githolon 0.101.3 → 0.101.5

package/dist/cli.mjs

@@ -3941,29 +3941,26 @@ async function ensureApplicationWorkspace(application, opts = {}) {
   });
   const bare = lineageIdentity(home.principal);
   const now = Date.now();
-  const birth = await fetch(
-    `${cloud}/v2/workspaces/${encodeURIComponent(home.home)}/workspaces/birthChild`,
+  const birth = await signAndPostOffer(
+    home.home,
+    "workspaces",
+    "birthChild",
     {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        name: application,
-        parent: home.home,
-        principal: bare,
-        tier: "edge",
-        requestedBy: bare,
-        requestedAt: now,
-        foundingAdminHash: home.device.keyHash,
-        bornAt: new Date(now).toISOString(),
-        frameworkHash,
-        lawHash,
-        platformCert: JSON.stringify(birthCert),
-        actor: home.principal,
-        authorSecret: home.device.secret
-      })
-    }
+      name: application,
+      parent: home.home,
+      principal: bare,
+      tier: "edge",
+      requestedBy: bare,
+      requestedAt: now,
+      foundingAdminHash: home.device.keyHash,
+      bornAt: new Date(now).toISOString(),
+      frameworkHash,
+      lawHash,
+      platformCert: JSON.stringify(birthCert)
+    },
+    { ...opts, principal: bare }
   );
-  const body = await birth.json().catch(() => null);
+  const body = birth.body;
   const failed = body?.birthOutcomes?.find((outcome) => outcome.status !== "born");
   if (!birth.ok || body?.ok === false || failed) {
     if (!await fetch(statusUrl).then((r) => r.ok).catch(() => false)) {
@@ -5391,7 +5388,7 @@ async function probeOfferLane(cloud, ws, route, fetchImpl = fetch) {
     const spec = await r.json().catch(() => void 0);
     if (spec === void 0 || typeof spec !== "object") return { served: false, routesTarget: void 0 };
     const served = true;
-    const routesTarget = route === void 0 ? void 0 : openapiRoutesDirective(spec, route.domain, route.directiveId);
+    const routesTarget = route === void 0 || route.visibility === "framework" ? void 0 : openapiRoutesDirective(spec, route.domain, route.directiveId);
     return { served, routesTarget };
   } catch {
     return { served: void 0, routesTarget: void 0 };
@@ -6283,7 +6280,11 @@ async function deploy2(ws, opts) {
       return 1;
     }
     const { probeCloudCapabilities: probeCloudCapabilities2, negotiateDeployRoute: negotiateDeployRoute2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
-    const route = { domain: "nomos", directiveId: expectsPending ? "stageDomain" : "installDomain" };
+    const route = {
+      domain: "nomos",
+      directiveId: expectsPending ? "stageDomain" : "installDomain",
+      visibility: "framework"
+    };
     const caps = await probeCloudCapabilities2(cloud, ws, route);
     const refusal = negotiateDeployRoute2(caps, { signed: true, ws, sealedSizeChars: packageUsda.length, route });
     if (refusal !== void 0) {
@@ -9161,6 +9162,7 @@ var init_dlq = __esm({
 // src/cli.ts
 import { existsSync as existsSync16, readdirSync as readdirSync6, readFileSync as readFileSync16 } from "node:fs";
 import { spawnSync as spawnSync6 } from "node:child_process";
+import { createHash as createHash7 } from "node:crypto";
 import { createRequire as createRequire3 } from "node:module";
 import { dirname as dirname9, join as join17, resolve as resolve5 } from "node:path";
 import { pathToFileURL as pathToFileURL5, fileURLToPath } from "node:url";
@@ -10686,7 +10688,7 @@ async function runProof(args) {
     return 1;
   };
   const live = args.includes("--live");
-  if (args.includes("--keep")) return refuse("--keep no longer applies: proof --live uses your durable signed Nomos home and creates only the requested business aggregate");
+  if (args.includes("--keep")) return refuse("--keep no longer applies: proof --live owns its isolated acceptance workspace and preserves its verified history");
   let domain;
   let domainValueIdx = -1;
   const di = args.findIndex((a) => a === "--domain" || a.startsWith("--domain="));
@@ -10773,14 +10775,16 @@ async function runProof(args) {
     );
   }
   const barePrincipal = home.principal.startsWith("user:") ? home.principal.slice("user:".length) : home.principal;
-  const deployed = await deploy2(home.home, { principal: barePrincipal });
-  if (deployed !== 0) return refuse("proof --live: Nomos could not install the compiled business law into the signed session home");
+  const proofIdentity = createHash7("sha256").update(home.home).update("\0").update(readFileSync16(proofPath)).digest("hex").slice(0, 24);
+  const proofWorkspace = `nomos-proof-${proofIdentity}`;
+  const deployed = await deploy2(proofWorkspace, { principal: barePrincipal });
+  if (deployed !== 0) return refuse("proof --live: Nomos could not install the compiled business law into its isolated acceptance application");
   const r = spawnSync6(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: {
       ...process.env,
-      NOMOS_WS: home.home,
+      NOMOS_WS: proofWorkspace,
       NOMOS_PRINCIPAL: home.principal,
       NOMOS_AUTHOR_SECRET: home.device.secret,
       NOMOS_PROOF_MANAGED: "1"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.101.3",
+  "version": "0.101.5",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.101.3",
-    "@githolon/dsl": "^0.101.3",
+    "@githolon/client": "^0.101.5",
+    "@githolon/dsl": "^0.101.5",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {