githolon 0.103.9 → 0.103.10

package/dist/compile_mountability_entry.js

@@ -3932,7 +3932,7 @@ var init_engine = __esm({
     outboxRefName = (requestId) => `refs/heads/outbox/${String(requestId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
     GENESIS_WARRANT_ID = "genesis-warrant:self";
     isWarranted = (eng, ws) => qById(eng, ws, GENESIS_WARRANT_ID).length > 0;
-    projectionStats = (eng, ws) => namedQueryProto(eng, ws || "root", QueryOperation.PROJECTION_STATS);
+    projectionStats = (eng, ws = "root", options = {}) => namedQueryProto(eng, ws || "root", QueryOperation.PROJECTION_STATS, options.deep ? { deep: true } : {});
     memoryDropProbe = (eng, ws) => namedQueryProto(eng, ws, QueryOperation.MEMORY_DROP_PROBE);
     readiness = (eng, ws) => namedQueryProto(eng, ws, QueryOperation.READINESS);
   }

package/dist/dev-server.mjs

@@ -2595,8 +2595,8 @@ function resolveGatewayOperation(spec, opName, method) {
 
 // ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
 var DEPLOYED_KERNELS = [
-  { prefix: "b40b537a", hash: "b40b537a66fe971c86ace3e0f8f2c1ff4087bdb0f7e50d2c9e5d5798633f41a6", version: "kernel-b40b537a", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
-  { prefix: "fd8eeca0", hash: "fd8eeca068dabc11c84825a181062df5958fb9322c945e623753494f760fdc37", version: "kernel-fd8eeca0", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
+  { prefix: "d512065a", hash: "d512065a204a4b5ac59dd8dfc262d98e49d9e47823582a6123351f4668c68c8b", version: "kernel-d512065a", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] },
+  { prefix: "1c66f90d", hash: "1c66f90d98e71f451b5d3505bba09b66694a22674845e2fd499468854c1a0aae", version: "kernel-1c66f90d", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"] }
 ];
 
 // ../cloud/cloudflare-shell/src/staged-intents.ts

package/dist/full-cli.mjs

@@ -3213,7 +3213,7 @@ function providerOperation(mode, rawFields, workBytes) {
   else throw new Error(`no typed protobuf operation for provider call '${mode}'`);
   return { case: "custody", value: create(CustodyRequestSchema, { operation: custody }) };
 }
-function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes) {
+function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes, context = {}) {
   const rounded = Object.fromEntries(Object.entries({ encode: encoded.encodeMs, ...phases }).map(([key2, value]) => [key2, Math.round(value * 1e3) / 1e3]));
   const totalMs = Object.values(rounded).reduce((sum2, value) => sum2 + value, 0);
   const debug = globalThis.__NOMOS_PROFILE_TRANSPORT__ === true || globalThis.process?.env?.NOMOS_PROFILE_TRANSPORT === "1";
@@ -3221,10 +3221,13 @@ function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes
   console.warn(`[nomos-transport-perf] ${JSON.stringify({
     host,
     mode: encoded.mode,
+    detail: encoded.detail,
+    requestId: encoded.requestId,
     totalMs: Math.round(totalMs * 1e3) / 1e3,
     phases: rounded,
     requestBytes: encoded.bytes.length,
-    responseBytes
+    responseBytes,
+    ...context
   })}`);
 }
 function nmsInternalEncodeProviderCall(mode, fields, workBytes, requestPrefix = "browser") {
@@ -3241,7 +3244,9 @@ function nmsInternalEncodeTypedProviderCall(operation, requestPrefix = "browser"
     requestId,
     operation
   }));
-  return { requestId, mode: operation.case || "empty", bytes, encodeMs: monotonicMs() - started };
+  const query3 = operation.case === "query" ? operation.value.query : void 0;
+  const detail = query3?.case === "named" ? `query:named:${String(query3.value.operation)}` : query3?.case ? `query:${query3.case}` : operation.case || "empty";
+  return { requestId, mode: operation.case || "empty", detail, bytes, encodeMs: monotonicMs() - started };
 }
 function nmsInternalDecodeProviderResponse(bytes, requestId, stderr = []) {
   const response = fromBinary(CallResponseSchema, bytes);
@@ -3302,7 +3307,8 @@ function nmsInternalDecodeProviderResponse(bytes, requestId, stderr = []) {
               verdictDecodeUs: Number(result.value.spans.verdictDecodeUs),
               promoteAndCleanupRefsUs: Number(result.value.spans.promoteAndCleanupRefsUs),
               frontierRebuildUs: Number(result.value.spans.frontierRebuildUs),
-              frontierStoreUs: Number(result.value.spans.frontierStoreUs)
+              frontierStoreUs: Number(result.value.spans.frontierStoreUs),
+              verification: result.value.spans.verification ? jsVerifyChainDiagnostics(result.value.spans.verification) : void 0
             } : void 0
           });
         case "repoStats":
@@ -3371,7 +3377,15 @@ function jsVerifyChainDiagnostics(diagnostics) {
         typedInstallVerifierUs: Number(step.phases.typedInstallVerifierUs),
         admissionUs: Number(step.phases.admissionUs),
         foldUs: Number(step.phases.foldUs)
-      } : void 0
+      } : void 0,
+      engineTimings: step.engineTimings.map((timing) => ({
+        phase: timing.phase,
+        totalUs: Number(timing.totalUs)
+      }))
+    })),
+    engineTimings: diagnostics.engineTimings.map((timing) => ({
+      phase: timing.phase,
+      totalUs: Number(timing.totalUs)
     }))
   };
 }
@@ -3418,7 +3432,7 @@ function nmsInternalParseSnapshot(bytes) {
   return { treeBytes: bytes, ckpt: null, frontier: null, cursor: null, stateRoot: null, syncedBase: null };
 }
 function nmsInternalBuildSnapshot(treeBytes, ckpt, syncedBase) {
-  const hasCheckpoint = !!(ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor && ckpt.stateRoot));
+  const hasCheckpoint = !!(ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor));
   if (!hasCheckpoint && !syncedBase) return treeBytes;
   return enc2.encode(JSON.stringify({
     v: 2,
@@ -3564,7 +3578,7 @@ function createWasmEnginePlane({ span } = {}) {
     const view = {
       /** The parsed restore checkpoint (so index.mjs can drive checkpoint_import after boot, exactly as before). */
       get restoreCheckpoint() {
-        return _ckptBlobStr || _ckptFrontierStr || _ckptCursor && _ckptStateRoot ? { blob: _ckptBlobStr, frontier: _ckptFrontierStr, cursor: _ckptCursor, stateRoot: _ckptStateRoot } : null;
+        return _ckptBlobStr || _ckptFrontierStr || _ckptCursor ? { blob: _ckptBlobStr, frontier: _ckptFrontierStr, cursor: _ckptCursor, stateRoot: _ckptStateRoot } : null;
       },
       /** The converged fork point persisted in the restoreFrom snapshot (null for old/tree-only snapshots). */
       get restoreSyncedBase() {
@@ -3738,7 +3752,7 @@ function createWasmEnginePlane({ span } = {}) {
         const treeBytes = serializeTree(wsDirNode);
         return nmsInternalBuildSnapshot(
           treeBytes,
-          ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor && ckpt.stateRoot) ? ckpt : null,
+          ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor) ? ckpt : null,
           opts.syncedBase || null
         );
       }
@@ -5345,7 +5359,7 @@ async function connectSingle({ cloud, workspace, clientId, authToken, restoreFro
   if (salvageOnly) allowUnborn = true;
   if (!cloud || !workspace) throw new Error("connect({ cloud, workspace }) required");
   const _fetch = typeof fetchImpl === "function" ? fetchImpl : globalThis.fetch;
-  const deviceSecret = authorSecret || "";
+  let deviceSecret = authorSecret || "";
   const base = cloud.replace(/\/+$/, "");
   const localOnly = /^local:\/\//i.test(base);
   const historicSnapshotConfig = historicSnapshots === false ? null : historicSnapshots && typeof historicSnapshots === "object" ? historicSnapshots : {};
@@ -5589,9 +5603,11 @@ ${String(commit).toLowerCase()}`;
   const watchStops = /* @__PURE__ */ new Set();
   let installedLawRowsCache;
   let installedLawCurrentCache;
-  const invalidateInstalledLawRows = () => {
+  let installedInterfaceCache;
+  const invalidateInstalledLawMetadata = () => {
     installedLawRowsCache = void 0;
     installedLawCurrentCache = void 0;
+    installedInterfaceCache = void 0;
   };
   let _disposed = false;
   const nudgeWatches = () => {
@@ -5936,10 +5952,13 @@ ${String(commit).toLowerCase()}`;
   const compatGuardWrite = (directiveId, force) => assertWriteShippable(compatState, directiveId, { force, workspace });
   let _lastInterfaceReadError = null;
   const installedInterfaceInner = () => {
+    if (installedInterfaceCache !== void 0) return installedInterfaceCache;
     try {
       const compact = JSON.parse(call("query", { queryBytes: qBytes({ op: "interfaceOffer" }) }));
       _lastInterfaceReadError = null;
-      return compact && typeof compact === "object" && !Array.isArray(compact) && Object.keys(compact).length ? compact : null;
+      const installedInterface = compact && typeof compact === "object" && !Array.isArray(compact) && Object.keys(compact).length ? compact : null;
+      installedInterfaceCache = installedInterface;
+      return installedInterface;
     } catch (error) {
       _lastInterfaceReadError = error instanceof Error ? error : new Error(String(error));
       return null;
@@ -6079,7 +6098,7 @@ ${String(commit).toLowerCase()}`;
         }
       }
     }
-    invalidateInstalledLawRows();
+    invalidateInstalledLawMetadata();
     nudgeWatches();
     return {
       upToDate: false,
@@ -6221,22 +6240,35 @@ ${String(commit).toLowerCase()}`;
     };
     return err13;
   };
-  if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor && ckptStateRoot) {
+  if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor) {
     const _ckptSpan = span("receive", restoreFrom ? "boot: restore folded state (snapshot)" : "boot: restore checkpoint", "boot");
+    let checkpointResult = null;
     try {
-      call("checkpoint_import", {
+      checkpointResult = JSON.parse(call("checkpoint_import", {
         ...ckptBlobStr ? { blob: ckptBlobStr } : {},
         ...ckptFrontierStr ? { frontier: ckptFrontierStr } : {},
         ...ckptStagedFrontierFile ? { stagedFrontierFile: ckptStagedFrontierFile } : {},
         ...ckptCursor ? { cursor: ckptCursor } : {},
-        ...ckptStateRoot ? { stateRoot: ckptStateRoot } : {}
-      });
+        ...ckptStateRoot ? { stateRoot: ckptStateRoot } : {},
+        // Cold-open latency is a public runtime property. Ask the kernel for
+        // its bounded phase table so tenant tooling can distinguish custody,
+        // schema, SQLite hydration and policy-cache work without profiling the
+        // opaque host bridge or weakening the kernel boundary.
+        spans: true
+      }));
     } catch (error) {
       if (typeof process !== "undefined" && process.env?.NOMOS_DEBUG_RAW) {
         console.error("[nomos] checkpoint restore refused", error);
       }
     }
-    _ckptSpan.end();
+    _ckptSpan.end(checkpointResult ? {
+      restored: checkpointResult.restored,
+      reason: checkpointResult.reason,
+      aggregates: checkpointResult.aggregates,
+      readOnly: checkpointResult.readOnly,
+      lazyReadIndex: checkpointResult.lazyReadIndex,
+      kernelSpans: checkpointResult.kernelSpans
+    } : {});
   }
   const remoteUnavailableAtConnect = (cause) => {
     const msg = String(cause?.message || cause);
@@ -6712,7 +6744,7 @@ ${String(commit).toLowerCase()}`;
         affected = Array.isArray(res.affected) ? res.affected : [];
       }
       if ((domain === "nomos" || domain === "bootstrap") && ["installDomain", "stageDomain", "promoteDomain", "rollbackDomain"].includes(directiveId)) {
-        invalidateInstalledLawRows();
+        invalidateInstalledLawMetadata();
       }
       scheduleMaintenanceSoon();
       nudgeWatchesSoon();
@@ -9357,6 +9389,29 @@ ${String(commit).toLowerCase()}`;
       authHeaders = packAuthHeaders({ authToken: activeAuthToken, principal: connectionPrincipal });
       return { refreshed: true };
     },
+    /** Refresh the client-held identity proof and/or default signing key without disposing, remounting or
+     * refolding this resident holon. The kernel remains the authority: changing the client key grants
+     * nothing; the next offer still has to prove that key is enrolled under the workspace law. */
+    refreshCredentials: ({ authToken: token, authorSecret: secret } = {}) => {
+      if (token !== void 0) {
+        const next = typeof token === "string" ? token.trim() : "";
+        if (next) {
+          const subjectClaim = jwtClaim(next, "sub");
+          const nextSubject = canonicalPrincipal(
+            typeof subjectClaim === "string" ? subjectClaim : ""
+          );
+          if (!nextSubject || nextSubject !== connectionPrincipal) {
+            throw new Error("credential refresh changed the signed-in identity; reopen the application explicitly");
+          }
+        }
+        activeAuthToken = next;
+        authHeaders = packAuthHeaders({ authToken: activeAuthToken, principal: connectionPrincipal });
+      }
+      if (secret !== void 0) {
+        deviceSecret = typeof secret === "string" ? secret.trim() : "";
+      }
+      return { refreshed: true };
+    },
     /**
      * THE ONE ENCODER as the public offer entrypoint. A generated client (TS or Dart-via-bridge) calls THIS
      * with the planned payload + the verified `actor` — it NEVER re-encodes the v2 envelope itself. The bytes
@@ -14829,7 +14884,7 @@ var init_engine = __esm({
     outboxRefName = (requestId) => `refs/heads/outbox/${String(requestId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
     GENESIS_WARRANT_ID = "genesis-warrant:self";
     isWarranted = (eng, ws) => qById(eng, ws, GENESIS_WARRANT_ID).length > 0;
-    projectionStats = (eng, ws) => namedQueryProto(eng, ws || "root", QueryOperation2.PROJECTION_STATS);
+    projectionStats = (eng, ws = "root", options = {}) => namedQueryProto(eng, ws || "root", QueryOperation2.PROJECTION_STATS, options.deep ? { deep: true } : {});
     memoryDropProbe = (eng, ws) => namedQueryProto(eng, ws, QueryOperation2.MEMORY_DROP_PROBE);
     readiness = (eng, ws) => namedQueryProto(eng, ws, QueryOperation2.READINESS);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.103.9",
+  "version": "0.103.10",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
     "@bufbuild/protobuf": "^2.13.0",
-    "@githolon/dsl": "^0.103.9",
+    "@githolon/dsl": "^0.103.10",
     "isomorphic-git": "^1.38.4",
     "tsx": "^4.19.2"
   },