githolon 0.105.24 → 0.106.0

package/dist/compile_mountability_entry.js

@@ -265,13 +265,23 @@ async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {})
   for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
 `));
   parts.push(pkt("done\n"));
-  const r = await fetch(`${remote}/git-upload-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
-    body: concatBytes(parts)
-  });
-  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
-  const buf = new Uint8Array(await r.arrayBuffer());
+  const body = concatBytes(parts);
+  const reqHeaders = { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers };
+  const MAX_ATTEMPTS = 6;
+  let buf;
+  for (let attempt = 1; ; attempt++) {
+    try {
+      const r = await fetch(`${remote}/git-upload-pack`, { method: "POST", headers: reqHeaders, body, signal: AbortSignal.timeout(18e4) });
+      if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+      buf = new Uint8Array(await r.arrayBuffer());
+      break;
+    } catch (e) {
+      const msg = String(e?.message || e);
+      const transient = /terminated|other side closed|socket|ECONNRESET|ECONNREFUSED|UND_ERR|fetch failed|network|aborted|timeout/i.test(msg) && !/upload-pack \d{3}:/.test(msg);
+      if (!transient || attempt >= MAX_ATTEMPTS) throw e;
+      await new Promise((res) => setTimeout(res, Math.min(4e3, 400 * attempt)));
+    }
+  }
   const { lines, rest } = readPktLines(buf, 0);
   const packChunks = [];
   let sideband = false;

package/dist/dev-server.mjs

@@ -248,13 +248,23 @@ async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {})
   for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
 `));
   parts.push(pkt("done\n"));
-  const r = await fetch(`${remote}/git-upload-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
-    body: concatBytes(parts)
-  });
-  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
-  const buf = new Uint8Array(await r.arrayBuffer());
+  const body = concatBytes(parts);
+  const reqHeaders = { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers };
+  const MAX_ATTEMPTS = 6;
+  let buf;
+  for (let attempt = 1; ; attempt++) {
+    try {
+      const r = await fetch(`${remote}/git-upload-pack`, { method: "POST", headers: reqHeaders, body, signal: AbortSignal.timeout(18e4) });
+      if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+      buf = new Uint8Array(await r.arrayBuffer());
+      break;
+    } catch (e) {
+      const msg = String(e?.message || e);
+      const transient = /terminated|other side closed|socket|ECONNRESET|ECONNREFUSED|UND_ERR|fetch failed|network|aborted|timeout/i.test(msg) && !/upload-pack \d{3}:/.test(msg);
+      if (!transient || attempt >= MAX_ATTEMPTS) throw e;
+      await new Promise((res) => setTimeout(res, Math.min(4e3, 400 * attempt)));
+    }
+  }
   const { lines, rest } = readPktLines(buf, 0);
   const packChunks = [];
   let sideband = false;

package/dist/full-cli.mjs

@@ -928,6 +928,14 @@ function aggregate(id, fields, opts) {
         const v = requires(cap2);
         return build({ kind: "readableBy", cap: v.requires }, v, contracts, dartNameDecl);
       },
+      // Owner-only, PLAINTEXT. Deliberately a `readableBy` audience gating on the framework owner-read
+      // relation — NOT `kind: "owned"`, so the encryption lowering below is skipped and content stays
+      // operator-readable. The relation is seated at workspace scope (`workspace:self#<rel>`) at birth
+      // (see framework/home.ts genesis), which is why an existing chain resolves it with no backfill.
+      // `owned()` is the same read gate PLUS per-record encryption; this is the confidentiality-free rung.
+      ownerReadable: () => {
+        return build({ kind: "readableBy", cap: OWNED_READ_RELATION }, requires(OWNED_READ_RELATION), contracts, dartNameDecl);
+      },
       owned: () => {
         return build({ kind: "owned", ownerField: OWNER_FIELD }, requires(OWNED_READ_RELATION), contracts, dartNameDecl);
       },
@@ -4364,6 +4372,56 @@ async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefi
   }
   return refs;
 }
+async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
+  if (!wants.length) return null;
+  const caps = "ofs-delta agent=nomos-cloud";
+  const parts = [];
+  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
+`)));
+  parts.push(FLUSH);
+  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
+`));
+  parts.push(pkt("done\n"));
+  const body = concatBytes(parts);
+  const reqHeaders = { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers };
+  const MAX_ATTEMPTS = 6;
+  let buf;
+  for (let attempt = 1; ; attempt++) {
+    try {
+      const r = await fetch(`${remote}/git-upload-pack`, { method: "POST", headers: reqHeaders, body, signal: AbortSignal.timeout(18e4) });
+      if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+      buf = new Uint8Array(await r.arrayBuffer());
+      break;
+    } catch (e) {
+      const msg = String(e?.message || e);
+      const transient = /terminated|other side closed|socket|ECONNRESET|ECONNREFUSED|UND_ERR|fetch failed|network|aborted|timeout/i.test(msg) && !/upload-pack \d{3}:/.test(msg);
+      if (!transient || attempt >= MAX_ATTEMPTS) throw e;
+      await new Promise((res) => setTimeout(res, Math.min(4e3, 400 * attempt)));
+    }
+  }
+  const { lines, rest } = readPktLines(buf, 0);
+  const packChunks = [];
+  let sideband = false;
+  for (const line of lines) {
+    if (line.length === 0) continue;
+    const head = dec3.decode(line.subarray(0, Math.min(line.length, 3)));
+    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
+    const band = line[0];
+    if (band === 1) {
+      packChunks.push(line.subarray(1));
+      sideband = true;
+    } else if (band === 2) {
+    } else if (band === 3) {
+      throw new Error("upload-pack fatal: " + dec3.decode(line.subarray(1)).slice(0, 180));
+    }
+  }
+  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
+  if (pack.length < 12 || dec3.decode(pack.subarray(0, 4)) !== "PACK") {
+    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
+  }
+  return pack;
+}
 async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}, fetchImpl = fetch) {
   if (!updates.length) return { ok: true, noop: true };
   const body = concatBytes([receivePackCommandPrefix(updates), pack && pack.length ? pack : EMPTY_PACK]);
@@ -6066,6 +6124,33 @@ ${String(commit).toLowerCase()}`;
   const addReadRemote = async () => {
   };
   const applyPack = (packB64, head) => provider.applyPack(packB64, head);
+  const directFullClone = async (label) => {
+    let lease = null;
+    try {
+      const r = await _fetch(`${base}/v2/workspaces/${workspace}/git-read-lease`, { headers: authHeaders });
+      if (r.ok) {
+        const d = await r.json();
+        if (d && d.ok && typeof d.remote === "string" && typeof d.token === "string") lease = { remote: d.remote, token: d.token };
+      }
+    } catch {
+    }
+    if (!lease) return false;
+    const _f = span("receive", `${label} (direct artifacts)`, "cfetch", {});
+    try {
+      const auth = { Authorization: "Basic " + btoa("x:" + lease.token) };
+      const refs = await lsRefs(lease.remote, auth, { service: "git-upload-pack", prefix: "refs/heads/main" });
+      const head = refs["refs/heads/main"];
+      if (!head || !/^[0-9a-f]{40}$/i.test(head)) return false;
+      const pack = await fetchPack(lease.remote, auth, { wants: [head] });
+      if (!pack || !pack.byteLength) return false;
+      applyPack(nmsInternalSnapshotToBase64(pack), head);
+      return true;
+    } catch {
+      return false;
+    } finally {
+      _f.end();
+    }
+  };
   try {
     await provider.boot({ base, workspace, branch: BRANCH, repoArg, restoreSnapshot: restoreFrom || null, fetchImpl: _fetch, authHeaders });
   } catch (error) {
@@ -6243,7 +6328,7 @@ ${String(commit).toLowerCase()}`;
       _bootLedger.end();
       if (!allowUnborn) throw new Error(`workspace '${workspace}' has no ledger main \u2014 create it first (POST /v2/workspaces/${workspace})`);
     } else {
-      await fetchAndApplyPack("", "boot: fetch full pack");
+      if (!await directFullClone("boot: full pack")) await fetchAndApplyPack("", "boot: fetch full pack");
       const mounted = await mountWithResidency(remoteMain, "boot restore");
       if (mounted && typeof mounted === "object" && mounted.kernelSpans) {
         bootKernelSpans = mounted.kernelSpans;
@@ -6778,7 +6863,7 @@ ${String(commit).toLowerCase()}`;
   const forceFullMainHistory = async (why, _cause) => {
     const _full = span("receive", `${why}: re-pull FULL main`, "cfetch");
     try {
-      await fetchAndApplyPack("", `${why}: full main pack`);
+      if (!await directFullClone(`${why}: full main`)) await fetchAndApplyPack("", `${why}: full main pack`);
     } finally {
       _full.end();
     }
@@ -12001,7 +12086,7 @@ async function lsRefs2(remote, headers = {}, { service = "git-upload-pack", pref
   }
   return refs;
 }
-async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+async function fetchPack2(remote, headers = {}, { wants = [], haves = [] } = {}) {
   wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID2);
   if (!wants.length) return null;
   const caps = "ofs-delta agent=nomos-cloud";
@@ -12012,13 +12097,23 @@ async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {})
   for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID2) parts.push(pkt2(`have ${h}
 `));
   parts.push(pkt2("done\n"));
-  const r = await fetch(`${remote}/git-upload-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
-    body: concatBytes2(parts)
-  });
-  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
-  const buf = new Uint8Array(await r.arrayBuffer());
+  const body = concatBytes2(parts);
+  const reqHeaders = { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers };
+  const MAX_ATTEMPTS = 6;
+  let buf;
+  for (let attempt = 1; ; attempt++) {
+    try {
+      const r = await fetch(`${remote}/git-upload-pack`, { method: "POST", headers: reqHeaders, body, signal: AbortSignal.timeout(18e4) });
+      if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+      buf = new Uint8Array(await r.arrayBuffer());
+      break;
+    } catch (e) {
+      const msg = String(e?.message || e);
+      const transient = /terminated|other side closed|socket|ECONNRESET|ECONNREFUSED|UND_ERR|fetch failed|network|aborted|timeout/i.test(msg) && !/upload-pack \d{3}:/.test(msg);
+      if (!transient || attempt >= MAX_ATTEMPTS) throw e;
+      await new Promise((res) => setTimeout(res, Math.min(4e3, 400 * attempt)));
+    }
+  }
   const { lines, rest } = readPktLines2(buf, 0);
   const packChunks = [];
   let sideband = false;
@@ -14228,7 +14323,7 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   const tip = refs[remoteRefFull] || null;
   if (!tip) return null;
   if (tip !== have) {
-    const pk = await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
+    const pk = await fetchPack2(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
     if (pk) applyPackInto(eng, ws, pk, tip);
   }
   if (writeRef) kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.105.24",
+  "version": "0.106.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
     "@bufbuild/protobuf": "^2.13.0",
-    "@githolon/dsl": "^0.105.24",
+    "@githolon/dsl": "^0.106.0",
     "fast-xml-parser": "5.10.1",
     "isomorphic-git": "^1.38.4",
     "tsx": "^4.19.2"