@githolon/dsl 0.108.3 → 0.108.6

package/src/codegen_dart_client.ts

@@ -87,7 +87,10 @@ import {
   isNamespacedAggregate,
   qualifyReadProjectionType,
 } from "./read_projection_namespace.js";
-import { isBusinessIntent } from "./intent.js";
+import {
+  childAuthenticationRecoveryAggregateId,
+  isBusinessIntent,
+} from "./intent.js";
 import { publicClientInterface, type DomainInterface } from "./shape_compat.js";
 import { BUSINESS_CORRECTION_DIRECTIVE } from "./framework/business_corrections.js";
 import { deriveDirectiveRecordTarget } from "./workspace_routing.js";
@@ -114,6 +117,10 @@ export const dartInternalWorkspaceSharingReceiptMethod = (
   directiveId: string
 ): string => `nmsInternal${cap(camel(directiveId))}`;
 
+export const dartInternalChildAuthenticationRecoveryMethod = (
+  aggregateId: string,
+): string => `nmsInternalRepair${cap(camel(aggregateId))}Authentication`;
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 type AnyDirective = Directive<any>;
 
@@ -522,11 +529,12 @@ function dartUsdaFieldValue(
 ): string {
   const selected = `${row}.field(${JSON.stringify(field.lawPath)})`;
   const required = `${row}.requiredField(${JSON.stringify(field.lawPath)})`;
-  const foreignWorkspaceExpression = field.foreignWorkspacePath === undefined
-    ? undefined
-    : `(${row}.field(${JSON.stringify(
-        field.foreignWorkspacePath
-      )})?.stringValue() ?? '')`;
+  const foreignWorkspaceExpression =
+    field.foreignWorkspacePath === undefined
+      ? undefined
+      : `(${row}.field(${JSON.stringify(
+          field.foreignWorkspacePath
+        )})?.stringValue() ?? '')`;
   const present = dartUsdaPresentValue(
     field.spec,
     field.spec.optional ? `${selected}!` : required,
@@ -635,14 +643,15 @@ function emitDartUsdaResultDecoder(
   const computedFields = decoder.computedFields.map((field) => {
     const selected = `row.field(${JSON.stringify(field.path)})`;
     const required = `row.requiredField(${JSON.stringify(field.path)})`;
-    const decode = (value: string) => field.enumType === undefined
-      ? dartUsdaProjectionValue(field.schema, value)
-      : `${field.enumType}.fromWire(${value}.jsonValue() as String)`;
+    const decode = (value: string) =>
+      field.enumType === undefined
+        ? dartUsdaProjectionValue(field.schema, value)
+        : `${field.enumType}.fromWire(${value}.jsonValue() as String)`;
     return field.required
       ? `      ${dartMemberName(field.name)}: ${decode(required)},`
       : `      ${dartMemberName(
           field.name
-        )}: ${selected} == null ? null : ${decode(`${selected}!`)},`;
+        )}: ${selected} == null || ${selected}!.typeName == 'NomosNullValue' ? null : ${decode(`${selected}!`)},`;
   });
   const provenanceFields = decoder.attributedFields.map((name) => {
     const field = decoder.baseFields.find(
@@ -893,9 +902,10 @@ export function generateDartBridgeClient(
           `Dart result USDA codegen: '${domain}.${aggregate.id}' has no canonical USDA path`
         );
       }
-      const aggregateEnumDartTypes = aggregate.framework === true
-        ? collectDartEnums([aggregate], [], "nomos_framework").dartTypes
-        : enumDartTypes;
+      const aggregateEnumDartTypes =
+        aggregate.framework === true
+          ? collectDartEnums([aggregate], [], "nomos_framework").dartTypes
+          : enumDartTypes;
       const specs = aggregateFieldSpecs(
         aggregate,
         aggregateEnumDartTypes,
@@ -967,35 +977,40 @@ export function generateDartBridgeClient(
             schema: read.returns,
             required: false,
           })),
-      ].map((field) => {
-        const readNode = callUsda.graph.nodes.find(
-          (node) => node.kind === "read" && node.entity.label === field.name
-        );
-        if (readNode === undefined) {
-          throw new Error(
-            `Dart result USDA codegen: composed law has no '${domain}.${field.name}' read field`
+      ]
+        .map((field) => {
+          const readNode = callUsda.graph.nodes.find(
+            (node) => node.kind === "read" && node.entity.label === field.name
           );
-        }
-        const path = callUsda.paths.get(readNode.entity.id);
-        if (path === undefined) {
-          throw new Error(
-            `Dart result USDA codegen: '${domain}.${field.name}' has no canonical USDA path`
-          );
-        }
-        return { ...field, path };
-      }).map((field) => {
-        const inner = (() => {
-          let schema = field.schema;
-          while (["optional", "default", "nullable"].includes(zodKind(schema))) {
-            schema = zodDef(schema).innerType!;
+          if (readNode === undefined) {
+            throw new Error(
+              `Dart result USDA codegen: composed law has no '${domain}.${field.name}' read field`
+            );
           }
-          return schema;
-        })();
-        const enumType = field.required && zodKind(inner) === "enum"
-          ? enumDartTypes.get(dartEnumLookupKey(inner))
-          : undefined;
-        return enumType === undefined ? field : { ...field, enumType };
-      });
+          const path = callUsda.paths.get(readNode.entity.id);
+          if (path === undefined) {
+            throw new Error(
+              `Dart result USDA codegen: '${domain}.${field.name}' has no canonical USDA path`
+            );
+          }
+          return { ...field, path };
+        })
+        .map((field) => {
+          const inner = (() => {
+            let schema = field.schema;
+            while (
+              ["optional", "default", "nullable"].includes(zodKind(schema))
+            ) {
+              schema = zodDef(schema).innerType!;
+            }
+            return schema;
+          })();
+          const enumType =
+            field.required && zodKind(inner) === "enum"
+              ? enumDartTypes.get(dartEnumLookupKey(inner))
+              : undefined;
+          return enumType === undefined ? field : { ...field, enumType };
+        });
       const decoder = {
         model: readModelClassName(aggregate.id),
         refType: concreteClassName(aggregate.id),
@@ -1055,10 +1070,7 @@ export function generateDartBridgeClient(
     scopes: readonly { scope: string; owned?: true }[]
   ): string =>
     `[${scopes
-      .map(
-        (s) =>
-          `(scope: ${dartStr(s.scope)}, owned: ${s.owned === true})`
-      )
+      .map((s) => `(scope: ${dartStr(s.scope)}, owned: ${s.owned === true})`)
       .join(", ")}]`;
   const needsReadPrincipal = (typeId: string): boolean => {
     const audience = aggById.get(typeId)?.audience;
@@ -1184,10 +1196,16 @@ export function generateDartBridgeClient(
   const dirs = allDirs.filter(
     (d) => (d as { birthsChild?: boolean }).birthsChild !== true
   );
+  // Only a no-argument enrolled-device intent can be the client's automatic stale-token
+  // recovery hook. Enrolled-device intents with typed inputs are explicit business operations
+  // (for example all-device-loss recovery bound to a named principal) and remain ordinary
+  // generated APIs; their proof posture does not make them automatic lifecycle hooks.
   const authenticationRecoveryDirs = dirs.filter(
     (directive) =>
       isBusinessIntent(directive) &&
-      directive.offerAuthenticationProof === "enrolledDevice"
+      directive.offerAuthenticationProof === "enrolledDevice" &&
+      introspectPayload(directive.payloadSchema as z.ZodTypeAny, enumDartTypes)
+        .length === 0
   );
   if (authenticationRecoveryDirs.length > 1) {
     throw new Error(
@@ -1196,16 +1214,68 @@ export function generateDartBridgeClient(
     );
   }
   const authenticationRecovery = authenticationRecoveryDirs[0];
-  if (
-    authenticationRecovery !== undefined &&
-    introspectPayload(
-      authenticationRecovery.payloadSchema as z.ZodTypeAny,
-      enumDartTypes
-    ).length !== 0
-  ) {
-    throw new Error(
-      `Dart client codegen: '${domain}/${authenticationRecovery.id}' is the automatic enrolled-device ` +
-        "authentication recovery intent and therefore must accept an empty payload"
+  const childAuthenticationRecoveries = dirs.flatMap((directive) => {
+    if (!isBusinessIntent(directive)) return [];
+    const aggregateId = childAuthenticationRecoveryAggregateId(directive);
+    if (aggregateId === undefined) return [];
+    const fields = introspectPayload(
+      directive.payloadSchema as z.ZodTypeAny,
+      enumDartTypes,
+    );
+    if (
+      fields.length !== 2 ||
+      fields.some(
+        (field) =>
+          !["workspace", "user"].includes(field.name) ||
+          field.optional ||
+          field.dartType !== "String",
+      )
+    ) {
+      throw new Error(
+        `Dart child-authentication recovery '${domain}/${directive.id}' must accept exactly required string fields { workspace, user }`,
+      );
+    }
+    return [{ aggregateId, directive }];
+  });
+  for (const recovery of childAuthenticationRecoveries) {
+    if (
+      childAuthenticationRecoveries.some(
+        (candidate) =>
+          candidate !== recovery &&
+          candidate.aggregateId === recovery.aggregateId,
+      )
+    ) {
+      throw new Error(
+        `Dart client codegen: '${domain}' declares more than one authentication repair action for '${recovery.aggregateId}'`,
+      );
+    }
+    const method = safeMethod(recovery.directive.id);
+    const input = dartActionInputClassName(recovery.directive);
+    methods.push(
+      `  /// Generated child-open recovery: inspect the child's kernel posture, then ask this`,
+      `  /// authenticated parent law to send its committed signer/provider state to that exact child.`,
+      `  Future<void> ${dartInternalChildAuthenticationRecoveryMethod(
+        recovery.aggregateId,
+      )}(String workspace) async {`,
+      `    final expectedPrincipal = actor ?? bridge.principal ?? '';`,
+      `    if (expectedPrincipal.isEmpty) {`,
+      `      throw StateError('Child authentication recovery requires the signed-in principal.');`,
+      `    }`,
+      `    final child = await bridge.acquireSession(workspace);`,
+      `    final posture = await child.nmsAuthenticationPosture(principal: expectedPrincipal);`,
+      `    if (posture.isReadyFor(expectedPrincipal)) return;`,
+      `    await ${method}(${input}(`,
+      `      workspace: workspace, user: expectedPrincipal,`,
+      `    ));`,
+      `    final parentSync = await bridge.sync(admit: true);`,
+      `    if (parentSync.offline || parentSync.pushFailed) {`,
+      `      throw StateError('Parent authentication recovery could not reach custody: ' +`,
+      `        (parentSync.hasPushError() ? parentSync.pushError.message : 'workspace is offline'));`,
+      `    }`,
+      `    await child.nmsAwaitProviderTokenReady(principal: expectedPrincipal);`,
+      `    await child.nmsAwaitAuthenticationReady(principal: expectedPrincipal);`,
+      `  }`,
+      ``,
     );
   }
   const localOfferDirs = [...dirs, ...birthDirs];
@@ -1261,7 +1331,12 @@ export function generateDartBridgeClient(
     );
     const payloadClass = compilerInternal
       ? `({${specs
-          .map((spec) => `${spec.dartType}${spec.optional ? "?" : ""} ${dartMemberName(spec.name)}`)
+          .map(
+            (spec) =>
+              `${spec.dartType}${spec.optional ? "?" : ""} ${dartMemberName(
+                spec.name
+              )}`
+          )
           .join(", ")}})`
       : dartActionInputClassName(directive);
     if (compilerInternal) internalRecordTypes.set(directive.id, payloadClass);
@@ -1305,7 +1380,16 @@ export function generateDartBridgeClient(
     for (const input of dartBusinessRecordInputs(directive, mod.aggregates)) {
       const origin = `NmsInternalRecordOrigins.require(payload.${input.argument})`;
       access.set(input.idField, { value: `${origin}.id` });
-      access.set(input.workspaceField, { value: `${origin}.workspace` });
+      access.set(input.workspaceField, {
+        value: `${origin}.workspace`,
+        // A business record always has a canonical origin. When the authored
+        // wire field is optional, the generated application input replaces it
+        // with that required typed record, so the derived workspace is present
+        // by construction rather than nullable caller data.
+        ...(specsByName.get(input.workspaceField)?.optional === true
+          ? { present: "true" }
+          : {}),
+      });
     }
     for (const input of dartForeignReferenceInputs(directive, mod.aggregates)) {
       const member = `payload.${dartMemberName(input.idField)}`;
@@ -1322,8 +1406,8 @@ export function generateDartBridgeClient(
         ...(input.optional
           ? present
           : specsByName.get(input.workspaceField)?.optional === true
-            ? { present: "true" }
-            : {}),
+          ? { present: "true" }
+          : {}),
       });
     }
     const stamps = autoStampFields(
@@ -2491,7 +2575,9 @@ export function generateDartBridgeClient(
         (spec) =>
           spec.name !== b.valuePayloadField &&
           spec.name !== b.idPayloadField &&
-          !autoStampFields(dir.payloadSchema as z.ZodTypeAny).includes(spec.name)
+          !autoStampFields(dir.payloadSchema as z.ZodTypeAny).includes(
+            spec.name
+          )
       );
       const needsTypedDecision = otherPublicFacts.some(
         (spec) => !spec.optional
@@ -2505,8 +2591,7 @@ export function generateDartBridgeClient(
           `final class ${decisionClass} {`,
           `  final ${mergedSpec.dartType} merged;`,
           ...otherPublicFacts.map(
-            (spec) =>
-              `  final ${spec.dartType} ${dartMemberName(spec.name)};`
+            (spec) => `  final ${spec.dartType} ${dartMemberName(spec.name)};`
           ),
           `  const ${decisionClass}({required this.merged, ${otherPublicFacts
             .map((spec) => `required this.${dartMemberName(spec.name)}`)
@@ -2532,7 +2617,9 @@ export function generateDartBridgeClient(
         "payload",
         ...encoder.arguments,
       ].join(", ")})`;
-      const mergedExpression = needsTypedDecision ? "decision.merged" : "merged";
+      const mergedExpression = needsTypedDecision
+        ? "decision.merged"
+        : "merged";
       const payloadArguments = [
         `${dartMemberName(b.valuePayloadField)}: ${mergedExpression}`,
         ...(needsTypedDecision
@@ -2922,15 +3009,11 @@ export function generateDartBridgeClient(
         : aOwned
         ? `, await _client._readKeys(${aScopesExpr}, [(type: ${dartStr(
             runtimeType
-          )}, id: id)])${
-            aPrivate ? ", _client.actor" : ""
-          }`
+          )}, id: id)])${aPrivate ? ", _client.actor" : ""}`
         : pastKeysArg(agg.id);
     const nominalByIdWatch = aScopes.length
       ? `Stream.fromFuture(_readKeys(${aScopesExpr}${
-          aOwned
-            ? `, [(type: ${dartStr(runtimeType)}, id: id)]`
-            : ""
+          aOwned ? `, [(type: ${dartStr(runtimeType)}, id: id)]` : ""
         })).asyncExpand((keys) => bridge.nmsWatchByIdUsda(${dartStr(
           runtimeType
         )}, id, keys: keys${
@@ -2996,7 +3079,9 @@ export function generateDartBridgeClient(
       aOwned
         ? `      _client._readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await _client.bridge.nmsQueryByTypeAtUsda(moment, ${dartStr(
             runtimeType
-          )}, keys${aPrivate ? ", _client.actor" : ""}), _client._ws), (row) => row.ref);`
+          )}, keys${
+            aPrivate ? ", _client.actor" : ""
+          }), _client._ws), (row) => row.ref);`
         : `      _nmsDecode${model}Rows(await _client.bridge.nmsQueryByTypeAtUsda(moment, ${dartStr(
             runtimeType
           )}${pastKeysArg(agg.id)}), _client._ws);`,
@@ -3033,13 +3118,35 @@ export function generateDartBridgeClient(
       `    );`,
       `  }`,
       ``,
-      `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) async {`,
+      ...(authenticationRecovery === undefined
+        ? [`  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) async {`]
+        : [
+            `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) =>`,
+            `      _adoptGeneratedModelAttempt(because, false);`,
+            `  Future<NomosModelAdoption> _adoptGeneratedModelAttempt(`,
+            `      String? because, bool recoveredProviderEpoch) async {`,
+          ]),
       `    final result = await bridge.nomosFrameworkAdoptGeneratedModel(`,
       `      domain: ${dartStr(
         domain
       )}, candidateHash: domainHash, because: because);`,
       `    final review = _nomosModelReview(result);`,
       `    final stage = result.stage;`,
+      ...(authenticationRecovery === undefined
+        ? []
+        : [
+            `    if (!result.accepted && !recoveredProviderEpoch) {`,
+            `      final posture = await bridge.nmsAuthenticationPosture(principal: actor);`,
+            `      if (posture.providerToken == NomosProviderTokenVerification.noMatchingKey) {`,
+            `        print('[nomos-model-recovery] local ${domain} posture=' + posture.providerToken.name);`,
+            `        await ${safeMethod(
+              authenticationRecovery.id
+            )}(const ${dartActionInputClassName(authenticationRecovery)}());`,
+            `        await bridge.nmsAwaitAuthenticationReady(principal: actor);`,
+            `        return _adoptGeneratedModelAttempt(because, true);`,
+            `      }`,
+            `    }`,
+          ]),
       `    if ((stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_PROMOTED ||`,
       `         stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ALREADY_CURRENT) && result.accepted) {`,
       `      return NomosModelAdoption.adopted(`,
@@ -3083,12 +3190,30 @@ export function generateDartBridgeClient(
             `    final archive = await rootBundle.load(${dartStr(
               opts.lawAssetKey
             )});`,
-            `    await bridge.nomosInternalStageGeneratedModel(`,
+            `    Future<void> attempt() => bridge.nomosInternalStageGeneratedModel(`,
             `      domain: ${dartStr(domain)},`,
             `      candidateHash: domainHash,`,
             `      lawUsdz: archive.buffer.asUint8List(`,
             `        archive.offsetInBytes, archive.lengthInBytes),`,
             `    );`,
+            ...(authenticationRecovery === undefined
+              ? [`    await attempt();`]
+              : [
+                  `    try {`,
+                  `      await attempt();`,
+                  `    } on NomosModelStageFailure {`,
+                  `      final posture = await bridge.nmsAuthenticationPosture(principal: actor);`,
+                  `      print('[nomos-model-recovery] local ${domain} posture=' + posture.providerToken.name);`,
+                  `      if (posture.providerToken != NomosProviderTokenVerification.noMatchingKey) rethrow;`,
+                  `      await ${safeMethod(
+                    authenticationRecovery.id
+                  )}(const ${dartActionInputClassName(
+                    authenticationRecovery
+                  )}());`,
+                  `      await bridge.nmsAwaitAuthenticationReady(principal: actor);`,
+                  `      await attempt();`,
+                  `    }`,
+                ]),
             `  }`,
             ``,
           ]),
@@ -3788,77 +3913,27 @@ export function generateDartBridgeClient(
     `  /// IMMEDIATELY — at provider construction, not two clicks into the app. The synchronous`,
     `  /// constructor remains for codepaths that can't await; it lazily runs the SAME preflight on the`,
     `  /// first dispatch.`,
+    `  static Future<void> _catchUpBeforeModelPreparation(NomosSession session) async {`,
+    `    try {`,
+    `      await session.sync(admit: true);`,
+    `    } catch (error) {`,
+    `      // Offline-first: inability to reach shared custody does not revoke the local workspace.`,
+    `      // The subsequent typed compatibility/model gate remains authoritative and will either`,
+    `      // accept the local law or surface the precise governed action still required.`,
+    `      print('[nomos-model-catch-up] ${domain} continuing from local custody: ' + error.toString());`,
+    `    }`,
+    `  }`,
+    ``,
     `  static Future<${className}> bind(NomosSession session, {String? actor${
       manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""
     }}) async {`,
     `    final candidate = ${className}(session, actor: actor${
       manualEncryptionPresent ? ", keyStore: keyStore" : ""
     });`,
-    `    Never throwForAdoption(NomosModelAdoption adoption) {`,
-    `      throw DomainClientModelAdoptionRequired(`,
-    `        expectedDomainKey: interface.domain,`,
-    `        expectedDomainHash: interface.expectedDomainHash,`,
-    `        status: adoption.status.name,`,
-    `        summary: adoption.summary,`,
-    `        review: DomainModelReview(`,
-    `          checkedActions: adoption.review.checkedActions,`,
-    `          candidateActions: adoption.review.candidateActions,`,
-    `          sameOutcome: adoption.review.sameOutcome,`,
-    `          differences: [`,
-    `            for (final difference in adoption.review.differences)`,
-    `              DomainModelDifference(`,
-    `                kind: switch (difference.kind) {`,
-    `                  NomosModelDifferenceKind.rules => DomainModelDifferenceKind.rules,`,
-    `                  NomosModelDifferenceKind.outcome => DomainModelDifferenceKind.outcome,`,
-    `                  NomosModelDifferenceKind.evidence => DomainModelDifferenceKind.evidence,`,
-    `                },`,
-    `                area: difference.area,`,
-    `                action: difference.action,`,
-    `                summary: difference.summary,`,
-    `              ),`,
-    `          ],`,
-    `        ),`,
-    ...(opts.lawAssetKey === undefined
-      ? [`        stage: null,`]
-      : [
-          `        stage: adoption.status == NomosModelAdoptionStatus.needsStaging`,
-          `            ? () => candidate._stageGeneratedModel()`,
-          `            : null,`,
-        ]),
-    `        accept: adoption.status == NomosModelAdoptionStatus.needsDecision`,
-    `            ? (reason) async {`,
-    `                final accepted = await adoption.accept(reason);`,
-    `                // A retry that still isn't adopted (a transient business-outcome/history race,`,
-    `                // e.g. concurrent writes landing between the bare preflight and this accept) must`,
-    `                // NOT be swallowed as a terminal StateError: re-throw the SAME typed exception so`,
-    `                // the caller's governed-steps retry loop gets another decide()/accept() attempt`,
-    `                // instead of failing outright on the first race it hits.`,
-    `                if (accepted.status != NomosModelAdoptionStatus.adopted) {`,
-    `                  throwForAdoption(accepted);`,
-    `                }`,
-    `              }`,
-    `            : null,`,
-    `      );`,
-    `    }`,
-    `    Future<void> adoptGeneratedModel() async {`,
-    `      final adoption = await candidate._adoptGeneratedModel();`,
-    `      if (adoption.status == NomosModelAdoptionStatus.adopted) return;`,
-    `      throwForAdoption(adoption);`,
-    `    }`,
-    `    try {`,
-    `      await session.assertCompatible(interface);`,
-    `    } on DomainClientSessionMismatch catch (mismatch) {`,
-    `      // A deployed successor is deliberately invisible until the generated candidate proves it`,
-    `      // against this workspace's exact history. Do that before rejecting the candidate for`,
-    `      // expecting its own newer interface; all other bind failures retain their precise cause.`,
-    `      if (!mismatch.canAttemptGeneratedModelAdoption) rethrow;`,
-    `      await adoptGeneratedModel();`,
-    `    }`,
-    `    // Shape compatibility governs readable structure; exact package identity governs`,
-    `    // which plans may author. A plan-only successor must therefore enter the same`,
-    `    // proof-gated lifecycle even when every generated read type remains compatible.`,
-    `    final law = await session.lawStatus(interface.expectedDomainHash);`,
-    `    if (law['drifted'] == true) await adoptGeneratedModel();`,
+    `    // Binding proves that this client can read and author against the law the`,
+    `    // workspace already runs. It never deploys, stages, promotes, or rewrites`,
+    `    // workspace law. Model rollout is an explicit operator action through`,
+    `    // [model], outside application startup.`,
     `    await session.assertCompatible(interface);`,
     `    // RELEASE COHERENCE: resolve this law's OSGi Contract Namespace requirements before use.`,
     `    await session.assertKernelCoherence(kernelContracts, lawHash: ${hashConst});`,
@@ -3882,38 +3957,26 @@ export function generateDartBridgeClient(
     `  /// privately retains refreshable cloud access for a genuinely-absent authorized workspace.`,
     `  static Future<${className}> open<TAggregate>(NomosBridge bridge, {NomosRef<TAggregate>? ref, String? workspace, String? actor${
       manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""
-    }}) async {`,
+    }, Future<void> Function()? recoverAuthentication}) async {`,
     `    final ws = ref == null ? workspace : NmsInternalNomosRefs.workspace(ref);`,
     `    if (ws == null || ws.isEmpty) {`,
     `      throw ArgumentError('${className}.open: pass a workspace: or ref: — the workspace to open and bind');`,
     `    }`,
     `    final session = await bridge.acquireSession(ws);`,
-    ...(opts.lawAssetKey === undefined
+    ...(authenticationRecovery === undefined
       ? []
       : [
-          `    final law = await session.lawStatus(${hashConst});`,
-          `    if (law['drifted'] == true) {`,
-          `      if (bridge is! NomosSession) {`,
-          `        throw StateError('Generated child model inheritance needs a bound parent session.');`,
+          `    if (recoverAuthentication != null) {`,
+          `      final posture = await session.nmsAuthenticationPosture(principal: actor);`,
+          `      if (!posture.isReadyFor(actor ?? '')) {`,
+          `        await recoverAuthentication();`,
+          `        await session.nmsAwaitAuthenticationReady(principal: actor);`,
           `      }`,
-          `      final archive = await rootBundle.load(${dartStr(
-            opts.lawAssetKey
-          )});`,
-          `      await bridge.nomosInternalEnsureGeneratedModelInChild(`,
-          `        childWorkspace: ws,`,
-          `        domain: interface.domain,`,
-          `        candidateHash: ${hashConst},`,
-          `        lawUsdz: archive.buffer.asUint8List(`,
-          `          archive.offsetInBytes, archive.lengthInBytes),`,
-          `      );`,
           `    }`,
         ]),
-    `    return nmsInternalConvergeGeneratedModel<${className}>(`,
-    `      attempt: () => bind(session, actor: actor${
+    `    return bind(session, actor: actor${
       manualEncryptionPresent ? ", keyStore: keyStore" : ""
-    }),`,
-    `      handle: session.nomosInternalHandleModelChange,`,
-    `    );`,
+    });`,
     `  }`,
     ``,
     `  /// The session workspace this client is bound to (from the [NomosSession] handle, when constructed with`,
@@ -4010,7 +4073,7 @@ export function generateDartBridgeClient(
           `  Future<NomosOfferOutcome> _offer(NmsGeneratedCall call, {List<NomosConflictSnapshot> conflictSnapshots = const [], NomosOfferAuthenticationProof authenticationProof = NomosOfferAuthenticationProof.sessionCredentials}) async {`,
           `    await _preflightOnce();`,
           `    await _prepareCommand(call.directive);`,
-          `    Future<NomosOfferOutcome> attempt() => bridge.offerCallUsdaOutcome(call: call, actor: actor, domainHash: domainHash, conflictSnapshots: conflictSnapshots, authenticationProof: authenticationProof);`,
+    `    Future<NomosOfferOutcome> attempt() => bridge.offerCallUsdaOutcome(call: call, actor: actor, conflictSnapshots: conflictSnapshots, authenticationProof: authenticationProof);`,
           ...(authenticationRecovery === undefined
             ? [`    return attempt();`]
             : [
@@ -4020,7 +4083,9 @@ export function generateDartBridgeClient(
                 `    } on NomosKernelCallFailure {`,
                 `      final posture = await bridge.nmsAuthenticationPosture(principal: actor);`,
                 `      if (posture.providerToken != NomosProviderTokenVerification.noMatchingKey) rethrow;`,
-                `      await ${safeMethod(authenticationRecovery.id)}(const ${dartActionInputClassName(
+                `      await ${safeMethod(
+                  authenticationRecovery.id
+                )}(const ${dartActionInputClassName(
                   authenticationRecovery
                 )}());`,
                 `      await bridge.nmsAwaitAuthenticationReady(principal: actor);`,