githolon 0.100.3 → 0.100.5

package/dist/cli.mjs

@@ -3098,6 +3098,7 @@ __export(governance_exports, {
   certifyEra: () => certifyEra,
   consentRebirth: () => consentRebirth,
   discoverSigningDomain: () => discoverSigningDomain,
+  ensureApplicationWorkspace: () => ensureApplicationWorkspace,
   ensureSovereignHome: () => ensureSovereignHome,
   exchangeOnboardingToken: () => exchangeOnboardingToken,
   executeRepairRebirth: () => executeRepairRebirth,
@@ -3277,6 +3278,20 @@ async function exchangeOnboardingToken(session, keyHash, idp = process.env["NOMO
   }
   return { token: body.token, issuer: body.issuer, subject: body.subject };
 }
+async function workspaceMainHead(cloud, workspace) {
+  return fetch(
+    `${cloud}/v2/workspaces/${encodeURIComponent(workspace)}/git/info/refs?service=git-upload-pack`
+  ).then(async (r) => r.ok ? /([0-9a-f]{40}) refs\/heads\/main\b/.exec(await r.text())?.[1] : void 0).catch(() => void 0);
+}
+async function waitForWorkspaceMain(cloud, workspace, timeoutMs = 3e4) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const head = await workspaceMainHead(cloud, workspace);
+    if (head !== void 0) return head;
+    await new Promise((resolve6) => setTimeout(resolve6, 250));
+  }
+  return void 0;
+}
 async function ensureSovereignHome(opts = {}) {
   const cloud = cloudBase(opts.cloud);
   const uid = opts.principal ?? currentPrincipal();
@@ -3421,6 +3436,123 @@ async function ensureSovereignHome(opts = {}) {
   }
   return { home, principal: actor, device, created: !exists };
 }
+async function ensureApplicationWorkspace(application, opts = {}) {
+  const cloud = cloudBase(opts.cloud);
+  const statusUrl = `${cloud}/v2/workspaces/${encodeURIComponent(application)}`;
+  const current = await fetch(statusUrl).catch(() => null);
+  if (current?.ok) {
+    const status2 = await current.json().catch(() => null);
+    const principal = String(status2?.lineage?.principal ?? "");
+    const session = canonicalPrincipal(currentPrincipal() ?? "");
+    if (await waitForWorkspaceMain(cloud, application) === void 0) {
+      throw new Error(`application '${application}' is born but canonical ledger main did not become readable`);
+    }
+    return {
+      application,
+      parent: String(status2?.lineage?.parent ?? ""),
+      principal,
+      created: false,
+      ...principal !== "" && session !== "" && sameIdentity(principal, session) ? { deployPrincipal: principal } : {}
+    };
+  }
+  if (current !== null && current.status !== 404 && current.status !== 409) {
+    throw new Error(`could not inspect deploy target '${application}' (${current.status}); refusing to guess that it is unborn`);
+  }
+  const home = await ensureSovereignHome(opts);
+  if (application === home.home) {
+    return {
+      application,
+      parent: "root",
+      principal: home.principal,
+      created: home.created,
+      deployPrincipal: home.principal
+    };
+  }
+  if (await fetch(statusUrl).then((r) => r.ok).catch(() => false)) {
+    if (await waitForWorkspaceMain(cloud, application) === void 0) {
+      throw new Error(`application '${application}' is born but canonical ledger main did not become readable`);
+    }
+    return {
+      application,
+      parent: home.home,
+      principal: home.principal,
+      created: false,
+      deployPrincipal: home.principal
+    };
+  }
+  const domains = await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home.home)}/domains`).then(async (r) => {
+    if (!r.ok) throw new Error(`application parent law discovery failed (${r.status})`);
+    return await r.json();
+  });
+  const frameworkHash = domains.currentLaw?.["nomos"];
+  const lawHash = domains.currentLaw?.["workspaces"];
+  if (!frameworkHash || !lawHash) {
+    throw new Error(`the signed session home does not carry the framework law needed to birth '${application}'`);
+  }
+  const parent = await connectGovernance(cloud, home.home);
+  const birthCert = await parent.certSign({
+    child: application,
+    founder: home.principal,
+    verified: true,
+    parentKey: home.device.public,
+    parentId: home.home,
+    epoch: 0,
+    secret: home.device.secret
+  });
+  const bare = lineageIdentity(home.principal);
+  const now = Date.now();
+  const birth = await fetch(
+    `${cloud}/v2/workspaces/${encodeURIComponent(home.home)}/workspaces/birthChild`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        name: application,
+        parent: home.home,
+        principal: bare,
+        tier: "edge",
+        requestedBy: bare,
+        requestedAt: now,
+        foundingAdminHash: home.device.keyHash,
+        bornAt: new Date(now).toISOString(),
+        frameworkHash,
+        lawHash,
+        platformCert: JSON.stringify(birthCert),
+        actor: home.principal,
+        authorSecret: home.device.secret
+      })
+    }
+  );
+  const body = await birth.json().catch(() => null);
+  const failed = body?.birthOutcomes?.find((outcome) => outcome.status !== "born");
+  if (!birth.ok || body?.ok === false || failed) {
+    if (!await fetch(statusUrl).then((r) => r.ok).catch(() => false)) {
+      throw new Error(
+        `Nomos could not create application '${application}' (${birth.status}): ${failed?.reason ?? String(body?.error ?? JSON.stringify(body))}`
+      );
+    }
+  }
+  if (await waitForWorkspaceMain(cloud, application) === void 0) {
+    throw new Error(`Nomos admitted application '${application}' but canonical ledger main did not become readable`);
+  }
+  const admin = await signAndPostOffer(
+    application,
+    "workspaces",
+    "grantAdmin",
+    { principal: bare, label: "application founder", grantedBy: bare, grantedAt: now },
+    { ...opts, principal: bare }
+  );
+  if (!admin.ok) {
+    throw new Error(`application '${application}' refused its founding admin (${admin.status}): ${JSON.stringify(admin.body)}`);
+  }
+  return {
+    application,
+    parent: home.home,
+    principal: home.principal,
+    created: true,
+    deployPrincipal: home.principal
+  };
+}
 async function signAndPostWorkspaceRetirement(parent, workspaceId, creator, opts) {
   return signAndPostPreparedOffer(
     parent,
@@ -3438,12 +3570,15 @@ async function signAndPostChildLifecycle(parent, child, creator, action, opts) {
   return signAndPostPreparedOffer(
     parent,
     void 0,
-    (actor) => action === "retire" ? {
-      directiveId: "retireChild",
-      payload: { child, principal: creator, retiredBy: lineageIdentity(actor), retiredAt: Date.now() }
-    } : {
-      directiveId: "reclaimChild",
-      payload: { child, reclaimedBy: lineageIdentity(actor), reclaimedAt: Date.now() }
+    (actor) => {
+      const creatorActing = creator !== "" && sameIdentity(creator, actor);
+      return action === "retire" ? {
+        directiveId: creatorActing ? "retireChild" : "retireChildAsAdmin",
+        payload: { child, principal: creator, retiredBy: lineageIdentity(actor), retiredAt: Date.now() }
+      } : {
+        directiveId: creatorActing ? "reclaimChild" : "reclaimChildAsAdmin",
+        payload: { child, reclaimedBy: lineageIdentity(actor), reclaimedAt: Date.now() }
+      };
     },
     opts,
     "self-if-unenrolled",
@@ -5627,6 +5762,22 @@ async function deploy2(ws, opts) {
     return 1;
   }
   const fileName = file.split("/").pop();
+  try {
+    const { ensureApplicationWorkspace: ensureApplicationWorkspace2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    const prepared = await ensureApplicationWorkspace2(ws, opts);
+    if (prepared.deployPrincipal !== void 0 && opts.principal === void 0) {
+      opts = {
+        ...opts,
+        principal: prepared.deployPrincipal.startsWith("user:") ? prepared.deployPrincipal.slice("user:".length) : prepared.deployPrincipal
+      };
+    }
+    if (prepared.created) {
+      out4(`  created application ${ws} under your Nomos home`);
+    }
+  } catch (e) {
+    err4(`deploy '${ws}' could not prepare the application: ${e.message}`);
+    return 1;
+  }
   const beforeLaw = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd : {}).catch(() => ({}));
   const before = beforeLaw.domains ?? [];
   const currentLaw2 = beforeLaw.currentLaw ?? {};

package/dist/dev-server.mjs

@@ -1846,32 +1846,42 @@ function aliasIdsFor(x, path2) {
   return new Set(ids);
 }
 function resolveGatewayOperation(spec, opName, method) {
-  if (!spec || !spec.paths || !opName || !method) return { op: null };
+  if (!spec || !opName || !method) return { op: null };
+  const routeTables = [
+    spec.paths ?? {},
+    spec["x-nomos-framework-routes"]?.paths ?? {}
+  ];
   const normalizedMethod = String(method).toLowerCase();
   const exactPath = `/${String(opName).replace(/^\/+/, "")}`;
-  const exact = spec.paths[exactPath]?.[normalizedMethod];
-  if (exact) return { op: exact, path: exactPath, ambiguous: null };
+  for (const paths of routeTables) {
+    const exact = paths[exactPath]?.[normalizedMethod];
+    if (exact) return { op: exact, path: exactPath, ambiguous: null };
+  }
   const slash = String(opName).indexOf("/");
   if (slash > 0) {
     const requestedDomain = String(opName).slice(0, slash);
     const requestedAlias = String(opName).slice(slash + 1);
     const matches2 = [];
-    for (const [path2, methods] of Object.entries(spec.paths)) {
-      const op = methods?.[normalizedMethod];
-      const x = op?.["x-nomos"];
-      if (!op || !x || x.domain !== requestedDomain) continue;
-      if (aliasIdsFor(x, path2).has(requestedAlias)) matches2.push({ op, path: path2 });
+    for (const paths of routeTables) {
+      for (const [path2, methods] of Object.entries(paths)) {
+        const op = methods?.[normalizedMethod];
+        const x = op?.["x-nomos"];
+        if (!op || !x || x.domain !== requestedDomain) continue;
+        if (aliasIdsFor(x, path2).has(requestedAlias)) matches2.push({ op, path: path2 });
+      }
     }
     if (matches2.length === 1) return { ...matches2[0], ambiguous: null };
     if (matches2.length > 1) return { op: null, ambiguous: matches2.map((m) => m.path).sort() };
     return { op: null, ambiguous: null };
   }
   const matches = [];
-  for (const [path2, methods] of Object.entries(spec.paths)) {
-    const op = methods?.[normalizedMethod];
-    const x = op?.["x-nomos"];
-    if (!op || !x) continue;
-    if (aliasIdsFor(x, path2).has(opName)) matches.push({ op, path: path2 });
+  for (const paths of routeTables) {
+    for (const [path2, methods] of Object.entries(paths)) {
+      const op = methods?.[normalizedMethod];
+      const x = op?.["x-nomos"];
+      if (!op || !x) continue;
+      if (aliasIdsFor(x, path2).has(opName)) matches.push({ op, path: path2 });
+    }
   }
   if (matches.length === 1) return { ...matches[0], ambiguous: null };
   if (matches.length > 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.100.3",
+  "version": "0.100.5",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.100.3",
-    "@githolon/dsl": "^0.100.3",
+    "@githolon/client": "^0.100.5",
+    "@githolon/dsl": "^0.100.5",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {