githolon 0.105.6 → 0.105.8

package/dist/compile_mountability_entry.js

@@ -360,7 +360,10 @@ var init_custody_transport = __esm({
 // vendor/engine/managed-promotion.ts
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -902,17 +905,18 @@ function offerResult(response) {
   }
 }
 function applicationQueryProto(eng, ws, query2, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng.ex, {
     case: "query",
     value: create(QueryRequestSchema, {
       target: protoTarget(ws, options.branch ?? BRANCH),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query2
     })
@@ -4031,12 +4035,10 @@ var init_engine = __esm({
       const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
       const derived = namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
         custodyWorkspace: workspace,
-        principal,
-        authorSecret,
         scope,
         ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
         ...recordWrap === void 0 ? {} : { recordWrap }
-      });
+      }, { principal, authorSecret });
       const ownedKeySubject = String(derived.ownedKeySubject || "");
       if (!requireSeat) {
         return {
@@ -4053,7 +4055,16 @@ var init_engine = __esm({
         let hex = "";
         for (const byte of enc3.encode(principal)) hex += byte.toString(16).padStart(2, "0");
         const object = `nomos-owned-principal:${hex || "00"}`;
-        const rows = qById(eng, workspace, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+        const rows = qById(
+          eng,
+          workspace,
+          `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`,
+          principal,
+          [],
+          "",
+          0,
+          authorSecret
+        );
         const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
         const leaves = row?.data?.subjects ?? row?.subjects ?? {};
         const leaf = (raw) => {
@@ -4084,14 +4095,12 @@ var init_engine = __esm({
         const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
         if (!custody) throw new Error("the approved device has no owned-data handoff");
         const opened = namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
-          workspace,
-          principal,
-          authorSecret,
+          custodyWorkspace: workspace,
           scope,
           ownedCustody: custody,
           ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
           ...recordWrap === void 0 ? {} : { recordWrap }
-        });
+        }, { principal, authorSecret });
         return {
           scope: String(opened.scope || scope),
           epoch: Number(opened.epoch) || 0,
@@ -4112,11 +4121,8 @@ var init_engine = __esm({
       };
     };
     cryptoOwnedDeviceRequest = (eng, workspace, principal, authorSecret, scope) => String(namedQueryProto(eng, workspace, QueryOperation.CRYPTO_OWNED_DEVICE_REQUEST, {
-      workspace,
-      principal,
-      authorSecret,
       scope
-    }).request || "");
+    }, { principal, authorSecret }).request || "");
     cryptoOwnedPrepareApproval = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_APPROVAL, args);
     cryptoOwnedPrepareRecovery = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_RECOVERY, args);
     cryptoKeygen = (eng) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_KEYGEN);
@@ -4154,7 +4160,10 @@ var init_engine = __esm({
       ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
       ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
     }).cert;
-    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => {
+      const result = namedQueryProto(eng, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+      return { hpkeEpk: String(result.hpkeEpk ?? ""), ct: String(result.ct ?? "") };
+    };
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => namedQueryProto(eng, "root", QueryOperation.CRYPTO_UNWRAP_KEY, { secret, hpkeEpk, ct }).scopeKey;
     readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
       eng,

package/dist/dev-server.mjs

@@ -618,17 +618,18 @@ function offerResult(response) {
   }
 }
 function applicationQueryProto(eng, ws, query2, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng.ex, {
     case: "query",
     value: create(QueryRequestSchema, {
       target: protoTarget(ws, options.branch ?? BRANCH),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query2
     })
@@ -2990,8 +2991,8 @@ function resolveGatewayOperation(spec, opName, method) {
 
 // ../cloud/cloudflare-shell/src/kernel-registry.generated.ts
 var DEPLOYED_KERNELS = [
-  { prefix: "796e512c", hash: "796e512cf4549c7fadbb4e56248ec076bca3992258a1b5282d678cb56bf24f35", version: "kernel-796e512c", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] },
-  { prefix: "beaabafa", hash: "beaabafa0d30eb83f1e49cc9f26251996ea3ef302e24ae36180a686145b41588", version: "kernel-beaabafa", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] }
+  { prefix: "08719339", hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", note: "production (this candidate)", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] },
+  { prefix: "ab5c45c0", hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", note: "test-mint (this candidate) \u2014 feature-equivalent to production", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"] }
 ];
 
 // ../cloud/cloudflare-shell/src/staged-intents.ts

package/dist/full-cli.mjs

@@ -4419,7 +4419,10 @@ var init_custody_transport = __esm({
 // ../cloud/web-client/src/_adapter/managed-promotion.ts
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -4862,7 +4865,7 @@ var init_principal = __esm({
 
 // ../cloud/web-client/src/dead_letters.ts
 function createDeadLetters(ctx) {
-  const { provider, enc: enc8, dec: dec8, b64 } = ctx;
+  const { provider, enc: enc8, dec: dec8, b64: b642 } = ctx;
   const DLQ_FILE = "dead-letters.json";
   const readDlq = () => {
     const d = provider.readWsFile(DLQ_FILE);
@@ -4884,7 +4887,7 @@ function createDeadLetters(ctx) {
       directiveId = doc.payload && doc.payload.directiveId || null;
     } catch {
     }
-    list.push({ id: e.id, oid: String(e.oid || e.id || "").slice(0, 10), source, error: String(error || "").slice(0, 300), domain, directiveId, at: (/* @__PURE__ */ new Date()).toISOString(), changeB64: b64(e.blob) });
+    list.push({ id: e.id, oid: String(e.oid || e.id || "").slice(0, 10), source, error: String(error || "").slice(0, 300), domain, directiveId, at: (/* @__PURE__ */ new Date()).toISOString(), changeB64: b642(e.blob) });
     writeDlq(list);
   }
   return { readDlq, writeDlq, deadLetter };
@@ -5371,6 +5374,191 @@ var init_serialized_scheduler = __esm({
   }
 });
 
+// ../cloud/web-client/src/intent_offer_codec.ts
+function encodeIntentOfferBytes({ domain, directiveId, payload, domainHash, security, actor }) {
+  const envelope = { v: 2, intent: { domain, directiveId, payload, domainHash } };
+  const securitySidecar = security && typeof security === "object" && !Array.isArray(security) ? { ...security } : {};
+  if (actor) securitySidecar.actor = actor;
+  if (typeof securitySidecar.actor === "string") {
+    const normalized = securitySidecar.actor.trim();
+    if (normalized) securitySidecar.actor = normalized;
+    else delete securitySidecar.actor;
+  }
+  if (Object.keys(securitySidecar).length > 0) envelope.security = securitySidecar;
+  return encoder.encode(JSON.stringify(envelope));
+}
+var encoder;
+var init_intent_offer_codec = __esm({
+  "../cloud/web-client/src/intent_offer_codec.ts"() {
+    "use strict";
+    encoder = new TextEncoder();
+  }
+});
+
+// ../cloud/web-client/src/remote_holon.ts
+function connectRemote(opts) {
+  const { cloud, workspace } = opts;
+  if (!cloud || !workspace) throw new Error("connectRemote requires { cloud, workspace }");
+  const base = cloud.replace(/\/+$/, "");
+  const _fetch = opts.fetch ?? fetch;
+  const wsUrl = (path2) => `${base}/v2/workspaces/${encodeURIComponent(workspace)}${path2}`;
+  const headers = (json) => {
+    const h = {};
+    if (json) h["content-type"] = "application/json";
+    if (opts.authToken) h["x-nomos-auth"] = opts.authToken;
+    else if (opts.principal) h["x-nomos-principal"] = opts.principal;
+    return h;
+  };
+  const readJson = async (r, what) => {
+    if (!r.ok) {
+      const text = await r.text().catch(() => "");
+      throw new Error(`${what} failed (${r.status}): ${text.slice(0, 300)}`);
+    }
+    return r.json();
+  };
+  const getRead = async (path2, what) => readJson(await _fetch(wsUrl(path2), { headers: headers(false) }), what);
+  async function offerDirective(domain, directiveId, payload, o) {
+    const bytes = encodeIntentOfferBytes({
+      domain,
+      directiveId,
+      payload,
+      domainHash: o?.domainHash,
+      actor: o?.actor
+    });
+    const r = await _fetch(wsUrl(`/${encodeURIComponent(directiveId)}`), {
+      method: "POST",
+      headers: headers(true),
+      body: JSON.stringify({ intentBytes: b64(bytes) })
+    });
+    const body = await r.json().catch(() => ({}));
+    if (r.status === 422 || body?.refused === true) {
+      throw new RemoteOfferRefusedError(
+        String(body?.error ?? "the law refused the offer"),
+        r.status
+      );
+    }
+    if (!r.ok || body?.ok === false) {
+      throw new Error(
+        `offer ${directiveId} failed (${r.status}): ${String(body?.error ?? "").slice(0, 300)}`
+      );
+    }
+    const result = {
+      head: String(body.head ?? ""),
+      ...Array.isArray(body.created) ? { created: body.created } : {},
+      ...Array.isArray(body.affected) ? { affected: body.affected } : {},
+      ...typeof body.workspace === "string" ? { workspace: body.workspace } : {},
+      ...body.born !== void 0 ? { born: body.born } : {},
+      ...body.birthOutcomes !== void 0 ? { birthOutcomes: body.birthOutcomes } : {}
+    };
+    return o?.returnCreated ? result : result.head;
+  }
+  const query3 = (queryId, params) => {
+    const qs = new URLSearchParams();
+    for (const [k, v] of Object.entries(params ?? {})) if (v != null) qs.set(k, String(v));
+    const suffix = qs.toString() ? `?${qs.toString()}` : "";
+    return getRead(`/${encodeURIComponent(queryId)}${suffix}`, `query ${queryId}`);
+  };
+  const queryById = (aggregateId) => getRead(`/aggregates/${encodeURIComponent(aggregateId)}`, `queryById ${aggregateId}`);
+  const tally = async (kind, id, groupKey) => {
+    const suffix = groupKey ? `?group=${encodeURIComponent(groupKey)}` : "";
+    const body = await getRead(`/${encodeURIComponent(id)}${suffix}`, `${kind} ${id}`);
+    if (typeof body === "number") return body;
+    const v = body?.[kind] ?? body?.value ?? body?.total;
+    return typeof v === "number" ? v : Number(v ?? 0);
+  };
+  const poll = (read, cb, intervalMs) => {
+    let stopped = false;
+    let timer;
+    const tick = async () => {
+      if (stopped) return;
+      try {
+        cb(await read());
+      } catch {
+      }
+      if (!stopped) timer = setTimeout(tick, intervalMs);
+    };
+    void tick();
+    return () => {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+    };
+  };
+  const defaultInterval = opts.watchIntervalMs ?? 2e3;
+  const principal = opts.principal ?? (opts.authToken ? (() => {
+    try {
+      const seg = opts.authToken.split(".")[1] ?? "";
+      const b = seg.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((seg.length + 3) % 4);
+      const claims = JSON.parse(
+        typeof atob === "function" ? atob(b) : nodeBuffer()?.from(b, "base64").toString("utf8") ?? ""
+      );
+      return claims.sub;
+    } catch {
+      return void 0;
+    }
+  })() : void 0);
+  return {
+    workspace,
+    cloud: base,
+    principal,
+    offerDirective,
+    query: query3,
+    queryById,
+    count: (countId, groupKey) => tally("count", countId, groupKey),
+    sum: (sumId, groupKey) => tally("sum", sumId, groupKey),
+    deadLetters: () => getRead(`/dead-letters`, "deadLetters"),
+    retryDeadLetter: async (id) => {
+      const r = await _fetch(wsUrl(`/dead-letters/retry?id=${encodeURIComponent(id)}`), {
+        method: "POST",
+        headers: headers(false)
+      });
+      const body = await readJson(r, `retryDeadLetter ${id}`);
+      const retried = body.retried?.find((entry) => entry.intentId === id) ?? body.retried?.[0];
+      if (retried) return { ok: true, ...retried.head ? { head: retried.head } : {} };
+      const failed = body.failed?.find((entry) => entry.intentId === id) ?? body.failed?.[0];
+      return { ok: false, error: failed?.error ?? `dead letter '${id}' was not retried` };
+    },
+    discardDeadLetter: async (id) => {
+      const r = await _fetch(wsUrl(`/dead-letters?id=${encodeURIComponent(id)}`), {
+        method: "DELETE",
+        headers: headers(false)
+      });
+      const body = await readJson(r, `discardDeadLetter ${id}`);
+      return { ok: true, removed: Number(body.discarded ?? body.removed ?? 0) };
+    },
+    watch: (queryId, params, cb, o) => poll(() => query3(queryId, params), cb, o?.intervalMs ?? defaultInterval),
+    watchById: (aggregateId, cb, o) => poll(() => queryById(aggregateId), cb, o?.intervalMs ?? defaultInterval),
+    /** The workspace's kernel-derived OpenAPI — the code-mode agent's map. */
+    openapi: () => getRead(`/openapi.json`, "openapi")
+  };
+}
+var nodeBuffer, RemoteOfferRefusedError, b64;
+var init_remote_holon = __esm({
+  "../cloud/web-client/src/remote_holon.ts"() {
+    "use strict";
+    init_intent_offer_codec();
+    nodeBuffer = () => globalThis.Buffer;
+    RemoteOfferRefusedError = class extends Error {
+      refused = true;
+      status;
+      constructor(message, status2) {
+        super(message);
+        this.name = "RemoteOfferRefusedError";
+        this.status = status2;
+      }
+    };
+    b64 = (bytes) => {
+      let s = "";
+      for (let i = 0; i < bytes.length; i += 32768) {
+        s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+      }
+      if (typeof btoa === "function") return btoa(s);
+      const buffer = nodeBuffer();
+      if (buffer) return buffer.from(bytes).toString("base64");
+      throw new Error("base64 encoding is unavailable in this runtime");
+    };
+  }
+});
+
 // ../cloud/web-client/src/index.ts
 var src_exports = {};
 __export(src_exports, {
@@ -5385,12 +5573,14 @@ __export(src_exports, {
   OfferDecisionError: () => OfferDecisionError,
   OwnedRecoveryPendingError: () => OwnedRecoveryPendingError,
   ParentSignerEnrollmentMissingError: () => ParentSignerEnrollmentMissingError,
+  RemoteOfferRefusedError: () => RemoteOfferRefusedError,
   assessKernelCoherence: () => assessKernelCoherence,
   authzDiagnosisFromRefusal: () => authzDiagnosisFromRefusal,
   birthOutcomeFailure: () => birthOutcomeFailure,
   canonicalPrincipal: () => canonicalPrincipal,
   checkCompat: () => checkCompat,
   connect: () => connect,
+  connectRemote: () => connectRemote,
   createWasmEnginePlane: () => createWasmEnginePlane,
   createWasmKernelProvider: () => createWasmKernelProvider,
   deriveWorkspaceName: () => deriveWorkspaceName,
@@ -5457,18 +5647,6 @@ function normalizeReferenceVersionTransport(refs) {
   }
   return { unique, order };
 }
-function encodeIntentOfferBytes({ domain, directiveId, payload, domainHash, security, actor }) {
-  const envelope = { v: 2, intent: { domain, directiveId, payload, domainHash } };
-  const securitySidecar = security && typeof security === "object" && !Array.isArray(security) ? { ...security } : {};
-  if (actor) securitySidecar.actor = actor;
-  if (typeof securitySidecar.actor === "string") {
-    const a = securitySidecar.actor.trim();
-    if (a) securitySidecar.actor = a;
-    else delete securitySidecar.actor;
-  }
-  if (Object.keys(securitySidecar).length > 0) envelope.security = securitySidecar;
-  return enc4.encode(JSON.stringify(envelope));
-}
 function decodeIntentOfferBytes(intentBytes) {
   const bytes = typeof intentBytes === "string" ? bytesUnb64(intentBytes) : intentBytes;
   if (!(bytes instanceof Uint8Array)) throw new Error("offer requires opaque intentBytes");
@@ -6360,13 +6538,13 @@ ${String(commit).toLowerCase()}`;
     }, _fetch);
     return { ref: sessionRef, bytes: pack.byteLength };
   }
-  const b64 = (bytes) => {
+  const b642 = (bytes) => {
     let s = "";
     for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode.apply(null, Array.from(bytes.subarray(i, i + 32768)));
     return btoa(s);
   };
   const unb64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
-  const { readDlq, writeDlq, deadLetter } = createDeadLetters({ provider, enc: enc4, dec: dec4, b64 });
+  const { readDlq, writeDlq, deadLetter } = createDeadLetters({ provider, enc: enc4, dec: dec4, b64: b642 });
   const edgeRefused = /* @__PURE__ */ new Set();
   async function pullInner(edgeRejections = null, prefetchedHead = null, opts = {}) {
     let remoteHead = prefetchedHead;
@@ -7061,7 +7239,7 @@ ${String(commit).toLowerCase()}`;
       if (returnSealed) {
         const d = res.intentOut && provider.readWsFile(res.intentOut);
         if (!d) throw new Error(`sealed offer: the author produced no sealed intent bytes (intentOut=${res.intentOut ?? "?"})`);
-        sealedB64 = b64(d);
+        sealedB64 = b642(d);
       }
       let created = null;
       let affected = null;
@@ -9829,7 +10007,7 @@ ${String(commit).toLowerCase()}`;
      *  wasm decodes the id's route tag and resolves its folded shard map. Returns `{ ok, tag, shard }`
      *  (`shard:""` = a known-tag but unplaced home; `tag:null` = not a route-tagged id). The routed wrapper
      *  uses this to CARRY an offer to the right shard — the DECISION is the holon's, the client only carries. */
-    route: (id) => serialize(async () => JSON.parse(call("query", { queryBytes: b64(enc4.encode(JSON.stringify({ op: "route", id }))) }))),
+    route: (id) => serialize(async () => JSON.parse(call("query", { queryBytes: b642(enc4.encode(JSON.stringify({ op: "route", id }))) }))),
     /** The PLANNED-PAYLOAD write surface (domain/directiveId/payload) — the routed wrapper delegates to this
      *  on the resolved shard (the CARRY, not a decision; routing is `route(id)`, the holon's). */
     dispatch: (domain, directiveId, payload, opts = {}) => offerDirective(domain, directiveId, payload, opts),
@@ -11364,10 +11542,13 @@ var init_src2 = __esm({
     init_governance_offers();
     init_serialized_scheduler();
     init_kernel_pb();
+    init_intent_offer_codec();
+    init_intent_offer_codec();
     init_kernel_provider_wasm();
     init_errors();
     init_principal();
     init_kernel_coherence();
+    init_remote_holon();
     enc4 = new TextEncoder();
     dec4 = new TextDecoder();
     BRANCH = "main";
@@ -11410,8 +11591,8 @@ var init_src2 = __esm({
     jwtClaim = (token, claim) => {
       try {
         const seg = String(token).split(".")[1];
-        const b64 = seg.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((seg.length + 3) % 4);
-        return JSON.parse(new TextDecoder().decode(bytesUnb64(b64)))[claim];
+        const b642 = seg.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((seg.length + 3) % 4);
+        return JSON.parse(new TextDecoder().decode(bytesUnb64(b642)))[claim];
       } catch {
         return void 0;
       }
@@ -11768,7 +11949,10 @@ var init_custody_transport2 = __esm({
 // vendor/engine/managed-promotion.ts
 function prepareManagedPromotion2(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -12310,17 +12494,18 @@ function offerResult(response) {
   }
 }
 function applicationQueryProto(eng, ws, query3, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng.ex, {
     case: "query",
     value: create2(QueryRequestSchema2, {
       target: protoTarget2(ws, options.branch ?? BRANCH2),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query3
     })
@@ -15150,7 +15335,7 @@ var init_engine = __esm({
       }))
     });
     repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
-    bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+    bytesFromB64 = (b642) => Uint8Array.from(atob(b642), (c) => c.charCodeAt(0));
     kgit = {
       // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
       resolveRef: (eng, gitdir, ref) => custodyProtoCase(eng, {
@@ -15439,12 +15624,10 @@ var init_engine = __esm({
       const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
       const derived = namedQueryProto(eng, workspace, QueryOperation2.CRYPTO_OWNED_SCOPE_KEY, {
         custodyWorkspace: workspace,
-        principal,
-        authorSecret,
         scope,
         ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
         ...recordWrap === void 0 ? {} : { recordWrap }
-      });
+      }, { principal, authorSecret });
       const ownedKeySubject = String(derived.ownedKeySubject || "");
       if (!requireSeat) {
         return {
@@ -15461,7 +15644,16 @@ var init_engine = __esm({
         let hex = "";
         for (const byte of enc7.encode(principal)) hex += byte.toString(16).padStart(2, "0");
         const object = `nomos-owned-principal:${hex || "00"}`;
-        const rows = qById(eng, workspace, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+        const rows = qById(
+          eng,
+          workspace,
+          `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`,
+          principal,
+          [],
+          "",
+          0,
+          authorSecret
+        );
         const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
         const leaves = row?.data?.subjects ?? row?.subjects ?? {};
         const leaf = (raw) => {
@@ -15492,14 +15684,12 @@ var init_engine = __esm({
         const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
         if (!custody) throw new Error("the approved device has no owned-data handoff");
         const opened = namedQueryProto(eng, workspace, QueryOperation2.CRYPTO_OWNED_SCOPE_KEY, {
-          workspace,
-          principal,
-          authorSecret,
+          custodyWorkspace: workspace,
           scope,
           ownedCustody: custody,
           ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
           ...recordWrap === void 0 ? {} : { recordWrap }
-        });
+        }, { principal, authorSecret });
         return {
           scope: String(opened.scope || scope),
           epoch: Number(opened.epoch) || 0,
@@ -15520,11 +15710,8 @@ var init_engine = __esm({
       };
     };
     cryptoOwnedDeviceRequest = (eng, workspace, principal, authorSecret, scope) => String(namedQueryProto(eng, workspace, QueryOperation2.CRYPTO_OWNED_DEVICE_REQUEST, {
-      workspace,
-      principal,
-      authorSecret,
       scope
-    }).request || "");
+    }, { principal, authorSecret }).request || "");
     cryptoOwnedPrepareApproval = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation2.CRYPTO_OWNED_PREPARE_APPROVAL, args);
     cryptoOwnedPrepareRecovery = (eng, args) => namedQueryProto(eng, args.workspace, QueryOperation2.CRYPTO_OWNED_PREPARE_RECOVERY, args);
     cryptoKeygen = (eng) => namedQueryProto(eng, "root", QueryOperation2.CRYPTO_KEYGEN);
@@ -15562,7 +15749,10 @@ var init_engine = __esm({
       ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
       ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
     }).cert;
-    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => namedQueryProto(eng, "root", QueryOperation2.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+    cryptoWrapKey = (eng, { recipientPub, scopeKey }) => {
+      const result = namedQueryProto(eng, "root", QueryOperation2.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+      return { hpkeEpk: String(result.hpkeEpk ?? ""), ct: String(result.ct ?? "") };
+    };
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => namedQueryProto(eng, "root", QueryOperation2.CRYPTO_UNWRAP_KEY, { secret, hpkeEpk, ct }).scopeKey;
     readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
       eng,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.105.6",
+  "version": "0.105.8",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
     "@bufbuild/protobuf": "^2.13.0",
-    "@githolon/dsl": "^0.105.6",
+    "@githolon/dsl": "^0.105.8",
     "isomorphic-git": "^1.38.4",
     "tsx": "^4.19.2"
   },