githolon 0.15.0 → 0.16.0

package/dist/cli.mjs

@@ -449,12 +449,164 @@ var init_tree = __esm({
   }
 });
 
+// vendor/engine/custody-transport.mjs
+function concatBytes(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  const out10 = new Uint8Array(n);
+  let o = 0;
+  for (const c of chunks) {
+    out10.set(c, o);
+    o += c.length;
+  }
+  return out10;
+}
+function pkt(payload) {
+  const body = typeof payload === "string" ? enc2.encode(payload) : payload;
+  const len = (body.length + 4).toString(16).padStart(4, "0");
+  return concatBytes([enc2.encode(len), body]);
+}
+function readPktLines(buf, off = 0) {
+  const lines = [];
+  while (off + 4 <= buf.length) {
+    const hex = dec2.decode(buf.subarray(off, off + 4));
+    if (!/^[0-9a-f]{4}$/.test(hex)) break;
+    const len = parseInt(hex, 16);
+    if (len === 0) {
+      off += 4;
+      break;
+    }
+    if (len < 4 || off + len > buf.length) break;
+    lines.push(buf.subarray(off + 4, off + len));
+    off += len;
+  }
+  return { lines, rest: off };
+}
+async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) {
+  const r = await fetch(`${remote}/info/refs?service=${service}`, { headers });
+  if (!r.ok) {
+    if (r.status === 404) return {};
+    throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  }
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const banner = readPktLines(buf, 0);
+  const { lines } = readPktLines(buf, banner.rest);
+  const refs = {};
+  for (const line of lines) {
+    let s = dec2.decode(line).replace(/\n$/, "");
+    if (s.startsWith("#")) continue;
+    const nul = s.indexOf("\0");
+    if (nul >= 0) s = s.slice(0, nul);
+    const sp = s.indexOf(" ");
+    if (sp !== 40) continue;
+    const oid = s.slice(0, 40), name = s.slice(41);
+    if (!/^[0-9a-f]{40}$/.test(oid)) continue;
+    if (prefix && !name.startsWith(prefix)) continue;
+    refs[name] = oid;
+  }
+  return refs;
+}
+async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
+  if (!wants.length) return null;
+  const caps = "thin-pack ofs-delta agent=nomos-cloud";
+  const parts = [];
+  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
+`)));
+  parts.push(FLUSH);
+  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
+`));
+  parts.push(pkt("done\n"));
+  const r = await fetch(`${remote}/git-upload-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
+    body: concatBytes(parts)
+  });
+  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const { lines, rest } = readPktLines(buf, 0);
+  const packChunks = [];
+  let sideband = false;
+  for (const line of lines) {
+    if (line.length === 0) continue;
+    const head = dec2.decode(line.subarray(0, Math.min(line.length, 3)));
+    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
+    const band = line[0];
+    if (band === 1) {
+      packChunks.push(line.subarray(1));
+      sideband = true;
+    } else if (band === 2) {
+    } else if (band === 3) {
+      throw new Error("upload-pack fatal: " + dec2.decode(line.subarray(1)).slice(0, 180));
+    }
+  }
+  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
+  if (pack.length < 12 || dec2.decode(pack.subarray(0, 4)) !== "PACK") {
+    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
+  }
+  return pack;
+}
+var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
+var init_custody_transport = __esm({
+  "vendor/engine/custody-transport.mjs"() {
+    "use strict";
+    enc2 = new TextEncoder();
+    dec2 = new TextDecoder();
+    ZERO_OID = "0".repeat(40);
+    EMPTY_PACK = new Uint8Array([
+      80,
+      65,
+      67,
+      75,
+      0,
+      0,
+      0,
+      2,
+      0,
+      0,
+      0,
+      0,
+      // "PACK", ver 2, 0 objects
+      2,
+      157,
+      8,
+      130,
+      59,
+      216,
+      168,
+      234,
+      181,
+      16,
+      173,
+      106,
+      // sha1(the 12 header bytes)
+      199,
+      92,
+      130,
+      60,
+      253,
+      62,
+      211,
+      30
+    ]);
+    FLUSH = enc2.encode("0000");
+  }
+});
+
 // vendor/engine/engine.mjs
 import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
-import git from "isomorphic-git";
-import http from "isomorphic-git/http/web";
+function b64Bytes(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(s);
+}
+function b64Json(o) {
+  return b64Bytes(enc3.encode(JSON.stringify(o)));
+}
 async function sha256hex(t) {
-  const b = await crypto.subtle.digest("SHA-256", enc2.encode(t));
+  const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
   return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
 }
 function osEntropyBuffer(n) {
@@ -472,7 +624,7 @@ function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
 }
 function call(ex, mode, fields, STDERR) {
-  const req = enc2.encode(JSON.stringify({ mode, ...fields }));
+  const req = enc3.encode(JSON.stringify({ mode, ...fields }));
   const reqPtr = ex.git_holon_alloc(req.length);
   try {
     new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
@@ -485,7 +637,7 @@ function call(ex, mode, fields, STDERR) {
     }
     const { ptr, len } = unpack(packed);
     try {
-      const e = JSON.parse(dec2.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
+      const e = JSON.parse(dec3.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
       if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
       return e.result;
     } finally {
@@ -498,7 +650,7 @@ function call(ex, mode, fields, STDERR) {
 async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy = "nomos-cloud" }) {
   const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
   const root = /* @__PURE__ */ new Map();
-  root.set("domain.package.usda", new File(enc2.encode(bootstrapPkg)));
+  root.set("domain.package.usda", new File(enc3.encode(bootstrapPkg)));
   root.set("ws", new Directory(/* @__PURE__ */ new Map()));
   const preopen = new PreopenDirectory("/work", root);
   const STDERR = [];
@@ -535,39 +687,18 @@ async function mountWorkspace(eng, ws, ledger) {
   if (eng.mounted.has(ws)) return eng.mounted.get(ws);
   stageWorkspaceDir(eng, ws);
   const gitdir = gitdirOf(ws);
-  let restored = false, remoteMain = null, restoreError = null, checkpoint = null;
+  let restored = false, remoteMain = null, restoreError = null;
   try {
-    const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
-    remoteMain = info.refs && info.refs.heads && info.refs.heads.main || null;
+    await custodySkeleton(eng, gitdir);
+    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
     if (remoteMain) {
-      await git.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: "main" });
-      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-      const ckpt = await discoverCheckpointFromCustody(ledger).catch(() => null);
-      let shallowOk = false;
-      if (ckpt?.cursor && ckpt.frontier) {
-        const steps = [32, 96, 256, 1024];
-        for (let i = 0; i < steps.length; i++) {
-          const depth = steps[i], relative = i > 0;
-          await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, depth, relative, headers: ledger.headers });
-          if (await git.readCommit({ fs: eng.fs, gitdir, oid: ckpt.cursor }).then(() => true, () => false)) {
-            shallowOk = true;
-            break;
-          }
-        }
-      }
-      if (!shallowOk) await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, headers: ledger.headers });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "refs/heads/main", value: remoteMain, force: true });
-      await git.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: "ref: refs/heads/main", force: true, symbolic: true });
-      if (shallowOk && ckpt?.blob) {
-        const r = importCheckpoint(eng, ws, ckpt.blob, ckpt.frontier);
-        checkpoint = { restored: !!(r && r.restored), frontierSeeded: !!(r && r.frontierSeeded), cursor: r && r.cursor ? r.cursor : ckpt.cursor, ref: ckpt.ref };
-      }
+      kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
       restored = true;
     }
   } catch (e) {
     restoreError = String(e && e.stack || e).split("\n").slice(0, 5).join(" | ");
   }
-  const m = { restored, remoteMain, restoreError, checkpoint };
+  const m = { restored, remoteMain, restoreError };
   eng.mounted.set(ws, m);
   return m;
 }
@@ -586,95 +717,69 @@ function mintId(eng, typeTag) {
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
-  writeWork(eng, `payload-${seq}.json`, enc2.encode(JSON.stringify(payload)));
-  writeWork(eng, `envelope-${seq}.json`, enc2.encode(stringifyBig(envelope)));
+  writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
+  writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
   const defer = opts.deferProjection !== false;
-  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
-function importCheckpoint(eng, ws, blobB64, frontierB64) {
-  return JSON.parse(call(eng.ex, "checkpoint_import", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH, blob: blobB64, ...frontierB64 ? { frontier: frontierB64 } : {} }, eng.STDERR));
-}
-async function streamAll(stream) {
-  const chunks = [];
-  const reader = stream.getReader();
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    chunks.push(value);
-  }
-  let len = 0;
-  for (const c of chunks) len += c.length;
-  const out10 = new Uint8Array(len);
-  let at = 0;
-  for (const c of chunks) {
-    out10.set(c, at);
-    at += c.length;
-  }
-  return out10;
-}
-async function gunzip(bytes) {
-  const ds = new DecompressionStream("gzip");
-  return streamAll(new Response(bytes).body.pipeThrough(ds));
-}
-async function discoverCheckpointFromCustody(ledger) {
-  const freshHeaders = () => ({ ...ledger.headers || {} });
-  const refs = (await git.listServerRefs({ http, url: ledger.remote, headers: freshHeaders(), prefix: "refs/meta/checkpoint/", protocolVersion: 2 }) || []).filter((r) => r.ref && r.ref.startsWith("refs/meta/checkpoint/") && r.oid);
-  if (!refs.length) return null;
-  const root = /* @__PURE__ */ new Map();
-  root.set("ckpt", new Directory(/* @__PURE__ */ new Map()));
-  const preopen = new PreopenDirectory("/work", root);
-  const fs = makeGitFs(preopen, "/work", { File, Directory });
-  const gitdir = "/work/ckpt/nomos.git";
-  await git.init({ fs, gitdir, bare: true, defaultBranch: BRANCH });
-  await git.addRemote({ fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-  const readFile = async (oid, filepath) => {
+async function custodySkeleton(eng, gitdir) {
+  const p = eng.fs.promises;
+  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
     try {
-      return (await git.readBlob({ fs, gitdir, oid, filepath })).blob;
-    } catch {
-      return null;
-    }
-  };
-  for (let i = refs.length - 1; i >= 0 && i >= refs.length - 3; i--) {
-    const { ref, oid } = refs[i];
-    try {
-      await git.fetch({ fs, http, gitdir, remote: "origin", ref, singleBranch: true, depth: 1, headers: freshHeaders() });
-      const gz = await readFile(oid, "checkpoint");
-      if (!gz) continue;
-      let meta = {};
-      try {
-        const mb = await readFile(oid, "meta");
-        if (mb) meta = JSON.parse(dec2.decode(mb));
-      } catch {
-      }
-      const codec = meta.codec ?? "gzip";
-      const blob = dec2.decode(codec === "gzip" ? await gunzip(gz) : gz);
-      const fgz = await readFile(oid, "frontier");
-      const frontier = fgz ? dec2.decode(codec === "gzip" ? await gunzip(fgz) : fgz) : null;
-      return { ref, oid, cursor: meta.cursor || null, blob, frontier };
-    } catch {
+      await p.mkdir(`${gitdir}${d}`);
+    } catch (e) {
+      if (e && e.code !== "EEXIST") throw e;
     }
   }
-  return null;
+  try {
+    await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}
+`);
+  } catch {
+  }
+  try {
+    await p.writeFile(`${gitdir}/config`, "[core]\n	repositoryformatversion = 0\n	bare = true\n");
+  } catch {
+  }
 }
-function applyIntentBytes(eng, ws, bytes) {
-  const name = `intent-in-${eng.seq++}.json`;
+async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
+  const remoteRefFull = fullRef(remoteRef);
+  const refs = await custodyLsRefs(ledger, remoteRefFull);
+  const tip = refs[remoteRefFull] || null;
+  if (!tip) return null;
+  if (tip !== have) applyPackInto(eng, ws, await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] }));
+  kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  return tip;
+}
+function offerIntent(eng, ws, bytes, opts) {
+  const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
-  return JSON.parse(call(eng.ex, "apply_intent", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch: BRANCH }, eng.STDERR));
+  const deferProjection = !!(opts && opts.defer);
+  const branch = opts && opts.branch || BRANCH;
+  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
+}
+function offerAdmit(eng, ws, bytes, opts) {
+  const v = offerIntent(eng, ws, bytes, opts);
+  return v.outcome === "admitted" ? { ok: true, head: v.head } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+}
+function applyIntentBytes(eng, ws, bytes, opts) {
+  return offerAdmit(eng, ws, bytes, opts);
 }
 function verifyChainLocal(eng, ws) {
-  return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
-var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, cryptoUnwrapKey, count, sum;
+var enc3, dec3, BRANCH, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
     init_git_fs();
     init_tree();
-    enc2 = new TextEncoder();
-    dec2 = new TextDecoder();
+    init_custody_transport();
+    enc3 = new TextEncoder();
+    dec3 = new TextDecoder();
     BRANCH = "main";
     repoArgOf = (ws) => `/work/ws/${ws}`;
     gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
@@ -682,12 +787,49 @@ var init_engine = __esm({
       const v = typeof p === "bigint" ? p : BigInt(p);
       return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
     };
+    repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
+    bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+    kgit = {
+      // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
+      resolveRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)).oid,
+      // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
+      readBlob: (eng, gitdir, oid, path) => {
+        const r = JSON.parse(call(eng.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path }, eng.STDERR));
+        return r.ok ? bytesFromB64(r.blobB64) : null;
+      },
+      // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+      // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
+      intentsAbove: (eng, gitdir, head, base = "", limit = 0) => JSON.parse(call(eng.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng.STDERR)).intents,
+      // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
+      listRefs: (eng, gitdir, prefix) => JSON.parse(call(eng.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng.STDERR)).refs,
+      // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
+      writeRef: (eng, gitdir, ref, value) => JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
+      // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
+      deleteRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
+      // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
+      // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
+      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng.ex, "write_meta_commit", {
+        repoArg: repoArgOfGitdir(gitdir),
+        parents,
+        files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
+        message,
+        timeSecs,
+        ref
+      }, eng.STDERR)).oid
+    };
     installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
-    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
-    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+    fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
+    applyPackInto = (eng, ws, pack) => {
+      if (!pack || !pack.length) return;
+      const r = JSON.parse(call(eng.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng.STDERR));
+      if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
+    };
+    custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
+    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
-    count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
-    sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
+    count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+    sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
   }
 });
 
@@ -1321,10 +1463,10 @@ function compileAsync(cwd, args = []) {
   }
   return new Promise((resolveRun) => {
     const chunks = [];
-    const dec3 = new TextDecoder();
+    const dec4 = new TextDecoder();
     const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    child.stdout?.on("data", (c) => chunks.push(dec3.decode(c)));
-    child.stderr?.on("data", (c) => chunks.push(dec3.decode(c)));
+    child.stdout?.on("data", (c) => chunks.push(dec4.decode(c)));
+    child.stderr?.on("data", (c) => chunks.push(dec4.decode(c)));
     child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
     child.on(
       "close",
@@ -1490,8 +1632,8 @@ function startServer(s) {
           req.on("data", (c) => chunks.push(c));
           req.on("end", () => {
             try {
-              const dec3 = new TextDecoder();
-              const body = chunks.map((c) => dec3.decode(c)).join("") || "{}";
+              const dec4 = new TextDecoder();
+              const body = chunks.map((c) => dec4.decode(c)).join("") || "{}";
               const r = author(s.eng, WS, decodeURIComponent(dispatch[1]), decodeURIComponent(dispatch[2]), JSON.parse(body), s.lawHash);
               if (r["ok"] === false) return respond(422, { ok: false, error: r["error"] });
               s.intents++;
@@ -1709,7 +1851,7 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
 var out5 = (s) => void process.stdout.write(s + "\n");
 var err5 = (s) => void process.stderr.write("error: " + s + "\n");
-function git2(args, opts = {}) {
+function git(args, opts = {}) {
   const r = spawnSync3("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
   return r.status ?? 1;
 }
@@ -1753,7 +1895,7 @@ async function gitSetup(opts) {
     return 1;
   }
   const helper = `!"${process.execPath}" "${self}" git-credential`;
-  if (git2(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git2(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
+  if (git(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
     err5("git config failed \u2014 is git installed?");
     return 1;
   }
@@ -1763,7 +1905,7 @@ async function gitSetup(opts) {
 }
 async function gitRemote(ws, name, opts) {
   const cloud = cloudBase(opts.cloud);
-  if (git2(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
+  if (git(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
     err5("not a git repository \u2014 run inside your repo (git init first)");
     return 1;
   }
@@ -1771,8 +1913,8 @@ async function gitRemote(ws, name, opts) {
   if (setupRc !== 0) return setupRc;
   ensureSecret(cloud, ws);
   const url = `${cloud}/v1/workspaces/${ws}/git`;
-  if (git2(["remote", "add", name, url], { quiet: true }) !== 0) {
-    if (git2(["remote", "set-url", name, url], { quiet: true }) !== 0) {
+  if (git(["remote", "add", name, url], { quiet: true }) !== 0) {
+    if (git(["remote", "set-url", name, url], { quiet: true }) !== 0) {
       err5(`could not add or update remote '${name}'`);
       return 1;
     }
@@ -1788,7 +1930,7 @@ async function gitRemote(ws, name, opts) {
       );
       return 1;
     }
-    if (git2(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
+    if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
       err5("git config failed setting the principal header");
       return 1;
     }
@@ -2012,7 +2154,7 @@ init_cloud();
 init_local_holon();
 import { existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
-import git3 from "isomorphic-git";
+import git2 from "isomorphic-git";
 var out7 = (s) => void process.stdout.write(s + "\n");
 var err7 = (s) => void process.stderr.write("error: " + s + "\n");
 var SOURCE = "source";
@@ -2067,12 +2209,12 @@ function typeOf(ev) {
 }
 async function walkChain(eng, ws) {
   const gitdir = gitdirOf(ws);
-  const dec3 = new TextDecoder();
+  const dec4 = new TextDecoder();
   const entries = [];
-  for (const c of await git3.log({ fs: eng.fs, gitdir, ref: "main" })) {
+  for (const c of await git2.log({ fs: eng.fs, gitdir, ref: "main" })) {
     try {
-      const { blob } = await git3.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
-      entries.push({ oid: c.oid, bytes: blob, doc: JSON.parse(dec3.decode(blob)) });
+      const { blob } = await git2.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
+      entries.push({ oid: c.oid, bytes: blob, doc: JSON.parse(dec4.decode(blob)) });
     } catch {
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/dsl": "^0.15.0",
+    "@githolon/dsl": "^0.16.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {