@githolon/dsl 0.108.4 → 0.108.7

package/dart/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.65.3
+
+- Generate parent-law authentication cascades that wait for both provider and signer custody, without a child self-enrolment shortcut.
+- Preserve nominal USDA calls and typed Runtime v2 results across local and remote workspace boundaries.
+
 ## 0.65.2
 
 - Preserve complete typed birth lineage and recover existing workspaces through the authenticated

package/dart/lib/src/application_framework_calls.dart

@@ -9,6 +9,19 @@ import 'package:nomos_types/nomos_kernel_protocol.dart' show BirthCertificate;
 import 'generated_call.dart';
 import 'result_usda.dart' show NmsUsdaLayer, NmsUsdaPrim;
 
+/// Generated enum for field values: guardian-quorum, platform-identity-provider.
+enum NmsFrameworkSeedReceivingGroupPolicyRecovery {
+  guardian_quorum('guardian-quorum'),
+  platform_identity_provider('platform-identity-provider');
+
+  final String wire;
+  const NmsFrameworkSeedReceivingGroupPolicyRecovery(this.wire);
+
+  static NmsFrameworkSeedReceivingGroupPolicyRecovery fromWire(String wire) =>
+      NmsFrameworkSeedReceivingGroupPolicyRecovery.values.firstWhere((e) => e.wire == wire,
+          orElse: () => throw FormatException('unknown NmsFrameworkSeedReceivingGroupPolicyRecovery: $wire'));
+}
+
 /// Compiler-generated framework value 'OwnedCustody'.
 /// Its canonical semantic representation is USDA; this class is the typed Dart view.
 final class OwnedCustody {
@@ -267,12 +280,14 @@ abstract interface class NmsApplicationFrameworkCalls {
     required String principal,
     required String workspaceId,
     required String bornAt,
+    List<({String keyHash, int validFromEpoch})>? admissionCheckpointSigners,
   });
 
   NmsGeneratedCall seedReceivingGroupPolicy({
     required String domain,
     required String workspace,
     required String setAt,
+    NmsFrameworkSeedReceivingGroupPolicyRecovery? recovery,
   });
 
   NmsGeneratedCall seedReceivingGroup({
@@ -283,6 +298,12 @@ abstract interface class NmsApplicationFrameworkCalls {
     required String bornAt,
   });
 
+  /// Compiler-selected application law for recovering a replacement device into its existing receiving group.
+  /// The generated implementation binds this semantic capability to one exact nominal application intent.
+  NmsGeneratedCall recoverExistingReceivingGroupDevice({
+    required String user,
+  });
+
   NmsGeneratedCall redeemInvitation({
     required String domain,
     required String workspace,

package/dart/lib/src/dev_cloud.dart

@@ -41,6 +41,20 @@ class RemoteWorkspaceState {
       'RemoteWorkspaceState($workspace, ${initialized ? "born" : "unborn"}, head=${head.isEmpty ? "∅" : head.substring(0, head.length.clamp(0, 10))}, $commits commit(s))';
 }
 
+/// One device-bound proof minted by the local standards-edge identity provider.
+/// Domain and custody APIs never receive the provider's JSON representation.
+class DevIdentityToken {
+  final String token;
+  final String issuer;
+  final String audience;
+
+  const DevIdentityToken({
+    required this.token,
+    required this.issuer,
+    required this.audience,
+  });
+}
+
 class NomosTestCloudException implements Exception {
   final String message;
   NomosTestCloudException(this.message);
@@ -100,6 +114,59 @@ class NomosTestCloud {
     );
   }
 
+  /// Rotate the external test IdP and its platform AuthProvider in one lawful
+  /// operator ceremony. The server changes its minting key only after the
+  /// platform admits the signed generated `setAuthProvider` call.
+  Future<void> rotateIdentityProvider() async {
+    final request = await _client.postUrl(
+      _upstream.replace(path: '/dev/rotate-idp'),
+    );
+    request.contentLength = 0;
+    final response = await request.close();
+    final body = await response.transform(utf8.decoder).join();
+    if (response.statusCode != HttpStatus.noContent) {
+      throw NomosTestCloudException(
+        'test IdP rotation failed (${response.statusCode}): '
+        '${body.substring(0, body.length.clamp(0, 300))}',
+      );
+    }
+  }
+
+  /// Mint a fresh, device-bound JWT at the external identity-provider edge.
+  Future<DevIdentityToken> mintIdentityToken({
+    required String subject,
+    required String nonce,
+  }) async {
+    final request = await _client.postUrl(
+      _upstream.replace(path: '/dev/mint-token'),
+    );
+    request.headers.contentType = ContentType.json;
+    request.write(jsonEncode({'sub': subject, 'nonce': nonce}));
+    final response = await request.close();
+    final text = await response.transform(utf8.decoder).join();
+    if (response.statusCode != HttpStatus.ok) {
+      throw NomosTestCloudException(
+        'test IdP token mint failed (${response.statusCode}): '
+        '${text.substring(0, text.length.clamp(0, 300))}',
+      );
+    }
+    final decoded = jsonDecode(text);
+    if (decoded case {
+      'token': final String token,
+      'issuer': final String issuer,
+      'audience': final String audience,
+    } when token.isNotEmpty && issuer.isNotEmpty && audience.isNotEmpty) {
+      return DevIdentityToken(
+        token: token,
+        issuer: issuer,
+        audience: audience,
+      );
+    }
+    throw NomosTestCloudException(
+      'test IdP returned an invalid identity proof',
+    );
+  }
+
   /// Start the test cloud: spawn `node <serverEntry> --port <n> [--ephemeral] [--data <dir>]`, wait until its
   /// `/health` answers, then bring up the partition proxy in front of it. [serverEntry] is the dev-server
   /// entry (`cloud/dev-server/server.ts` in-repo, or `dist/dev-server.mjs` from a published `githolon`) — the

package/dart/lib/src/nms_test_environment.dart

@@ -4,5 +4,5 @@ library;
 
 import 'package:meta/meta.dart' show internal;
 
-export 'dev_cloud.dart' show NomosTestCloud;
+export 'dev_cloud.dart' show DevIdentityToken, NomosTestCloud;
 export 'test_harness.dart' show NomosTestHarness;