@githolon/dsl 0.103.3 → 0.103.5

package/dart/test/webview_bridge_test.dart

@@ -168,9 +168,30 @@ class FakeRunner implements BridgeTransport {
         case 'autoSync':
           _incoming.add(reply({'started': true}));
           break;
+        case 'refreshCredentials':
+          _incoming.add(reply({'refreshed': true}));
+          break;
         case 'lawStatus':
           _incoming.add(reply({'installed': true, 'drifted': false}));
           break;
+        case 'metrics':
+          final session = args['session'];
+          _incoming.add(reply(session == 'home'
+              ? {
+                  'ahead': 0,
+                  'behind': false,
+                  'saved': 2,
+                  'onMain': 3,
+                  'deadLetters': 0,
+                }
+              : {
+                  'ahead': 4,
+                  'behind': true,
+                  'saved': 5,
+                  'onMain': 6,
+                  'deadLetters': 1,
+                }));
+          break;
         case 'cryptoOwnedDeviceRequest':
           _incoming.add(reply({'request': 'opaque-owned-device-request'}));
           break;
@@ -225,6 +246,15 @@ class FakeRunner implements BridgeTransport {
             }
           }));
           break;
+        case 'stageGeneratedModel':
+          _incoming.add(reply({
+            'verdict': {
+              'ok': true,
+              'status': 'pending',
+              'candidateHash': 'candidate-law-hash',
+            }
+          }));
+          break;
         case 'restorePreviousGeneratedModel':
           _incoming.add(reply({
             'verdict': {
@@ -248,8 +278,11 @@ class FakeRunner implements BridgeTransport {
         case 'offerDirective':
           _incoming.add(reply({
             'head': 'HEAD-owned-approval',
+            'intentId': 'intent-owned-approval',
             'created': <Object?>[],
-            'births': <Object?>[],
+            'born': args['directiveId'] == 'birthChild'
+                ? <Object?>['notes-child']
+                : <Object?>[],
             'workspace': 'notes',
           }));
           break;
@@ -300,6 +333,19 @@ class FakeRunner implements BridgeTransport {
       _incoming.add({'v': kWebviewBridgeVersion, 'event': 'sync', ...event});
 }
 
+class ErrorRunner implements BridgeTransport {
+  final _incoming = StreamController<Map<String, Object?>>.broadcast();
+
+  @override
+  Stream<Map<String, Object?>> get messages => _incoming.stream;
+
+  @override
+  void send(Map<String, Object?> message) {}
+
+  void fail(Object error) => _incoming.addError(error);
+  Future<void> close() => _incoming.close();
+}
+
 /// A transport that answers EVERY request with one canned `result` (the golden corpus's reply) and records
 /// the request the bridge sent — so we can assert both halves of the wire contract from the Dart side.
 class ReplayTransport implements BridgeTransport {
@@ -403,6 +449,20 @@ Object? _expectedTyped(String op, Map<String, Object?> result) {
 }
 
 void main() {
+  test('transport failure fails readiness immediately', () async {
+    final transport = ErrorRunner();
+    final bridge = NomosBridge(transport);
+    final failure = StateError('runner exited');
+    transport.fail(failure);
+    await expectLater(
+      bridge.ready,
+      throwsA(isA<StateError>()
+          .having((e) => e.message, 'message', 'runner exited')),
+    );
+    await bridge.dispose();
+    await transport.close();
+  });
+
   // ── THE GOLDEN CORPUS — the cross-language conformance the JS runner replays too ──
   // For each case: call the typed bridge method with the corpus `args`, then assert (1) the request the bridge
   // SENT carries exactly those args, and (2) the typed value the bridge parsed from the corpus `result` matches.
@@ -439,6 +499,7 @@ void main() {
       final now = DateTime.now().millisecondsSinceEpoch;
       final transport = ReplayTransport({
         'head': 'H1',
+        'intentId': 'intent-span',
         'created': <Object?>[],
         'workspace': 'ws',
         // the runner's op-pickup + durable-ack instants (additive `timing` field)
@@ -463,8 +524,12 @@ void main() {
     test(
         'a runner without timing (older bundle) emits no bridge-leg spans and still answers',
         () async {
-      final transport = ReplayTransport(
-          {'head': 'H1', 'created': <Object?>[], 'workspace': 'ws'});
+      final transport = ReplayTransport({
+        'head': 'H1',
+        'intentId': 'intent-old-runner',
+        'created': <Object?>[],
+        'workspace': 'ws'
+      });
       final bridge = NomosBridge(transport);
       await bridge.ready;
       final out = await bridge.offerOutcome(
@@ -484,8 +549,12 @@ void main() {
   // author path signs THIS offer with the intended enrolled key, not the connect-time one). Both offer lanes. ──
   group('per-offer authorSecret threads to the runner op (#9)', () {
     test('offerOutcome carries authorSecret to the runner op args', () async {
-      final transport = ReplayTransport(
-          {'head': 'H1', 'created': <Object?>[], 'workspace': 'ws'});
+      final transport = ReplayTransport({
+        'head': 'H1',
+        'intentId': 'intent-secret',
+        'created': <Object?>[],
+        'workspace': 'ws'
+      });
       final bridge = NomosBridge(transport);
       await bridge.ready;
       await bridge.offerOutcome(
@@ -520,8 +589,12 @@ void main() {
     test(
         'no authorSecret ⇒ the op omits it (byte-identical to the pre-#9 contract)',
         () async {
-      final transport = ReplayTransport(
-          {'head': 'H1', 'created': <Object?>[], 'workspace': 'ws'});
+      final transport = ReplayTransport({
+        'head': 'H1',
+        'intentId': 'intent-no-secret',
+        'created': <Object?>[],
+        'workspace': 'ws'
+      });
       final bridge = NomosBridge(transport);
       await bridge.ready;
       await bridge.offerOutcome(
@@ -683,7 +756,8 @@ void main() {
         await bridge.lawStatus('abc'), {'installed': true, 'drifted': false});
   });
 
-  test('version freshness returns the required sum type without resolving history',
+  test(
+      'version freshness returns the required sum type without resolving history',
       () async {
     await bridge.ready;
     final reference = NmsInternalVersionedNomosRefs.create<Object, Object>(
@@ -706,7 +780,8 @@ void main() {
     final request = runner.sent.last;
     expect(request['op'], 'checkRefFreshness');
     final args = (request['args'] as Map).cast<String, Object?>();
-    final check = ((args['refs'] as List).single as Map).cast<String, Object?>();
+    final check =
+        ((args['refs'] as List).single as Map).cast<String, Object?>();
     expect(check['currentField'], 'currentPublication');
     expect((check['pinned'] as Map)['id'], 'publication:1');
     expect((check['series'] as Map)['id'], 'series:1');
@@ -879,6 +954,26 @@ void main() {
     });
   });
 
+  test(
+      'generated model staging carries opaque USDA through one framework-private operation',
+      () async {
+    await bridge.ready;
+    await bridge.nomosInternalStageGeneratedModel(
+      domain: 'evo',
+      candidateHash: 'candidate-law-hash',
+      lawUsdz: const [1, 2, 3],
+    );
+
+    final request = runner.sent.firstWhere(
+      (message) => message['op'] == 'stageGeneratedModel',
+    );
+    expect((request['args'] as Map).cast<String, Object?>(), {
+      'domain': 'evo',
+      'candidateHash': 'candidate-law-hash',
+      'lawUsdz': 'AQID',
+    });
+  });
+
   test(
       'watch is a reactive stream; a runner push reaches the listener; cancel unwatches',
       () async {
@@ -942,6 +1037,118 @@ void main() {
     expect((req['args'] as Map)['signalId'], 'signal:ws:list:main');
   });
 
+  test(
+      'an exact write receipt advances from local acceptance to remote convergence',
+      () async {
+    await bridge.ready;
+    final outcome = await bridge.offerOutcome(
+      domain: 'notes',
+      directiveId: 'writeNote',
+      payload: {'text': 'hello'},
+    );
+    expect(outcome.receipt.current.phase, NomosOperationPhase.locallyAccepted);
+    expect(
+      bridge.session('notes').currentStatus.phase,
+      SyncPhase.syncing,
+      reason: 'a locally accepted write cannot remain falsely current',
+    );
+    expect(bridge.session('notes').currentStatus.ahead, 1);
+
+    runner.pushSync({
+      'session': 'notes',
+      'reason': 'write',
+      'result': {
+        'admittedIntentIds': ['intent-owned-approval'],
+      },
+    });
+    await outcome.receipt.admitted.timeout(const Duration(seconds: 1));
+    expect(outcome.receipt.current.phase,
+        NomosOperationPhase.admittedToRemoteCustody);
+
+    runner.pushSync({
+      'session': 'notes',
+      'reason': 'drain-read',
+      'result': {
+        'convergedIntentIds': ['intent-owned-approval'],
+      },
+    });
+    await outcome.receipt.converged.timeout(const Duration(seconds: 1));
+    expect(outcome.receipt.current.isConverged, isTrue);
+    expect(bridge.session('notes').currentStatus.phase, SyncPhase.idle);
+  });
+
+  test('offline debt leaves a receipt pending and reconnect settles it',
+      () async {
+    await bridge.ready;
+    final outcome = await bridge.offerOutcome(
+      domain: 'notes',
+      directiveId: 'writeNote',
+      payload: {'text': 'offline'},
+    );
+    runner.pushSync({
+      'session': 'notes',
+      'reason': 'write',
+      'result': {'offline': true, 'stillAhead': true},
+    });
+    await Future<void>.delayed(Duration.zero);
+    expect(outcome.receipt.current.phase, NomosOperationPhase.locallyAccepted);
+
+    runner.pushSync({
+      'session': 'notes',
+      'reason': 'reconnect',
+      'result': {
+        'admittedIntentIds': ['intent-owned-approval'],
+        'convergedIntentIds': ['intent-owned-approval'],
+      },
+    });
+    await outcome.receipt.converged.timeout(const Duration(seconds: 1));
+  });
+
+  test('a generated child workspace inherits the parent birth receipt',
+      () async {
+    await bridge.ready;
+    final outcome = await bridge.offerOutcome(
+      domain: 'notes',
+      directiveId: 'birthChild',
+      payload: {'name': 'child'},
+    );
+    final childReceipt =
+        bridge.session('notes-child').nomosInternalWorkspaceCreationReceipt();
+    expect(childReceipt, same(outcome.receipt));
+  });
+
+  test(
+      'background authentication failure refreshes through the retained application session',
+      () async {
+    String token(String marker) =>
+        '${base64Url.encode(utf8.encode('{"alg":"none"}')).replaceAll('=', '')}.'
+        '${base64Url.encode(utf8.encode('{"sub":"alice","iss":"test","marker":"$marker"}')).replaceAll('=', '')}.x';
+    await bridge.ready;
+    await bridge.connect(
+      cloud: 'https://cloud.example',
+      workspace: 'notes',
+      session: 'notes',
+      authToken: token('initial'),
+    );
+    bridge.session('notes').nomosInternalRetainCloudAccess(
+          cloud: 'https://cloud.example',
+          signIn: () async => token('refreshed'),
+        );
+
+    runner.pushSync({
+      'session': 'notes',
+      'reason': 'reconnect',
+      'result': {
+        'pushFailed': true,
+        'pushError': {'status': 401, 'error': 'token expired'},
+      },
+    });
+    await Future<void>.delayed(const Duration(milliseconds: 10));
+    final refresh = runner.sent
+        .lastWhere((message) => message['op'] == 'refreshCredentials');
+    expect((refresh['args'] as Map)['authToken'], token('refreshed'));
+  });
+
   test(
       'background sync status never calls an offline or failed round successful',
       () async {
@@ -979,6 +1186,147 @@ void main() {
     expect(bridge.currentStatus.lastError, isNull);
   });
 
+  test('application sync status scopes and folds every connected workspace',
+      () async {
+    await bridge.ready;
+    await bridge.connect(cloud: 'https://c', workspace: 'home');
+    await bridge.connect(cloud: 'https://c', workspace: 'estate');
+
+    final status = await bridge.syncStatus.firstWhere(
+      (value) => value.ahead == 4 && value.behind == 1,
+    );
+
+    expect(status.saved, 7);
+    expect(status.onMain, 9);
+    expect(status.deadLetters, 1);
+    final metricRequests =
+        runner.sent.where((message) => message['op'] == 'metrics').toList();
+    expect(metricRequests, hasLength(2));
+    expect(
+      metricRequests
+          .map((message) => (message['args'] as Map)['session'])
+          .toSet(),
+      {'home', 'estate'},
+    );
+  });
+
+  test('workspace application status is isolated from sibling workspace debt',
+      () async {
+    await bridge.ready;
+    await bridge.connect(cloud: 'https://c', workspace: 'home');
+    await bridge.connect(cloud: 'https://c', workspace: 'estate');
+
+    expect(
+      bridge.session('home').currentStatus.phase,
+      SyncPhase.syncing,
+      reason: 'an unmeasured session must not claim to be current',
+    );
+
+    final home = await bridge.session('home').syncStatus.firstWhere(
+          (value) => value.saved == 2,
+        );
+    final estate = await bridge.session('estate').syncStatus.firstWhere(
+          (value) => value.saved == 5,
+        );
+
+    expect(home.ahead, 0);
+    expect(home.behind, 0);
+    expect(estate.ahead, 4);
+    expect(estate.behind, 1);
+
+    runner.pushSync({
+      'session': 'estate',
+      'reason': 'reconnect',
+      'ok': false,
+      'error': 'estate only failed',
+    });
+    await Future<void>.delayed(Duration.zero);
+    expect(bridge.session('home').currentStatus.phase, SyncPhase.idle);
+    expect(bridge.session('estate').currentStatus.phase, SyncPhase.error);
+    expect(bridge.currentStatus.phase, SyncPhase.error);
+  });
+
+  test('custody push refusal is scoped, actionable, and cleared by recovery',
+      () async {
+    await bridge.ready;
+    await bridge.connect(cloud: 'https://c', workspace: 'home');
+    await bridge.connect(cloud: 'https://c', workspace: 'estate');
+
+    runner.pushSync({
+      'session': 'estate',
+      'reason': 'local-write',
+      'result': {
+        'stillAhead': true,
+        'pushFailed': true,
+        'pushError': {
+          'status': 409,
+          'refused': true,
+          'error': 'candidate law is not admitted',
+        },
+      },
+    });
+    await Future<void>.delayed(Duration.zero);
+
+    expect(bridge.session('home').currentStatus.phase, isNot(SyncPhase.error));
+    expect(bridge.session('estate').currentStatus.phase, SyncPhase.error);
+    expect(
+      bridge.session('estate').currentStatus.lastError,
+      'Shared custody refused this workspace change (HTTP 409): '
+      'candidate law is not admitted',
+    );
+    expect(bridge.currentStatus.phase, SyncPhase.error);
+
+    runner.pushSync({
+      'session': 'estate',
+      'reason': 'retry',
+      'result': {'stillAhead': false},
+    });
+    await Future<void>.delayed(Duration.zero);
+
+    expect(bridge.session('estate').currentStatus.phase, SyncPhase.idle);
+    expect(bridge.session('estate').currentStatus.lastError, isNull);
+  });
+
+  test('status listener attached before connect never sends ambiguous metrics',
+      () async {
+    await bridge.ready;
+    final statuses = <SyncStatus>[];
+    final subscription = bridge.syncStatus.listen(statuses.add);
+    await Future<void>.delayed(Duration.zero);
+
+    expect(
+      runner.sent.where((message) => message['op'] == 'metrics'),
+      isEmpty,
+    );
+
+    await bridge.connect(cloud: 'https://c', workspace: 'home');
+    await bridge.connect(cloud: 'https://c', workspace: 'estate');
+    for (var attempt = 0;
+        attempt < 20 &&
+            !statuses.any((status) => status.ahead == 4 && status.behind == 1);
+        attempt += 1) {
+      await Future<void>.delayed(const Duration(milliseconds: 10));
+    }
+
+    final metricRequests =
+        runner.sent.where((message) => message['op'] == 'metrics').toList();
+    expect(metricRequests, isNotEmpty);
+    expect(
+      metricRequests.every(
+        (message) =>
+            (message['args'] as Map)['session'] is String &&
+            ((message['args'] as Map)['session'] as String).isNotEmpty,
+      ),
+      isTrue,
+    );
+    expect(
+      statuses.any((status) => status.ahead == 4 && status.behind == 1),
+      isTrue,
+    );
+    expect(statuses.last.lastError, isNull);
+    await subscription.cancel();
+  });
+
   test('a law refusal throws NomosBridgeError with the verbatim message',
       () async {
     await bridge.ready;

package/dart_types/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.8.3
+
+- Add the typed `GitObjectId` value used to identify immutable custody objects without falling back to
+  interchangeable strings.
+
 ## 0.8.2
 
 - Carry the typed bounded-startup, missing-law and governed child-policy errors used by the USDA-native

package/dart_types/lib/nomos_types.dart

@@ -46,6 +46,7 @@ export 'src/invitation.dart' show Identity, User, Recipient, Invitation;
 // birth methods — actor/authorSecret are distinct types, so a transposition is a compile error.
 export 'src/principal.dart';
 export 'src/sha256_digest.dart';
+export 'src/git_object_id.dart';
 // The CUSTODY-LIFECYCLE types (rebirth_and_custody_lifecycle.md): NomosCustodyBreak / NomosCustodyStatus /
 // CustodyBreakPolicy — custody incompatibility as a first-class, typed, app-decidable event. Pure data.
 export 'src/custody.dart';

package/dart_types/lib/src/git_object_id.dart

@@ -0,0 +1,37 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.
+
+/// A Git object identity in Nomos's current gix custody spelling: exactly 40
+/// lowercase hexadecimal characters.
+///
+/// This is deliberately not interchangeable with [String] or a semantic
+/// content digest. The wrapper is zero-cost at runtime and validates at the
+/// application boundary before an offer is assembled.
+extension type const GitObjectId._(String value) {
+  factory GitObjectId(String value) {
+    if (!_isLowercaseGitObjectId(value)) {
+      throw FormatException(
+        'expected a 40-character lowercase hexadecimal Git object id',
+        value,
+      );
+    }
+    return GitObjectId._(value);
+  }
+
+  static GitObjectId parse(String value) => GitObjectId(value);
+
+  static GitObjectId? tryParse(String value) {
+    if (!_isLowercaseGitObjectId(value)) return null;
+    return GitObjectId._(value);
+  }
+}
+
+bool _isLowercaseGitObjectId(String value) {
+  if (value.length != 40) return false;
+  for (final codeUnit in value.codeUnits) {
+    final digit = codeUnit >= 0x30 && codeUnit <= 0x39;
+    final lowercaseHex = codeUnit >= 0x61 && codeUnit <= 0x66;
+    if (!digit && !lowercaseHex) return false;
+  }
+  return true;
+}

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. The hand-written serde-JSON-compatible types plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.8.2
+version: 0.8.3
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.103.3",
+  "version": "0.103.5",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",