nomos_client 0.62.2

Nomos 2 Dart frontend types — the hand-written kernel wire types plus the code-generated per-domain aggregate + directive-payload types. (De)serializes the EXACT serde JSON the Rust kernel + projectio [...]

0.62.2

• Make NomosTestHarness own a complete, verifiable local trust lineage. Tests still bind a business actor and call the generated birth method; the harness privately mints its test root, seats the signer and delegation, lands the warrant in order, and refuses any child whose full chain does not replay to that root.

0.62.1

• Align the public Dart documentation with the one Flutter application entry point: identity comes from the token passed to NomosScope.home(application:, authToken:); application code no longer supplies a subject or device-token callback.

0.62.0

• Generated business clients expose one birth(payload) method. The bound session supplies its verified principal from the authentication token, and Nomos owns the identity, provenance, persistence, and recovery ceremony beneath the business call.

0.61.3

• cloudBound seeds the KEYLESS enroll-once delegation (mintKeylessDelegation) so a keyless private home is born with a well-formed cert chain (was: platform_cert in the delegation slot → self-refusal).

0.61.2

• cloudBound works against PRIVATE platforms/homes (declared read caps — the co2 shape): the device ceremony uses a LOCAL scratch session (never clones the platform), and the born home mounts with the dev-IdP token when the caller passes none (a private ledger serves only a VERIFIED principal).

0.61.1

• Runner entry resolution prefers the BUILT @githolon/client/runner/node-entry.mjs (published consumers: node refuses type-stripping under node_modules, so the raw .ts entry only booted in-repo — DEFECT P3-002).

0.61.0

• ERA-0 cloud-bound harness — NomosTestHarness.cloudBound now runs the full WARRANTED onboarding ceremony against the test cloud: the platform is BORN warranted+attested at cloud boot (NomosTestCloud.start(platform:, deployJsonPath:)), the owner's device enrols through the REAL first-device lane (/dev/mint-token → enrollFirstDevice), and birthHome is device-signed + attested with ownerKeyHash (the born home is SIGNER-READY — it births estates/catalogues offline from intent 0). Six named phases, all deadlined.
• NomosTestCloud.start(platform:, deployJsonPath:) — the dev cloud stands the platform up at boot (era-0: the host does not create workspaces; the harness's old POST-create refuses 409 by design). /health gates on platformReady: true so clients never race the ceremony.
• acquireSession(…, authorSecret:) — sign a locally-born (warranted) child session's writes with its owner's device key; deviceSecret(workspace)/devicePublicKey(workspace) expose the harness device (the harness IS the device) for .births() payload ownerKeyHash derivation.
• Requires githolon/@githolon/client ≥ the era-0 release (the client auto-signs self-serve birth certs on the kernel's typed birth-unattestable refusal — apps never hand-roll certs).

0.56.0

• NomosTestCloud (co2 #4) — a headless, cloud-BOUND real-sync test harness: start/stop a local githolon cloud dev (the same engine plane production runs), an online/offline PARTITION proxy (setOnline) for deterministic link sever/heal, and remote head/commit inspection (remoteHead). Sessions connect cloud-bound to cloud.origin; sync/convergence uses the existing bridge.sync.
• Typed snapshot lifecycle on NomosTestHarness (co2 #5) — snapshotWorkspace/snapshotPlane and restoreWorkspace/restorePlane over the per-workspace export()/connect(restoreFrom:) primitives, with typed WorkspaceSnapshot/PlaneSnapshot (JSON round-trip, session/workspace metadata). Migrate staged AppSim snapshots mechanically — no reaching into custody internals.
• assertCompatible surfaces a projection read failure (co2 #2) as a distinct projectionReadFailed cause (carrying the failed query) instead of reclassifying an evicted/failed session as trulyNotDeployed.

0.55.2

• Session-state DX (co2): explicit workspace lifecycle state on listWorkspaces() — connected | resident | parked — so a listed-but-unopened workspace (e.g. a locally-born child) is distinguishable at a glance, ending the "listed but session(ws) fails on first op" footgun.
• NomosRef.acquire(bridge) — open a born/resident ref directly: await outcome.bornRefs.single.acquire(bridge) (sugar over acquireSession, keyed by the ref's workspace).
• NomosSession.isConnected + assertConnected() — the fail-at-bind guard: a clear, actionable StateError instead of an opaque "session is not connected" on the first read/write.
• Patch bump — keeps the exact-minor ^0.55.0 pins valid, no generated-client re-pin needed.

0.55.1

• Add deriveWorkspaceName(namespace, key) — re-derive the workspace name a keyed birth (birth.keyed) produced, so a born workspace is addressable from its key with zero persistence (byte-identical to @githolon/dsl + @githolon/client; contract-tested vectors). Replaces hand-rolled <x>WorkspaceFor<Id> helpers.
• Expose bridge.issueDelegationCert({signerSecret, grantorId, relation, subject, epoch, certChain}) — issue a role-delegation cert (the .delegatedRole() lane) from the public client; deliver via acceptDelegatedRole. Runner bundle rebuilt.

0.55.0

• Security: enrollSigner self-binds (device can only enroll itself; cross-principal forgery closed by construction, offline-secure). Client lifecycle fixes from the adversarial sweep: watches survive LRU park/remount (realm-owned rebind registry — no more silent watch death), DLQ recovery never drops salvage on offline/unborn planes, a failed connect leaves no phantom session, evicted handles throw typed nomos.session.disposed, and query()/queryById() throw on a read-forbidden verdict. Per-offer authorSecret threads to the signing path. Requires bundle >= 0.80.0.

0.54.2

• Runner-bundle floor -> 0.79.0 (the fixed-group npm lift; 0.54.1 was published mid-release with the 0.78.1 floor — runtime-equivalent, this aligns the published package with the paired bundle exactly).

0.54.1

• Fix: principal normalization mismatch in signer recovery — enrollment wrote identity:user:<uid>#signer (the kernel-canonical captured principal) while the posture/preflight reads stripped user: and reported false missing-signer-enrollment immediately after a successful repair. One canonical normalizer now routes every surface; co2's five-step acceptance (repair → immediate enrolled:true → canAuthor ok → birth admits) is the regression test, with user:-shaped principals, proven failing-then-passing. Typed authz diagnosis now also rides the createWorkspace relay (no more generic 422).

0.54.0

• Parent-signer recovery (the reborn-parent scar): ensureParentSignerEnrollment(...) — idempotent verify-and-repair of identity:<uid>#signer on a configured parent (one relation read when healthy; lawful repair via the discovered signing directive — enrollSigner pre-warrant, the keyless enrollFirstDevice lane on a warranted parent); parentSignerEnrollment(...) posture read; devicePublicOf(secret).
• canAuthor(directiveId, ...) preflight — evaluates the gate's premises read-only and returns the typed verdict ({actor, keyHash, cause}) BEFORE the user fills a form; NomosSession.canAuthorTyped throws the typed error.
• Gate refusals classify into nomos.authz.* typed errors (see nomos_types 0.4.0). Requires the paired runner bundle >= 0.78.0.

0.53.0

• Stale-baked-bundle detection. The runner bundle stamps its release version into the ready frame (build-time injected — it cannot lie); the bridge refuses an older or pre-stamp bundle at boot with the typed StaleRunnerBundle naming found/expected and the flutter clean remedy. Flutter silently keeping an old baked bundle across a pub upgrade is now a one-line error at app start instead of behavioral archaeology. allowStaleRunnerBundle: true is the deliberate mixed-version escape hatch. Requires the paired runner bundle >= 0.77.1 (nomos_flutter 0.53.7).

0.52.0

• Offer ack decoupled from watch fan-out (co2's 2.08s 3×3-grid report): the durable acknowledgement (plan + gate + fold + git write) resolves before any watch fan-out runs; the post-write nudge — including the O(law-size) compat recompute that was the bulk of the unaccounted ~1.1s — is a coalesced macrotask after the ack. Ack latency is now watcher-count-independent (fixture: 346ms with 12 watchers → 71ms flat). Read-your-writes holds (projection updates at fold time, tested); ticks are never lost (coalescing + flush-on-dispose, tested).
• Full offer span taxonomy on recentSpans/spanEvents with no new API: payload-encode, compat-preflight, bridge-ipc, gate-fold, watch-nudge, response-delivery (git-write is not separable client-side — plan+gate+fold+write is ONE wasm call). Older runner bundles degrade cleanly (no bridge-leg spans).
• Regression test for local-only sync observational inertness (offer → query → sync{localOnly} → head unchanged → same row).

0.51.0

• The burn-down wave. Dead-letter queue surface on the session plane: deadLetters(), retryDeadLetter(), discardDeadLetter(), salvage(), absorbSalvage() — with the local-only retry/absorb fixes and the salvage-shape parking fix (refused work is NEVER silently dropped). nomos_headless.dart exports the full session surface. Requires Nomos Cloud ≥ the 2026-07-11 burn-down deploy for the fleet DLQ sweep lanes (/dlq-summary, /dlq-sweep) and the content-addressed large-deploy staging lane.

0.50.1

• Structural: the session-delegation-gap class is closed. All event-dispatch registries (watch subscriptions, compat watches, custody/sync/signal/flame/span/transfer/status controllers, span buffers, session registries) now route through one _eventPlane seam that resolves to the plane owning the message loop — the base class is correct for NomosSession automatically, and all 17 hand-written per-method session overrides are DELETED (including the 0.48.1 watchPendingConflicts fix, whose regression test still passes — the proof). Five latent unreported instances of the same bug fixed en passant: session.custodyEvents (dead stream), connectedSessions (empty), connect()-on-session state stamping, checkCompat() caching, noteLocalSpan() (dead buffer). A source-level tripwire test fails the suite if a future Stream-returning method bypasses the seam.
• The first-five-minutes gauntlet — one checklist test walking the entire promised surface (deviceKeyed cluster + phase diagnostics, the blessed session-bound shape, local autoSync posture with zero-fetch assertion, acquireSession single-flight, reactive first-snapshots, attested keyed reads, custody reset/re-seed, deadline-bounded disposal) — now runs in CI on every client/runner/codegen change. Every one of this week's four tenant-reported lifecycle bugs appears as an explicit leg.

0.50.0

• No silent hangs — the standing harness property. Every NomosTestHarness lifecycle phase now has a deadline (overridable via the new phaseTimeout param) and throws a typed HarnessPhaseTimeout naming the phase (e.g. "3b: keyed reconnect of 'catalogue'"), workspace, elapsed time, the awaited bridge op, and likely causes — a wedge is a 30-second named exception, never a 40-minute bisection. Every phase logs terse enter/exit diagnostics. Disposal deadline breaches are logged, not thrown — teardown always completes.
• Keyed-reconnect lane hardened (the deviceKeyed cluster hang report): harness phase 3b (keygen + keyed reconnect) had no timeout and no diagnostics — any wedge there hung silently after "4 session(s) connected". Additionally two runner/realm defects fixed: the stale session record stayed routable during an async re-open (concurrent ops could hit the disposed holon — now an atomic replace with a fast typed refusal in the window), and a re-open with new credentials but no restoreFrom silently kept the OLD identity (the fresh authorSecret was never installed) — an identity-bearing option change now forces an in-place re-mount over resident custody.
• co2's acceptance implemented verbatim: cluster(deviceKeyed:) completes, devicePublicKey populated, colocated attested read signed by the re-opened key, disposal completes.

0.49.0

• Fix: local-only autoSync() deadlocked the multi-workspace plane. A local:// session's autoSync registered the full cloud machinery (doorbell WebSocket retry loop, fallback timers, intent-offer POSTs that could never land) — the future never completed, the runner dispatcher starved, sibling queries and listWorkspaces() hung, and teardown wedged. autoSync() on a local-only session now registers nothing and returns immediately; sync() is a true no-op (localOnly: true summary); a local:// holon performs ZERO network attempts. (co2's acceptance test implemented verbatim; failed before, passes after.)
• New: acquireSession(workspace, {ifAbsentCredentials}) — atomic single-flight session acquisition: reuses a connected session, joins an in-flight open (concurrent calls yield the same handle, one connect), opens local-only for workspaces the plane already knows (mounted/parked/resident custody — credentials never invoked), and only calls ifAbsentCredentials (exactly once) when a genuine cloud open is required.

0.48.1

• Fix: NomosSession.watchPendingConflicts() never emitted. The session overrode every other reactive read to register on the parent plane (which owns the message loop) but omitted this one — a session-bound generated client's conflict stream registered on the session's own dead controller registry and never delivered an event. Now delegates like watch/watchById/watchActivity. Regression test: a session-level subscription must emit its first snapshot. (Reported by co2 with the exact fix — thank you.)

0.48.0

• Session-bound clients (architecture/session_bound_clients.md) — generated clients now bind to exactly ONE NomosSession: XClient.bind(session) async preflight factory (structural interface compat, typed DomainClientSessionMismatch at construction), all dispatch through the session, births infer the parent from the session (no loose parent strings), engine.follow(NomosRef) mounts by ref, NomosOfferOutcome.bornRefs. The kernel's generic "no active installed law declares domain 'x'" is wrapped into the context-rich DomainNotInstalledForSession (session identity, both workspaces, active domain keys/hashes, the four possible causes).
• Root-bridge generic writes (offer/offerDirective/offerIntent/offerCreates/createWorkspace) are @Deprecated in app code — kept for CLI/admin tooling; the session-bound generated surface is the path.
• NomosSession.pendingConflicts() / watchPendingConflicts() — the maintained Surfaced-conflict "decisions needed" read (derived, not drained).
• Test harness: resetWorkspaceCustody, seedWorkspaceFromDeployJson, assertDomainInstalled, session.assertCompatible(XClient.interface).
• Requires Nomos Cloud ≥ the 2026-07-11 deploy (wasm 72604ff7 — the Surfaced/captured-basis kernel) and pairs with @githolon/dsl 0.72.0 codegen.

0.47.0

• Fix: NomosBridge.createWorkspace hardcoded domain: "workspaces" in the underlying signed offer — a tenant birthing through their OWN platform's custom law (e.g. a birthEstateWorkspace directive under a co2_platform domain) was refused, because the sealed intent always claimed domain: "workspaces" regardless of which law actually declares the requested directiveId. Added a domain parameter (default "workspaces", fully back-compatible) — call bridge.createWorkspace(domain: 'co2_platform', directiveId: 'birthEstateWorkspace', domainHash: ..., ...) to birth through a custom platform law. This release was overdue: the fix landed in nomos_flutter 0.52.2's bundled JS runtime, but this Dart-level API surface lives in nomos_client and was never republished alongside it — a real release-process gap, not a client-side workaround. Requires nomos_flutter >= 0.52.2 to match the bundled runtime behavior.

0.46.0

• Custody lifecycle on NomosBridge/NomosSession: connect(..., onCustodyBreak: CustodyBreakPolicy), custodyStatus(), the custodyEvents stream, resolveCustodyBreak() (the ask lane — put the decision in front of the user), salvagedIntents/reofferSalvaged/discardSalvaged. A rebirth/supersession is a first-class typed event: named truthfully, decided by the app, local work never silently adopted nor lost. Requires nomos_types >= 0.1.4.

0.45.0

• offerOutcome(...) — the one outcome-returning offer lane generated clients now call for EVERY directive: returns NomosOfferOutcome with workspace-stamped created (NomosCreated gains workspace + a NomosRef get ref view). Activity raw rows carry created + workspace. Requires nomos_types >= 0.1.3.

0.44.0

• Activity-feed runtime reads on NomosBridge/NomosSession: activityLog({base, limit}) — the committed intent log as raw rows {intentId, domain, directiveId, actorSubject, occurredAt, payload} (decoded payload; the verified author; the physical HLC) — and watchActivity({base}), a stream re-deriving the feed on every sync tick. Generic (raw Maps); the generated renderActivity (from directives' declared .activity() metadata) types them into ActivityEvents. Requires nomos_types >= 0.1.2.

0.43.0

• NomosBridge.foreignReader({cloud}) — a NomosForeignReader backed by the device's multi-workspace bridge plane, so a generated ForeignRef (t.foreignRef) resolves against real data: it mounts the foreign workspace on demand (connect(session: ws, allowUnborn: true), idempotent) and reads it (session(ws).queryById(id)); watch re-reads on each sync tick. A locator resolver, not a foreign key — the foreign holon is mounted only when you resolve. Requires nomos_types >= 0.1.1 (the ForeignRef types).

0.41.0

• NomosTestHarness emits named phase-progress diagnostics (install → spawn runner → await ready → connect, plus per-session progress in cluster) and each connect() carries a connectTimeout (default 120s) that throws a NAMED remedy instead of hanging — so a multi-test AppSim run can tell install vs runner-wait vs session-block vs deadlock (co2 feedback).

0.40.0

• connect(maxMounted: …) — the realm's mounted-workspace budget (LRU park/remount above it); useful on memory-constrained devices holding many local workspaces.
• MULTI-WORKSPACE BY DEFAULT IN TESTS: NomosTestHarness.ephemeral now connects a DECOY session alongside the workspace under test, and harness.bridge is a NomosSession HANDLE pinned to it (existing tenant tests work unchanged). Sole-session inference therefore never silently passes under the harness — an op that forgot its session refuses in your first test with the same multiple sessions connected — pass session a real multi-workspace app raises. Opt out with decoySession: false.
• NomosBridge.open(...) — connect + pinned NomosSession handle in one call (final home = await bridge.open(workspace: …); HomeClient(home)): the recommended plane/handle shape; the bare bridge methods remain one-workspace sugar.

0.39.0

• Multi-session compat surface: watchCompatibility takes an optional session; NomosSession pins its compat watch, compat, and onLawChanged to ITS workspace (per-session lawChanged scoping — previously a multi-session plane's compat verdict was whichever session synced last, and a session's compat watch refused on a >1-session plane).

0.38.0

• SPLIT: the pure data core (wire types, offer codec, NomosReads, aggregate meta, schema validation, error info) moved to the new nomos_types package; nomos_client depends on and re-exports it, so existing imports are unchanged. Frontend/UI code can now depend on nomos_types alone.

0.37.1

• Doc fix: NomosBridge.attestedRead docs now match the runtime — the call answers { entry: {queryId, result, attestation: …} }; pass result['entry'] as one offerDirective attestations element.

0.32.0

• SPATIAL READS: NomosBbox + NomosBridge.spatialWithin(spatialId, bbox) + watchSpatial(...) — the R*Tree probe surfaces on the bridge; generated clients (tooling ≥0.46) emit typed sitesByBounds({required NomosBbox bbox}) + watch accessors.
• Analyzer-clean under strict lints (curly-braces rule) — the two remaining unbraced ifs in the bridge are gone.

0.31.0

• NomosFieldMeta.fromBirth — the registry surfaces BIRTH-PRESENCE LAW (.fromBirth() fields, tooling ≥0.42): a gate invariant guarantees the field present on every row, and the generated read models type it non-nullable.

0.30.0

• RUNTIME AGGREGATE METADATA: NomosAggregateMeta / NomosFieldMeta / mergeAggregateMeta (src/aggregate_meta.dart) — the support types for the generated per-domain const Map<String, NomosAggregateMeta> <domain>AggregateMeta registry (nomos-compile ≥0.41 tooling). Generic surfaces (history/audit UIs, op renderers, in-app agents) resolve NomosAggregateMeta.typeOfId(op.aggregate) → field kinds, enum wire values, VO/variant names, and the typed fromJson decoder — the compiler's knowledge emitted as data, derived from the law's own declarations.

0.29.0

• LAW-MINTED IDS RETURN TO THE CALLER: NomosBridge.offerCreates(...) → NomosOfferOutcome{head, created} — a .creates plan mints its aggregate id inside the sealed intent (payloads never carry one); the offer now hands the minted ids back, so generated create methods return the typed id with no query-after round-trip. New types NomosOfferOutcome / NomosCreated.
• NomosBridge.mintId(typeTag) — reserve a kernel-minted typed id (<TypeTag>_<uuidv7>) via the holon's front-door mint, for app-side references. (.creates payloads still carry NO id — the law mints those.)
• Generated Dart clients (nomos-compile ≥0.38 tooling): .creates(...) directive methods now return Future<NomosOfferOutcome> instead of Future<String> — outcome.created.single.id is the new aggregate's typed id.

0.28.0

• NomosTestHarness (nomos_headless.dart): ephemeral real-law fixtures — one call births a throwaway cloud workspace, deploys compiled *.deploy.json law, and hands out independent client replicas (connect(clientId:)) over the node runner. Identity defaults to the githolon login --agent session (~/.holon/credentials.json). Live-proven: birth → deploy → write on one replica → converge + typed read on another, 14s end-to-end.
• HEADLESS TRANSPORT (package:nomos_client/nomos_headless.dart): NodeRunnerTransport — a BridgeTransport over the @githolon/client node runner (runner/node-entry.mjs) as a plain child process (NDJSON stdio). flutter test / dart test / CI drive the REAL githolon (byte-identical wasm, real ledger, real gate) through NomosBridge + the generated typed clients — no Flutter plugins, no WebView, no assets. Requires node on PATH + a resolvable @githolon/client (auto-resolved from the app's node_modules, or pass entry:). Proven end-to-end: connect → offerDirective → sync(admit) → typed query, and the same test green under both dart test and flutter test.

0.27.0

• TYPED SNAPSHOT RECOVERY (corrupt local custody): NomosBridge.connect(recover: true) recovers IN-PLACE from a corrupt restoreFrom snapshot — salvages local-only authored writes (via the fallible intents_above, which stops at a missing-ancestor gap) + the DLQ, refolds FRESH from cloud, re-offers the salvaged work (deduped), re-queues the DLQ. The report rides bridge.lastRecovery = {salvagedWrites, requeuedDeadLetters, unsalvageable} — a write the current law refuses lands in unsalvageable + the DLQ (surfaced, never dropped). Also holon.salvage() / holon.absorbSalvage(). Closes the restoreFrom-leaves-read-model-empty case.

0.26.0

• TIER-2 SYNC SIZE: NomosBridge.syncSize() → {bytes, kind} — how many bytes this workspace would transfer to catch up, WITHOUT downloading (a HEAD on the serving pack; the host answers Content-Length, cached ~15s). Sum across open workspaces for an aggregate "X MB to sync" total before any download.

0.25.0

• SYNC STATE + REAL LOADING BARS: NomosBridge gains syncStatus (Stream

0.24.0

• createWorkspace / shareWith no longer require authorSecret — it defaults to the connection's signing key (the home device key NomosScope.home loaded). A frontend dev never threads a key through make-workspace or share.

0.23.0

• NomosBridge.shareWith — one-call cross-custody share (sign quote + deliver recordShare to the subjects home). Closes the shared-with-me loop.

0.22.0

• NomosBridge.offerIntent (canonical write verb; offerDirective kept as alias) + one-call NomosBridge.createWorkspace (sign + relay a control-plane offer).

0.21.0

• NomosBridge.noteLocalSpan(...) — inject a locally-measured span (e.g. the Dart-side durable save, the "saved to disk" number) into the span stream so it appears on the flame chart AND the per-phase stats exactly like a kernel span. Additive; used by nomos_flutter's durable-save-on-write.

0.20.2

• NomosBridge.connect accepts the internal allowUnborn opt-in used by NomosScope.home, so the home-birth ceremony can boot a local bridge before the home workspace has a remote main. The default remains strict for ordinary workspaces.

0.20.1

• NomosBridgeError now carries structured NomosErrorInfo alongside the existing human-readable message. The envelope includes stable code/component/operation fields, workspace/domain/directive context, trace/span ids, arbitrary attributes, and toTelemetryAttributes() for future OpenTelemetry export without taking an SDK dependency.
• Every bridge request now carries an OpenTelemetry-shaped trace context. String-only legacy runner errors still work and are upgraded locally with operation/trace metadata.

0.20.0

• Authority-aware: NomosBridge.offerDirective(domain, directiveId, payload, {actor, domainHash}) — generated clients route every offer through THE ONE encoder (encodeIntentOfferBytes in @githolon/client); no per-client envelope encoding. New typed MissingOfferAuthority — a .requires(...) directive authored with no actor throws BEFORE submit (an actorless gated offer cannot be generated). Lockstep jump to 0.20.0.

0.17.0

• Lockstep bump with the birth-primitive release (see @githolon/dsl 0.17.0): birth is one law primitive (birthChild), the platform-creator tier collapsed onto #creator, grantCreation takes a user or key subject. The Dart wire types track the current /v2 governance surface.

0.16.0

• First pub.dev release: kernel wire types, NomosBridge protocol, typed offer/query/watch surface.