@githolon/dsl 0.42.0 → 0.44.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/aggregate.ts

@@ -313,6 +313,14 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
       ? { hasInvariant: true as const, invariant: composedInvariant }
       : {}),
     ...(fromBirthFields.length > 0 ? { fromBirthFields } : {}),
+    // VALUE-FREE INVARIANT (nomosFlowGate rule 4a): when the ONLY invariant is the synthesized
+    // fromBirth presence check, its refusal correlates with STRUCTURE the law itself guarantees
+    // publicly (a fromBirth field is present on every lawful row) — never with a secret VALUE.
+    // The flow gate exempts it from the declassify requirement; ANY user invariant (which may
+    // read plaintext values) re-arms the rule.
+    ...(fromBirthFields.length > 0 && userInvariant === undefined
+      ? { invariantValueFree: true as const }
+      : {}),
     ...(opts?.invariantDeclassify !== undefined ? { invariantDeclassify: opts.invariantDeclassify } : {}),
     ...(opts?.cap !== undefined ? { cap: opts.cap } : {}),
     ...(opts?.global === true ? { global: true } : {}),

package/src/codegen_dart.ts

@@ -1392,6 +1392,10 @@ function voToJsonExpr(f: ValueObjectFieldDescriptor, expr: string, depth = 0): s
  * per file when the file emits ≥1 VO class (`toJson()`-based value equality). */
 function emitVoHelpers(): string {
   return [
+    `/// The copyWith ABSENT-vs-null sentinel: an omitted optional param keeps the current`,
+    `/// value; an explicit \`null\` clears it. (Dart cannot distinguish the two otherwise.)`,
+    `const Object _voUnset = Object();`,
+    ``,
     `/// Deep json equality for generated value-object classes (toJson-based).`,
     `bool _voJsonEq(Object? a, Object? b) {`,
     `  if (a is Map && b is Map) {`,
@@ -1428,6 +1432,36 @@ function emitVoHelpers(): string {
  * `toJson` (the authored payload shape — optionals OMITTED when null, matching the zod
  * `.optional()` contract), and toJson-based value equality. A `geo.*` VO emits the
  * fixed RFC 7946 shape (typed `coordinates`; `type` is the constant geometry kind). */
+/** The generated `copyWith` for a VO/arm class: non-nullable fields take an optional param
+ * (`?? this.x` — they cannot be cleared; presence is the type's contract); OPTIONAL fields use
+ * the `_voUnset` sentinel so `copyWith()` keeps the value while `copyWith(x: null)` CLEARS it —
+ * the two intents Dart's named params cannot otherwise distinguish. The Dart idiom for the TS
+ * spread (dart_codegen_parity.md P3). */
+function emitCopyWith(
+  cls: string,
+  fields: readonly { member: string; dartType: string; optional: boolean }[],
+): string[] {
+  if (fields.length === 0) return [];
+  const params = fields.map((x) =>
+    x.optional ? `    Object? ${x.member} = _voUnset,` : `    ${x.dartType}? ${x.member},`,
+  );
+  const args = fields.map((x) =>
+    x.optional
+      ? `        ${x.member}: identical(${x.member}, _voUnset) ? this.${x.member} : ${x.member} as ${x.dartType}?,`
+      : `        ${x.member}: ${x.member} ?? this.${x.member},`,
+  );
+  return [
+    `  /// A copy with the given fields replaced. Omitting an optional param keeps its value;`,
+    `  /// passing \`null\` explicitly CLEARS it (the _voUnset sentinel distinguishes the two).`,
+    `  ${cls} copyWith({`,
+    ...params,
+    `  }) =>`,
+    `      ${cls}(`,
+    ...args,
+    `      );`,
+  ];
+}
+
 /** Emit a `union(...)` as a SEALED Dart hierarchy: the sealed base (decode switch on the
  * blessed `type` discriminator + abstract `toJson`), one final arm class per arm (anonymous
  * arms carry their fields; NAMED-VO arms hold a single `value` of the named class), and the
@@ -1441,6 +1475,8 @@ function emitUnionClasses(d: ValueObjectDescriptor): string {
     `/// Union \`${d.name}\` — a sum type stored as ONE json leaf (wholesale-replace; the`,
     `/// \`type\` discriminator names the arm). Adding an arm is ADDITIVE (older clients decode`,
     `/// it as [${d.name}Unknown]); removing/renaming an arm is a retype (#58 dispositions).`,
+    `/// \`.encrypted()\` on a field of this type seals the WHOLE leaf — discriminator included;`,
+    `/// per-arm sensitivity cannot be split (model differently-classified arms as separate fields).`,
     `sealed class ${d.name} {`,
     `  const ${d.name}();`,
     `  Map<String, Object?> toJson();`,
@@ -1464,6 +1500,9 @@ function emitUnionClasses(d: ValueObjectDescriptor): string {
         `      ${cls}(${arm.ref}.fromProjected((m['value']! as Map).cast<String, Object?>()));`,
         `  @override`,
         `  Map<String, Object?> toJson() => <String, Object?>{'type': '${key}', 'value': value.toJson()};`,
+        ``,
+        `  /// A copy with [value] replaced.`,
+        `  ${cls} copyWith({${arm.ref}? value}) => ${cls}(value ?? this.value);`,
         `  @override`,
         `  bool operator ==(Object other) => other is ${cls} && _voJsonEq(other.toJson(), toJson());`,
         `  @override`,
@@ -1512,6 +1551,8 @@ function emitUnionClasses(d: ValueObjectDescriptor): string {
       ...literalToLines,
       ...toLines,
       `      };`,
+      ``,
+      ...emitCopyWith(cls, fields.map((x) => ({ member: x.member, dartType: dartTypeOfVoField(x.f, cls, x.wireName), optional: x.optional }))),
       `  @override`,
       `  bool operator ==(Object other) => other is ${cls} && _voJsonEq(other.toJson(), toJson());`,
       `  @override`,
@@ -1624,6 +1665,8 @@ function emitValueObjectClass(d: ValueObjectDescriptor): string {
       `        'coordinates': coordinates,`,
       `      };`,
       ``,
+      ...emitCopyWith(d.name, [{ member: "coordinates", dartType: coordsType, optional: false }]),
+      ``,
       `  @override`,
       `  bool operator ==(Object other) =>`,
       `      other is ${d.name} && _voJsonEq(other.toJson(), toJson());`,
@@ -1686,6 +1729,8 @@ function emitValueObjectClass(d: ValueObjectDescriptor): string {
     ...toLines,
     `      };`,
     ``,
+    ...emitCopyWith(d.name, fields.map((x) => ({ member: x.member, dartType: dartTypeOfVoField(x.f, d.name, x.wireName), optional: x.optional }))),
+    ``,
     `  @override`,
     `  bool operator ==(Object other) =>`,
     `      other is ${d.name} && _voJsonEq(other.toJson(), toJson());`,

package/src/flow_gate.ts

@@ -38,6 +38,10 @@ type FlowModule = {
   readonly aggregates?: readonly {
     readonly id: string;
     readonly hasInvariant?: boolean;
+    /** True when the invariant is PROVABLY value-free (only the synthesized fromBirth
+     * presence check — no user predicate). Its refusal correlates with law-guaranteed
+     * structure, never a secret value, so rule 4a exempts it from declassify. */
+    readonly invariantValueFree?: boolean;
     readonly invariantDeclassify?: string;
     readonly encryptedFields?: readonly string[];
     readonly fields?: Record<string, unknown>;
@@ -150,6 +154,9 @@ export function assertFlowGate(m: CanonicalManifest, mod?: FlowModule): void {
     // 4a — an aggregate `invariant` over a private aggregate with a plaintext field.
     for (const a of mod.aggregates ?? []) {
       if (!a.hasInvariant || !privateTypes.has(a.id) || a.invariantDeclassify) continue;
+      // A VALUE-FREE invariant (the synthesized fromBirth presence check alone) refuses only on
+      // ABSENCE of a field the law guarantees present — structure, not secret. No declassify needed.
+      if (a.invariantValueFree === true) continue;
       const enc = new Set(a.encryptedFields ?? []);
       const hasPlaintext = Object.keys(a.fields ?? {}).some((f) => !enc.has(f));
       if (!hasPlaintext) continue; // fully-encrypted: the invariant reads only ciphertext — can't leak this way
@@ -166,8 +173,19 @@ export function assertFlowGate(m: CanonicalManifest, mod?: FlowModule): void {
       let refs: readonly { readonly aggregate: string }[];
       try {
         refs = wi.reads({ intent: new Proxy({}, { get: () => "" }) as Record<string, unknown>, principal: "" }) ?? [];
-      } catch {
-        continue; // the read-set can't be resolved on a probe intent — skip (no false refusal; conservative on availability)
+      } catch (e) {
+        // THE 4b PROBE HOLE, CLOSED (classified_first_class.md §2.1): a read-set that cannot be
+        // resolved on the probe used to be SKIPPED — "conservative on availability" was a hole on
+        // SAFETY (an invariant could escape rule 4 by accident of a throwing reads()). On a domain
+        // that HAS private types, an unresolvable read-set now REFUSES: make reads() total over a
+        // probe intent (every field reads as ""), or declare declassify if the read-set is
+        // genuinely intent-dependent and touches private state.
+        throw new FlowGateError(
+          `[nomosFlowGate rule 4b — unresolvable read-set] workspaceInvariant '${wi.id}' on '${wi.on}': its ` +
+            `.reads() threw on the compile probe (${String((e as Error)?.message ?? e).slice(0, 120)}) so the gate ` +
+            `cannot prove the refusal is secret-free while this domain declares private types. Make .reads() total ` +
+            `over a probe intent (every intent field reads as ""), or acknowledge with .declassify("<why>").`,
+        );
       }
       for (const r of refs) {
         const short = r.aggregate.includes(".") ? r.aggregate.slice(r.aggregate.lastIndexOf(".") + 1) : r.aggregate;