@githolon/dsl 0.105.14 → 0.105.16

package/dart/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 0.64.32
+
+- Prove a restored generated-application device is enrolled before exposing business APIs, including recovery from an interrupted bootstrap journal.
+
+## 0.64.31
+
+- Restage the validated intent-offer byte gate and deterministic signer-posture reader into the immutable Dart runner.
+
+## 0.64.30
+
+- Recover an authenticated generated application's replacement device through the established repeated-birth compatibility lane when guardian policy refuses keyless enrolment.
+- Resolve signer posture from the relation tuple's deterministic aggregate address so composed application law cannot make framework query aliases ambiguous.
+
 ## 0.64.29
 
 - Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

package/dart/lib/src/runner/node-entry.mjs

@@ -8152,8 +8152,8 @@ function createGovernanceOffers(ctx) {
     },
     /**
      * PARENT-AUTHORITY POSTURE (read-only diagnostic): is `identity:<principal>#signer@key:<keyHash>`
-     * a LIVE tuple on `parent`'s chain? Reads the parent's declared `relationTuplesByObject` query over
-     * the open gateway — one O(1) relation read, no authoring. Returns
+     * a LIVE tuple on `parent`'s chain? Reads the tuple's deterministic aggregate address over the
+     * generic record lane — one O(1) read, no authoring and no ambiguous query alias in composed law. Returns
      * `{ parent, principal, keyHash, object, relation, enrolled, revoked, checkedAt }`.
      * `revoked: true` means the subject's leaf was flipped `status:revoked` (remove-wins — a lawful
      * re-enroll of the SAME key is refused; mint + enroll a new device key instead).
@@ -8167,19 +8167,13 @@ function createGovernanceOffers(ctx) {
         keyHash = await sha256hexBytes2(bytesUnb642(publicKey));
       }
       const object = signerObjectOf(p);
+      const aggregateId = `reltuple-${object}-signer`;
       let rows;
       if (parent === workspace && !remote) {
-        rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
+        rows = JSON.parse(call("query", { queryBytes: qBytes2({ op: "byId", aggregateId }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const route = await resolveFrameworkRoute({
-          parent,
-          operationId: "relationTuplesByObject",
-          method: "get",
-          token: authToken,
-          principal: p
-        });
-        const r = await _fetch(`${base}/v2/workspaces/${parent}${route.path}?object=${encodeURIComponent(object)}`, { headers });
+        const r = await _fetch(`${base}/v2/workspaces/${parent}/aggregates/${encodeURIComponent(aggregateId)}`, { headers });
         const text = await r.text();
         let body;
         try {
@@ -8187,7 +8181,7 @@ function createGovernanceOffers(ctx) {
         } catch {
           body = text;
         }
-        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s relationTuplesByObject failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
+        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s signer tuple failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
         rows = Array.isArray(body) ? body : body && Array.isArray(body.rows) ? body.rows : [];
       }
       let enrolled = false, revoked = false, verifiedVia;

package/dart/lib/src/runner/offline-install.mjs

@@ -102,6 +102,8 @@ async function refreshRuntimeDir(cloud, dir, { fetchImpl = globalThis.fetch, log
 // src/_adapter/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
+  MAX_INLINE_INTENT_OFFER_BYTES: () => MAX_INLINE_INTENT_OFFER_BYTES,
+  MAX_STAGED_INTENT_OFFER_BYTES: () => MAX_STAGED_INTENT_OFFER_BYTES,
   NOMOS_SHARD_ROWS_READ: () => NOMOS_SHARD_ROWS_READ,
   admitAll: () => admitAll,
   admitIntentOffers: () => admitIntentOffers,
@@ -164,6 +166,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installedLaw: () => installedLaw,
   intentOfferResidencies: () => intentOfferResidencies,
+  intentOfferSizeRefusal: () => intentOfferSizeRefusal,
   isDirty: () => isDirty,
   isWarranted: () => isWarranted,
   kernelStamp: () => kernelStamp,
@@ -6781,6 +6784,12 @@ async function replicateIntents(eng2, ws, ledger, intents, { push = true } = {})
   log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
   return { replicated, skipped, refused };
 }
+var MAX_INLINE_INTENT_OFFER_BYTES = 32 * 1024 * 1024;
+var MAX_STAGED_INTENT_OFFER_BYTES = 64 * 1024 * 1024;
+function intentOfferSizeRefusal(staged, byteLength) {
+  const maxOfferBytes = staged ? MAX_STAGED_INTENT_OFFER_BYTES : MAX_INLINE_INTENT_OFFER_BYTES;
+  return byteLength <= 0 || byteLength > maxOfferBytes ? `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` : null;
+}
 async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
   const main = await mainIntentIds(eng2, ws);
   const sessions = /* @__PURE__ */ new Map();
@@ -6852,9 +6861,16 @@ async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
       if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
-      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
-      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
-        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+      if (!blob) {
+        rec.rejected.push({
+          oid: String(offer?.oid || "").slice(0, 10),
+          error: intentOfferSizeRefusal(!!offer?.staged, 0)
+        });
+        continue;
+      }
+      const sizeRefusal = intentOfferSizeRefusal(!!offer?.staged, blob.byteLength);
+      if (sizeRefusal !== null) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: sizeRefusal });
         continue;
       }
       const inspected = kgit.inspectChange(eng2, blob);

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.29
+version: 0.64.32
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.14",
+  "version": "0.105.16",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -7183,8 +7183,8 @@ function createGovernanceOffers(ctx) {
     },
     /**
      * PARENT-AUTHORITY POSTURE (read-only diagnostic): is `identity:<principal>#signer@key:<keyHash>`
-     * a LIVE tuple on `parent`'s chain? Reads the parent's declared `relationTuplesByObject` query over
-     * the open gateway — one O(1) relation read, no authoring. Returns
+     * a LIVE tuple on `parent`'s chain? Reads the tuple's deterministic aggregate address over the
+     * generic record lane — one O(1) read, no authoring and no ambiguous query alias in composed law. Returns
      * `{ parent, principal, keyHash, object, relation, enrolled, revoked, checkedAt }`.
      * `revoked: true` means the subject's leaf was flipped `status:revoked` (remove-wins — a lawful
      * re-enroll of the SAME key is refused; mint + enroll a new device key instead).
@@ -7198,19 +7198,13 @@ function createGovernanceOffers(ctx) {
         keyHash = await sha256hexBytes2(bytesUnb642(publicKey));
       }
       const object = signerObjectOf(p);
+      const aggregateId = `reltuple-${object}-signer`;
       let rows;
       if (parent === workspace && !remote) {
-        rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
+        rows = JSON.parse(call("query", { queryBytes: qBytes2({ op: "byId", aggregateId }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const route = await resolveFrameworkRoute({
-          parent,
-          operationId: "relationTuplesByObject",
-          method: "get",
-          token: authToken,
-          principal: p
-        });
-        const r = await _fetch(`${base}/v2/workspaces/${parent}${route.path}?object=${encodeURIComponent(object)}`, { headers });
+        const r = await _fetch(`${base}/v2/workspaces/${parent}/aggregates/${encodeURIComponent(aggregateId)}`, { headers });
         const text2 = await r.text();
         let body;
         try {
@@ -7218,7 +7212,7 @@ function createGovernanceOffers(ctx) {
         } catch {
           body = text2;
         }
-        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s relationTuplesByObject failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
+        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s signer tuple failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
         rows = Array.isArray(body) ? body : body && Array.isArray(body.rows) ? body.rows : [];
       }
       let enrolled = false, revoked = false, verifiedVia;
@@ -13504,6 +13498,27 @@ function applicationError(message, code, cause) {
   if (cause !== void 0) error.cause = cause;
   return error;
 }
+function applicationOpenFailure(application, requestedModel, cause) {
+  const typed = cause;
+  if (typed?.name === "NomosApplicationError" && typeof typed.code === "string") {
+    return cause;
+  }
+  const raw = String(cause?.message ?? cause ?? "unknown failure");
+  if (/birth-current-law-unavailable|birth install target|\[nomos\.birth\.model_not_active\]/i.test(raw)) {
+    const model = /(?:birth install target|under model)\s+([0-9a-f]{64})/i.exec(raw)?.[1] ?? requestedModel;
+    const shortModel = /^[0-9a-f]{64}$/i.test(model) ? `${model.slice(0, 16)}\u2026` : "the requested model";
+    return applicationError(
+      `Nomos application '${application}' cannot create this private workspace because its parent does not currently serve model ${shortModel}. No workspace was created. A current generated client should inherit the parent's active model at birth and then govern adoption of its packaged model; regenerate the application client before retrying, or have an authorised application release adopt that model on the parent.`,
+      "nomos.application.bootstrap_model_not_active",
+      cause
+    );
+  }
+  return applicationError(
+    `Nomos could not finish preparing the signed-in '${application}' application: ${raw}`,
+    "nomos.application.open_failed",
+    cause
+  );
+}
 async function ensureGeneratedModelCurrent(application, approveModel) {
   if (application.model?.adopt === void 0) {
     throw applicationError(
@@ -13869,7 +13884,6 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
     let authorityHolon = await measureOpen("open private application custody", () => mountAuthority(secret, authToken));
     const storedJournal = await measureOpen("load application bootstrap state", () => store.loadText(journalState));
     const completed = storedJournal === "complete";
-    const hadDurableSecret = secret !== null;
     let publicKey;
     if (secret === null) {
       const device = await measureOpen("create application device identity", () => authorityHolon.authorKeygen());
@@ -13890,6 +13904,43 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       throw applicationError("Sign in changed authority while preparing this application device.", "nomos.authority.changed_during_open");
     }
     authToken = deviceToken;
+    const birthOrRepeat = async () => {
+      const birth = await measureOpen("establish private application custody", () => authorityHolon.nomosInternalBirthReceivingGroup({
+        parent: application,
+        principal,
+        subject,
+        device: { secret, public: publicKey },
+        authToken,
+        idToken: authToken,
+        verifiedVia: issuer,
+        bornAt: now().toISOString(),
+        confirm: true
+      }));
+      const verdict = birth.verify;
+      if (verdict !== void 0 && verdict.valid !== true) throw new Error(`the born application failed replay verification: ${String(verdict.error ?? "unknown")}`);
+    };
+    const ensureSignerEnrollment = async () => {
+      const enroll = () => authorityHolon.ensureParentSignerEnrollment({
+        // The write gate that this device will use is the receiving-group workspace itself.
+        // The application root authorises/births that home; it is not a substitute signer index.
+        parent: receivingGroup,
+        // The author gate speaks canonical Nomos principals. A provider subject is deliberately
+        // opaque and may contain its own namespace separators; never enrol that raw value as the actor.
+        principal: subject,
+        publicKey,
+        authorSecret: secret,
+        authToken,
+        idToken: authToken,
+        verifiedVia: issuer
+      });
+      try {
+        await measureOpen("confirm private-custody signer enrolment", enroll);
+      } catch (error) {
+        if (!String(error).includes("receiving-group-additional-device-requires-current-device-or-guardian")) throw error;
+        await birthOrRepeat();
+        await measureOpen("verify recovered private-custody signer enrolment", enroll);
+      }
+    };
     if (!completed) {
       let homeAvailable = false;
       try {
@@ -13897,33 +13948,7 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       } catch {
       }
       if (!homeAvailable) {
-        const birth = await measureOpen("establish private application custody", () => authorityHolon.nomosInternalBirthReceivingGroup({
-          parent: application,
-          principal,
-          subject,
-          device: { secret, public: publicKey },
-          authToken,
-          idToken: authToken,
-          verifiedVia: issuer,
-          bornAt: now().toISOString(),
-          confirm: true
-        }));
-        const verdict = birth.verify;
-        if (verdict !== void 0 && verdict.valid !== true) throw new Error(`the born application failed replay verification: ${String(verdict.error ?? "unknown")}`);
-      } else if (!hadDurableSecret) {
-        await measureOpen("enrol application device in its private custody", () => authorityHolon.ensureParentSignerEnrollment({
-          // The write gate that this device will use is the receiving-group workspace itself.
-          // The application root authorises/births that home; it is not a substitute signer index.
-          parent: receivingGroup,
-          // The author gate speaks canonical Nomos principals. A provider subject is deliberately
-          // opaque and may contain its own namespace separators; never enrol that raw value as the actor.
-          principal: subject,
-          publicKey,
-          authorSecret: secret,
-          authToken,
-          idToken: authToken,
-          verifiedVia: issuer
-        }));
+        await birthOrRepeat();
       }
       await measureOpen("save application bootstrap progress", () => store.saveText(journalState, "home-available"));
       authorityHolon = await measureOpen("rebind durable application authority", () => mountAuthority(secret, authToken));
@@ -13936,23 +13961,11 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       const verified = await measureOpen("verify new application custody", () => authorityHolon.verifyChain());
       if (verified.valid !== true) throw new Error(`the private authority context failed replay verification: ${String(verified.error ?? "unknown")}`);
       await measureOpen("save application bootstrap progress", () => store.saveText(journalState, "verified"));
-      try {
-        await measureOpen("confirm private-custody signer enrolment", () => authorityHolon.ensureParentSignerEnrollment({
-          parent: receivingGroup,
-          principal: subject,
-          authorSecret: secret,
-          authToken,
-          idToken: authToken,
-          verifiedVia: issuer
-        }));
-      } catch (error) {
-        if (/revoked/i.test(String(error))) throw error;
-      }
-      await measureOpen("complete application bootstrap journal", async () => {
+      await measureOpen("save verified application bootstrap journal", async () => {
         await store.saveText(journalState, "complete");
-        await store.remove(journalState);
       });
     }
+    await ensureSignerEnrollment();
     holon = authorityHolon;
     const authorityVerified = await measureOpen("verify application custody", () => holon.verifyChain());
     if (authorityVerified.valid !== true) throw new Error(`the private authority context failed replay verification: ${String(authorityVerified.error ?? "unknown")}`);
@@ -14042,7 +14055,7 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
   } catch (cause) {
     await closeRealm().catch(() => {
     });
-    throw applicationError("Nomos could not finish preparing the signed-in business application.", "nomos.application.open_failed", cause);
+    throw applicationOpenFailure(application, options.lawHash, cause);
   }
 }
 export {

package/src/compile_package_main.ts

@@ -1664,8 +1664,8 @@ const NOMOS_TYPES_DEP = "^0.8.7";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.29";
-const NOMOS_FLUTTER_DEP = "^0.63.52";
+const NOMOS_CLIENT_DEP = "^0.64.32";
+const NOMOS_FLUTTER_DEP = "^0.63.55";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).