@githolon/dsl 0.112.4 → 0.112.6

package/compile_proof.d.mts

@@ -36,12 +36,14 @@ export function writePlanCompileProof(options: {
   plan: string;
   planSha256: string;
   inputs: readonly { readonly path: string; readonly sha256: string }[];
+  sourceRoot?: string;
 }): void;
 export function readPlanCompileProof(options: {
   proofPath: string;
   baseIdentity: string;
   runtimeSha256: string;
   digestFile?: (file: string) => string;
+  sourceRoot?: string;
 }): { javascript: string; sha256: string } | undefined;
 export function writeKeyProofUsda(file: string, format: string, key: string): void;
 export function readKeyProofUsda(file: string, format: string): string | undefined;

package/compile_proof.mjs

@@ -1,5 +1,5 @@
 // A content-addressed compiler proof expressed as USDA, not a parallel JSON manifest.
-// It is disposable build cache metadata under node_modules/.cache: law and custody
+// It is disposable build cache metadata under .nomos-cache: law and custody
 // remain the emitted typed USDA closure.
 import { createHash } from "node:crypto";
 import {
@@ -123,7 +123,7 @@ export function compileInputs({ cwd, dslDir, configPath, argumentIdentity }) {
 
 export function compileProofPath(cwd, configPath) {
   const key = sha256(path.resolve(configPath)).slice(0, 24);
-  return path.join(cwd, "node_modules", ".cache", "nomos", `${key}.compile-proof.usda`);
+  return path.join(cwd, ".nomos-cache", `${key}.compile-proof.usda`);
 }
 
 function artifactPrim(kind, entry, proofDir) {
@@ -253,14 +253,14 @@ export function readCompileProof({ proofPath, inputs }) {
   };
 }
 
-function emitPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, plan, planSha256, inputs }) {
+function emitPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, plan, planSha256, inputs, sourceRoot }) {
   const proofDir = path.dirname(proofPath);
-  const inputPrims = inputs.map((entry) => artifactPrim("input", entry, proofDir));
+  const inputPrims = inputs.map((entry) => artifactPrim("input", entry, sourceRoot ?? proofDir));
   return [
     "#usda 1.0",
     "(",
     "    customLayerData = {",
-    '        string "nomos:format" = "nomos.plan-compile-proof.v1"',
+    `        string "nomos:format" = "nomos.plan-compile-proof.${sourceRoot === undefined ? "v1" : "v2"}"`,
     "    }",
     ")",
     "",
@@ -284,28 +284,33 @@ function emitPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, plan, pl
   ].join("\n");
 }
 
-export function writePlanCompileProof({ proofPath, baseIdentity, runtimeSha256, plan, planSha256, inputs }) {
+export function writePlanCompileProof({ proofPath, baseIdentity, runtimeSha256, plan, planSha256, inputs, sourceRoot }) {
   if (![baseIdentity, runtimeSha256, planSha256, ...inputs.map((entry) => entry.sha256)].every((value) => HASH.test(value))) {
     throw new Error("plan compile proof requires content-addressed identities");
   }
+  if (sourceRoot !== undefined && inputs.some(({ path: file }) => {
+    const relative = path.relative(sourceRoot, file);
+    return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+  })) throw new Error("portable plan compile proof requires inputs inside source root");
   mkdirSync(path.dirname(proofPath), { recursive: true });
   const temporary = `${proofPath}.tmp-${process.pid}`;
   writeFileSync(
     temporary,
-    emitPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, plan, planSha256, inputs }),
+    emitPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, plan, planSha256, inputs, sourceRoot }),
     "utf8",
   );
   renameSync(temporary, proofPath);
 }
 
-export function readPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, digestFile }) {
+export function readPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, digestFile, sourceRoot }) {
   let text;
   try {
     text = readFileSync(proofPath, "utf8");
   } catch {
     return undefined;
   }
-  if (!text.includes('string "nomos:format" = "nomos.plan-compile-proof.v1"')) return undefined;
+  const format = `nomos.plan-compile-proof.${sourceRoot === undefined ? "v1" : "v2"}`;
+  if (!text.includes(`string "nomos:format" = "${format}"`)) return undefined;
   if (property(text, "baseIdentity") !== baseIdentity || property(text, "runtimeSha256") !== runtimeSha256) {
     return undefined;
   }
@@ -314,7 +319,9 @@ export function readPlanCompileProof({ proofPath, baseIdentity, runtimeSha256, d
   const inputs = [];
   const inputPattern = /def NomosCompileInput "[^"]+"\s*\{\s*custom uniform asset nomos:path = @([^@]+)@\s*custom uniform string nomos:sha256 = "([0-9a-f]{64})"\s*\}/gu;
   for (const match of inputsScope.matchAll(inputPattern)) {
-    inputs.push({ path: path.resolve(path.dirname(proofPath), match[1]), sha256: match[2] });
+    const relative = match[1];
+    if (sourceRoot !== undefined && (path.isAbsolute(relative) || relative === ".." || relative.startsWith("../"))) return undefined;
+    inputs.push({ path: path.resolve(sourceRoot ?? path.dirname(proofPath), relative), sha256: match[2] });
   }
   if (inputs.length === 0) return undefined;
   for (const input of inputs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.112.4",
+  "version": "0.112.6",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
@@ -73,7 +73,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@githolon/runtime": "^0.112.4",
+    "@githolon/runtime": "^0.112.6",
     "@bufbuild/protobuf": "^2.13.0",
     "@bufbuild/protoc-gen-es": "^2.13.0",
     "esbuild": "0.24.2",

package/src/compile_package_main.ts

@@ -46,6 +46,7 @@ import type { Directive } from "./directive.js";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import { checkOperationContracts } from "./operation_contract_check.js";
+import { compilerIntermediateCacheRoot, compilerSourceName, compilerSourceRoot } from "./compiler_cache.js";
 import {
   APPLICATION_CONTRACT_MODULE,
   assertGeneratedClientBundleBoundary,
@@ -1902,10 +1903,7 @@ function tsOperationProtoCache(
     .update(readFileSync(generatorPackage))
     .digest("hex");
   const cacheDir = path.join(
-    cacheRoot,
-    "node_modules",
-    ".cache",
-    "nomos",
+    compilerIntermediateCacheRoot(cacheRoot),
     "operation-protobuf",
     "typescript"
   );
@@ -1970,8 +1968,11 @@ function dartOperationProtoCache(
       path.join(path.dirname(path.dirname(plugin)), "pubspec.lock"),
     ];
     const digest = createHash("sha256");
+    const sourceRoot = compilerSourceRoot();
     for (const file of files) {
-      digest.update(`\0${file}\0`);
+      const name = sourceRoot !== undefined && path.resolve(file).startsWith(`${sourceRoot}${path.sep}`)
+        ? compilerSourceName(file, sourceRoot) : file;
+      digest.update(`\0${name}\0`);
       if (existsSync(file)) digest.update(readFileSync(file));
     }
     return digest.digest("hex");
@@ -1985,10 +1986,7 @@ function dartOperationProtoCache(
     .update(generatorIdentity)
     .digest("hex");
   const cacheDir = path.join(
-    process.cwd(),
-    "node_modules",
-    ".cache",
-    "nomos",
+    compilerIntermediateCacheRoot(process.cwd()),
     "operation-protobuf",
     "dart"
   );
@@ -2546,7 +2544,7 @@ const NOMOS_TYPES_DEP = "^0.11.3";
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
 const NOMOS_CLIENT_DEP = "^0.66.11";
-const NOMOS_FLUTTER_DEP = "^0.65.17";
+const NOMOS_FLUTTER_DEP = "^0.65.19";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -6442,6 +6440,7 @@ async function main(): Promise<void> {
       baseIdentity: string;
       runtimeSha256: string;
       digestFile?: (file: string) => string;
+      sourceRoot?: string;
     }): { javascript: string; sha256: string } | undefined;
     writePlanCompileProof(options: {
       proofPath: string;
@@ -6450,15 +6449,20 @@ async function main(): Promise<void> {
       plan: string;
       planSha256: string;
       inputs: readonly { readonly path: string; readonly sha256: string }[];
+      sourceRoot?: string;
     }): void;
   };
   const planCacheDir = path.join(
-    cfgDir,
-    "node_modules",
-    ".cache",
-    "nomos",
+    compilerIntermediateCacheRoot(cfgDir),
     "plans"
   );
+  const configuredSourceRoot = compilerSourceRoot();
+  const planSourceRoot = configuredSourceRoot !== undefined &&
+    !path.relative(configuredSourceRoot, cfgDir).startsWith("..") &&
+    !path.isAbsolute(path.relative(configuredSourceRoot, cfgDir))
+    ? configuredSourceRoot : undefined;
+  const portablePlanText = (value: string): string => planSourceRoot === undefined
+    ? value : value.replaceAll(planSourceRoot, "<nomos-source-root>");
   const planInputDigestCache = new Map<string, string>();
   const planBytesDigest = (bytes: Uint8Array): string =>
     createHash("sha256").update(bytes).digest("hex");
@@ -6910,10 +6914,10 @@ async function main(): Promise<void> {
       [
         planCompilerIdentity,
         runtimeSha256,
-        path.resolve(cfgDir),
+        planSourceRoot === undefined ? path.resolve(cfgDir) : compilerSourceName(cfgDir, planSourceRoot),
         compact ? "compact" : "readable",
-        signature,
-        entrySource,
+        portablePlanText(signature),
+        portablePlanText(entrySource),
       ].join("\0")
     );
     const cachePlanPath = path.join(planCacheDir, `${baseIdentity}.mjs`);
@@ -6928,6 +6932,7 @@ async function main(): Promise<void> {
           baseIdentity,
           runtimeSha256,
           digestFile: planInputDigest,
+          ...(planSourceRoot === undefined ? {} : { sourceRoot: planSourceRoot }),
         });
     let bundled: string;
     if (cached !== undefined) {
@@ -6984,7 +6989,11 @@ async function main(): Promise<void> {
         .filter((file) => existsSync(file))
         .map((file) => ({ path: file, sha256: planInputDigest(file) }))
         .sort((left, right) => left.path.localeCompare(right.path));
-      if (inputs.length > 0) {
+      const inputsArePortable = planSourceRoot === undefined || inputs.every(({ path: file }) => {
+        const relative = path.relative(planSourceRoot, file);
+        return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+      });
+      if (inputs.length > 0 && inputsArePortable) {
         mkdirSync(planCacheDir, { recursive: true });
         const temporary = `${cachePlanPath}.tmp-${process.pid}`;
         writeFileSync(temporary, bundled, "utf8");
@@ -6996,6 +7005,7 @@ async function main(): Promise<void> {
           plan: cachePlanPath,
           planSha256: sha256HexUtf8(bundled),
           inputs,
+          ...(planSourceRoot === undefined ? {} : { sourceRoot: planSourceRoot }),
         });
       }
     }
@@ -8369,10 +8379,7 @@ async function main(): Promise<void> {
     .update(readFileSync(fileURLToPath(import.meta.url)))
     .digest("hex");
   const declarationCacheDir = path.join(
-    cfgDir,
-    "node_modules",
-    ".cache",
-    "nomos",
+    compilerIntermediateCacheRoot(cfgDir),
     "typescript-declarations"
   );
   const declarationCachePath = path.join(
@@ -9468,7 +9475,7 @@ async function main(): Promise<void> {
   if (analyzeFlag) runDartAnalyze(dartOut);
 
   // The unchanged lane is itself USDA: a disposable content proof under
-  // node_modules/.cache relates authored/compiler inputs to every generated
+  // .nomos-cache relates authored/compiler inputs to every generated
   // artifact. It is not another law manifest and carries no semantic opinions.
   const compileProofPath = process.env.NOMOS_COMPILE_PROOF_PATH;
   const compileArgumentIdentity = process.env.NOMOS_COMPILE_ARGUMENT_IDENTITY;

package/src/compiler_cache.ts

@@ -0,0 +1,26 @@
+import { homedir } from "node:os";
+import path from "node:path";
+
+/** Disposable compiler intermediates may live on one machine for all local runners. */
+export function compilerIntermediateCacheRoot(localRoot: string): string {
+  const configured = process.env.NOMOS_COMPILER_CACHE_ROOT;
+  if (configured === undefined || configured === "") return path.join(localRoot, ".nomos-cache");
+  const expanded = configured === "~" ? homedir() : configured.startsWith(`~${path.sep}`)
+    ? path.join(homedir(), configured.slice(2)) : configured;
+  if (!path.isAbsolute(expanded)) throw new Error("NOMOS_COMPILER_CACHE_ROOT must be absolute or start with ~/");
+  return path.resolve(expanded);
+}
+
+/** Relative source names keep content-addressed plans portable between runner checkouts. */
+export function compilerSourceRoot(): string | undefined {
+  const configured = process.env.NOMOS_COMPILER_SOURCE_ROOT;
+  return configured === undefined || configured === "" ? undefined : path.resolve(configured);
+}
+
+export function compilerSourceName(file: string, sourceRoot: string): string {
+  const relative = path.relative(sourceRoot, path.resolve(file));
+  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw new Error(`compiler input is outside NOMOS_COMPILER_SOURCE_ROOT: ${file}`);
+  }
+  return (relative || ".").replaceAll(path.sep, "/");
+}

package/src/operation_contract_check.ts

@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
+import { compilerIntermediateCacheRoot } from './compiler_cache.js';
 
 /** Validate the emitted law, not a second in-memory interpretation of the DSL.
  * Cached results accelerate compilation only; they never enter custody or stand
@@ -14,7 +15,7 @@ export function checkOperationContracts(lawPath: string, descriptorPath: string,
   const key = createHash('sha256').update('nomos.operation-contract-check.v1\0')
     .update(readFileSync(artifact)).update(readFileSync(checker)).update(readFileSync(lawPath))
     .update(readFileSync(descriptorPath)).digest('hex');
-  const cache = path.join(cacheRoot, 'node_modules', '.cache', 'nomos', 'operation-contracts');
+  const cache = path.join(compilerIntermediateCacheRoot(cacheRoot), 'operation-contracts');
   const receipt = path.join(cache, `${key}.ok`);
   if (existsSync(receipt)) return;
   try {