@githolon/testing 0.5.1 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -1190,7 +1190,7 @@ export function author(eng, ws, domain, directiveId, payload, controllerHash, op
   // (`warmEngine`, which every host already calls) flushes it eagerly. Pass
   // `opts.deferProjection: false` to keep the pre-#47 synchronous refresh.
   const defer = opts.deferProjection !== false;
-  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...(defer ? { deferProjection: true } : {}) }, eng.STDERR));
+  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...(defer ? { deferProjection: true } : {}) }, eng.STDERR));
   if (defer && res.ok) (eng.pendingProjection ??= new Set()).add(ws);
   return res;
 }
@@ -1208,6 +1208,25 @@ export function flushDeferredProjections(eng) {
   if (eng.pendingProjection) eng.pendingProjection.clear();
 }
 
+// ── PROJECTION CHECKPOINT (the cold-fold fix) ──────────────────────────────────────────────
+// A `:memory:` projection is rebuilt cold on every mount → a long-chain workspace (root, every
+// workspace's governance hub) re-folds genesis→tip = O(chain) (14s at 1105 commits, and it OOMs
+// the DO under load). The checkpoint persists the folded projection (cursor + every table) so a
+// cold mount RESTORES it and the first read folds only tip−cursor (O(delta)).
+
+/** Export `ws`'s projection-at-head to a base64 blob the HOST persists. Returns
+ *  `{cursor, blob, bytes}` (or `{empty:true}` for an unborn branch). */
+export function exportCheckpoint(eng, ws) {
+  return JSON.parse(call(eng.ex, "checkpoint_export", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+}
+
+/** Restore a checkpoint blob into the pool BEFORE the first read on a cold mount (no-op if the pool
+ *  is already warm). The HOST restores ONLY a blob whose stored lawHash matches the workspace's
+ *  CURRENT law (schema parity); a mismatched/absent blob costs at most a cold fold, never a wrong read. */
+export function importCheckpoint(eng, ws, blobB64) {
+  return JSON.parse(call(eng.ex, "checkpoint_import", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH, blob: blobB64 }, eng.STDERR));
+}
+
 // DURABILITY-BEFORE-ACK: only acked once the write LANDED in the ledger; a failed push
 // unmounts (drops local state) so the next access re-restores from custody.
 export async function commitAndPush(eng, ws, ledger) {
@@ -1219,14 +1238,40 @@ export async function commitAndPush(eng, ws, ledger) {
   }
 }
 
-export const qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
-export const query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
+// READ VISIBILITY (slice 5.1): the host STAMPS the presented `principal` onto the
+// read RPC (an impure identity read — never a host DECISION); the githolon gates the
+// read against its OWN folded role-bindings and returns `{ok:false, error:"read-
+// forbidden:..."}` for a private type the principal may not read. Absent/"" principal
+// is the pre-5.1 wire — public reads are byte-identical.
+// `keys` (slice 6) = the reader's injected scope keys [{scope, epoch, key(b64)}], resolved
+// host-side (X25519 unwrap). Threaded into the read RPC; the wasm AEAD-opens envelope fields.
+export const qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
+export const query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+// THE AUTHOR-SIDE SEAL (slice 6): encrypt a plaintext field value into the on-chain envelope
+// (XChaCha isn't in WebCrypto, so the client calls the wasm; the scope key is injected, never on chain).
+// The SLOT IDENTITY is the #58 STABLE SID (rename-safety): the caller resolves (type,field)→sid
+// from the law's nomosStableIds and passes aggSid/fieldSid; they ride IN the envelope so a rename
+// of the encrypted type/field never breaks decryption, and the gate proves they are the law's.
+export const cryptoSealField = (eng, { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }) =>
+  JSON.parse(call(eng.ex, "crypto_seal_field", { scopeKey, scope, epoch, aggSid, fieldSid, plaintext }, eng.STDERR)).envelope;
+// The client X25519 crypto (slice 6): keygen (device identity), wrap (committer → recipient pubkey),
+// unwrap (reader's device secret → scope key). The secret stays client/host-side, never on chain.
+export const cryptoKeygen = (eng) => JSON.parse(call(eng.ex, "crypto_keygen", {}, eng.STDERR));
+export const cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "crypto_wrap_key", { recipientPub, scopeKey }, eng.STDERR));
+export const cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
+// THE READ-POSTURE PROBE (slice 5.1): the githolon's own verdict on whether the
+// workspace is private + whether `principal` may read ALL of it — the host relays it
+// to gate the BULK reads (snapshot, git clone, count/sum) it cannot gate per-row-type.
+export const readPosture = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "read_posture", { repoArg: repoArgOf(ws), workspace: ws, principal, branch: BRANCH }, eng.STDERR));
 export const count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
 export const sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
 /** The maintained O(1) min/max read (#47 — the slice-4 extremum hand-back made an RPC).
  *  `kind` = "min"|"max"; an absent group answers `value: null` (never a fabricated 0). */
 export const extremum = (eng, ws, extremumId, kind, groupKey) => JSON.parse(call(eng.ex, "extremum", { repoArg: repoArgOf(ws), workspace: ws, extremumId, kind, groupKey: groupKey ?? "", branch: BRANCH }, eng.STDERR));
 export const nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
+// E2E crypto linkage probe (the encryption arc): run the wrap→unwrap + field seal→open
+// INSIDE the deployable wasm. Pure — no workspace, no chain. Returns {wrapHandoff, fieldAead}.
+export const cryptoSelftest = (eng) => JSON.parse(call(eng.ex, "crypto_selftest", { repoArg: "/work/none" }, eng.STDERR));
 
 /** Re-admit ONE carried intent (bytes) on local main — the DLQ-retry primitive. */
 export function applyIntentBytes(eng, ws, bytes) {