@githolon/dsl 0.61.0 → 0.61.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.61.0",
+  "version": "0.61.2",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -116,6 +116,41 @@ const SUBJECT_CANDIDATES: readonly string[] = [`user:${ZERO_UUID}`, `key:${HEX64
  * schema and return the first that validates. If none fits an exotic constraint, fall back to the
  * readable placeholder (behaviour unchanged from before — that directive is proven by hand).
  */
+/** BIRTHS ISOLATION (multi-`.births()` parent): a parent with SEVERAL birth legs (co2:
+ *  birthCatalogueWorkspace + birthEstateWorkspace) synthesizes the SAME readable `sample-<field>` payloads,
+ *  so each leg's plan DERIVES THE SAME child workspace name and the second birth collides on an
+ *  already-born name. Give each leg a distinct child by suffixing its `sample-`-prefixed string values with
+ *  a per-leg discriminator — but ONLY when the suffixed payload STILL satisfies the directive's own schema
+ *  (a constrained field is left untouched, never broken). A single-birth parent is unaffected (no suffix). */
+function uniquifyBirthPayload(
+  payload: Record<string, unknown>,
+  disc: string,
+  schema: z.ZodTypeAny | undefined,
+): Record<string, unknown> {
+  const suffixed: Record<string, unknown> = {};
+  let changed = false;
+  for (const [k, v] of Object.entries(payload)) {
+    if (typeof v === "string" && v.startsWith("sample-")) { suffixed[k] = `${v}-${disc}`; changed = true; }
+    else suffixed[k] = v;
+  }
+  if (!changed) return payload;
+  // Re-validate PER FIELD (the birthPayload has its framework/law-hash fields deleted — they are injected at
+  // runtime — so a whole-payload parse would spuriously fail on the missing required fields). For a
+  // ZodObject we check each suffixed value against ITS OWN field schema; a field whose schema rejects the
+  // suffix (a length/regex bound) is reverted to its original value (never break a constrained field).
+  const shape =
+    schema !== undefined && typeof (schema as { shape?: unknown }).shape === "object"
+      ? ((schema as unknown as { shape: Record<string, z.ZodTypeAny> }).shape)
+      : undefined;
+  for (const [k, v] of Object.entries(suffixed)) {
+    const orig = payload[k];
+    if (v === orig) continue;
+    const fieldSchema = shape?.[k];
+    if (fieldSchema !== undefined && !fieldSchema.safeParse(v).success) suffixed[k] = orig; // revert the constrained field
+  }
+  return suffixed;
+}
+
 function sampleString(zt: z.ZodTypeAny, field: string): string {
   const readable = `sample-${field}`;
   if (zt.safeParse(readable).success) return readable;
@@ -2071,8 +2106,20 @@ export function legsForDomain(mod: DomainModule, modules: readonly DomainModule[
   // The child-birth legs (one per `.births()` directive) — discovered by running each plan. A parent
   // with SEVERAL births (co2: birthCatalogueWorkspace + birthEstateWorkspace) keeps EVERY leg; keeping
   // only the first left the other children compile-valid-only (unprovable through their birth).
-  const childBirths = allBirths.filter((b) => b.parentDomain === domain).map((b) => {
+  const parentBirths = allBirths.filter((b) => b.parentDomain === domain);
+  const childBirths = parentBirths.map((b) => {
     const withParent = attachParentSetup(b, allBirths);
+    // BIRTHS ISOLATION: with >1 birth leg, uniquify each leg's synthesized child so the legs don't collide
+    // on one generated child workspace name (the discriminator = the birth directive id, unique per leg).
+    if (parentBirths.length > 1) {
+      const birthDir = (mod.directives as Directive<unknown>[]).find((d) => d?.id === b.birthDirectiveId);
+      const schema = birthDir?.payloadSchema as z.ZodTypeAny | undefined;
+      const disc = b.birthDirectiveId;
+      const uniq = uniquifyBirthPayload(withParent.birthPayload, disc, schema);
+      if (uniq !== withParent.birthPayload) {
+        return { ...withParent, birthPayload: uniq };
+      }
+    }
     // A GATED birth with no parent-birth authority path: seat its relation via the SAME granter/seed
     // discovery the relation-bootstrap leg uses (the law's own authority path, e.g. co2's
     // seedPlatformFounder → seedPlatformAdmin → grantCo2EstateCreator → birthEstateWorkspace).
@@ -2293,6 +2340,65 @@ function v2CatchFinally(): string[] {
  * lawHash are injected from the deployed law (the child install resolves bytes by hash from the parent's
  * custody; a `sample-*` hash would fail). The dispatch rides the gateway offer lane (authenticated principal).
  */
+/**
+ * THE LIVE AUTHORITY-CHAIN SEATING for a GATED `.births()` leg (the co2 case). A birth gated by
+ * `.requires(R)` needs its actor to HOLD R before the birth admits — and R may itself be reachable only
+ * through a RECURSIVE chain of grants (co2: seedPlatformFounder → seedPlatformAdmin [grants co2Admin] →
+ * grantCo2EstateCreator [grants co2EstateCreator] → birthEstateWorkspace). This walks the discovered
+ * `relationSetup` chain and emits each step as a cloud dispatch under the SAME `birthActor`, seating every
+ * relation ON that actor (subject/founder/grantedBy fields overwritten to it) — so one actor plays founder,
+ * admin, and creator, ending holding R. Recurses granter-authority-first (deepest prerequisite runs first).
+ * `actorVar`/`wsVar` are the runtime var names the birth leg already binds.
+ */
+function liveAuthorityChainLines(setup: RelationBootstrapLeg, actorVar: string, wsVar: string): string[] {
+  const lines: string[] = [];
+  // 1. the granter's OWN authority first (recursive — the deepest prerequisite is seated before its dependents).
+  if (setup.granterAuthority !== undefined) {
+    lines.push(...liveAuthorityChainLines(setup.granterAuthority, actorVar, wsVar));
+  }
+  // A runtime dispatch: build the payload literal, overwrite subject/founder/grantedBy/routed fields to the
+  // actor (seat the relation ON it), stamp the auto-stamped fields, POST to the parent ws as the actor.
+  const dispatch = (
+    directiveId: string,
+    payload: Record<string, unknown>,
+    routed: readonly string[],
+    autoStamped: readonly string[],
+    label: string,
+  ): string[] => {
+    const overwrite = new Set<string>(routed);
+    const entries = Object.entries(payload).map(([k, v]) =>
+      overwrite.has(k) || /^(subject|principal|grantedBy|grantee|member|user|owner|founder)$/i.test(k)
+        ? `${JSON.stringify(k)}: ${actorVar}`
+        : `${JSON.stringify(k)}: ${JSON.stringify(v)}`,
+    );
+    return [
+      `  {`,
+      `    const cp: Record<string, unknown> = { ${entries.join(", ")} };`,
+      ...autoStamped.map((f) => `    cp[${JSON.stringify(f)}] = new Date().toISOString();`),
+      `    const cr = await fetch(\`\${CLOUD}/v2/workspaces/\${${wsVar}}/${directiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": ${actorVar} }, body: JSON.stringify(cp) });`,
+      `    const cd = await cr.json();`,
+      `    if (!cd.ok) fail(\`authority chain (${label}) ${directiveId} refused: \${JSON.stringify(cd)}\`);`,
+      `    ok(\`authority chain — ${directiveId} seated (as \${${actorVar}})\`);`,
+      `  }`,
+    ];
+  };
+  // 2. this leg's prerequisite seeds (as the actor = founder).
+  for (const seed of setup.prerequisiteSeeds ?? []) {
+    lines.push(...dispatch(seed.directiveId, seed.payload, [], seed.autoStamped, "prerequisite"));
+  }
+  // 3. the grant that seats this leg's relation ON the actor (subject = actor).
+  lines.push(
+    ...dispatch(
+      setup.grantDirectiveId,
+      setup.grantPayload,
+      [...setup.grantSubjectFields, ...setup.grantGrantedByFields],
+      setup.grantAutoStamped,
+      "grant",
+    ),
+  );
+  return lines;
+}
+
 function liveChildBirthLegLines(cb: ChildBirthLeg, opts: TsProofOptions, n: () => number): string[] {
   const hashConst = tsHashConstName(opts.packageName);
   // The birth payload literal: the synthesized values + the REAL hashes onto the discovered fields + the
@@ -2356,6 +2462,14 @@ function liveChildBirthLegLines(cb: ChildBirthLeg, opts: TsProofOptions, n: () =
       : []),
     `  birthPayload[${JSON.stringify(cb.lawHashField ?? "lawHash")}] = ${hashConst};`,
     ...cb.birthAutoStamped.map((f) => `  birthPayload[${JSON.stringify(f)}] = new Date().toISOString();`),
+    // GATED BIRTH: seat the FULL authority chain on birthActor before the birth (co2: seedPlatformFounder →
+    // seedPlatformAdmin → grantCo2EstateCreator → the birth). Without this the .requires(R) birth is refused.
+    ...(cb.relationSetup !== undefined
+      ? [
+          `  // seat the .requires("${cb.birthRequiresRelation}") authority chain on birthActor before the gated birth:`,
+          ...liveAuthorityChainLines(cb.relationSetup, "birthActor", "birthParentWs"),
+        ]
+      : []),
     `  const br = await fetch(\`\${CLOUD}/v2/workspaces/\${birthParentWs}/${cb.birthDirectiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": birthActor }, body: JSON.stringify(birthPayload) });`,
     `  const bd = await br.json();`,
     `  if (!bd.ok) fail(\`child birth offer ${cb.parentDomain}/${cb.birthDirectiveId} refused: \${JSON.stringify(bd)}\`);`,

package/src/compat_package_main.ts

@@ -97,11 +97,29 @@ function loadFileOffer(arg: string): { offer: InterfaceMap; source: string } {
 }
 
 /** Read a LIVE workspace's on-ledger offer via connect() (`@githolon/client`). */
+/**
+ * Parse a live compat target URL into its cloud BASE and workspace. The base is everything BEFORE
+ * `/v2/workspaces/` — NOT just the origin — so a gateway mounted under a PATH PREFIX
+ * (`https://host/nomos/cloud/v2/workspaces/<ws>`) keeps that prefix. Otherwise the client would fetch the
+ * runtime at the wrong base (`https://host/v1/runtime/holon.wasm` 404s instead of
+ * `https://host/nomos/cloud/v1/runtime/holon.wasm`). Split on the marker so an arbitrary-depth prefix
+ * survives; without the marker the whole URL (a `--workspace`-paired base) is the cloud.
+ */
+export function parseLiveTarget(
+  url: string,
+  workspaceFlag?: string,
+): { cloud: string; workspace: string | undefined } {
+  const marker = "/v2/workspaces/";
+  const at = url.indexOf(marker);
+  const cloud = (at >= 0 ? url.slice(0, at) : url.replace(/[?#].*$/, "")).replace(/\/+$/, "");
+  const wsFromUrl = at >= 0 ? url.slice(at + marker.length).split(/[/?#]/)[0] : undefined;
+  const workspace = workspaceFlag ?? (wsFromUrl !== undefined && wsFromUrl !== "" ? wsFromUrl : undefined);
+  return { cloud, workspace };
+}
+
 async function loadLiveOffer(url: string, workspaceFlag?: string): Promise<{ offer: InterfaceMap; source: string }> {
-  const m = /^(https?:\/\/[^/]+)(?:\/v2\/workspaces\/([^/?#]+))?/.exec(url);
-  if (!m) fail(`could not parse the live target URL: ${url}`);
-  const cloud = m[1]!;
-  const workspace = workspaceFlag ?? m[2];
+  if (!/^https?:\/\//.test(url)) fail(`could not parse the live target URL: ${url}`);
+  const { cloud, workspace } = parseLiveTarget(url, workspaceFlag);
   if (!workspace) fail(`live target needs a workspace — use https://host/v2/workspaces/<ws> or add --workspace <ws>`);
   let connect: (opts: { cloud: string; workspace: string }) => Promise<{ interfaceOffer(): Promise<InterfaceMap | null> }>;
   try {
@@ -184,4 +202,9 @@ async function main(): Promise<void> {
   process.exit(incompatible.length > 0 ? 1 : 0);
 }
 
-void main();
+// Run ONLY as the entry point (the compat launcher), never on import (the test imports parseLiveTarget).
+{
+  const { pathToFileURL } = await import("node:url");
+  const entry = process.argv[1];
+  if (entry !== undefined && import.meta.url === pathToFileURL(entry).href) void main();
+}