githolon 0.14.0 → 0.16.0

package/dist/cli.mjs

@@ -449,12 +449,164 @@ var init_tree = __esm({
   }
 });
 
+// vendor/engine/custody-transport.mjs
+function concatBytes(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  const out10 = new Uint8Array(n);
+  let o = 0;
+  for (const c of chunks) {
+    out10.set(c, o);
+    o += c.length;
+  }
+  return out10;
+}
+function pkt(payload) {
+  const body = typeof payload === "string" ? enc2.encode(payload) : payload;
+  const len = (body.length + 4).toString(16).padStart(4, "0");
+  return concatBytes([enc2.encode(len), body]);
+}
+function readPktLines(buf, off = 0) {
+  const lines = [];
+  while (off + 4 <= buf.length) {
+    const hex = dec2.decode(buf.subarray(off, off + 4));
+    if (!/^[0-9a-f]{4}$/.test(hex)) break;
+    const len = parseInt(hex, 16);
+    if (len === 0) {
+      off += 4;
+      break;
+    }
+    if (len < 4 || off + len > buf.length) break;
+    lines.push(buf.subarray(off + 4, off + len));
+    off += len;
+  }
+  return { lines, rest: off };
+}
+async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) {
+  const r = await fetch(`${remote}/info/refs?service=${service}`, { headers });
+  if (!r.ok) {
+    if (r.status === 404) return {};
+    throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  }
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const banner = readPktLines(buf, 0);
+  const { lines } = readPktLines(buf, banner.rest);
+  const refs = {};
+  for (const line of lines) {
+    let s = dec2.decode(line).replace(/\n$/, "");
+    if (s.startsWith("#")) continue;
+    const nul = s.indexOf("\0");
+    if (nul >= 0) s = s.slice(0, nul);
+    const sp = s.indexOf(" ");
+    if (sp !== 40) continue;
+    const oid = s.slice(0, 40), name = s.slice(41);
+    if (!/^[0-9a-f]{40}$/.test(oid)) continue;
+    if (prefix && !name.startsWith(prefix)) continue;
+    refs[name] = oid;
+  }
+  return refs;
+}
+async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
+  if (!wants.length) return null;
+  const caps = "thin-pack ofs-delta agent=nomos-cloud";
+  const parts = [];
+  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
+`)));
+  parts.push(FLUSH);
+  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
+`));
+  parts.push(pkt("done\n"));
+  const r = await fetch(`${remote}/git-upload-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
+    body: concatBytes(parts)
+  });
+  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const { lines, rest } = readPktLines(buf, 0);
+  const packChunks = [];
+  let sideband = false;
+  for (const line of lines) {
+    if (line.length === 0) continue;
+    const head = dec2.decode(line.subarray(0, Math.min(line.length, 3)));
+    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
+    const band = line[0];
+    if (band === 1) {
+      packChunks.push(line.subarray(1));
+      sideband = true;
+    } else if (band === 2) {
+    } else if (band === 3) {
+      throw new Error("upload-pack fatal: " + dec2.decode(line.subarray(1)).slice(0, 180));
+    }
+  }
+  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
+  if (pack.length < 12 || dec2.decode(pack.subarray(0, 4)) !== "PACK") {
+    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
+  }
+  return pack;
+}
+var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
+var init_custody_transport = __esm({
+  "vendor/engine/custody-transport.mjs"() {
+    "use strict";
+    enc2 = new TextEncoder();
+    dec2 = new TextDecoder();
+    ZERO_OID = "0".repeat(40);
+    EMPTY_PACK = new Uint8Array([
+      80,
+      65,
+      67,
+      75,
+      0,
+      0,
+      0,
+      2,
+      0,
+      0,
+      0,
+      0,
+      // "PACK", ver 2, 0 objects
+      2,
+      157,
+      8,
+      130,
+      59,
+      216,
+      168,
+      234,
+      181,
+      16,
+      173,
+      106,
+      // sha1(the 12 header bytes)
+      199,
+      92,
+      130,
+      60,
+      253,
+      62,
+      211,
+      30
+    ]);
+    FLUSH = enc2.encode("0000");
+  }
+});
+
 // vendor/engine/engine.mjs
 import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
-import git from "isomorphic-git";
-import http from "isomorphic-git/http/web";
+function b64Bytes(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(s);
+}
+function b64Json(o) {
+  return b64Bytes(enc3.encode(JSON.stringify(o)));
+}
 async function sha256hex(t) {
-  const b = await crypto.subtle.digest("SHA-256", enc2.encode(t));
+  const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
   return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
 }
 function osEntropyBuffer(n) {
@@ -472,7 +624,7 @@ function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
 }
 function call(ex, mode, fields, STDERR) {
-  const req = enc2.encode(JSON.stringify({ mode, ...fields }));
+  const req = enc3.encode(JSON.stringify({ mode, ...fields }));
   const reqPtr = ex.git_holon_alloc(req.length);
   try {
     new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
@@ -485,7 +637,7 @@ function call(ex, mode, fields, STDERR) {
     }
     const { ptr, len } = unpack(packed);
     try {
-      const e = JSON.parse(dec2.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
+      const e = JSON.parse(dec3.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
       if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
       return e.result;
     } finally {
@@ -495,15 +647,10 @@ function call(ex, mode, fields, STDERR) {
     ex.git_holon_dealloc(reqPtr, req.length);
   }
 }
-function seedManifests(m, strings) {
-  m.set("domain_manifests.json", new File(enc2.encode(strings.read)));
-  m.set("identity-manifests.json", new File(enc2.encode(strings.identity)));
-}
-async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, manifestStrings, replica, installedBy = "nomos-cloud" }) {
+async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy = "nomos-cloud" }) {
   const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
   const root = /* @__PURE__ */ new Map();
-  seedManifests(root, manifestStrings);
-  root.set("domain.package.usda", new File(enc2.encode(bootstrapPkg)));
+  root.set("domain.package.usda", new File(enc3.encode(bootstrapPkg)));
   root.set("ws", new Directory(/* @__PURE__ */ new Map()));
   const preopen = new PreopenDirectory("/work", root);
   const STDERR = [];
@@ -523,75 +670,35 @@ async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, manifestString
     hashes,
     bootstrapPkg,
     nomosPkg,
-    manifestStrings,
     installedBy,
     fs: makeGitFs(preopen, "/work", { File, Directory }),
     mounted: /* @__PURE__ */ new Map(),
     // ws -> { restored, remoteMain, restoreError }
-    mainIntents: /* @__PURE__ */ new Map(),
+    mainIntents: /* @__PURE__ */ new Map()
     // ws -> { head, ids:Set, oids:Set } (admission idempotence)
-    knownDomainsCache: null
   };
   return eng;
 }
-function setManifests(eng, strings) {
-  eng.manifestStrings = strings;
-  eng.knownDomainsCache = null;
-  eng.directiveRoutesCache = null;
-  eng.scopedReadsCache = null;
-  eng.placementDirectivesCache = null;
-  eng.tenantTypesCache = null;
-  eng.globalAggregatesCache = null;
-  const root = eng.preopen.dir.contents;
-  seedManifests(root, strings);
-  const wsRoot = root.get("ws");
-  for (const ws of eng.mounted.keys()) {
-    const wsDir = wsRoot.contents.get(ws);
-    if (wsDir) seedManifests(wsDir.contents, strings);
-  }
-}
 function stageWorkspaceDir(eng, ws) {
   const wsContents = /* @__PURE__ */ new Map();
-  seedManifests(wsContents, eng.manifestStrings);
   eng.preopen.dir.contents.get("ws").contents.set(ws, new Directory(wsContents));
 }
 async function mountWorkspace(eng, ws, ledger) {
   if (eng.mounted.has(ws)) return eng.mounted.get(ws);
   stageWorkspaceDir(eng, ws);
   const gitdir = gitdirOf(ws);
-  let restored = false, remoteMain = null, restoreError = null, checkpoint = null;
+  let restored = false, remoteMain = null, restoreError = null;
   try {
-    const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
-    remoteMain = info.refs && info.refs.heads && info.refs.heads.main || null;
+    await custodySkeleton(eng, gitdir);
+    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
     if (remoteMain) {
-      await git.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: "main" });
-      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-      const ckpt = await discoverCheckpointFromCustody(ledger).catch(() => null);
-      let shallowOk = false;
-      if (ckpt?.cursor && ckpt.frontier) {
-        const steps = [32, 96, 256, 1024];
-        for (let i = 0; i < steps.length; i++) {
-          const depth = steps[i], relative = i > 0;
-          await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, depth, relative, headers: ledger.headers });
-          if (await git.readCommit({ fs: eng.fs, gitdir, oid: ckpt.cursor }).then(() => true, () => false)) {
-            shallowOk = true;
-            break;
-          }
-        }
-      }
-      if (!shallowOk) await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, headers: ledger.headers });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "refs/heads/main", value: remoteMain, force: true });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: "ref: refs/heads/main", force: true, symbolic: true });
-      if (shallowOk && ckpt?.blob) {
-        const r = importCheckpoint(eng, ws, ckpt.blob, ckpt.frontier);
-        checkpoint = { restored: !!(r && r.restored), frontierSeeded: !!(r && r.frontierSeeded), cursor: r && r.cursor ? r.cursor : ckpt.cursor, ref: ckpt.ref };
-      }
+      kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
       restored = true;
     }
   } catch (e) {
     restoreError = String(e && e.stack || e).split("\n").slice(0, 5).join(" | ");
   }
-  const m = { restored, remoteMain, restoreError, checkpoint };
+  const m = { restored, remoteMain, restoreError };
   eng.mounted.set(ws, m);
   return m;
 }
@@ -610,95 +717,69 @@ function mintId(eng, typeTag) {
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
-  writeWork(eng, `payload-${seq}.json`, enc2.encode(JSON.stringify(payload)));
-  writeWork(eng, `envelope-${seq}.json`, enc2.encode(stringifyBig(envelope)));
+  writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
+  writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
   const defer = opts.deferProjection !== false;
-  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
-function importCheckpoint(eng, ws, blobB64, frontierB64) {
-  return JSON.parse(call(eng.ex, "checkpoint_import", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH, blob: blobB64, ...frontierB64 ? { frontier: frontierB64 } : {} }, eng.STDERR));
-}
-async function streamAll(stream) {
-  const chunks = [];
-  const reader = stream.getReader();
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    chunks.push(value);
-  }
-  let len = 0;
-  for (const c of chunks) len += c.length;
-  const out10 = new Uint8Array(len);
-  let at = 0;
-  for (const c of chunks) {
-    out10.set(c, at);
-    at += c.length;
-  }
-  return out10;
-}
-async function gunzip(bytes) {
-  const ds = new DecompressionStream("gzip");
-  return streamAll(new Response(bytes).body.pipeThrough(ds));
-}
-async function discoverCheckpointFromCustody(ledger) {
-  const freshHeaders = () => ({ ...ledger.headers || {} });
-  const refs = (await git.listServerRefs({ http, url: ledger.remote, headers: freshHeaders(), prefix: "refs/meta/checkpoint/", protocolVersion: 2 }) || []).filter((r) => r.ref && r.ref.startsWith("refs/meta/checkpoint/") && r.oid);
-  if (!refs.length) return null;
-  const root = /* @__PURE__ */ new Map();
-  root.set("ckpt", new Directory(/* @__PURE__ */ new Map()));
-  const preopen = new PreopenDirectory("/work", root);
-  const fs = makeGitFs(preopen, "/work", { File, Directory });
-  const gitdir = "/work/ckpt/nomos.git";
-  await git.init({ fs, gitdir, bare: true, defaultBranch: BRANCH });
-  await git.addRemote({ fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-  const readFile = async (oid, filepath) => {
-    try {
-      return (await git.readBlob({ fs, gitdir, oid, filepath })).blob;
-    } catch {
-      return null;
-    }
-  };
-  for (let i = refs.length - 1; i >= 0 && i >= refs.length - 3; i--) {
-    const { ref, oid } = refs[i];
+async function custodySkeleton(eng, gitdir) {
+  const p = eng.fs.promises;
+  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
     try {
-      await git.fetch({ fs, http, gitdir, remote: "origin", ref, singleBranch: true, depth: 1, headers: freshHeaders() });
-      const gz = await readFile(oid, "checkpoint");
-      if (!gz) continue;
-      let meta = {};
-      try {
-        const mb = await readFile(oid, "meta");
-        if (mb) meta = JSON.parse(dec2.decode(mb));
-      } catch {
-      }
-      const codec = meta.codec ?? "gzip";
-      const blob = dec2.decode(codec === "gzip" ? await gunzip(gz) : gz);
-      const fgz = await readFile(oid, "frontier");
-      const frontier = fgz ? dec2.decode(codec === "gzip" ? await gunzip(fgz) : fgz) : null;
-      return { ref, oid, cursor: meta.cursor || null, blob, frontier };
-    } catch {
+      await p.mkdir(`${gitdir}${d}`);
+    } catch (e) {
+      if (e && e.code !== "EEXIST") throw e;
     }
   }
-  return null;
+  try {
+    await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}
+`);
+  } catch {
+  }
+  try {
+    await p.writeFile(`${gitdir}/config`, "[core]\n	repositoryformatversion = 0\n	bare = true\n");
+  } catch {
+  }
+}
+async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
+  const remoteRefFull = fullRef(remoteRef);
+  const refs = await custodyLsRefs(ledger, remoteRefFull);
+  const tip = refs[remoteRefFull] || null;
+  if (!tip) return null;
+  if (tip !== have) applyPackInto(eng, ws, await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] }));
+  kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  return tip;
 }
-function applyIntentBytes(eng, ws, bytes) {
-  const name = `intent-in-${eng.seq++}.json`;
+function offerIntent(eng, ws, bytes, opts) {
+  const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
-  return JSON.parse(call(eng.ex, "apply_intent", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch: BRANCH }, eng.STDERR));
+  const deferProjection = !!(opts && opts.defer);
+  const branch = opts && opts.branch || BRANCH;
+  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
+}
+function offerAdmit(eng, ws, bytes, opts) {
+  const v = offerIntent(eng, ws, bytes, opts);
+  return v.outcome === "admitted" ? { ok: true, head: v.head } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+}
+function applyIntentBytes(eng, ws, bytes, opts) {
+  return offerAdmit(eng, ws, bytes, opts);
 }
 function verifyChainLocal(eng, ws) {
-  return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
-var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, cryptoUnwrapKey, count, sum;
+var enc3, dec3, BRANCH, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
     init_git_fs();
     init_tree();
-    enc2 = new TextEncoder();
-    dec2 = new TextDecoder();
+    init_custody_transport();
+    enc3 = new TextEncoder();
+    dec3 = new TextDecoder();
     BRANCH = "main";
     repoArgOf = (ws) => `/work/ws/${ws}`;
     gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
@@ -706,12 +787,49 @@ var init_engine = __esm({
       const v = typeof p === "bigint" ? p : BigInt(p);
       return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
     };
+    repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
+    bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+    kgit = {
+      // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
+      resolveRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)).oid,
+      // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
+      readBlob: (eng, gitdir, oid, path) => {
+        const r = JSON.parse(call(eng.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path }, eng.STDERR));
+        return r.ok ? bytesFromB64(r.blobB64) : null;
+      },
+      // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+      // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
+      intentsAbove: (eng, gitdir, head, base = "", limit = 0) => JSON.parse(call(eng.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng.STDERR)).intents,
+      // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
+      listRefs: (eng, gitdir, prefix) => JSON.parse(call(eng.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng.STDERR)).refs,
+      // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
+      writeRef: (eng, gitdir, ref, value) => JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
+      // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
+      deleteRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
+      // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
+      // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
+      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng.ex, "write_meta_commit", {
+        repoArg: repoArgOfGitdir(gitdir),
+        parents,
+        files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
+        message,
+        timeSecs,
+        ref
+      }, eng.STDERR)).oid
+    };
     installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
-    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
-    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+    fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
+    applyPackInto = (eng, ws, pack) => {
+      if (!pack || !pack.length) return;
+      const r = JSON.parse(call(eng.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng.STDERR));
+      if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
+    };
+    custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
+    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
-    count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
-    sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
+    count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+    sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
   }
 });
 
@@ -740,9 +858,8 @@ async function fetchRuntime(cloud) {
   const localWasm = process.env["NOMOS_LOCAL_WASM"];
   if (localWasm) {
     const bytes = readFileSync2(localWasm);
-    const manifests2 = await fetchJsonCached(`${cloud}/v1/runtime/manifests`, join4(cache, "manifests.json"));
     const packages2 = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join4(cache, "packages.json"));
-    return { wasmBytes: bytes, manifests: manifests2, packages: packages2 };
+    return { wasmBytes: bytes, packages: packages2 };
   }
   try {
     const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
@@ -754,25 +871,8 @@ async function fetchRuntime(cloud) {
     if (!existsSync3(wasmCache)) throw e;
     wasmBytes = readFileSync2(wasmCache);
   }
-  const manifests = await fetchJsonCached(`${cloud}/v1/runtime/manifests`, join4(cache, "manifests.json"));
   const packages = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join4(cache, "packages.json"));
-  return { wasmBytes, manifests, packages };
-}
-function mergeManifests(baked, overlay) {
-  const read = JSON.parse(baked.domainManifests);
-  const identity = JSON.parse(baked.identityManifests);
-  for (const [k, v] of Object.entries(overlay.identityManifests ?? {})) identity[k] = v;
-  const r = overlay.readManifest;
-  if (r !== void 0) {
-    for (const [t, schema] of Object.entries(r["aggregateFieldKinds"] ?? {})) read["aggregateFieldKinds"][t] = schema;
-    for (const key of ["queries", "counts", "sums", "mins", "maxes", "spatials", "deriveds", "combineds"]) {
-      for (const d of r[key] ?? []) {
-        const list = read[key] = read[key] ?? [];
-        if (!list.some((x) => JSON.stringify(x) === JSON.stringify(d))) list.push(d);
-      }
-    }
-  }
-  return { read: JSON.stringify(read), identity: JSON.stringify(identity) };
+  return { wasmBytes, packages };
 }
 function writeTreeToDisk(dir, diskPath) {
   mkdirSync3(diskPath, { recursive: true });
@@ -793,13 +893,11 @@ function readTreeFromDisk(diskPath) {
 }
 async function holonEngine(cloud, overlay, installedBy) {
   const runtime = await fetchRuntime(cloud);
-  const manifestStrings = overlay === void 0 ? { read: runtime.manifests.domainManifests, identity: runtime.manifests.identityManifests } : mergeManifests(runtime.manifests, overlay);
   const replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
   const eng = await createEngine({
     wasmModule: await WebAssembly.compile(runtime.wasmBytes),
     bootstrapPkg: runtime.packages.bootstrap,
     nomosPkg: runtime.packages.nomos,
-    manifestStrings,
     replica,
     installedBy
   });
@@ -1365,10 +1463,10 @@ function compileAsync(cwd, args = []) {
   }
   return new Promise((resolveRun) => {
     const chunks = [];
-    const dec3 = new TextDecoder();
+    const dec4 = new TextDecoder();
     const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    child.stdout?.on("data", (c) => chunks.push(dec3.decode(c)));
-    child.stderr?.on("data", (c) => chunks.push(dec3.decode(c)));
+    child.stdout?.on("data", (c) => chunks.push(dec4.decode(c)));
+    child.stderr?.on("data", (c) => chunks.push(dec4.decode(c)));
     child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
     child.on(
       "close",
@@ -1534,8 +1632,8 @@ function startServer(s) {
           req.on("data", (c) => chunks.push(c));
           req.on("end", () => {
             try {
-              const dec3 = new TextDecoder();
-              const body = chunks.map((c) => dec3.decode(c)).join("") || "{}";
+              const dec4 = new TextDecoder();
+              const body = chunks.map((c) => dec4.decode(c)).join("") || "{}";
               const r = author(s.eng, WS, decodeURIComponent(dispatch[1]), decodeURIComponent(dispatch[2]), JSON.parse(body), s.lawHash);
               if (r["ok"] === false) return respond(422, { ok: false, error: r["error"] });
               s.intents++;
@@ -1567,12 +1665,9 @@ function readDeployBody(cwd, packageName) {
 async function installLaw(s, deployBody, installedBy) {
   const newHash = await sha256hex(deployBody.packageUsda);
   if (newHash === s.lawHash) return { ok: true };
-  const previous = { ...s.eng.manifestStrings };
   const t0 = performance.now();
-  setManifests(s.eng, mergeManifests(s.runtime.manifests, deployBody));
   const res = author(s.eng, WS, "nomos", "installDomain", installPayload(newHash, deployBody.packageUsda, installedBy), s.eng.hashes.nomos);
   if (res.ok === false) {
-    setManifests(s.eng, previous);
     return { ok: false, error: `law install refused: ${res.error ?? "unknown"} \u2014 the previous law (${s.lawHash.slice(0, 12)}\u2026) keeps serving; fix and save again` };
   }
   s.lawHash = newHash;
@@ -1756,7 +1851,7 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
 var out5 = (s) => void process.stdout.write(s + "\n");
 var err5 = (s) => void process.stderr.write("error: " + s + "\n");
-function git2(args, opts = {}) {
+function git(args, opts = {}) {
   const r = spawnSync3("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
   return r.status ?? 1;
 }
@@ -1800,7 +1895,7 @@ async function gitSetup(opts) {
     return 1;
   }
   const helper = `!"${process.execPath}" "${self}" git-credential`;
-  if (git2(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git2(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
+  if (git(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
     err5("git config failed \u2014 is git installed?");
     return 1;
   }
@@ -1810,7 +1905,7 @@ async function gitSetup(opts) {
 }
 async function gitRemote(ws, name, opts) {
   const cloud = cloudBase(opts.cloud);
-  if (git2(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
+  if (git(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
     err5("not a git repository \u2014 run inside your repo (git init first)");
     return 1;
   }
@@ -1818,8 +1913,8 @@ async function gitRemote(ws, name, opts) {
   if (setupRc !== 0) return setupRc;
   ensureSecret(cloud, ws);
   const url = `${cloud}/v1/workspaces/${ws}/git`;
-  if (git2(["remote", "add", name, url], { quiet: true }) !== 0) {
-    if (git2(["remote", "set-url", name, url], { quiet: true }) !== 0) {
+  if (git(["remote", "add", name, url], { quiet: true }) !== 0) {
+    if (git(["remote", "set-url", name, url], { quiet: true }) !== 0) {
       err5(`could not add or update remote '${name}'`);
       return 1;
     }
@@ -1835,7 +1930,7 @@ async function gitRemote(ws, name, opts) {
       );
       return 1;
     }
-    if (git2(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
+    if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
       err5("git config failed setting the principal header");
       return 1;
     }
@@ -1850,7 +1945,7 @@ async function gitRemote(ws, name, opts) {
 var HELP = {
   compile: {
     usage: "githolon compile [config] [--layered]",
-    what: "Compile the package by ./nomos.package.mjs (the @githolon/dsl launcher): ONE deterministic\n.package.usda (sha256 = the law's content hash) + read/identity manifests + the deploy body +\nthe typed TS client + the generated proof \u2014 all into build/.",
+    what: "Compile the package by ./nomos.package.mjs (the @githolon/dsl launcher): ONE deterministic\n.package.usda (sha256 = the law's content hash) + the deploy body +\nthe typed TS client + the generated proof \u2014 all into build/.",
     flags: [
       ["[config]", "an alternate config file (default: nomos.package.mjs)"],
       ["--layered", "also emit the per-domain layered USD view"]
@@ -1884,7 +1979,7 @@ var HELP = {
       ["<ws|dir>", "a workspace name on the cloud, or a local holon directory (githolon ledger init)"],
       ["--step N", "non-interactive; print the running tallies every N intents"],
       ["--json", "one JSON line per step + the final verdict (pipe it)"],
-      ["--file <deploy.json>", "stage this deploy body's read manifests (default: the one in ./build)"]
+      ["--file <deploy.json>", "reserved for local package hints (default: the one in ./build)"]
     ],
     examples: ["githolon replay my-guestbook", "githolon replay ./my-holon --step 10", "githolon replay my-guestbook --json | jq .directive"]
   },
@@ -2057,9 +2152,9 @@ init_engine();
 init_engine();
 init_cloud();
 init_local_holon();
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
-import git3 from "isomorphic-git";
+import git2 from "isomorphic-git";
 var out7 = (s) => void process.stdout.write(s + "\n");
 var err7 = (s) => void process.stderr.write("error: " + s + "\n");
 var SOURCE = "source";
@@ -2114,12 +2209,12 @@ function typeOf(ev) {
 }
 async function walkChain(eng, ws) {
   const gitdir = gitdirOf(ws);
-  const dec3 = new TextDecoder();
+  const dec4 = new TextDecoder();
   const entries = [];
-  for (const c of await git3.log({ fs: eng.fs, gitdir, ref: "main" })) {
+  for (const c of await git2.log({ fs: eng.fs, gitdir, ref: "main" })) {
     try {
-      const { blob } = await git3.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
-      entries.push({ oid: c.oid, bytes: blob, doc: JSON.parse(dec3.decode(blob)) });
+      const { blob } = await git2.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
+      entries.push({ oid: c.oid, bytes: blob, doc: JSON.parse(dec4.decode(blob)) });
     } catch {
     }
   }
@@ -2147,15 +2242,9 @@ async function replay(target, opts) {
   const cloud = cloudBase(opts.cloud);
   const json = opts.json === true;
   const emit = (o) => out7(JSON.stringify(o));
-  let overlay;
-  try {
-    overlay = JSON.parse(readFileSync7(discoverDeployJson(process.cwd(), opts.file), "utf8"));
-  } catch {
-    overlay = void 0;
-  }
   let eng;
   try {
-    ({ eng } = await holonEngine(cloud, overlay, "githolon-replay"));
+    ({ eng } = await holonEngine(cloud, void 0, "githolon-replay"));
   } catch (e) {
     err7(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -10,7 +10,7 @@
     "directory": "cli"
   },
   "bin": {
-    "githolon": "./dist/cli.mjs"
+    "githolon": "dist/cli.mjs"
   },
   "files": [
     "dist"
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/dsl": "^0.14.0",
+    "@githolon/dsl": "^0.16.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {