@githolon/dsl 0.61.1 → 0.61.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.61.1",
+  "version": "0.61.3",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_proof.ts

@@ -2108,17 +2108,16 @@ export function legsForDomain(mod: DomainModule, modules: readonly DomainModule[
   // only the first left the other children compile-valid-only (unprovable through their birth).
   const parentBirths = allBirths.filter((b) => b.parentDomain === domain);
   const childBirths = parentBirths.map((b) => {
-    const withParent = attachParentSetup(b, allBirths);
     // BIRTHS ISOLATION: with >1 birth leg, uniquify each leg's synthesized child so the legs don't collide
     // on one generated child workspace name (the discriminator = the birth directive id, unique per leg).
+    // MUTABLE leg — uniquify does NOT short-circuit the relationSetup attachment below (co2's two sibling
+    // gated births both need BOTH: a distinct child AND the seeded authority chain).
+    let withParent = attachParentSetup(b, allBirths);
     if (parentBirths.length > 1) {
       const birthDir = (mod.directives as Directive<unknown>[]).find((d) => d?.id === b.birthDirectiveId);
       const schema = birthDir?.payloadSchema as z.ZodTypeAny | undefined;
-      const disc = b.birthDirectiveId;
-      const uniq = uniquifyBirthPayload(withParent.birthPayload, disc, schema);
-      if (uniq !== withParent.birthPayload) {
-        return { ...withParent, birthPayload: uniq };
-      }
+      const uniq = uniquifyBirthPayload(withParent.birthPayload, b.birthDirectiveId, schema);
+      if (uniq !== withParent.birthPayload) withParent = { ...withParent, birthPayload: uniq };
     }
     // A GATED birth with no parent-birth authority path: seat its relation via the SAME granter/seed
     // discovery the relation-bootstrap leg uses (the law's own authority path, e.g. co2's
@@ -2340,6 +2339,65 @@ function v2CatchFinally(): string[] {
  * lawHash are injected from the deployed law (the child install resolves bytes by hash from the parent's
  * custody; a `sample-*` hash would fail). The dispatch rides the gateway offer lane (authenticated principal).
  */
+/**
+ * THE LIVE AUTHORITY-CHAIN SEATING for a GATED `.births()` leg (the co2 case). A birth gated by
+ * `.requires(R)` needs its actor to HOLD R before the birth admits — and R may itself be reachable only
+ * through a RECURSIVE chain of grants (co2: seedPlatformFounder → seedPlatformAdmin [grants co2Admin] →
+ * grantCo2EstateCreator [grants co2EstateCreator] → birthEstateWorkspace). This walks the discovered
+ * `relationSetup` chain and emits each step as a cloud dispatch under the SAME `birthActor`, seating every
+ * relation ON that actor (subject/founder/grantedBy fields overwritten to it) — so one actor plays founder,
+ * admin, and creator, ending holding R. Recurses granter-authority-first (deepest prerequisite runs first).
+ * `actorVar`/`wsVar` are the runtime var names the birth leg already binds.
+ */
+function liveAuthorityChainLines(setup: RelationBootstrapLeg, actorVar: string, wsVar: string): string[] {
+  const lines: string[] = [];
+  // 1. the granter's OWN authority first (recursive — the deepest prerequisite is seated before its dependents).
+  if (setup.granterAuthority !== undefined) {
+    lines.push(...liveAuthorityChainLines(setup.granterAuthority, actorVar, wsVar));
+  }
+  // A runtime dispatch: build the payload literal, overwrite subject/founder/grantedBy/routed fields to the
+  // actor (seat the relation ON it), stamp the auto-stamped fields, POST to the parent ws as the actor.
+  const dispatch = (
+    directiveId: string,
+    payload: Record<string, unknown>,
+    routed: readonly string[],
+    autoStamped: readonly string[],
+    label: string,
+  ): string[] => {
+    const overwrite = new Set<string>(routed);
+    const entries = Object.entries(payload).map(([k, v]) =>
+      overwrite.has(k) || /^(subject|principal|grantedBy|grantee|member|user|owner|founder)$/i.test(k)
+        ? `${JSON.stringify(k)}: ${actorVar}`
+        : `${JSON.stringify(k)}: ${JSON.stringify(v)}`,
+    );
+    return [
+      `  {`,
+      `    const cp: Record<string, unknown> = { ${entries.join(", ")} };`,
+      ...autoStamped.map((f) => `    cp[${JSON.stringify(f)}] = new Date().toISOString();`),
+      `    const cr = await fetch(\`\${CLOUD}/v2/workspaces/\${${wsVar}}/${directiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": ${actorVar} }, body: JSON.stringify(cp) });`,
+      `    const cd = await cr.json();`,
+      `    if (!cd.ok) fail(\`authority chain (${label}) ${directiveId} refused: \${JSON.stringify(cd)}\`);`,
+      `    ok(\`authority chain — ${directiveId} seated (as \${${actorVar}})\`);`,
+      `  }`,
+    ];
+  };
+  // 2. this leg's prerequisite seeds (as the actor = founder).
+  for (const seed of setup.prerequisiteSeeds ?? []) {
+    lines.push(...dispatch(seed.directiveId, seed.payload, [], seed.autoStamped, "prerequisite"));
+  }
+  // 3. the grant that seats this leg's relation ON the actor (subject = actor).
+  lines.push(
+    ...dispatch(
+      setup.grantDirectiveId,
+      setup.grantPayload,
+      [...setup.grantSubjectFields, ...setup.grantGrantedByFields],
+      setup.grantAutoStamped,
+      "grant",
+    ),
+  );
+  return lines;
+}
+
 function liveChildBirthLegLines(cb: ChildBirthLeg, opts: TsProofOptions, n: () => number): string[] {
   const hashConst = tsHashConstName(opts.packageName);
   // The birth payload literal: the synthesized values + the REAL hashes onto the discovered fields + the
@@ -2403,6 +2461,14 @@ function liveChildBirthLegLines(cb: ChildBirthLeg, opts: TsProofOptions, n: () =
       : []),
     `  birthPayload[${JSON.stringify(cb.lawHashField ?? "lawHash")}] = ${hashConst};`,
     ...cb.birthAutoStamped.map((f) => `  birthPayload[${JSON.stringify(f)}] = new Date().toISOString();`),
+    // GATED BIRTH: seat the FULL authority chain on birthActor before the birth (co2: seedPlatformFounder →
+    // seedPlatformAdmin → grantCo2EstateCreator → the birth). Without this the .requires(R) birth is refused.
+    ...(cb.relationSetup !== undefined
+      ? [
+          `  // seat the .requires("${cb.birthRequiresRelation}") authority chain on birthActor before the gated birth:`,
+          ...liveAuthorityChainLines(cb.relationSetup, "birthActor", "birthParentWs"),
+        ]
+      : []),
     `  const br = await fetch(\`\${CLOUD}/v2/workspaces/\${birthParentWs}/${cb.birthDirectiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": birthActor }, body: JSON.stringify(birthPayload) });`,
     `  const bd = await br.json();`,
     `  if (!bd.ok) fail(\`child birth offer ${cb.parentDomain}/${cb.birthDirectiveId} refused: \${JSON.stringify(bd)}\`);`,

package/src/compat_package_main.ts

@@ -97,11 +97,29 @@ function loadFileOffer(arg: string): { offer: InterfaceMap; source: string } {
 }
 
 /** Read a LIVE workspace's on-ledger offer via connect() (`@githolon/client`). */
+/**
+ * Parse a live compat target URL into its cloud BASE and workspace. The base is everything BEFORE
+ * `/v2/workspaces/` — NOT just the origin — so a gateway mounted under a PATH PREFIX
+ * (`https://host/nomos/cloud/v2/workspaces/<ws>`) keeps that prefix. Otherwise the client would fetch the
+ * runtime at the wrong base (`https://host/v1/runtime/holon.wasm` 404s instead of
+ * `https://host/nomos/cloud/v1/runtime/holon.wasm`). Split on the marker so an arbitrary-depth prefix
+ * survives; without the marker the whole URL (a `--workspace`-paired base) is the cloud.
+ */
+export function parseLiveTarget(
+  url: string,
+  workspaceFlag?: string,
+): { cloud: string; workspace: string | undefined } {
+  const marker = "/v2/workspaces/";
+  const at = url.indexOf(marker);
+  const cloud = (at >= 0 ? url.slice(0, at) : url.replace(/[?#].*$/, "")).replace(/\/+$/, "");
+  const wsFromUrl = at >= 0 ? url.slice(at + marker.length).split(/[/?#]/)[0] : undefined;
+  const workspace = workspaceFlag ?? (wsFromUrl !== undefined && wsFromUrl !== "" ? wsFromUrl : undefined);
+  return { cloud, workspace };
+}
+
 async function loadLiveOffer(url: string, workspaceFlag?: string): Promise<{ offer: InterfaceMap; source: string }> {
-  const m = /^(https?:\/\/[^/]+)(?:\/v2\/workspaces\/([^/?#]+))?/.exec(url);
-  if (!m) fail(`could not parse the live target URL: ${url}`);
-  const cloud = m[1]!;
-  const workspace = workspaceFlag ?? m[2];
+  if (!/^https?:\/\//.test(url)) fail(`could not parse the live target URL: ${url}`);
+  const { cloud, workspace } = parseLiveTarget(url, workspaceFlag);
   if (!workspace) fail(`live target needs a workspace — use https://host/v2/workspaces/<ws> or add --workspace <ws>`);
   let connect: (opts: { cloud: string; workspace: string }) => Promise<{ interfaceOffer(): Promise<InterfaceMap | null> }>;
   try {
@@ -184,4 +202,9 @@ async function main(): Promise<void> {
   process.exit(incompatible.length > 0 ? 1 : 0);
 }
 
-void main();
+// Run ONLY as the entry point (the compat launcher), never on import (the test imports parseLiveTarget).
+{
+  const { pathToFileURL } = await import("node:url");
+  const entry = process.argv[1];
+  if (entry !== undefined && import.meta.url === pathToFileURL(entry).href) void main();
+}