kind, field.definitionVersion),
+        };
+      }
+      final checked = ${n}Binding.resolve(id: field.id, kind: field.kind, definitionVersion: field.definitionVersion, value: value);
+      if (checked is ${n}Rejection) throw checked;
+      return ${n}Edit._(field.id, field.kind, field.definitionVersion, value);
+    } on ${n}Rejection {
+      rethrow;
+    } on Object {
+      throw ${n}InvalidInput._(field.id, field.kind, field.definitionVersion);
+    }
+  }
+}
+
+Object? _${n}Snapshot(Object? value) => switch (value) {
+  Map value => value.map((key, item) => MapEntry(key as String, _${n}Snapshot(item))),
+  List value => value.map(_${n}Snapshot).toList(),
+  _ => value,
+};`;
+}