@githolon/dsl 0.100.6 → 0.101.1

package/dart/test/webview_bridge_test.dart

@@ -136,6 +136,88 @@ class FakeRunner implements BridgeTransport {
         case 'lawStatus':
           _incoming.add(reply({'installed': true, 'drifted': false}));
           break;
+        case 'cryptoOwnedDeviceRequest':
+          _incoming.add(reply({'request': 'opaque-owned-device-request'}));
+          break;
+        case 'cryptoOwnedPrepareApproval':
+          _incoming.add(reply({
+            'newKeySubject': 'key:${'a' * 64}',
+            'ownedCustody': 'opaque-owned-custody',
+            'verifiedVia': 'nomos:test-root',
+            'validFromEpoch': 0,
+            'approvedAt': '2026-07-18T14:20:00.000Z',
+          }));
+          break;
+        case 'cryptoOwnedScopeKeys':
+          _incoming.add(reply({
+            'keys': [
+              {
+                'scope': 'notes.Note:note-1#owned-reader',
+                'epoch': 2,
+                'key': 'opaque-record-key',
+              }
+            ]
+          }));
+          break;
+        case 'cryptoOwnedEnsureIdentity':
+          _incoming.add(reply({'ready': true}));
+          break;
+        case 'cryptoOwnedPrepareRecordAction':
+          _incoming.add(reply({
+            'recordId': 'note-1',
+            'peer': 'user:bob',
+            'epoch': 2,
+            'wraps': <Object?>[],
+          }));
+          break;
+        case 'adoptGeneratedModel':
+          _incoming.add(reply({
+            'verdict': {
+              'ok': false,
+              'stage': 'acceptance',
+              'report': {
+                'replayedIntents': 2,
+                'candidateIntents': 2,
+                'projection': {'equal': false},
+                'divergences': [
+                  {
+                    'kind': 'plan-divergence',
+                    'directiveId': 'registerSite',
+                  }
+                ],
+              },
+              'error': 'exact history changes under the candidate',
+            }
+          }));
+          break;
+        case 'restorePreviousGeneratedModel':
+          _incoming.add(reply({
+            'verdict': {
+              'ok': false,
+              'stage': 'acceptance',
+              'report': {
+                'replayedIntents': 4,
+                'candidateIntents': 3,
+                'projection': {'equal': false},
+                'divergences': [
+                  {
+                    'kind': 'plan-divergence',
+                    'directiveId': 'setMood',
+                  }
+                ],
+              },
+              'error': 'restoring previous law needs a business reason',
+            }
+          }));
+          break;
+        case 'offerDirective':
+          _incoming.add(reply({
+            'head': 'HEAD-owned-approval',
+            'created': <Object?>[],
+            'births': <Object?>[],
+            'workspace': 'notes',
+          }));
+          break;
         case 'badop':
           _incoming.add({
             'v': kWebviewBridgeVersion,
@@ -467,6 +549,32 @@ void main() {
     expect(bridge.principal, 'user:ada');
   });
 
+  test(
+      'generated model restoration crosses one framework-private bridge operation',
+      () async {
+    await bridge.ready;
+    final verdict =
+        await bridge.nomosFrameworkRestorePreviousGeneratedModel(
+      domain: 'evo',
+      currentHash: 'current-law-hash',
+      because: 'the previous operating policy is required',
+    );
+
+    expect(verdict['ok'], isFalse);
+    expect(verdict['stage'], 'acceptance');
+    expect(
+        ((verdict['report'] as Map)['divergences'] as List).single,
+        containsPair('directiveId', 'setMood'));
+    final request = runner.sent.firstWhere(
+      (message) => message['op'] == 'restorePreviousGeneratedModel',
+    );
+    expect((request['args'] as Map).cast<String, Object?>(), {
+      'domain': 'evo',
+      'currentHash': 'current-law-hash',
+      'because': 'the previous operating policy is required',
+    });
+  });
+
   test(
       'connect / query / queryById / count / sync / lawStatus all wrap the runner',
       () async {
@@ -481,6 +589,172 @@ void main() {
         await bridge.lawStatus('abc'), {'installed': true, 'drifted': false});
   });
 
+  test('moments and historic reads keep commit plumbing behind an opaque handle',
+      () async {
+    final momentsTransport = ReplayTransport({
+      'commits': [
+        {
+          'oid': 'abc123',
+          'at': 1784383200000,
+          'actorSubject': 'user:ada',
+          'domain': 'estate',
+          'directiveId': 'createSite',
+        }
+      ]
+    });
+    final momentsBridge = NomosBridge(momentsTransport);
+    await momentsBridge.ready;
+    final moments = await momentsBridge.moments(limit: 12);
+    expect(moments, hasLength(1));
+    expect(moments.single.id, 'abc123');
+    expect(moments.single.actorSubject, 'user:ada');
+    expect(moments.single.action, 'createSite');
+    expect((momentsTransport.lastRequest!['args'] as Map)['limit'], 12);
+    await momentsBridge.dispose();
+
+    final readTransport = ReplayTransport({
+      'rows': [
+        {
+          'id': 'EstateSite_1',
+          'data': {'name': 'HQ'}
+        }
+      ]
+    });
+    final readBridge = NomosBridge(readTransport);
+    await readBridge.ready;
+    final rows = await readBridge.queryByIdAt(moments.single, 'EstateSite_1');
+    expect(rows.single['data'], {'name': 'HQ'});
+    expect(readTransport.lastRequest!['op'], 'queryByIdAt');
+    expect((readTransport.lastRequest!['args'] as Map),
+        containsPair('commit', 'abc123'));
+    await readBridge.dispose();
+  });
+
+  test('devices traffic one opaque request and one atomic framework approval',
+      () async {
+    await bridge.ready;
+    final devices = NomosDevices(
+      bridge: bridge,
+      domain: 'notes',
+      domainHash: 'a' * 64,
+      actor: 'user:alice',
+      scope: 'nomos_internal_owned_read_7c1f5e',
+    );
+
+    final request = await devices.request();
+    expect(request, 'opaque-owned-device-request');
+    final requestCall = runner.sent.firstWhere(
+      (message) => message['op'] == 'cryptoOwnedDeviceRequest',
+    );
+    expect((requestCall['args'] as Map)['scope'],
+        'nomos_internal_owned_read_7c1f5e');
+
+    final outcome = await devices.approve(request);
+    expect(outcome.head, 'HEAD-owned-approval');
+    final prepareCall = runner.sent.firstWhere(
+      (message) => message['op'] == 'cryptoOwnedPrepareApproval',
+    );
+    expect((prepareCall['args'] as Map).cast<String, Object?>(), {
+      'request': 'opaque-owned-device-request',
+      'scope': 'nomos_internal_owned_read_7c1f5e',
+    });
+    final offerCall = runner.sent.firstWhere(
+      (message) => message['op'] == 'offerDirective',
+    );
+    final offerArgs = (offerCall['args'] as Map).cast<String, Object?>();
+    expect(offerArgs['domain'], 'notes');
+    expect(offerArgs['directiveId'],
+        'nomos_internal_approve_owned_device_7c1f5e');
+    expect(offerArgs['actor'], 'user:alice');
+    expect(offerArgs['domainHash'], 'a' * 64);
+    expect(offerArgs['payload'], {
+      'newKeySubject': 'key:${'a' * 64}',
+      'ownedCustody': 'opaque-owned-custody',
+      'verifiedVia': 'nomos:test-root',
+      'validFromEpoch': 0,
+      'approvedAt': '2026-07-18T14:20:00.000Z',
+    });
+  });
+
+  test('record sharing keeps keys, identity and action payloads behind the bridge',
+      () async {
+    await bridge.ready;
+    final keys = await bridge.nomosOwnedScopeKeys(
+      'owned-reader',
+      recordType: 'notes.Note',
+      recordId: 'note-1',
+    );
+    expect(keys.single.epoch, 2);
+    expect(keys.single.key, 'opaque-record-key');
+
+    await bridge.nomosEnsureOwnedIdentity(
+      scope: 'owned-reader',
+      domain: 'notes',
+      domainHash: 'a' * 64,
+    );
+    final payload = await bridge.nomosPrepareOwnedRecordAction(
+      action: 'share',
+      scope: 'owned-reader',
+      record: const NomosRef(
+        workspace: 'ws-1',
+        type: 'notes.Note',
+        id: 'note-1',
+      ),
+      peer: 'user:bob',
+    );
+    expect(payload, containsPair('recordId', 'note-1'));
+
+    final keyCall = runner.sent.firstWhere(
+      (message) => message['op'] == 'cryptoOwnedScopeKeys',
+    );
+    expect((keyCall['args'] as Map).cast<String, Object?>(), {
+      'scope': 'owned-reader',
+      'record': {'type': 'notes.Note', 'id': 'note-1'},
+    });
+    final identityCall = runner.sent.firstWhere(
+      (message) => message['op'] == 'cryptoOwnedEnsureIdentity',
+    );
+    expect((identityCall['args'] as Map).cast<String, Object?>(), {
+      'scope': 'owned-reader',
+      'domain': 'notes',
+      'domainHash': 'a' * 64,
+    });
+    final actionCall = runner.sent.firstWhere(
+      (message) => message['op'] == 'cryptoOwnedPrepareRecordAction',
+    );
+    expect((actionCall['args'] as Map).cast<String, Object?>(), {
+      'action': 'share',
+      'scope': 'owned-reader',
+      'record': {'type': 'notes.Note', 'id': 'note-1'},
+      'peer': 'user:bob',
+    });
+  });
+
+  test(
+      'generated model adoption crosses one framework-private bridge operation',
+      () async {
+    await bridge.ready;
+    final verdict = await bridge.nomosFrameworkAdoptGeneratedModel(
+      domain: 'evo',
+      candidateHash: 'candidate-law-hash',
+      because: 'the renamed business action is intentional',
+    );
+
+    expect(verdict['ok'], isFalse);
+    expect(verdict['stage'], 'acceptance');
+    expect(
+        ((verdict['report'] as Map)['divergences'] as List).single,
+        containsPair('directiveId', 'registerSite'));
+    final request = runner.sent.firstWhere(
+      (message) => message['op'] == 'adoptGeneratedModel',
+    );
+    expect((request['args'] as Map).cast<String, Object?>(), {
+      'domain': 'evo',
+      'candidateHash': 'candidate-law-hash',
+      'because': 'the renamed business action is intentional',
+    });
+  });
+
   test(
       'watch is a reactive stream; a runner push reaches the listener; cancel unwatches',
       () async {

package/dart_types/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.7.0
+
+- Add the public conflict and description shapes used by generated aggregate clients: merge observations,
+  pending decisions, typed organisation references and recursive business descriptions now have one Dart
+  representation shared with the TypeScript client.
+
 ## 0.5.0
 
 - Add typed `SourceSessionNotMounted` error (code `nomos.attested_read.source_not_mounted`) for the colocated attested-read fix — a foreign `read(q, {from})` whose source workspace isn't mounted now fails fast with a typed error + `mountSourceSession` remedy.

package/dart_types/lib/src/errors.dart

@@ -21,9 +21,15 @@ import 'error_info.dart' show NomosBridgeError, NomosErrorInfo;
 /// recoverable, carrying the eviction/escalation decision fields); everything else stays the generic
 /// [NomosBridgeError]. Apps `switch` on the type / `code`, never scrape prose.
 NomosBridgeError nomosErrorFromInfo(NomosErrorInfo info) {
-  if (info.code.startsWith('nomos.custody.')) return CustodyError.fromInfo(info);
-  if (info.code.startsWith('nomos.law.')) return LawMismatchError.fromInfo(info);
-  if (info.code.startsWith('nomos.authz.')) return AuthzRefusedError.fromInfo(info);
+  if (info.code == 'nomos.owned.recovery_pending') {
+    return OwnedRecoveryPending.fromInfo(info);
+  }
+  if (info.code.startsWith('nomos.custody.'))
+    return CustodyError.fromInfo(info);
+  if (info.code.startsWith('nomos.law.'))
+    return LawMismatchError.fromInfo(info);
+  if (info.code.startsWith('nomos.authz.'))
+    return AuthzRefusedError.fromInfo(info);
   if (info.code.startsWith('nomos.auth.')) return AuthError.fromInfo(info);
   if (info.code.startsWith('nomos.load.')) return LoadError.fromInfo(info);
   if (info.code == 'nomos.attested_read.source_not_mounted') {
@@ -52,7 +58,8 @@ class NomosRecommendedAction {
   static const reauth = 'reauth';
 
   /// Quarantine the local snapshot and re-clone fresh (evict local custody).
-  static const quarantineLocalSnapshotAndReclone = 'quarantineLocalSnapshotAndReclone';
+  static const quarantineLocalSnapshotAndReclone =
+      'quarantineLocalSnapshotAndReclone';
 
   /// Ask the cloud to serve the full chain and retry (escalate cloud custody).
   static const refetchFullHistoryAndRetry = 'refetchFullHistoryAndRetry';
@@ -73,6 +80,15 @@ class NomosRecommendedAction {
   /// [SourceSessionNotMounted] (a directive's `read(q, {from})` resolves in-engine from the mounted source).
   static const mountSourceSession = 'mountSourceSession';
 
+  /// Ask the designated recovery person to open this workspace once. Nomos completes the handoff privately.
+  static const openRecoveryPrincipalDevice = 'openRecoveryPrincipalDevice';
+
+  /// Wait for the designated recovery person to open this workspace, then reopen this device.
+  static const waitForRecoveryPrincipal = 'waitForRecoveryPrincipal';
+
+  /// Recovery was never enabled: use a working device, or re-birth an empty workspace.
+  static const useWorkingDeviceOrRebirth = 'useWorkingDeviceOrRebirth';
+
   /// No automatic remedy — surface to a human.
   static const none = 'none';
 
@@ -97,6 +113,12 @@ class NomosRecommendedAction {
         return 'restore the device signer on the parent (ensureParentSignerEnrollment / NomosScope.home repairs it on reopen)';
       case mountSourceSession:
         return 'mount the attested read\'s source workspace as a session on this plane (connect it / ref.acquire) so the read resolves in-engine';
+      case openRecoveryPrincipalDevice:
+        return 'ask the designated recovery person to open this workspace once; Nomos completes the handoff privately';
+      case waitForRecoveryPrincipal:
+        return 'wait for the designated recovery person to open this workspace, then reopen this device';
+      case useWorkingDeviceOrRebirth:
+        return 'use a working device, or re-birth the empty workspace if recovery was never enabled';
       case none:
         return 'no automatic remedy — inspect the error';
       default:
@@ -105,6 +127,56 @@ class NomosRecommendedAction {
   }
 }
 
+/// All-device-loss recovery is a normal, resumable lifecycle state. The app may render the one concrete
+/// [recommendedAction]; it never needs to inspect escrow wraps, Orders, Receipts, or key material.
+class OwnedRecoveryPending extends NomosBridgeError {
+  final String code;
+  final String? workspace;
+  final String stage;
+  final String? orderId;
+  final String? recoveryPrincipal;
+  final String recommendedAction;
+
+  OwnedRecoveryPending({
+    this.code = 'nomos.owned.recovery_pending',
+    required String message,
+    this.workspace,
+    this.stage = 'request',
+    this.orderId,
+    this.recoveryPrincipal,
+    this.recommendedAction = NomosRecommendedAction.waitForRecoveryPrincipal,
+    NomosErrorInfo? info,
+  }) : super(message, info: info);
+
+  factory OwnedRecoveryPending.fromInfo(NomosErrorInfo info) {
+    String? attr(String name) {
+      final value =
+          info.attributes['nomos.owned.$name'] ?? info.attributes[name];
+      return value?.toString();
+    }
+
+    return OwnedRecoveryPending(
+      code: info.code,
+      message: info.message,
+      workspace: info.workspace,
+      stage: attr('stage') ?? 'request',
+      orderId: attr('orderId') ?? attr('order_id'),
+      recoveryPrincipal:
+          attr('recoveryPrincipal') ?? attr('recovery_principal'),
+      recommendedAction: attr('recommendedAction') ??
+          attr('recommended_action') ??
+          NomosRecommendedAction.waitForRecoveryPrincipal,
+      info: info,
+    );
+  }
+
+  @override
+  String toString() =>
+      'OwnedRecoveryPending(stage: $stage${orderId != null ? ', order: $orderId' : ''}'
+      '${recoveryPrincipal != null ? ', recoveryPrincipal: $recoveryPrincipal' : ''}, '
+      'recommendedAction: $recommendedAction): $message';
+}
+
 /// LAW DRIFT — the client was generated under one law and the workspace runs another (`nomos.law.*`): either a
 /// §5 connect-time compat check, or a dispatch-time refusal when a payload's baked hash names law the workspace
 /// no longer runs. When [structurallyCompatible] is true the operation can still proceed (structural subtyping);
@@ -169,12 +241,18 @@ class LawMismatchError extends NomosBridgeError {
       code: info.code,
       message: info.message,
       workspace: info.workspace,
-      generatedFor: attr('generatedFor') ?? attr('generated_for') ?? attr('clientHash'),
-      workspaceRuns: attr('workspaceRuns') ?? attr('workspace_runs') ?? attr('installed'),
+      generatedFor:
+          attr('generatedFor') ?? attr('generated_for') ?? attr('clientHash'),
+      workspaceRuns:
+          attr('workspaceRuns') ?? attr('workspace_runs') ?? attr('installed'),
       operation: info.operation ?? attr('operation'),
       structurallyCompatible: compat(),
-      incompatibleMember: attr('incompatibleMember') ?? attr('incompatible_member') ?? attr('member'),
-      recommendedAction: attr('recommendedAction') ?? attr('recommended_action') ?? NomosRecommendedAction.recompileClient,
+      incompatibleMember: attr('incompatibleMember') ??
+          attr('incompatible_member') ??
+          attr('member'),
+      recommendedAction: attr('recommendedAction') ??
+          attr('recommended_action') ??
+          NomosRecommendedAction.recompileClient,
       info: info,
     );
   }
@@ -261,9 +339,11 @@ class AuthzRefusedError extends NomosBridgeError {
       keyHash: attr('keyHash') ?? attr('key_hash'),
       object: attr('object'),
       relation: attr('relation'),
-      directiveId: attr('directiveId') ?? attr('directive_id') ?? attr('directive'),
+      directiveId:
+          attr('directiveId') ?? attr('directive_id') ?? attr('directive'),
     );
-    if (info.code == 'nomos.authz.signer_enrollment_missing' || cause == 'missing-signer-enrollment') {
+    if (info.code == 'nomos.authz.signer_enrollment_missing' ||
+        cause == 'missing-signer-enrollment') {
       return ParentSignerEnrollmentMissing(
         message: info.message,
         workspace: fields.workspace,
@@ -284,7 +364,9 @@ class AuthzRefusedError extends NomosBridgeError {
       relation: fields.relation,
       directiveId: fields.directiveId,
       cause: cause,
-      recommendedAction: attr('recommendedAction') ?? attr('recommended_action') ?? NomosRecommendedAction.none,
+      recommendedAction: attr('recommendedAction') ??
+          attr('recommended_action') ??
+          NomosRecommendedAction.none,
       info: info,
     );
   }
@@ -321,7 +403,8 @@ class ParentSignerEnrollmentMissing extends AuthzRefusedError {
           relation: 'signer',
           directiveId: directiveId,
           cause: 'missing-signer-enrollment',
-          recommendedAction: NomosRecommendedAction.ensureParentSignerEnrollment,
+          recommendedAction:
+              NomosRecommendedAction.ensureParentSignerEnrollment,
           info: info,
         );
 }
@@ -367,7 +450,9 @@ class AuthError extends NomosBridgeError {
       workspace: info.workspace,
       issuer: attr('issuer'),
       operation: info.operation ?? attr('operation'),
-      recommendedAction: attr('recommendedAction') ?? attr('recommended_action') ?? NomosRecommendedAction.reauth,
+      recommendedAction: attr('recommendedAction') ??
+          attr('recommended_action') ??
+          NomosRecommendedAction.reauth,
       info: info,
     );
   }
@@ -415,7 +500,9 @@ class LoadError extends NomosBridgeError {
       message: info.message,
       artifact: attr('artifact'),
       sourceUrl: attr('sourceUrl') ?? attr('source_url') ?? attr('url'),
-      recommendedAction: attr('recommendedAction') ?? attr('recommended_action') ?? NomosRecommendedAction.retry,
+      recommendedAction: attr('recommendedAction') ??
+          attr('recommended_action') ??
+          NomosRecommendedAction.retry,
       info: info,
     );
   }
@@ -462,7 +549,8 @@ class SourceSessionNotMounted extends NomosBridgeError {
 
   factory SourceSessionNotMounted.fromInfo(NomosErrorInfo info) {
     String? attr(String name) {
-      final v = info.attributes['nomos.attested_read.$name'] ?? info.attributes[name];
+      final v =
+          info.attributes['nomos.attested_read.$name'] ?? info.attributes[name];
       return v?.toString();
     }
 
@@ -470,16 +558,19 @@ class SourceSessionNotMounted extends NomosBridgeError {
       code: info.code,
       message: info.message,
       from: attr('from'),
-      sourceWorkspace: attr('source_workspace') ?? attr('sourceWorkspace') ?? info.workspace,
-      queryId: (info.attributes['nomos.query_id'] ?? attr('queryId'))?.toString(),
-      recommendedAction: attr('recommendedAction') ?? attr('recommended_action') ?? NomosRecommendedAction.mountSourceSession,
+      sourceWorkspace:
+          attr('source_workspace') ?? attr('sourceWorkspace') ?? info.workspace,
+      queryId:
+          (info.attributes['nomos.query_id'] ?? attr('queryId'))?.toString(),
+      recommendedAction: attr('recommendedAction') ??
+          attr('recommended_action') ??
+          NomosRecommendedAction.mountSourceSession,
       info: info,
     );
   }
 
   @override
-  String toString() =>
-      'SourceSessionNotMounted(source: $sourceWorkspace'
+  String toString() => 'SourceSessionNotMounted(source: $sourceWorkspace'
       '${queryId != null ? ', query: $queryId' : ''}, recommendedAction: $recommendedAction): $message';
 }
 
@@ -587,13 +678,16 @@ class CustodyError extends NomosBridgeError {
         orElse: () => CustodySource.unknown,
       ),
       recoverable: attr('recoverable') != 'false',
-      recommendedAction: attr('recommended_action') ?? attr('recommendedAction') ?? 'refetchFullHistoryAndRetry',
+      recommendedAction: attr('recommended_action') ??
+          attr('recommendedAction') ??
+          'refetchFullHistoryAndRetry',
       info: info,
     );
   }
 
   /// True when the remedy is to quarantine the local snapshot and re-clone (evict local custody).
-  bool get shouldEvictLocalCustody => recommendedAction == 'quarantineLocalSnapshotAndReclone';
+  bool get shouldEvictLocalCustody =>
+      recommendedAction == 'quarantineLocalSnapshotAndReclone';
 
   @override
   String toString() =>
@@ -607,7 +701,8 @@ class CustodyError extends NomosBridgeError {
 /// REMEDY: re-acquire a fresh token from the auth provider and reconnect.
 class AuthTokenInvalid extends NomosBridgeError {
   AuthTokenInvalid([String? message])
-      : super(message ?? 'the auth-provider token was missing or rejected (the cloud refused 401) — a birth needs a verified principal');
+      : super(message ??
+            'the auth-provider token was missing or rejected (the cloud refused 401) — a birth needs a verified principal');
 }
 
 /// The workspace name the cloud reported for the born home does NOT equal `homeNameOf(subject)`. The home's
@@ -619,8 +714,10 @@ class HomeNameMismatch extends NomosBridgeError {
 
   /// What the cloud reported (its status `lineage.id` / the name it served).
   final String reported;
-  HomeNameMismatch({required this.expected, required this.reported, String? message})
-      : super(message ?? 'the cloud reported home "$reported" but this subject hashes to "$expected" — refusing to mount a home whose name does not bind its owner');
+  HomeNameMismatch(
+      {required this.expected, required this.reported, String? message})
+      : super(message ??
+            'the cloud reported home "$reported" but this subject hashes to "$expected" — refusing to mount a home whose name does not bind its owner');
 }
 
 /// The workspace exists and is born, but the HOME LAW is not installed/active on it — so it is a plain
@@ -631,7 +728,8 @@ class HomeLawMissing extends NomosBridgeError {
   /// The workspace that is missing the home law.
   final String workspace;
   HomeLawMissing({required this.workspace, String? message})
-      : super(message ?? 'workspace "$workspace" is born but the home law is not installed/active on it — refusing to mount a plain workspace as a home');
+      : super(message ??
+            'workspace "$workspace" is born but the home law is not installed/active on it — refusing to mount a plain workspace as a home');
 }
 
 /// The offer to the home's birth lane was REFUSED by the parent's gate (the law denied the birth — e.g. the
@@ -644,14 +742,17 @@ class BirthRejected extends NomosBridgeError {
   /// The HTTP status the cloud answered, when known.
   final int? statusCode;
   BirthRejected({String? message, this.directiveId, this.statusCode})
-      : super(message ?? 'the home birth offer was refused by the law${directiveId != null ? ' (directive "$directiveId")' : ''}${statusCode != null ? ' [$statusCode]' : ''}');
+      : super(message ??
+            'the home birth offer was refused by the law${directiveId != null ? ' (directive "$directiveId")' : ''}${statusCode != null ? ' [$statusCode]' : ''}');
 }
 
 /// A pack the cloud returned (or the local holon produced) was malformed — it could not be parsed/applied as
 /// a git pack. This is a transport/custody integrity fault, not a law refusal. REMEDY: retry; if persistent,
 /// the custody bytes are corrupt.
 class PackMalformed extends NomosBridgeError {
-  PackMalformed([String? message]) : super(message ?? 'a returned pack was malformed and could not be applied (custody integrity fault)');
+  PackMalformed([String? message])
+      : super(message ??
+            'a returned pack was malformed and could not be applied (custody integrity fault)');
 }
 
 /// The home law's content hash could not be resolved — the cloud reported no current law for the home's
@@ -661,7 +762,8 @@ class LawHashUnavailable extends NomosBridgeError {
   /// The workspace whose current law hash could not be resolved.
   final String workspace;
   LawHashUnavailable({required this.workspace, String? message})
-      : super(message ?? 'could not resolve the current law hash for "$workspace" — the cloud reported no installed law for the home');
+      : super(message ??
+            'could not resolve the current law hash for "$workspace" — the cloud reported no installed law for the home');
 }
 
 /// AUTHORITY IS UNFORGEABLE-BY-CONSTRUCTION: a GATED directive (one carrying a `.requires(relation)` write
@@ -678,7 +780,11 @@ class MissingOfferAuthority extends NomosBridgeError {
 
   /// The relation the law requires the author to hold (e.g. `admin`).
   final String requires;
-  MissingOfferAuthority({required this.domain, required this.directiveId, required this.requires, String? message})
+  MissingOfferAuthority(
+      {required this.domain,
+      required this.directiveId,
+      required this.requires,
+      String? message})
       : super(message ??
             '$domain/$directiveId requires the "$requires" relation — construct the client with an actor (the verified principal) to author it; a gated offer cannot be made without an authority');
 }