@githolon/dsl 0.116.4 → 0.117.0

package/dart/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.70.3
+
+Refresh the packaged Peer Office runner from the shared client source used by the hosted headless application client. The existing text-decoder BOM behavior is explicit; the kernel and Peer Office protocols are unchanged.
+
+- Keep the runtime event subscription alive while realm closure waits for preparation source release and acknowledged custody retention, within the existing ten-second disposal deadline.
+
+- Refresh outdated Git custody advertisements before rejecting an acknowledged frontier, while preserving ancestry and compare-and-swap safety checks.
+
 ## 0.70.2
 
 - Carries the restaged peer runner for the native host 0.68.1 selection (CAP-874); its runtime identity moves with the runtime's patch release.

package/dart/lib/src/reception/dart_reception.dart

@@ -31,6 +31,8 @@ import 'package:nomos_types/nomos_types.dart'
     show
         nomosErrorFromInfo,
         NomosErrorInfo,
+        NomosRuntimeError,
+        NomosRuntimeFailure,
         ParentSignerEnrollmentMissing,
         NomosRef,
         VersionedNomosRef,
@@ -4224,15 +4226,35 @@ class DartReception {
       // host's transport disposal) releases the subscriptions regardless.
     }
     try {
-      final response = await _invokeRuntimeV2(
-        nomos_protocol.RuntimeRequest(
-          closeRealm: nomos_protocol.CloseRealmRequest(),
-        ),
-      ).timeout(const Duration(seconds: 10));
-      if (!response.hasRealmClosed()) {
-        throw StateError(
-          'Runtime v2 returned ${response.whichOutcome().name} for closeRealm',
-        );
+      final closing = Stopwatch()..start();
+      const deadline = Duration(seconds: 10);
+      while (true) {
+        final remaining = deadline - closing.elapsed;
+        if (remaining <= Duration.zero) {
+          throw TimeoutException('Peer Office realm closure remains pending');
+        }
+        try {
+          final response = await _invokeRuntimeV2(
+            nomos_protocol.RuntimeRequest(
+              closeRealm: nomos_protocol.CloseRealmRequest(),
+            ),
+          ).timeout(remaining);
+          if (response.hasRealmClosed()) break;
+          throw StateError(
+              'Runtime v2 returned ${response.whichOutcome().name} for closeRealm');
+        } catch (error) {
+          final code = switch (error) {
+            NomosRuntimeFailure(:final code) => code,
+            NomosRuntimeError(:final info) => info.code,
+            _ => null,
+          };
+          if (code != 'nomos.runtime.preparation_io_pending' &&
+              code != 'nomos.runtime.custody_retention_pending') rethrow;
+        }
+        // The office still owns physical release or acknowledged custody. Keep
+        // the event subscription alive while its existing host pump settles it;
+        // a refused close is not permission to dispose that owner's directory.
+        await Future<void>.delayed(const Duration(milliseconds: 10));
       }
     } catch (_) {
       // A dead/unstarted embedding has no reachable runner to release. The

package/dart/lib/src/runner/node-entry.mjs

@@ -8694,6 +8694,18 @@ function gitCustodyDesk(kernel, fetchImpl = fetch, observe, phaseStarted, import
         }
         const publish = async (allowReconcile) => {
           const oldHead = remote.get(reference) ?? ZERO_OID;
+          const expectedRemote = sealedMain.get(key) ?? resolveRef(workspace, receiptRef(ledger)) ?? ZERO_OID;
+          if (allowReconcile && expectedRemote !== ZERO_OID && oldHead !== expectedRemote) {
+            remote = new Map(Object.entries(await lsRefs(
+              ledger.remote,
+              ledger.headers ?? {},
+              { service: "git-receive-pack", prefix: "refs/", signal: ledger.signal },
+              fetchImpl
+            )));
+            observedRemoteRefs.set(key, remote);
+            await publish(false);
+            return;
+          }
           const bookmarkUpdates = [SYNC_BASE_REF, PLACEMENT_SYNC_BASE_REF].filter((ref) => named.has(ref) && remote.get(ref) !== named.get(ref)).map((ref) => ({ ref, oldOid: remote.get(ref) ?? ZERO_OID, newOid: named.get(ref) }));
           const outcomeUpdates = cursors.filter(([ref]) => ref.startsWith(EFFECT_OUTCOME_PREFIX) && remote.get(ref) === void 0).map(([ref, oid]) => ({ ref, oldOid: ZERO_OID, newOid: oid }));
           const deliveryUpdates = cursors.filter(([ref]) => ref.startsWith(DELIVERY_PREFIX) && remote.get(ref) === void 0).map(([ref, oid]) => ({ ref, oldOid: ZERO_OID, newOid: oid }));
@@ -8703,7 +8715,6 @@ function gitCustodyDesk(kernel, fetchImpl = fetch, observe, phaseStarted, import
           if (ledger.readOnly) {
             throw new Error(`read-only custody for '${workspace}' does not hold the requested frontier`);
           }
-          const expectedRemote = sealedMain.get(key) ?? resolveRef(workspace, receiptRef(ledger)) ?? ZERO_OID;
           let ancestryPack;
           if (oldHead !== expectedRemote && oldHead !== head) {
             if (oldHead !== ZERO_OID) {
@@ -24990,7 +25001,7 @@ function delayUntilDue(follow, nowUnixMillis) {
 
 // ../src/runtime/runtime_identity.ts
 init_define_NOMOS_KERNEL_RELEASE();
-var PEER_RUNTIME_IDENTITY = "0.116.4" ? `@githolon/runtime@${"0.116.4"}` : "@githolon/runtime@unbundled";
+var PEER_RUNTIME_IDENTITY = "0.117.0" ? `@githolon/runtime@${"0.117.0"}` : "@githolon/runtime@unbundled";
 
 // ../src/runtime/replica_follow_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.70.2
+version: 0.70.3
 
 environment:
   sdk: ^3.5.0

package/dart/test/realm_close_pending_test.dart

@@ -0,0 +1,55 @@
+import 'dart:async';
+import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:test/test.dart';
+
+final class _Office implements PeerOfficeConnection {
+  final events = StreamController<p.RuntimeEvent>.broadcast(sync: true);
+  final List<String> refusals;
+  int closes = 0;
+  int sequence = 0;
+  bool listenerRetained = true;
+  _Office(this.refusals);
+  @override
+  Stream<p.RuntimeEvent> get runtimeEvents => events.stream;
+  @override
+  int nextRuntimeRequestId() => ++sequence;
+  @override
+  Future<p.RuntimeResponse> invokeRuntime(p.RuntimeRequest request) async {
+    expect(request.hasCloseRealm(), isTrue);
+    listenerRetained &= events.hasListener;
+    final index = closes++;
+    return p.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        failure: index < refusals.length
+            ? p.RuntimeFailure(code: refusals[index], message: 'owner pending')
+            : null,
+        realmClosed: index >= refusals.length ? p.RealmClosed() : null);
+  }
+}
+
+void main() {
+  test(
+      'realm disposal retains events through physical release and custody settlement',
+      () async {
+    final office = _Office([
+      'nomos.runtime.preparation_io_pending',
+      'nomos.runtime.custody_retention_pending',
+    ]);
+    final reception = DartReception(office);
+    await reception.dispose();
+    expect(office.closes, 3);
+    expect(office.listenerRetained, isTrue);
+    expect(office.events.hasListener, isFalse);
+    await office.events.close();
+  });
+  test('an unrelated refusal is not retried as preparation', () async {
+    final office = _Office(['nomos.runtime.not_authorized']);
+    final reception = DartReception(office);
+    await reception.dispose();
+    expect(office.closes, 1);
+    expect(office.events.hasListener, isFalse);
+    await office.events.close();
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.116.4",
+  "version": "0.117.0",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
@@ -32,6 +32,8 @@
     "./workspace-type": "./src/workspace_type.ts",
     "./workspace-routing": "./src/workspace_routing.ts",
     "./workspace-sharding": "./src/workspace_sharding.ts",
+    "./reception-artifact": "./src/reception_artifact.ts",
+    "./reception-artifact-contract": "./src/reception_artifact_contract.ts",
     "./build-package": "./src/build_package.ts",
     "./codegen-dart": "./src/codegen_dart.ts",
     "./codegen-dot": "./src/codegen_dot.ts",
@@ -77,7 +79,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@githolon/runtime": "^0.116.4",
+    "@githolon/runtime": "^0.117.0",
     "@bufbuild/protobuf": "^2.13.0",
     "@bufbuild/protoc-gen-es": "^2.13.0",
     "esbuild": "0.24.2",

package/src/codegen_ts.ts

@@ -1177,6 +1177,10 @@ export interface TsClientOptions {
   /** Export the holon-level factories beside the application surface: the one TypeScript Reception the
    * compiler emits carries both (a code-mode or unattended peer binds the factories to any NomosHolon). */
   readonly exportHolonFactory?: boolean;
+  /** Compiler-only single-domain binding, with the exact composed modules retained
+   * as ownership evidence for cross-domain births. Emits no application opener
+   * that follows children or references sibling factories. */
+  readonly factoryOnly?: { readonly composition: readonly DomainModule[] };
   /** Emit only the fixed framework operator call set (identity, lifecycle and birth). This is the
    * small server/operator companion: exact generated USDA calls, no application/read runtime. */
   readonly frameworkOperatorOnly?: boolean;
@@ -1467,6 +1471,8 @@ function generateTsClientBody(
   opts: TsClientOptions,
   brandSink: Set<string>,
 ): string {
+  if (opts.factoryOnly && (modules.length !== 1 || !opts.factoryOnly.composition.includes(modules[0]!) || opts.exportHolonFactory !== true))
+    throw new Error("single-factory codegen requires one exported facet from its exact composed modules");
   if (opts.callUsda === undefined) {
     throw new Error(
       "TypeScript client codegen requires the composed law graph; application calls and results may not fall back to generic maps"
@@ -1604,9 +1610,10 @@ function generateTsClientBody(
     };
   });
   const aggregateOwners = new Map<string, string[]>();
-  for (const module of modules) {
+  for (const module of opts.factoryOnly?.composition ?? modules) {
     const domain = module.domain ?? module.name;
     for (const aggregate of module.aggregates) {
+      if (opts.factoryOnly && ((aggregate as { businessBirthInternal?: unknown }).businessBirthInternal === true || isFrameworkAggregate(aggregate))) continue;
       aggregateOwners.set(aggregate.id, [
         ...(aggregateOwners.get(aggregate.id) ?? []),
         domain,
@@ -6786,7 +6793,7 @@ function generateTsClientBody(
   // THE ONE APPLICATION ENTRY. Domain factories remain implementation detail; this package-level opener
   // owns identity, home binding, durable custody, continuous sync, compatibility and recovery. Multi-domain
   // applications are flattened into one business vocabulary and collision-check rather than silently choosing.
-  {
+  if (opts.factoryOnly === undefined) {
     const rootBirths = applicationBirths.filter((birth) =>
       clientDomains.includes(birth.sourceDomain)
     );

package/src/compile_package_main.ts

@@ -264,6 +264,8 @@ import {
 } from "./compatibility_graph.js";
 import { proofLegsIndex } from "./codegen_proof.js";
 import { usdzPack } from "./usdz.js";
+import { compilerReceptionOperations, bundleCompilerReceptionFactory, compressCompilerReceptionTemplate } from "./reception_template.js";
+import { embedReceptionTemplate, appendReceptionDomainOpinion, RECEPTION_CLOSURE_TOKEN } from "./reception_artifact_contract.js";
 import {
   LAW_UNIT_MANIFEST,
   assertLawUnitsCoverPackage,
@@ -2588,8 +2590,8 @@ const NOMOS_TYPES_DEP = "^0.15.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.70.2";
-const NOMOS_FLUTTER_DEP = "^0.68.4";
+const NOMOS_CLIENT_DEP = "^0.70.3";
+const NOMOS_FLUTTER_DEP = "^0.68.5";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -7861,6 +7863,81 @@ async function main(): Promise<void> {
       });
   }
 
+  // RELEASE COHERENCE — typed OSGi Contract Namespace requirements derived from law shape.
+  const kernelContracts = (() => {
+    const probes: KernelContractProbeModule[] = domainModules.map((m) => ({
+      ...(m.queries ? { queries: m.queries } : {}),
+      ...(m.deriveds ? { deriveds: m.deriveds } : {}),
+      ...(m.surfacedResolvers
+        ? { surfacedResolvers: m.surfacedResolvers }
+        : {}),
+      ...(m.aggregates ? { aggregates: m.aggregates } : {}),
+    }));
+    return requiredKernelContracts(probes);
+  })();
+
+  // Compiler-private receiving-group machinery is deliberately not a public facet.
+  for (const [name, graph] of typedLawGraphs) {
+    if (graph.domain.entity.label !== APPLICATION_HOME_DOMAIN) continue;
+    const paths = typedLawPathsByName.get(name)!;
+    const domainPath = paths.get(graph.domain.entity.id)!;
+    const safeDomain = name.replace(/[^A-Za-z0-9._-]/g, "_");
+    const index = v3DomainAssets.findIndex(asset => asset.logicalPath === `domains/${safeDomain}.usda`);
+    const prior = v3DomainAssets[index]!;
+    const text = appendReceptionDomainOpinion(prior.utf8, domainPath, 'custom token nomos:receptionVisibility = "private"');
+    const sha256 = sha256HexUtf8(text);
+    v3DomainAssets[index] = { ...prior, utf8: text, sha256 };
+    typedDomainIdentityByName.set(name, sha256);
+  }
+
+  // Complete compiler-produced Reception metadata belongs to the domain unit.
+  // The realised closure is not known until the target kernel composes its installed
+  // set; its token is bound only by the server generator, outside law identity.
+  for (const module of presentationDomainModules) {
+    const graph = typedLawGraphs.get(module.name);
+    const paths = typedLawPathsByName.get(module.name);
+    if (!graph || !paths) fail(`Reception metadata has no graph for '${module.name}'`);
+    const domain = module.domain ?? module.name;
+    const domainPath = paths.get(graph.domain.entity.id);
+    if (!domainPath) fail(`Reception metadata has no stable domain path for '${domain}'`);
+    const selectedGraphs = new Map([[module.name, graph]]);
+    const selectedPaths = new Map([[module.name, paths]]);
+    const schema = operationProtoSchema([module], selectedGraphs, selectedPaths);
+    const scratch = path.join(outDir, ".reception-metadata", sha256HexUtf8(domain));
+    mkdirSync(scratch, { recursive: true });
+    const protoPath = path.join(scratch, schema.fileName);
+    writeFileSync(protoPath, schema.source, "utf8");
+    try {
+      execFileSync("protoc", tsProtocArgs(scratch, protoPath, protocGenEs()), { stdio: "pipe" });
+      const binding = readFileSync(path.join(scratch, "operation_payloads_pb.ts"), "utf8");
+      const source = generateTsClient([module], {
+        packageName: module.name, domainHash: RECEPTION_CLOSURE_TOKEN,
+        interface: { [domain]: packageInterface[domain]! }, kernelContracts,
+        homeDomain: domain, exportHolonFactory: true, callUsda: [{ graph, paths }],
+        factoryOnly: { composition: presentationDomainModules },
+      });
+      const factorySource = await bundleCompilerReceptionFactory({ factory: tsClientFactoryName(domain), clientSource: source, operationBinding: binding });
+      const template = {
+        factorySource, factorySha256: sha256HexUtf8(factorySource),
+        domain, factory: tsClientFactoryName(domain), clientSource: source,
+        operations: compilerReceptionOperations(module, graph),
+        operationBinding: binding, operationProto: schema.source,
+        sourceSha256: sha256HexUtf8(source), bindingSha256: sha256HexUtf8(binding), protoSha256: sha256HexUtf8(schema.source),
+      };
+      const safeDomain = module.name.replace(/[^A-Za-z0-9._-]/g, "_");
+      const index = v3DomainAssets.findIndex(asset => asset.logicalPath === `domains/${safeDomain}.usda`);
+      if (index < 0) fail(`Reception metadata cannot locate domain layer '${module.name}'`);
+      const prior = v3DomainAssets[index]!;
+      const text = embedReceptionTemplate(prior.utf8, domainPath, compressCompilerReceptionTemplate(template));
+      const sha256 = sha256HexUtf8(text);
+      v3DomainAssets[index] = { ...prior, utf8: text, sha256 };
+      typedDomainIdentityByName.set(module.name, sha256);
+    } finally {
+      rmSync(scratch, { recursive: true, force: true });
+    }
+  }
+  rmSync(path.join(outDir, ".reception-metadata"), { recursive: true, force: true });
+
   stage("boot probe (started)");
   // ── 2. Canonical typed USDA closure ──
   // There is no flattened package and no JSON law intermediate. Sparse typed source opinions plus
@@ -8254,18 +8331,7 @@ async function main(): Promise<void> {
       return "unknown";
     }
   })();
-  // RELEASE COHERENCE — typed OSGi Contract Namespace requirements derived from law shape.
-  const kernelContracts = (() => {
-    const probes: KernelContractProbeModule[] = domainModules.map((m) => ({
-      ...(m.queries ? { queries: m.queries } : {}),
-      ...(m.deriveds ? { deriveds: m.deriveds } : {}),
-      ...(m.surfacedResolvers
-        ? { surfacedResolvers: m.surfacedResolvers }
-        : {}),
-      ...(m.aggregates ? { aggregates: m.aggregates } : {}),
-    }));
-    return requiredKernelContracts(probes);
-  })();
+
 
   // ── 3b. NO OPENAPI SIDECAR. OpenAPI remains the sanctioned standard for describing this package's
   // API — but it is SERVED, not stored: the kernel derives it from the installed typed USDA IR

package/src/protocol/nomos/kernel/v1/openusd_cache_pb.d.ts

@@ -0,0 +1,240 @@
+// @generated by protoc-gen-es v2.13.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file nomos/kernel/v1/openusd_cache.proto (package nomos.kernel.cache.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file nomos/kernel/v1/openusd_cache.proto.
+ */
+export declare const file_nomos_kernel_v1_openusd_cache: GenFile;
+
+/**
+ * Existing parsed OpenUSD law-product frame version 1, encoded by
+ * projection/src/law_cache.rs. This exposes its generic transport layout;
+ * it adds no kernel request, authority, business schema or execution path.
+ *
+ * @generated from message nomos.kernel.cache.v1.CachedOpenUsdLayer
+ */
+export declare type CachedOpenUsdLayer = Message<"nomos.kernel.cache.v1.CachedOpenUsdLayer"> & {
+  /**
+   * @generated from field: uint32 format_version = 1;
+   */
+  formatVersion: number;
+
+  /**
+   * @generated from field: string package_identity = 2;
+   */
+  packageIdentity: string;
+
+  /**
+   * @generated from field: repeated nomos.kernel.cache.v1.CachedPrim prims = 3;
+   */
+  prims: CachedPrim[];
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedOpenUsdLayer.
+ * Use `create(CachedOpenUsdLayerSchema)` to create a new message.
+ */
+export declare const CachedOpenUsdLayerSchema: GenMessage<CachedOpenUsdLayer>;
+
+/**
+ * @generated from message nomos.kernel.cache.v1.CachedPrim
+ */
+export declare type CachedPrim = Message<"nomos.kernel.cache.v1.CachedPrim"> & {
+  /**
+   * @generated from field: string path = 1;
+   */
+  path: string;
+
+  /**
+   * @generated from field: optional string type_name = 2;
+   */
+  typeName?: string | undefined;
+
+  /**
+   * @generated from field: repeated nomos.kernel.cache.v1.CachedProperty properties = 3;
+   */
+  properties: CachedProperty[];
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedPrim.
+ * Use `create(CachedPrimSchema)` to create a new message.
+ */
+export declare const CachedPrimSchema: GenMessage<CachedPrim>;
+
+/**
+ * @generated from message nomos.kernel.cache.v1.CachedProperty
+ */
+export declare type CachedProperty = Message<"nomos.kernel.cache.v1.CachedProperty"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string declared_type = 2;
+   */
+  declaredType: string;
+
+  /**
+   * @generated from field: nomos.kernel.cache.v1.CachedValue value = 3;
+   */
+  value?: CachedValue | undefined;
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedProperty.
+ * Use `create(CachedPropertySchema)` to create a new message.
+ */
+export declare const CachedPropertySchema: GenMessage<CachedProperty>;
+
+/**
+ * @generated from message nomos.kernel.cache.v1.CachedValue
+ */
+export declare type CachedValue = Message<"nomos.kernel.cache.v1.CachedValue"> & {
+  /**
+   * @generated from oneof nomos.kernel.cache.v1.CachedValue.kind
+   */
+  kind: {
+    /**
+     * @generated from field: bool bool = 1;
+     */
+    value: boolean;
+    case: "bool";
+  } | {
+    /**
+     * @generated from field: nomos.kernel.cache.v1.CachedBoolArray bool_array = 2;
+     */
+    value: CachedBoolArray;
+    case: "boolArray";
+  } | {
+    /**
+     * @generated from field: sint64 int = 3;
+     */
+    value: bigint;
+    case: "int";
+  } | {
+    /**
+     * @generated from field: fixed64 uint = 4;
+     */
+    value: bigint;
+    case: "uint";
+  } | {
+    /**
+     * @generated from field: double double = 5;
+     */
+    value: number;
+    case: "double";
+  } | {
+    /**
+     * @generated from field: string string = 6;
+     */
+    value: string;
+    case: "string";
+  } | {
+    /**
+     * @generated from field: string token = 7;
+     */
+    value: string;
+    case: "token";
+  } | {
+    /**
+     * @generated from field: nomos.kernel.cache.v1.CachedStringArray string_array = 8;
+     */
+    value: CachedStringArray;
+    case: "stringArray";
+  } | {
+    /**
+     * @generated from field: nomos.kernel.cache.v1.CachedTokenArray token_array = 9;
+     */
+    value: CachedTokenArray;
+    case: "tokenArray";
+  } | {
+    /**
+     * @generated from field: string asset = 10;
+     */
+    value: string;
+    case: "asset";
+  } | {
+    /**
+     * @generated from field: nomos.kernel.cache.v1.CachedRelationship relationship = 11;
+     */
+    value: CachedRelationship;
+    case: "relationship";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedValue.
+ * Use `create(CachedValueSchema)` to create a new message.
+ */
+export declare const CachedValueSchema: GenMessage<CachedValue>;
+
+/**
+ * @generated from message nomos.kernel.cache.v1.CachedBoolArray
+ */
+export declare type CachedBoolArray = Message<"nomos.kernel.cache.v1.CachedBoolArray"> & {
+  /**
+   * @generated from field: repeated bool values = 1 [packed = true];
+   */
+  values: boolean[];
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedBoolArray.
+ * Use `create(CachedBoolArraySchema)` to create a new message.
+ */
+export declare const CachedBoolArraySchema: GenMessage<CachedBoolArray>;
+
+/**
+ * @generated from message nomos.kernel.cache.v1.CachedStringArray
+ */
+export declare type CachedStringArray = Message<"nomos.kernel.cache.v1.CachedStringArray"> & {
+  /**
+   * @generated from field: repeated string values = 1;
+   */
+  values: string[];
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedStringArray.
+ * Use `create(CachedStringArraySchema)` to create a new message.
+ */
+export declare const CachedStringArraySchema: GenMessage<CachedStringArray>;
+
+/**
+ * @generated from message nomos.kernel.cache.v1.CachedTokenArray
+ */
+export declare type CachedTokenArray = Message<"nomos.kernel.cache.v1.CachedTokenArray"> & {
+  /**
+   * @generated from field: repeated string values = 1;
+   */
+  values: string[];
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedTokenArray.
+ * Use `create(CachedTokenArraySchema)` to create a new message.
+ */
+export declare const CachedTokenArraySchema: GenMessage<CachedTokenArray>;
+
+/**
+ * @generated from message nomos.kernel.cache.v1.CachedRelationship
+ */
+export declare type CachedRelationship = Message<"nomos.kernel.cache.v1.CachedRelationship"> & {
+  /**
+   * @generated from field: repeated string targets = 1;
+   */
+  targets: string[];
+};
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedRelationship.
+ * Use `create(CachedRelationshipSchema)` to create a new message.
+ */
+export declare const CachedRelationshipSchema: GenMessage<CachedRelationship>;
+

package/src/protocol/nomos/kernel/v1/openusd_cache_pb.js

@@ -0,0 +1,68 @@
+// @generated by protoc-gen-es v2.13.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file nomos/kernel/v1/openusd_cache.proto (package nomos.kernel.cache.v1, syntax proto3)
+/* eslint-disable */
+
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+
+/**
+ * Describes the file nomos/kernel/v1/openusd_cache.proto.
+ */
+export const file_nomos_kernel_v1_openusd_cache = /*@__PURE__*/
+  fileDesc("CiNub21vcy9rZXJuZWwvdjEvb3BlbnVzZF9jYWNoZS5wcm90bxIVbm9tb3Mua2VybmVsLmNhY2hlLnYxIngKEkNhY2hlZE9wZW5Vc2RMYXllchIWCg5mb3JtYXRfdmVyc2lvbhgBIAEoDRIYChBwYWNrYWdlX2lkZW50aXR5GAIgASgJEjAKBXByaW1zGAMgAygLMiEubm9tb3Mua2VybmVsLmNhY2hlLnYxLkNhY2hlZFByaW0iewoKQ2FjaGVkUHJpbRIMCgRwYXRoGAEgASgJEhYKCXR5cGVfbmFtZRgCIAEoCUgAiAEBEjkKCnByb3BlcnRpZXMYAyADKAsyJS5ub21vcy5rZXJuZWwuY2FjaGUudjEuQ2FjaGVkUHJvcGVydHlCDAoKX3R5cGVfbmFtZSJoCg5DYWNoZWRQcm9wZXJ0eRIMCgRuYW1lGAEgASgJEhUKDWRlY2xhcmVkX3R5cGUYAiABKAkSMQoFdmFsdWUYAyABKAsyIi5ub21vcy5rZXJuZWwuY2FjaGUudjEuQ2FjaGVkVmFsdWUijQMKC0NhY2hlZFZhbHVlEg4KBGJvb2wYASABKAhIABI8Cgpib29sX2FycmF5GAIgASgLMiYubm9tb3Mua2VybmVsLmNhY2hlLnYxLkNhY2hlZEJvb2xBcnJheUgAEg0KA2ludBgDIAEoEkgAEg4KBHVpbnQYBCABKAZIABIQCgZkb3VibGUYBSABKAFIABIQCgZzdHJpbmcYBiABKAlIABIPCgV0b2tlbhgHIAEoCUgAEkAKDHN0cmluZ19hcnJheRgIIAEoCzIoLm5vbW9zLmtlcm5lbC5jYWNoZS52MS5DYWNoZWRTdHJpbmdBcnJheUgAEj4KC3Rva2VuX2FycmF5GAkgASgLMicubm9tb3Mua2VybmVsLmNhY2hlLnYxLkNhY2hlZFRva2VuQXJyYXlIABIPCgVhc3NldBgKIAEoCUgAEkEKDHJlbGF0aW9uc2hpcBgLIAEoCzIpLm5vbW9zLmtlcm5lbC5jYWNoZS52MS5DYWNoZWRSZWxhdGlvbnNoaXBIAEIGCgRraW5kIiUKD0NhY2hlZEJvb2xBcnJheRISCgZ2YWx1ZXMYASADKAhCAhABIiMKEUNhY2hlZFN0cmluZ0FycmF5Eg4KBnZhbHVlcxgBIAMoCSIiChBDYWNoZWRUb2tlbkFycmF5Eg4KBnZhbHVlcxgBIAMoCSIlChJDYWNoZWRSZWxhdGlvbnNoaXASDwoHdGFyZ2V0cxgBIAMoCWIGcHJvdG8z");
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedOpenUsdLayer.
+ * Use `create(CachedOpenUsdLayerSchema)` to create a new message.
+ */
+export const CachedOpenUsdLayerSchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 0);
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedPrim.
+ * Use `create(CachedPrimSchema)` to create a new message.
+ */
+export const CachedPrimSchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 1);
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedProperty.
+ * Use `create(CachedPropertySchema)` to create a new message.
+ */
+export const CachedPropertySchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 2);
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedValue.
+ * Use `create(CachedValueSchema)` to create a new message.
+ */
+export const CachedValueSchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 3);
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedBoolArray.
+ * Use `create(CachedBoolArraySchema)` to create a new message.
+ */
+export const CachedBoolArraySchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 4);
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedStringArray.
+ * Use `create(CachedStringArraySchema)` to create a new message.
+ */
+export const CachedStringArraySchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 5);
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedTokenArray.
+ * Use `create(CachedTokenArraySchema)` to create a new message.
+ */
+export const CachedTokenArraySchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 6);
+
+/**
+ * Describes the message nomos.kernel.cache.v1.CachedRelationship.
+ * Use `create(CachedRelationshipSchema)` to create a new message.
+ */
+export const CachedRelationshipSchema = /*@__PURE__*/
+  messageDesc(file_nomos_kernel_v1_openusd_cache, 7);
+

package/src/reception_artifact.ts

@@ -0,0 +1,66 @@
+/** Pure hosted generation from authenticated compiled USD metadata. The compiler
+ * already bundled each facet. This assembler neither transforms TypeScript nor
+ * executes tenant code, business plans, network access or a kernel. */
+import {
+  artifactIdentity, receptionSha256, validateReceptionGenerationInput, verifyReceptionArtifact,
+  RECEPTION_CLOSURE_TOKEN,
+  type ClosureReceptionArtifact, type ReceptionGenerationInput,
+} from "./reception_artifact_contract.js";
+export * from "./reception_artifact_contract.js";
+
+export async function generateReceptionArtifact(input: ReceptionGenerationInput): Promise<ClosureReceptionArtifact> {
+  const templates = await validateReceptionGenerationInput(input);
+  const artifactId = await artifactIdentity(input.closure, input.generator, input.runtimeContract);
+  const inventory = templates.map(({ domain, factory, factorySha256, operations }) => ({ domain, factory, sourceSha256: factorySha256, operations }));
+  const entry = [
+    'import { WorkerEntrypoint } from "cloudflare:workers";',
+    ...templates.map((template, index) => `const factory${index} = (() => { ${template.factorySource.replaceAll(JSON.stringify(RECEPTION_CLOSURE_TOKEN), JSON.stringify(input.closure))} return __NOMOS_RECEPTION_FACET__.${template.factory}; })();`),
+    `const domains = Object.freeze(Object.assign(Object.create(null), { ${templates.map((template, index) => `${JSON.stringify(template.domain)}: factory${index}`).join(", ")} }));`,
+    `const description = ${JSON.stringify({ artifactId, closure: input.closure, generator: input.generator, runtimeContract: input.runtimeContract, domains: inventory })};`,
+    `function serialiseResult(value, depth = 0, seen = new Set()) {`,
+    `  const unavailable = () => { const error = new Error("Generated result cannot cross the hosted JSON contract"); error.code = "nomos.reception.result.unavailable"; throw error; };`,
+    `  if (depth > 64) return unavailable();`,
+    `  if (value === undefined) return { $nomos: "absent" };`,
+    `  if (value === null || typeof value === "string" || typeof value === "boolean") return value;`,
+    `  if (typeof value === "number") { if (!Number.isFinite(value)) return unavailable(); return value; }`,
+    `  if (typeof value === "bigint") return { $nomos: "integer", decimal: value.toString() };`,
+    `  if (value instanceof Uint8Array) { let binary = ""; for (const byte of value) binary += String.fromCharCode(byte); return { $nomos: "bytes", base64: btoa(binary) }; }`,
+    `  if (value instanceof Date) { if (!Number.isFinite(value.getTime())) return unavailable(); return { $nomos: "timestamp", iso: value.toISOString() }; }`,
+    `  if (typeof value !== "object" || seen.has(value)) return unavailable();`,
+    `  seen.add(value); try {`,
+    `    if (Array.isArray(value)) return value.map(item => serialiseResult(item, depth + 1, seen));`,
+    `    const prototype = Object.getPrototypeOf(value); if (prototype !== Object.prototype && prototype !== null) return unavailable();`,
+    `    const output = {}; for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) { if (descriptor.get || descriptor.set) return unavailable(); Object.defineProperty(output, key, { value: serialiseResult(descriptor.value, depth + 1, seen), enumerable: true }); } return output;`,
+    `  } finally { seen.delete(value); }`,
+    `}`,
+    `export default class Reception extends WorkerEntrypoint {`,
+    `  describe() { return description; }`,
+    `  async invoke(call, office) {`,
+    `    if (!call || typeof call.domain !== "string" || typeof call.member !== "string" || !Array.isArray(call.args)) throw new Error("invalid Reception invocation");`,
+    `    if (call.member === "constructor" || call.member.startsWith("__") || call.member.startsWith("watch")) throw new Error("unsupported hosted Reception member");`,
+    `    if (!Object.hasOwn(domains, call.domain)) throw new Error("Reception domain is absent from this closure");`,
+    `    if (typeof call.workspace !== "string" || !call.workspace || typeof call.principal !== "string" || !call.principal) throw new Error("Reception requires request scoped workspace and principal");`,
+    `    const scoped = { workspace: call.workspace, principal: call.principal, offerCall: (...args) => office.offerCall(...args),`,
+    `      __nomosQuery: (...args) => office.__nomosQuery(...args), __nomosQueryUsda: (...args) => office.__nomosQueryUsda(...args),`,
+    `      __nomosQueryByIdUsda: (...args) => office.__nomosQueryByIdUsda(...args), __nomosQueryByTypeUsda: (...args) => office.__nomosQueryByTypeUsda(...args),`,
+    `      __nomosQueryPage: (...args) => office.__nomosQueryPage(...args), __nomosQueryPageUsda: (...args) => office.__nomosQueryPageUsda(...args) };`,
+    `    const selected = description.domains.find(domain => domain.domain === call.domain)?.operations.find(operation => operation.member === call.member);`,
+    `    if (!selected) throw new Error("Reception member is not declared for stateless hosting");`,
+    `    const client = domains[call.domain](scoped);`,
+    `    const path = call.member.split("."); let parent = client;`,
+    `    for (const part of path.slice(0, -1)) { if (!part || part.startsWith("__") || part === "constructor" || !Object.hasOwn(parent, part)) throw new Error("Reception business member is absent from this closure"); parent = parent[part]; if (!parent || typeof parent !== "object") throw new Error("Reception business member is absent from this closure"); }`,
+    `    const member = path.at(-1); if (!member || member.startsWith("watch") || member.startsWith("__") || member === "constructor" || !Object.hasOwn(parent, member) || typeof parent[member] !== "function") throw new Error("Reception business member is absent from this closure");`,
+    `    const args = [...call.args];`,
+    `    if (selected.kind === "byId" && typeof args[0] === "string" && typeof parent.fromAddress === "function") args[0] = parent.fromAddress(args[0]);`,
+    `    return serialiseResult(await parent[member](...args));`,
+    `  }`,
+    `}`,
+  ].join("\n");
+  const moduleSource = entry + "\n";
+  const artifact: ClosureReceptionArtifact = { manifest: {
+    format: "nomos.reception-artifact.v1", artifactId, closure: input.closure, generator: input.generator,
+    runtimeContract: input.runtimeContract, entrypoint: "reception.mjs", moduleSha256: await receptionSha256(moduleSource), domains: inventory,
+  }, moduleSource };
+  await verifyReceptionArtifact(artifact, input);
+  return artifact;
+}

package/src/reception_artifact_contract.ts

@@ -0,0 +1,258 @@
+/** Derived Reception identity is independent of admitted law and request authority. */
+import { usdaString, usdaUnquote } from "./usda_text.js";
+
+export const RECEPTION_GENERATOR = "nomos-typescript-reception-v1";
+export const RECEPTION_RUNTIME_CONTRACT = "nomos-peer-office-reception-v1";
+export const RECEPTION_TEMPLATE_FORMAT = "nomos.reception-template.v1";
+export const RECEPTION_COMPRESSED_TEMPLATE_FORMAT = "nomos.reception-template.v2";
+export const RECEPTION_SOURCE_BYTES_LIMIT = 16 * 1024 * 1024;
+export const RECEPTION_CLOSURE_TOKEN = "__NOMOS_REALISED_CLOSURE_V1__";
+export interface ReceptionGenerationInput {
+  readonly closure: string;
+  readonly generator: string;
+  readonly runtimeContract: string;
+  readonly semanticLayer: string | Uint8Array;
+  readonly domains?: readonly string[];
+}
+export interface ReceptionOperation {
+  readonly member: string;
+  readonly kind: "offer" | "query" | "byType" | "byId";
+  readonly selector: string;
+}
+export interface ReceptionTemplate {
+  /** Compiler-only deterministic envelope; decoded sources keep their exact digests. */
+  readonly sourceEnvelope?: { readonly gzipBase64: string; readonly decodedBytes: number };
+  readonly factorySource: string;
+  readonly factorySha256: string;
+  readonly operations: readonly ReceptionOperation[];
+  readonly domain: string;
+  readonly factory: string;
+  readonly clientSource: string;
+  readonly operationBinding: string;
+  readonly operationProto: string;
+  readonly sourceSha256: string;
+  readonly bindingSha256: string;
+  readonly protoSha256: string;
+}
+export interface ReceptionArtifactManifest {
+  readonly format: "nomos.reception-artifact.v1";
+  readonly artifactId: string;
+  readonly closure: string;
+  readonly generator: string;
+  readonly runtimeContract: string;
+  readonly entrypoint: "reception.mjs";
+  readonly moduleSha256: string;
+  readonly domains: readonly { readonly domain: string; readonly factory: string; readonly sourceSha256: string; readonly operations: readonly ReceptionOperation[] }[];
+}
+export interface ClosureReceptionArtifact {
+  readonly manifest: ReceptionArtifactManifest;
+  readonly moduleSource: string;
+}
+const HEX = /^[0-9a-f]{64}$/;
+export async function receptionSha256(value: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return Array.from(new Uint8Array(digest), x => x.toString(16).padStart(2, "0")).join("");
+}
+export async function artifactIdentity(closure: string, generator: string, runtimeContract: string): Promise<string> {
+  if (!HEX.test(closure) || generator !== RECEPTION_GENERATOR || runtimeContract !== RECEPTION_RUNTIME_CONTRACT)
+    throw new Error("Reception generation requires a realised closure and supported generator/runtime contract");
+  return receptionSha256(JSON.stringify(["nomos.reception-artifact.v1", closure, generator, runtimeContract]));
+}
+const base64 = (value: string): string => {
+  const bytes = new TextEncoder().encode(value);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+};
+const unbase64Bytes = (value: string): Uint8Array<ArrayBuffer> => {
+  const binary = atob(value);
+  if (btoa(binary) !== value) throw new Error("Reception metadata has noncanonical base64");
+  return Uint8Array.from(binary, c => c.charCodeAt(0));
+};
+const unbase64 = (value: string): string => new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(unbase64Bytes(value));
+async function receptionSources(gzipBase64: string, declaredBytes: string): Promise<readonly [string, string, string, string]> {
+  const length = Number(declaredBytes);
+  if (!/^[1-9][0-9]*$/.test(declaredBytes) || !Number.isSafeInteger(length) || length > RECEPTION_SOURCE_BYTES_LIMIT)
+    throw new Error("Reception metadata has an invalid decoded source length");
+  const reader = new Blob([unbase64Bytes(gzipBase64)]).stream().pipeThrough(new DecompressionStream("gzip")).getReader();
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      if (chunk.value.byteLength > length - offset) throw new Error("Reception metadata exceeds its decoded source length");
+      bytes.set(chunk.value, offset); offset += chunk.value.byteLength;
+    }
+  } finally { await reader.cancel().catch(() => {}); }
+  if (offset !== length) throw new Error("Reception metadata has an incomplete decoded source envelope");
+  const sources: unknown = JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(bytes));
+  if (!Array.isArray(sources) || sources.length !== 4 || sources.some(value => typeof value !== "string" || !value))
+    throw new Error("Reception metadata has an incomplete source envelope");
+  return sources as [string, string, string, string];
+}
+/** Compiler metadata is composed under the domain's stable USD path. Source is
+ * quoted as base64 so OpenUSD flattening cannot change escaping or whitespace. */
+export function receptionTemplateUsda(domainPath: string, template: ReceptionTemplate): string {
+  if (!/^\/Nomos\/Domains\/d_[0-9a-f]{16}$/.test(domainPath)) throw new Error("invalid Reception domain path");
+  const fields = {
+    format: template.sourceEnvelope ? RECEPTION_COMPRESSED_TEMPLATE_FORMAT : RECEPTION_TEMPLATE_FORMAT,
+    domain: template.domain, factory: template.factory,
+    ...(template.sourceEnvelope ? {
+      sourcesGzipBase64: template.sourceEnvelope.gzipBase64, sourcesDecodedBytes: String(template.sourceEnvelope.decodedBytes),
+    } : {
+      factorySourceBase64: base64(template.factorySource), clientSourceBase64: base64(template.clientSource),
+      operationBindingBase64: base64(template.operationBinding), operationProtoBase64: base64(template.operationProto),
+    }),
+    factorySha256: template.factorySha256, sourceSha256: template.sourceSha256,
+    bindingSha256: template.bindingSha256, protoSha256: template.protoSha256,
+  };
+  return ['over "Nomos"', '{', '    over "Domains"', '    {', `        over "${domainPath.split("/").at(-1)}"`, '        {',
+    '            def NomosReceptionTemplate "Reception"', '            {',
+    ...Object.entries(fields).map(([key, value]) => `                custom string nomos:${key} = ${usdaString(value)}`),
+    `                custom string[] nomos:members = [${template.operations.map(x => usdaString(x.member)).join(", ")}]`,
+    `                custom token[] nomos:operationKinds = [${template.operations.map(x => usdaString(x.kind)).join(", ")}]`,
+    `                custom string[] nomos:selectors = [${template.operations.map(x => usdaString(x.selector)).join(", ")}]`,
+    '            }', '        }', '    }', '}', ''].join("\n");
+}
+/** Add an opinion inside the existing prim. Repeating a top-level over in one
+ * layer replaces its earlier spec in OpenUSD; metadata must never erase law. */
+export function appendReceptionDomainOpinion(layer: string, domainPath: string, body: string): string {
+  const frames: string[] = [];
+  let pending: string | undefined;
+  let inserted = false;
+  const output: string[] = [];
+  for (const raw of layer.split("\n")) {
+    const line = raw.trim();
+    const prim = /^(?:def|over|class)\s+(?:\w+\s+)?"([^"\\]+)"(?:\s*\()?\s*$/.exec(line);
+    if (prim) pending = prim[1]!;
+    if (line.endsWith("= {")) frames.push("#dictionary");
+    else if (line === "{") { frames.push(pending ?? "#dictionary"); pending = undefined; }
+    else if (line === "}") {
+      if (`/${frames.join("/")}` === domainPath) {
+        if (inserted) throw new Error("duplicate Reception domain prim");
+        const indentation = raw.slice(0, raw.indexOf("}")) + "    ";
+        output.push(...body.trimEnd().split("\n").map(value => indentation + value));
+        inserted = true;
+      }
+      frames.pop();
+    }
+    output.push(raw);
+  }
+  if (!inserted) throw new Error(`Reception metadata cannot find domain prim ${domainPath}`);
+  return output.join("\n");
+}
+export function embedReceptionTemplate(layer: string, domainPath: string, template: ReceptionTemplate): string {
+  const fragment = receptionTemplateUsda(domainPath, template).split("\n").slice(6, -4).map(line => line.slice(12)).join("\n");
+  return appendReceptionDomainOpinion(layer, domainPath, fragment);
+}
+
+/** Parses only compiler metadata; never evaluates any tenant code. Every domain
+ * selected by the exact semantic product must carry one complete template. */
+export async function validateReceptionGenerationInput(input: ReceptionGenerationInput): Promise<readonly ReceptionTemplate[]> {
+  await artifactIdentity(input.closure, input.generator, input.runtimeContract);
+  const templates: ReceptionTemplate[] = [];
+  const lawDomains = new Map<string, { label?: string; visibility?: string }>();
+  const frames: string[] = [];
+  let pending: { name: string; type: string } | undefined;
+  let fields: Record<string, string> | undefined;
+  let templatePath: string | undefined;
+  let arrays: Record<string, string[]> = {};
+  let dictionaryDepth = 0;
+  // Compiler startup precedes protocol generation during a clean Prepare install.
+  // Only consumers of the realised binary product need the generated cache decoder.
+  const semanticLayer = typeof input.semanticLayer === "string" ? input.semanticLayer
+    : (await import("./reception_cache.js")).receptionMetadataFromLawProduct(input.semanticLayer, input.closure);
+  // Preflight the entire closure before allocating any decompressed source. A
+  // small compressed input must not allow many individually bounded envelopes
+  // to exhaust the generator isolate. Legacy base64 is bounded by its encoded
+  // size as well, before it is decoded.
+  let sourceBytes = 0;
+  for (const match of semanticLayer.matchAll(/^\s*(?:custom\s+)?(?:uniform\s+)?string\s+nomos:(sourcesDecodedBytes|factorySourceBase64|clientSourceBase64|operationBindingBase64|operationProtoBase64)\s*=\s*("(?:[^"\\]|\\.)*")\s*$/gm)) {
+    const value = usdaUnquote(match[2]!);
+    const bytes = match[1] === "sourcesDecodedBytes" ? Number(value) : Math.ceil(value.length * 3 / 4);
+    if ((match[1] === "sourcesDecodedBytes" && !/^[1-9][0-9]*$/.test(value)) || !Number.isSafeInteger(bytes) || bytes > RECEPTION_SOURCE_BYTES_LIMIT - sourceBytes)
+      throw new Error("Reception metadata exceeds the closure decoded source budget");
+    sourceBytes += bytes;
+  }
+  for (const raw of semanticLayer.split("\n")) {
+    const line = raw.trim();
+    if (line.endsWith("= {")) { dictionaryDepth += 1; continue; }
+    if (dictionaryDepth > 0) { if (line === "}") dictionaryDepth -= 1; continue; }
+    const prim = /^(?:def|over)\s+(?:(\w+)\s+)?"([^"\\]+)"(?:\s*\()?\s*$/.exec(line);
+    if (prim) { pending = { name: prim[2]!, type: prim[1] ?? "" }; continue; }
+    if (line === "{") {
+      if (!pending) continue;
+      frames.push(pending.name);
+      const path = `/${frames.join("/")}`;
+      if (/^\/Nomos\/Domains\/d_[0-9a-f]{16}$/.test(path) && !lawDomains.has(path)) lawDomains.set(path, {});
+      if (pending.type === "NomosReceptionTemplate") {
+        if (!/^\/Nomos\/Domains\/d_[0-9a-f]{16}\/Reception$/.test(path)) throw new Error("Reception metadata is outside its domain");
+        fields = {}; arrays = {}; templatePath = path;
+      }
+      pending = undefined; continue;
+    }
+    if (line === "}") {
+      if (fields && `/${frames.join("/")}` === templatePath) {
+        const required = (name: string): string => { const value = fields![name]; if (!value) throw new Error(`Reception metadata missing ${name}`); return value; };
+        const format = required("format");
+        if (format !== RECEPTION_TEMPLATE_FORMAT && format !== RECEPTION_COMPRESSED_TEMPLATE_FORMAT) throw new Error("unsupported Reception metadata format");
+        if (!arrays.members || !arrays.operationKinds || !arrays.selectors || arrays.members.length !== arrays.operationKinds.length || arrays.members.length !== arrays.selectors.length) throw new Error("Reception metadata has no complete operation inventory");
+        const operations = arrays.members.map((member, index) => ({ member, kind: arrays.operationKinds![index] as ReceptionOperation["kind"], selector: arrays.selectors![index]! }));
+        if (new Set(operations.map(x => x.member)).size !== operations.length || operations.some(x => !x.member || !x.selector || !["offer", "query", "byType", "byId"].includes(x.kind))) throw new Error("invalid Reception operation inventory");
+        const [factorySource, clientSource, operationBinding, operationProto] = format === RECEPTION_COMPRESSED_TEMPLATE_FORMAT
+          ? await receptionSources(required("sourcesGzipBase64"), required("sourcesDecodedBytes"))
+          : [unbase64(required("factorySourceBase64")), unbase64(required("clientSourceBase64")), unbase64(required("operationBindingBase64")), unbase64(required("operationProtoBase64"))];
+        templates.push({ operations, factorySource: factorySource!, factorySha256: required("factorySha256"), domain: required("domain"), factory: required("factory"), clientSource: clientSource!,
+          operationBinding: operationBinding!, operationProto: operationProto!,
+          sourceSha256: required("sourceSha256"), bindingSha256: required("bindingSha256"), protoSha256: required("protoSha256") });
+        fields = undefined; templatePath = undefined;
+      }
+      frames.pop(); continue;
+    }
+    const domain = lawDomains.get(`/${frames.join("/")}`);
+    if (domain) {
+      const declaration = /^(?:custom\s+)?(?:uniform\s+)?(?:string|token)\s+nomos:(label|receptionVisibility)\s*=\s*("(?:[^"\\]|\\.)*")$/.exec(line);
+      if (declaration) { const key = declaration[1] === "label" ? "label" : "visibility"; domain[key] = usdaUnquote(declaration[2]!); }
+    }
+    if (fields) {
+      const array = /^(?:custom\s+)?(?:uniform\s+)?(?:string|token)\[\]\s+nomos:(members|operationKinds|selectors)\s*=\s*\[(.*)\]$/.exec(line);
+      if (array) { arrays[array[1]!] = Array.from(array[2]!.matchAll(/"(?:[^"\\]|\\.)*"/g), x => usdaUnquote(x[0])); continue; }
+      const attribute = /^(?:custom\s+)?(?:uniform\s+)?string\s+nomos:(\w+)\s*=\s*("(?:[^"\\]|\\.)*")$/.exec(line);
+      if (attribute) { if (fields[attribute[1]!] !== undefined) throw new Error("duplicate Reception metadata field"); fields[attribute[1]!] = usdaUnquote(attribute[2]!); }
+    }
+  }
+  if (templates.length === 0) throw new Error("realised law carries no compiler Reception metadata; recompile with a supported compiler");
+  const domains = new Set<string>();
+  for (const template of templates) {
+    if (domains.has(template.domain)) throw new Error(`duplicate Reception domain ${template.domain}`);
+    domains.add(template.domain);
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(template.factory)) throw new Error("invalid Reception factory");
+    for (const [source, digest] of [[template.factorySource, template.factorySha256], [template.clientSource, template.sourceSha256], [template.operationBinding, template.bindingSha256], [template.operationProto, template.protoSha256]]) {
+      if (!HEX.test(digest!) || await receptionSha256(source!) !== digest) throw new Error("Reception compiler metadata digest mismatch");
+    }
+    if (!template.clientSource.includes(JSON.stringify(RECEPTION_CLOSURE_TOKEN)) || !template.factorySource.includes(JSON.stringify(RECEPTION_CLOSURE_TOKEN))) throw new Error("Reception source has no closure identity binding");
+  }
+  for (const domain of lawDomains.values()) {
+    if (domain.visibility === "private") continue;
+    if (!domain.label || !domains.has(domain.label)) throw new Error(`realised law domain ${domain.label ?? "without label"} carries no Reception metadata`);
+  }
+  // An optional authoritative caller inventory adds an exact domain set check.
+  const declaredPrivate = new Set([...lawDomains.values()].filter(x => x.visibility === "private").map(x => x.label));
+  const expectedDomains = input.domains?.filter(domain => !declaredPrivate.has(domain));
+  if (expectedDomains && (expectedDomains.length !== domains.size || expectedDomains.some(domain => !domains.has(domain))))
+    throw new Error("realised law Reception domain inventory is incomplete");
+  return templates.sort((a, b) => a.domain < b.domain ? -1 : a.domain > b.domain ? 1 : 0);
+}
+export async function verifyReceptionArtifact(artifact: ClosureReceptionArtifact, expected?: { closure: string; generator: string; runtimeContract: string }): Promise<void> {
+  const manifest = artifact.manifest;
+  if (!manifest || manifest.format !== "nomos.reception-artifact.v1" || manifest.entrypoint !== "reception.mjs" || typeof artifact.moduleSource !== "string") throw new Error("invalid Reception artifact");
+  if (expected && (manifest.closure !== expected.closure || manifest.generator !== expected.generator || manifest.runtimeContract !== expected.runtimeContract)) throw new Error("Reception artifact provenance mismatch");
+  if (manifest.artifactId !== await artifactIdentity(manifest.closure, manifest.generator, manifest.runtimeContract) || manifest.moduleSha256 !== await receptionSha256(artifact.moduleSource)) throw new Error("Reception artifact digest mismatch");
+  if (!Array.isArray(manifest.domains) || manifest.domains.length === 0 || new Set(manifest.domains.map(x => x.domain)).size !== manifest.domains.length) throw new Error("invalid Reception artifact domain inventory");
+  for (const domain of manifest.domains) {
+    if (typeof domain.domain !== "string" || !domain.domain || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(domain.factory) || !HEX.test(domain.sourceSha256) || !Array.isArray(domain.operations)) throw new Error("invalid Reception artifact domain contract");
+    const operations: readonly ReceptionOperation[] = domain.operations;
+    if (new Set(operations.map(x => x.member)).size !== operations.length || operations.some(x => typeof x.member !== "string" || !x.member || typeof x.selector !== "string" || !x.selector || !["offer", "query", "byType", "byId"].includes(x.kind))) throw new Error("invalid Reception artifact operation inventory");
+  }
+}

package/src/reception_cache.ts

@@ -0,0 +1,45 @@
+/** Decode the existing generic OpenUSD law-product frame using its published
+ * Protobuf schema. These bytes are already verified by the target; their frame
+ * identity is checked again before selecting any compiler metadata. */
+import { fromBinary } from "@bufbuild/protobuf";
+import { CachedOpenUsdLayerSchema } from "./protocol/nomos/kernel/v1/openusd_cache_pb.js";
+import { usdaString } from "./usda_text.js";
+
+export function receptionMetadataFromLawProduct(bytes: Uint8Array, closure: string): string {
+  const layer = fromBinary(CachedOpenUsdLayerSchema, bytes);
+  if (layer.formatVersion !== 1 || layer.packageIdentity !== closure)
+    throw new Error("Reception law product format or closure identity mismatch");
+  const paths = new Set<string>();
+  const output = ["#usda 1.0"];
+  const domains = layer.prims.filter(prim => /^\/Nomos\/Domains\/d_[0-9a-f]{16}$/.test(prim.path));
+  for (const domain of domains) {
+    const template = layer.prims.filter(prim => prim.path === `${domain.path}/Reception`);
+    if (template.length > 1) throw new Error("Reception law product repeats a template prim");
+    const selected = [domain, ...template];
+    output.push('def Scope "Nomos"', '{', '    def Scope "Domains"', '    {', `        def Scope ${usdaString(domain.path.split("/").at(-1)!)}`, '        {');
+    for (const prim of selected) {
+      if (paths.has(prim.path)) throw new Error("Reception law product repeats a domain prim");
+      paths.add(prim.path);
+      const names = new Set<string>();
+      if (prim !== domain) {
+        if (prim.typeName !== "NomosReceptionTemplate") throw new Error("Reception law product has an incompatible template prim type");
+        output.push('            def NomosReceptionTemplate "Reception"', '            {');
+      }
+      for (const property of prim.properties) {
+        if (prim === domain && !["nomos:label", "nomos:receptionVisibility"].includes(property.name)) continue;
+        if (names.has(property.name)) throw new Error("Reception law product repeats a property");
+        names.add(property.name);
+        const value = property.value?.kind;
+        if (value?.case === "string" || value?.case === "token") {
+          output.push(`                custom ${value.case} ${property.name} = ${usdaString(value.value)}`);
+        } else if (value?.case === "stringArray" || value?.case === "tokenArray") {
+          output.push(`                custom ${value.case === "stringArray" ? "string" : "token"}[] ${property.name} = [${value.value.values.map(usdaString).join(", ")}]`);
+        } else throw new Error(`Reception law product property ${property.name} has an incompatible value type`);
+      }
+      if (prim !== domain) output.push('            }');
+    }
+    output.push('        }', '    }', '}');
+  }
+  if (domains.length === 0) throw new Error("Reception law product contains no domain inventory");
+  return output.join("\n");
+}

package/src/reception_template.ts

@@ -0,0 +1,81 @@
+import { build, version as esbuildVersion } from "esbuild";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { gzipSync } from "node:zlib";
+/** Compiler-only inventory of the generated stateless business methods. */
+import type { DomainModule } from "./codegen_dart.js";
+import type { LawGraph } from "./law_graph.js";
+import { generatedAggregateCollectionName } from "./generated_client_names.js";
+import { isNamespacedAggregate, qualifyReadProjectionType } from "./read_projection_namespace.js";
+import type { ReceptionOperation } from "./reception_artifact_contract.js";
+import type { ReceptionTemplate } from "./reception_artifact_contract.js";
+import { isFrameworkAggregate, isFrameworkQuery } from "./framework/framework_aggregates.js";
+
+/** Keep source completeness without multiplying opaque metadata in semantic USD.
+ * gzip has no timestamp/name, so repeated compiler runs carry the same bytes. */
+export function compressCompilerReceptionTemplate(template: ReceptionTemplate): ReceptionTemplate {
+  const bytes = Buffer.from(JSON.stringify([template.factorySource, template.clientSource, template.operationBinding, template.operationProto]));
+  return { ...template, sourceEnvelope: { gzipBase64: gzipSync(bytes, { level: 9 }).toString("base64"), decodedBytes: bytes.byteLength } };
+}
+const queryMember = (value: string) => {
+  const camel = value.replace(/[_\s-]+(\w)/g, (_match, letter: string) => letter.toUpperCase());
+  return camel[0]!.toLowerCase() + camel.slice(1);
+};
+export function compilerReceptionOperations(module: DomainModule, graph: LawGraph): readonly ReceptionOperation[] {
+  const operations: ReceptionOperation[] = [];
+  const domain = module.domain ?? module.name;
+  for (const node of graph.nodes) {
+    if (node.kind === "intent" && node.public) {
+      const selector = node.publicRoute ?? node.entity.label;
+      operations.push({ member: selector, kind: "offer", selector });
+    }
+  }
+  for (const read of [...(module.queries ?? []), ...(module.orderedReads ?? [])]) {
+    if ((read as { businessBirthInternal?: unknown }).businessBirthInternal === true || isFrameworkQuery(read as Parameters<typeof isFrameworkQuery>[0])) continue;
+    operations.push({ member: queryMember(read.id), kind: "query", selector: read.id });
+  }
+  for (const aggregate of module.aggregates) {
+    if ((aggregate as { businessBirthInternal?: boolean }).businessBirthInternal || isFrameworkAggregate(aggregate)) continue;
+    const collection = generatedAggregateCollectionName(aggregate.id);
+    const selector = isNamespacedAggregate(aggregate) ? qualifyReadProjectionType(domain, aggregate.id) : aggregate.id;
+    operations.push({ member: `${collection}.all`, kind: "byType", selector }, { member: `${collection}.find`, kind: "byId", selector });
+  }
+  const sorted = operations.sort((a, b) => a.member < b.member ? -1 : a.member > b.member ? 1 : 0);
+  if (new Set(sorted.map(x => x.member)).size !== sorted.length) throw new Error(`Reception metadata repeats business member in ${domain}`);
+  return sorted;
+}
+
+/** Compiler-only: lower the existing generated client to a closure-independent
+ * factory fragment. The hosted generator performs no TypeScript transformation. */
+export async function bundleCompilerReceptionFactory(template: { factory: string; clientSource: string; operationBinding: string }): Promise<string> {
+  if (esbuildVersion !== "0.24.2") throw new Error(`unsupported Reception compiler transformer ${esbuildVersion}`);
+  const compilerRequire = createRequire(import.meta.url);
+  const files = new Map([
+    ["entry.ts", `export { ${template.factory} } from "./client.ts";`],
+    ["client.ts", template.clientSource], ["operation_payloads_pb.ts", template.operationBinding],
+  ]);
+  const result = await build({ entryPoints: ["entry.ts"], bundle: true, write: false,
+    format: "iife", globalName: "__NOMOS_RECEPTION_FACET__", platform: "browser", target: "es2022",
+    minify: true, legalComments: "none", charset: "utf8", logLevel: "silent", sourcemap: false,
+    plugins: [{ name: "compiler-reception-factory", setup(builder) {
+      builder.onResolve({ filter: /.*/ }, args => {
+        if (args.path === "entry.ts") return { path: args.path, namespace: "reception" };
+        if (args.namespace === "reception") {
+          if (args.path === "./client.ts") return { path: "client.ts", namespace: "reception" };
+          if (args.path === "./operation_payloads_pb.js") return { path: "operation_payloads_pb.ts", namespace: "reception" };
+          if (args.path === "@githolon/runtime/application") return { path: join(dirname(compilerRequire.resolve("@githolon/runtime/package.json")), "src", "application_reception.ts") };
+          if (/^@bufbuild\/protobuf(?:\/[A-Za-z0-9_-]+)?$/.test(args.path)) return { path: compilerRequire.resolve(args.path) };
+          throw new Error(`Reception compiler source imports forbidden module '${args.path}'`);
+        }
+        return undefined;
+      });
+      builder.onLoad({ filter: /.*/, namespace: "reception" }, args => {
+        const contents = files.get(args.path);
+        if (contents === undefined) throw new Error(`Reception compiler missing source '${args.path}'`);
+        return { contents, loader: "ts" };
+      });
+    } }],
+  });
+  if (result.outputFiles?.length !== 1) throw new Error("Reception compiler emitted no unique factory");
+  return result.outputFiles[0]!.text;
+}