@githolon/testing 0.5.1 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -1219,14 +1219,40 @@ export async function commitAndPush(eng, ws, ledger) {
   }
 }
 
-export const qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
-export const query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
+// READ VISIBILITY (slice 5.1): the host STAMPS the presented `principal` onto the
+// read RPC (an impure identity read — never a host DECISION); the githolon gates the
+// read against its OWN folded role-bindings and returns `{ok:false, error:"read-
+// forbidden:..."}` for a private type the principal may not read. Absent/"" principal
+// is the pre-5.1 wire — public reads are byte-identical.
+// `keys` (slice 6) = the reader's injected scope keys [{scope, epoch, key(b64)}], resolved
+// host-side (X25519 unwrap). Threaded into the read RPC; the wasm AEAD-opens envelope fields.
+export const qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
+export const query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+// THE AUTHOR-SIDE SEAL (slice 6): encrypt a plaintext field value into the on-chain envelope
+// (XChaCha isn't in WebCrypto, so the client calls the wasm; the scope key is injected, never on chain).
+// The SLOT IDENTITY is the #58 STABLE SID (rename-safety): the caller resolves (type,field)→sid
+// from the law's nomosStableIds and passes aggSid/fieldSid; they ride IN the envelope so a rename
+// of the encrypted type/field never breaks decryption, and the gate proves they are the law's.
+export const cryptoSealField = (eng, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) =>
+  JSON.parse(call(eng.ex, "crypto_seal_field", { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }, eng.STDERR)).envelope;
+// The client X25519 crypto (slice 6): keygen (device identity), wrap (committer → recipient pubkey),
+// unwrap (reader's device secret → scope key). The secret stays client/host-side, never on chain.
+export const cryptoKeygen = (eng) => JSON.parse(call(eng.ex, "crypto_keygen", {}, eng.STDERR));
+export const cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "crypto_wrap_key", { recipientPub, scopeKey }, eng.STDERR));
+export const cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
+// THE READ-POSTURE PROBE (slice 5.1): the githolon's own verdict on whether the
+// workspace is private + whether `principal` may read ALL of it — the host relays it
+// to gate the BULK reads (snapshot, git clone, count/sum) it cannot gate per-row-type.
+export const readPosture = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "read_posture", { repoArg: repoArgOf(ws), workspace: ws, principal, branch: BRANCH }, eng.STDERR));
 export const count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
 export const sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
 /** The maintained O(1) min/max read (#47 — the slice-4 extremum hand-back made an RPC).
  *  `kind` = "min"|"max"; an absent group answers `value: null` (never a fabricated 0). */
 export const extremum = (eng, ws, extremumId, kind, groupKey) => JSON.parse(call(eng.ex, "extremum", { repoArg: repoArgOf(ws), workspace: ws, extremumId, kind, groupKey: groupKey ?? "", branch: BRANCH }, eng.STDERR));
 export const nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
+// E2E crypto linkage probe (the encryption arc): run the wrap→unwrap + field seal→open
+// INSIDE the deployable wasm. Pure — no workspace, no chain. Returns {wrapHandoff, fieldAead}.
+export const cryptoSelftest = (eng) => JSON.parse(call(eng.ex, "crypto_selftest", { repoArg: "/work/none" }, eng.STDERR));
 
 /** Re-admit ONE carried intent (bytes) on local main — the DLQ-retry primitive. */
 export function applyIntentBytes(eng, ws, bytes) {