githolon 0.16.0 → 0.16.1

package/dist/cli.mjs

@@ -190,7 +190,7 @@ async function wsCreate(name, opts) {
     out(`  session saved \u2192 ${credsPath()} (auto-refreshed; births ride x-nomos-auth)`);
     principal = s.accessToken;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${name}`, {
+  const r = await fetch(`${cloud}/v2/workspaces/${name}`, {
     method: "POST",
     headers: principalHeaders(principal)
   });
@@ -214,7 +214,7 @@ async function wsCreate(name, opts) {
 }
 async function wsStatus(name, opts) {
   const cloud = cloudBase(opts.cloud);
-  const r = await fetch(`${cloud}/v1/workspaces/${name}`);
+  const r = await fetch(`${cloud}/v2/workspaces/${name}`);
   const text = await r.text();
   if (!r.ok) {
     err(`status '${name}' (${r.status}): ${text}`);
@@ -233,7 +233,7 @@ async function wsRetire(ws, opts) {
     );
     return 1;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/retire`, {
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/retire`, {
     method: "POST",
     headers: { authorization: `Bearer ${secret}` }
   });
@@ -249,7 +249,7 @@ async function wsRetire(ws, opts) {
   out(`\u2713 workspace ${ws} retired on ${cloud}${d.alreadyRetired === true ? " (it was already retired)" : ""}`);
   out("  nothing was deleted \u2014 the ledger and its data are retained per the Nomos Pre-Release License");
   out("  it no longer counts toward your workspace allowance; reads keep serving, deploys/pushes refuse");
-  out("  to un-retire: contact the operator (an admin restores the record via POST /v1/root/governance)");
+  out("  to un-retire: contact the operator (an admin restores the record via root's governance offer, POST /v2/workspaces/root/createWorkspace)");
   return 0;
 }
 async function deploy(ws, opts) {
@@ -270,8 +270,8 @@ async function deploy(ws, opts) {
     );
     return 1;
   }
-  const before = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`, {
+  const before = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
     body: readFileSync(file, "utf8")
@@ -310,7 +310,7 @@ async function secretRotate(ws, opts) {
     err(`no stored secret for ${ws} on ${cloud} \u2014 githolon secret set ${ws} <secret> first`);
     return 1;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/rotate-secret`, {
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/rotate-secret`, {
     method: "POST",
     headers: { authorization: `Bearer ${current}` }
   });
@@ -453,13 +453,13 @@ var init_tree = __esm({
 function concatBytes(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
-  const out10 = new Uint8Array(n);
+  const out9 = new Uint8Array(n);
   let o = 0;
   for (const c of chunks) {
-    out10.set(c, o);
+    out9.set(c, o);
     o += c.length;
   }
-  return out10;
+  return out9;
 }
 function pkt(payload) {
   const body = typeof payload === "string" ? enc2.encode(payload) : payload;
@@ -612,13 +612,13 @@ async function sha256hex(t) {
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out10 = new Array(n), T = 2 ** 53;
+  const out9 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z = 0n;
     for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out10[i] = Number(z >> 11n) / T;
+    out9[i] = Number(z >> 11n) / T;
   }
-  return out10;
+  return out9;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
@@ -771,7 +771,7 @@ function applyIntentBytes(eng, ws, bytes, opts) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
-var enc3, dec3, BRANCH, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, cryptoUnwrapKey, count, sum;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
@@ -781,6 +781,7 @@ var init_engine = __esm({
     enc3 = new TextEncoder();
     dec3 = new TextDecoder();
     BRANCH = "main";
+    RESULT_PACK_INLINE_MAX = 256 * 1024;
     repoArgOf = (ws) => `/work/ws/${ws}`;
     gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
     unpack = (p) => {
@@ -918,21 +919,21 @@ function sealedIntentOf(eng, ws, res) {
 }
 function printVerdict(v) {
   if (v["valid"] === true) {
-    out3(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
-    out3(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
+    out2(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
+    out2(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
     return true;
   }
-  err3(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
+  err2(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
   return false;
 }
-var out3, err3;
+var out2, err2;
 var init_local_holon = __esm({
   "src/local_holon.ts"() {
     "use strict";
     init_engine();
     init_cloud();
-    out3 = (s) => void process.stdout.write(s + "\n");
-    err3 = (s) => void process.stderr.write("error: " + s + "\n");
+    out2 = (s) => void process.stdout.write(s + "\n");
+    err2 = (s) => void process.stderr.write("error: " + s + "\n");
   }
 });
 
@@ -1081,7 +1082,7 @@ var init_proof_offline = __esm({
 
 // src/cli.ts
 import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "node:fs";
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { createRequire as createRequire2 } from "node:module";
 import { dirname as dirname5, join as join10, resolve as resolve2 } from "node:path";
 import { pathToFileURL as pathToFileURL4 } from "node:url";
@@ -1264,171 +1265,11 @@ Re-run with --force to replace it.`
   return { path, contents };
 }
 
-// src/capability.ts
-init_cloud();
-import { spawnSync } from "node:child_process";
-var out2 = (s) => void process.stdout.write(s + "\n");
-var err2 = (s) => void process.stderr.write("error: " + s + "\n");
-var CAP_NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
-function readStdin() {
-  if (process.stdin.isTTY === true) {
-    process.stderr.write(
-      "paste the credential value, then Ctrl-D (it never rides argv \u2014 ps/history are hosts too):\n"
-    );
-  }
-  return new Promise((resolveValue) => {
-    let buf = "";
-    process.stdin.setEncoding("utf8");
-    process.stdin.on("data", (chunk) => {
-      buf += chunk;
-    });
-    process.stdin.on("end", () => resolveValue(buf.trim()));
-    process.stdin.resume();
-  });
-}
-function readGcloud(name) {
-  const r = spawnSync("gcloud", ["secrets", "versions", "access", "latest", `--secret=${name}`], {
-    encoding: "utf8",
-    maxBuffer: 1024 * 1024
-  });
-  if (r.error !== void 0 || r.status !== 0) {
-    throw new Error(
-      `gcloud secret read failed (${r.error?.message ?? r.stderr?.trim() ?? `exit ${r.status}`}) \u2014 is gcloud installed + authed, and does secret '${name}' exist?`
-    );
-  }
-  const v = r.stdout.trim();
-  if (v === "") throw new Error(`gcloud secret '${name}' is empty`);
-  return v;
-}
-function parseExpiresAt(s) {
-  const n = /^\d+$/.test(s) ? Number(s) : Date.parse(s);
-  if (!Number.isInteger(n) || n <= 0) throw new Error(`--expires-at '${s}' is neither epoch-ms nor an ISO date`);
-  return n;
-}
-async function bindLane(lane, ws, capability, opts) {
-  const cloud = cloudBase(opts.cloud);
-  if (!CAP_NAME.test(capability)) {
-    err2(`capability must be a lowercase law name matching [a-z0-9][a-z0-9._-]{0,63} \u2014 e.g. cf-analytics, openai`);
-    return 1;
-  }
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err2(
-      `no stored secret for ${ws} on ${cloud} \u2014 capability ${lane} is owner-gated
-  githolon secret set ${ws} <secret>  (import the workspaceSecret you hold)`
-    );
-    return 1;
-  }
-  let value;
-  try {
-    value = opts.fromGcloud !== void 0 ? readGcloud(opts.fromGcloud) : await readStdin();
-  } catch (e) {
-    err2(e.message);
-    return 1;
-  }
-  if (value === "") {
-    err2("no credential value arrived \u2014 pipe it on stdin, or pass --from-gcloud <secret-name>");
-    return 1;
-  }
-  let expiresAt;
-  try {
-    expiresAt = opts.expiresAt !== void 0 ? parseExpiresAt(opts.expiresAt) : void 0;
-  } catch (e) {
-    err2(e.message);
-    return 1;
-  }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities/${lane}`, {
-    method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
-    body: JSON.stringify({
-      capability,
-      secret: value,
-      ...opts.scope !== void 0 ? { scope: opts.scope } : {},
-      ...expiresAt !== void 0 ? { expiresAt } : {}
-    })
-  });
-  const d = await r.json().catch(() => void 0);
-  if (r.status === 401) {
-    err2(`${lane} refused (401) \u2014 the stored secret for ${ws} is not the workspace's. githolon secret set ${ws} <secret>`);
-    return 1;
-  }
-  if (!r.ok || d?.ok !== true) {
-    err2(`capability ${lane} '${capability}' on ${ws} failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
-  }
-  out2(`\u2713 ${capability} ${lane === "rotate" ? "rotated" : "bound"} on ${ws} (epoch ${d.epoch})`);
-  out2(`  the VALUE lives host-side only (the workspace's holon) \u2014 it never enters the ledger`);
-  out2(`  the law fact: keyHash ${(d.keyHash ?? "").slice(0, 16)}\u2026 status ${d.status}`);
-  return 0;
-}
-async function capabilityBind(ws, capability, opts) {
-  return bindLane("bind", ws, capability, opts);
-}
-async function capabilityRotate(ws, capability, opts) {
-  return bindLane("rotate", ws, capability, opts);
-}
-async function capabilityList(ws, opts) {
-  const cloud = cloudBase(opts.cloud);
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err2(`no stored secret for ${ws} on ${cloud} \u2014 the binding facts are owner-gated
-  githolon secret set ${ws} <secret>`);
-    return 1;
-  }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities`, {
-    headers: { authorization: `Bearer ${secret}` }
-  });
-  const d = await r.json().catch(() => void 0);
-  if (!r.ok || d?.ok !== true) {
-    err2(`capability list '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
-  }
-  const bindings = d.bindings ?? [];
-  if (bindings.length === 0) {
-    out2(`no capability bindings on ${ws} \u2014 bind one: githolon capability bind ${ws} <capability>`);
-    return 0;
-  }
-  for (const b of bindings) {
-    const bits = [
-      `epoch ${b.epoch}`,
-      `${b.status}`,
-      `keyHash ${(b.keyHash ?? "").slice(0, 16)}\u2026`,
-      ...b.scope !== void 0 ? [`scope ${b.scope}`] : [],
-      ...b.expiresAt !== void 0 ? [`expires ${new Date(b.expiresAt).toISOString()}`] : [],
-      ...b.held !== void 0 ? [b.held ? "value held" : "VALUE MISSING (rotate to restore)"] : []
-    ];
-    out2(`${b.capability}  ${bits.join(" \xB7 ")}`);
-  }
-  out2(`(facts about authority \u2014 the values live host-side and are never listed)`);
-  return 0;
-}
-async function capabilityUnbind(ws, capability, opts) {
-  const cloud = cloudBase(opts.cloud);
-  const secret = getSecret(cloud, ws);
-  if (secret === void 0) {
-    err2(`no stored secret for ${ws} on ${cloud} \u2014 unbind is owner-gated
-  githolon secret set ${ws} <secret>`);
-    return 1;
-  }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities/unbind`, {
-    method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
-    body: JSON.stringify({ capability })
-  });
-  const d = await r.json().catch(() => void 0);
-  if (!r.ok || d?.ok !== true) {
-    err2(`capability unbind '${capability}' on ${ws} failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
-  }
-  out2(`\u2713 ${capability} unbound on ${ws} \u2014 the law fact is revoked (the record stays) and the host forgot the value`);
-  return 0;
-}
-
 // src/cli.ts
 init_cloud();
 
 // src/compile.ts
-import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { dirname, join as join3 } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -1452,7 +1293,7 @@ function runCompile(args) {
 `);
     return 1;
   }
-  const r = spawnSync2(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
   return r.status ?? 1;
 }
 function compileAsync(cwd, args = []) {
@@ -1571,8 +1412,8 @@ async function resolveWorkspace(explicit, cwd, target, usageHint) {
 
 // src/dev.ts
 init_proof_offline();
-var out4 = (s) => void process.stdout.write(s + "\n");
-var err4 = (s) => void process.stderr.write("error: " + s + "\n");
+var out3 = (s) => void process.stdout.write(s + "\n");
+var err3 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS = "dev";
 var DEFAULT_PORT = 7700;
 var DEBOUNCE_MS = 200;
@@ -1695,21 +1536,21 @@ async function dev(opts) {
   const cwd = process.cwd();
   const cloud = cloudBase(opts.cloud);
   const project = await loadProject(cwd).catch((e) => {
-    err4(e.message);
+    err3(e.message);
     return void 0;
   });
   if (project === void 0) {
     if (!existsSync6(join7(cwd, CONFIG_FILE))) {
-      err4(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
+      err3(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
     }
     return 1;
   }
   const creds = loadCreds();
   const installedBy = creds.session?.uid ?? creds.principal ?? "githolon-dev";
-  out4(`githolon dev \u2014 ${project.name}: compiling\u2026`);
+  out3(`githolon dev \u2014 ${project.name}: compiling\u2026`);
   const firstCompile = await compileAsync(cwd);
   if (!firstCompile.ok) {
-    err4(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
+    err3(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
 ${firstCompile.output}`);
     return 1;
   }
@@ -1717,14 +1558,14 @@ ${firstCompile.output}`);
   try {
     deployBody = readDeployBody(cwd, project.name);
   } catch (e) {
-    err4(e.message);
+    err3(e.message);
     return 1;
   }
   let engBoot;
   try {
     engBoot = await holonEngine(cloud, deployBody, installedBy);
   } catch (e) {
-    err4(`cannot boot the local holon: ${String(e.message ?? e)}
+    err3(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* and is cached in ~/.holon/runtime after one fetch \u2014 connect once, then dev runs offline`);
     return 1;
   }
@@ -1747,19 +1588,19 @@ ${firstCompile.output}`);
   s.intents++;
   const installed = await installLaw(s, deployBody, installedBy);
   if (!installed.ok) {
-    err4(installed.error ?? "law install failed");
+    err3(installed.error ?? "law install failed");
     return 1;
   }
   s.proof = await runProofCycle(s, cwd, deployBody, installedBy);
   if (opts.once === true) {
-    out4(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
+    out3(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
     return s.proof === void 0 || s.proof.ok ? 0 : 1;
   }
   let server;
   try {
     server = await startServer(s);
   } catch (e) {
-    err4(e.message);
+    err3(e.message);
     return 1;
   }
   const moduleDirs = /* @__PURE__ */ new Set();
@@ -1787,7 +1628,7 @@ ${firstCompile.output}`);
     s.compileMs = run.ms;
     if (!run.ok) {
       s.lastError = run.output.trim() || "compile failed";
-      out4(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
+      out3(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
 ${run.output}`);
     } else {
       s.lastError = void 0;
@@ -1796,16 +1637,16 @@ ${run.output}`);
         const inst = await installLaw(s, body, installedBy);
         if (!inst.ok) {
           s.lastError = inst.error ?? "install failed";
-          out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+          out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
         } else {
           s.proof = await runProofCycle(s, cwd, body, installedBy);
           const total = performance.now() - t0;
-          out4(statusScreen(s));
-          out4(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
+          out3(statusScreen(s));
+          out3(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
         }
       } catch (e) {
         s.lastError = String(e.message ?? e);
-        out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+        out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
       }
     }
     cycling = false;
@@ -1831,8 +1672,8 @@ ${run.output}`);
     })
   );
   s.watchRoots.push(CONFIG_FILE);
-  out4(statusScreen(s));
-  out4("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
+  out3(statusScreen(s));
+  out3("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
   return new Promise((resolveExit) => {
     const stop = () => {
       for (const w of watchers) w.close();
@@ -1846,13 +1687,13 @@ ${run.output}`);
 
 // src/git.ts
 init_cloud();
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
-var out5 = (s) => void process.stdout.write(s + "\n");
-var err5 = (s) => void process.stderr.write("error: " + s + "\n");
+var out4 = (s) => void process.stdout.write(s + "\n");
+var err4 = (s) => void process.stderr.write("error: " + s + "\n");
 function git(args, opts = {}) {
-  const r = spawnSync3("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
+  const r = spawnSync2("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
   return r.status ?? 1;
 }
 function ensureSecret(cloud, ws) {
@@ -1872,7 +1713,7 @@ function parseCredentialInput(input) {
   return kv;
 }
 function workspaceFromPath(path) {
-  const m = (path ?? "").match(/^v1\/workspaces\/([^/]+)\/git(\/|$)/);
+  const m = (path ?? "").match(/^v[12]\/workspaces\/([^/]+)\/git(\/|$)/);
   return m?.[1];
 }
 async function gitCredential(action) {
@@ -1882,40 +1723,40 @@ async function gitCredential(action) {
   if (kv["protocol"] !== "https" || ws === void 0) return 0;
   const cloud = `https://${kv["host"]}`;
   const token = await sessionToken().catch(() => void 0);
-  out5(`username=${token ?? "nomos"}`);
-  out5(`password=${ensureSecret(cloud, ws)}`);
-  out5("");
+  out4(`username=${token ?? "nomos"}`);
+  out4(`password=${ensureSecret(cloud, ws)}`);
+  out4("");
   return 0;
 }
 async function gitSetup(opts) {
   const cloud = cloudBase(opts.cloud);
   const self = process.argv[1];
   if (self === void 0) {
-    err5("cannot locate the githolon CLI entry to install as a credential helper");
+    err4("cannot locate the githolon CLI entry to install as a credential helper");
     return 1;
   }
   const helper = `!"${process.execPath}" "${self}" git-credential`;
   if (git(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
-    err5("git config failed \u2014 is git installed?");
+    err4("git config failed \u2014 is git installed?");
     return 1;
   }
-  out5(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
-  out5(`  pushes/clones of ${cloud}/v1/workspaces/<ws>/git now authenticate from ~/.holon`);
+  out4(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
+  out4(`  pushes/clones of ${cloud}/v2/workspaces/<ws>/git now authenticate from ~/.holon`);
   return 0;
 }
 async function gitRemote(ws, name, opts) {
   const cloud = cloudBase(opts.cloud);
   if (git(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
-    err5("not a git repository \u2014 run inside your repo (git init first)");
+    err4("not a git repository \u2014 run inside your repo (git init first)");
     return 1;
   }
   const setupRc = await gitSetup(opts);
   if (setupRc !== 0) return setupRc;
   ensureSecret(cloud, ws);
-  const url = `${cloud}/v1/workspaces/${ws}/git`;
+  const url = `${cloud}/v2/workspaces/${ws}/git`;
   if (git(["remote", "add", name, url], { quiet: true }) !== 0) {
     if (git(["remote", "set-url", name, url], { quiet: true }) !== 0) {
-      err5(`could not add or update remote '${name}'`);
+      err4(`could not add or update remote '${name}'`);
       return 1;
     }
   }
@@ -1923,7 +1764,7 @@ async function gitRemote(ws, name, opts) {
   if (token === void 0) {
     const principal = loadCreds().principal;
     if (principal === void 0) {
-      err5(
+      err4(
         `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
   githolon login --agent   (then just push)
   \u2014 or re-run after githolon ws create/login so a principal is on file`
@@ -1931,13 +1772,13 @@ async function gitRemote(ws, name, opts) {
       return 1;
     }
     if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
-      err5("git config failed setting the principal header");
+      err4("git config failed setting the principal header");
       return 1;
     }
   }
-  out5(`\u2713 remote '${name}' \u2192 ${url}`);
-  out5(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
-  out5(`  birth/deploy by push:  git push ${name} main`);
+  out4(`\u2713 remote '${name}' \u2192 ${url}`);
+  out4(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
+  out4(`  birth/deploy by push:  git push ${name} main`);
   return 0;
 }
 
@@ -2041,22 +1882,6 @@ var HELP = {
     what: "The workspace-secret store (~/.holon/credentials.json, 0600). `set` imports one you already\nhold; `rotate` mints a fresh one (and claims a legacy workspace).",
     examples: ["githolon secret set my-ws nws_v1_\u2026", "githolon secret rotate my-ws"]
   },
-  capability: {
-    usage: "githolon capability <bind|rotate|unbind> <ws> <capability> | list <ws>  [--from-gcloud <name>] [--scope <s>] [--expires-at <iso|ms>] [--cloud <url>]",
-    what: "Capability credentials (architecture/capability_credentials.md): the ledger holds FACTS ABOUT\nAUTHORITY (the CapabilityBinding record \u2014 keyHash/scope/expiry/epoch), the credential VALUE\nlives at exactly ONE host (the workspace's holon). `bind` ships the value over the owner-gated\nlane ONCE \u2014 from stdin (pipe it) or Google Secret Manager, NEVER argv (ps/history are hosts\ntoo). `rotate` = revoke + re-bind at epoch+1; `unbind` revokes the fact and the host forgets\nthe value; `list` shows facts only.",
-    flags: [
-      ["--from-gcloud <name>", "read the value from `gcloud secrets versions access latest --secret=<name>`"],
-      ["--scope <s>", "a narrowing label recorded on the law fact (e.g. read-only)"],
-      ["--expires-at <t>", "expiry recorded on the law fact (ISO date/datetime or epoch-ms; fail-closed at the host)"],
-      ["--cloud <url>", "target cloud (default: $NOMOS_CLOUD or the public cloud)"]
-    ],
-    examples: [
-      "cat token.txt | githolon capability bind nomos-usage cf-analytics",
-      "githolon capability bind my-ws openai --from-gcloud openai-api-key --scope read-only",
-      "githolon capability list nomos-usage",
-      "githolon capability rotate nomos-usage cf-analytics --from-gcloud cf-analytics-token"
-    ]
-  },
   git: {
     usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
     what: "Stock git push as deploy/birth. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then: git push nomos main). With no <ws>, the\nproject's `workspace` binding resolves it.",
@@ -2088,23 +1913,23 @@ function commandHelp(cmd) {
 init_engine();
 init_cloud();
 init_local_holon();
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join8 } from "node:path";
-var out6 = (s) => void process.stdout.write(s + "\n");
-var err6 = (s) => void process.stderr.write("error: " + s + "\n");
+var out5 = (s) => void process.stdout.write(s + "\n");
+var err5 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS2 = "local";
 async function ledgerInit(dir, opts) {
   const cloud = cloudBase(opts.cloud);
   if (existsSync7(dir) && readdirSync3(dir).length > 0) {
-    err6(`refusing to mint into non-empty directory: ${dir}`);
+    err5(`refusing to mint into non-empty directory: ${dir}`);
     return 1;
   }
   let deployFile;
   try {
     deployFile = discoverDeployJson(process.cwd(), opts.file);
   } catch (e) {
-    err6(e.message);
+    err5(e.message);
     return 1;
   }
   const deployBody = JSON.parse(readFileSync6(deployFile, "utf8"));
@@ -2112,10 +1937,10 @@ async function ledgerInit(dir, opts) {
   const c = loadCreds();
   const principal = await sessionToken().catch(() => void 0) !== void 0 ? c.session.uid : c.principal;
   if (principal === void 0) {
-    err6("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
+    err5("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
     return 1;
   }
-  out6(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
+  out5(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
   const { eng } = await holonEngine(cloud, deployBody, principal);
   await mountFresh(eng, WS2);
   author(eng, WS2, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, principal), "");
@@ -2127,17 +1952,17 @@ async function ledgerInit(dir, opts) {
   writeTreeToDisk(gitTree, gitDir);
   const cfgPath = join8(gitDir, "config");
   writeFileSync4(cfgPath, readFileSync6(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
-  spawnSync4("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
-  out6(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
-  out6(`
+  spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
+  out5(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
+  out5(`
 Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
-  out6(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
+  out5(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
   const gitDir = existsSync7(join8(dir, ".git")) ? join8(dir, ".git") : dir;
   if (!existsSync7(join8(gitDir, "HEAD"))) {
-    err6(`${dir} is not a git repo (no HEAD)`);
+    err5(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
   const { eng } = await holonEngine(cloudBase(opts.cloud), void 0, "verify");
@@ -2155,8 +1980,8 @@ init_local_holon();
 import { existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 import git2 from "isomorphic-git";
-var out7 = (s) => void process.stdout.write(s + "\n");
-var err7 = (s) => void process.stderr.write("error: " + s + "\n");
+var out6 = (s) => void process.stdout.write(s + "\n");
+var err6 = (s) => void process.stderr.write("error: " + s + "\n");
 var SOURCE = "source";
 var REPLAY = "replay";
 function summarizePayload(payload, max = 100) {
@@ -2192,9 +2017,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out10 = {};
-    for (const [k, x] of Object.entries(v)) out10[k] = capJsonStrings(x, max);
-    return out10;
+    const out9 = {};
+    for (const [k, x] of Object.entries(v)) out9[k] = capJsonStrings(x, max);
+    return out9;
   }
   return v;
 }
@@ -2241,12 +2066,12 @@ function readKey() {
 async function replay(target, opts) {
   const cloud = cloudBase(opts.cloud);
   const json = opts.json === true;
-  const emit = (o) => out7(JSON.stringify(o));
+  const emit = (o) => out6(JSON.stringify(o));
   let eng;
   try {
     ({ eng } = await holonEngine(cloud, void 0, "githolon-replay"));
   } catch (e) {
-    err7(`cannot boot the local holon: ${String(e.message ?? e)}
+    err6(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);
     return 1;
   }
@@ -2254,15 +2079,15 @@ async function replay(target, opts) {
   if (isDir) {
     const gitDir = existsSync8(join9(target, ".git")) ? join9(target, ".git") : target;
     if (!existsSync8(join9(gitDir, "HEAD"))) {
-      err7(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
+      err6(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
       return 1;
     }
     await mountFresh(eng, SOURCE);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
-    const m = await mountWorkspace(eng, SOURCE, { remote: `${cloud}/v1/workspaces/${target}/git`, headers: {} });
+    const m = await mountWorkspace(eng, SOURCE, { remote: `${cloud}/v2/workspaces/${target}/git`, headers: {} });
     if (m.restored !== true) {
-      err7(
+      err6(
         `workspace '${target}' has no refs/heads/main on ${cloud} \u2014 nothing to replay` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : "") + `
   check the name (githolon ws status ${target}), or pass a local holon directory instead`
       );
@@ -2271,7 +2096,7 @@ async function replay(target, opts) {
   }
   const chain = await walkChain(eng, SOURCE);
   if (chain.length === 0) {
-    err7(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
+    err6(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
     return 1;
   }
   await mountFresh(eng, REPLAY);
@@ -2280,8 +2105,8 @@ async function replay(target, opts) {
   const tallies = /* @__PURE__ */ new Map();
   let autoRun = !interactive;
   if (!json) {
-    out7(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
-    if (interactive) out7("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
+    out6(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
+    if (interactive) out6("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
   }
   for (let i = 0; i < chain.length; i++) {
     const { oid, bytes, doc } = chain[i];
@@ -2295,8 +2120,8 @@ async function replay(target, opts) {
     if (res.ok === false) {
       const msg = `replay REFUSED at intent ${i} (${domain}/${directive}, ${oid.slice(0, 10)}): ${res.error ?? "unknown"}`;
       if (json) emit({ step: i, oid, domain, directive, refused: true, error: res.error ?? "unknown" });
-      else err7(msg);
-      err7("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
+      else err6(msg);
+      err6("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
       printVerdict(verifyChainLocal(eng, SOURCE));
       return 1;
     }
@@ -2317,31 +2142,31 @@ async function replay(target, opts) {
         tallies: Object.fromEntries(tallies)
       });
     } else {
-      out7(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
-      out7(`      payload  ${summarizePayload(doc.payload?.payload)}`);
+      out6(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
+      out6(`      payload  ${summarizePayload(doc.payload?.payload)}`);
       for (const ev of doc.events ?? []) {
         const id = ev.aggregate ?? "?";
         const was = before.get(id);
         const verb = ev.marker === "Create" ? "+ created" : ev.marker === "Delete" ? "- deleted" : was === void 0 ? "~ touched" : "~ updated";
-        out7(`      ${verb}  ${id}`);
+        out6(`      ${verb}  ${id}`);
         const ops = summarizeOps(ev);
-        if (ops.length > 0) out7(`                ${ops}`);
+        if (ops.length > 0) out6(`                ${ops}`);
       }
       const tallyLine = [...tallies.entries()].map(([t, n]) => `${t}:${n}`).join("  ");
       const showTally = stepEvery > 0 ? (i + 1) % stepEvery === 0 || i === chain.length - 1 : true;
-      if (showTally && tallyLine.length > 0) out7(`      rows     ${tallyLine}`);
+      if (showTally && tallyLine.length > 0) out6(`      rows     ${tallyLine}`);
     }
     if (interactive && !autoRun && i < chain.length - 1) {
       const key = await readKey();
       if (key === "quit") {
-        out7(`
+        out6(`
 stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below covers the WHOLE chain as delivered`);
         break;
       }
       if (key === "all") autoRun = true;
     }
   }
-  if (!json) out7("");
+  if (!json) out6("");
   const verdict = verifyChainLocal(eng, SOURCE);
   if (json) {
     emit({ finale: true, verdict });
@@ -2355,40 +2180,40 @@ init_local_holon();
 init_cloud();
 init_engine();
 var SOURCE2 = "source";
-var out8 = (s) => {
+var out7 = (s) => {
   process.stdout.write(s + "\n");
 };
-var err8 = (s) => {
+var err7 = (s) => {
   process.stderr.write(`error: ${s}
 `);
 };
 async function decrypt(ws, opts) {
   const cloud = cloudBase(opts.cloud);
   if (!opts.as) {
-    err8("--as <principal> is required (who to decrypt as)");
+    err7("--as <principal> is required (who to decrypt as)");
     return 1;
   }
   if (!opts.secret) {
-    err8("--secret <base64 X25519 device secret> is required");
+    err7("--secret <base64 X25519 device secret> is required");
     return 1;
   }
   if (!opts.query) {
-    err8("--query <queryId> is required (the read to decrypt)");
+    err7("--query <queryId> is required (the read to decrypt)");
     return 1;
   }
   let eng;
   try {
     ({ eng } = await holonEngine(cloud, opts.overlay, "githolon-decrypt"));
   } catch (e) {
-    err8(`cannot boot the local holon: ${String(e.message ?? e)}`);
+    err7(`cannot boot the local holon: ${String(e.message ?? e)}`);
     return 1;
   }
   const m = await mountWorkspace(eng, SOURCE2, {
-    remote: `${cloud}/v1/workspaces/${ws}/git`,
+    remote: `${cloud}/v2/workspaces/${ws}/git`,
     headers: { "x-nomos-principal": opts.as }
   });
   if (m.restored !== true) {
-    err8(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
+    err7(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
     return 1;
   }
   const wraps = query(eng, SOURCE2, "wrappedKeysByRecipient", JSON.stringify({ recipientPrincipal: opts.as }), opts.as);
@@ -2403,14 +2228,14 @@ async function decrypt(ws, opts) {
       }
     }
   }
-  if (opts.json !== true) out8(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
+  if (opts.json !== true) out7(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
   const rows = query(eng, SOURCE2, opts.query, JSON.stringify(opts.params ?? {}), opts.as, keys);
   if (rows && !Array.isArray(rows) && rows.ok === false) {
-    err8(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
+    err7(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
   '${opts.as}' is not granted this scope's read capability` : ""));
     return 1;
   }
-  out8(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
+  out7(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
   return 0;
 }
 
@@ -2418,8 +2243,8 @@ async function decrypt(ws, opts) {
 init_engine();
 init_cloud();
 import { readFileSync as readFileSync8 } from "node:fs";
-var out9 = (s) => void process.stdout.write(s + "\n");
-var err9 = (s) => void process.stderr.write("error: " + s + "\n");
+var out8 = (s) => void process.stdout.write(s + "\n");
+var err8 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws) {
   const active = installed.filter((d) => d.phase === "Active" && typeof d.domainHash === "string");
   const currents = active.filter((d) => d.current === true);
@@ -2457,7 +2282,7 @@ async function status(wsArg, opts) {
   try {
     ws = await resolveWorkspace(wsArg, process.cwd(), opts.target, "githolon status <ws>");
   } catch (e) {
-    err9(e.message);
+    err8(e.message);
     return 1;
   }
   let localHash;
@@ -2467,37 +2292,37 @@ async function status(wsArg, opts) {
   } catch {
     localHash = void 0;
   }
-  const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).catch(() => void 0);
+  const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).catch(() => void 0);
   if (r === void 0) {
-    err9(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
+    err8(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
     return 1;
   }
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
-    err9(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
+    err8(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
   is the workspace born? githolon ws create ${ws}`);
     return 1;
   }
-  out9(`workspace  ${ws} on ${cloud}`);
+  out8(`workspace  ${ws} on ${cloud}`);
   const allDomains = d.domains ?? [];
   const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
   const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
   const controllerCount = allDomains.length - domains.length;
-  if (allDomains.length === 0) out9(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  if (allDomains.length === 0) out8(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
   for (const dom of domains) {
     const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
-    out9(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
+    out8(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
   }
-  if (controllerCount > 0) out9(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  if (controllerCount > 0) out8(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
   const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
-  if (tenantActive > 1) out9(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
+  if (tenantActive > 1) out8(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
   if (localHash === void 0) {
-    out9(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
+    out8(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;
   }
-  out9(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
+  out8(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
   const verdict = lawDiffVerdict(localHash, domains, ws);
-  for (const line of verdict.lines) out9(line);
+  for (const line of verdict.lines) out8(line);
   return verdict.inSync ? 0 : 2;
 }
 
@@ -2541,15 +2366,6 @@ a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding):
   githolon secret set <ws> <secret>                       import a secret you already hold
   githolon secret rotate <ws>                             rotate (and re-save) the workspace secret
 
-Capability credentials (facts on the ledger, values host-side \u2014 the value NEVER rides argv;
-stdin or --from-gcloud only; architecture/capability_credentials.md):
-  githolon capability bind <ws> <capability>              bind a credential: value from stdin (or
-                                                       --from-gcloud <name>) \u2192 the workspace's holon;
-                                                       sha256(value) \u2192 the law-state binding fact
-  githolon capability list <ws>                           the binding FACTS (never the values)
-  githolon capability rotate <ws> <capability>            revoke + re-bind at epoch+1 (new value)
-  githolon capability unbind <ws> <capability>            revoke the fact; the host forgets the value
-
 Git lane (stock git push as deploy/birth \u2014 see also: push-to-create):
   githolon git setup                                      install the credential helper for the cloud host
   githolon git remote [<ws>] [<remoteName>]               wire this repo to a workspace (default name: nomos)
@@ -2628,38 +2444,6 @@ ${USAGE}`);
   if (sub === "rotate" && ws !== void 0) return secretRotate(ws, opts);
   return usageFail("expected: githolon secret <set <ws> <secret> | rotate <ws>>");
 }
-async function runCapability(argv) {
-  const usageFail = (m) => {
-    process.stderr.write(`error: ${m}
-
-${commandHelp("capability")}`);
-    return 1;
-  };
-  const pos = [];
-  const opts = {};
-  const rest = argv.slice(1);
-  for (let i = 0; i < rest.length; i++) {
-    const a = rest[i];
-    if (a === "--cloud" || a === "--from-gcloud" || a === "--scope" || a === "--expires-at") {
-      const v = rest[++i];
-      if (v === void 0) return usageFail(`${a} requires a value`);
-      if (a === "--cloud") opts.cloud = v;
-      else if (a === "--from-gcloud") opts.fromGcloud = v;
-      else if (a === "--scope") opts.scope = v;
-      else opts.expiresAt = v;
-    } else if (a.startsWith("--")) {
-      return usageFail(`unknown flag '${a}'`);
-    } else {
-      pos.push(a);
-    }
-  }
-  const [sub, ws, capability] = pos;
-  if (sub === "bind" && ws !== void 0 && capability !== void 0) return capabilityBind(ws, capability, opts);
-  if (sub === "rotate" && ws !== void 0 && capability !== void 0) return capabilityRotate(ws, capability, opts);
-  if (sub === "unbind" && ws !== void 0 && capability !== void 0) return capabilityUnbind(ws, capability, opts);
-  if (sub === "list" && ws !== void 0) return capabilityList(ws, opts);
-  return usageFail("expected: githolon capability <bind|rotate|unbind> <ws> <capability> | list <ws>");
-}
 function isKind(s) {
   return s !== void 0 && KINDS.includes(s);
 }
@@ -2739,7 +2523,7 @@ async function runProof(args) {
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join10(tsxDir, tsxBinRel ?? "dist/cli.mjs");
   console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept, secret printed once" : "") + ")");
-  const r = spawnSync5(process.execPath, [tsxCli, proofPath], {
+  const r = spawnSync4(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: { ...process.env, ...keep ? { PROOF_KEEP: "1" } : {} }
@@ -2750,7 +2534,7 @@ function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== "generate" && command !== "g") {
     throw new Error(
-      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | status | generate | ws | deploy | secret | capability.`
+      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | status | generate | ws | deploy | secret.`
     );
   }
   let outDir = DEFAULT_OUT;
@@ -2916,9 +2700,6 @@ ${commandHelp("status")}`);
   if (argv[0] === "ws" || argv[0] === "deploy" || argv[0] === "secret") {
     return runCloud(argv);
   }
-  if (argv[0] === "capability") {
-    return runCapability(argv);
-  }
   if (argv[0] === "login") {
     const agent = argv.includes("--agent");
     const tokenAt = argv.indexOf("--token");
@@ -2975,8 +2756,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err10) {
-    process.stderr.write(`error: ${err10.message}
+  } catch (err9) {
+    process.stderr.write(`error: ${err9.message}
 
 ${USAGE}`);
     return 1;
@@ -2995,8 +2776,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path}
 `);
     return 0;
-  } catch (err10) {
-    process.stderr.write(`error: ${err10.message}
+  } catch (err9) {
+    process.stderr.write(`error: ${err9.message}
 `);
     return 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/dsl": "^0.16.0",
+    "@githolon/dsl": "^0.16.1",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {