@githolon/dsl 0.49.0 → 0.50.0

package/check_package.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+// `githolon check` launcher — the twin of `compile_package.mjs`: resolve `tsx`
+// (the caller's, else the DSL's own dependency) and run `src/check_package_main.ts`
+// under it (the main dynamically imports the caller's TS domain modules, which
+// needs the tsx ESM loader). Resolution goes through Node's resolver (createRequire),
+// NOT node_modules/.bin paths — hoisted/workspace installs put the bin shims elsewhere.
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const DSL_DIR = path.dirname(fileURLToPath(import.meta.url));
+const MAIN = path.join(DSL_DIR, "src", "check_package_main.ts");
+
+function resolvePkgDir(name, fromDir) {
+  try {
+    const req = createRequire(pathToFileURL(path.join(fromDir, "noop.js")));
+    return path.dirname(req.resolve(`${name}/package.json`));
+  } catch {
+    return undefined;
+  }
+}
+
+const tsxDir = resolvePkgDir("tsx", process.cwd()) ?? resolvePkgDir("tsx", DSL_DIR);
+if (!tsxDir) {
+  console.error("githolon check: tsx not found — reinstall @githolon/dsl (tsx is one of its dependencies)");
+  process.exit(1);
+}
+const tsxPkg = JSON.parse(readFileSync(path.join(tsxDir, "package.json"), "utf8"));
+const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.tsx;
+const tsxCli = path.join(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+
+try {
+  execFileSync(process.execPath, [tsxCli, MAIN, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    cwd: process.cwd(),
+  });
+} catch (e) {
+  process.exit(e.status ?? 1);
+}

package/dart/lib/src/webview_bridge.dart

@@ -292,6 +292,96 @@ class NomosBbox {
       {'minLng': minLng, 'minLat': minLat, 'maxLng': maxLng, 'maxLat': maxLat};
 }
 
+// ── E2E SEALING (the sealing client) — the GENERIC key-custody surface. Generated domain clients bake the
+//   per-domain map + seal/read helpers, but these types are domain-agnostic, so they live here (in the
+//   nomos_client library) exactly like [MissingOfferAuthority] — one definition, re-exported per client. ──
+
+/// A held E2E scope key: the base64 symmetric key + the epoch it belongs to (forward-only rotation).
+class NomosScopeKey {
+  final String scope;
+  final int epoch;
+  final String key;
+  const NomosScopeKey(
+      {required this.scope, required this.epoch, required this.key});
+  Map<String, Object?> toJson() => {'scope': scope, 'epoch': epoch, 'key': key};
+}
+
+/// The app-supplied KEY CUSTODY surface (E2E sealing). Supply one to a generated `<Domain>Client` and its
+/// encrypted directive fields SEAL automatically before dispatch + encrypted read fields DECRYPT
+/// automatically. [WrappedKeyStore] is the default over the on-chain WrappedKeys; an app may implement this
+/// to source keys from secure storage (the key custody policy stays the app's; the protocol plumbing does not).
+abstract class NomosKeyStore {
+  /// The CURRENT (highest-epoch) scope key, for SEALING a write. null ⇒ EncryptionKeyUnavailable.
+  Future<NomosScopeKey?> scopeKey(String scope);
+
+  /// EVERY held key for these scopes (all epochs), injected on reads so old ciphertext also decrypts.
+  Future<List<NomosScopeKey>> readKeys(List<String> scopes);
+}
+
+/// Thrown when a write must seal an encrypted field but the KeyStore holds no key for its scope — the write
+/// NEVER falls through to a plaintext dispatch (the sid-envelope gate would refuse it anyway; we pre-fire).
+class EncryptionKeyUnavailable implements Exception {
+  final String scope;
+  final String field;
+  String get code => 'nomos.crypto.key_unavailable';
+  String get recommendedAction => 'obtainScopeKey';
+  EncryptionKeyUnavailable(this.scope, this.field);
+  @override
+  String toString() =>
+      'EncryptionKeyUnavailable: cannot seal "$field": no scope key held for "$scope" (obtain the cap + wrap the scope epoch first)';
+}
+
+/// THE DEFAULT KeyStore — unwraps this principal's on-chain WrappedKeys with its device secret, caching per
+/// scope. Mirror of the documented reader handshake (e2e_encryption.md): the secret stays client-side, the
+/// operator stays blind. Key custody (where `deviceSecret` lives — enclave, password-derived, …) is the app's.
+class WrappedKeyStore implements NomosKeyStore {
+  final NomosBridge bridge;
+  final String principal;
+  final String deviceSecret;
+  final Map<String, Future<List<NomosScopeKey>>> _cache = {};
+  WrappedKeyStore(
+      {required this.bridge,
+      required this.principal,
+      required this.deviceSecret});
+
+  Future<List<NomosScopeKey>> _loadScope(String scope) {
+    return _cache.putIfAbsent(scope, () async {
+      final rows = await bridge
+          .query('wrappedKeysByRecipient', {'recipientPrincipal': principal});
+      final held = <NomosScopeKey>[];
+      for (final row in rows) {
+        final d = ((row['data'] ?? row) as Map);
+        if (d['scope']?.toString() != scope) continue;
+        final key = await bridge.cryptoUnwrapKey(
+            secret: deviceSecret,
+            hpkeEpk: d['hpkeEpk'].toString(),
+            ct: d['ct'].toString());
+        held.add(NomosScopeKey(
+            scope: scope,
+            epoch: (d['epoch'] as num?)?.toInt() ?? 0,
+            key: key));
+      }
+      held.sort((a, b) => b.epoch - a.epoch);
+      return held;
+    });
+  }
+
+  @override
+  Future<NomosScopeKey?> scopeKey(String scope) async {
+    final ks = await _loadScope(scope);
+    return ks.isEmpty ? null : ks.first;
+  }
+
+  @override
+  Future<List<NomosScopeKey>> readKeys(List<String> scopes) async {
+    final all = <NomosScopeKey>[];
+    for (final s in scopes) {
+      all.addAll(await _loadScope(s));
+    }
+    return all;
+  }
+}
+
 /// The result of [NomosBridge.offerCreates]: the new local [head] plus every aggregate the plan minted.
 class NomosOfferOutcome {
   final String head;
@@ -771,14 +861,78 @@ class NomosBridge {
           Map<String, Object?> args) async =>
       _asMap(await _call('attestationSign', {'args': args}));
 
-  /// A declared query's rows from the local projection.
+  /// A declared query's rows from the local projection. `keys` (E2E sealing) injects the reader's held
+  /// scope keys so encrypted fields AEAD-open in-wasm; absent ⇒ they stay opaque envelopes (today's
+  /// behavior). `principal` stamps the private-read gate (defaults to the connection's bound principal).
+  /// Both are OMITTED from the wire when absent, so a public un-keyed read is byte-identical to before.
   Future<List<Map<String, dynamic>>> query(String queryId,
-          [Map<String, Object?> params = const {}]) async =>
-      _asRows(await _call('query', {'queryId': queryId, 'params': params}));
+          [Map<String, Object?> params = const {},
+          List<NomosScopeKey>? keys,
+          String? principal]) async =>
+      _asRows(await _call('query', {
+        'queryId': queryId,
+        'params': params,
+        ...?_readAuthArgs(keys, principal),
+      }));
+
+  /// A single aggregate by id (the by-id read). `keys`/`principal`: see [query].
+  Future<List<Map<String, dynamic>>> queryById(String id,
+          [List<NomosScopeKey>? keys, String? principal]) async =>
+      _asRows(await _call('queryById', {
+        'id': id,
+        ...?_readAuthArgs(keys, principal),
+      }));
+
+  /// The read auth sidecar (private reads + E2E): `keys`/`principal` as top-level call args, or null when
+  /// neither is present (so the wire is byte-identical to before this existed).
+  Map<String, Object?>? _readAuthArgs(List<NomosScopeKey>? keys, String? principal) {
+    final out = <String, Object?>{};
+    if (principal != null && principal.isNotEmpty) out['principal'] = principal;
+    if (keys != null && keys.isNotEmpty) out['keys'] = keys.map((k) => k.toJson()).toList();
+    return out.isEmpty ? null : out;
+  }
 
-  /// A single aggregate by id (the by-id read).
-  Future<List<Map<String, dynamic>>> queryById(String id) async =>
-      _asRows(await _call('queryById', {'id': id}));
+  /// E2E CRYPTO OPS (operator-blind sealing) — routed to the kernel via the WebView runner. XChaCha isn't in
+  /// WebCrypto/Dart, so these drive the wasm; the scope key + device secret are INJECTED per call and never
+  /// touch the chain. Mirror of the TS holon's crypto seam (@githolon/client).
+  /// Mint an X25519 device keypair for the handshake: `{secret, public}` (base64). Secret stays on device.
+  Future<Map<String, Object?>> cryptoKeygen() async =>
+      _asMap(await _call('cryptoKeygen'));
+
+  /// AUTHOR-SIDE SEAL: encrypt `plaintext` into its on-chain ciphertext envelope, bound to the scope + #58
+  /// stable sids (rename-safe). Returns the envelope string the encrypted field value is written as.
+  Future<String> cryptoSealField(
+          {required String scopeKey,
+          required String scope,
+          required int epoch,
+          required String aggSid,
+          required String fieldSid,
+          required String plaintext}) async =>
+      (_asMap(await _call('cryptoSealField', {
+        'scopeKey': scopeKey,
+        'scope': scope,
+        'epoch': epoch,
+        'aggSid': aggSid,
+        'fieldSid': fieldSid,
+        'plaintext': plaintext,
+      }))['envelope'] ?? '')
+          .toString();
+
+  /// Wrap a scope key TO a recipient's public key (committer side): `{hpkeEpk, ct}` base64 ciphertext.
+  Future<Map<String, Object?>> cryptoWrapKey(
+          {required String recipientPub, required String scopeKey}) async =>
+      _asMap(await _call('cryptoWrapKey',
+          {'recipientPub': recipientPub, 'scopeKey': scopeKey}));
+
+  /// Unwrap an on-chain WrappedKey with this device's secret → the base64 scope key (reader side).
+  Future<String> cryptoUnwrapKey(
+          {required String secret,
+          required String hpkeEpk,
+          required String ct}) async =>
+      (_asMap(await _call('cryptoUnwrapKey',
+                  {'secret': secret, 'hpkeEpk': hpkeEpk, 'ct': ct}))['scopeKey'] ??
+              '')
+          .toString();
 
   /// THE SPATIAL READ: rows of the declared spatial index's of-type whose geometry
   /// intersects [bbox] — an R*Tree probe on the local projection, same row shape as [query].

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -46,7 +46,8 @@
     "dart",
     "!dart/.dart_tool",
     "!dart/build",
-    "compile_package.mjs"
+    "compile_package.mjs",
+    "check_package.mjs"
   ],
   "publishConfig": {
     "access": "public"

package/src/check_package_main.ts

@@ -0,0 +1,83 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded
+// QuickJS engine}.  If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * `githolon check` — the author-time gate as a standalone command
+ * (architecture/author_time_gate.md, slice 1). Loads `nomos.package.mjs`, composes each
+ * domain the SAME way `compile` does (`composeDomainModule` — the one owner of directive
+ * discovery), runs {@link checkDomainModules}, prints the unified report, and exits
+ * non-zero on any REFUSE-level finding. `compile` runs the same twins implicitly.
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { composeDomainModule, type Mod } from "./build_package.js";
+import type { DomainModule } from "./codegen_dart.js";
+import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
+
+interface DomainConfig {
+  key: string;
+  name?: string;
+  modules: string[];
+}
+interface PackageConfig {
+  name: string;
+  domains: DomainConfig[];
+}
+
+function fail(msg: string): never {
+  console.error(`githolon check: ${msg}`);
+  process.exit(2);
+}
+
+/**
+ * Compose the package's domain modules from `nomos.package.mjs` — the check-time subset of what
+ * `compile_package_main` does: import the config, import each domain's TS modules, and hand them to
+ * `composeDomainModule` (the shared composition primitive that discovers directives/aggregates and
+ * applies the secondary-ensure auto-declare). Returns the composed modules ready for the twins.
+ */
+export async function loadComposedModules(configArg: string): Promise<DomainModule[]> {
+  const configPath = path.resolve(process.cwd(), configArg);
+  if (!existsSync(configPath)) fail(`config not found: ${configPath}`);
+  const cfgDir = path.dirname(configPath);
+  const cfgModule = (await import(pathToFileURL(configPath).href)) as { default?: PackageConfig };
+  const cfg = cfgModule.default;
+  if (!cfg || typeof cfg.name !== "string" || !Array.isArray(cfg.domains) || cfg.domains.length === 0) {
+    fail(`config must default-export { name, domains: [{ key, modules }, ...] }`);
+  }
+  const composed: DomainModule[] = [];
+  for (const d of cfg.domains) {
+    if (typeof d.key !== "string" || !Array.isArray(d.modules) || d.modules.length === 0) {
+      fail(`each domain needs { key, modules: [path, ...] }; got ${JSON.stringify(d)}`);
+    }
+    const mods: Mod[] = [];
+    for (const rel of d.modules) {
+      const abs = path.resolve(cfgDir, rel);
+      if (!existsSync(abs)) fail(`domain '${d.key}': module not found: ${abs}`);
+      mods.push((await import(pathToFileURL(abs).href)) as Mod);
+    }
+    composed.push(composeDomainModule({ name: d.name ?? d.key, domain: d.key, modules: mods }));
+  }
+  return composed;
+}
+
+async function main(): Promise<void> {
+  const argv = process.argv.slice(2);
+  const configArg = argv.find((a) => !a.startsWith("--")) ?? "nomos.package.mjs";
+  const modules = await loadComposedModules(configArg);
+  const findings = checkDomainModules(modules);
+
+  console.log(`githolon check: ${findings.length} finding(s)`);
+  for (const line of formatFindings(findings)) {
+    const level = line.includes("REFUSE") ? "  ✗ " : line.includes("WARN") ? "  ⚠ " : "  • ";
+    console.log(level + line);
+  }
+  if (findings.length === 0) console.log("  all clear — no static twin flagged anything");
+
+  process.exit(hasRefusal(findings) ? 1 : 0);
+}
+
+void main();

package/src/codegen_dart_client.ts

@@ -36,7 +36,7 @@ import type { DomainModule } from "./codegen_dart.js";
 import { cap, readModelClassName } from "./codegen_dart.js";
 import { finishCount } from "./count.js";
 import { finishSum } from "./sum.js";
-import { autoStampFields } from "./codegen_ts.js";
+import { autoStampFields, domainEncryptionMap, type EncDomainMap, type InterfaceAggShape } from "./codegen_ts.js";
 
 const camel = (s: string) => s.replace(/[_\s-]+(\w)/g, (_m, c: string) => c.toUpperCase());
 const lcFirst = (s: string) => (s.length ? s[0]!.toLowerCase() + s.slice(1) : s);
@@ -127,6 +127,24 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   const aggById = new Map<string, AggregateHandle>();
   for (const a of mod.aggregates) aggById.set(a.id, a);
 
+  // THE E2E-SEALING MAP (the sealing client) — non-null iff a field is `.encrypted()`. When null NOTHING
+  // below emits (the generated Dart client is byte-identical to a pre-sealing compile). Same map + sids as
+  // the TS client (one source of truth: `domainEncryptionMap`); requires the baked interface for the sids.
+  const encMap: EncDomainMap | null =
+    opts.interface !== undefined
+      ? domainEncryptionMap(mod, opts.interface as { aggregates?: Record<string, InterfaceAggShape> })
+      : null;
+  const encPresent = encMap !== null;
+  /** The distinct scopes a read of `typeId` must inject keys for (empty ⇒ nothing encrypted on it). */
+  const readScopesFor = (typeId: string): string[] => {
+    const r = encMap?.reads?.[typeId];
+    return r === undefined ? [] : [...new Set(Object.values(r).map((x) => x.scope))].sort();
+  };
+  const keysArg = (typeId: string): string => {
+    const scopes = readScopesFor(typeId);
+    return scopes.length ? `, await _readKeys([${scopes.map((s) => dartStr(s)).join(", ")}])` : "";
+  };
+
   const methods: string[] = [];
 
   // ── directives → typed offer ──
@@ -148,6 +166,34 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const gateDoc = gate !== undefined
       ? `  /// GATED: needs an \`actor\` (the \`${gate.relation}\` relation) — throws MissingOfferAuthority otherwise.`
       : "";
+    // E2E SEALING (the sealing client): a directive with `.encrypted()` payload fields SEALS them via the
+    // bound [keyStore] before dispatch (a missing key throws [EncryptionKeyUnavailable] — never a plaintext
+    // write). One async block covers creates + mutate + gated + stamps; `seal: false` is the escape hatch.
+    if (encMap?.directives?.[d.id] !== undefined) {
+      const isCreates = (d as { marker?: string }).marker === "creates";
+      const retType = isCreates ? "NomosOfferOutcome" : "String";
+      const offerFn = isCreates ? "offerCreates" : "offerDirective";
+      methods.push(
+        `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the new local head.`,
+        `  /// Encrypted field(s) are SEALED via the bound [keyStore] before dispatch (pass \`seal: false\` to skip).`,
+        ...(stamps.length > 0 ? [`  /// Omitted ${stamps.map((s) => `\`${s}\``).join(" / ")} auto-stamp(s) ISO now() at offer.`] : []),
+        ...(gateDoc ? [gateDoc] : []),
+        `  Future<${retType}> ${method}(${payloadClass} payload, {bool seal = true}) async {`,
+        ...(gateGuard ? [gateGuard] : []),
+        `    final data = payload.toPayloadJson();`,
+        ...(stamps.length > 0
+          ? [
+              `    final now = DateTime.now().toUtc().toIso8601String();`,
+              ...stamps.map((s) => `    data.putIfAbsent(${dartStr(s)}, () => now);`),
+            ]
+          : []),
+        `    await _sealPayload(data, ${dartStr(d.id)}, seal);`,
+        `    return bridge.${offerFn}(domain: ${dartStr(domain)}, directiveId: ${dartStr(d.id)}, payload: data, actor: actor, domainHash: domainHash);`,
+        `  }`,
+        ``,
+      );
+      continue;
+    }
     if ((d as { marker?: string }).marker === "creates") {
       // LAW-MINTED ID RETURN: a `.creates` plan mints its aggregate id inside the sealed intent (the payload
       // carries none — callers never supply ids). The bridge's offerCreates hands the minted ids back with the
@@ -213,9 +259,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const argMap = `{${q.key.map((k) => `${dartStr(k)}: ${dartKeyParam(k)}`).join(", ")}}`;
     const m = safeMethod(lcFirst(camel(q.id)));
     methods.push(
-      `  /// Declared query \`${q.id}\` (indexed probe — routed by the read manifest).`,
+      `  /// Declared query \`${q.id}\` (indexed probe — routed by the read manifest).${readScopesFor(q.returns).length ? " Encrypted field(s) decrypt when the bound [keyStore] holds the scope key; else they stay opaque envelopes." : ""}`,
       `  Future<List<${model}>> ${m}({${params}}) async =>`,
-      `      (await bridge.query(${dartStr(q.id)}, ${argMap})).map((r) => ${rowToModel(model, "r")}).toList();`,
+      `      (await bridge.query(${dartStr(q.id)}, ${argMap}${keysArg(q.returns)})).map((r) => ${rowToModel(model, "r")}).toList();`,
       ``,
       `  /// Reactive \`${q.id}\` — re-emits on every local change (cancel the subscription to stop).`,
       `  Stream<List<${model}>> watch${cap(camel(q.id))}({${params}}) =>`,
@@ -267,9 +313,9 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     const lc = lcFirst(camel(agg.id));
     const Cap = cap(camel(agg.id));
     methods.push(
-      `  /// Read one ${agg.id} by aggregate id.`,
+      `  /// Read one ${agg.id} by aggregate id.${readScopesFor(agg.id).length ? " Encrypted field(s) decrypt when the bound [keyStore] holds the scope key." : ""}`,
       `  Future<List<${model}>> ${safeMethod(`${lc}ById`)}(String id) async =>`,
-      `      (await bridge.queryById(id)).map((r) => ${rowToModel(model, "r")}).toList();`,
+      `      (await bridge.queryById(id${keysArg(agg.id)})).map((r) => ${rowToModel(model, "r")}).toList();`,
       ``,
       `  /// Watch one ${agg.id} by aggregate id (local reactive read).`,
       `  Stream<List<${model}>> watch${Cap}ById(String id) =>`,
@@ -277,7 +323,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
       ``,
       `  /// Every ${agg.id} (the type-index probe — O(result), not a scan).`,
       `  Future<List<${model}>> ${safeMethod(`list${Cap}s`)}() async =>`,
-      `      (await bridge.query('aggregatesByType', {'__type': ${dartStr(agg.id)}})).map((r) => ${rowToModel(model, "r")}).toList();`,
+      `      (await bridge.query('aggregatesByType', {'__type': ${dartStr(agg.id)}}${keysArg(agg.id)})).map((r) => ${rowToModel(model, "r")}).toList();`,
       ``,
     );
   }
@@ -305,7 +351,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `// client file gives an app the whole typed surface.`,
     `export '${mod.name}.dart';`,
     ...(opts.frameworkImportUri !== undefined ? [`export '${opts.frameworkImportUri}';`] : []),
-    `export '${supportImport}' show NomosBridge, BridgeTransport, NomosBridgeError, MissingOfferAuthority, kWebviewBridgeVersion;`,
+    `export '${supportImport}' show NomosBridge, BridgeTransport, NomosBridgeError, MissingOfferAuthority, kWebviewBridgeVersion${encPresent ? ", NomosScopeKey, NomosKeyStore, EncryptionKeyUnavailable, WrappedKeyStore" : ""};`,
     ``,
     `/// sha256 of the deployed \`.package.usda\` — the installed law this client offers under.`,
     `const String ${hashConst} = ${dartStr(opts.domainHash)};`,
@@ -344,8 +390,18 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `  /// The verified principal uid every offer is authored as (sealed as \`security.actor\` by the one encoder).`,
     `  /// Null ⇒ open (un-gated) authoring; a gated directive then throws [MissingOfferAuthority].`,
     `  final String? actor;`,
-    `  ${className}(this.bridge, {this.domainHash = ${hashConst}, this.actor});`,
+    ...(encPresent
+      ? [
+          ``,
+          `  /// THE KEY CUSTODY surface (E2E sealing). When set, encrypted directive fields SEAL automatically`,
+          `  /// before dispatch and encrypted read fields DECRYPT automatically; null ⇒ ciphertext passes through`,
+          `  /// unchanged (today's behavior). See [WrappedKeyStore] for the default over the on-chain WrappedKeys.`,
+          `  final NomosKeyStore? keyStore;`,
+        ]
+      : []),
+    `  ${className}(this.bridge, {this.domainHash = ${hashConst}, this.actor${encPresent ? ", this.keyStore" : ""}});`,
     ``,
+    ...(encPresent ? dartEncClassMembers(encMap!) : []),
     ...(opts.interface !== undefined
       ? [
           `  /// This client's structural interface requirement (#72) as JSON — hand it to the`,
@@ -370,3 +426,42 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     ``,
   ].join("\n");
 }
+
+/** The in-class E2E-sealing members: the baked map + the seal/read private helpers. */
+function dartEncClassMembers(encMap: EncDomainMap): string[] {
+  return [
+    `  /// The baked E2E-sealing map (compile-time, from the SAME sids the law was compiled with): which`,
+    `  /// directive payload fields seal → { scope, aggSid, fieldSid }, and which read-model fields decrypt.`,
+    `  static final Map<String, dynamic> encryptionMap = (jsonDecode(${dartRawJson(encMap)}) as Map).cast<String, dynamic>();`,
+    ``,
+    `  /// Seal the mapped encrypted fields of \`data\` in place before dispatch. No keyStore / \`seal == false\``,
+    `  /// ⇒ passthrough (today's behavior); a held key seals; a missing key throws [EncryptionKeyUnavailable].`,
+    `  Future<void> _sealPayload(Map<String, dynamic> data, String directiveId, bool seal) async {`,
+    `    if (!seal || keyStore == null) return;`,
+    `    final fields = (encryptionMap['directives'] as Map)[directiveId] as Map?;`,
+    `    if (fields == null) return;`,
+    `    for (final entry in fields.entries) {`,
+    `      final field = entry.key as String;`,
+    `      final m = entry.value as Map;`,
+    `      if (data[field] == null) continue;`,
+    `      final scope = m['scope'] as String;`,
+    `      final sk = await keyStore!.scopeKey(scope);`,
+    `      if (sk == null) throw EncryptionKeyUnavailable(scope, field);`,
+    `      data[field] = await bridge.cryptoSealField(`,
+    `        scopeKey: sk.key, scope: scope, epoch: sk.epoch,`,
+    `        aggSid: m['aggSid'] as String, fieldSid: m['fieldSid'] as String,`,
+    `        plaintext: data[field].toString(),`,
+    `      );`,
+    `    }`,
+    `  }`,
+    ``,
+    `  /// The read keys to inject for \`scopes\`, or null when there is nothing to inject (no keyStore / no`,
+    `  /// held keys) — the read then behaves exactly as today (encrypted fields stay opaque envelopes).`,
+    `  Future<List<NomosScopeKey>?> _readKeys(List<String> scopes) async {`,
+    `    if (keyStore == null || scopes.isEmpty) return null;`,
+    `    final keys = await keyStore!.readKeys(scopes);`,
+    `    return keys.isEmpty ? null : keys;`,
+    `  }`,
+    ``,
+  ];
+}

package/src/codegen_proof.ts

@@ -1384,7 +1384,7 @@ export interface ChildBirthParentSetup {
 /** A stub `nomos` global (mint + sha256) so a `.births()` plan that mints / hashes a child name runs to
  *  completion at codegen. The hash is a deterministic STUB (the codegen never needs the real digest — the
  *  recipe's workspace is read at RUNTIME from the offer's `born`); mint mirrors `harvestPrincipalFlows`. */
-function withBirthProbeGlobals<T>(run: () => T): T {
+export function withBirthProbeGlobals<T>(run: () => T): T {
   const g = globalThis as unknown as { nomos?: { mint?: (t: string) => string; sha256?: (s: string) => string; read?: unknown } };
   const had = "nomos" in g;
   const prior = g.nomos;