@githolon/dsl 0.95.2 → 0.96.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.95.2",
+  "version": "0.96.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/build_package.ts

@@ -75,6 +75,7 @@ import { collectValueObjectDescriptors } from "./value_object.js";
 import { emitUsd } from "./usd.js";
 import { expandCapabilityExports } from "./capability_exports.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { AuthProvider, setAuthProvider, authProvider } from "./framework/workspaces.js";
 import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
 import { assertIdOfLint } from "./idof_lint.js";
@@ -209,7 +210,24 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // insertion order does not perturb the hash. Era-safe: only a relation-using domain gains the aggregate,
   // so no existing (relation-free) manifest hash drifts, and a tenant that already had the explicit export
   // sees NO further move (identical bytes).
+  // AUTH-PROVIDER AUTO-COMPOSE — the "a private workspace can always declare a verifier" DX fix (kills the
+  // `no-authprovider-verifier` dead-workspace trap). A package declaring ANY private read (an aggregate
+  // `visibility: requires(cap)` — also the ONLY host for `.encrypted()` fields) MUST be able to author its
+  // identity verifier, else it is born PERMANENTLY unable to verify a reader's token. Auto-carry the framework
+  // `AuthProvider` aggregate + the admin-gated `setAuthProvider` directive (its `.requires("admin")` gate
+  // travels with it, so a SHARED private workspace can't let a non-admin swap the verifier) + the
+  // `authProvider` query — exactly as RelationTuple is carried. Placed BEFORE the usesRelations check so
+  // setAuthProvider's admin gate pulls RelationTuple in too. ERA-SAFE: a PUBLIC package declares no private
+  // aggregate, gains nothing, stays byte-identical; a private package recompiled under this DSL moves hash anyway.
+  const declaresPrivateRead = [...byId.values()].some(
+    (a) => (a as { visibility?: unknown }).visibility !== undefined,
+  );
+  if (declaresPrivateRead) {
+    if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
+    if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
+  }
   const usesRelations =
+    declaresPrivateRead ||
     (spec.relationTypes ?? []).length > 0 ||
     directives.some((d) => (d as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
     directives.some((d) => d.aggregateId === RelationTuple.id);
@@ -311,6 +329,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // `usesRelations` was computed above the aggregate snapshot (so RelationTuple could be injected into the
   // schema); reuse it here to append the audit query. The two MUST agree — the aggregate and the query it
   // returns have to enter the manifest together, or the read projection can't resolve the return schema.
+  // Auth-provider auto-compose (sibling of the RelationTuple query carry): a private package gets the
+  // `authProvider` read so the workspace can surface its declared verifier.
+  if (declaresPrivateRead && !queries.some((q) => q.id === authProvider.id)) {
+    queries.push(authProvider);
+  }
   if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
     queries.push(relationTuplesByObject);
   }