@githolon/dsl 0.95.0 → 0.95.2

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.5.0"
+    version: "0.6.0"
   package_config:
     dependency: transitive
     description:

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.59.0
+version: 0.60.0
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.95.0",
+  "version": "0.95.2",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/compile_package_main.ts

@@ -1047,11 +1047,11 @@ const DART_TYPES_IMPORT = `import 'package:nomos_types/nomos_types.dart';`;
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.5.0";
+const NOMOS_TYPES_DEP = "^0.6.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.58.0";
+const NOMOS_CLIENT_DEP = "^0.60.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/signing_identity.ts

@@ -329,8 +329,11 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
        *  walk (`verify_to_root`, keyless branch) RE-VERIFIES the token against the platform-attested
        *  AuthProvider (bound to K_root by the terminal platform_cert), so a forged/swapped cert fails the
        *  child's own gate. Writing it as the user's `SignerDelegation` is what lets `birthHome`'s offer-effect
-       *  assemble a WARRANTED travelling chain (closes co2's `birth-cert-not-seeded` / empty signerDelegation). */
-      delegationCert: z.string().min(1),
+       *  assemble a WARRANTED travelling chain (closes co2's `birth-cert-not-seeded` / empty signerDelegation).
+       *  OPTIONAL — an enroll-only flow (seat the signer, no imminent home birth) omits it and seeds no
+       *  delegation (backward-compatible with every pre-B `enrollFirstDevice` caller). The keyless home-birth
+       *  ceremony ALWAYS supplies it (that is what seeds the delegation the chain needs). */
+      delegationCert: z.string().min(1).optional(),
     }),
   )
   .plan((p, ctx) => {
@@ -354,6 +357,8 @@ export const enrollFirstDevice = directive("enrollFirstDevice")
     // The delegation is keyed by the AUTHENTICATED principal — EXACTLY the `founder` the kernel's birth
     // offer-effect reads it back by (`read_signer_delegation(state, &founder)`, founder == captured principal
     // == this `rawPrincipal`, already in `user:<uid>` form). Do NOT re-prefix.
+    // Absent delegationCert ⇒ enroll-only (no delegation seeded), byte-identical to a pre-B enroll.
+    if (!p.delegationCert) return tupleOps;
     const d = instance(SignerDelegation, signerDelegationInstanceId(rawPrincipal));
     const delegationOps: PlannedOp[] = [
       withMarker(set(d, "user", rawPrincipal), "ensures"),