githolon 0.105.13 → 0.105.15

package/dist/compile_mountability_entry.js

@@ -431,7 +431,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -447,7 +447,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -556,6 +555,8 @@ var init_kernel_pb = __esm({
 // vendor/engine/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
+  MAX_INLINE_INTENT_OFFER_BYTES: () => MAX_INLINE_INTENT_OFFER_BYTES,
+  MAX_STAGED_INTENT_OFFER_BYTES: () => MAX_STAGED_INTENT_OFFER_BYTES,
   NOMOS_SHARD_ROWS_READ: () => NOMOS_SHARD_ROWS_READ,
   admitAll: () => admitAll,
   admitIntentOffers: () => admitIntentOffers,
@@ -618,6 +619,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installedLaw: () => installedLaw,
   intentOfferResidencies: () => intentOfferResidencies,
+  intentOfferSizeRefusal: () => intentOfferSizeRefusal,
   isDirty: () => isDirty,
   isWarranted: () => isWarranted,
   kernelStamp: () => kernelStamp,
@@ -1624,6 +1626,10 @@ async function replicateIntents(eng, ws, ledger, intents, { push = true } = {})
   log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
   return { replicated, skipped, refused };
 }
+function intentOfferSizeRefusal(staged, byteLength) {
+  const maxOfferBytes = staged ? MAX_STAGED_INTENT_OFFER_BYTES : MAX_INLINE_INTENT_OFFER_BYTES;
+  return byteLength <= 0 || byteLength > maxOfferBytes ? `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` : null;
+}
 async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
   const main = await mainIntentIds(eng, ws);
   const sessions = /* @__PURE__ */ new Map();
@@ -1695,9 +1701,16 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
       if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
-      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
-      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
-        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+      if (!blob) {
+        rec.rejected.push({
+          oid: String(offer?.oid || "").slice(0, 10),
+          error: intentOfferSizeRefusal(!!offer?.staged, 0)
+        });
+        continue;
+      }
+      const sizeRefusal = intentOfferSizeRefusal(!!offer?.staged, blob.byteLength);
+      if (sizeRefusal !== null) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: sizeRefusal });
         continue;
       }
       const inspected = kgit.inspectChange(eng, blob);
@@ -1957,7 +1970,7 @@ async function mountWorkspace(eng, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
-      if (!seeded?.seeded) {
+      if (!seeded?.seeded && ledger.readOnly !== true) {
         void pushCheckpoint(eng, ws, ledger).catch(() => {
         });
       }
@@ -3118,12 +3131,12 @@ async function verifyChain(eng, ws, ledger) {
 function verifyChainLocal(eng, ws) {
   return namedQueryProto(eng, ws, QueryOperation.VERIFY_CHAIN);
 }
-function historyPreflight(eng, ws, domain, candidateHash, atHash, dispositions) {
+function historyPreflight(eng, ws, domain, candidateHash, atHash, actor = "") {
   return namedQueryProto(eng, ws, QueryOperation.HISTORY_PREFLIGHT, {
     domain,
     candidateHash,
     atHash,
-    ...dispositions ? { dispositions } : {}
+    ...actor.trim() ? { ackBy: actor.trim() } : {}
   });
 }
 function historyRestorePreflight(eng, ws, domain, currentHash, priorHash, atHash, actor) {
@@ -3150,7 +3163,7 @@ function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
   }
   let report;
   try {
-    report = historyPreflight(eng, ws, domain, candidateHash, atHash, opts.dispositions);
+    report = historyPreflight(eng, ws, domain, candidateHash, atHash, actingPrincipal);
   } catch (error) {
     return { ok: false, stage: "preflight", error: String(error?.message || error) };
   }
@@ -3159,7 +3172,6 @@ function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
   const {
     replaces: _replaces,
     retireReplaced: _retireReplaced,
-    dispositions: _dispositions,
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;
@@ -3649,7 +3661,7 @@ function warmKernelCaches(eng, opts = {}) {
     ...opts.interactiveOnly ? { interactiveOnly: true } : {}
   });
 }
-var enc3, dec3, BRANCH, PROTO_ABI_VERSION, protoRequestSequence, certificateBytes, protoBirthCertificate, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, unsignedWasiPointers, log, protoTarget, protoAuthority, repoArgOfGitdir, bytesFromB64, kgit, closureInstallPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, importCustodyObjects, syncCandidate, custodyLsRefs, capturedReadUnix, queryArguments, queryAuthorityOptions, qById, query, queryPage, queryProfile, authorizationAddress, authorizationSubject, currentAuthorizationFrontier, check, expand, cryptoSealField, cryptoOwnedScopeKey, cryptoOwnedDeviceRequest, cryptoOwnedPrepareApproval, cryptoOwnedPrepareRecovery, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted, projectionStats, memoryDropProbe, readiness;
+var enc3, dec3, BRANCH, PROTO_ABI_VERSION, protoRequestSequence, certificateBytes, protoBirthCertificate, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, unsignedWasiPointers, log, protoTarget, protoAuthority, repoArgOfGitdir, bytesFromB64, kgit, closureInstallPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, MAX_INLINE_INTENT_OFFER_BYTES, MAX_STAGED_INTENT_OFFER_BYTES, CKPT_REF, pushVia, fullRef, applyPackInto, importCustodyObjects, syncCandidate, custodyLsRefs, capturedReadUnix, queryArguments, queryAuthorityOptions, qById, query, queryPage, queryProfile, authorizationAddress, authorizationSubject, currentAuthorizationFrontier, check, expand, cryptoSealField, cryptoOwnedScopeKey, cryptoOwnedDeviceRequest, cryptoOwnedPrepareApproval, cryptoOwnedPrepareRecovery, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted, projectionStats, memoryDropProbe, readiness;
 var init_engine = __esm({
   "vendor/engine/engine.ts"() {
     "use strict";
@@ -3907,6 +3919,8 @@ var init_engine = __esm({
     tallyOf = (eng, ws, read, group) => read.kind === "count" ? count(eng, ws, read.id, group).count : read.kind === "sum" ? sum(eng, ws, read.id, group).sum : extremum(eng, ws, read.id, read.kind, group).value;
     isExtremumRead = (read) => read.kind === "min" || read.kind === "max";
     extremumMonotone = (read, prev, next) => next === null && prev === null || next !== null && (prev === null || (read.kind === "min" ? next <= prev : next >= prev));
+    MAX_INLINE_INTENT_OFFER_BYTES = 32 * 1024 * 1024;
+    MAX_STAGED_INTENT_OFFER_BYTES = 64 * 1024 * 1024;
     CKPT_REF = (lawHash) => `refs/meta/checkpoint/${lawHash}`;
     pushVia = (ledger, fn) => ledger && ledger.pushLane ? ledger.pushLane(fn) : fn();
     fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;

package/dist/dev-server.mjs

@@ -910,6 +910,10 @@ function summaryOfCapture(ctx, fromOid, toOid) {
     rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1))
   };
 }
+function intentOfferSizeRefusal(staged, byteLength) {
+  const maxOfferBytes = staged ? MAX_STAGED_INTENT_OFFER_BYTES : MAX_INLINE_INTENT_OFFER_BYTES;
+  return byteLength <= 0 || byteLength > maxOfferBytes ? `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` : null;
+}
 async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
   const main = await mainIntentIds(eng, ws);
   const sessions = /* @__PURE__ */ new Map();
@@ -981,9 +985,16 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
       if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
-      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
-      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
-        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+      if (!blob) {
+        rec.rejected.push({
+          oid: String(offer?.oid || "").slice(0, 10),
+          error: intentOfferSizeRefusal(!!offer?.staged, 0)
+        });
+        continue;
+      }
+      const sizeRefusal = intentOfferSizeRefusal(!!offer?.staged, blob.byteLength);
+      if (sizeRefusal !== null) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: sizeRefusal });
         continue;
       }
       const inspected = kgit.inspectChange(eng, blob);
@@ -1168,7 +1179,7 @@ async function mountWorkspace(eng, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
-      if (!seeded?.seeded) {
+      if (!seeded?.seeded && ledger.readOnly !== true) {
         void pushCheckpoint(eng, ws, ledger).catch(() => {
         });
       }
@@ -2153,7 +2164,7 @@ async function ledgerStats(eng, ws, ledger = null) {
   if (mounted) mounted.ledgerStats = out;
   return out;
 }
-var enc3, dec3, BRANCH, PROTO_ABI_VERSION, protoRequestSequence, certificateBytes, protoBirthCertificate, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, unsignedWasiPointers, log, protoTarget, protoAuthority, repoArgOfGitdir, bytesFromB64, kgit, closureInstallPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, capturedReadUnix, queryArguments, queryAuthorityOptions, qById, query, authorKeygen, certSign, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted;
+var enc3, dec3, BRANCH, PROTO_ABI_VERSION, protoRequestSequence, certificateBytes, protoBirthCertificate, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, unsignedWasiPointers, log, protoTarget, protoAuthority, repoArgOfGitdir, bytesFromB64, kgit, closureInstallPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, MAX_INLINE_INTENT_OFFER_BYTES, MAX_STAGED_INTENT_OFFER_BYTES, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, capturedReadUnix, queryArguments, queryAuthorityOptions, qById, query, authorKeygen, certSign, readPosture, count, sum, pendingConflicts, pendingConflictSummary, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted;
 var init_engine = __esm({
   "../adapter/engine.ts"() {
     "use strict";
@@ -2411,6 +2422,8 @@ var init_engine = __esm({
     tallyOf = (eng, ws, read, group) => read.kind === "count" ? count(eng, ws, read.id, group).count : read.kind === "sum" ? sum(eng, ws, read.id, group).sum : extremum(eng, ws, read.id, read.kind, group).value;
     isExtremumRead = (read) => read.kind === "min" || read.kind === "max";
     extremumMonotone = (read, prev, next) => next === null && prev === null || next !== null && (prev === null || (read.kind === "min" ? next <= prev : next >= prev));
+    MAX_INLINE_INTENT_OFFER_BYTES = 32 * 1024 * 1024;
+    MAX_STAGED_INTENT_OFFER_BYTES = 64 * 1024 * 1024;
     CKPT_REF = (lawHash) => `refs/meta/checkpoint/${lawHash}`;
     pushVia = (ledger, fn) => ledger && ledger.pushLane ? ledger.pushLane(fn) : fn();
     fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
@@ -2991,8 +3004,8 @@ function resolveGatewayOperation(spec, opName, method) {
 
 // ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
 var DEPLOYED_KERNELS = [
-  { prefix: "64219cdd", hash: "64219cdd5441cd92cb08d5200a6e65e7814364cc6d1b7cd1b014322ea4372092", version: "kernel-64219cdd", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] },
-  { prefix: "9ca691fd", hash: "9ca691fd3524897b2edc236167b1b490701c85b41ad066cc41041829d42357f7", version: "kernel-9ca691fd", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] }
+  { prefix: "d37253bc", hash: "d37253bcefd90a180a6a1af96422a9f0724dfca9efd9ae7cff070afa2c410f09", version: "kernel-d37253bc", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] },
+  { prefix: "b6bddd8d", hash: "b6bddd8d61390edbe2ee4e5f3c7f21108bdb7800af746d20f568936f63e2d517", version: "kernel-b6bddd8d", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] }
 ];
 
 // ../cloud/cloudflare-shell/src/staged-intents.ts