@githolon/dsl 0.117.0 → 0.119.9

package/dart_types/lib/src/proto/nomos/runtime/v2/correspondence_desk.pb.dart

@@ -8334,6 +8334,7 @@ class LiveFrontier extends $pb.GeneratedMessage {
     $core.String? outcomesDigest,
     $core.Iterable<RetainedRef>? outcomes,
     $core.String? sealed,
+    $core.Iterable<$core.String>? heldTrees,
   }) {
     final result = create();
     if (head != null) result.head = head;
@@ -8344,6 +8345,7 @@ class LiveFrontier extends $pb.GeneratedMessage {
     if (outcomesDigest != null) result.outcomesDigest = outcomesDigest;
     if (outcomes != null) result.outcomes.addAll(outcomes);
     if (sealed != null) result.sealed = sealed;
+    if (heldTrees != null) result.heldTrees.addAll(heldTrees);
     return result;
   }
 
@@ -8370,6 +8372,7 @@ class LiveFrontier extends $pb.GeneratedMessage {
     ..pPM<RetainedRef>(6, _omitFieldNames ? '' : 'outcomes',
         subBuilder: RetainedRef.create)
     ..aOS(7, _omitFieldNames ? '' : 'sealed')
+    ..pPS(8, _omitFieldNames ? '' : 'heldTrees')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -8448,6 +8451,13 @@ class LiveFrontier extends $pb.GeneratedMessage {
   $core.bool hasSealed() => $_has(6);
   @$pb.TagNumber(7)
   void clearSealed() => $_clearField(7);
+
+  /// Law-closure trees this copy already holds in some workspace on its own peer (CAP-901), at most
+  /// 16. The peer may leave every object reachable from a named tree out of a checkpoint it offers
+  /// (LiveCheckpointOffer.omitted_trees); the copy supplies them from its own custody before it verifies
+  /// the checkpoint, or asks again naming none. A copy that names none gets the whole checkpoint.
+  @$pb.TagNumber(8)
+  $pb.PbList<$core.String> get heldTrees => $_getList(7);
 }
 
 /// Start or resume a checkpoint. A resume names the checkpoint (`head`, `pack_id`) and the bytes it
@@ -8460,12 +8470,14 @@ class LiveCheckpointRequest extends $pb.GeneratedMessage {
     $core.String? packId,
     $fixnum.Int64? offset,
     $core.int? windowChunks,
+    $core.Iterable<$core.String>? heldTrees,
   }) {
     final result = create();
     if (head != null) result.head = head;
     if (packId != null) result.packId = packId;
     if (offset != null) result.offset = offset;
     if (windowChunks != null) result.windowChunks = windowChunks;
+    if (heldTrees != null) result.heldTrees.addAll(heldTrees);
     return result;
   }
 
@@ -8489,6 +8501,7 @@ class LiveCheckpointRequest extends $pb.GeneratedMessage {
         defaultOrMaker: $fixnum.Int64.ZERO)
     ..aI(4, _omitFieldNames ? '' : 'windowChunks',
         fieldType: $pb.PbFieldType.OU3)
+    ..pPS(5, _omitFieldNames ? '' : 'heldTrees')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -8546,6 +8559,11 @@ class LiveCheckpointRequest extends $pb.GeneratedMessage {
   $core.bool hasWindowChunks() => $_has(3);
   @$pb.TagNumber(4)
   void clearWindowChunks() => $_clearField(4);
+
+  /// As in LiveFrontier: trees the copy holds and the checkpoint may leave out. A resume names the same
+  /// trees it named when the checkpoint was offered (they are part of the checkpoint's identity).
+  @$pb.TagNumber(5)
+  $pb.PbList<$core.String> get heldTrees => $_getList(4);
 }
 
 /// The checkpoint the peer will send: the frontier state at H (H's commit and state tree, and the
@@ -8564,6 +8582,8 @@ class LiveCheckpointOffer extends $pb.GeneratedMessage {
     $core.String? requestId,
     $core.String? sealed,
     $core.String? main,
+    $core.Iterable<$core.String>? omittedTrees,
+    $core.Iterable<$core.String>? sharedTrees,
   }) {
     final result = create();
     if (head != null) result.head = head;
@@ -8577,6 +8597,8 @@ class LiveCheckpointOffer extends $pb.GeneratedMessage {
     if (requestId != null) result.requestId = requestId;
     if (sealed != null) result.sealed = sealed;
     if (main != null) result.main = main;
+    if (omittedTrees != null) result.omittedTrees.addAll(omittedTrees);
+    if (sharedTrees != null) result.sharedTrees.addAll(sharedTrees);
     return result;
   }
 
@@ -8609,6 +8631,8 @@ class LiveCheckpointOffer extends $pb.GeneratedMessage {
     ..aOS(10, _omitFieldNames ? '' : 'requestId')
     ..aOS(11, _omitFieldNames ? '' : 'sealed')
     ..aOS(12, _omitFieldNames ? '' : 'main')
+    ..pPS(13, _omitFieldNames ? '' : 'omittedTrees')
+    ..pPS(14, _omitFieldNames ? '' : 'sharedTrees')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -8725,6 +8749,16 @@ class LiveCheckpointOffer extends $pb.GeneratedMessage {
   $core.bool hasMain() => $_has(10);
   @$pb.TagNumber(12)
   void clearMain() => $_clearField(12);
+
+  /// The held trees (named by the copy's ask) whose reachable objects this pack leaves out (CAP-901):
+  /// the copy supplies them from its own custody before it verifies the checkpoint.
+  @$pb.TagNumber(13)
+  $pb.PbList<$core.String> get omittedTrees => $_getList(11);
+
+  /// The law-closure trees this checkpoint carries (its `state/law-units` tree): a copy that holds one
+  /// in another workspace may name it in its next ask and receive a checkpoint without it.
+  @$pb.TagNumber(14)
+  $pb.PbList<$core.String> get sharedTrees => $_getList(12);
 }
 
 /// One chunk of a checkpoint, or (with `request_id`) of a history slice.
@@ -9646,6 +9680,7 @@ class PeerStreamReceipt extends $pb.GeneratedMessage {
     $core.String? sealed,
     $core.String? stagedPackFile,
     $core.String? main,
+    $core.Iterable<$core.String>? omittedTrees,
   }) {
     final result = create();
     if (pack != null) result.pack = pack;
@@ -9656,6 +9691,7 @@ class PeerStreamReceipt extends $pb.GeneratedMessage {
     if (sealed != null) result.sealed = sealed;
     if (stagedPackFile != null) result.stagedPackFile = stagedPackFile;
     if (main != null) result.main = main;
+    if (omittedTrees != null) result.omittedTrees.addAll(omittedTrees);
     return result;
   }
 
@@ -9694,6 +9730,7 @@ class PeerStreamReceipt extends $pb.GeneratedMessage {
     ..aOS(6, _omitFieldNames ? '' : 'sealed')
     ..aOS(7, _omitFieldNames ? '' : 'stagedPackFile')
     ..aOS(8, _omitFieldNames ? '' : 'main')
+    ..pPS(9, _omitFieldNames ? '' : 'omittedTrees')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -9801,6 +9838,11 @@ class PeerStreamReceipt extends $pb.GeneratedMessage {
   $core.bool hasMain() => $_has(7);
   @$pb.TagNumber(8)
   void clearMain() => $_clearField(8);
+
+  /// With a checkpoint: the trees its pack leaves out (LiveCheckpointOffer.omitted_trees), which the
+  /// copy supplies from its own custody before the import verifies it.
+  @$pb.TagNumber(9)
+  $pb.PbList<$core.String> get omittedTrees => $_getList(8);
 }
 
 enum PeerSocketEffect_Operation { openUrl, send, close, notSet }
@@ -10348,8 +10390,18 @@ class LiveLinkClosure extends $pb.GeneratedMessage {
   void clearUnansweredBatches() => $_clearField(12);
 }
 
+/// The peer observed a socket receipt. `rung_workspaces` names each workspace whose upstream rang
+/// for a main this copy does not hold while the receipt was handled: its follow round is now due, and
+/// it is news a person is waiting for. A native shell starts that round at once rather than after the
+/// foreground's quiet window, still behind interactive requests already queued.
 class PeerSocketObserved extends $pb.GeneratedMessage {
-  factory PeerSocketObserved() => create();
+  factory PeerSocketObserved({
+    $core.Iterable<$core.String>? rungWorkspaces,
+  }) {
+    final result = create();
+    if (rungWorkspaces != null) result.rungWorkspaces.addAll(rungWorkspaces);
+    return result;
+  }
 
   PeerSocketObserved._();
 
@@ -10365,6 +10417,7 @@ class PeerSocketObserved extends $pb.GeneratedMessage {
       package:
           const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
       createEmptyInstance: create)
+    ..pPS(1, _omitFieldNames ? '' : 'rungWorkspaces')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -10385,6 +10438,9 @@ class PeerSocketObserved extends $pb.GeneratedMessage {
   static PeerSocketObserved getDefault() => _defaultInstance ??=
       $pb.GeneratedMessage.$_defaultFor<PeerSocketObserved>(create);
   static PeerSocketObserved? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $pb.PbList<$core.String> get rungWorkspaces => $_getList(0);
 }
 
 class ExportLiveOffersRequest extends $pb.GeneratedMessage {

package/dart_types/lib/src/proto/nomos/runtime/v2/maintenance_desk.pb.dart

@@ -127,10 +127,12 @@ class LocalReadPending extends $pb.GeneratedMessage {
   factory LocalReadPending({
     $core.String? workId,
     $core.int? resumeAfterMillis,
+    $core.String? heldReason,
   }) {
     final result = create();
     if (workId != null) result.workId = workId;
     if (resumeAfterMillis != null) result.resumeAfterMillis = resumeAfterMillis;
+    if (heldReason != null) result.heldReason = heldReason;
     return result;
   }
 
@@ -151,6 +153,7 @@ class LocalReadPending extends $pb.GeneratedMessage {
     ..aOS(1, _omitFieldNames ? '' : 'workId')
     ..aI(2, _omitFieldNames ? '' : 'resumeAfterMillis',
         fieldType: $pb.PbFieldType.OU3)
+    ..aOS(3, _omitFieldNames ? '' : 'heldReason')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -189,6 +192,17 @@ class LocalReadPending extends $pb.GeneratedMessage {
   $core.bool hasResumeAfterMillis() => $_has(1);
   @$pb.TagNumber(2)
   void clearResumeAfterMillis() => $_clearField(2);
+
+  /// CAP-900: why the kernel holds this read (ReadIndexPending.last_ready_absent), so the shell's
+  /// log names it. Diagnostic text only: shells never branch on it.
+  @$pb.TagNumber(3)
+  $core.String get heldReason => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set heldReason($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasHeldReason() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearHeldReason() => $_clearField(3);
 }
 
 /// An exact custody frontier advanced through a write entrance which is not

package/dart_types/lib/src/proto/nomos/runtime/v2/observability_desk.pbenum.dart

@@ -100,6 +100,28 @@ class RuntimeUnavailableReason extends $pb.ProtobufEnum {
       RuntimeUnavailableReason._(
           7, _omitEnumNames ? '' : 'RUNTIME_UNAVAILABLE_REASON_PEER_BUSY');
 
+  /// CAP-891: this peer's only ready read index for the workspace was built under the law its head
+  /// has since replaced. The application's decoders belong to the new law, so no rows are served
+  /// from it; read maintenance is building the index under the new law. Retryable: render
+  /// "updating", never an empty result and never a decode failure (CO2-APP-209).
+  static const RuntimeUnavailableReason
+      RUNTIME_UNAVAILABLE_REASON_READ_INDEX_REFRESHING_SUCCESSOR_LAW =
+      RuntimeUnavailableReason._(
+          8,
+          _omitEnumNames
+              ? ''
+              : 'RUNTIME_UNAVAILABLE_REASON_READ_INDEX_REFRESHING_SUCCESSOR_LAW');
+
+  /// This workspace has never been on this device: its placement keeps a local copy here and that
+  /// copy's first download (Replica Follow) is under way. Answered at once, to a read and to a
+  /// write alike; nothing is admitted against an absent base. Retryable, and ONE-TIME per workspace
+  /// per device: once the first download lands the copy persists across kills, updates and reboots,
+  /// and writes go against it as normal (Jack, 11 Oct 2026). Distinct from LOCAL_REPLICA_NOT_READY,
+  /// which also names a copy that is here but unreadable (being refetched or awaiting a drop).
+  static const RuntimeUnavailableReason
+      RUNTIME_UNAVAILABLE_REASON_FIRST_DOWNLOAD = RuntimeUnavailableReason._(
+          9, _omitEnumNames ? '' : 'RUNTIME_UNAVAILABLE_REASON_FIRST_DOWNLOAD');
+
   static const $core.List<RuntimeUnavailableReason> values =
       <RuntimeUnavailableReason>[
     RUNTIME_UNAVAILABLE_REASON_UNSPECIFIED,
@@ -110,10 +132,12 @@ class RuntimeUnavailableReason extends $pb.ProtobufEnum {
     RUNTIME_UNAVAILABLE_REASON_CREDENTIAL_UNAVAILABLE,
     RUNTIME_UNAVAILABLE_REASON_WORKSPACE_OPENING,
     RUNTIME_UNAVAILABLE_REASON_PEER_BUSY,
+    RUNTIME_UNAVAILABLE_REASON_READ_INDEX_REFRESHING_SUCCESSOR_LAW,
+    RUNTIME_UNAVAILABLE_REASON_FIRST_DOWNLOAD,
   ];
 
   static final $core.List<RuntimeUnavailableReason?> _byValue =
-      $pb.ProtobufEnum.$_initByValueList(values, 7);
+      $pb.ProtobufEnum.$_initByValueList(values, 9);
   static RuntimeUnavailableReason? valueOf($core.int value) =>
       value < 0 || value >= _byValue.length ? null : _byValue[value];
 

package/dart_types/lib/src/runtime_outcome.dart

@@ -17,6 +17,18 @@ enum NomosUnavailableReason {
   localReplicaNotReady,
   credentialUnavailable,
   workspaceOpening,
+
+  /// The workspace's only ready read index was built under a law its head has since replaced,
+  /// and it is being rebuilt under the new law (CAP-891). This application decodes the head's
+  /// law only (no reception for the predecessor closure, CAP-884), so no rows are served from
+  /// it. A wait like [localReplicaNotReady], never a result and never a failure (CAP-900).
+  readIndexRefreshing,
+
+  /// This workspace has never been on this device and its first download is under way. A read
+  /// answers empty and a write is refused, at once; nothing is admitted against an absent base.
+  /// ONE-TIME per workspace per device: the landed copy persists (CAP-907). Distinct from
+  /// [localReplicaNotReady], which also names a copy here that is unreadable (Jack, 11 Oct 2026).
+  firstDownload,
   unknown,
 }
 
@@ -57,6 +69,11 @@ final class NomosUnavailable implements Exception {
         NomosUnavailableReason.credentialUnavailable,
       RuntimeUnavailableReason.RUNTIME_UNAVAILABLE_REASON_WORKSPACE_OPENING =>
         NomosUnavailableReason.workspaceOpening,
+      RuntimeUnavailableReason
+          .RUNTIME_UNAVAILABLE_REASON_READ_INDEX_REFRESHING_SUCCESSOR_LAW =>
+        NomosUnavailableReason.readIndexRefreshing,
+      RuntimeUnavailableReason.RUNTIME_UNAVAILABLE_REASON_FIRST_DOWNLOAD =>
+        NomosUnavailableReason.firstDownload,
       _ => NomosUnavailableReason.unknown,
     },
     workspace: unavailable.workspace,

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. Typed protobuf and USDA boundary values plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.15.0
+version: 0.15.2
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.117.0",
+  "version": "0.119.9",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
@@ -34,6 +34,9 @@
     "./workspace-sharding": "./src/workspace_sharding.ts",
     "./reception-artifact": "./src/reception_artifact.ts",
     "./reception-artifact-contract": "./src/reception_artifact_contract.ts",
+    "./reception-unit-artifact": "./src/reception_unit_artifact.ts",
+    "./reception-unit-artifact-contract": "./src/reception_unit_artifact_contract.ts",
+    "./reception-unit-source": "./src/reception_unit_source.ts",
     "./build-package": "./src/build_package.ts",
     "./codegen-dart": "./src/codegen_dart.ts",
     "./codegen-dot": "./src/codegen_dot.ts",
@@ -79,10 +82,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@githolon/runtime": "^0.117.0",
+    "@githolon/runtime": "^0.119.9",
     "@bufbuild/protobuf": "^2.13.0",
     "@bufbuild/protoc-gen-es": "^2.13.0",
     "esbuild": "0.24.2",
+    "fflate": "0.8.2",
     "tsx": "^4.19.2",
     "typescript": "^5.6.3",
     "vscode-languageserver": "^9.0.1",

package/src/codegen_ts.ts

@@ -4765,6 +4765,7 @@ function generateTsClientBody(
         d as unknown as {
           businessBirth?: {
             aggregateId: string;
+            domain: string;
             publicPayloadSchema: z.ZodTypeAny;
             rootId: string;
             namespace: string;
@@ -4789,17 +4790,15 @@ function generateTsClientBody(
         businessBirth === undefined
           ? undefined
           : (() => {
-              const owners = [
-                ...new Set(
-                  aggregateOwners.get(businessBirth.aggregateId) ?? []
-                ),
-              ];
+              if (typeof businessBirth.domain !== "string" || businessBirth.domain.length === 0) {
+                throw new Error(`codegen: business birth '${domain}/${d.id}' has no declared owning domain`);
+              }
+              const owners = (aggregateOwners.get(businessBirth.aggregateId) ?? [])
+                .filter(owner => owner === businessBirth.domain);
               if (owners.length !== 1) {
                 throw new Error(
                   `codegen: business birth '${domain}/${d.id}' must target one generated domain owning ` +
-                    `'${businessBirth.aggregateId}', found ${
-                      owners.length === 0 ? "none" : owners.join(", ")
-                    }`
+                    `'${businessBirth.domain}/${businessBirth.aggregateId}', found ${owners.length}`
                 );
               }
               return owners[0]!;

package/src/compile_package_main.ts

@@ -265,6 +265,7 @@ import {
 import { proofLegsIndex } from "./codegen_proof.js";
 import { usdzPack } from "./usdz.js";
 import { compilerReceptionOperations, bundleCompilerReceptionFactory, compressCompilerReceptionTemplate } from "./reception_template.js";
+import { ReceptionUnitContextIndex } from "./reception_unit_context.js";
 import { embedReceptionTemplate, appendReceptionDomainOpinion, RECEPTION_CLOSURE_TOKEN } from "./reception_artifact_contract.js";
 import {
   LAW_UNIT_MANIFEST,
@@ -2586,12 +2587,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.15.0";
+const NOMOS_TYPES_DEP = "^0.15.2";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.70.3";
-const NOMOS_FLUTTER_DEP = "^0.68.5";
+const NOMOS_CLIENT_DEP = "^0.70.10";
+const NOMOS_FLUTTER_DEP = "^0.69.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -7893,6 +7894,11 @@ async function main(): Promise<void> {
   // Complete compiler-produced Reception metadata belongs to the domain unit.
   // The realised closure is not known until the target kernel composes its installed
   // set; its token is bound only by the server generator, outside law identity.
+  const receptionUnitContexts = new ReceptionUnitContextIndex(domainModules.map(module => {
+    const graph = typedLawGraphs.get(module.name);
+    if (!graph) fail(`Reception unit context has no graph for '${module.name}'`);
+    return { module, graph };
+  }), lawDependencies, v3LawPathByNode);
   for (const module of presentationDomainModules) {
     const graph = typedLawGraphs.get(module.name);
     const paths = typedLawPathsByName.get(module.name);
@@ -7912,7 +7918,8 @@ async function main(): Promise<void> {
       const binding = readFileSync(path.join(scratch, "operation_payloads_pb.ts"), "utf8");
       const source = generateTsClient([module], {
         packageName: module.name, domainHash: RECEPTION_CLOSURE_TOKEN,
-        interface: { [domain]: packageInterface[domain]! }, kernelContracts,
+        interface: { [domain]: packageInterface[domain]! },
+        kernelContracts: receptionUnitContexts.forGraph(graph).kernelContracts,
         homeDomain: domain, exportHolonFactory: true, callUsda: [{ graph, paths }],
         factoryOnly: { composition: presentationDomainModules },
       });

package/src/reception_template.ts

@@ -1,7 +1,7 @@
 import { build, version as esbuildVersion } from "esbuild";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
-import { gzipSync } from "node:zlib";
+import { gzipSync } from "fflate";
 /** Compiler-only inventory of the generated stateless business methods. */
 import type { DomainModule } from "./codegen_dart.js";
 import type { LawGraph } from "./law_graph.js";
@@ -12,10 +12,11 @@ import type { ReceptionTemplate } from "./reception_artifact_contract.js";
 import { isFrameworkAggregate, isFrameworkQuery } from "./framework/framework_aggregates.js";
 
 /** Keep source completeness without multiplying opaque metadata in semantic USD.
- * gzip has no timestamp/name, so repeated compiler runs carry the same bytes. */
+ * The pinned pure-JS compressor, fixed memory level and zero timestamp keep law bytes independent
+ * of the host's zlib version. Do not substitute native gzip for this encoder. */
 export function compressCompilerReceptionTemplate(template: ReceptionTemplate): ReceptionTemplate {
   const bytes = Buffer.from(JSON.stringify([template.factorySource, template.clientSource, template.operationBinding, template.operationProto]));
-  return { ...template, sourceEnvelope: { gzipBase64: gzipSync(bytes, { level: 9 }).toString("base64"), decodedBytes: bytes.byteLength } };
+  return { ...template, sourceEnvelope: { gzipBase64: Buffer.from(gzipSync(bytes, { level: 9, mem: 8, mtime: 0 })).toString("base64"), decodedBytes: bytes.byteLength } };
 }
 const queryMember = (value: string) => {
   const camel = value.replace(/[_\s-]+(\w)/g, (_match, letter: string) => letter.toUpperCase());

package/src/reception_unit_artifact.ts

@@ -0,0 +1,105 @@
+/** Pure additive prototype; no production activation, source transformation or law evaluation.
+ * Unit associations must be authenticated upstream. A cached module receives closure context
+ * only through a fresh host-verified binding; the Office still judges the requested operation. */
+import { RECEPTION_CLOSURE_TOKEN, RECEPTION_SOURCE_BYTES_LIMIT } from "./reception_artifact_contract.js";
+import {
+  assertUnitReceptionRecord, snapshotUnitReceptionValue, canonicalReceptionOperations, closureReceptionOperations, closureReceptionManifestIdentity,
+  receptionSha256, unitReceptionArtifactIdentity, unitReceptionUnavailable, validateUnitReceptionIdentity,
+  verifyClosureReceptionManifest, verifyUnitReceptionArtifact, verifyUnitReceptionManifest,
+  UNIT_RECEPTION_ARTIFACT_FORMAT, CLOSURE_RECEPTION_MANIFEST_FORMAT,
+  type UnitReceptionInput, type UnitReceptionArtifact, type UnitReceptionManifest,
+  type ClosureReceptionManifestInput, type ClosureReceptionManifest,
+} from "./reception_unit_artifact_contract.js";
+export * from "./reception_unit_artifact_contract.js";
+
+export async function generateUnitReceptionArtifact(input: UnitReceptionInput): Promise<UnitReceptionArtifact> {
+  input = snapshotUnitReceptionValue(input);
+  assertUnitReceptionRecord(input, ["unitKey", "unitHash", "domain", "generator", "runtimeContract", "template"]);
+  validateUnitReceptionIdentity(input);
+  const template = input.template;
+  if (!template || template.domain !== input.domain || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(template.factory)) unitReceptionUnavailable("unit Reception template domain/factory mismatch");
+  let bytes = 0;
+  for (const [source, hash] of [[template.factorySource, template.factorySha256], [template.clientSource, template.sourceSha256],
+    [template.operationBinding, template.bindingSha256], [template.operationProto, template.protoSha256]]) {
+    if (typeof source !== "string" || !source) unitReceptionUnavailable("incomplete unit Reception template");
+    if (source.length > RECEPTION_SOURCE_BYTES_LIMIT) unitReceptionUnavailable("unit Reception source budget exceeded");
+    bytes += new TextEncoder().encode(source).byteLength;
+    if (bytes > RECEPTION_SOURCE_BYTES_LIMIT) unitReceptionUnavailable("unit Reception source budget exceeded");
+    if (typeof hash !== "string" || !/^[0-9a-f]{64}$/.test(hash) || await receptionSha256(source) !== hash) unitReceptionUnavailable("unit Reception template digest mismatch");
+  }
+  const literal = JSON.stringify(RECEPTION_CLOSURE_TOKEN);
+  if (!template.factorySource.includes(literal) || !template.clientSource.includes(literal)) unitReceptionUnavailable("unit Reception template has no closure binding");
+  const operations = canonicalReceptionOperations(template.operations);
+  const description = { unitKey: input.unitKey, unitHash: input.unitHash, domain: input.domain,
+    generator: input.generator, runtimeContract: input.runtimeContract, factory: template.factory, operations };
+  // This is a lexical expression substituted once into compiler-produced code, not an eval or
+  // per-closure module rewrite. Each call gets a separate factory and closure variable.
+  const source = [
+    'import { WorkerEntrypoint } from "cloudflare:workers";',
+    `const description = ${JSON.stringify(description)};`,
+    `description.operations = Object.freeze(description.operations.map(operation => Object.freeze(operation))); Object.freeze(description);`,
+    `const operations = Object.freeze(Object.fromEntries(description.operations.map(operation => [operation.member, Object.freeze(operation)])));`,
+    `function bindFactory(__nomosBoundClosure) { ${template.factorySource.replaceAll(literal, "__nomosBoundClosure")} return __NOMOS_RECEPTION_FACET__.${template.factory}; }`,
+    `function serialiseResult(value, depth = 0, seen = new Set()) {`,
+    `  const unavailable = () => { const error = new Error("Generated result cannot cross the hosted JSON contract"); error.code = "nomos.reception.result.unavailable"; throw error; };`,
+    `  if (depth > 64) return unavailable();`,
+    `  if (value === undefined) return { $nomos: "absent" };`,
+    `  if (value === null || typeof value === "string" || typeof value === "boolean") return value;`,
+    `  if (typeof value === "number") { if (!Number.isFinite(value)) return unavailable(); return value; }`,
+    `  if (typeof value === "bigint") return { $nomos: "integer", decimal: value.toString() };`,
+    `  if (value instanceof Uint8Array) { let binary = ""; for (const byte of value) binary += String.fromCharCode(byte); return { $nomos: "bytes", base64: btoa(binary) }; }`,
+    `  if (value instanceof Date) { if (!Number.isFinite(value.getTime())) return unavailable(); return { $nomos: "timestamp", iso: value.toISOString() }; }`,
+    `  if (typeof value !== "object" || seen.has(value)) return unavailable();`,
+    `  seen.add(value); try {`,
+    `    if (Array.isArray(value)) return value.map(item => serialiseResult(item, depth + 1, seen));`,
+    `    const prototype = Object.getPrototypeOf(value); if (prototype !== Object.prototype && prototype !== null) return unavailable();`,
+    `    const output = {}; for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) { if (descriptor.get || descriptor.set) return unavailable(); Object.defineProperty(output, key, { value: serialiseResult(descriptor.value, depth + 1, seen), enumerable: true }); } return output;`,
+    `  } finally { seen.delete(value); }`,
+    `}`,
+    `export default class UnitReception extends WorkerEntrypoint {`,
+    `  describe() { return description; }`,
+    `  async invoke(call, office, binding) {`,
+    `    if (!call || !binding || call.domain !== description.domain || binding.domain !== description.domain || binding.unitKey !== description.unitKey || binding.unitHash !== description.unitHash || call.member !== binding.member || call.closure !== binding.closure || !/^[0-9a-f]{64}$/.test(binding.closure)) throw new Error("unit Reception invocation binding mismatch");`,
+    `    if (typeof call.workspace !== "string" || !call.workspace || typeof call.principal !== "string" || !call.principal || !Array.isArray(call.args)) throw new Error("invalid unit Reception invocation");`,
+    `    if (!Object.hasOwn(operations, call.member)) throw new Error("unit Reception member is absent");`,
+    `    const selected = operations[call.member]; if (binding.kind !== selected.kind || binding.selector !== selected.selector) throw new Error("unit Reception operation binding mismatch");`,
+    `    const scoped = { workspace: call.workspace, principal: call.principal, offerCall: (...args) => office.offerCall(...args),`,
+    `      __nomosQuery: (...args) => office.__nomosQuery(...args), __nomosQueryUsda: (...args) => office.__nomosQueryUsda(...args),`,
+    `      __nomosQueryByIdUsda: (...args) => office.__nomosQueryByIdUsda(...args), __nomosQueryByTypeUsda: (...args) => office.__nomosQueryByTypeUsda(...args),`,
+    `      __nomosQueryPage: (...args) => office.__nomosQueryPage(...args), __nomosQueryPageUsda: (...args) => office.__nomosQueryPageUsda(...args),`,
+    `      prepareDomain: (domain, closure) => { if (domain !== description.domain || closure !== binding.closure) throw new Error("unit Reception closure binding escaped its call"); } };`,
+    `    const client = bindFactory(binding.closure)(scoped);`,
+    `    const path = call.member.split("."); let parent = client;`,
+    `    for (const part of path.slice(0, -1)) { if (!part || part.startsWith("__") || ["constructor", "prototype"].includes(part) || !Object.hasOwn(parent, part)) throw new Error("unit Reception business member is absent"); parent = parent[part]; if (!parent || typeof parent !== "object") throw new Error("unit Reception business member is absent"); }`,
+    `    const member = path.at(-1); if (!member || member.startsWith("watch") || member.startsWith("__") || ["constructor", "prototype"].includes(member) || !Object.hasOwn(parent, member) || typeof parent[member] !== "function") throw new Error("unit Reception business member is absent");`,
+    `    const args = [...call.args];`,
+    `    if (selected.kind === "byId" && typeof args[0] === "string" && typeof parent.fromAddress === "function") args[0] = parent.fromAddress(args[0]);`,
+    `    return serialiseResult(await parent[member](...args));`,
+    `  }`,
+    `}`, "",
+  ].join("\n");
+  const content: Omit<UnitReceptionManifest, "artifactId"> = { format: UNIT_RECEPTION_ARTIFACT_FORMAT,
+    unitKey: input.unitKey, unitHash: input.unitHash, domain: input.domain, generator: input.generator,
+    runtimeContract: input.runtimeContract, entrypoint: "reception-unit.mjs", moduleSha256: await receptionSha256(source),
+    factory: template.factory, factorySha256: template.factorySha256, sourceSha256: template.sourceSha256,
+    bindingSha256: template.bindingSha256, protoSha256: template.protoSha256, operations };
+  const artifact: UnitReceptionArtifact = { manifest: { ...content, artifactId: await unitReceptionArtifactIdentity(content) }, moduleSource: source };
+  await verifyUnitReceptionArtifact(artifact, input);
+  return snapshotUnitReceptionValue(artifact);
+}
+
+export async function generateClosureReceptionManifest(input: ClosureReceptionManifestInput): Promise<ClosureReceptionManifest> {
+  input = snapshotUnitReceptionValue(input);
+  assertUnitReceptionRecord(input, ["closure", "generator", "runtimeContract", "units", "domains"]);
+  if (!Array.isArray(input.domains) || input.domains.length === 0 || new Set(input.domains).size !== input.domains.length) unitReceptionUnavailable("invalid authoritative Reception domain coverage");
+  if (!Array.isArray(input.units) || input.units.length === 0) unitReceptionUnavailable("invalid closure Reception units");
+  for (const unit of input.units) await verifyUnitReceptionManifest(unit);
+  const units = input.units.map((unit: UnitReceptionManifest) => ({ ...unit, operations: unit.operations.map(operation => ({ ...operation })) }))
+    .sort((a, b) => a.unitKey < b.unitKey ? -1 : a.unitKey > b.unitKey ? 1 : 0);
+  if (input.domains.length !== units.length || units.some(unit => !input.domains.includes(unit.domain))) unitReceptionUnavailable("closure Reception domain membership is incomplete");
+  const content = { format: CLOSURE_RECEPTION_MANIFEST_FORMAT, closure: input.closure,
+    generator: input.generator, runtimeContract: input.runtimeContract, units, operations: closureReceptionOperations(units) } as const;
+  const manifest = { ...content, manifestId: await closureReceptionManifestIdentity(content) };
+  await verifyClosureReceptionManifest(manifest, input);
+  return snapshotUnitReceptionValue(manifest);
+}