@githolon/dsl 0.107.4 → 0.108.1

package/dart/test/offer_authentication_proof_test.dart

@@ -0,0 +1,193 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+import 'package:test/test.dart';
+
+final class _ProofTransport
+    implements BridgeTransport, NomosKernelCallTransport {
+  final _messages = StreamController<Map<String, Object?>>.broadcast();
+  protocol.CallRequest? lastCall;
+  var providerToken = protocol.ProviderTokenVerificationStatus
+      .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_MATCHING_KEY;
+  var enrolledDevice = true;
+  var resolvedPrincipal = 'user:jack';
+  var syncCalls = 0;
+
+  _ProofTransport() {
+    scheduleMicrotask(
+      () => _messages.add({
+        'v': kWebviewBridgeVersion,
+        'event': 'ready',
+        'bundleVersion': 'unbundled-dev',
+      }),
+    );
+  }
+
+  @override
+  Stream<Map<String, Object?>> get messages => _messages.stream;
+
+  @override
+  void send(Map<String, Object?> message) {
+    if (message['op'] != 'connect') {
+      throw UnsupportedError('unexpected legacy operation ${message['op']}');
+    }
+    final id = message['id']! as int;
+    final args = (message['args']! as Map).cast<String, Object?>();
+    scheduleMicrotask(
+      () => _messages.add({
+        'v': kWebviewBridgeVersion,
+        'id': id,
+        'ok': true,
+        'result': {'workspace': args['workspace']},
+      }),
+    );
+  }
+
+  @override
+  Future<protocol.RuntimeResponse> invokeRuntime(
+    protocol.RuntimeRequest request,
+  ) async {
+    if (request.hasSyncWorkspace()) {
+      syncCalls += 1;
+      providerToken = protocol.ProviderTokenVerificationStatus
+          .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID;
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        syncWorkspace: protocol.SyncWorkspaceResponse(
+          workspace: request.syncWorkspace.session,
+        ),
+      );
+    }
+    return protocol.RuntimeResponse(
+      protocolVersion: 2,
+      requestId: request.requestId,
+      realmClosed: protocol.RealmClosed(),
+    );
+  }
+
+  @override
+  Future<protocol.CallResponse> callKernel({
+    required String session,
+    required protocol.CallRequest request,
+  }) async {
+    lastCall = request.deepCopy();
+    if (request.hasQuery() && request.query.hasAuthenticationPosture()) {
+      return protocol.CallResponse(
+        protocolVersion: 1,
+        requestId: request.requestId,
+        query: protocol.QueryResponse(
+          authenticationPosture: protocol.AuthenticationPostureResponse(
+            providerToken: providerToken,
+            enrolledDevice: enrolledDevice,
+            resolvedPrincipal: resolvedPrincipal,
+          ),
+        ),
+      );
+    }
+    return protocol.CallResponse(
+      protocolVersion: 1,
+      requestId: request.requestId,
+      offer: protocol.OfferResponse(
+        admitted: protocol.OfferAdmitted(
+          head: 'HEAD-offer',
+          intentId: 'intent-offer',
+        ),
+      ),
+    );
+  }
+}
+
+void main() {
+  test('law-selected enrolled-device proof withholds the provider token',
+      () async {
+    final transport = _ProofTransport();
+    final bridge = NomosBridge(transport);
+    addTearDown(bridge.dispose);
+    final secret = base64Encode(List<int>.filled(32, 7));
+    await bridge.ready;
+    await bridge.connect(
+      workspace: 'home',
+      session: 'home',
+      authorSecret: secret,
+      authToken: 'stale.provider.token',
+    );
+    final call = NmsInternalGeneratedCalls.create(
+      domain: 'identity',
+      directive: 'recoverProvider',
+      canonicalUsda: Uint8List.fromList([1]),
+    );
+
+    await bridge.session('home').offerCallUsdaOutcome(call: call);
+    expect(transport.lastCall!.offer.authoring.authToken, isNotEmpty);
+    expect(transport.lastCall!.offer.authoring.authorSecret, isNotEmpty);
+
+    await bridge.session('home').offerCallUsdaOutcome(
+          call: call,
+          authenticationProof: NomosOfferAuthenticationProof.enrolledDevice,
+        );
+    expect(transport.lastCall!.offer.authoring.authToken, isEmpty);
+    expect(transport.lastCall!.offer.authoring.authorSecret, isNotEmpty);
+  });
+
+  test('enrolled-device proof fails before transport without a device key',
+      () async {
+    final transport = _ProofTransport();
+    final bridge = NomosBridge(transport);
+    addTearDown(bridge.dispose);
+    await bridge.ready;
+    await bridge.connect(
+      workspace: 'home',
+      session: 'home',
+      authToken: 'stale.provider.token',
+    );
+    final call = NmsInternalGeneratedCalls.create(
+      domain: 'identity',
+      directive: 'recoverProvider',
+      canonicalUsda: Uint8List.fromList([1]),
+    );
+
+    await expectLater(
+      bridge.session('home').offerCallUsdaOutcome(
+            call: call,
+            authenticationProof: NomosOfferAuthenticationProof.enrolledDevice,
+          ),
+      throwsA(isA<StateError>()),
+    );
+    expect(transport.lastCall, isNull);
+  });
+
+  test('authentication recovery waits for the exact typed kernel postcondition',
+      () async {
+    final transport = _ProofTransport();
+    final bridge = NomosBridge(transport);
+    addTearDown(bridge.dispose);
+    final secret = base64Encode(List<int>.filled(32, 7));
+    await bridge.ready;
+    await bridge.connect(
+      workspace: 'home',
+      session: 'home',
+      authorSecret: secret,
+      authToken: 'stale.provider.token',
+    );
+    final home = bridge.session('home');
+
+    final before = await home.nmsAuthenticationPosture(principal: 'user:jack');
+    expect(
+      before.providerToken,
+      NomosProviderTokenVerification.noMatchingKey,
+    );
+    expect(before.enrolledDevice, isTrue);
+
+    final after = await home.nmsAwaitAuthenticationReady(
+      principal: 'user:jack',
+    );
+    expect(after.providerToken, NomosProviderTokenVerification.valid);
+    expect(after.enrolledDevice, isTrue);
+    expect(after.resolvedPrincipal, 'user:jack');
+    expect(transport.syncCalls, 1);
+  });
+}

package/dart/test/result_usda_test.dart

@@ -0,0 +1,49 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:test/test.dart';
+
+void main() {
+  test('parses canonical nominal rows without a generic result map', () {
+    final result = NmsUsdaResult.parse(
+      Uint8List.fromList(
+        utf8.encode('''#usda 1.0
+(
+    defaultPrim = "Result"
+)
+
+def NomosReadResult "Result"
+{
+    custom uniform bool nomos:done = true
+
+    def NomosListValue "Rows"
+    {
+        def NomosRecordValue "i_00000000"
+        {
+            custom uniform string nomos:id = "note:1"
+            custom rel nomos:type = </Nomos/Domains/d_1/Aggregates/a_note>
+
+            def NomosStringValue "f_title"
+            {
+                custom rel nomos:field = </Nomos/Domains/d_1/Aggregates/a_note/Fields/f_title>
+                custom uniform string nomos:value = "Ship"
+            }
+        }
+    }
+}
+'''),
+      ),
+    );
+
+    expect(result.done, isTrue);
+    expect(result.rows.single.relationship('nomos:type'),
+        '/Nomos/Domains/d_1/Aggregates/a_note');
+    expect(
+      result.rows.single
+          .requiredField('/Nomos/Domains/d_1/Aggregates/a_note/Fields/f_title')
+          .stringValue(),
+      'Ship',
+    );
+  });
+}

package/dart/test/session_bound_test.dart

@@ -59,7 +59,7 @@ Future<NomosTestHarness> _harness() => NomosTestHarness.ephemeral(
     );
 
 Future<NomosOfferOutcome> _birthEstate(
-  NomosSession session,
+  HomeApplication application,
   NomosTestHarness harness, {
   String owner = _owner,
 }) {
@@ -69,12 +69,7 @@ Future<NomosOfferOutcome> _birthEstate(
     lawHash: harness.lawHashes(harness.workspace).first,
     bornAt: DateTime.now().toUtc().toIso8601String(),
   );
-  return session.offerOutcome(
-    domain: 'home',
-    directiveId: 'birthEstateWorkspace',
-    payload: facts.nmsInternalToPayloadJson(),
-    actor: owner,
-  );
+  return nomosInternalHomeBirthEstateWorkspace(application, facts);
 }
 
 void main() {
@@ -124,14 +119,15 @@ void main() {
       // This fixture predates businessBirth and intentionally keeps its kernel birth
       // primitive out of the generated tenant application. The raw offer is framework
       // setup; the generated application remains the only public business surface.
-      final birth = await _birthEstate(home, harness);
+      final birth = await _birthEstate(homeApplication, harness);
       expect(birth.workspace, harness.workspace,
           reason:
               'the birth offer landed in the SESSION workspace, no loose parent');
       expect(birth.gatewayVerdict, isNull,
           reason: 'the local offer lane, not the legacy relay');
       expect(birth.born, hasLength(1));
-      expect(birth.birthOutcomes.first['status'], 'born');
+      expect(birth.birthOutcomes.first.status,
+          NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN);
 
       // FOLLOW THE REF (ask 8): NomosRef in, mounted session out — never a string pair.
       final estate = await harness.bridge.follow(birth.bornRefs.single,
@@ -184,8 +180,9 @@ void main() {
       // emitted, regardless of ticks. The fix delegates to the parent plane like every other
       // reactive read; the first tick must deliver a snapshot (empty — no Surfaced law here).
       final first = session.watchPendingConflicts().first;
-      await nomosInternalBindHomeApplication(session, _owner);
-      await _birthEstate(session, harness);
+      final application =
+          await nomosInternalBindHomeApplication(session, _owner);
+      await _birthEstate(application, harness);
       final rows = await first.timeout(const Duration(seconds: 30));
       expect(rows, isEmpty,
           reason:

package/dart/test/stale_bundle_test.dart

@@ -4,6 +4,7 @@
 import 'dart:async';
 
 import 'package:nomos_client/src/nms_conformance_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
 import 'package:test/test.dart';
 
 class _StampedRunner implements BridgeTransport {
@@ -19,16 +20,29 @@ class _StampedRunner implements BridgeTransport {
   @override
   Stream<Map<String, Object?>> get messages => _incoming.stream;
   @override
+  Future<protocol.RuntimeResponse> invokeRuntime(
+    protocol.RuntimeRequest request,
+  ) async =>
+      protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        realmClosed: protocol.RealmClosed(),
+      );
+  @override
   void send(Map<String, Object?> message) {}
 }
 
 void main() {
-  test('a PRE-STAMP bundle (no bundleVersion) fails ready with StaleRunnerBundle', () async {
+  test(
+      'a PRE-STAMP bundle (no bundleVersion) fails ready with StaleRunnerBundle',
+      () async {
     final b = NomosBridge(_StampedRunner(null));
     await expectLater(b.ready, throwsA(isA<StaleRunnerBundle>()));
   });
 
-  test('an OLDER stamp fails ready, and the error names found/expected + the remedy', () async {
+  test(
+      'an OLDER stamp fails ready, and the error names found/expected + the remedy',
+      () async {
     final b = NomosBridge(_StampedRunner('0.53.1'));
     Object? err;
     try {
@@ -59,7 +73,8 @@ void main() {
   });
 
   test('allowStaleRunnerBundle is the deliberate escape hatch', () async {
-    final b = NomosBridge(_StampedRunner('0.1.0'), allowStaleRunnerBundle: true);
+    final b =
+        NomosBridge(_StampedRunner('0.1.0'), allowStaleRunnerBundle: true);
     await b.ready;
   });
 }

package/dart/test/test_harness_test.dart

@@ -11,7 +11,10 @@ library;
 
 import 'dart:io';
 
+import 'package:fixnum/fixnum.dart' show Int64;
 import 'package:nomos_client/src/nms_conformance_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart'
+    show RuntimeTransportFailure, SyncWorkspaceResponse;
 import 'package:test/test.dart';
 
 String get _repoEntry =>
@@ -46,35 +49,19 @@ void main() {
       'convergence never reports rejected or dead-lettered business work as success',
       () {
     expect(
-        nmsPermanentConvergenceFailure({
-          'stillAhead': false,
-          'admission': {
-            'ok': true,
-            'sessions': [
-              {
-                'rejected': [
-                  {'directiveId': 'commissionAsset', 'error': 'event-mismatch'}
-                ]
-              }
-            ],
-            'deadLetters': [
-              {'directiveId': 'commissionAsset', 'error': 'event-mismatch'}
-            ],
-          },
-        }),
-        contains('commissionAsset'));
+        nmsPermanentConvergenceFailure(
+          SyncWorkspaceResponse(refused: Int64.ONE),
+        ),
+        contains('refused=1'));
     expect(
-        nmsPermanentConvergenceFailure({
-          'stillAhead': false,
-          'pushError': {'refused': true, 'error': 'policy-refused'},
-        }),
+        nmsPermanentConvergenceFailure(SyncWorkspaceResponse(
+          pushError: RuntimeTransportFailure(
+            refused: true,
+            message: 'policy-refused',
+          ),
+        )),
         contains('policy-refused'));
-    expect(
-        nmsPermanentConvergenceFailure({
-          'stillAhead': false,
-          'admission': {'ok': true, 'sessions': const []},
-        }),
-        isNull);
+    expect(nmsPermanentConvergenceFailure(SyncWorkspaceResponse()), isNull);
   });
 
   test('ephemeral rejects an empty deploy list with a named remedy', () async {