nomos_client
Nomos 2 Dart client — generated domain values, intent payloads and application lifecycle types over the typed Nomos kernel protocol and USDA custody model.
0.65.0
3.1K downloads/mo
#4609 most downloaded on pub.dev
Captain-App/nomos2
What this package is like to depend on
Last release today
23 Aug 2026
Ships on a steady schedule
a new release about every 8 days
Most releases are documented
notes for 87 of 97 stable releases
Nothing withdrawn
no release was ever pulled
2 months old
97 releases · first in 2026
97 releases in the last 12 months
see the full history below
Release timeline
97 releases · Jun 2026 to Aug 2026Releases
latest 60 of 97-
0.65.023 Aug 2026Release notes
Open source →- Consume the generated typed offer-admission ABI from
nomos_types0.9.0 and keep current birth certificate evidence as structured USDA values rather than JSON envelopes.
- Consume the generated typed offer-admission ABI from
-
0.64.4623 Aug 2026Release notes
Open source →- Restaged the generated runtime bridge: regenerated vendored runtime assets. Published pub.dev archives are immutable, so regenerated bytes ride their own version.
-
0.64.3915 Aug 2026Release notes
Open source →- Resolve kernel compatibility through typed OSGi Contract Namespace requirements and OpenUSD candidate custody, removing the private JSON selection and feature-manifest formats from generated hosts.
-
0.64.3613 Aug 2026Release notes
Open source →- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
-
0.64.3413 Aug 2026Release notes
Open source →- Keep the typed birth certificate on the birth offer only, so preliminary signer enrolment can settle before generated business APIs open.
-
0.64.3313 Aug 2026Release notes
Open source →- Converge arbitrary historical generated-model backlogs while failing a genuinely repeated immutable lifecycle step with a typed stall error.
-
0.64.3212 Aug 2026Release notes
Open source →- Prove a restored generated-application device is enrolled before exposing business APIs, including recovery from an interrupted bootstrap journal.
-
0.64.3112 Aug 2026Release notes
Open source →- Restage the validated intent-offer byte gate and deterministic signer-posture reader into the immutable Dart runner.
-
0.64.2912 Aug 2026Release notes
Open source →- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
-
0.64.2811 Aug 2026Release notes
Open source →- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
-
0.64.2711 Aug 2026Release notes
Open source →- Make
https://nomos.cafethe sole default Nomos Cloud surface used by the WebView bridge. The published Dart runtime no longer points at the retired Captain App hostname.
- Make
-
0.64.2611 Aug 2026Release notes
Open source →- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
-
0.64.2510 Aug 2026Release notes
Open source →- Rebuild the vendored Dart runner from
@githolon/client0.105.8. Web-client source is an input to this immutable pub.dev archive, so the Dart package now advances whenever that source changes.
- Rebuild the vendored Dart runner from
-
0.64.2410 Aug 2026Release notes
Open source →- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
-
0.64.2309 Aug 2026Release notes
Open source →- Rebuild the self-contained runner without the retired structural-interface sidecar assumption; compatibility is carried by the generated client and offered by installed USDA.
- Depend on
nomos_types0.8.7 so JSON-valued domain objects retain fields alongsidevalue.
-
0.64.2207 Aug 2026Release notes
Open source →- connect() no longer manufactures a custody verdict from an unrelated failure. A boot error
propagates as itself;
nomos.custody.snapshot_corruptis raised only by the snapshot reader that found the bytes unreadable, so a transient network fault cannot trigger quarantine-and-reclone of healthy local custody.
- connect() no longer manufactures a custody verdict from an unrelated failure. A boot error
propagates as itself;
-
0.64.2107 Aug 2026Release notes
Open source →- NEW:
Realm.snapshot(name)— export one workspace's exact resident custody without manufacturing a runner session. A generated birth can leave a child resident in the shared kernel before application code acquires it, so host persistence cannot be defined as "every connected session": mounted, parked and born-but-unopened residents all export. This is what makes a locally-born estate survive a close. - Snapshots carry the workspace they belong to. Restoring one into a DIFFERENT workspace is now a typed recoverable error rather than a silent misinterpretation, and a corrupt v2 envelope is refused instead of being decoded as legacy binary custody.
- The kernel's colocated-read residency refusal is recognised and satisfied on the device runner lane, matching the cloud.
- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
- NEW:
-
0.64.2006 Aug 2026Release notes
Open source →- NEW:
bridge.localWorkRejectedEvents— a typed stream ofNomosLocalWorkRejectedEvent(from nomos_types 0.8.6) forwarded over the runner bridge, so apps render honest UX ("queued, will retry" vs "preserved for review — contact support") instead of scraping raw refusal prose. parentSignerEnrollmentgainsremote: true— force the CLOUD-gateway read even when this holon IS the parent: the seated barrier's proof-by-read (enrolled there ⇒ durably in custody, not merely locally folded).- Rebuild the bundled runner from @githolon/client 0.105.5 (the seal-obligation release: footage-first offer lane, scoreboard truth, FF-only seals, seal retry, no-evict-while-dirty).
- NEW:
-
0.64.1906 Aug 2026Release notes
Open source →- Rebuild the bundled runner assets from @githolon/client 0.105.3: fixes
ensureParentSignerEnrollmentroutingenrollFirstDevicewhen the caller is already connected directly to the target workspace (parent === workspace) — the local structural lookup can never find it (deliberately absent from public business OpenAPI), and the framework-route fallback was previously gated to skip exactly this case.
- Rebuild the bundled runner assets from @githolon/client 0.105.3: fixes
-
0.64.1806 Aug 2026Release notes
Open source →- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
-
0.64.1705 Aug 2026Release notes
Open source →- Rebuild the bundled runner assets from @githolon/client 0.104.0 (the evolve-on-read release). Published pub.dev archives are immutable, so regenerated runtime bytes need their own version.
-
0.64.1605 Aug 2026Release notes
Open source →- Rebundle the runner runtime (
node-entry.mjs,offline-install.mjs) generated from@githolon/client0.103.19, which carries the evolve-gate fix:promoteDomaindispositions are read from the law that DECLARES the call, so a law upgrade with a genuine field/aggregate removal is promotable through the offer lane.
- Rebundle the runner runtime (
-
0.64.1505 Aug 2026Release notes
Open source →DomainClientModelAdoptionRequired.acceptgains an optionaldispositionsparameter, threaded through to the bridge'snomosFrameworkAdoptGeneratedModel— a tenant can now acknowledge a genuine field/aggregate removal ({"retired": [sid, ...]}) from a generated client'smodel.adopt()decision instead of only via a raw adapter script.
-
0.64.1404 Aug 2026Release notes
Open source →- Resolve framework-private first-device offers through the application law's concrete home route, and distinguish a merely installed model from the model currently serving generated application writes.
-
0.64.1303 Aug 2026Release notes
Open source →- Preserve cross-replica foreign-read identity with the canonical USDA state root while treating the Git commit as a replica-local custody hint; the shared kernel resolves and rederives the resident source state.
-
0.64.1203 Aug 2026Release notes
Open source →- Preserve a clean resident unborn workspace across successive offers so framework genesis remains colocated until its first durable push; only an actual failed restore is discarded for a dependency-ready retry.
-
0.64.1002 Aug 2026Release notes
Open source →- Single-flight each generated child open on the process-wide kernel plane, reuse resident sibling custody for foreign reads, and restore every generated child from framework-owned local custody before consulting cloud transport. Typed kernel refusals and the offer gate remain the only authority path.
-
0.64.802 Aug 2026Release notes
Open source →- Deduplicate structurally identical workspace and application status snapshots while still seeding every new listener, preventing periodic metrics refreshes from rebuilding otherwise unchanged applications.
-
0.64.702 Aug 2026Release notes
Open source →- Bound generated application startup and referenced-workspace opens, preserving typed custody failures and retryable custody while keeping law adoption inside the generated lifecycle.
- Preserve compound action output contracts through generated clients.
-
0.64.602 Aug 2026Release notes
Open source →- Publish the complete generated-application runtime already present in the coordinated source release, including typed operation receipts, model changes, custody actions and staged-model handling.
- Refuse to treat an occupied pub.dev version as released unless its runtime library and package metadata byte-match the current checkout.
-
0.64.501 Aug 2026Release notes
Open source →- Consume
nomos_types 0.8.3so custody object identities remain typed through generated clients. - Dispatch generated reads through protobuf enum variants and preserve Nomos value kinds end to end, eliminating the generic JSON request envelope from the kernel boundary.
- Execute framework births, genesis and common read plans as typed USDA-native recipes while retaining tenant-authored JSON only as an explicit presentation edge.
- Consume
-
0.64.431 Jul 2026Release notes
Open source →- Require generated applications to seed explicit child-birth and workspace policies before first use; missing law remains a typed kernel refusal instead of a compiled allowance or creation fallback.
- Keep application startup single-flight and bounded through authentication, custody restore, law install and client binding so concurrent UI consumers share one lifecycle and one actionable result.
-
0.64.330 Jul 2026Release notes
Open source →- Single-flight generated child-workspace acquisition and continuous sync so concurrent references share one open, one lifecycle result and one error rather than cloning or registering the same workspace twice.
- Generate separate shared-workspace reads so applications can render denormalized owned-workspace cards without eagerly opening every founded child merely to discover genuinely shared lives.
-
0.64.230 Jul 2026Release notes
Open source →- Execute generated applications through the typed USDA-native kernel boundary, including native read recipes, sealed offer diagnostics and lawful self-serve birth retries after typed kernel refusals.
- Remove the legacy JSON deployment and bridge paths so tenant type errors continue to originate at the kernel boundary used in production.
-
0.64.123 Jul 2026Release notes
Open source →- Resolve a compiled OpenUSD application as one ordered package set in generated offline and connected scenarios, keeping reference-only control law off user replicas while payload law births their workspaces.
- Pin source and published test runs to the exact coordinated kernel release, and make restart, reconnect and clean reinstall use the same hidden multi-workspace custody lifecycle.
- Seat every business workspace founder on its private transport relation at genesis so public business records can coexist with framework-private identity state and still reopen on a fresh device.
-
0.64.022 Jul 2026Release notes
Open source →- Generate one self-documenting application object: intent-shaped business actions at the root, typed aggregate collections for reads and navigation, aggregate-specific conflict decisions, and verified activity. The generated application is the application state; raw runtime clients are private.
- Let one intent atomically create and ensure any number of aggregate consequences. Every created record and
reference-bearing query uses
NomosRef<T>; secondary ensures keep their aggregate identity through compilation and admission. - Generate restart-safe offline scenarios and ownership-aware proofs while keeping keys, certificates, signers, warrants, topology and retry machinery outside the tenant API.
- Mark the generator-only runtime library internal, so tenant imports receive an analyzer refusal while compiler-generated application code retains the sole intentional implementation bridge.
-
0.63.119 Jul 2026Release notes
Open source →- Make automatic sync a truthful client-owned lifecycle: local acceptance is durable, offline/restored sessions remain usable, reconnect converges parent before child, and failed/offline sync never reports a successful timestamp.
- Make home bootstrap and designated recovery resumable across interruption, exposing one typed next action while keeping identity proofs, signers, custody wrapping and retry state private.
- Expand the generated CO2 gauntlet through application, home, Estate, Site and Asset with two offline devices, process restart, conflict merge, automatic convergence and cold replay.
-
0.63.019 Jul 2026Release notes
Open source →- Generated clients now expose business-first conflict policy, schema-aware merge continuation and recursive organisation descriptions. The client privately owns lifecycle discovery, parent/child traversal, signer custody and replay; applications follow typed business references rather than framework routes.
-
0.62.217 Jul 2026Release notes
Open source →- Make
NomosTestHarnessown a complete, verifiable local trust lineage. Tests still bind a business actor and call the generated birth method; the harness privately mints its test root, seats the signer and delegation, lands the warrant in order, and refuses any child whose full chain does not replay to that root.
- Make
-
0.62.117 Jul 2026Release notes
Open source →- Align the public Dart documentation with the one Flutter application entry point: identity comes from the
token passed to
NomosScope.home(application:, authToken:); application code no longer supplies a subject or device-token callback.
- Align the public Dart documentation with the one Flutter application entry point: identity comes from the
token passed to
-
0.62.016 Jul 2026Release notes
Open source →- Generated business clients expose one
birth(payload)method. The bound session supplies its verified principal from the authentication token, and Nomos owns the identity, provenance, persistence, and recovery ceremony beneath the business call.
- Generated business clients expose one
-
0.61.316 Jul 2026Release notes
Open source →- cloudBound seeds the KEYLESS enroll-once delegation (mintKeylessDelegation) so a keyless private home is born with a well-formed cert chain (was: platform_cert in the delegation slot → self-refusal).
-
0.61.216 Jul 2026Release notes
Open source →- cloudBound works against PRIVATE platforms/homes (declared read caps — the co2 shape): the device ceremony uses a LOCAL scratch session (never clones the platform), and the born home mounts with the dev-IdP token when the caller passes none (a private ledger serves only a VERIFIED principal).
-
0.61.116 Jul 2026Release notes
Open source →- Runner entry resolution prefers the BUILT
@githolon/client/runner/node-entry.mjs(published consumers: node refuses type-stripping under node_modules, so the raw .ts entry only booted in-repo — DEFECT P3-002).
- Runner entry resolution prefers the BUILT
-
0.61.016 Jul 2026Release notes
Open source →- ERA-0 cloud-bound harness —
NomosTestHarness.cloudBoundnow runs the full WARRANTED onboarding ceremony against the test cloud: the platform is BORN warranted+attested at cloud boot (NomosTestCloud.start(platform:, deployJsonPath:)), the owner's device enrols through the REAL first-device lane (/dev/mint-token→enrollFirstDevice), andbirthHomeis device-signed + attested withownerKeyHash(the born home is SIGNER-READY — it births estates/catalogues offline from intent 0). Six named phases, all deadlined. NomosTestCloud.start(platform:, deployJsonPath:)— the dev cloud stands the platform up at boot (era-0: the host does not create workspaces; the harness's old POST-create refuses 409 by design)./healthgates onplatformReady: trueso clients never race the ceremony.acquireSession(…, authorSecret:)— sign a locally-born (warranted) child session's writes with its owner's device key;deviceSecret(workspace)/devicePublicKey(workspace)expose the harness device (the harness IS the device) for.births()payloadownerKeyHashderivation.- Requires
githolon/@githolon/client≥ the era-0 release (the client auto-signs self-serve birth certs on the kernel's typedbirth-unattestablerefusal — apps never hand-roll certs).
- ERA-0 cloud-bound harness —
-
0.60.015 Jul 2026Nothing published for this version
-
0.59.015 Jul 2026Nothing published for this version
-
0.58.014 Jul 2026Nothing published for this version
-
0.57.014 Jul 2026Nothing published for this version
-
0.56.014 Jul 2026Release notes
Open source →- NomosTestCloud (co2 #4) — a headless, cloud-BOUND real-sync test harness: start/stop a local
githolon cloud dev(the same engine plane production runs), an online/offline PARTITION proxy (setOnline) for deterministic link sever/heal, and remote head/commit inspection (remoteHead). Sessions connect cloud-bound tocloud.origin; sync/convergence uses the existingbridge.sync. - Typed snapshot lifecycle on NomosTestHarness (co2 #5) —
snapshotWorkspace/snapshotPlaneandrestoreWorkspace/restorePlaneover the per-workspaceexport()/connect(restoreFrom:)primitives, with typedWorkspaceSnapshot/PlaneSnapshot(JSON round-trip, session/workspace metadata). Migrate staged AppSim snapshots mechanically — no reaching into custody internals. assertCompatiblesurfaces a projection read failure (co2 #2) as a distinctprojectionReadFailedcause (carrying the failed query) instead of reclassifying an evicted/failed session astrulyNotDeployed.
- NomosTestCloud (co2 #4) — a headless, cloud-BOUND real-sync test harness: start/stop a local
-
0.55.213 Jul 2026Release notes
Open source →- Session-state DX (co2): explicit workspace lifecycle
stateonlistWorkspaces()—connected | resident | parked— so a listed-but-unopened workspace (e.g. a locally-born child) is distinguishable at a glance, ending the "listed butsession(ws)fails on first op" footgun. NomosRef.acquire(bridge)— open a born/resident ref directly:await outcome.bornRefs.single.acquire(bridge)(sugar overacquireSession, keyed by the ref's workspace).NomosSession.isConnected+assertConnected()— the fail-at-bind guard: a clear, actionableStateErrorinstead of an opaque "session is not connected" on the first read/write.- Patch bump — keeps the exact-minor
^0.55.0pins valid, no generated-client re-pin needed.
- Session-state DX (co2): explicit workspace lifecycle
-
0.55.113 Jul 2026Release notes
Open source →- Add
deriveWorkspaceName(namespace, key)— re-derive the workspace name a keyed birth (birth.keyed) produced, so a born workspace is addressable from its key with zero persistence (byte-identical to @githolon/dsl + @githolon/client; contract-tested vectors). Replaces hand-rolled<x>WorkspaceFor<Id>helpers. - Expose
bridge.issueDelegationCert({signerSecret, grantorId, relation, subject, epoch, certChain})— issue a role-delegation cert (the.delegatedRole()lane) from the public client; deliver viaacceptDelegatedRole. Runner bundle rebuilt.
- Add
-
0.55.012 Jul 2026Release notes
Open source →- Security: enrollSigner self-binds (device can only enroll itself; cross-principal forgery closed
by construction, offline-secure). Client lifecycle fixes from the adversarial sweep: watches
survive LRU park/remount (realm-owned rebind registry — no more silent watch death), DLQ recovery
never drops salvage on offline/unborn planes, a failed connect leaves no phantom session, evicted
handles throw typed
nomos.session.disposed, andquery()/queryById()throw on a read-forbidden verdict. Per-offerauthorSecretthreads to the signing path. Requires bundle >= 0.80.0.
- Security: enrollSigner self-binds (device can only enroll itself; cross-principal forgery closed
by construction, offline-secure). Client lifecycle fixes from the adversarial sweep: watches
survive LRU park/remount (realm-owned rebind registry — no more silent watch death), DLQ recovery
never drops salvage on offline/unborn planes, a failed connect leaves no phantom session, evicted
handles throw typed
-
0.54.212 Jul 2026Release notes
Open source →- Runner-bundle floor -> 0.79.0 (the fixed-group npm lift; 0.54.1 was published mid-release with the 0.78.1 floor — runtime-equivalent, this aligns the published package with the paired bundle exactly).
-
0.54.112 Jul 2026Release notes
Open source →- Fix: principal normalization mismatch in signer recovery — enrollment wrote
identity:user:<uid>#signer(the kernel-canonical captured principal) while the posture/preflight reads strippeduser:and reported falsemissing-signer-enrollmentimmediately after a successful repair. One canonical normalizer now routes every surface; co2's five-step acceptance (repair → immediate enrolled:true → canAuthor ok → birth admits) is the regression test, withuser:-shaped principals, proven failing-then-passing. Typed authz diagnosis now also rides thecreateWorkspacerelay (no more generic 422).
- Fix: principal normalization mismatch in signer recovery — enrollment wrote
-
0.54.012 Jul 2026Release notes
Open source →- Parent-signer recovery (the reborn-parent scar):
ensureParentSignerEnrollment(...)— idempotent verify-and-repair ofidentity:<uid>#signeron a configured parent (one relation read when healthy; lawful repair via the discovered signing directive — enrollSigner pre-warrant, the keyless enrollFirstDevice lane on a warranted parent);parentSignerEnrollment(...)posture read;devicePublicOf(secret). canAuthor(directiveId, ...)preflight — evaluates the gate's premises read-only and returns the typed verdict ({actor, keyHash, cause}) BEFORE the user fills a form;NomosSession.canAuthorTypedthrows the typed error.- Gate refusals classify into
nomos.authz.*typed errors (see nomos_types 0.4.0). Requires the paired runner bundle >= 0.78.0.
- Parent-signer recovery (the reborn-parent scar):
-
0.53.012 Jul 2026Release notes
Open source →- Stale-baked-bundle detection. The runner bundle stamps its release version into the
readyframe (build-time injected — it cannot lie); the bridge refuses an older or pre-stamp bundle at boot with the typedStaleRunnerBundlenaming found/expected and theflutter cleanremedy. Flutter silently keeping an old baked bundle across a pub upgrade is now a one-line error at app start instead of behavioral archaeology.allowStaleRunnerBundle: trueis the deliberate mixed-version escape hatch. Requires the paired runner bundle >= 0.77.1 (nomos_flutter 0.53.7).
- Stale-baked-bundle detection. The runner bundle stamps its release version into the
-
0.52.011 Jul 2026Release notes
Open source →- Offer ack decoupled from watch fan-out (co2's 2.08s 3×3-grid report): the durable acknowledgement (plan + gate + fold + git write) resolves before any watch fan-out runs; the post-write nudge — including the O(law-size) compat recompute that was the bulk of the unaccounted ~1.1s — is a coalesced macrotask after the ack. Ack latency is now watcher-count-independent (fixture: 346ms with 12 watchers → 71ms flat). Read-your-writes holds (projection updates at fold time, tested); ticks are never lost (coalescing + flush-on-dispose, tested).
- Full offer span taxonomy on
recentSpans/spanEventswith no new API:payload-encode,compat-preflight,bridge-ipc,gate-fold,watch-nudge,response-delivery(git-writeis not separable client-side — plan+gate+fold+write is ONE wasm call). Older runner bundles degrade cleanly (no bridge-leg spans). - Regression test for local-only sync observational inertness (offer → query → sync{localOnly} → head unchanged → same row).
-
0.51.011 Jul 2026Release notes
Open source →- The burn-down wave. Dead-letter queue surface on the session plane:
deadLetters(),retryDeadLetter(),discardDeadLetter(),salvage(),absorbSalvage()— with the local-only retry/absorb fixes and the salvage-shape parking fix (refused work is NEVER silently dropped).nomos_headless.dartexports the full session surface. Requires Nomos Cloud ≥ the 2026-07-11 burn-down deploy for the fleet DLQ sweep lanes (/dlq-summary,/dlq-sweep) and the content-addressed large-deploy staging lane.
- The burn-down wave. Dead-letter queue surface on the session plane:
-
0.50.111 Jul 2026Release notes
Open source →- Structural: the session-delegation-gap class is closed. All event-dispatch registries
(watch subscriptions, compat watches, custody/sync/signal/flame/span/transfer/status
controllers, span buffers, session registries) now route through one
_eventPlaneseam that resolves to the plane owning the message loop — the base class is correct forNomosSessionautomatically, and all 17 hand-written per-method session overrides are DELETED (including the 0.48.1watchPendingConflictsfix, whose regression test still passes — the proof). Five latent unreported instances of the same bug fixed en passant:session.custodyEvents(dead stream),connectedSessions(empty),connect()-on-session state stamping,checkCompat()caching,noteLocalSpan()(dead buffer). A source-level tripwire test fails the suite if a future Stream-returning method bypasses the seam. - The first-five-minutes gauntlet — one checklist test walking the entire promised surface (deviceKeyed cluster + phase diagnostics, the blessed session-bound shape, local autoSync posture with zero-fetch assertion, acquireSession single-flight, reactive first-snapshots, attested keyed reads, custody reset/re-seed, deadline-bounded disposal) — now runs in CI on every client/runner/codegen change. Every one of this week's four tenant-reported lifecycle bugs appears as an explicit leg.
- Structural: the session-delegation-gap class is closed. All event-dispatch registries
(watch subscriptions, compat watches, custody/sync/signal/flame/span/transfer/status
controllers, span buffers, session registries) now route through one