@githolon/dsl 0.23.1 → 0.24.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.23.1",
+  "version": "0.24.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -361,6 +361,12 @@ export interface ChildBirthLeg {
   readonly birthPayload: Record<string, unknown>;
   /** Required `…At` fields the runtime stamps with ISO now() at dispatch (mirrors the create leg). */
   readonly birthAutoStamped: readonly string[];
+  /** The payload field whose value is the authoring actor for this birth offer, when discoverable from the
+   *  genesis recipe's step actors. Needed for gated births (`.births().requires(...)`) so proof drives the
+   *  same actor the generated client would seal as `security.actor`. */
+  readonly birthActorField?: string;
+  /** The relation the birth offer requires (`.births().requires(...)`), when present. */
+  readonly birthRequiresRelation?: string;
   /** The payload field that carries the bootstrap framework-controller hash (runtime: the local wasm's own
    *  controller hash) — discovered from the recipe's `bootstrap/installDomain` step's payload, by matching
    *  the field whose synthesized value the recipe routed there. `undefined` ⇒ the recipe hard-codes it. */
@@ -379,6 +385,21 @@ export interface ChildBirthLeg {
   readonly childSeedInstanceId?: string;
   /** A child declared query that reads the seed back (returns the seed aggregate). `undefined` ⇒ by-id only. */
   readonly childQuery?: { readonly id: string; readonly key: readonly string[] };
+  /** Optional parent setup: when this birth is gated by authority that is established by first birthing the
+   *  parent workspace (home → estate is the canonical case), the proof runner drives this setup birth first
+   *  and then authors the child birth inside the born parent. */
+  readonly parentSetup?: ChildBirthParentSetup;
+}
+
+export interface ChildBirthParentSetup {
+  readonly parentDomain: string;
+  readonly birthDirectiveId: string;
+  readonly birthPayload: Record<string, unknown>;
+  readonly birthAutoStamped: readonly string[];
+  readonly birthActorField?: string;
+  readonly frameworkHashField?: string;
+  readonly lawHashField?: string;
+  readonly childDomain: string;
 }
 
 /** A stub `nomos` global (mint + sha256) so a `.births()` plan that mints / hashes a child name runs to
@@ -489,6 +510,19 @@ export function discoverChildBirthLeg(
   const nomosStep = installSteps.find((s) => s.domain === "nomos");
   const frameworkHashField = bootstrapStep ? fieldForValue(bootstrapStep.payload?.domainHash) : undefined;
   const lawHashField = nomosStep ? fieldForValue(nomosStep.payload?.domainHash) : undefined;
+  const actorField = (() => {
+    for (const step of chain as Array<DiscoveredGenesisStep & { actor?: unknown }>) {
+      const actor = step?.actor;
+      const exact = fieldForValue(actor);
+      if (exact !== undefined) return exact;
+      if (typeof actor !== "string") continue;
+      for (const [field, value] of Object.entries(synth.value)) {
+        if (typeof value !== "string" || value.length === 0) continue;
+        if (actor === `user:${value}` || actor === `key:${value}`) return field;
+      }
+    }
+    return undefined;
+  })();
 
   // The parent payload the leg dispatches: the synthesized values MINUS the framework/law-hash placeholders
   // (the runtime injects the REAL hashes onto those fields by name — a `sample-*` hash would fail the child
@@ -502,6 +536,8 @@ export function discoverChildBirthLeg(
     birthDirectiveId: birthDir.id,
     birthPayload,
     birthAutoStamped: synth.autoStamped,
+    ...(actorField !== undefined ? { birthActorField: actorField } : {}),
+    ...(birthDir.requiresRelationGate !== undefined ? { birthRequiresRelation: birthDir.requiresRelationGate.relation } : {}),
     ...(frameworkHashField !== undefined ? { frameworkHashField } : {}),
     ...(lawHashField !== undefined ? { lawHashField } : {}),
     childDomain,
@@ -512,6 +548,38 @@ export function discoverChildBirthLeg(
   };
 }
 
+function childBirthsForModule(mod: DomainModule, modules: readonly DomainModule[]): ChildBirthLeg[] {
+  const domain = mod.domain ?? mod.name;
+  const out: ChildBirthLeg[] = [];
+  for (const d of mod.directives as Directive<unknown>[]) {
+    if (d?.birthsChild !== true || typeof d.payloadSchema !== "object") continue;
+    const leg = discoverChildBirthLeg(d, domain, modules);
+    if (leg !== undefined) out.push(leg);
+  }
+  return out;
+}
+
+function asParentSetup(leg: ChildBirthLeg): ChildBirthParentSetup {
+  return {
+    parentDomain: leg.parentDomain,
+    birthDirectiveId: leg.birthDirectiveId,
+    birthPayload: leg.birthPayload,
+    birthAutoStamped: leg.birthAutoStamped,
+    ...(leg.birthActorField !== undefined ? { birthActorField: leg.birthActorField } : {}),
+    ...(leg.frameworkHashField !== undefined ? { frameworkHashField: leg.frameworkHashField } : {}),
+    ...(leg.lawHashField !== undefined ? { lawHashField: leg.lawHashField } : {}),
+    childDomain: leg.childDomain,
+  };
+}
+
+function attachParentSetup(leg: ChildBirthLeg, allBirths: readonly ChildBirthLeg[]): ChildBirthLeg {
+  if (leg.birthRequiresRelation === undefined) return leg;
+  const setup = allBirths.find((candidate) =>
+    candidate.childDomain === leg.parentDomain &&
+    !(candidate.parentDomain === leg.parentDomain && candidate.birthDirectiveId === leg.birthDirectiveId));
+  return setup === undefined ? leg : { ...leg, parentSetup: asParentSetup(setup) };
+}
+
 /** Discover the SINGLETON instance id a seed directive writes (a fixed `<Agg>:self`-shaped id), by running
  *  its plan with a probe payload + birth-probe globals and reading the first written op's instance id when
  *  it is a constant (the same id across two distinct probe payloads). `undefined` ⇒ not a fixed singleton. */
@@ -644,6 +712,7 @@ function birthDirectiveOf(mod: DomainModule): Directive<unknown> | undefined {
  *  domain is at least `compile-valid` (gaps 1+3 — every domain is proof-addressable). */
 export function legsForDomain(mod: DomainModule, modules: readonly DomainModule[]): ProofLegs {
   const domain = mod.domain ?? mod.name;
+  const allBirths = modules.flatMap((m) => childBirthsForModule(m, modules));
   // The standalone-create leg (when the domain has a non-birth `.creates`). FAIL SOFT: an exotic payload
   // shape the synthesizer can't sample just drops the standalone leg (the domain stays compile-valid /
   // child-birth-provable), never loses the index.
@@ -655,11 +724,12 @@ export function legsForDomain(mod: DomainModule, modules: readonly DomainModule[
   }
   // The child-birth leg (when the domain has a `.births()` directive) — discovered by running its plan.
   const birthDir = birthDirectiveOf(mod);
-  const childBirth = birthDir !== undefined ? discoverChildBirthLeg(birthDir, domain, modules) : undefined;
+  const childBirth = birthDir !== undefined ? allBirths.find((b) => b.parentDomain === domain && b.birthDirectiveId === birthDir.id) : undefined;
+  const childBirthWithSetup = childBirth !== undefined ? attachParentSetup(childBirth, allBirths) : undefined;
 
   const legs: ProofKind[] = ["compile-valid"];
   if (standalone !== null) legs.push("standalone-provable");
-  if (childBirth !== undefined) legs.push("child-birth-provable");
+  if (childBirthWithSetup !== undefined) legs.push("child-birth-provable");
 
   return {
     domain,
@@ -675,7 +745,7 @@ export function legsForDomain(mod: DomainModule, modules: readonly DomainModule[
           ...(standalone.count !== undefined ? { count: standalone.count } : {}),
         }
       : {}),
-    ...(childBirth !== undefined ? { childBirth } : {}),
+    ...(childBirthWithSetup !== undefined ? { childBirth: childBirthWithSetup } : {}),
   };
 }
 
@@ -798,26 +868,65 @@ function liveChildBirthLegLines(cb: ChildBirthLeg, opts: TsProofOptions, n: () =
   // The birth payload literal: the synthesized values + the REAL hashes onto the discovered fields + the
   // auto-stamped `…At` fields stamped now.
   const lines: string[] = [];
+  const setup = cb.parentSetup;
+  const actorExpr = (field: string | undefined, payloadVar: string): string | undefined =>
+    field !== undefined ? `String(${payloadVar}[${JSON.stringify(field)}] ?? "")` : undefined;
+  const birthActorExpr = actorExpr(cb.birthActorField, "birthPayload");
   lines.push(
     `// ${n()}. CHILD BIRTH (G3 — birth is the defined consequence of an offer): drive \`${cb.parentDomain}/${cb.birthDirectiveId}\``,
     `//    against the cloud; the kernel's offer-effect installs the child law in-chain + folds the child's`,
     `//    genesis (estate/${cb.childSeedDirectiveId}) through the CHILD's own gate, then BORNS the child workspace.`,
     `{`,
+    `  const frameworkHashFor = async (workspace: string) => {`,
+    `    const st = await (await fetch(\`\${CLOUD}/v2/workspaces/\${workspace}\`)).json().catch(() => ({}));`,
+    `    const frameworkHash = st.controller?.domainHash ?? st.controllerHash ?? "";`,
+    `    if (!frameworkHash) fail(\`could not resolve the framework controller hash from workspace \${workspace} — needed for the child's in-chain installDomain\`);`,
+    `    return frameworkHash;`,
+    `  };`,
     `  const birthPayload: Record<string, unknown> = { ...${JSON.stringify(cb.birthPayload)} };`,
+    ...(
+      birthActorExpr !== undefined && cb.birthRequiresRelation !== undefined
+        ? [
+            `  const birthActor = ${birthActorExpr};`,
+            `  if (!birthActor) fail(${JSON.stringify(`child birth ${cb.parentDomain}/${cb.birthDirectiveId} is gated by .requires("${cb.birthRequiresRelation}") but the proof could not derive an actor from ${cb.birthActorField}`)});`,
+          ]
+        : [
+            `  const birthActor = PRINCIPAL;`,
+          ]
+    ),
+    ...(setup !== undefined
+      ? [
+          `  // Parent setup: this child birth is gated by authority seeded when the parent workspace is born.`,
+          `  const setupPayload: Record<string, unknown> = { ...${JSON.stringify(setup.birthPayload)} };`,
+          ...(setup.birthActorField !== undefined && cb.birthActorField !== undefined
+            ? [`  setupPayload[${JSON.stringify(setup.birthActorField)}] = birthPayload[${JSON.stringify(cb.birthActorField)}];`]
+            : []),
+          ...(setup.frameworkHashField !== undefined ? [`  setupPayload[${JSON.stringify(setup.frameworkHashField)}] = await frameworkHashFor(WS);`] : []),
+          ...(setup.lawHashField !== undefined ? [`  setupPayload[${JSON.stringify(setup.lawHashField)}] = ${hashConst};`] : []),
+          ...setup.birthAutoStamped.map((f) => `  setupPayload[${JSON.stringify(f)}] = new Date().toISOString();`),
+          `  const setupActor = ${actorExpr(setup.birthActorField, "setupPayload") ?? "birthActor"} || birthActor;`,
+          `  const sr = await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/${setup.birthDirectiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": setupActor }, body: JSON.stringify(setupPayload) });`,
+          `  const sd = await sr.json();`,
+          `  if (!sd.ok) fail(\`parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: \${JSON.stringify(sd)}\`);`,
+          `  const setupBorn: Array<{ workspace?: string }> = sd.born ?? [];`,
+          `  const birthParentWs = setupBorn[0]?.workspace;`,
+          `  if (!birthParentWs) fail(\`parent setup admitted but spawned no workspace (born=\${JSON.stringify(setupBorn)})\`);`,
+          `  ok(\`parent setup — \${birthParentWs} born by ${setup.parentDomain}/${setup.birthDirectiveId} before gated child birth\`);`,
+        ]
+      : [
+          `  const birthParentWs = WS;`,
+        ]),
     ...(cb.frameworkHashField !== undefined
       ? [
           `  // The framework CONTROLLER hash (the bootstrap install-target the child runs as intent 0) — read it`,
           `  // from the workspace's own status (the kernel's controllerHash); the child install resolves the bytes`,
           `  // by hash from the parent's custody, so this MUST be the real framework hash (a guess would fail).`,
-          `  const st = await (await fetch(\`\${CLOUD}/v2/workspaces/\${WS}\`)).json().catch(() => ({}));`,
-          `  const frameworkHash = st.controller?.domainHash ?? st.controllerHash ?? "";`,
-          `  if (!frameworkHash) fail("could not resolve the framework controller hash from the workspace status — needed for the child's in-chain installDomain");`,
-          `  birthPayload[${JSON.stringify(cb.frameworkHashField)}] = frameworkHash;`,
+          `  birthPayload[${JSON.stringify(cb.frameworkHashField)}] = await frameworkHashFor(birthParentWs);`,
         ]
       : []),
     `  birthPayload[${JSON.stringify(cb.lawHashField ?? "lawHash")}] = ${hashConst};`,
     ...cb.birthAutoStamped.map((f) => `  birthPayload[${JSON.stringify(f)}] = new Date().toISOString();`),
-    `  const br = await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/${cb.birthDirectiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": PRINCIPAL }, body: JSON.stringify(birthPayload) });`,
+    `  const br = await fetch(\`\${CLOUD}/v2/workspaces/\${birthParentWs}/${cb.birthDirectiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": birthActor }, body: JSON.stringify(birthPayload) });`,
     `  const bd = await br.json();`,
     `  if (!bd.ok) fail(\`child birth offer ${cb.parentDomain}/${cb.birthDirectiveId} refused: \${JSON.stringify(bd)}\`);`,
     `  const born: Array<{ workspace?: string }> = bd.born ?? [];`,