@githolon/testing 0.16.2 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.16.2",
+  "version": "0.17.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -1368,7 +1368,8 @@ export function evolveDryRun(eng, ws, usda, domainHash, dispositions = null) {
  * and the generated clients call. The minted id rides IN the payload, so replay
  * reads the captured id and never re-mints (determinism via capture). */
 export function mintId(eng, typeTag) {
-  return JSON.parse(call(eng.ex, "mint", { typeTag, nowMillis: Date.now() }, eng.STDERR)).id;
+  // P8: id reservation rides the ONE opaque `query` verb (op:"mint") — no legacy top-level mint arm.
+  return JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "mint", typeTag, nowMillis: Date.now() }) }, eng.STDERR)).id;
 }
 
 export function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
@@ -1763,24 +1764,25 @@ export const expand = (eng, ws, object, relation) => JSON.parse(call(eng.ex, "qu
 // from the law's nomosStableIds and passes aggSid/fieldSid; they ride IN the envelope so a rename
 // of the encrypted type/field never breaks decryption, and the gate proves they are the law's.
 export const cryptoSealField = (eng, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) =>
-  JSON.parse(call(eng.ex, "crypto_seal_field", { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }, eng.STDERR)).envelope;
+  JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoSealField", scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) }, eng.STDERR)).envelope;
 // The client X25519 crypto (slice 6): keygen (device identity), wrap (committer → recipient pubkey),
 // unwrap (reader's device secret → scope key). The secret stays client/adapter-side, never on chain.
-export const cryptoKeygen = (eng) => JSON.parse(call(eng.ex, "crypto_keygen", {}, eng.STDERR));
+// P8: all ride the ONE opaque `query` verb (non-effectful producers) — no legacy top-level crypto arms.
+export const cryptoKeygen = (eng) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoKeygen" }) }, eng.STDERR));
 
 // AUTHOR DEVICE KEY (warrant-flip, identity_keys.md) — mint an ed25519 signing keypair IN the holon
 // (`author_keygen`); the secret stays client-side (here: the test/adapter injects it back as `authorSecret`
 // on the author call). Returns { ok, secret, public } (both base64). `author_sign` is the lower-level
 // standalone signer; the author DOOR signs internally from the injected secret, so callers use `author`.
-export const authorKeygen = (eng) => JSON.parse(call(eng.ex, "author_keygen", {}, eng.STDERR));
+export const authorKeygen = (eng) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "authorKeygen" }) }, eng.STDERR));
 // THE CROSS-CUSTODY ATTESTATION SIGNER (home_holons §3/§5) — the asserter's client produces a SIGNED QUOTE
 // over the edge it is sharing (`attestation_sign`; the bytes are derived IN-wasm — the `author_sign` parity
 // contract). The device `secret` (base64) is injected for THIS call only. Returns { ok, signature, publicKey }
 // (base64) — the parts a `recordShare` payload carries; the subject's home gate verifies them (§3 gate-arm).
 export const attestationSign = (eng, { secret, asserterWorkspace, object, relation, subject, attestedAt }) =>
-  JSON.parse(call(eng.ex, "attestation_sign", { secret, asserterWorkspace, object, relation, subject, attestedAt }, eng.STDERR));
-export const cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "crypto_wrap_key", { recipientPub, scopeKey }, eng.STDERR));
-export const cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
+  JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "attestationSign", secret, asserterWorkspace, object, relation, subject, attestedAt }) }, eng.STDERR));
+export const cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoWrapKey", recipientPub, scopeKey }) }, eng.STDERR));
+export const cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng.STDERR)).scopeKey;
 // THE READ-POSTURE PROBE (slice 5.1): the githolon's own verdict on whether the
 // workspace is private + whether `principal` may read ALL of it — the adapter relays it
 // to gate the WHOLE-LEDGER reads (snapshot, git clone) it cannot serve partially.