@githolon/dsl 0.97.1 → 0.97.3

package/dart/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.61.2
+
+- cloudBound works against PRIVATE platforms/homes (declared read caps — the co2 shape): the device
+  ceremony uses a LOCAL scratch session (never clones the platform), and the born home mounts with the
+  dev-IdP token when the caller passes none (a private ledger serves only a VERIFIED principal).
+
+## 0.61.1
+
+- Runner entry resolution prefers the BUILT `@githolon/client/runner/node-entry.mjs` (published consumers:
+  node refuses type-stripping under node_modules, so the raw .ts entry only booted in-repo — DEFECT P3-002).
+
 ## 0.61.0
 
 - **ERA-0 cloud-bound harness** — `NomosTestHarness.cloudBound` now runs the full WARRANTED onboarding

package/dart/lib/src/test_harness.dart

@@ -810,13 +810,17 @@ class NomosTestHarness {
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           run: () async {
-            // The runner's crypto ops (authorKeygen/signBirthCert) run on a CONNECTED holon — open an
-            // onboarding session against the PLATFORM first (reads are open; this is the enrol surface).
+            // The runner's crypto ops (authorKeygen/signBirthCert) run on a CONNECTED holon — open a
+            // SCRATCH session on an unborn name (allowUnborn ⇒ an empty local holon; the pull-miss is
+            // tolerated): a PRIVATE platform (declared read caps — co2's shape) refuses an
+            // unauthenticated ledger clone, and the ceremony never needs the platform's ledger anyway
+            // (its writes go over the HTTP gateway below).
             await plane.connect(
               cloud: cloud.origin,
-              workspace: platformWorkspace,
+              workspace: '$clientId-onboard-scratch',
+              session: '$clientId-onboard-scratch',
               clientId: '$clientId-onboard',
-              authToken: authToken,
+              allowUnborn: true,
             );
             final kp = await plane.authorKeygen();
             final publicB64 = (kp['public'] ?? '').toString();
@@ -895,7 +899,9 @@ class NomosTestHarness {
                 cloud: cloud.origin,
                 workspace: home!,
                 clientId: clientId,
-                authToken: authToken,
+                // A PRIVATE home (declared read caps — co2's shape) serves its ledger only to a VERIFIED
+                // principal: ride the caller's token when given, else the dev-IdP token the ceremony minted.
+                authToken: authToken ?? device.idpToken,
                 // The home was born WARRANTED with THIS device enrolled in its genesis (ownerKeyHash) —
                 // connect with the same key so every write is signed and the home's own `.births()` offers
                 // (estates/catalogues) are device-attested (the client signs the birth cert automatically).
@@ -1263,18 +1269,24 @@ class NomosTestHarness {
   }
 
   static Future<String> _resolveEntry(String node, String from) async {
-    final r = await Process.run(
-      node,
-      ['-p', "require.resolve('@githolon/client/runner/node-entry.ts')"],
-      workingDirectory: from,
-    );
-    final out = (r.stdout as String).trim();
-    if (r.exitCode != 0 || out.isEmpty) {
-      throw NomosTestHarnessException(
-          'cannot resolve @githolon/client/runner/node-entry.ts from $from — '
-          'is @githolon/client installed (npm install)? Pass nodeEntry: to override. stderr: ${r.stderr}');
+    // PREFER the BUILT .mjs (the published-consumer entry): node refuses type-stripping under node_modules
+    // (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING — co2 DEFECT P3-002), so the raw .ts entry only boots
+    // in-repo. The .mjs ships from @githolon/client ≥0.97.2; the .ts fallback keeps in-repo dev working.
+    for (final entry in const [
+      '@githolon/client/runner/node-entry.mjs',
+      '@githolon/client/runner/node-entry.ts',
+    ]) {
+      final r = await Process.run(
+        node,
+        ['-p', "require.resolve('$entry')"],
+        workingDirectory: from,
+      );
+      final out = (r.stdout as String).trim();
+      if (r.exitCode == 0 && out.isNotEmpty) return out;
     }
-    return out;
+    throw NomosTestHarnessException(
+        'cannot resolve @githolon/client/runner/node-entry.{mjs,ts} from $from — '
+        'is @githolon/client installed (npm install)? Pass nodeEntry: to override.');
   }
 }
 

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.61.0
+version: 0.61.2
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.97.1",
+  "version": "0.97.3",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",