@githolon/dsl 0.108.7 → 0.110.1

package/src/codegen_dart_scenario.ts

@@ -1,6 +1,6 @@
 import type { DomainModule } from "./codegen_dart.js";
 import { cap } from "./codegen_dart.js";
-import { dartApplicationClassName } from "./codegen_dart_application.js";
+import { dartApplicationClassName } from "./codegen_dart_facade.js";
 import { synthesizePayload } from "./codegen_proof.js";
 import { isBusinessIntent } from "./intent.js";
 
@@ -103,7 +103,7 @@ export function generateDartScenario(
   const usesJsonFacts = permissions.some(
     (permission) => Object.keys(permission.sampleFacts).length > 0,
   );
-  const bind = `nomosInternalBind${application}`;
+  const receive = `receive${application}`;
   const applicationFile = options.applicationFile ?? `${mod.name}.application`;
   return [
     `// AUTO-GENERATED by nomos-compile — business application test environment.`,
@@ -116,13 +116,28 @@ export function generateDartScenario(
     `import 'package:flutter/services.dart' show rootBundle;`,
     `import 'package:flutter/widgets.dart' show WidgetsFlutterBinding;`,
     `import 'package:${clientPackage}/${clientPackage}.dart' show ${application};`,
-    `import 'package:${clientPackage}/src/generated/${applicationFile}.dart' show ${bind};`,
+    `import 'package:${clientPackage}/src/generated/${applicationFile}.dart' show ${receive};`,
     ...(options.applicationFrameworkCallsFile === undefined
       ? []
       : [`import 'package:${clientPackage}/src/generated/${options.applicationFrameworkCallsFile}.dart' show nomosInternalApplicationFrameworkCalls;`]),
-    `import 'package:nomos_flutter/src/generated_application_host.dart' show NmsInternalApplicationUserBinding;`,
-    `import 'package:nomos_client/src/home.dart' show nmsInternalReceivingGroupNameOf;`,
-    `import 'package:nomos_client/src/nms_test_environment.dart' show NomosTestCloud, NomosTestHarness;`,
+    `import 'package:nomos_client/src/reception/reception_session.dart' show NmsReceptionUser, NmsReceptionSessionView;`,
+    `import 'package:nomos_client/src/nms_generated_runtime.dart' show NomosSession;`,
+    `import 'package:nomos_client/src/nms_test_environment.dart' show NomosTestCloud, NomosTestHarness, NomosTestFrontier;`,
+    ``,
+    `// The office names the framework's identity anchor; a scenario never re-derives it.`,
+    `Future<NmsReceptionSessionView> _nmsTestReception(`,
+    `  NomosSession session, String principal,`,
+    `) async {`,
+    `  final identityId = await session.nmsReceivingGroupWorkspace(principal);`,
+    `  return NmsReceptionSessionView(`,
+    `    desk: session,`,
+    `    user: NmsReceptionUser(`,
+    `      actor: principal,`,
+    `      identityId: identityId,`,
+    `      identityAddress: 'nomos-identity:\${Uri.encodeComponent(identityId)}',`,
+    `    ),`,
+    `  );`,
+    `}`,
     ``,
     `final class ${testPerson} {`,
     `  static final RegExp _idPattern = RegExp(r'^[A-Za-z0-9][A-Za-z0-9._-]*$');`,
@@ -207,14 +222,13 @@ export function generateDartScenario(
       ? []
       : [`      applicationMaxChildWorkspacesPerUser: ${options.applicationMaxChildWorkspacesPerUser},`]),
     `      ownerSubject: person._principal,`,
-    `      workspace: nmsInternalReceivingGroupNameOf(person._principal),`,
     `      nodeEntry: Platform.environment['NOMOS_NODE_ENTRY'],`,
     `      phaseTimeout: const Duration(minutes: 2),`,
     `      onDiagnostic: Platform.environment['NOMOS_TEST_DIAGNOSTICS'] == '1' ? stderr.writeln : null,`,
     `    );`,
-    `    final application = await ${bind}(`,
-    `      environment.session(environment.workspace), NmsInternalApplicationUserBinding.fromActor(person._principal),`,
-    `    );`,
+    `    final application = await ${receive}(await _nmsTestReception(`,
+    `      environment.session(environment.workspace), person._principal,`,
+    `    ));`,
     `    final scenario = ${scenario}._(environment, person._principal, packageFiles.last, application);`,
     `    registerTearDown?.call(scenario.close);`,
     `    return scenario;`,
@@ -243,6 +257,9 @@ export function generateDartScenario(
     `    late final NomosTestHarness environment;`,
     `    try {`,
     `      environment = await NomosTestHarness.cloudBound(`,
+    ...(options.applicationFrameworkCallsFile === undefined
+      ? []
+      : [`        applicationFrameworkCalls: nomosInternalApplicationFrameworkCalls,`]),
     `        cloud: cloud, lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
     `        platformWorkspace: applicationName, subject: person._principal,`,
     `        nodeEntry: Platform.environment['NOMOS_NODE_ENTRY'],`,
@@ -253,12 +270,24 @@ export function generateDartScenario(
     `      await cloud.stop();`,
     `      rethrow;`,
     `    }`,
-    `    final application = await ${bind}(environment.homeSession, NmsInternalApplicationUserBinding.fromActor(person._principal));`,
+    `    final application = await ${receive}(await _nmsTestReception(environment.homeSession, person._principal));`,
     `    final scenario = ${scenario}._(environment, person._principal, packageFiles.last, application);`,
     `    registerTearDown?.call(scenario.close);`,
     `    return scenario;`,
     `  }`,
     ``,
+    `  /// Capture an authenticated point in this isolated local test peer.`,
+    `  Future<NomosTestFrontier> captureLocalFrontier(String workspace, {NomosTestFrontier? after}) => _environment.captureLocalFrontier(workspace, after: after);`,
+    ``,
+    `  /// Arrange retained-upgrade test custody, with canonical verification.`,
+    `  Future<void> arrangeRetainedFrontier(NomosTestFrontier frontier) async {`,
+    `    await _environment.arrangeRetainedFrontier(frontier);`,
+    `    _application = await ${receive}(await _nmsTestReception(_environment.homeSession, _principal));`,
+    `  }`,
+    ``,
+    `  /// Deliver held Git history through ordinary admission and watch invalidation.`,
+    `  Future<String> admitRetainedAdvance(NomosTestFrontier frontier) => _environment.admitRetainedAdvance(frontier);`,
+    ``,
     `  /// Simulate losing connectivity. Local business actions remain available.`,
     `  void disconnect() => _environment.testCloud?.setOnline(false);`,
     ``,
@@ -273,14 +302,14 @@ export function generateDartScenario(
     `  /// Kill and reopen the application from durable local state, then return the same business API.`,
     `  Future<${application}> restart() async {`,
     `    await _environment.restart();`,
-    `    _application = await ${bind}(_environment.homeSession, NmsInternalApplicationUserBinding.fromActor(_principal));`,
+    `    _application = await ${receive}(await _nmsTestReception(_environment.homeSession, _principal));`,
     `    return _application;`,
     `  }`,
     ``,
     `  /// Remove local custody and reinstall entirely from remote history.`,
     `  Future<${application}> reinstall() async {`,
     `    await _environment.reinstall();`,
-    `    _application = await ${bind}(_environment.homeSession, NmsInternalApplicationUserBinding.fromActor(_principal));`,
+    `    _application = await ${receive}(await _nmsTestReception(_environment.homeSession, _principal));`,
     `    return _application;`,
     `  }`,
     ``,

package/src/codegen_proof.ts

@@ -44,7 +44,7 @@ import type { RelationTypeDecl, Rewrite } from "./relation_schema.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 import { finishCount } from "./count.js";
 import { clearDirectiveId } from "./clear_directive.js";
-import type { DomainInterface } from "./shape_compat.js";
+import type { DomainInterface } from "./compatibility_graph.js";
 import { idOfMetaOf, idOfTargetKindOf, versionedRefOfMetaOf, voMetaOf, voSample } from "./value_object.js";
 import { mintedCreateField } from "./workspace_routing.js";
 import { deterministicPorts } from "./ctx.js";
@@ -2249,7 +2249,7 @@ export function discoverChildBirthLegOrReason(
     return { reason: `${who}: the plan THREW at the compile probe (${(e as Error)?.message ?? e}) — the probe runs it on a synthesized payload to read the birth recipe` };
   }
   if (recipe === undefined) {
-    return { reason: `${who}: the plan declared .births() but recorded NO birth — its plan must call birth({ workspace, genesisChain }) (see dsl/src/framework/home.ts birthHome, or bench/scale/fixtures/estate-birth)` };
+    return { reason: `${who}: the plan declared .births() but recorded NO birth — its plan must call birth({ workspace, genesisChain }) (see dsl/src/framework/receiving_group.ts birthReceivingGroup, or bench/scale/fixtures/estate-birth)` };
   }
   if (!Array.isArray(recipe.genesisChain)) {
     return { reason: `${who}: birth() was called without a genesisChain ARRAY — the recipe is { workspace, genesisChain: [ ...steps ] }` };
@@ -3352,7 +3352,7 @@ function generateSealedApplicationProof(
     `// Regenerated from the business law; do not edit or maintain a second client example.`,
     `// The local proof runner executes every deep framework leg without exposing it here.`,
     `// @nomos-proof-legs ${marker}`,
-    `import { ${opener}, sameRecord${optionalReferenceImport}${typeImports} } from "./${opts.packageName}.client.mjs";`,
+    `import { ${opener}, sameRecord${optionalReferenceImport}${typeImports} } from "./${opts.packageName}.reception.mjs";`,
     ``,
     `const fail: (message: string) => never = (message) => { throw new Error(message); };`,
     `const ok = (message: string) => console.log("✓ " + message);`,

package/src/codegen_provider_dart.ts

@@ -72,6 +72,11 @@ export interface ImpureCapabilityDecl {
   readonly name?: string;
   /** HTTPS offer endpoint; absent means obligations remain locally requested. */
   readonly endpoint?: string;
+  /** Resolved execution policy authored with an addressed capability. */
+  readonly execution?: {
+    readonly placement: "custodian";
+    readonly cardinality: "singleton";
+  };
   /** Maintained requested-task read used by the executor scan lane. */
   readonly tasks?: { readonly id: string };
   /** The task aggregate handle; `.id` is the wire type (e.g. `TranscribeVoiceNoteAggregate`). */

package/src/codegen_query_proto.ts

@@ -0,0 +1,158 @@
+import type { LawGraph, LawRowReadNode } from "./law_graph.js";
+import {
+  composedWireIdentity,
+  operationMessageIdentity,
+  protoFieldName,
+  protoMessageName,
+} from "./codegen_call_proto.js";
+
+export type QueryScalarKind = "string" | "reference" | "token" | "integer" | "boolean";
+
+export interface DartQueryProtoParameter {
+  readonly authoredPath: string;
+  readonly name: string;
+  readonly type: "String" | "int" | "bool";
+  readonly value: string;
+  readonly kind: QueryScalarKind;
+}
+
+export interface TsQueryProtoParameter {
+  readonly authoredPath: string;
+  readonly name: string;
+  readonly type: "string" | "number" | "boolean";
+  readonly value: string;
+  readonly kind: QueryScalarKind;
+}
+
+export interface QueryProtoEncoder {
+  readonly functionName: string;
+  readonly call: string;
+  readonly typeUrl: string;
+  readonly source: readonly string[];
+}
+
+const symbol = (value: string): string =>
+  value.replace(/[^A-Za-z0-9_$]+/g, "_").replace(/^[^A-Za-z_$]/, "_$&");
+
+function querySpec(
+  graph: LawGraph,
+  paths: ReadonlyMap<string, string>,
+  domain: string,
+  queryId: string,
+) {
+  const query = graph.nodes.find(
+    (node): node is LawRowReadNode =>
+      node.kind === "read" && (node.readKind === "query" || node.readKind === "ordered") && node.entity.label === queryId,
+  );
+  if (query === undefined) {
+    throw new Error(`query Protobuf codegen: domain '${domain}' has no law query '${queryId}'`);
+  }
+  const nodes = new Map(graph.nodes.map((node) => [node.entity.id, node]));
+  const keys = (query.readKind === "query" ? query.key : []).map((key) => {
+    const field = nodes.get(key.field.id);
+    if (field?.kind !== "field") {
+      throw new Error(`query Protobuf codegen: '${domain}/${queryId}' references non-field '${key.field.id}'`);
+    }
+    const terminalRef = key.path.at(-1);
+    const terminal = terminalRef === undefined
+      ? field
+      : nodes.get(terminalRef.id);
+    if (
+      terminal?.kind !== "field" &&
+      !(
+        terminal?.kind === "structural" &&
+        (terminal.structuralKind === "value-field" || terminal.structuralKind === "value-variant")
+      )
+    ) {
+      throw new Error(
+        `query Protobuf codegen: '${domain}/${queryId}' key '${field.entity.label}' has non-field terminal '${terminalRef?.id ?? key.field.id}'`,
+      );
+    }
+    return { key, field, sid: composedWireIdentity(paths, terminal.entity) };
+  });
+  const messageName = protoMessageName(
+    "Query",
+    operationMessageIdentity(graph, query.entity.sid),
+  );
+  return {
+    query,
+    keys,
+    messageName,
+    typeUrl: `type.nomos.dev/nomos.operation.v1.Query_${query.entity.sid}`,
+  };
+}
+
+export function emitTsQueryProtoEncoder(
+  graph: LawGraph,
+  paths: ReadonlyMap<string, string>,
+  domain: string,
+  queryId: string,
+  parameters: readonly TsQueryProtoParameter[],
+): QueryProtoEncoder {
+  const spec = querySpec(graph, paths, domain, queryId);
+  if (spec.keys.length !== parameters.length) {
+    throw new Error(`query Protobuf codegen: '${domain}/${queryId}' key/parameter length differs`);
+  }
+  const properties = spec.keys.map(({ key, sid }, index) => {
+    const parameter = parameters[index]!;
+    if (key.authoredPath !== parameter.authoredPath) {
+      throw new Error(`query Protobuf codegen: '${domain}/${queryId}' key ${index} identity differs`);
+    }
+    const value = parameter.kind === "integer" ? `BigInt(${parameter.name})` : parameter.name;
+    return `${protoFieldName(sid)}: ${value}`;
+  });
+  const functionName = `_nmsQueryProto_${symbol(domain)}_${symbol(queryId)}`;
+  return {
+    functionName,
+    call: `${functionName}(${parameters.map((parameter) => parameter.value).join(", ")})`,
+    typeUrl: spec.typeUrl,
+    source: [
+      `function ${functionName}(${parameters.map((parameter) => `${parameter.name}: ${parameter.type}`).join(", ")}): NmsGeneratedQuery<${JSON.stringify(domain)}, ${JSON.stringify(queryId)}> {`,
+      `  const message = create(_nmsop.${spec.messageName}Schema, { ${properties.join(", ")} });`,
+      `  return _nmsGeneratedQuery(${JSON.stringify(domain)}, ${JSON.stringify(queryId)}, ${JSON.stringify(spec.typeUrl)}, toBinary(_nmsop.${spec.messageName}Schema, message));`,
+      `}`,
+      ``,
+    ],
+  };
+}
+
+export function emitDartQueryProtoEncoder(
+  graph: LawGraph,
+  paths: ReadonlyMap<string, string>,
+  domain: string,
+  queryId: string,
+  parameters: readonly DartQueryProtoParameter[],
+): QueryProtoEncoder {
+  const spec = querySpec(graph, paths, domain, queryId);
+  if (spec.keys.length !== parameters.length) {
+    throw new Error(`query Protobuf codegen: '${domain}/${queryId}' key/parameter length differs`);
+  }
+  const setters = spec.keys.map(({ key, sid }, index) => {
+    const parameter = parameters[index]!;
+    if (key.authoredPath !== parameter.authoredPath) {
+      throw new Error(`query Protobuf codegen: '${domain}/${queryId}' key ${index} identity differs`);
+    }
+    const value = parameter.kind === "integer" ? `_nmsProtoInt(${parameter.name})` : parameter.name;
+    return `    ..${protoFieldName(sid)} = ${value}`;
+  });
+  const functionName = `_nmsQueryProto_${symbol(domain)}_${symbol(queryId)}`;
+  return {
+    functionName,
+    call: `${functionName}(${parameters.map((parameter) => parameter.value).join(", ")})`,
+    typeUrl: spec.typeUrl,
+    source: [
+      `NmsGeneratedQuery ${functionName}(${parameters.map((parameter) => `${parameter.type} ${parameter.name}`).join(", ")}) {`,
+      `  final message = _nmsop.${spec.messageName}()`,
+      ...setters,
+      `  ;`,
+      `  return NmsInternalGeneratedQueries.create(`,
+      `    domain: ${JSON.stringify(domain)},`,
+      `    query: ${JSON.stringify(queryId)},`,
+      `    protobufType: ${JSON.stringify(spec.typeUrl)},`,
+      `    protobufPayload: Uint8List.fromList(message.writeToBuffer()),`,
+      `  );`,
+      `}`,
+      ``,
+    ],
+  };
+}

package/src/codegen_refusal.ts

@@ -0,0 +1,189 @@
+import type { DomainModule } from "./codegen_dart.js";
+import type { ValueObject } from "./value_object.js";
+import { isBusinessIntent } from "./intent.js";
+import type { LawGraph } from "./law_graph.js";
+
+const cap = (s: string) => s[0]!.toUpperCase() + s.slice(1);
+export function refusalContracts(mod: DomainModule, command: string): ValueObject<unknown>[] {
+  const collect = (id: string, active = new Set<string>()): ValueObject<unknown>[] => {
+    if (active.has(id)) throw new Error(`cyclic refusal contract composition at '${id}'`);
+    const direct = (mod.workspaceInvariants ?? []).flatMap(rule => rule.on === id && rule.refusal ? [rule.refusal] : []);
+    const declaration = mod.directives.find(d => d.id === id);
+    return [...direct, ...(isBusinessIntent(declaration)
+      ? declaration.steps.flatMap(step => collect(step.directive.id, new Set([...active, id]))) : [])];
+  };
+  return [...new Map(collect(command).map(value => [value.name, value])).values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+export const refusalType = (command: string, contracts: readonly ValueObject<unknown>[]): string =>
+  contracts.length === 1 ? contracts[0]!.name : `${cap(command)}Refusal`;
+export const refusalDecoder = (command: string): string => `nmsDecode${cap(command)}Refusal`;
+
+export function dartRefusalUnions(mod: DomainModule): string[] {
+  return (mod.applicationIntents ?? mod.directives).flatMap(command => {
+    const contracts = refusalContracts(mod, command.id);
+    if (contracts.length < 2) return [];
+    const name = refusalType(command.id, contracts);
+    return [`sealed class ${name} { const ${name}(); }`, ...contracts.map(contract =>
+      `final class ${name}${contract.name} extends ${name} { final ${contract.name} value; const ${name}${contract.name}(this.value); }`)];
+  });
+}
+
+/** Expand the authenticated nominal graph into codecs. No schema lookup or law
+ * evaluation is delegated to Reception or UI code. */
+export function dartRefusalDecoders(mod: DomainModule, graph: LawGraph, paths: ReadonlyMap<string, string>): string[] {
+  const nodes = new Map<string, LawGraph["nodes"][number]>(graph.nodes.map(node => [node.entity.id, node]));
+  const functions = new Map<string, string[]>();
+  const path = (id: string) => {
+    const value = paths.get(id);
+    if (!value) throw new Error(`refusal codegen has no law path for ${id}`);
+    return JSON.stringify(value);
+  };
+  const emit = (id: string): string => {
+    const name = `_nmsRefusal_${id.replace(/[^a-zA-Z0-9_]/g, "_")}`;
+    if (functions.has(id)) return name;
+    functions.set(id, []);
+    const node = nodes.get(id);
+    if (!node) throw new Error(`refusal codegen has no type ${id}`);
+    const expression = node.kind === "type"
+      ? node.form === "sum" ? { kind: "sum" as const, variants: node.variants }
+        : { kind: "record" as const, fields: node.fields }
+      : node.kind === "structural" && node.structuralKind === "value-type" ? node.expression : undefined;
+    if (!expression) throw new Error(`refusal codegen expected nominal type at ${id}`);
+    const lines = [`Object? ${name}(NmsUsdaPrim value) {`,
+      `  if (value.relationship('nomos:type') != ${path(id)}) throw const NmsUnsupportedNominalRefusal();`];
+    switch (expression.kind) {
+      case "record": {
+        const fields = expression.fields.map(ref => {
+          const field = nodes.get(ref.id);
+          if (!field || (field.kind !== "field" && !(field.kind === "structural" && field.structuralKind === "value-field")))
+            throw new Error(`refusal codegen expected field ${ref.id}`);
+          return { label: field.kind === "field" ? field.entity.label : field.name,
+            id: ref.id, value: field.value.id, required: field.required };
+        });
+        lines.push(`  if (value.typeName != 'NomosRecordValue') throw const FormatException('Expected nominal record');`,
+          `  for (final field in value.children) { if (!<String>{${fields.map(field => path(field.id)).join(", ")}}.contains(field.relationship('nomos:field'))) throw const NmsUnsupportedNominalRefusal(); }`,
+          `  return <String, dynamic>{`,
+          ...fields.map(field => `${field.required ? "" : `    if (value.field(${path(field.id)}) != null) `}${JSON.stringify(field.label)}: ${emit(field.value)}(value.requiredField(${path(field.id)})),`), `  };`);
+        break;
+      }
+      case "sum":
+        lines.push(`  if (value.typeName != 'NomosSumValue') throw const FormatException('Expected nominal sum');`,
+          `  return switch (value.relationship('nomos:variant')) {`, ...expression.variants.map(ref => {
+            const variant = nodes.get(ref.id);
+            if (variant?.kind !== "structural" || variant.structuralKind !== "value-variant") throw new Error(`missing refusal variant ${ref.id}`);
+            const body = `${emit(variant.value.id)}(value.requiredChild('Value'))`;
+            return `    ${path(ref.id)} => ${node.kind === "type"
+              ? `<String, dynamic>{'type': ${JSON.stringify(variant.label)}, ${nodes.get(variant.value.id)?.kind === "type" ? `'value': ${body}` : `...(${body} as Map<String, dynamic>)`}}`
+              : body},`;
+          }), `    _ => throw const NmsUnsupportedNominalRefusal(),`, `  };`);
+        break;
+      case "string": lines.push(`  return value.stringValue();`); break;
+      case "enum": lines.push(`  final text = value.stringValue();`, `  if (!<String>{${expression.values.map(v => JSON.stringify(v)).join(", ")}}.contains(text)) throw const NmsUnsupportedNominalRefusal();`, `  return text;`); break;
+      case "integer": lines.push(`  return value.intValue();`); break;
+      case "number": lines.push(`  return value.numberValue();`); break;
+      case "boolean": lines.push(`  return value.boolValue();`); break;
+      case "literal":
+        lines.push(`  final literal = value.property('nomos:value');`, `  if (literal != ${JSON.stringify(expression.value)}) throw const NmsUnsupportedNominalRefusal();`, `  return literal;`); break;
+      case "list": lines.push(`  if (value.typeName != 'NomosListValue') throw const FormatException('Expected nominal list');`, `  return value.children.map((child) => ${emit(expression.element.id)}(child)).toList();`); break;
+      case "map": lines.push(`  if (value.typeName != 'NomosMapValue') throw const FormatException('Expected nominal map');`, `  final result = <String, dynamic>{};`, `  for (final entry in value.children) {`, `    final key = entry.requiredStringProperty('nomos:key');`, `    if (result.containsKey(key)) throw const FormatException('Duplicate nominal map key');`, `    result[key] = ${emit(expression.value.id)}(entry.requiredChild('Value'));`, `  }`, `  return result;`); break;
+      case "nullable": lines.push(`  return value.typeName == 'NomosNullValue' ? null : ${emit(expression.value.id)}(value);`); break;
+      case "default": case "recursive": lines.splice(1, 1); lines.push(`  return ${emit(expression.value.id)}(value);`); break;
+      case "null": lines.push(`  if (value.typeName != 'NomosNullValue') throw const FormatException('Expected nominal null');`, `  return null;`); break;
+      default: throw new Error(`refusal codec does not support ${expression.kind}`);
+    }
+    lines.push(`}`);
+    functions.set(id, lines);
+    return name;
+  };
+  const decoders = mod.directives.flatMap(command => {
+    const contracts = refusalContracts(mod, command.id);
+    if (!contracts.length) return [];
+    const result = refusalType(command.id, contracts);
+    return [`${result}? ${refusalDecoder(command.id)}(NomosDomainRefusalEvidence refusal) {`,
+      `  final value = NmsUsdaLayer.parse(refusal.valueUsda);`,
+      `  return switch (refusal.typeIdentity) {`, ...contracts.map(contract => {
+        const node = graph.nodes.find(node => node.kind === "type" && node.entity.label === contract.name);
+        if (!node) throw new Error(`missing refusal type ${contract.name}`);
+        const decoded = `${contract.name}.fromProjected(${emit(node.entity.id)}(value) as Map<String, dynamic>)`;
+        return `    ${path(node.entity.id)} => ${contracts.length === 1 ? decoded : `${result}${contract.name}(${decoded})`},`;
+      }), `    _ => null,`, `  };`, `}`];
+  });
+  return [...functions.values()].flat().concat(decoders);
+}
+
+export const tsRefusalDecoder = (mod: DomainModule, command: string): string =>
+  `_nmsRefusal_${(mod.domain ?? mod.name).replace(/\W/g, '_')}_${command}`;
+
+export function tsRefusalDecoders(mod: DomainModule, graph: LawGraph, paths: ReadonlyMap<string, string>): string[] {
+  const nodes = new Map<string, LawGraph['nodes'][number]>(graph.nodes.map(node => [node.entity.id, node]));
+  const functions = new Map<string, string[]>();
+  const path = (id: string): string => {
+    const value = paths.get(id);
+    if (!value) throw new Error(`refusal codegen has no law path for ${id}`);
+    return JSON.stringify(value);
+  };
+  const emit = (id: string): string => {
+    const name = `_nmsRefusalValue_${id.replace(/\W/g, '_')}`;
+    if (functions.has(id)) return name;
+    functions.set(id, []);
+    const node = nodes.get(id);
+    const expression = node?.kind === 'type' ? node.form === 'sum'
+      ? { kind: 'sum' as const, variants: node.variants } : { kind: 'record' as const, fields: node.fields }
+      : node?.kind === 'structural' && node.structuralKind === 'value-type' ? node.expression : undefined;
+    if (!expression) throw new Error(`refusal codegen expected nominal type ${id}`);
+    const lines = [`function ${name}(value: _NominalValue): unknown {`,
+      `  if (value.relationship('nomos:type') !== ${path(id)}) throw new _UnsupportedNominalRefusal();`];
+    switch (expression.kind) {
+      case 'record': {
+        const fields = expression.fields.map(ref => {
+          const field = nodes.get(ref.id);
+          if (!field || (field.kind !== 'field' && !(field.kind === 'structural' && field.structuralKind === 'value-field'))) throw new Error(`missing field ${ref.id}`);
+          return { label: field.kind === 'field' ? field.entity.label : field.name, id: ref.id, value: field.value.id, required: field.required };
+        });
+        lines.push(`  if (value.typeName !== 'NomosRecordValue') throw new TypeError('Expected nominal record');`,
+          `  for (const child of value.children) if (!([${fields.map(field => path(field.id)).join(', ')}] as readonly string[]).includes(child.relationship('nomos:field') ?? '')) throw new _UnsupportedNominalRefusal();`,
+          `  return {`, ...fields.map(field => field.required
+            ? `    ${JSON.stringify(field.label)}: ${emit(field.value)}(value.requiredField(${path(field.id)})),`
+            : `    ...(value.field(${path(field.id)}) === undefined ? {} : { ${JSON.stringify(field.label)}: ${emit(field.value)}(value.requiredField(${path(field.id)})) }),`), `  };`);
+        break;
+      }
+      case 'sum':
+        lines.push(`  if (value.typeName !== 'NomosSumValue') throw new TypeError('Expected nominal sum');`,
+          `  switch (value.relationship('nomos:variant')) {`, ...expression.variants.map(ref => {
+            const variant = nodes.get(ref.id);
+            if (variant?.kind !== 'structural' || variant.structuralKind !== 'value-variant') throw new Error(`missing variant ${ref.id}`);
+            const body = `${emit(variant.value.id)}(value.child('Value'))`;
+            return `    case ${path(ref.id)}: return ${node?.kind === "type"
+              ? `{ type: ${JSON.stringify(variant.label)}, ${nodes.get(variant.value.id)?.kind === "type" ? `value: ${body}` : `...(${body} as Record<string, unknown>)`} }`
+              : body};`;
+          }), `    default: throw new _UnsupportedNominalRefusal();`, `  }`); break;
+      case 'string': lines.push(`  return value.stringValue();`); break;
+      case 'enum': lines.push(`  const text = value.stringValue();`, `  if (!${JSON.stringify(expression.values)}.includes(text)) throw new _UnsupportedNominalRefusal();`, `  return text;`); break;
+      case 'integer': lines.push(`  return value.numberValue(true);`); break;
+      case 'number': lines.push(`  return value.numberValue();`); break;
+      case 'boolean': lines.push(`  return value.boolValue();`); break;
+      case 'literal': lines.push(`  const literal = value.property('nomos:value');`, `  if (literal !== ${JSON.stringify(expression.value)}) throw new _UnsupportedNominalRefusal();`, `  return literal;`); break;
+      case 'list': lines.push(`  if (value.typeName !== 'NomosListValue') throw new TypeError('Expected nominal list');`, `  return value.children.map(child => ${emit(expression.element.id)}(child));`); break;
+      case 'map': lines.push(`  if (value.typeName !== 'NomosMapValue') throw new TypeError('Expected nominal map');`, `  const result = new Map<string, unknown>();`, `  for (const entry of value.children) {`, `    const key = entry.property('nomos:key');`, `    if (typeof key !== 'string') throw new TypeError('Expected nominal key');`, `    if (result.has(key)) throw new TypeError('Duplicate nominal map key');`, `    result.set(key, ${emit(expression.value.id)}(entry.child('Value')));`, `  }`, `  return Object.fromEntries(result);`); break;
+      case 'nullable': lines.push(`  return value.typeName === 'NomosNullValue' ? null : ${emit(expression.value.id)}(value);`); break;
+      case 'default': case 'recursive': lines.splice(1, 1); lines.push(`  return ${emit(expression.value.id)}(value);`); break;
+      case 'null': lines.push(`  if (value.typeName !== 'NomosNullValue') throw new TypeError('Expected nominal null');`, `  return null;`); break;
+      default: throw new Error(`refusal codec does not support ${expression.kind}`);
+    }
+    lines.push('}'); functions.set(id, lines); return name;
+  };
+  const decoders = mod.directives.flatMap(command => {
+    const contracts = refusalContracts(mod, command.id);
+    if (!contracts.length) return [];
+    const result = contracts.length === 1 ? contracts[0]!.name : `${cap(mod.domain ?? mod.name)}${cap(command.id)}Refusal`;
+    const declarations = contracts.length < 2 ? [] : [`export type ${result} = ${contracts.map(contract => `{ readonly family: ${JSON.stringify(contract.name)}; readonly value: ${contract.name} }`).join(' | ')};`];
+    return [...declarations, `function ${tsRefusalDecoder(mod, command.id)}(refusal: _DomainRefusalEvidence): ${result} | undefined {`,
+      `  switch (refusal.typeIdentity) {`, ...contracts.map(contract => {
+        const type = graph.nodes.find(node => node.kind === 'type' && node.entity.label === contract.name);
+        if (!type) throw new Error(`missing refusal type ${contract.name}`);
+        const body = `${emit(type.entity.id)}(_parseNominalValue(refusal.valueUsda)) as ${contract.name}`;
+        return `    case ${path(type.entity.id)}: return ${contracts.length === 1 ? body : `{ family: ${JSON.stringify(contract.name)}, value: ${body} }`};`;
+      }), `    default: return undefined;`, `  }`, `}`];
+  });
+  return [...functions.values()].flat().concat(decoders);
+}