@githolon/dsl 0.98.0 → 0.98.2

package/dart/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.61.3
+
+- cloudBound seeds the KEYLESS enroll-once delegation (mintKeylessDelegation) so a keyless private home
+  is born with a well-formed cert chain (was: platform_cert in the delegation slot → self-refusal).
+
 ## 0.61.2
 
 - cloudBound works against PRIVATE platforms/homes (declared read caps — the co2 shape): the device

package/dart/lib/src/test_harness.dart

@@ -835,6 +835,22 @@ class NomosTestHarness {
             if (idpToken.isEmpty || issuer.isEmpty) {
               throw NomosTestHarnessException('cloudBound: /dev/mint-token returned no token — is the test cloud started with platform:/deployJsonPath: and a law composing setAuthProvider?');
             }
+            // THE KEYLESS ENROLL-ONCE DELEGATION (links[1] of the home cert chain) — device-self-signed,
+            // its authority the dev-IdP token. enrollFirstDevice SEEDS it as the user's SignerDelegation, so
+            // birthHome's offer-effect assembles a WELL-FORMED chain [home_cert, u_delegation, …platform…].
+            // WITHOUT it the platform holds no delegation for the owner, the assembly falls to the
+            // no-delegation branch, the platform_cert lands in the delegation slot, and the home refuses at
+            // its OWN verify door ("home cert founder != delegation cert founder").
+            final delegationCert = await plane.mintKeylessDelegation({
+              'user': subject,
+              'deviceKey': publicB64,
+              'childName': _homeNameOf(subject),
+              'parentId': platformWorkspace,
+              'verifiedVia': issuer,
+              'idpToken': idpToken,
+              'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
+              'epoch': 0,
+            }, secret);
             await post('/v2/workspaces/$platformWorkspace/enrollFirstDevice', {
               'keyHash': keyHash,
               'verifiedVia': issuer,
@@ -843,6 +859,7 @@ class NomosTestHarness {
               'idpToken': idpToken,
               'actor': subject,
               'authorSecret': secret,
+              'delegationCert': jsonEncode(delegationCert),
             }, headers: {'x-nomos-auth': idpToken});
             return (publicB64: publicB64, secret: secret, keyHash: keyHash, idpToken: idpToken);
           });

package/dart/lib/src/webview_bridge.dart

@@ -1829,6 +1829,20 @@ class NomosBridge {
       }))['cert'] as Map<String, Object?>? ??
       const {};
 
+  /// MINT THE KEYLESS ENROLL-ONCE DELEGATION (`enrollFirstDevice.delegationCert`, the verified-first-device
+  /// lane). The device SELF-signs it; its authority is the carried `idpToken` (the kernel re-verifies that to
+  /// the platform's AuthProvider at every lane), so no S_P/admin signature is needed. [spec] carries
+  /// `{user, deviceKey, childName, parentId, verifiedVia, idpToken, capturedClock, epoch}`. WITHOUT this the
+  /// keyless home is born with a malformed cert chain (the platform_cert falls into the delegation slot →
+  /// `home cert founder != delegation cert founder` at the home's own verify door).
+  Future<Map<String, Object?>> mintKeylessDelegation(
+          Map<String, Object?> spec, String deviceSecret) async =>
+      _asMap(await _call('mintKeylessDelegation', {
+        'spec': spec,
+        'deviceSecret': deviceSecret,
+      }))['cert'] as Map<String, Object?>? ??
+      const {};
+
   /// ENROLL THIS DEVICE — the LIVE gate: bind a device key's PUBLIC half to `principal` on-chain as a
   /// `signer` so the holon's gate can PROVE this device's authorship on replay (and the VA chain attest it).
   /// `publicKey` is the base64 PUBLIC half (from [mintDeviceKey]); `authToken` (defaults to the connect-time

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.61.2
+version: 0.61.3
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.98.0",
+  "version": "0.98.2",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/framework/home.ts

@@ -36,6 +36,7 @@ import { set, type PlannedOp } from "../ops.js";
 import { query } from "../query.js";
 import { birth } from "../births.js";
 import { readFrameworkDeclared } from "../read.js";
+import { authProvider as authProviderQuery } from "./auth_provider_law.js";
 import { workspaceInvariant, refAs } from "./workspace_invariant.js";
 import { identityRelations } from "./signing_identity.js";
 import { writeTuple } from "./relations.js";
@@ -291,7 +292,7 @@ export const birthHome = directive("birthHome")
     birth({ workspace: homeName, genesisChain });
     return [];
   })
-  .reads("authProvider") // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
+  .reads(authProviderQuery) // the parent-side AuthProvider capture the inheritance copies (the #58 lane)
   .births(); // BIRTH IS A DECLARED KERNEL PRIMITIVE — emits the `nomosBirthGate` era key; the kernel folds the recipe
 
 /**