githolon 0.100.2 → 0.100.4

package/dist/cli.mjs

@@ -3098,6 +3098,7 @@ __export(governance_exports, {
   certifyEra: () => certifyEra,
   consentRebirth: () => consentRebirth,
   discoverSigningDomain: () => discoverSigningDomain,
+  ensureApplicationWorkspace: () => ensureApplicationWorkspace,
   ensureSovereignHome: () => ensureSovereignHome,
   exchangeOnboardingToken: () => exchangeOnboardingToken,
   executeRepairRebirth: () => executeRepairRebirth,
@@ -3120,6 +3121,7 @@ __export(governance_exports, {
   renderRebirthImpact: () => renderRebirthImpact,
   resolveGovernanceHash: () => resolveGovernanceHash,
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
+  signAndPostChildLifecycle: () => signAndPostChildLifecycle,
   signAndPostGovernance: () => signAndPostGovernance,
   signAndPostOffer: () => signAndPostOffer,
   signAndPostWorkspaceBirth: () => signAndPostWorkspaceBirth,
@@ -3276,6 +3278,20 @@ async function exchangeOnboardingToken(session, keyHash, idp = process.env["NOMO
   }
   return { token: body.token, issuer: body.issuer, subject: body.subject };
 }
+async function workspaceMainHead(cloud, workspace) {
+  return fetch(
+    `${cloud}/v2/workspaces/${encodeURIComponent(workspace)}/git/info/refs?service=git-upload-pack`
+  ).then(async (r) => r.ok ? /([0-9a-f]{40}) refs\/heads\/main\b/.exec(await r.text())?.[1] : void 0).catch(() => void 0);
+}
+async function waitForWorkspaceMain(cloud, workspace, timeoutMs = 3e4) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const head = await workspaceMainHead(cloud, workspace);
+    if (head !== void 0) return head;
+    await new Promise((resolve6) => setTimeout(resolve6, 250));
+  }
+  return void 0;
+}
 async function ensureSovereignHome(opts = {}) {
   const cloud = cloudBase(opts.cloud);
   const uid = opts.principal ?? currentPrincipal();
@@ -3420,6 +3436,123 @@ async function ensureSovereignHome(opts = {}) {
   }
   return { home, principal: actor, device, created: !exists };
 }
+async function ensureApplicationWorkspace(application, opts = {}) {
+  const cloud = cloudBase(opts.cloud);
+  const statusUrl = `${cloud}/v2/workspaces/${encodeURIComponent(application)}`;
+  const current = await fetch(statusUrl).catch(() => null);
+  if (current?.ok) {
+    const status2 = await current.json().catch(() => null);
+    const principal = String(status2?.lineage?.principal ?? "");
+    const session = canonicalPrincipal(currentPrincipal() ?? "");
+    if (await waitForWorkspaceMain(cloud, application) === void 0) {
+      throw new Error(`application '${application}' is born but canonical ledger main did not become readable`);
+    }
+    return {
+      application,
+      parent: String(status2?.lineage?.parent ?? ""),
+      principal,
+      created: false,
+      ...principal !== "" && session !== "" && sameIdentity(principal, session) ? { deployPrincipal: principal } : {}
+    };
+  }
+  if (current !== null && current.status !== 404 && current.status !== 409) {
+    throw new Error(`could not inspect deploy target '${application}' (${current.status}); refusing to guess that it is unborn`);
+  }
+  const home = await ensureSovereignHome(opts);
+  if (application === home.home) {
+    return {
+      application,
+      parent: "root",
+      principal: home.principal,
+      created: home.created,
+      deployPrincipal: home.principal
+    };
+  }
+  if (await fetch(statusUrl).then((r) => r.ok).catch(() => false)) {
+    if (await waitForWorkspaceMain(cloud, application) === void 0) {
+      throw new Error(`application '${application}' is born but canonical ledger main did not become readable`);
+    }
+    return {
+      application,
+      parent: home.home,
+      principal: home.principal,
+      created: false,
+      deployPrincipal: home.principal
+    };
+  }
+  const domains = await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home.home)}/domains`).then(async (r) => {
+    if (!r.ok) throw new Error(`application parent law discovery failed (${r.status})`);
+    return await r.json();
+  });
+  const frameworkHash = domains.currentLaw?.["nomos"];
+  const lawHash = domains.currentLaw?.["workspaces"];
+  if (!frameworkHash || !lawHash) {
+    throw new Error(`the signed session home does not carry the framework law needed to birth '${application}'`);
+  }
+  const parent = await connectGovernance(cloud, home.home);
+  const birthCert = await parent.certSign({
+    child: application,
+    founder: home.principal,
+    verified: true,
+    parentKey: home.device.public,
+    parentId: home.home,
+    epoch: 0,
+    secret: home.device.secret
+  });
+  const bare = lineageIdentity(home.principal);
+  const now = Date.now();
+  const birth = await fetch(
+    `${cloud}/v2/workspaces/${encodeURIComponent(home.home)}/workspaces/birthChild`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        name: application,
+        parent: home.home,
+        principal: bare,
+        tier: "edge",
+        requestedBy: bare,
+        requestedAt: now,
+        foundingAdminHash: home.device.keyHash,
+        bornAt: new Date(now).toISOString(),
+        frameworkHash,
+        lawHash,
+        platformCert: JSON.stringify(birthCert),
+        actor: home.principal,
+        authorSecret: home.device.secret
+      })
+    }
+  );
+  const body = await birth.json().catch(() => null);
+  const failed = body?.birthOutcomes?.find((outcome) => outcome.status !== "born");
+  if (!birth.ok || body?.ok === false || failed) {
+    if (!await fetch(statusUrl).then((r) => r.ok).catch(() => false)) {
+      throw new Error(
+        `Nomos could not create application '${application}' (${birth.status}): ${failed?.reason ?? String(body?.error ?? JSON.stringify(body))}`
+      );
+    }
+  }
+  if (await waitForWorkspaceMain(cloud, application) === void 0) {
+    throw new Error(`Nomos admitted application '${application}' but canonical ledger main did not become readable`);
+  }
+  const admin = await signAndPostOffer(
+    application,
+    "workspaces",
+    "grantAdmin",
+    { principal: bare, label: "application founder", grantedBy: bare, grantedAt: now },
+    { ...opts, principal: bare }
+  );
+  if (!admin.ok) {
+    throw new Error(`application '${application}' refused its founding admin (${admin.status}): ${JSON.stringify(admin.body)}`);
+  }
+  return {
+    application,
+    parent: home.home,
+    principal: home.principal,
+    created: true,
+    deployPrincipal: home.principal
+  };
+}
 async function signAndPostWorkspaceRetirement(parent, workspaceId, creator, opts) {
   return signAndPostPreparedOffer(
     parent,
@@ -3433,6 +3566,22 @@ async function signAndPostWorkspaceRetirement(parent, workspaceId, creator, opts
     creator
   );
 }
+async function signAndPostChildLifecycle(parent, child, creator, action, opts) {
+  return signAndPostPreparedOffer(
+    parent,
+    void 0,
+    (actor) => action === "retire" ? {
+      directiveId: "retireChild",
+      payload: { child, principal: creator, retiredBy: lineageIdentity(actor), retiredAt: Date.now() }
+    } : {
+      directiveId: "reclaimChild",
+      payload: { child, reclaimedBy: lineageIdentity(actor), reclaimedAt: Date.now() }
+    },
+    opts,
+    "self-if-unenrolled",
+    creator
+  );
+}
 async function relaySealedOfferViaStage(cloud, ws, directiveId, intentBytesB64, fetchImpl) {
   const raw = Buffer.from(intentBytesB64, "base64");
   const sha2562 = createHash("sha256").update(raw).digest("hex");
@@ -5471,9 +5620,19 @@ async function wsStatus(name, opts) {
   out4(text);
   return 0;
 }
+async function childBirthRecord(cloud, parent, child) {
+  try {
+    const id = `nomos-birth-record:${child}`;
+    const r = await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(parent)}/aggregates/${encodeURIComponent(id)}`);
+    const body = await r.json().catch(() => void 0);
+    return body?.ok === true ? body.rows?.find((row) => row.data?.child === child) : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function wsRetire(ws, opts) {
   const cloud = cloudBase(opts.cloud);
-  const { signAndPostWorkspaceRetirement: signAndPostWorkspaceRetirement2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  const { signAndPostChildLifecycle: signAndPostChildLifecycle2, signAndPostWorkspaceRetirement: signAndPostWorkspaceRetirement2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
   const parent = opts.parent ?? "root";
   let record;
   try {
@@ -5485,12 +5644,29 @@ async function wsRetire(ws, opts) {
   }
   const recordId = record?.id;
   if (recordId === void 0) {
-    err4(
-      `retire '${ws}': no CloudWorkspace record named '${ws}' in ${parent}'s registry \u2014 nothing lawful to retire.
-  (a workspace born via the OPEN lane \u2014 bare POST /v2/workspaces/${ws} \u2014 has no registry row;
-   registered births ride \`githolon ws create ${ws} --via ${parent}\`. An unregistered leak needs a custodian sweep.)`
-    );
-    return 1;
+    const childRecord = await childBirthRecord(cloud, parent, ws);
+    if (childRecord === void 0) {
+      err4(
+        `retire '${ws}': no CloudWorkspace or NomosBirthRecord named '${ws}' in ${parent}'s registry \u2014 nothing lawful to retire.
+  An out-of-band custody repo has no parent lifecycle fact and needs a custodian investigation.`
+      );
+      return 1;
+    }
+    const creator = childRecord.data?.principal ?? "";
+    let childVerdict;
+    try {
+      childVerdict = await signAndPostChildLifecycle2(parent, ws, creator, "retire", opts);
+    } catch (e) {
+      err4(e.message);
+      return 1;
+    }
+    if (!childVerdict.ok) {
+      err4(`retire '${ws}' refused (${childVerdict.status}): ${typeof childVerdict.body === "string" ? childVerdict.body : JSON.stringify(childVerdict.body)}`);
+      return 1;
+    }
+    out4(`\u2713 child ${ws} retired via signed lifecycle offer to ${parent} on ${cloud}`);
+    out4("  custody is retained; reclaim is a separate, law-gated terminal step");
+    return 0;
   }
   let v;
   try {
@@ -5519,17 +5695,30 @@ async function wsRetire(ws, opts) {
 }
 async function wsReclaim(ws, opts) {
   const cloud = cloudBase(opts.cloud);
-  const { signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+  const { signAndPostChildLifecycle: signAndPostChildLifecycle2, signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
   const parent = opts.parent ?? "root";
   let v;
   try {
     const principal = resolveGovernancePrincipal2(opts);
-    v = await signAndPostGovernance2(
-      parent,
-      "reclaimWorkspace",
-      { workspaceId: ws, reclaimedBy: principal, reclaimedAt: Date.now() },
-      opts
-    );
+    const q = await fetch(`${cloud}/v2/workspaces/${parent}/workspaceByName?name=${encodeURIComponent(ws)}`);
+    const qd = await q.json().catch(() => void 0);
+    const rows = qd?.ok === true ? qd.rows ?? [] : [];
+    const workspace = rows.find((r) => r.data?.status === "retired") ?? rows[0];
+    if (workspace?.id !== void 0) {
+      v = await signAndPostGovernance2(
+        parent,
+        "reclaimWorkspace",
+        { workspaceId: workspace.id, reclaimedBy: principal, reclaimedAt: Date.now() },
+        opts
+      );
+    } else {
+      const child = await childBirthRecord(cloud, parent, ws);
+      if (child === void 0) {
+        err4(`reclaim '${ws}': no CloudWorkspace or NomosBirthRecord named '${ws}' in ${parent}'s registry`);
+        return 1;
+      }
+      v = await signAndPostChildLifecycle2(parent, ws, child.data?.principal ?? "", "reclaim", opts);
+    }
   } catch (e) {
     err4(e.message);
     return 1;
@@ -5538,7 +5727,7 @@ async function wsReclaim(ws, opts) {
     err4(`reclaim '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
     return 1;
   }
-  out4(`\u2713 workspace ${ws} reclaimed via signed governance offer to ${parent} on ${cloud}`);
+  out4(`\u2713 workspace ${ws} reclaimed via signed lifecycle offer to ${parent} on ${cloud}`);
   out4("  the custodian drops the ledger bytes on seeing this fact folded; the reclaimed FACT is append-only");
   return 0;
 }
@@ -5570,6 +5759,22 @@ async function deploy2(ws, opts) {
     return 1;
   }
   const fileName = file.split("/").pop();
+  try {
+    const { ensureApplicationWorkspace: ensureApplicationWorkspace2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    const prepared = await ensureApplicationWorkspace2(ws, opts);
+    if (prepared.deployPrincipal !== void 0 && opts.principal === void 0) {
+      opts = {
+        ...opts,
+        principal: prepared.deployPrincipal.startsWith("user:") ? prepared.deployPrincipal.slice("user:".length) : prepared.deployPrincipal
+      };
+    }
+    if (prepared.created) {
+      out4(`  created application ${ws} under your Nomos home`);
+    }
+  } catch (e) {
+    err4(`deploy '${ws}' could not prepare the application: ${e.message}`);
+    return 1;
+  }
   const beforeLaw = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd : {}).catch(() => ({}));
   const before = beforeLaw.domains ?? [];
   const currentLaw2 = beforeLaw.currentLaw ?? {};

package/dist/dev-server.mjs

@@ -1846,32 +1846,42 @@ function aliasIdsFor(x, path2) {
   return new Set(ids);
 }
 function resolveGatewayOperation(spec, opName, method) {
-  if (!spec || !spec.paths || !opName || !method) return { op: null };
+  if (!spec || !opName || !method) return { op: null };
+  const routeTables = [
+    spec.paths ?? {},
+    spec["x-nomos-framework-routes"]?.paths ?? {}
+  ];
   const normalizedMethod = String(method).toLowerCase();
   const exactPath = `/${String(opName).replace(/^\/+/, "")}`;
-  const exact = spec.paths[exactPath]?.[normalizedMethod];
-  if (exact) return { op: exact, path: exactPath, ambiguous: null };
+  for (const paths of routeTables) {
+    const exact = paths[exactPath]?.[normalizedMethod];
+    if (exact) return { op: exact, path: exactPath, ambiguous: null };
+  }
   const slash = String(opName).indexOf("/");
   if (slash > 0) {
     const requestedDomain = String(opName).slice(0, slash);
     const requestedAlias = String(opName).slice(slash + 1);
     const matches2 = [];
-    for (const [path2, methods] of Object.entries(spec.paths)) {
-      const op = methods?.[normalizedMethod];
-      const x = op?.["x-nomos"];
-      if (!op || !x || x.domain !== requestedDomain) continue;
-      if (aliasIdsFor(x, path2).has(requestedAlias)) matches2.push({ op, path: path2 });
+    for (const paths of routeTables) {
+      for (const [path2, methods] of Object.entries(paths)) {
+        const op = methods?.[normalizedMethod];
+        const x = op?.["x-nomos"];
+        if (!op || !x || x.domain !== requestedDomain) continue;
+        if (aliasIdsFor(x, path2).has(requestedAlias)) matches2.push({ op, path: path2 });
+      }
     }
     if (matches2.length === 1) return { ...matches2[0], ambiguous: null };
     if (matches2.length > 1) return { op: null, ambiguous: matches2.map((m) => m.path).sort() };
     return { op: null, ambiguous: null };
   }
   const matches = [];
-  for (const [path2, methods] of Object.entries(spec.paths)) {
-    const op = methods?.[normalizedMethod];
-    const x = op?.["x-nomos"];
-    if (!op || !x) continue;
-    if (aliasIdsFor(x, path2).has(opName)) matches.push({ op, path: path2 });
+  for (const paths of routeTables) {
+    for (const [path2, methods] of Object.entries(paths)) {
+      const op = methods?.[normalizedMethod];
+      const x = op?.["x-nomos"];
+      if (!op || !x) continue;
+      if (aliasIdsFor(x, path2).has(opName)) matches.push({ op, path: path2 });
+    }
   }
   if (matches.length === 1) return { ...matches[0], ambiguous: null };
   if (matches.length > 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.100.2",
+  "version": "0.100.4",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.100.2",
-    "@githolon/dsl": "^0.100.2",
+    "@githolon/client": "^0.100.4",
+    "@githolon/dsl": "^0.100.4",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {