githolon 0.101.6 → 0.102.1

package/dist/dev-server.mjs

@@ -775,6 +775,14 @@ function currentLaw(eng, ws) {
 function installedLaw(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "installedLaw" }), branch: BRANCH }, eng.STDERR));
 }
+function kernelStamp(eng, ws) {
+  return JSON.parse(call(eng.ex, "query", {
+    repoArg: repoArgOf(ws),
+    workspace: ws,
+    queryBytes: b64Json({ op: "kernelStamp" }),
+    branch: BRANCH
+  }, eng.STDERR));
+}
 function domainPackage(eng, ws, hash) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "domainPackage", hash }), branch: BRANCH }, eng.STDERR));
 }
@@ -1422,7 +1430,8 @@ async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}
   const payload = upgrade ? stagePayload(domainHash, usda, eng.installedBy, supersedes) : installPayload(domainHash, usda, eng.installedBy, dispositions);
   const result = author(eng, ws, "nomos", directiveId, payload, eng.hashes.nomos, {
     actor: opts.actor ?? "",
-    ...opts.authToken ? { authToken: opts.authToken } : {}
+    ...opts.authToken ? { authToken: opts.authToken } : {},
+    ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}
   });
   if (result.ok === false) {
     unmount(eng, ws);
@@ -1738,26 +1747,6 @@ async function bootstrapPlatform(dev, opts) {
     }
     log2(`platform '${platform}' genesis'd via the operator anchor lane (framework ${eng.hashes.nomos.slice(0, 12)})`);
   });
-  if (opts.deploy) {
-    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
-    const usda = body.packageUsda || body.usda;
-    if (!usda) throw new Error(`--deploy ${opts.deploy} has no packageUsda (nothing to install)`);
-    const deployErr = await serialize(async () => {
-      const ledger = ledgerFor(platform);
-      const domainHash = await sha256hex(usda);
-      try {
-        const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, { actor: "user:dev-admin" });
-        if (out && out.ok === false) return String(out.error || "the law refused the platform package");
-        log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
-        return null;
-      } catch (e) {
-        return errMsg(e);
-      }
-    });
-    if (deployErr) throw new Error(`platform law deploy REFUSED: ${deployErr.slice(0, 400)}`);
-  } else {
-    log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
-  }
   const testMint = isTestMint(eng);
   if (!testMint) {
     throw new Error(
@@ -1797,7 +1786,7 @@ async function bootstrapPlatform(dev, opts) {
       // signed by S_root
     });
     const certChain = JSON.stringify({ links: [platformCert] });
-    const homeDomain = homeDomainOf(opts) || "home";
+    const homeDomain = FRAMEWORK_HOME_DOMAIN;
     const lawKeys = await serialize(async () => {
       await mountWorkspace(eng, platform, ledgerFor(platform));
       return currentLaw(eng, platform);
@@ -1880,6 +1869,31 @@ async function bootstrapPlatform(dev, opts) {
       dev.homeDomain = homeDomain;
     }
   }
+  if (opts.deploy) {
+    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
+    const usda = body.packageUsda || body.usda;
+    if (!usda) throw new Error(`--deploy ${opts.deploy} has no packageUsda (nothing to install)`);
+    const founderDevice = dev.operatorDevice;
+    if (!founderDevice) throw new Error("platform law deploy needs the warranted founder device established by bootstrap");
+    const deployErr = await serialize(async () => {
+      const ledger = ledgerFor(platform);
+      const domainHash = await sha256hex(usda);
+      try {
+        const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, {
+          actor: "user:dev-operator",
+          authorSecret: founderDevice.secret
+        });
+        if (out && out.ok === false) return String(out.error || "the law refused the platform package");
+        log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
+        return null;
+      } catch (e) {
+        return errMsg(e);
+      }
+    });
+    if (deployErr) throw new Error(`platform law deploy REFUSED: ${deployErr.slice(0, 400)}`);
+  } else {
+    log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
+  }
   if (opts.authProvider || opts.firebaseProject) {
     log2(`AuthProvider: ${opts.authProvider || `firebase:${opts.firebaseProject}`} \u2014 register it via the platform's setAuthProvider governance offer;`);
     log2("  the kernel verifies x-nomos-auth JWTs against the law-declared key (host stays blind).");
@@ -1888,13 +1902,14 @@ async function bootstrapPlatform(dev, opts) {
   log2(attested ? "bootstrap complete \u2014 platform law deployed + ROOT-ATTESTED (BirthAttestation certChain seeded; birthHome assembles a valid travelling cert)." : "bootstrap complete (platform law deployed; attested-birth legs gated as noted above \u2014 need the test-mint wasm).");
   return { platform, testMint, attested };
 }
-var log2;
+var log2, FRAMEWORK_HOME_DOMAIN;
 var init_bootstrap = __esm({
   "../cloud/dev-server/bootstrap.ts"() {
     "use strict";
     init_engine();
     init_types();
     log2 = (m) => console.log(`[bootstrap] ${m}`);
+    FRAMEWORK_HOME_DOMAIN = "__nomos_application_home_v1";
   }
 });
 
@@ -1998,8 +2013,8 @@ function resolveGatewayOperation(spec, opName, method) {
 
 // ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
 var DEPLOYED_KERNELS = [
-  { prefix: "cf01b3ae", hash: "cf01b3ae327618b26da3af8eb6abe5e16a7f050e8a9d9b6ca92e2a1d78dd280b", version: "kernel-cf01b3ae", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
-  { prefix: "4f8ffb62", hash: "4f8ffb623c3717d973b1ced653e23f7a8f63fe73b83aa5a0f83f4dd8c46bd81f", version: "kernel-4f8ffb62", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
+  { prefix: "bc52f7eb", hash: "bc52f7eb630bc5a9a03b4c62b9b7ab58c4b6f25e687ecd51c72f9251763593fc", version: "kernel-bc52f7eb", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
+  { prefix: "17d8f91b", hash: "17d8f91b661dc8c3a6dea72d699f9f5759ab5e6b4e3e3e5e90afceb3a7034154", version: "kernel-17d8f91b", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
 ];
 
 // ../cloud/cloudflare-shell/src/staged-intents.ts
@@ -2212,6 +2227,18 @@ var unb64 = (s) => new Uint8Array(Buffer.from(s, "base64"));
 function configDir() {
   return process.env.HOLON_CONFIG_DIR || path.join(os.homedir(), ".holon");
 }
+function explicitRuntimeDir() {
+  if (process.env.NOMOS_CANDIDATE_RUNTIME) {
+    return { dir: process.env.NOMOS_CANDIDATE_RUNTIME, candidate: true };
+  }
+  if (process.env.NOMOS_OFFLINE_RUNTIME) {
+    return { dir: process.env.NOMOS_OFFLINE_RUNTIME, candidate: false };
+  }
+  return null;
+}
+function selectedRuntimeDir() {
+  return explicitRuntimeDir()?.dir ?? path.join(configDir(), "runtime");
+}
 function firstExisting(...paths) {
   for (const p of paths) {
     if (p && existsSync2(p)) return p;
@@ -2257,21 +2284,39 @@ function capabilitiesForKernelHash(hash) {
 }
 var DEFAULT_KERNEL_SOURCE = "https://nomos.captainapp.co.uk";
 async function resolveTestMintWasm(kernelSource) {
-  const runtimeCache = path.join(configDir(), "runtime");
+  const explicitRuntime = explicitRuntimeDir();
+  const runtimeCache = selectedRuntimeDir();
   const cachePath = path.join(runtimeCache, "holon-testmint.wasm");
+  if (explicitRuntime) {
+    if (existsSync2(cachePath)) {
+      const bytes = readFileSync2(cachePath);
+      if (isTestMintBytes(bytes)) {
+        return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "explicit-runtime" };
+      }
+    }
+    if (explicitRuntime.candidate || String(process.env.NOMOS_RUNTIME_REFRESH || "auto").toLowerCase() === "never") {
+      throw new Error(
+        `explicit runtime is missing a valid test-mint kernel at ${cachePath}; hydrate that exact runtime bundle before running the generated proof`
+      );
+    }
+  }
   const local = process.env.NOMOS_LOCAL_WASM;
-  if (local && existsSync2(local)) {
+  if (!explicitRuntime && local && existsSync2(local)) {
     const bytes = readFileSync2(local);
     if (isTestMintBytes(bytes)) return { wasmPath: local, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "NOMOS_LOCAL_WASM" };
   }
   const bundled = path.join(DIR, "kernel-testmint.wasm");
-  if (existsSync2(bundled)) {
+  if (!explicitRuntime && existsSync2(bundled)) {
     const bytes = readFileSync2(bundled);
     if (isTestMintBytes(bytes)) return { wasmPath: bundled, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "bundled" };
   }
-  if (existsSync2(cachePath)) {
+  if (!explicitRuntime && existsSync2(cachePath)) {
     const bytes = readFileSync2(cachePath);
-    if (isTestMintBytes(bytes)) return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "cache" };
+    const sha = createHash2("sha256").update(bytes).digest("hex");
+    const currentTestMint = DEPLOYED_KERNELS.find((entry) => /test-mint/i.test(entry.note));
+    if (isTestMintBytes(bytes) && currentTestMint?.hash === sha) {
+      return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "cache" };
+    }
   }
   const src = String(kernelSource || process.env.NOMOS_KERNEL_SOURCE || DEFAULT_KERNEL_SOURCE).replace(/\/+$/, "");
   const url = `${src}/v1/runtime/holon-testmint.wasm`;
@@ -2292,7 +2337,8 @@ async function resolveTestMintWasm(kernelSource) {
   );
 }
 async function loadRuntime(opts = {}) {
-  const runtimeCache = path.join(configDir(), "runtime");
+  const explicitRuntime = explicitRuntimeDir();
+  const runtimeCache = selectedRuntimeDir();
   const repoDomainsDir = path.join(REPO_ROOT, "cloud/cloudflare-shell/container/domains");
   const vendoredFrameworkDir = path.join(DIR, "framework");
   let wasmPath, wasmBytes, kernelKind, kernelSource;
@@ -2300,9 +2346,10 @@ async function loadRuntime(opts = {}) {
     ({ wasmPath, wasmBytes, kernelKind, kernelSource } = await resolveTestMintWasm(opts.kernelSource));
   } else {
     wasmPath = firstExisting(
-      process.env.NOMOS_LOCAL_WASM,
-      path.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
-      path.join(runtimeCache, "holon.wasm")
+      explicitRuntime ? path.join(runtimeCache, "holon.wasm") : null,
+      explicitRuntime ? null : process.env.NOMOS_LOCAL_WASM,
+      explicitRuntime ? null : path.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
+      explicitRuntime ? null : path.join(runtimeCache, "holon.wasm")
     );
     if (!wasmPath) {
       throw new Error(
@@ -2316,7 +2363,16 @@ async function loadRuntime(opts = {}) {
   const repoBootstrap = firstExisting(path.join(repoDomainsDir, "domain_bootstrap.package.usda"));
   const repoNomos = firstExisting(path.join(repoDomainsDir, "domain_nomos.package.usda"));
   let bootstrapPkg, nomosPkg;
-  if (repoBootstrap && repoNomos) {
+  const explicitPackages = explicitRuntime ? path.join(runtimeCache, "packages.json") : null;
+  if (explicitPackages && existsSync2(explicitPackages)) {
+    const pkgs = JSON.parse(readFileSync2(explicitPackages, "utf8"));
+    bootstrapPkg = pkgs.bootstrap;
+    nomosPkg = pkgs.nomos;
+  } else if (explicitRuntime) {
+    throw new Error(
+      `explicit runtime is missing framework packages at ${explicitPackages}; hydrate that exact runtime bundle before starting the local Nomos cloud`
+    );
+  } else if (repoBootstrap && repoNomos) {
     bootstrapPkg = readFileSync2(repoBootstrap, "utf8");
     nomosPkg = readFileSync2(repoNomos, "utf8");
   } else if (existsSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"))) {
@@ -2527,7 +2583,22 @@ async function startDevCloud(opts = {}) {
         return res.end(Buffer.from(wasmBytes));
       }
       if (url.pathname === "/v1/runtime/capabilities") {
-        const stamp = capabilitiesForKernelHash(kernelSha);
+        let stamp = capabilitiesForKernelHash(kernelSha);
+        if (!stamp.known) {
+          try {
+            const observed = kernelStamp(eng, opts.platform || "root");
+            if (typeof observed.version === "string" && Array.isArray(observed.features) && observed.features.every((feature) => typeof feature === "string")) {
+              stamp = {
+                hash: kernelSha,
+                version: observed.version,
+                note: "kernel self-attested local candidate",
+                features: observed.features,
+                known: true
+              };
+            }
+          } catch {
+          }
+        }
         return sendJson(res, {
           ok: true,
           prod: stamp,
@@ -2976,10 +3047,52 @@ Sec-WebSocket-Accept: ${accept}\r
     persistBorn,
     // `--platform` requested ⇒ NOT ready until the boot-time ceremony completes (main flips it true).
     ...opts.platform ? { platformReady: false } : {},
-    close: () => new Promise((resolve) => server.close(() => resolve()))
+    close: () => new Promise((resolve) => {
+      server.close(() => resolve());
+      server.closeAllConnections?.();
+    })
   };
   return devSelf;
 }
+async function startGeneratedApplicationProofCloud(opts) {
+  const probe = http.createServer();
+  await new Promise((resolve, reject) => {
+    probe.once("error", reject);
+    probe.listen(0, "127.0.0.1", () => resolve());
+  });
+  const address = probe.address();
+  const port = typeof address === "object" && address !== null ? address.port : 0;
+  await new Promise((resolve) => probe.close(() => resolve()));
+  if (port <= 0) throw new Error("could not allocate a local port for the generated application proof");
+  const dev = await startDevCloud({
+    port,
+    ephemeral: true,
+    attested: true,
+    platform: opts.platform,
+    deploy: opts.deploy
+  });
+  try {
+    const { bootstrapPlatform: bootstrapPlatform2 } = await Promise.resolve().then(() => (init_bootstrap(), bootstrap_exports));
+    await bootstrapPlatform2(dev, { platform: opts.platform, deploy: opts.deploy, attested: true });
+    dev.platformReady = true;
+    if (dev.operatorDevice === void 0) {
+      throw new Error("the local proof cloud did not establish its private founding device");
+    }
+    const idp = dev.testIdP;
+    if (idp === void 0) throw new Error("the local proof cloud did not establish its test identity provider");
+    const proofUid = `proof-owner-${createHash2("sha256").update(opts.platform).digest("hex").slice(0, 16)}`;
+    const principal = `user:${proofUid}`;
+    dev.generatedApplicationProof = {
+      principal,
+      authToken: idp.mint({ sub: proofUid })
+    };
+    return dev;
+  } catch (error) {
+    await dev.close().catch(() => {
+    });
+    throw error;
+  }
+}
 function parseArgs(argv) {
   const o = {};
   for (let i = 0; i < argv.length; i++) {
@@ -3035,5 +3148,7 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   });
 }
 export {
-  startDevCloud
+  resolveTestMintWasm,
+  startDevCloud,
+  startGeneratedApplicationProofCloud
 };