@githolon/dsl 0.95.1 → 0.96.0

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.5.0"
+    version: "0.6.0"
   package_config:
     dependency: transitive
     description:

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.59.0
+version: 0.60.0
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.95.1",
+  "version": "0.96.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/build_package.ts

@@ -75,6 +75,7 @@ import { collectValueObjectDescriptors } from "./value_object.js";
 import { emitUsd } from "./usd.js";
 import { expandCapabilityExports } from "./capability_exports.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { AuthProvider, setAuthProvider, authProvider } from "./framework/workspaces.js";
 import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
 import { assertIdOfLint } from "./idof_lint.js";
@@ -209,7 +210,24 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // insertion order does not perturb the hash. Era-safe: only a relation-using domain gains the aggregate,
   // so no existing (relation-free) manifest hash drifts, and a tenant that already had the explicit export
   // sees NO further move (identical bytes).
+  // AUTH-PROVIDER AUTO-COMPOSE — the "a private workspace can always declare a verifier" DX fix (kills the
+  // `no-authprovider-verifier` dead-workspace trap). A package declaring ANY private read (an aggregate
+  // `visibility: requires(cap)` — also the ONLY host for `.encrypted()` fields) MUST be able to author its
+  // identity verifier, else it is born PERMANENTLY unable to verify a reader's token. Auto-carry the framework
+  // `AuthProvider` aggregate + the admin-gated `setAuthProvider` directive (its `.requires("admin")` gate
+  // travels with it, so a SHARED private workspace can't let a non-admin swap the verifier) + the
+  // `authProvider` query — exactly as RelationTuple is carried. Placed BEFORE the usesRelations check so
+  // setAuthProvider's admin gate pulls RelationTuple in too. ERA-SAFE: a PUBLIC package declares no private
+  // aggregate, gains nothing, stays byte-identical; a private package recompiled under this DSL moves hash anyway.
+  const declaresPrivateRead = [...byId.values()].some(
+    (a) => (a as { visibility?: unknown }).visibility !== undefined,
+  );
+  if (declaresPrivateRead) {
+    if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
+    if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
+  }
   const usesRelations =
+    declaresPrivateRead ||
     (spec.relationTypes ?? []).length > 0 ||
     directives.some((d) => (d as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
     directives.some((d) => d.aggregateId === RelationTuple.id);
@@ -311,6 +329,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // `usesRelations` was computed above the aggregate snapshot (so RelationTuple could be injected into the
   // schema); reuse it here to append the audit query. The two MUST agree — the aggregate and the query it
   // returns have to enter the manifest together, or the read projection can't resolve the return schema.
+  // Auth-provider auto-compose (sibling of the RelationTuple query carry): a private package gets the
+  // `authProvider` read so the workspace can surface its declared verifier.
+  if (declaresPrivateRead && !queries.some((q) => q.id === authProvider.id)) {
+    queries.push(authProvider);
+  }
   if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
     queries.push(relationTuplesByObject);
   }

package/src/compile_package_main.ts

@@ -1047,11 +1047,11 @@ const DART_TYPES_IMPORT = `import 'package:nomos_types/nomos_types.dart';`;
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.5.0";
+const NOMOS_TYPES_DEP = "^0.6.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.58.0";
+const NOMOS_CLIENT_DEP = "^0.60.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).