@githolon/dsl 0.105.1 → 0.105.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dart/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,7 @@
|
|
|
1
|
+
## 0.64.18
|
|
2
|
+
|
|
3
|
+
- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
|
|
4
|
+
|
|
1
5
|
## 0.64.17
|
|
2
6
|
|
|
3
7
|
- Rebuild the bundled runner assets from @githolon/client 0.104.0 (the evolve-on-read release). Published pub.dev archives are immutable, so regenerated runtime bytes need their own version.
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
|
|
3
3
|
// <define:__NOMOS_KERNEL_RELEASE__>
|
|
4
|
-
var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "
|
|
4
|
+
var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d42871a577eb20acd931873998ecb4348df4bfdd09b772f1fb4c20c59b6e85cd", version: "kernel-d42871a5", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "a90ca104fdb9d9eb3d42f605f5f85e000e2e84bd782a2aac8bb1be2a49d45833", version: "kernel-a90ca104", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
|
|
5
5
|
|
|
6
6
|
// runner/node-entry.ts
|
|
7
7
|
import { createInterface } from "node:readline";
|
|
@@ -6,7 +6,7 @@ var __export = (target, all) => {
|
|
|
6
6
|
};
|
|
7
7
|
|
|
8
8
|
// <define:__NOMOS_KERNEL_RELEASE__>
|
|
9
|
-
var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "
|
|
9
|
+
var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d42871a577eb20acd931873998ecb4348df4bfdd09b772f1fb4c20c59b6e85cd", version: "kernel-d42871a5", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "a90ca104fdb9d9eb3d42f605f5f85e000e2e84bd782a2aac8bb1be2a49d45833", version: "kernel-a90ca104", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
|
|
10
10
|
|
|
11
11
|
// runner/offline-install.ts
|
|
12
12
|
import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";
|
package/dart/pubspec.yaml
CHANGED
|
@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
|
|
|
7
7
|
description: >-
|
|
8
8
|
Nomos 2 Dart client — generated domain values, intent payloads and application
|
|
9
9
|
lifecycle types over the typed Nomos kernel protocol and USDA custody model.
|
|
10
|
-
version: 0.64.
|
|
10
|
+
version: 0.64.18
|
|
11
11
|
|
|
12
12
|
environment:
|
|
13
13
|
sdk: ^3.5.0
|
package/package.json
CHANGED
|
@@ -1653,8 +1653,8 @@ const NOMOS_TYPES_DEP = "^0.8.5";
|
|
|
1653
1653
|
// 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
|
|
1654
1654
|
// DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
|
|
1655
1655
|
// REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
|
|
1656
|
-
const NOMOS_CLIENT_DEP = "^0.64.
|
|
1657
|
-
const NOMOS_FLUTTER_DEP = "^0.63.
|
|
1656
|
+
const NOMOS_CLIENT_DEP = "^0.64.18";
|
|
1657
|
+
const NOMOS_FLUTTER_DEP = "^0.63.29";
|
|
1658
1658
|
// DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
|
|
1659
1659
|
// and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
|
|
1660
1660
|
// land back in dependency_overrides (the exact co2 report this closes, third occurrence).
|
package/src/framework/home.ts
CHANGED
|
@@ -94,8 +94,14 @@ export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
|
|
|
94
94
|
* The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
|
|
95
95
|
* client-side branch: every peer replays the same rule. The first supported posture is intentionally small
|
|
96
96
|
* and secure: a live, verified device may add or revoke another device; keyless IdP enrolment is only the
|
|
97
|
-
* pre-group bootstrap lane
|
|
98
|
-
*
|
|
97
|
+
* pre-group bootstrap lane.
|
|
98
|
+
*
|
|
99
|
+
* ALL-DEVICE-LOSS RECOVERY — design done, NOT YET SHIPPED (`architecture/guardian_device_recovery.md`,
|
|
100
|
+
* 2026-08-06). DO NOT re-derive this from scratch under a live incident again — read that doc first. The
|
|
101
|
+
* primitives already exist (`enrollDelegation` + `birthReceivingGroup` + `revokeSigner`); what's missing is
|
|
102
|
+
* a kernel-side closure (birth-repeat currently accepts a SELF-signed delegation onto an already-founded
|
|
103
|
+
* group — a live gap, not a feature, until closed) plus client wiring. `guardianQuorum`/`recovery` below are
|
|
104
|
+
* the policy fields that design reads.
|
|
99
105
|
*/
|
|
100
106
|
export const ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
|
|
101
107
|
additionalDevice: t.string().merge(Lww),
|
|
@@ -201,7 +207,15 @@ const receivingGroupPolicyRefs = readSet(
|
|
|
201
207
|
);
|
|
202
208
|
|
|
203
209
|
/** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
|
|
204
|
-
* device policy. A new group device must be approved by a current device or, later, guardian evidence.
|
|
210
|
+
* device policy. A new group device must be approved by a current device or, later, guardian evidence.
|
|
211
|
+
*
|
|
212
|
+
* KNOWN GAP (`architecture/guardian_device_recovery.md`): this invariant is declared `.on("enrollFirstDevice")`
|
|
213
|
+
* and only fires when that directive targets THIS home directly. It is NOT re-applied when the birth
|
|
214
|
+
* offer-effect (`run_birth_effect`, repeating `nomosInternalBirthReceivingGroup` against an ALREADY-founded
|
|
215
|
+
* home) folds a signer seat via the SAME underlying mechanism — a self-signed keyless delegation currently
|
|
216
|
+
* reseats a device there with no guardian, no approval, no delay. Verified live 2026-08-06. Fix belongs in
|
|
217
|
+
* the kernel's keyless `verify_to_root` branch (refuse a self-signed cert onto an already-warranted signer
|
|
218
|
+
* roster); do not paper over it in the DSL only. */
|
|
205
219
|
export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
|
|
206
220
|
.on("enrollFirstDevice")
|
|
207
221
|
.reads(receivingGroupPolicyRefs)
|