@githolon/dsl 0.25.0 → 0.26.0

package/dart/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 0.22.0
+
+- `NomosBridge.offerIntent` (canonical write verb; `offerDirective` kept as alias) + one-call `NomosBridge.createWorkspace` (sign + relay a control-plane offer).
+
+## 0.21.0
+- `NomosBridge.noteLocalSpan(...)` — inject a locally-measured span (e.g. the Dart-side durable save, the
+  "saved to disk" number) into the span stream so it appears on the flame chart AND the per-phase stats
+  exactly like a kernel span. Additive; used by `nomos_flutter`'s durable-save-on-write.
+
 ## 0.20.2
 - `NomosBridge.connect` accepts the internal `allowUnborn` opt-in used by `NomosScope.home`, so the
   home-birth ceremony can boot a local bridge before the home workspace has a remote main. The default

package/dart/analysis_options.yaml

@@ -0,0 +1,5 @@
+analyzer:
+  exclude:
+    # Copy-paste Flutter glue example. `nomos_client` is intentionally pure Dart
+    # and must not depend on `webview_flutter` just to analyze its library.
+    - example/**

package/dart/lib/src/webview_bridge.dart

@@ -408,6 +408,94 @@ class NomosBridge {
     return r['head'].toString();
   }
 
+  /// UNDO the most-recent action via the kernel STRIKE primitive (the fold drops the struck intent by parity).
+  /// [scope] `'all'` undoes any author's most-recent action; `'user'` only THIS replica's own. [actions] is the
+  /// app's set of undoable directive ids (so undo never strikes a framework/control intent). [domain] +
+  /// [directiveId] name the law's strike directive (default `todo`/`undo`). Returns `{ok, undone, head}` (ok
+  /// false + reason when there's nothing to undo). REDO is [redoMostRecent] — it strikes the strike.
+  /// OFFER AN INTENT — the write verb. Plan a directive (domain/directiveId/payload) as the verified [actor];
+  /// the holon encodes the v2 offer envelope via the single codec and admits it. Returns the new local head.
+  /// (This is the canonical name; [offerDirective] is the legacy alias the generated clients still call.)
+  Future<String> offerIntent({
+    required String domain,
+    required String directiveId,
+    required Object? payload,
+    String? actor,
+    String? domainHash,
+  }) =>
+      offerDirective(
+          domain: domain,
+          directiveId: directiveId,
+          payload: payload,
+          actor: actor,
+          domainHash: domainHash);
+
+  /// MAKE A WORKSPACE — the one-call tenant path. A child workspace under a platform/[parent] is a SIGNED
+  /// control-plane offer; the holon seals `createWorkspace` (or [directiveId] `birthChild`) with the
+  /// requester's device key ([authorSecret], as [actor], e.g. `user:<uid>`) and relays it to the parent's
+  /// gateway. Returns the worker verdict (`{ok, status, body}`). The tenant move is one line:
+  /// `await bridge.createWorkspace(name: 'foo', parent: 'my-platform', actor: 'user:$uid', authorSecret: key)`.
+  Future<Map<String, Object?>> createWorkspace({
+    required String parent,
+    required String actor,
+    required String authorSecret,
+    String? name,
+    Object? payload,
+    String directiveId = 'createWorkspace',
+    String? domainHash,
+    String? authToken,
+  }) async {
+    final r = _asMap(await _call('createWorkspace', {
+      'parent': parent,
+      'actor': actor,
+      'authorSecret': authorSecret,
+      if (name != null) 'name': name,
+      if (payload != null) 'payload': payload,
+      'directiveId': directiveId,
+      if (domainHash != null) 'domainHash': domainHash,
+      if (authToken != null) 'authToken': authToken,
+    }));
+    return (r['verdict'] as Map?)?.cast<String, Object?>() ?? r;
+  }
+
+  Future<Map<String, Object?>> undoMostRecent({
+    String scope = 'all',
+    List<String>? actions,
+    String domain = '',
+    String directiveId = 'undo',
+  }) async =>
+      _asMap(await _call('undoMostRecent', {
+        'scope': scope,
+        if (actions != null) 'actions': actions,
+        'domain': domain,
+        'directiveId': directiveId,
+      }));
+
+  /// REDO the most-recent undo (strike the strike → its target re-applies). Same [scope]/[domain]/[directiveId]
+  /// as [undoMostRecent]. Returns `{ok, redone, head}`.
+  Future<Map<String, Object?>> redoMostRecent({
+    String scope = 'all',
+    String domain = '',
+    String directiveId = 'undo',
+  }) async =>
+      _asMap(await _call('redoMostRecent', {
+        'scope': scope,
+        'domain': domain,
+        'directiveId': directiveId,
+      }));
+
+  /// HISTORY of one aggregate (a todo) — the full action timeline from the ledger: every intent that touched
+  /// it + the strikes that retract them (undo/restore/redo), oldest→newest. Each entry:
+  /// `{id, who, mine, at(ms), action, fields[], done?, text?, removed?, marker, isStrike, targetAction, struck}`.
+  /// The caller formats the labels (created / renamed / done / deleted / restored / undone). No extra read —
+  /// who/when ride inside the intent id.
+  Future<List<Map<String, Object?>>> historyOf(String aggregateId) async {
+    final r = _asMap(await _call('historyOf', {'aggregateId': aggregateId}));
+    return ((r['entries'] as List?) ?? const [])
+        .map((e) => (e as Map).cast<String, Object?>())
+        .toList();
+  }
+
   /// Mint an ed25519 DEVICE KEY in-kernel → `{secret, public}` (base64). The SECRET stays on this device
   /// (persist it in secure storage); pass it to [connect] as `authorSecret` (or per-offer `signWith`) so the
   /// holon SIGNS each intent. The PUBLIC half is what gets enrolled so the gate re-verifies the signature on

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.21.0
+version: 0.22.0
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_ts.ts

@@ -432,7 +432,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
 
   // ── DERIVED BIRTH LANES (sharding §10 RATIFIED, slice 1) ──
   // A `workspaceType(...).hasMany(...)` taxonomy DERIVES typed birth helpers over
-  // the EXISTING birth machinery (the boot lane + the parent's birthPlatform/createWorkspace
+  // the EXISTING birth machinery (the boot lane + the parent's birthChild/createWorkspace
   // governance offers, `POST /v2/workspaces/...` — derived, never forked). Fully typesafe
   // per Jack's ruling: the caller passes LOGICAL names
   // (parent param named after the parent TYPE); the `p--ws` composition is internal

package/src/framework/home.ts

@@ -84,9 +84,9 @@ export function writeHomeOwner(p: { principal: string; homeName: string; bornAt:
 }
 
 /**
- * `seedHomeOwner` — the birth-door directive that stamps the home's owner + its self-committed `homeName` at
- * the fixed singleton id. A CONTROL-PLANE write: the host authors it once at lazy birth; the open session
- * lane structurally REFUSES it (by directive id). `.ensures` (a deterministic-keyed singleton). The `homeName`
+ * `seedHomeOwner` — the genesis directive that stamps the home's owner + its self-committed `homeName` at
+ * the fixed singleton id. It is authored by the birth/genesis chain and structurally refused on the open
+ * session lane. `.ensures` (a deterministic-keyed singleton). The `homeName`
  * is caller-supplied but the {@link homeNameBindsOwner} invariant proves it `== home-<sha256(principal)>`,
  * so a squatter cannot claim a name slot that doesn't hash to ITS own owner.
  */

package/src/framework/workspaces.ts

@@ -334,10 +334,9 @@ export const QuotaGrant = aggregate("QuotaGrant", {
 });
 
 /**
- * PlatformGrant — the invite to BECOME A PLATFORM. Platform creation is
- * invite-only: a principal may author {@link birthPlatform} iff an `active`
- * PlatformGrant names their uid. Same grant/revoke discipline as Admin/Creation
- * grants — authority is a law-state fact, never a worker config.
+ * PlatformGrant — legacy audit surface for platform invites. Platform creation now rides
+ * {@link birthChild} with genesis data and is gated by `#creator`; any remaining PlatformGrant rows are
+ * inert compatibility/audit data, never a worker config.
  */
 export const PlatformGrant = aggregate("PlatformGrant", {
   /** The auth-provider principal uid invited to create platforms. */