githolon 0.97.2 → 0.97.4

package/dist/dev-server.mjs

@@ -1674,6 +1674,7 @@ async function bootstrapPlatform(dev, opts) {
       );
     } else {
       let devIdP;
+      let pendingIdP;
       {
         const { generateKeyPairSync, sign: nodeSign } = await import("node:crypto");
         const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
@@ -1688,22 +1689,25 @@ async function bootstrapPlatform(dev, opts) {
           const si = `${header}.${payload}`;
           return `${si}.${b64url(nodeSign("sha256", Buffer.from(si), { key: privateKey, dsaEncoding: "ieee-p1363" }))}`;
         };
-        const ap = await serialize(async () => authorOn(
-          eng,
-          platform,
-          ledgerFor(platform),
-          homeDomain,
-          "setAuthProvider",
-          { issuer: ISS, keys: JWKS, audience: AUD, principalClaim: "sub", deviceBindingClaim: "nonce" },
-          lawHash,
-          { actor: OPERATOR, principalVerified: true }
-        ));
-        if (ap.ok) {
-          devIdP = { issuer: ISS, audience: AUD, jwks: JWKS, mint };
-          log2(`dev test IdP registered (setAuthProvider ${ISS}, aud ${AUD}) \u2014 mint tokens via POST /dev/mint-token`);
-        } else {
-          log2(`dev test IdP NOT registered \u2014 the law composes no setAuthProvider (${String(ap.error).slice(0, 120)}); /dev/mint-token will refuse`);
+        const apPayload = { issuer: ISS, keys: JWKS, audience: AUD, principalClaim: "sub", deviceBindingClaim: "nonce" };
+        try {
+          const deployBody = opts.deploy ? JSON.parse(readFileSync(opts.deploy, "utf8")) : null;
+          const iface = deployBody?.interface ?? {};
+          const domIface = iface.domains?.[homeDomain] ?? iface[homeDomain];
+          const fields = domIface?.directives?.["setAuthProvider"]?.fields ?? {};
+          for (const [name, spec] of Object.entries(fields)) {
+            if (spec?.optional === true || apPayload[name] !== void 0) continue;
+            if (spec?.kind === "int" && /At$/.test(name)) apPayload[name] = Date.now();
+            else if (spec?.kind === "string" && /At$/.test(name)) apPayload[name] = (/* @__PURE__ */ new Date()).toISOString();
+            else if (spec?.kind === "string" && /By$/.test(name)) apPayload[name] = OPERATOR;
+            else if (spec?.kind === "string" && /url$/i.test(name)) apPayload[name] = `${ISS}/jwks.json`;
+            else if (spec?.kind === "string") apPayload[name] = "dev";
+            else log2(`dev test IdP: required setAuthProvider field '${name}' (kind ${spec?.kind}) is not synthesizable \u2014 the author below may refuse typed`);
+          }
+        } catch (e) {
+          log2(`dev test IdP: BYO-shape fill failed (${errMsg(e).slice(0, 200)}) \u2014 the canonical payload stands`);
         }
+        pendingIdP = { ISS, AUD, JWKS, mint, apPayload };
       }
       const sOp = authorKeygen(eng);
       const opKeyHash = createHash("sha256").update(Buffer.from(sOp.public, "base64")).digest("hex");
@@ -1736,6 +1740,24 @@ async function bootstrapPlatform(dev, opts) {
       });
       if (!warrant.ok) throw new Error(`platform WARRANT (seedGenesis) REFUSED: ${String(warrant.error).slice(0, 400)}`);
       dev.operatorDevice = sOp;
+      if (pendingIdP) {
+        const ap = await serialize(async () => authorOn(
+          eng,
+          platform,
+          ledgerFor(platform),
+          homeDomain,
+          "setAuthProvider",
+          pendingIdP.apPayload,
+          lawHash,
+          { actor: OPERATOR, principalVerified: true, authorSecret: sOp.secret }
+        ));
+        if (ap.ok) {
+          devIdP = { issuer: pendingIdP.ISS, audience: pendingIdP.AUD, jwks: pendingIdP.JWKS, mint: pendingIdP.mint };
+          log2(`dev test IdP registered (setAuthProvider ${pendingIdP.ISS}, aud ${pendingIdP.AUD}) \u2014 mint tokens via POST /dev/mint-token`);
+        } else {
+          log2(`dev test IdP NOT registered \u2014 setAuthProvider refused (payload keys: ${Object.keys(pendingIdP.apPayload).join(",")}): ${String(ap.error).slice(0, 600)}`);
+        }
+      }
       dev.testIdP = devIdP;
       log2(`root-attested platform: enrolled founding device ${opKeyHash.slice(0, 12)}\u2026, seeded BirthAttestation (platform_cert signed by K_root, P_P=${sP.public.slice(0, 12)}\u2026), WARRANTED (self-id ${platform})`);
       log2("  a birthHome under this platform now assembles [home_cert, u_delegation(S_P), platform_cert(K_root)] \u2014 no unwarranted-cert.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.97.2",
+  "version": "0.97.4",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.97.2",
-    "@githolon/dsl": "^0.97.2",
+    "@githolon/client": "^0.97.4",
+    "@githolon/dsl": "^0.97.4",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {