@githolon/dsl 0.108.4 → 0.108.7

package/dart/lib/src/webview_bridge.dart

@@ -27,6 +27,7 @@ import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
 import 'package:nomos_types/nomos_types.dart'
     show
         nomosErrorFromInfo,
+        NomosBridgeError,
         NomosTraceContext,
         NomosErrorInfo,
         NomosRef,
@@ -1420,6 +1421,21 @@ final class NomosKernelCallFailure implements Exception {
   String toString() => 'NomosKernelCallFailure($code: $message)';
 }
 
+/// A generated model candidate was not staged by the bound workspace.
+///
+/// This remains distinct from an ordinary domain-offer refusal: generated
+/// clients may use a typed authentication-posture query to decide whether a
+/// law-declared provider-epoch recovery action is applicable, without parsing
+/// this diagnostic prose or catching an unrelated [StateError].
+final class NomosModelStageFailure implements Exception {
+  const NomosModelStageFailure(this.message);
+
+  final String message;
+
+  @override
+  String toString() => 'NomosModelStageFailure($message)';
+}
+
 /// Product-facing progress for one accepted write. Transport topology and custody identifiers remain private.
 final class NomosOperationStatus {
   const NomosOperationStatus(this.phase, {this.updatedAt});
@@ -2797,6 +2813,11 @@ class NomosBridge {
       NomosOfferAuthenticationProof.sessionCredentials => sessionToken,
       NomosOfferAuthenticationProof.enrolledDevice => null,
     };
+    // Intentionally visible in device logs: this is the OBD port for a failed
+    // lawful dispatch. It names no token, device secret or tenant payload.
+    // ignore: avoid_print
+    print('[nomos-offer] dispatch ${call.domain}/${call.directive} in '
+        '$workspace using ${authenticationProof.name}');
     final response = await kernelTransport.callKernel(
       session: runtimeSession,
       request: nomos_protocol.CallRequest(
@@ -2834,6 +2855,9 @@ class NomosBridge {
       ),
     );
     if (response.hasFailure()) {
+      // ignore: avoid_print
+      print('[nomos-offer] refused ${call.domain}/${call.directive} in '
+          '$workspace: ${response.failure.code}: ${response.failure.message}');
       throw NomosKernelCallFailure(
         code: response.failure.code,
         message: response.failure.message,
@@ -2847,6 +2871,9 @@ class NomosBridge {
     final offer = response.offer;
     if (!offer.hasAdmitted()) throw NomosTypedOfferFailure(offer);
     final admitted = offer.admitted;
+    // ignore: avoid_print
+    print('[nomos-offer] admitted ${call.domain}/${call.directive} in '
+        '$workspace as ${admitted.intentId} at ${admitted.head}');
     final birthOutcomes = List<NomosBirthOutcome>.unmodifiable(
       admitted.birthOutcomes,
     );
@@ -3677,20 +3704,35 @@ class NomosBridge {
     required String candidateHash,
     required List<int> lawUsdz,
   }) async {
-    final response = await _invokeRuntimeV2(
-      nomos_protocol.RuntimeRequest(
-        modelLifecycle: nomos_protocol.ModelLifecycleRequest(
-          session: _runtimeSession(),
-          stage: nomos_protocol.StageGeneratedModelRequest(
-            domain: domain,
-            candidateHash: candidateHash,
-            lawUsdz: lawUsdz,
+    print(
+      '[nomos-model-stage] local domain=$domain session=${_runtimeSession()}',
+    );
+    late final nomos_protocol.RuntimeResponse response;
+    try {
+      response = await _invokeRuntimeV2(
+        nomos_protocol.RuntimeRequest(
+          modelLifecycle: nomos_protocol.ModelLifecycleRequest(
+            session: _runtimeSession(),
+            stage: nomos_protocol.StageGeneratedModelRequest(
+              domain: domain,
+              candidateHash: candidateHash,
+              lawUsdz: lawUsdz,
+            ),
           ),
         ),
-      ),
-    );
+      );
+    } on NomosBridgeError catch (error) {
+      print(
+        '[nomos-model-stage] local refused domain=$domain as ${error.runtimeType}',
+      );
+      // Runtime v2 translates its generated failure arm before returning the
+      // response. Preserve the operation boundary so generated clients can
+      // query typed authentication posture and select a law-declared recovery
+      // action without scraping diagnostics or catching unrelated failures.
+      throw NomosModelStageFailure(error.message);
+    }
     if (!response.hasModelLifecycle() || !response.modelLifecycle.accepted) {
-      throw StateError(
+      throw NomosModelStageFailure(
         response.hasModelLifecycle() && response.modelLifecycle.hasMessage()
             ? response.modelLifecycle.message
             : 'Runtime v2 refused generated model staging',
@@ -4016,6 +4058,42 @@ class NomosBridge {
     return response.applicationCustodyEstablished;
   }
 
+  /// Offer one compiler-generated call to a remote workspace without cloning
+  /// that workspace onto this device. The resident source session signs the
+  /// target-kernel-prepared USDA; Runtime v2 carries the nominal call and the
+  /// admitted target head without a command string or tenant map.
+  Future<nomos_protocol.RemoteGeneratedOfferAccepted>
+      nomosInternalOfferRemoteGeneratedCall({
+    required String targetWorkspace,
+    required String actor,
+    required String authorSecret,
+    String? authToken,
+    required NmsGeneratedCall call,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        remoteGeneratedOffer: nomos_protocol.RemoteGeneratedOfferRequest(
+          sourceSession: _runtimeSession(),
+          targetWorkspace: targetWorkspace,
+          actor: actor,
+          authorSecret: base64Decode(authorSecret),
+          authToken: utf8.encode(authToken ?? ''),
+          call: nomos_protocol.DirectiveCall(
+            domain: call.domain,
+            directive: call.directive,
+            callUsda: call.canonicalUsda,
+          ),
+        ),
+      ),
+    );
+    if (!response.hasRemoteGeneratedOffer()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for a remote generated offer',
+      );
+    }
+    return response.remoteGeneratedOffer;
+  }
+
   /// Sign a cross-custody SHARE attestation `{secret, asserterWorkspace, object, relation, subject,
   /// attestedAt}` → `{publicKey, signature}`. This is what drives `recordShare` into an invitee's home
   /// (the free global invitation system): the granting workspace signs that it shares `object#relation`
@@ -4057,8 +4135,9 @@ class NomosBridge {
   nomos_protocol.QueryAuthority _nmsQueryAuthority(
     List<NomosScopeKey>? keys,
     String? principal,
-    String? session,
-  ) {
+    String? session, {
+    String? authorSecret,
+  }) {
     final runtimeSession = session ?? _sessionName;
     if (runtimeSession == null || runtimeSession.isEmpty) {
       throw StateError(
@@ -4066,7 +4145,7 @@ class NomosBridge {
     }
     final plane = _eventPlane;
     final token = plane._sessionAuthTokens[runtimeSession];
-    final secret = plane._sessionAuthorSecrets[runtimeSession];
+    final secret = authorSecret ?? plane._sessionAuthorSecrets[runtimeSession];
     return nomos_protocol.QueryAuthority(
       principalClaim:
           principal ?? plane._sessionPrincipals[runtimeSession] ?? '',
@@ -4206,10 +4285,16 @@ class NomosBridge {
   Future<NomosAuthenticationPosture> nmsAuthenticationPosture({
     String? session,
     String? principal,
+    String? authorSecret,
   }) async {
     final response = await _nmsKernelQuery(
       session: session,
-      authority: _nmsQueryAuthority(null, principal, session),
+      authority: _nmsQueryAuthority(
+        null,
+        principal,
+        session,
+        authorSecret: authorSecret,
+      ),
       query: nomos_protocol.QueryRequest(
         authenticationPosture: nomos_protocol.AuthenticationPostureQuery(),
       ),
@@ -4220,11 +4305,16 @@ class NomosBridge {
       );
     }
     final posture = response.authenticationPosture;
-    return NomosAuthenticationPosture(
+    final result = NomosAuthenticationPosture(
       providerToken: _providerTokenVerification(posture.providerToken),
       enrolledDevice: posture.enrolledDevice,
       resolvedPrincipal: posture.resolvedPrincipal,
     );
+    print(
+        '[nomos-auth-posture] workspace=${_eventPlane._workspaceBySession[session ?? _sessionName] ?? session ?? _sessionName ?? ''} '
+        'token=${result.providerToken.name} enrolled=${result.enrolledDevice} '
+        'principal=${result.resolvedPrincipal.isEmpty ? 'unresolved' : 'resolved'}');
+    return result;
   }
 
   /// Drive actual custody synchronization until the kernel proves that the
@@ -4235,6 +4325,7 @@ class NomosBridge {
   Future<NomosAuthenticationPosture> nmsAwaitAuthenticationReady({
     String? session,
     String? principal,
+    String? authorSecret,
     int maximumSyncRounds = 4,
   }) async {
     final runtimeSession = session ?? _sessionName;
@@ -4247,11 +4338,20 @@ class NomosBridge {
     var posture = await nmsAuthenticationPosture(
       session: session,
       principal: expectedPrincipal,
+      authorSecret: authorSecret,
     );
     if (posture.isReadyFor(expectedPrincipal)) return posture;
 
     for (var round = 0; round < maximumSyncRounds; round++) {
       final result = await sync(admit: true, session: session);
+      print(
+        '[nomos-auth-recovery] workspace=${_eventPlane._workspaceBySession[runtimeSession] ?? runtimeSession ?? ''} '
+        'round=${round + 1}/$maximumSyncRounds pulled=${result.pulled} '
+        'previous=${result.hasPreviousHead() ? (result.previousHead.length > 12 ? result.previousHead.substring(0, 12) : result.previousHead) : 'none'} '
+        'current=${result.hasCurrentHead() ? (result.currentHead.length > 12 ? result.currentHead.substring(0, 12) : result.currentHead) : 'none'} '
+        'ahead=${result.stillAhead} diverged=${result.diverged} reconnect=${result.reconnectRequired} '
+        'deferred=${result.deferred} refused=${result.refused} offline=${result.offline} pushFailed=${result.pushFailed}',
+      );
       if (result.offline || result.pushFailed) {
         throw StateError(
           'Authentication recovery could not converge custody: '
@@ -4261,15 +4361,68 @@ class NomosBridge {
       posture = await nmsAuthenticationPosture(
         session: session,
         principal: expectedPrincipal,
+        authorSecret: authorSecret,
       );
       if (posture.isReadyFor(expectedPrincipal)) return posture;
     }
-    throw StateError(
+    final failure = StateError(
       'Authentication recovery did not establish a valid provider token and enrolled device '
       'for $expectedPrincipal after $maximumSyncRounds custody rounds '
       '(token: ${posture.providerToken.name}, enrolled: ${posture.enrolledDevice}, '
       'resolved: ${posture.resolvedPrincipal})',
     );
+    print(
+      '[nomos-auth-recovery-exhausted] '
+      'workspace=${_eventPlane._workspaceBySession[runtimeSession] ?? runtimeSession ?? ''} '
+      'caller=${StackTrace.current}',
+    );
+    throw failure;
+  }
+
+  /// Synchronize until the workspace can verify the signed-in provider token.
+  /// This is deliberately weaker than [nmsAwaitAuthenticationReady]: historical
+  /// child law may need the refreshed verifier before it can lawfully enrol the
+  /// current device and adopt its successor law.
+  @internal
+  Future<NomosAuthenticationPosture> nmsAwaitProviderTokenReady({
+    String? session,
+    String? principal,
+    int maximumSyncRounds = 4,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    final expectedPrincipal = principal ??
+        this.principal ??
+        (runtimeSession == null
+            ? null
+            : _eventPlane._sessionPrincipals[runtimeSession]) ??
+        '';
+    bool ready(NomosAuthenticationPosture posture) =>
+        posture.providerToken == NomosProviderTokenVerification.valid &&
+        posture.resolvedPrincipal == expectedPrincipal;
+    var posture = await nmsAuthenticationPosture(
+      session: session,
+      principal: expectedPrincipal,
+    );
+    if (ready(posture)) return posture;
+    for (var round = 0; round < maximumSyncRounds; round++) {
+      final result = await sync(admit: true, session: session);
+      if (result.offline || result.pushFailed) {
+        throw StateError(
+          'Provider recovery could not converge custody: '
+          '${result.hasPushError() ? result.pushError.message : 'workspace is offline'}',
+        );
+      }
+      posture = await nmsAuthenticationPosture(
+        session: session,
+        principal: expectedPrincipal,
+      );
+      if (ready(posture)) return posture;
+    }
+    throw StateError(
+      'Provider recovery did not establish a valid token for '
+      '$expectedPrincipal after $maximumSyncRounds custody rounds '
+      '(token: ${posture.providerToken.name}, resolved: ${posture.resolvedPrincipal})',
+    );
   }
 
   Future<nomos_protocol.QueryResponse> _nmsKernelHistoricQuery({
@@ -5295,9 +5448,25 @@ class NomosBridge {
       (_asMap(await _call('export'))['snapshot'] ?? '').toString();
 
   /// The local ledger tip (an O(1) ref read). Cheap change signal — persistence skips re-exporting an
-  /// unchanged snapshot when [head] matches the last saved tip.
-  Future<String> head() async =>
-      (_asMap(await _call('head'))['head'] ?? '').toString();
+  /// unchanged snapshot when [head] matches the last saved tip. Runtime v2 carries this as an optional
+  /// protobuf field so an unborn workspace is distinct from a malformed bridge result.
+  Future<String> head() async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        workspaceStatus: nomos_protocol.WorkspaceStatusRequest(
+          session: _runtimeSession(),
+        ),
+      ),
+    );
+    if (!response.hasWorkspaceStatus()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name}, expected workspaceStatus',
+      );
+    }
+    return response.workspaceStatus.hasHead()
+        ? response.workspaceStatus.head
+        : '';
+  }
 
   /// AUTO-SYNC — event-driven background sync. The edge DOORBELL converges peers' writes in real time and a
   /// local write flushes the up leg at once; `fallbackMs` is only a just-in-case safety pull (default 60s).
@@ -6119,21 +6288,32 @@ class NomosSession extends NomosBridge {
         'Generated child model inheritance needs a bound parent session.',
       );
     }
-    final response = await _invokeRuntimeV2(
-      nomos_protocol.RuntimeRequest(
-        modelLifecycle: nomos_protocol.ModelLifecycleRequest(
-          session: childWorkspace,
-          stage: nomos_protocol.StageGeneratedModelRequest(
-            domain: domain,
-            candidateHash: candidateHash,
-            lawUsdz: lawUsdz,
-            sourceSession: source,
+    print(
+      '[nomos-model-stage] child domain=$domain source=$source target=$childWorkspace',
+    );
+    late final nomos_protocol.RuntimeResponse response;
+    try {
+      response = await _invokeRuntimeV2(
+        nomos_protocol.RuntimeRequest(
+          modelLifecycle: nomos_protocol.ModelLifecycleRequest(
+            session: childWorkspace,
+            stage: nomos_protocol.StageGeneratedModelRequest(
+              domain: domain,
+              candidateHash: candidateHash,
+              lawUsdz: lawUsdz,
+              sourceSession: source,
+            ),
           ),
         ),
-      ),
-    );
+      );
+    } on NomosBridgeError catch (error) {
+      print(
+        '[nomos-model-stage] child refused domain=$domain as ${error.runtimeType}',
+      );
+      throw NomosModelStageFailure(error.message);
+    }
     if (!response.hasModelLifecycle() || !response.modelLifecycle.accepted) {
-      throw StateError(
+      throw NomosModelStageFailure(
         response.hasModelLifecycle() && response.modelLifecycle.hasMessage()
             ? response.modelLifecycle.message
             : 'Runtime v2 refused generated child model staging',

package/dart/pubspec.lock

@@ -199,7 +199,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.9.0"
+    version: "0.10.0"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.65.2
+version: 0.65.3
 
 environment:
   sdk: ^3.5.0
@@ -16,7 +16,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.10.0
+  nomos_types: ^0.10.1
   fixnum: ^1.1.1
   json_schema: ^5.2.2
   crypto: ^3.0.0

package/dart/test/node_runner_transport_test.dart

@@ -41,12 +41,13 @@ void main() {
     await bridge.ready.timeout(const Duration(seconds: 15));
   });
 
-  test('a pre-connect op answers a typed bridge error', () async {
+  test('a pre-connect position read fails before crossing the runtime boundary',
+      () async {
     await bridge.ready.timeout(const Duration(seconds: 15));
     await expectLater(
       bridge.head(),
-      throwsA(isA<NomosBridgeError>()
-          .having((e) => e.message, 'message', contains('not connected'))),
+      throwsA(isA<StateError>().having((e) => e.message, 'message',
+          contains('No Nomos workspace is connected'))),
     );
   });
 
@@ -65,8 +66,7 @@ void main() {
         : null,
     () async {
       final ws = Platform.environment['NOMOS_HEADLESS_E2E']!;
-      final cloud = Platform.environment['NOMOS_CLOUD'] ??
-          'https://nomos.cafe';
+      final cloud = Platform.environment['NOMOS_CLOUD'] ?? 'https://nomos.cafe';
       await bridge.ready.timeout(const Duration(seconds: 15));
       await bridge.connect(
           cloud: cloud, workspace: ws, clientId: 'headless-test');

package/dart/test/webview_bridge_test.dart

@@ -24,6 +24,12 @@ protocol.RuntimeResponse _runtimeLifecycleResponse(
     case protocol.RuntimeRequest_Command.listWorkspaces:
       response.workspaceList = protocol.WorkspaceList();
       break;
+    case protocol.RuntimeRequest_Command.workspaceStatus:
+      response.workspaceStatus = protocol.WorkspaceStatus(
+        workspace: request.workspaceStatus.session,
+        head: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+      );
+      break;
     case protocol.RuntimeRequest_Command.prepareDomain:
       response.domainPrepared = protocol.DomainPrepared(
         domain: request.prepareDomain.domain,

package/dart_types/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.10.1
+
+- Carry the current typed Runtime v2 authentication, remote-offer, model-lifecycle, and custody frames from the shared Protobuf authority.
+
 ## 0.10.0
 
 - Replace the retired Runtime v1 command model with the generated Runtime v2 and custody snapshot