@githolon/dsl 0.80.1 → 0.80.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.80.1",
+  "version": "0.80.2",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/compile_package_main.ts

@@ -124,6 +124,7 @@ import {
 } from "./stable_ids.js";
 import { emitUsd, type UsdLayer } from "./usd.js";
 import { emitLayeredRelationUsda, type RelationLayerInput } from "./relation_composition.js";
+import { assertNoDartBarrelCollisions, type BarrelExportedFile } from "./dart_barrel_guard.js";
 import { generateTsClient, tsClientFactoryName, recursiveLazyTypes } from "./codegen_ts.js";
 import { generateOpenApiFragment, mergeOpenApiFragments } from "./codegen_openapi.js";
 import { domainInterface, type DomainInterface } from "./shape_compat.js";
@@ -892,6 +893,17 @@ function emitDart(
   //    dedup above makes the exports collision-free by construction; re-exporting the same library
   //    through two paths — e.g. a client's own `nomos_framework.dart` re-export — is not ambiguous).
   const genRel = DART_GENERATED_SUBDIR.split(path.sep).join("/");
+  // STRUCTURAL GUARD (dart_barrel_guard.ts): the barrel flat-exports every generated TYPES file, so no
+  // public name may be declared in ≥2 of them — else `dart analyze` fails the package with
+  // ambiguous_export. Refuse the compile NOW (before we write an uncompilable surface) with a named,
+  // actionable error. The framework-shared dedup keeps this green; this catches any future gap in it.
+  try {
+    assertNoDartBarrelCollisions(
+      [...sourceByFile.entries()].map(([label, src]): BarrelExportedFile => ({ label, src })),
+    );
+  } catch (e) {
+    fail((e as Error).message);
+  }
   const barrelLines = [
     "// GENERATED by nomos-compile — the package's public entrypoint. DO NOT EDIT.",
     "// Regenerated on every compile; generated implementation lives under src/generated/.",
@@ -1196,6 +1208,16 @@ function emitDartPackages(
         `// Import a domain with a prefix instead, e.g. \`import '${genRel}/<domain>.dart' as <domain>;\`.`,
       ]
     : [];
+  // STRUCTURAL GUARD (dart_barrel_guard.ts): refuse a types barrel that would flat-export the SAME public
+  // name from ≥2 files (ambiguous_export). Only the files the barrel ACTUALLY flat-exports are checked —
+  // under `barrelExports: 'explicit'` per-domain files are withheld, so they cannot collide there.
+  try {
+    assertNoDartBarrelCollisions(
+      typesExportKeys.map((f): BarrelExportedFile => ({ label: f, src: typesSources.get(f) ?? "" })),
+    );
+  } catch (e) {
+    fail((e as Error).message);
+  }
   const typesBarrel = [
     "// GENERATED by nomos-compile — the TYPES package's public entrypoint. DO NOT EDIT.",
     "// Pure data: payload classes, read models, VOs/enums, typed read accessors over the",

package/src/dart_barrel_guard.ts

@@ -0,0 +1,78 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth. ⇒ ONE Nomos GitHolon wasm.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * DART BARREL COLLISION GUARD — compile self-refuses an uncompilable Dart surface.
+ *
+ * A Nomos package's generated Dart is exposed through ONE package barrel that FLAT-EXPORTS each
+ * generated file (`export 'src/generated/estate.dart';`, …). Dart's `export` brings every PUBLIC
+ * top-level declaration into the barrel's namespace; if the SAME public name is declared in ≥2
+ * flat-exported files, `dart analyze` fails the whole package with `ambiguous_export` — an error the
+ * tenant cannot fix without hand-editing generated code or restructuring their package.
+ *
+ * The framework-shared dedup (`nomos_framework.dart`) is meant to make this impossible by
+ * construction (framework symbols emit ONCE), but any gap in that dedup — a framework payload class
+ * NOT routed to the shared file, a VO emitted per-domain — reintroduces the collision silently. This
+ * guard is the STRUCTURAL backstop: we KNOW the public names we emit and which files the barrel
+ * flat-exports, so we detect the ambiguity at COMPILE time (no `dart analyze` needed) and REFUSE with
+ * a named, actionable error. Third occurrence of this bug class in layered Dart — this closes it for good.
+ */
+
+/** One flat-exported generated file the barrel re-exports: a human label (the domain / file name) + its Dart source. */
+export interface BarrelExportedFile {
+  /** The file's identifying label used in the error message (e.g. the domain key `estate`). */
+  readonly label: string;
+  /** The generated Dart source. */
+  readonly src: string;
+}
+
+/** Declared PUBLIC top-level type/typedef names in a Dart source (class/enum/mixin/extension type/typedef).
+ *  Private (`_`-prefixed) names never leak through an `export`, so they cannot collide — excluded. */
+export function publicDartDeclarations(src: string): Set<string> {
+  const names = new Set<string>();
+  const re =
+    /^(?:abstract\s+|base\s+|final\s+|sealed\s+|interface\s+|mixin\s+)*(?:class|enum|mixin|extension type|typedef)\s+([A-Za-z][A-Za-z0-9_]*)/gm;
+  for (let m = re.exec(src); m !== null; m = re.exec(src)) {
+    if (!m[1]!.startsWith("_")) names.add(m[1]!);
+  }
+  return names;
+}
+
+/** name → the sorted labels of the flat-exported files that each DECLARE it. Only entries with ≥2 files
+ *  are collisions (an `ambiguous_export`); a name declared in exactly one file is fine. */
+export function findDartBarrelCollisions(
+  files: readonly BarrelExportedFile[],
+): Map<string, string[]> {
+  const byName = new Map<string, Set<string>>();
+  for (const f of files) {
+    for (const name of publicDartDeclarations(f.src)) {
+      const set = byName.get(name) ?? new Set<string>();
+      set.add(f.label);
+      byName.set(name, set);
+    }
+  }
+  const collisions = new Map<string, string[]>();
+  for (const [name, labels] of byName) {
+    if (labels.size >= 2) collisions.set(name, [...labels].sort());
+  }
+  return collisions;
+}
+
+/** THROW a named, actionable error if the flat-exported files declare any public name more than once.
+ *  Green (no-op) when the surface is collision-free — the state every valid package MUST be in. */
+export function assertNoDartBarrelCollisions(files: readonly BarrelExportedFile[]): void {
+  const collisions = findDartBarrelCollisions(files);
+  if (collisions.size === 0) return;
+  const lines = [...collisions.entries()]
+    .sort(([a], [b]) => (a < b ? -1 : 1))
+    .map(([name, labels]) => `  • '${name}' is declared in ${labels.map((l) => `'${l}'`).join(", ")}`);
+  throw new Error(
+    `generated Dart would not compile — the package barrel flat-exports the SAME public name from ` +
+      `multiple files, so 'dart analyze' fails with ambiguous_export:\n${lines.join("\n")}\n` +
+      `A public name emitted per-domain must be FRAMEWORK-SHARED (emitted ONCE in nomos_framework.dart) ` +
+      `— this is a compiler bug, not a tenant one; do not hand-edit generated code. If a FRAMEWORK ` +
+      `directive/aggregate/value-object payload is colliding, it must carry the framework brand so the ` +
+      `dedup routes it to the shared file (see framework_aggregates.ts / secondary_ensure.ts).`,
+  );
+}

package/src/secondary_ensure.ts

@@ -53,10 +53,22 @@ export function sanctioningEnsureDirectiveId(aggId: string): string {
  * lane for a plan's secondary deterministic `ensure(agg, …)`.
  */
 export function sanctioningEnsureDirective(agg: AggregateHandle): Directive<unknown> {
-  return directive(sanctioningEnsureDirectiveId(agg.id))
+  const dir = directive(sanctioningEnsureDirectiveId(agg.id))
     .ensures(agg)
     .payload(z.object({}).strict())
     .plan(() => []) as unknown as Directive<unknown>;
+  // FRAMEWORK-SHARED DEDUP (Dart codegen): when the sanctioned aggregate is a FRAMEWORK singleton
+  // (e.g. RelationTuple — auto-ensured into EVERY relation-using domain), this directive is injected
+  // per-domain but its payload class (`NomosEnsure_<Agg>Payload`, zero-field) is byte-identical across
+  // all of them. Left unbranded, each domain's Dart file re-defines the class and a layered types
+  // barrel flat-exporting ≥2 domains collides (`ambiguous_export`). Brand it framework — exactly the
+  // `nomosSourceFrontierEnsure` precedent — so its payload dedups into `nomos_framework.dart` ONCE.
+  // A sanction over a TENANT aggregate stays per-domain (its aggregate lives in that one domain, so no
+  // cross-domain collision is possible) — hence gating on the framework brand, not blanket branding.
+  if ((agg as { framework?: true }).framework === true) {
+    (dir as { framework?: true }).framework = true;
+  }
+  return dir;
 }
 
 /**