githolon 0.105.6 → 0.105.7

package/dist/compile_mountability_entry.js

@@ -360,7 +360,10 @@ var init_custody_transport = __esm({
 // vendor/engine/managed-promotion.ts
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -902,17 +905,18 @@ function offerResult(response) {
   }
 }
 function applicationQueryProto(eng, ws, query2, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng.ex, {
     case: "query",
     value: create(QueryRequestSchema, {
       target: protoTarget(ws, options.branch ?? BRANCH),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query2
     })
@@ -4031,12 +4035,10 @@ var init_engine = __esm({
       const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
       const derived = namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
         custodyWorkspace: workspace,
-        principal,
-        authorSecret,
         scope,
         ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
         ...recordWrap === void 0 ? {} : { recordWrap }
-      });
+      }, { principal, authorSecret });
       const ownedKeySubject = String(derived.ownedKeySubject || "");
       if (!requireSeat) {
         return {
@@ -4053,7 +4055,16 @@ var init_engine = __esm({
         let hex = "";
         for (const byte of enc3.encode(principal)) hex += byte.toString(16).padStart(2, "0");
         const object = `nomos-owned-principal:${hex || "00"}`;
-        const rows = qById(eng, workspace, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+        const rows = qById(
+          eng,
+          workspace,
+          `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`,
+          principal,
+          [],
+          "",
+          0,
+          authorSecret
+        );
         const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
         const leaves = row?.data?.subjects ?? row?.subjects ?? {};
         const leaf = (raw) => {
@@ -4084,14 +4095,12 @@ var init_engine = __esm({
         const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
         if (!custody) throw new Error("the approved device has no owned-data handoff");
         const opened = namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
-          workspace,
-          principal,
-          authorSecret,
+          custodyWorkspace: workspace,
           scope,
           ownedCustody: custody,
           ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
           ...recordWrap === void 0 ? {} : { recordWrap }
-        });
+        }, { principal, authorSecret });
         return {
           scope: String(opened.scope || scope),
           epoch: Number(opened.epoch) || 0,
@@ -4112,11 +4121,8 @@ var init_engine = __esm({
       };
     };
     cryptoOwnedDeviceRequest = (eng, workspace, principal, authorSecret, scope) => String(namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_DEVICE_REQUEST, {
-      workspace,
-      principal,
-      authorSecret,
       scope
-    }).request || "");
+    }, { principal, authorSecret }).request || "");
     cryptoOwnedPrepareApproval = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_APPROVAL, args);
     cryptoOwnedPrepareRecovery = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_RECOVERY, args);
     cryptoKeygen = (eng) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_KEYGEN);
@@ -4154,7 +4160,10 @@ var init_engine = __esm({
       ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
       ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
     }).cert;
-    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => {
+      const result = namedQueryProto(eng, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+      return { hpkeEpk: String(result.hpkeEpk ?? ""), ct: String(result.ct ?? "") };
+    };
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_UNWRAP_KEY, { secret, hpkeEpk, ct }).scopeKey;
     readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
       eng,

package/dist/dev-server.mjs

@@ -618,17 +618,18 @@ function offerResult(response) {
   }
 }
 function applicationQueryProto(eng, ws, query2, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng.ex, {
     case: "query",
     value: create(QueryRequestSchema, {
       target: protoTarget(ws, options.branch ?? BRANCH),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query2
     })
@@ -2990,8 +2991,8 @@ function resolveGatewayOperation(spec, opName, method) {
 
 // ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
 var DEPLOYED_KERNELS = [
-  { prefix: "796e512c", hash: "796e512cf4549c7fadbb4e56248ec076bca3992258a1b5282d678cb56bf24f35", version: "kernel-796e512c", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] },
-  { prefix: "beaabafa", hash: "beaabafa0d30eb83f1e49cc9f26251996ea3ef302e24ae36180a686145b41588", version: "kernel-beaabafa", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] }
+  { prefix: "08719339", hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] },
+  { prefix: "ab5c45c0", hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] }
 ];
 
 // ../cloud/cloudflare-shell/src/staged-intents.ts

package/dist/full-cli.mjs

@@ -4419,7 +4419,10 @@ var init_custody_transport = __esm({
 // ../cloud/web-client/src/_adapter/managed-promotion.ts
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -11768,7 +11771,10 @@ var init_custody_transport2 = __esm({
 // vendor/engine/managed-promotion.ts
 function prepareManagedPromotion2(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -12310,17 +12316,18 @@ function offerResult(response) {
   }
 }
 function applicationQueryProto(eng, ws, query3, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng.ex, {
     case: "query",
     value: create2(QueryRequestSchema2, {
       target: protoTarget2(ws, options.branch ?? BRANCH2),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query3
     })
@@ -15439,12 +15446,10 @@ var init_engine = __esm({
       const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
       const derived = namedQueryProto(eng, workspace, QueryOperation2.CRYPTO_OWNED_SCOPE_KEY, {
         custodyWorkspace: workspace,
-        principal,
-        authorSecret,
         scope,
         ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
         ...recordWrap === void 0 ? {} : { recordWrap }
-      });
+      }, { principal, authorSecret });
       const ownedKeySubject = String(derived.ownedKeySubject || "");
       if (!requireSeat) {
         return {
@@ -15461,7 +15466,16 @@ var init_engine = __esm({
         let hex = "";
         for (const byte of enc7.encode(principal)) hex += byte.toString(16).padStart(2, "0");
         const object = `nomos-owned-principal:${hex || "00"}`;
-        const rows = qById(eng, workspace, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+        const rows = qById(
+          eng,
+          workspace,
+          `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`,
+          principal,
+          [],
+          "",
+          0,
+          authorSecret
+        );
         const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
         const leaves = row?.data?.subjects ?? row?.subjects ?? {};
         const leaf = (raw) => {
@@ -15492,14 +15506,12 @@ var init_engine = __esm({
         const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
         if (!custody) throw new Error("the approved device has no owned-data handoff");
         const opened = namedQueryProto(eng, workspace, QueryOperation2.CRYPTO_OWNED_SCOPE_KEY, {
-          workspace,
-          principal,
-          authorSecret,
+          custodyWorkspace: workspace,
           scope,
           ownedCustody: custody,
           ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
           ...recordWrap === void 0 ? {} : { recordWrap }
-        });
+        }, { principal, authorSecret });
         return {
           scope: String(opened.scope || scope),
           epoch: Number(opened.epoch) || 0,
@@ -15520,11 +15532,8 @@ var init_engine = __esm({
       };
     };
     cryptoOwnedDeviceRequest = (eng, workspace, principal, authorSecret, scope) => String(namedQueryProto(eng, workspace, QueryOperation2.CRYPTO_OWNED_DEVICE_REQUEST, {
-      workspace,
-      principal,
-      authorSecret,
       scope
-    }).request || "");
+    }, { principal, authorSecret }).request || "");
     cryptoOwnedPrepareApproval = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation2.CRYPTO_OWNED_PREPARE_APPROVAL, args);
     cryptoOwnedPrepareRecovery = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation2.CRYPTO_OWNED_PREPARE_RECOVERY, args);
     cryptoKeygen = (eng) => namedQueryProto(eng, "root", QueryOperation2.CRYPTO_KEYGEN);
@@ -15562,7 +15571,10 @@ var init_engine = __esm({
       ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
       ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
     }).cert;
-    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => namedQueryProto(eng, "root", QueryOperation2.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => {
+      const result = namedQueryProto(eng, "root", QueryOperation2.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+      return { hpkeEpk: String(result.hpkeEpk ?? ""), ct: String(result.ct ?? "") };
+    };
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => namedQueryProto(eng, "root", QueryOperation2.CRYPTO_UNWRAP_KEY, { secret, hpkeEpk, ct }).scopeKey;
     readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
       eng,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.105.6",
+  "version": "0.105.7",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
     "@bufbuild/protobuf": "^2.13.0",
-    "@githolon/dsl": "^0.105.6",
+    "@githolon/dsl": "^0.105.7",
     "isomorphic-git": "^1.38.4",
     "tsx": "^4.19.2"
   },