@githolon/dsl 0.95.0 → 0.95.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.95.0",
+  "version": "0.95.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/framework/signing_identity.ts

@@ -329,8 +329,11 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
        *  walk (`verify_to_root`, keyless branch) RE-VERIFIES the token against the platform-attested
        *  AuthProvider (bound to K_root by the terminal platform_cert), so a forged/swapped cert fails the
        *  child's own gate. Writing it as the user's `SignerDelegation` is what lets `birthHome`'s offer-effect
-       *  assemble a WARRANTED travelling chain (closes co2's `birth-cert-not-seeded` / empty signerDelegation). */
-      delegationCert: z.string().min(1),
+       *  assemble a WARRANTED travelling chain (closes co2's `birth-cert-not-seeded` / empty signerDelegation).
+       *  OPTIONAL — an enroll-only flow (seat the signer, no imminent home birth) omits it and seeds no
+       *  delegation (backward-compatible with every pre-B `enrollFirstDevice` caller). The keyless home-birth
+       *  ceremony ALWAYS supplies it (that is what seeds the delegation the chain needs). */
+      delegationCert: z.string().min(1).optional(),
     }),
   )
   .plan((p, ctx) => {
@@ -354,6 +357,8 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     // The delegation is keyed by the AUTHENTICATED principal — EXACTLY the `founder` the kernel's birth
     // offer-effect reads it back by (`read_signer_delegation(state, &founder)`, founder == captured principal
     // == this `rawPrincipal`, already in `user:<uid>` form). Do NOT re-prefix.
+    // Absent delegationCert ⇒ enroll-only (no delegation seeded), byte-identical to a pre-B enroll.
+    if (!p.delegationCert) return tupleOps;
     const d = instance(SignerDelegation, signerDelegationInstanceId(rawPrincipal));
     const delegationOps: PlannedOp[] = [
       withMarker(set(d, "user", rawPrincipal), "ensures"),