githolon 0.101.6 → 0.102.0

package/dist/dev-server.mjs

@@ -775,6 +775,14 @@ function currentLaw(eng, ws) {
 function installedLaw(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "installedLaw" }), branch: BRANCH }, eng.STDERR));
 }
+function kernelStamp(eng, ws) {
+  return JSON.parse(call(eng.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    queryBytes: b64Json({ op: "kernelStamp" }),
+    branch: BRANCH
+  }, eng.STDERR));
+}
 function domainPackage(eng, ws, hash) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "domainPackage", hash }), branch: BRANCH }, eng.STDERR));
 }
@@ -1422,7 +1430,8 @@ async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}
   const payload = upgrade ? stagePayload(domainHash, usda, eng.installedBy, supersedes) : installPayload(domainHash, usda, eng.installedBy, dispositions);
   const result = author(eng, ws, "nomos", directiveId, payload, eng.hashes.nomos, {
     actor: opts.actor ?? "",
-    ...opts.authToken ? { authToken: opts.authToken } : {}
+    ...opts.authToken ? { authToken: opts.authToken } : {},
+    ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}
   });
   if (result.ok === false) {
     unmount(eng, ws);
@@ -1738,26 +1747,6 @@ async function bootstrapPlatform(dev, opts) {
     }
     log2(`platform '${platform}' genesis'd via the operator anchor lane (framework ${eng.hashes.nomos.slice(0, 12)})`);
   });
-  if (opts.deploy) {
-    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
-    const usda = body.packageUsda || body.usda;
-    if (!usda) throw new Error(`--deploy ${opts.deploy} has no packageUsda (nothing to install)`);
-    const deployErr = await serialize(async () => {
-      const ledger = ledgerFor(platform);
-      const domainHash = await sha256hex(usda);
-      try {
-        const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, { actor: "user:dev-admin" });
-        if (out && out.ok === false) return String(out.error || "the law refused the platform package");
-        log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
-        return null;
-      } catch (e) {
-        return errMsg(e);
-      }
-    });
-    if (deployErr) throw new Error(`platform law deploy REFUSED: ${deployErr.slice(0, 400)}`);
-  } else {
-    log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
-  }
   const testMint = isTestMint(eng);
   if (!testMint) {
     throw new Error(
@@ -1797,7 +1786,7 @@ async function bootstrapPlatform(dev, opts) {
       // signed by S_root
     });
     const certChain = JSON.stringify({ links: [platformCert] });
-    const homeDomain = homeDomainOf(opts) || "home";
+    const homeDomain = FRAMEWORK_HOME_DOMAIN;
     const lawKeys = await serialize(async () => {
       await mountWorkspace(eng, platform, ledgerFor(platform));
       return currentLaw(eng, platform);
@@ -1880,6 +1869,31 @@ async function bootstrapPlatform(dev, opts) {
       dev.homeDomain = homeDomain;
     }
   }
+  if (opts.deploy) {
+    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
+    const usda = body.packageUsda || body.usda;
+    if (!usda) throw new Error(`--deploy ${opts.deploy} has no packageUsda (nothing to install)`);
+    const founderDevice = dev.operatorDevice;
+    if (!founderDevice) throw new Error("platform law deploy needs the warranted founder device established by bootstrap");
+    const deployErr = await serialize(async () => {
+      const ledger = ledgerFor(platform);
+      const domainHash = await sha256hex(usda);
+      try {
+        const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, {
+          actor: "user:dev-operator",
+          authorSecret: founderDevice.secret
+        });
+        if (out && out.ok === false) return String(out.error || "the law refused the platform package");
+        log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
+        return null;
+      } catch (e) {
+        return errMsg(e);
+      }
+    });
+    if (deployErr) throw new Error(`platform law deploy REFUSED: ${deployErr.slice(0, 400)}`);
+  } else {
+    log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
+  }
   if (opts.authProvider || opts.firebaseProject) {
     log2(`AuthProvider: ${opts.authProvider || `firebase:${opts.firebaseProject}`} \u2014 register it via the platform's setAuthProvider governance offer;`);
     log2("  the kernel verifies x-nomos-auth JWTs against the law-declared key (host stays blind).");
@@ -1888,13 +1902,14 @@ async function bootstrapPlatform(dev, opts) {
   log2(attested ? "bootstrap complete \u2014 platform law deployed + ROOT-ATTESTED (BirthAttestation certChain seeded; birthHome assembles a valid travelling cert)." : "bootstrap complete (platform law deployed; attested-birth legs gated as noted above \u2014 need the test-mint wasm).");
   return { platform, testMint, attested };
 }
-var log2;
+var log2, FRAMEWORK_HOME_DOMAIN;
 var init_bootstrap = __esm({
   "../cloud/dev-server/bootstrap.ts"() {
     "use strict";
     init_engine();
     init_types();
     log2 = (m) => console.log(`[bootstrap] ${m}`);
+    FRAMEWORK_HOME_DOMAIN = "__nomos_application_home_v1";
   }
 });
 
@@ -1998,8 +2013,8 @@ function resolveGatewayOperation(spec, opName, method) {
 
 // ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
 var DEPLOYED_KERNELS = [
-  { prefix: "cf01b3ae", hash: "cf01b3ae327618b26da3af8eb6abe5e16a7f050e8a9d9b6ca92e2a1d78dd280b", version: "kernel-cf01b3ae", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
-  { prefix: "4f8ffb62", hash: "4f8ffb623c3717d973b1ced653e23f7a8f63fe73b83aa5a0f83f4dd8c46bd81f", version: "kernel-4f8ffb62", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
+  { prefix: "bc52f7eb", hash: "bc52f7eb630bc5a9a03b4c62b9b7ab58c4b6f25e687ecd51c72f9251763593fc", version: "kernel-bc52f7eb", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
+  { prefix: "17d8f91b", hash: "17d8f91b661dc8c3a6dea72d699f9f5759ab5e6b4e3e3e5e90afceb3a7034154", version: "kernel-17d8f91b", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
 ];
 
 // ../cloud/cloudflare-shell/src/staged-intents.ts
@@ -2527,7 +2542,22 @@ async function startDevCloud(opts = {}) {
         return res.end(Buffer.from(wasmBytes));
       }
       if (url.pathname === "/v1/runtime/capabilities") {
-        const stamp = capabilitiesForKernelHash(kernelSha);
+        let stamp = capabilitiesForKernelHash(kernelSha);
+        if (!stamp.known) {
+          try {
+            const observed = kernelStamp(eng, opts.platform || "root");
+            if (typeof observed.version === "string" && Array.isArray(observed.features) && observed.features.every((feature) => typeof feature === "string")) {
+              stamp = {
+                hash: kernelSha,
+                version: observed.version,
+                note: "kernel self-attested local candidate",
+                features: observed.features,
+                known: true
+              };
+            }
+          } catch {
+          }
+        }
         return sendJson(res, {
           ok: true,
           prod: stamp,
@@ -2976,10 +3006,52 @@ Sec-WebSocket-Accept: ${accept}\r
     persistBorn,
     // `--platform` requested ⇒ NOT ready until the boot-time ceremony completes (main flips it true).
     ...opts.platform ? { platformReady: false } : {},
-    close: () => new Promise((resolve) => server.close(() => resolve()))
+    close: () => new Promise((resolve) => {
+      server.close(() => resolve());
+      server.closeAllConnections?.();
+    })
   };
   return devSelf;
 }
+async function startGeneratedApplicationProofCloud(opts) {
+  const probe = http.createServer();
+  await new Promise((resolve, reject) => {
+    probe.once("error", reject);
+    probe.listen(0, "127.0.0.1", () => resolve());
+  });
+  const address = probe.address();
+  const port = typeof address === "object" && address !== null ? address.port : 0;
+  await new Promise((resolve) => probe.close(() => resolve()));
+  if (port <= 0) throw new Error("could not allocate a local port for the generated application proof");
+  const dev = await startDevCloud({
+    port,
+    ephemeral: true,
+    attested: true,
+    platform: opts.platform,
+    deploy: opts.deploy
+  });
+  try {
+    const { bootstrapPlatform: bootstrapPlatform2 } = await Promise.resolve().then(() => (init_bootstrap(), bootstrap_exports));
+    await bootstrapPlatform2(dev, { platform: opts.platform, deploy: opts.deploy, attested: true });
+    dev.platformReady = true;
+    if (dev.operatorDevice === void 0) {
+      throw new Error("the local proof cloud did not establish its private founding device");
+    }
+    const idp = dev.testIdP;
+    if (idp === void 0) throw new Error("the local proof cloud did not establish its test identity provider");
+    const proofUid = `proof-owner-${createHash2("sha256").update(opts.platform).digest("hex").slice(0, 16)}`;
+    const principal = `user:${proofUid}`;
+    dev.generatedApplicationProof = {
+      principal,
+      authToken: idp.mint({ sub: proofUid })
+    };
+    return dev;
+  } catch (error) {
+    await dev.close().catch(() => {
+    });
+    throw error;
+  }
+}
 function parseArgs(argv) {
   const o = {};
   for (let i = 0; i < argv.length; i++) {
@@ -3035,5 +3107,6 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   });
 }
 export {
-  startDevCloud
+  startDevCloud,
+  startGeneratedApplicationProofCloud
 };