@githolon/dsl 0.108.3 → 0.108.4

package/dart/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.65.2
+
+- Preserve complete typed birth lineage and recover existing workspaces through the authenticated
+  installed-controller lifecycle without falling back to dynamic host-authored payloads.
+
 ## 0.65.1
 
 - Publish the generated nominal application call and query surfaces required by current DSL output, so

package/dart/lib/src/runner/node-entry.mjs

@@ -14666,8 +14666,24 @@ function firstDeviceDelegationPayload(route, certificate, typedPayload) {
   if (declared.has("delegationCertificate")) {
     return { delegationCertificate: typedPayload };
   }
-  throw new Error(
-    `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract [nomos.application.contract_missing]`
+  throw new NomosClientError(
+    `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract`,
+    {
+      code: "nomos.application.contract_missing",
+      operation: "enrollFirstDevice",
+      recommendedAction: NomosRecommendedAction.redeployLaw,
+      info: {
+        code: "nomos.application.contract_missing",
+        message: `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract`,
+        component: "nomos.application",
+        domain: route.domain,
+        operation: "enrollFirstDevice",
+        attributes: {
+          "nomos.application.missing_contract": "delegationCertificate",
+          "nomos.recovery.action": "repeat-parent-authorized-birth"
+        }
+      }
+    }
   );
 }
 var GIT_OBJECT_ID = /^[0-9a-f]{40}$/;

package/dart/lib/src/runner/offline-install.mjs

@@ -4390,6 +4390,8 @@ __export(engine_exports, {
   author: () => author,
   authorEphemeral: () => authorEphemeral,
   authorKeygen: () => authorKeygen,
+  authorModelLifecyclePromotion: () => authorModelLifecyclePromotion,
+  authorModelLifecycleStage: () => authorModelLifecycleStage,
   authorOn: () => authorOn,
   authorOperatorCall: () => authorOperatorCall,
   backupHead: () => backupHead,
@@ -10898,6 +10900,7 @@ var AuthoringOptionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_ke
 var CapturedClockSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 49);
 var BirthCertificateSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 50);
 var SignBirthCertificateRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 51);
+var ModelLifecycleIntentSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 53);
 var OfferRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 54);
 var QueryRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 57);
 var QueryAuthoritySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
@@ -10912,6 +10915,10 @@ var PendingConflictsQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_
 var PendingConflictSummaryQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 77);
 var NamedQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 78);
 var FrontierTransitionRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 79);
+var FrontierTransitionDispositionMapEntrySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 80);
+var FrontierTransitionDispositionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 81);
+var FrontierTransitionViolationSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 82);
+var FrontierTransitionResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 83);
 var AuthorizationObjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 84);
 var AuthorizationSubjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 85);
 var AuthorizationConsistencySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 87);
@@ -10950,6 +10957,8 @@ var NomosValueSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel,
 var NomosStructSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 166);
 var BirthOutcomeStatusSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 0);
 var BirthOutcomeStatus = /* @__PURE__ */ tsEnum(BirthOutcomeStatusSchema);
+var ModelLifecycleOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 3);
+var ModelLifecycleOperation = /* @__PURE__ */ tsEnum(ModelLifecycleOperationSchema);
 var QueryResultFormatSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 5);
 var QueryResultFormat = /* @__PURE__ */ tsEnum(QueryResultFormatSchema);
 var QueryOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 6);
@@ -11586,6 +11595,100 @@ var closureInstallPayload = (hash, installedBy, options = {}) => ({
 function authorOperatorCall(eng2, ws, call, controllerHash, opts = {}) {
   return author(eng2, ws, call.domain, call.directive, call.canonicalUsda, controllerHash, opts);
 }
+function authorModelLifecycleStage(eng2, ws, lawUsdz, installedBy, supersedes, opts = {}) {
+  const sequence = eng2.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng2.replica
+  };
+  const response = offerRequestResponse(eng2, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.STAGE,
+        installedBy,
+        supersedes
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    }),
+    lawUsdz
+  }));
+  return offerResult(response);
+}
+function authorModelLifecyclePromotion(eng2, ws, transition, replaces, acceptanceReason, opts = {}) {
+  const sequence = eng2.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng2.replica
+  };
+  const dispositions = transition.dispositions === void 0 ? void 0 : create(FrontierTransitionDispositionsSchema, {
+    retired: [...transition.dispositions.retired],
+    retyped: Object.entries(transition.dispositions.retyped).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    rebinds: Object.entries(transition.dispositions.rebinds).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    acknowledgedBy: transition.dispositions.ackBy
+  });
+  const response = offerRequestResponse(eng2, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.PROMOTE,
+        replaces,
+        acceptanceReason,
+        transition: create(FrontierTransitionResponseSchema, {
+          atHash: transition.atHash,
+          currentHash: transition.currentHash,
+          atStateRoot: transition.atStateRoot ?? "",
+          candidateHash: transition.candidateHash,
+          domain: transition.domain,
+          domains: [...transition.domains ?? []],
+          ready: transition.ready,
+          violations: transition.evolve.violations.map(
+            ({ domain, detail }) => create(FrontierTransitionViolationSchema, { domain, detail })
+          ),
+          dispositions
+        })
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    })
+  }));
+  return offerResult(response);
+}
 function initializeWorkspace(eng2, ws, installedBy = eng2.installedBy) {
   const sequence = eng2.seq++;
   const captured = {
@@ -14457,11 +14560,12 @@ function promotePreflighted(eng2, ws, domain, candidateHash, opts = {}) {
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;
-  const result = authorOperatorCall(
+  const result = authorModelLifecyclePromotion(
     eng2,
     ws,
-    promoteDomainCall(ws, prepared.payload),
-    requireCurrentControllerLawHash(eng2, ws),
+    report,
+    prepared.payload.replaces,
+    prepared.payload.preflight.acceptanceReason,
     {
       ...authorOpts,
       ...actingPrincipal ? { actor: actingPrincipal } : {}

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.65.1
+version: 0.65.2
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.108.3",
+  "version": "0.108.4",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -13088,8 +13088,24 @@ function firstDeviceDelegationPayload(route, certificate, typedPayload) {
   if (declared.has("delegationCertificate")) {
     return { delegationCertificate: typedPayload };
   }
-  throw new Error(
-    `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract [nomos.application.contract_missing]`
+  throw new NomosClientError(
+    `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract`,
+    {
+      code: "nomos.application.contract_missing",
+      operation: "enrollFirstDevice",
+      recommendedAction: NomosRecommendedAction.redeployLaw,
+      info: {
+        code: "nomos.application.contract_missing",
+        message: `Nomos application route '${route.domain}${route.path}' does not declare the typed 'delegationCertificate' contract`,
+        component: "nomos.application",
+        domain: route.domain,
+        operation: "enrollFirstDevice",
+        attributes: {
+          "nomos.application.missing_contract": "delegationCertificate",
+          "nomos.recovery.action": "repeat-parent-authorized-birth"
+        }
+      }
+    }
   );
 }
 var GIT_OBJECT_ID = /^[0-9a-f]{40}$/;
@@ -22497,7 +22513,9 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       try {
         await measureOpen("confirm private-custody signer enrolment", enroll);
       } catch (error) {
-        if (!String(error).includes("receiving-group-additional-device-requires-current-device-or-guardian")) throw error;
+        const errorCode = typeof error === "object" && error !== null && "code" in error ? String(error.code ?? "") : "";
+        const parentAuthorizedMigrationRequired = errorCode === "nomos.application.contract_missing" || String(error).includes("receiving-group-additional-device-requires-current-device-or-guardian");
+        if (!parentAuthorizedMigrationRequired) throw error;
         await birthOrRepeat();
         await measureOpen("verify recovered private-custody signer enrolment", enroll);
       }

package/src/framework/auth_provider_law.ts

@@ -199,8 +199,20 @@ function readCurrentAuthProviderRows() {
   try {
     return readFrameworkDeclaredRows(authProvider, AuthProvider, { scope: "platform" });
   } catch (error) {
-    if (error instanceof z.ZodError && error.issues.some((issue) =>
-      issue.code === "unrecognized_keys" && issue.keys.includes("keys")
+    // Law plans execute in the deterministic VM, not in the compiler's Node
+    // realm. Imported class identity therefore cannot be used as an
+    // `instanceof` discriminator here: the compiler may carry the property
+    // path without carrying a constructible host class. Zod's issue list is
+    // already the nominal failure disclosure we need; inspect that bounded
+    // shape without depending on host-realm prototype identity.
+    const issues = error !== null && typeof error === "object" &&
+      "issues" in error && Array.isArray(error.issues)
+      ? error.issues
+      : [];
+    if (issues.some((issue: unknown) =>
+      issue !== null && typeof issue === "object" &&
+      "code" in issue && issue.code === "unrecognized_keys" &&
+      "keys" in issue && Array.isArray(issue.keys) && issue.keys.includes("keys")
     )) {
       throw new Error(
         "the AuthProvider still uses the historical serialized key field; migrate it to a typed keySet first",