githolon 0.2.2 → 0.3.0

package/dist/cli.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname as dirname2, join as join4, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "node:fs";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname4, join as join9, resolve as resolve2 } from "node:path";
+import { pathToFileURL as pathToFileURL4 } from "node:url";
 
 // src/generate.ts
 import { mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -430,6 +430,7 @@ async function deploy(ws, opts) {
     );
     return 1;
   }
+  const before = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
   const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
@@ -446,9 +447,17 @@ async function deploy(ws, opts) {
   }
   const phase = d.installation?.[0]?.data?.["status.phase"];
   out(`\u2713 deployed ${file.split("/").pop()} \u2192 ${ws}${typeof phase === "string" ? ` (${phase})` : ""}`);
-  if (typeof d.domainHash === "string") out(`  law hash ${d.domainHash}`);
+  if (typeof d.domainHash === "string") {
+    out(`  law ${describeLawMove(before, d.domainHash)}`);
+  }
   return 0;
 }
+function describeLawMove(before, newHash) {
+  const activeBefore = before.filter((x) => x.phase === "Active" && typeof x.domainHash === "string").map((x) => x.domainHash);
+  if (activeBefore.includes(newHash)) return `unchanged \u2014 ${newHash.slice(0, 16)}\u2026 was already installed (idempotent)`;
+  const prior = activeBefore.length > 0 ? activeBefore[activeBefore.length - 1] : void 0;
+  return prior !== void 0 ? `moved ${prior.slice(0, 16)}\u2026 \u2192 ${newHash.slice(0, 16)}\u2026` : `installed ${newHash.slice(0, 16)}\u2026 (the first law on this workspace)`;
+}
 async function secretSet(ws, secret, opts) {
   setSecret(cloudBase(opts.cloud), ws, secret);
   out(`\u2713 secret for ${ws} saved \u2192 ${credsPath()}`);
@@ -475,112 +484,63 @@ async function secretRotate(ws, opts) {
   return 0;
 }
 
-// src/git.ts
-import { spawnSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { readFileSync as readFileSync2 } from "node:fs";
-var out2 = (s) => void process.stdout.write(s + "\n");
-var err2 = (s) => void process.stderr.write("error: " + s + "\n");
-function git(args, opts = {}) {
-  const r = spawnSync("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
-  return r.status ?? 1;
-}
-function ensureSecret(cloud, ws) {
-  const existing = getSecret(cloud, ws);
-  if (existing !== void 0) return existing;
-  const minted = `holon_v1_${randomBytes(24).toString("hex")}`;
-  setSecret(cloud, ws, minted);
-  return minted;
-}
-function parseCredentialInput(input) {
-  const kv = {};
-  for (const line of input.split("\n")) {
-    if (line === "") break;
-    const i = line.indexOf("=");
-    if (i > 0) kv[line.slice(0, i)] = line.slice(i + 1);
-  }
-  return kv;
-}
-function workspaceFromPath(path) {
-  const m = (path ?? "").match(/^v1\/workspaces\/([^/]+)\/git(\/|$)/);
-  return m?.[1];
-}
-async function gitCredential(action) {
-  if (action !== "get") return 0;
-  const kv = parseCredentialInput(readFileSync2(0, "utf8"));
-  const ws = workspaceFromPath(kv["path"]);
-  if (kv["protocol"] !== "https" || ws === void 0) return 0;
-  const cloud = `https://${kv["host"]}`;
-  const token = await sessionToken().catch(() => void 0);
-  out2(`username=${token ?? "nomos"}`);
-  out2(`password=${ensureSecret(cloud, ws)}`);
-  out2("");
-  return 0;
+// src/compile.ts
+import { spawn, spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { dirname, join as join3 } from "node:path";
+import { pathToFileURL } from "node:url";
+function resolveCompileLauncher(cwd) {
+  const resolveDslPkg = (fromDir) => {
+    try {
+      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join3(fromDir, "noop.js")));
+      return req.resolve("@githolon/dsl/package.json");
+    } catch {
+      return void 0;
+    }
+  };
+  const dslPkg = resolveDslPkg(cwd) ?? resolveDslPkg(void 0);
+  return dslPkg === void 0 ? void 0 : join3(dirname(dslPkg), "compile_package.mjs");
 }
-async function gitSetup(opts) {
-  const cloud = cloudBase(opts.cloud);
-  const self = process.argv[1];
-  if (self === void 0) {
-    err2("cannot locate the githolon CLI entry to install as a credential helper");
-    return 1;
-  }
-  const helper = `!"${process.execPath}" "${self}" git-credential`;
-  if (git(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
-    err2("git config failed \u2014 is git installed?");
+var NO_DSL_REMEDY = "@githolon/dsl not found \u2014 add it to your project's dependencies";
+function runCompile(args) {
+  const launcher = resolveCompileLauncher(process.cwd());
+  if (launcher === void 0) {
+    process.stderr.write(`error: ${NO_DSL_REMEDY}
+`);
     return 1;
   }
-  out2(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
-  out2(`  pushes/clones of ${cloud}/v1/workspaces/<ws>/git now authenticate from ~/.holon`);
-  return 0;
+  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  return r.status ?? 1;
 }
-async function gitRemote(ws, name, opts) {
-  const cloud = cloudBase(opts.cloud);
-  if (git(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
-    err2("not a git repository \u2014 run inside your repo (git init first)");
-    return 1;
-  }
-  const setupRc = await gitSetup(opts);
-  if (setupRc !== 0) return setupRc;
-  ensureSecret(cloud, ws);
-  const url = `${cloud}/v1/workspaces/${ws}/git`;
-  if (git(["remote", "add", name, url], { quiet: true }) !== 0) {
-    if (git(["remote", "set-url", name, url], { quiet: true }) !== 0) {
-      err2(`could not add or update remote '${name}'`);
-      return 1;
-    }
-  }
-  const token = await sessionToken().catch(() => void 0);
-  if (token === void 0) {
-    const principal = loadCreds().principal;
-    if (principal === void 0) {
-      err2(
-        `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
-  githolon login --agent   (then just push)
-  \u2014 or re-run after githolon ws create/login so a principal is on file`
-      );
-      return 1;
-    }
-    if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
-      err2("git config failed setting the principal header");
-      return 1;
-    }
-  }
-  out2(`\u2713 remote '${name}' \u2192 ${url}`);
-  out2(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
-  out2(`  birth/deploy by push:  git push ${name} main`);
-  return 0;
+function compileAsync(cwd, args = []) {
+  const launcher = resolveCompileLauncher(cwd);
+  const t0 = performance.now();
+  if (launcher === void 0) {
+    return Promise.resolve({ ok: false, ms: 0, output: NO_DSL_REMEDY });
+  }
+  return new Promise((resolveRun) => {
+    const chunks = [];
+    const dec3 = new TextDecoder();
+    const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => chunks.push(dec3.decode(c)));
+    child.stderr?.on("data", (c) => chunks.push(dec3.decode(c)));
+    child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
+    child.on(
+      "close",
+      (code) => resolveRun({ ok: code === 0, ms: performance.now() - t0, output: chunks.join("") })
+    );
+  });
 }
 
-// src/ledger.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname, join as join3 } from "node:path";
-import { File as File2, Directory as Directory2 } from "@bjorn3/browser_wasi_shim";
+// src/dev.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3, watch } from "node:fs";
+import { createServer } from "node:http";
+import { dirname as dirname3, join as join6, resolve } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
 
 // vendor/engine/engine.mjs
 import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
-import git2 from "isomorphic-git";
+import git from "isomorphic-git";
 import http from "isomorphic-git/http/web";
 
 // vendor/engine/git-fs.mjs
@@ -598,7 +558,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
     const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
     return rel === "" ? [] : rel.split("/");
   }
-  function resolve2(ps) {
+  function resolve3(ps) {
     let cur = root;
     for (const part of ps) {
       if (!isDir(cur)) return null;
@@ -608,11 +568,11 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
     }
     return cur;
   }
-  const parent = (ps) => resolve2(ps.slice(0, -1));
+  const parent = (ps) => resolve3(ps.slice(0, -1));
   const leaf = (ps) => ps[ps.length - 1];
   const promises = {
     async readFile(p, opts) {
-      const n = resolve2(parts(p));
+      const n = resolve3(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (isDir(n)) throw fsErr("EISDIR", p);
       const data = n.data ?? new Uint8Array(0);
@@ -631,7 +591,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
       if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
     },
     async readdir(p) {
-      const n = resolve2(parts(p));
+      const n = resolve3(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (!isDir(n)) throw fsErr("ENOTDIR", p);
       return [...n.contents.keys()];
@@ -651,7 +611,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
       return promises.lstat(p);
     },
     async lstat(p) {
-      const n = resolve2(parts(p));
+      const n = resolve3(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       const dir = isDir(n);
       return {
@@ -701,14 +661,14 @@ async function sha256hex(t) {
 }
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
-  crypto.getRandomValues(bytes);
-  const out4 = new Array(n), T = 2 ** 53;
+  for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
+  const out8 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z = 0n;
     for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out4[i] = Number(z >> 11n) / T;
+    out8[i] = Number(z >> 11n) / T;
   }
-  return out4;
+  return out8;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
@@ -770,6 +730,22 @@ async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, manifestString
   };
   return eng;
 }
+function setManifests(eng, strings) {
+  eng.manifestStrings = strings;
+  eng.knownDomainsCache = null;
+  eng.directiveRoutesCache = null;
+  eng.scopedReadsCache = null;
+  eng.placementDirectivesCache = null;
+  eng.tenantTypesCache = null;
+  eng.globalAggregatesCache = null;
+  const root = eng.preopen.dir.contents;
+  seedManifests(root, strings);
+  const wsRoot = root.get("ws");
+  for (const ws of eng.mounted.keys()) {
+    const wsDir = wsRoot.contents.get(ws);
+    if (wsDir) seedManifests(wsDir.contents, strings);
+  }
+}
 async function mountWorkspace(eng, ws, ledger) {
   if (eng.mounted.has(ws)) return eng.mounted.get(ws);
   const wsContents = /* @__PURE__ */ new Map();
@@ -778,14 +754,14 @@ async function mountWorkspace(eng, ws, ledger) {
   const gitdir = gitdirOf(ws);
   let restored = false, remoteMain = null, restoreError = null;
   try {
-    const info = await git2.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
+    const info = await git.getRemoteInfo({ http, url: ledger.remote, headers: ledger.headers });
     remoteMain = info.refs && info.refs.heads && info.refs.heads.main || null;
     if (remoteMain) {
-      await git2.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: "main" });
-      await git2.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
-      await git2.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, headers: ledger.headers });
-      await git2.writeRef({ fs: eng.fs, gitdir, ref: "refs/heads/main", value: remoteMain, force: true });
-      await git2.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: "ref: refs/heads/main", force: true, symbolic: true });
+      await git.init({ fs: eng.fs, gitdir, bare: true, defaultBranch: "main" });
+      await git.addRemote({ fs: eng.fs, gitdir, remote: "origin", url: ledger.remote, force: true });
+      await git.fetch({ fs: eng.fs, http, gitdir, remote: "origin", ref: "main", singleBranch: true, headers: ledger.headers });
+      await git.writeRef({ fs: eng.fs, gitdir, ref: "refs/heads/main", value: remoteMain, force: true });
+      await git.writeRef({ fs: eng.fs, gitdir, ref: "HEAD", value: "ref: refs/heads/main", force: true, symbolic: true });
       restored = true;
     }
   } catch (e) {
@@ -795,42 +771,63 @@ async function mountWorkspace(eng, ws, ledger) {
   eng.mounted.set(ws, m);
   return m;
 }
+function unmount(eng, ws) {
+  eng.mounted.delete(ws);
+  eng.mainIntents.delete(ws);
+  const wsRoot = eng.preopen.dir.contents.get("ws");
+  if (wsRoot) wsRoot.contents.delete(ws);
+}
 function writeWork(eng, name, bytes) {
   eng.preopen.dir.contents.set(name, new File(bytes));
 }
-function author(eng, ws, domain, directiveId, payload, controllerHash) {
+function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
-  const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
+  const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
   writeWork(eng, `payload-${seq}.json`, enc2.encode(JSON.stringify(payload)));
   writeWork(eng, `envelope-${seq}.json`, enc2.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
-  return JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH }, eng.STDERR));
+  const defer = opts.deferProjection !== false;
+  const res = JSON.parse(call(eng.ex, "author", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: "", domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...defer ? { deferProjection: true } : {} }, eng.STDERR));
+  if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
+  return res;
+}
+var qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
+var query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
+var count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
+var sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
+function applyIntentBytes(eng, ws, bytes) {
+  const name = `intent-in-${eng.seq++}.json`;
+  writeWork(eng, name, bytes);
+  return JSON.parse(call(eng.ex, "apply_intent", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch: BRANCH }, eng.STDERR));
 }
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
 }
 
-// src/ledger.ts
-var out3 = (s) => void process.stdout.write(s + "\n");
-var err3 = (s) => void process.stderr.write("error: " + s + "\n");
-var WS = "local";
+// src/local_holon.ts
+import { randomBytes } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join4 } from "node:path";
+import { File as File2, Directory as Directory2 } from "@bjorn3/browser_wasi_shim";
+var out2 = (s) => void process.stdout.write(s + "\n");
+var err2 = (s) => void process.stderr.write("error: " + s + "\n");
 async function fetchJsonCached(url, cacheFile) {
   try {
     const r = await fetch(url);
     if (!r.ok) throw new Error(`${url} \u2192 ${r.status}`);
     const text = await r.text();
-    mkdirSync3(dirname(cacheFile), { recursive: true });
+    mkdirSync3(dirname2(cacheFile), { recursive: true });
     writeFileSync3(cacheFile, text, "utf8");
     return JSON.parse(text);
   } catch (e) {
-    if (existsSync3(cacheFile)) return JSON.parse(readFileSync3(cacheFile, "utf8"));
+    if (existsSync3(cacheFile)) return JSON.parse(readFileSync2(cacheFile, "utf8"));
     throw e;
   }
 }
 async function fetchRuntime(cloud) {
-  const cache = join3(configDir(), "runtime");
+  const cache = join4(configDir(), "runtime");
   let wasmBytes;
-  const wasmCache = join3(cache, "holon.wasm");
+  const wasmCache = join4(cache, "holon.wasm");
   try {
     const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
     if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
@@ -839,10 +836,10 @@ async function fetchRuntime(cloud) {
     writeFileSync3(wasmCache, wasmBytes);
   } catch (e) {
     if (!existsSync3(wasmCache)) throw e;
-    wasmBytes = readFileSync3(wasmCache);
+    wasmBytes = readFileSync2(wasmCache);
   }
-  const manifests = await fetchJsonCached(`${cloud}/v1/runtime/manifests`, join3(cache, "manifests.json"));
-  const packages = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join3(cache, "packages.json"));
+  const manifests = await fetchJsonCached(`${cloud}/v1/runtime/manifests`, join4(cache, "manifests.json"));
+  const packages = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join4(cache, "packages.json"));
   return { wasmBytes, manifests, packages };
 }
 function mergeManifests(baked, overlay) {
@@ -852,7 +849,7 @@ function mergeManifests(baked, overlay) {
   const r = overlay.readManifest;
   if (r !== void 0) {
     for (const [t, schema] of Object.entries(r["aggregateFieldKinds"] ?? {})) read["aggregateFieldKinds"][t] = schema;
-    for (const key of ["queries", "counts", "spatials", "deriveds", "combineds"]) {
+    for (const key of ["queries", "counts", "sums", "mins", "maxes", "spatials", "deriveds", "combineds"]) {
       for (const d of r[key] ?? []) {
         const list = read[key] = read[key] ?? [];
         if (!list.some((x) => JSON.stringify(x) === JSON.stringify(d))) list.push(d);
@@ -864,7 +861,7 @@ function mergeManifests(baked, overlay) {
 function writeTreeToDisk(dir, diskPath) {
   mkdirSync3(diskPath, { recursive: true });
   for (const [name, inode] of dir.contents) {
-    const p = join3(diskPath, name);
+    const p = join4(diskPath, name);
     if (inode.contents instanceof Map) writeTreeToDisk(inode, p);
     else writeFileSync3(p, inode.data ?? new Uint8Array(0));
   }
@@ -872,16 +869,16 @@ function writeTreeToDisk(dir, diskPath) {
 function readTreeFromDisk(diskPath) {
   const contents = /* @__PURE__ */ new Map();
   for (const name of readdirSync2(diskPath)) {
-    const p = join3(diskPath, name);
+    const p = join4(diskPath, name);
     if (statSync(p).isDirectory()) contents.set(name, readTreeFromDisk(p));
-    else contents.set(name, new File2(readFileSync3(p)));
+    else contents.set(name, new File2(readFileSync2(p)));
   }
   return new Directory2(contents);
 }
-async function engineFor(cloud, overlay, installedBy) {
+async function holonEngine(cloud, overlay, installedBy) {
   const runtime = await fetchRuntime(cloud);
   const manifestStrings = overlay === void 0 ? { read: runtime.manifests.domainManifests, identity: runtime.manifests.identityManifests } : mergeManifests(runtime.manifests, overlay);
-  const replica = BigInt(`0x${randomBytes2(8).toString("hex")}`) & (1n << 63n) - 1n;
+  const replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
   const eng = await createEngine({
     wasmModule: await WebAssembly.compile(runtime.wasmBytes),
     bootstrapPkg: runtime.packages.bootstrap,
@@ -890,67 +887,1022 @@ async function engineFor(cloud, overlay, installedBy) {
     replica,
     installedBy
   });
-  await mountWorkspace(eng, WS, { remote: "https://unborn.invalid/", headers: {} });
   return { eng, runtime };
 }
+async function mountFresh(eng, ws) {
+  await mountWorkspace(eng, ws, { remote: "https://unborn.invalid/", headers: {} });
+}
+function sealedIntentOf(eng, ws, res) {
+  if (typeof res.intentOut !== "string") return void 0;
+  const f = eng.preopen.dir.contents.get("ws").contents.get(ws)?.contents.get(res.intentOut);
+  if (f === void 0 || !(f.data instanceof Uint8Array)) return void 0;
+  try {
+    return JSON.parse(new TextDecoder().decode(f.data));
+  } catch {
+    return void 0;
+  }
+}
 function printVerdict(v) {
   if (v["valid"] === true) {
-    out3(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
-    out3(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
+    out2(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
+    out2(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
     return true;
   }
-  err3(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
+  err2(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
   return false;
 }
+
+// src/project.ts
+import { existsSync as existsSync4, statSync as statSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+var CONFIG_FILE = "nomos.package.mjs";
+async function loadProject(cwd, opts = {}) {
+  const configPath = join5(cwd, CONFIG_FILE);
+  if (!existsSync4(configPath)) return void 0;
+  const href = pathToFileURL2(configPath).href + (opts.bust === true ? `?v=${statSync2(configPath).mtimeMs}-${Date.now()}` : "");
+  const mod = await import(href);
+  const cfg = mod.default;
+  if (cfg === void 0 || typeof cfg.name !== "string" || cfg.name.length === 0) {
+    throw new Error(`${CONFIG_FILE} must default-export { name, domains } \u2014 see \`githolon compile --help\``);
+  }
+  const workspace = parseWorkspaceDecl(cfg.workspace, configPath);
+  return { name: cfg.name, ...workspace !== void 0 ? { workspace } : {}, configPath };
+}
+function parseWorkspaceDecl(raw, where) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw === "string") {
+    if (raw.length === 0) throw new Error(`'workspace' in ${where} is an empty string \u2014 name a workspace, or remove the key`);
+    return raw;
+  }
+  if (typeof raw === "object" && !Array.isArray(raw)) {
+    const entries = Object.entries(raw);
+    if (entries.length === 0) throw new Error(`'workspace' in ${where} is an empty object \u2014 declare targets, e.g. workspace: { dev: "my-ws-dev" }`);
+    for (const [target, ws] of entries) {
+      if (typeof ws !== "string" || ws.length === 0) {
+        throw new Error(`'workspace.${target}' in ${where} must be a workspace name (a string) \u2014 got ${JSON.stringify(ws)}`);
+      }
+    }
+    return raw;
+  }
+  throw new Error(`'workspace' in ${where} must be a string or { target: workspace } object \u2014 got ${JSON.stringify(raw)}`);
+}
+function resolveWorkspaceDecl(decl, target, where) {
+  if (decl === void 0) {
+    throw new Error(
+      `no 'workspace' bound in ${where} \u2014 add one line:
+  workspace: "<your-workspace>",        (or: workspace: { dev: "...", prod: "..." })
+or name the workspace explicitly on the command line`
+    );
+  }
+  if (typeof decl === "string") {
+    if (target !== void 0) {
+      throw new Error(
+        `--target ${target} given, but 'workspace' in ${where} is the single workspace "${decl}" \u2014
+  use the object form to declare targets: workspace: { ${target}: "<ws>" }`
+      );
+    }
+    return decl;
+  }
+  const targets = Object.keys(decl);
+  if (target === void 0) {
+    if (targets.length === 1) return decl[targets[0]];
+    throw new Error(
+      `'workspace' in ${where} declares ${targets.length} targets (${targets.join(", ")}) \u2014 pick one with --target <name>`
+    );
+  }
+  const ws = decl[target];
+  if (ws === void 0) {
+    throw new Error(
+      `--target ${target} is not declared in ${where} \u2014 its targets: ${targets.join(", ")}`
+    );
+  }
+  return ws;
+}
+async function resolveWorkspace(explicit, cwd, target, usageHint) {
+  if (explicit !== void 0) {
+    if (target !== void 0) {
+      throw new Error(`--target picks from the project's 'workspace' targets \u2014 drop the explicit workspace argument, or drop --target`);
+    }
+    return explicit;
+  }
+  const project = await loadProject(cwd);
+  if (project === void 0) {
+    throw new Error(
+      `no workspace named and no ${CONFIG_FILE} here (${cwd}) \u2014
+  ${usageHint}
+  or run inside a project whose ${CONFIG_FILE} binds one: workspace: "<ws>"`
+    );
+  }
+  return resolveWorkspaceDecl(project.workspace, target, project.configPath);
+}
+
+// src/proof_offline.ts
+function parseOfflineLegs(proofSource) {
+  if (!proofSource.includes("AUTO-GENERATED by nomos-compile")) {
+    throw new Error("not a generated proof (missing the AUTO-GENERATED header) \u2014 run `githolon compile` to (re)generate build/<name>.proof.mts");
+  }
+  const dispatch = proofSource.match(/^await app\.(\w+)\((\{.*\})\);$/m);
+  if (dispatch === null) {
+    throw new Error("generated proof has no `await app.<directive>({...})` dispatch \u2014 regenerate with `githolon compile` (a creating directive is required)");
+  }
+  const directiveId = dispatch[1];
+  const payload = JSON.parse(dispatch[2]);
+  const dom = proofSource.match(/dispatch (\w+)\/(\w+) — offline write/);
+  if (dom === null || dom[2] !== directiveId) {
+    throw new Error("generated proof names no `dispatch <domain>/<directive> \u2014 offline write` \u2014 regenerate with `githolon compile`");
+  }
+  const domain = dom[1];
+  const autoStamped = [];
+  const stampLine = proofSource.split("\n").find((l) => l.includes("omitted \u2014 the client auto-stamps ISO now()"));
+  if (stampLine !== void 0) {
+    for (const m of stampLine.matchAll(/`(\w+)`/g)) autoStamped.push(m[1]);
+  }
+  let queryLeg;
+  const q = proofSource.match(/local declared query (\w+):/);
+  if (q !== null) {
+    const call2 = proofSource.match(/^const rows = await app\.\w+\((\{.*\})\);$/m);
+    if (call2 === null) throw new Error(`generated proof names query '${q[1]}' but its accessor call is missing \u2014 regenerate with \`githolon compile\``);
+    queryLeg = { id: q[1], params: JSON.parse(call2[1]) };
+  }
+  let countLeg;
+  const c = proofSource.match(/local declared count (\w+):/);
+  if (c !== null) {
+    const call2 = proofSource.match(/^const localCount = await app\.\w+\((.*?)\);$/m);
+    if (call2 === null) throw new Error(`generated proof names count '${c[1]}' but its accessor call is missing \u2014 regenerate with \`githolon compile\``);
+    const arg = call2[1].trim();
+    countLeg = { id: c[1], group: arg.length === 0 ? "" : JSON.parse(arg) };
+  }
+  return {
+    domain,
+    directiveId,
+    payload,
+    autoStamped,
+    ...queryLeg !== void 0 ? { query: queryLeg } : {},
+    ...countLeg !== void 0 ? { count: countLeg } : {}
+  };
+}
+function runOfflineLegs(eng, ws, lawHash, legs) {
+  const t0 = performance.now();
+  const done = (ok, lines2, error) => ({
+    ok,
+    ms: performance.now() - t0,
+    legs: lines2,
+    ...error !== void 0 ? { error } : {}
+  });
+  const lines = [];
+  const payload = { ...legs.payload };
+  const stamp = (/* @__PURE__ */ new Date()).toISOString();
+  for (const f of legs.autoStamped) payload[f] = stamp;
+  const res = author(eng, ws, legs.domain, legs.directiveId, payload, lawHash);
+  if (res.ok === false) {
+    return done(false, lines, `dispatch ${legs.domain}/${legs.directiveId} refused: ${res.error ?? "unknown"} \u2014 the law itself rejected its own synthesized sample; check the directive's plan/payload schema`);
+  }
+  const createdId = (sealedIntentOf(eng, ws, res)?.events ?? []).find((e) => e.marker === "Create")?.aggregate;
+  lines.push(`\u2713 dispatch ${legs.domain}/${legs.directiveId} \u2014 offline write under the new law${createdId !== void 0 ? ` (${createdId.slice(0, 28)}\u2026)` : ""}`);
+  if (legs.query !== void 0) {
+    const rows = query(eng, ws, legs.query.id, JSON.stringify(legs.query.params));
+    if (rows.length !== 1 || createdId !== void 0 && rows[0].id !== createdId) {
+      return done(false, lines, `declared query ${legs.query.id} expected the 1 created row, got ${JSON.stringify(rows.map((r) => r.id))} \u2014 check the query's key fields against the directive's payload`);
+    }
+    lines.push(`\u2713 declared query ${legs.query.id} answers locally \u2014 1 row`);
+  }
+  if (legs.count !== void 0) {
+    const c = count(eng, ws, legs.count.id, legs.count.group).count;
+    if (c !== 1) {
+      return done(false, lines, `declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) expected 1, got ${c} \u2014 check the count's grouping against the created row`);
+    }
+    lines.push(`\u2713 declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) = 1 locally`);
+  }
+  return done(true, lines);
+}
+
+// src/dev.ts
+var out3 = (s) => void process.stdout.write(s + "\n");
+var err3 = (s) => void process.stderr.write("error: " + s + "\n");
+var WS = "dev";
+var DEFAULT_PORT = 7700;
+var DEBOUNCE_MS = 200;
+function statusScreen(s) {
+  const proofLine = s.proof === void 0 ? "\u2013 (no generated proof in build/ \u2014 every compile emits one when the law has a creating directive)" : s.proof.ok ? `\u2713 offline legs green in ${s.proof.ms.toFixed(0)} ms (${s.proof.legs.length} leg(s))` : `\u2717 RED \u2014 ${s.proof.error}`;
+  const lines = [
+    ``,
+    `githolon dev \u2014 ${s.packageName}   (cycle ${s.cycle}${s.lastError !== void 0 ? " \u2014 LAST COMPILE FAILED, serving the previous law" : ""})`,
+    `  law        ${s.lawHash.slice(0, 16)}\u2026  LIVE in the local holon`,
+    `  compile    ${s.compileMs.toFixed(0)} ms   law-install ${s.installMs.toFixed(0)} ms`,
+    `  proof      ${proofLine}`,
+    `  serving    http://127.0.0.1:${s.port}  (GET /query /counts/:id /sums/:id /aggregates/:id /status \xB7 POST /dispatch/:domain/:directive)`,
+    `  watching   ${s.watchRoots.join(" \xB7 ")}`,
+    `  data       ${s.intents} intent(s) on the dev chain \u2014 rows SURVIVE law edits`,
+    ``
+  ];
+  if (s.lastError !== void 0) lines.splice(5, 0, `  jam        ${s.lastError.split("\n")[0]}`);
+  return lines.join("\n");
+}
+function startServer(s) {
+  return new Promise((resolveSrv, rejectSrv) => {
+    const server = createServer((req, res) => {
+      const respond = (status2, body) => {
+        res.writeHead(status2, { "content-type": "application/json", "access-control-allow-origin": "*" });
+        res.end(JSON.stringify(body));
+      };
+      try {
+        const url = new URL(req.url ?? "/", `http://127.0.0.1:${s.port}`);
+        const p = url.pathname;
+        if (p === "/health") return respond(200, { ok: true });
+        if (p === "/status") {
+          return respond(200, {
+            ok: true,
+            package: s.packageName,
+            lawHash: s.lawHash,
+            cycle: s.cycle,
+            compileMs: Math.round(s.compileMs),
+            proof: s.proof === void 0 ? null : { ok: s.proof.ok, ms: Math.round(s.proof.ms), error: s.proof.error ?? null },
+            intents: s.intents,
+            watching: s.watchRoots
+          });
+        }
+        if (p === "/query") {
+          const queryId = url.searchParams.get("queryId");
+          if (queryId === null) return respond(400, { ok: false, error: "pass ?queryId=<id>&params=<json>" });
+          return respond(200, { ok: true, rows: query(s.eng, WS, queryId, url.searchParams.get("params") ?? "{}") });
+        }
+        const counts = p.match(/^\/counts\/([^/]+)$/);
+        if (counts !== null) return respond(200, { ok: true, count: count(s.eng, WS, decodeURIComponent(counts[1]), url.searchParams.get("group") ?? "").count });
+        const sums = p.match(/^\/sums\/([^/]+)$/);
+        if (sums !== null) return respond(200, { ok: true, sum: sum(s.eng, WS, decodeURIComponent(sums[1]), url.searchParams.get("group") ?? "").sum });
+        const byId = p.match(/^\/aggregates\/(.+)$/);
+        if (byId !== null) return respond(200, { ok: true, rows: qById(s.eng, WS, decodeURIComponent(byId[1])) });
+        const dispatch = p.match(/^\/dispatch\/([^/]+)\/([^/]+)$/);
+        if (dispatch !== null && req.method === "POST") {
+          const chunks = [];
+          req.on("data", (c) => chunks.push(c));
+          req.on("end", () => {
+            try {
+              const dec3 = new TextDecoder();
+              const body = chunks.map((c) => dec3.decode(c)).join("") || "{}";
+              const r = author(s.eng, WS, decodeURIComponent(dispatch[1]), decodeURIComponent(dispatch[2]), JSON.parse(body), s.lawHash);
+              if (r["ok"] === false) return respond(422, { ok: false, error: r["error"] });
+              s.intents++;
+              return respond(200, { ok: true, events: sealedIntentOf(s.eng, WS, r)?.events ?? [] });
+            } catch (e) {
+              return respond(422, { ok: false, error: String(e.message ?? e) });
+            }
+          });
+          return;
+        }
+        return respond(404, { ok: false, error: `no such route \u2014 GET /status /query /counts/:id /sums/:id /aggregates/:id, POST /dispatch/:domain/:directive` });
+      } catch (e) {
+        return respond(500, { ok: false, error: String(e.message ?? e) });
+      }
+    });
+    server.on("error", (e) => {
+      rejectSrv(new Error(`local server failed on port ${s.port}: ${e.code ?? e.message} \u2014 pick another with --port <n>`));
+    });
+    server.listen(s.port, "127.0.0.1", () => resolveSrv({ close: () => server.close() }));
+  });
+}
+function readDeployBody(cwd, packageName) {
+  const file = join6(cwd, "build", `${packageName}.deploy.json`);
+  if (!existsSync5(file)) {
+    throw new Error(`compile produced no ${file} \u2014 check the compile output above`);
+  }
+  return JSON.parse(readFileSync3(file, "utf8"));
+}
+async function installLaw(s, deployBody, installedBy) {
+  const newHash = await sha256hex(deployBody.packageUsda);
+  if (newHash === s.lawHash) return { ok: true };
+  const previous = { ...s.eng.manifestStrings };
+  const t0 = performance.now();
+  setManifests(s.eng, mergeManifests(s.runtime.manifests, deployBody));
+  const res = author(s.eng, WS, "nomos", "installDomain", installPayload(newHash, deployBody.packageUsda, installedBy), s.eng.hashes.nomos);
+  if (res.ok === false) {
+    setManifests(s.eng, previous);
+    return { ok: false, error: `law install refused: ${res.error ?? "unknown"} \u2014 the previous law (${s.lawHash.slice(0, 12)}\u2026) keeps serving; fix and save again` };
+  }
+  s.lawHash = newHash;
+  s.intents++;
+  s.installMs = performance.now() - t0;
+  return { ok: true };
+}
+async function runProofCycle(s, cwd, deployBody, installedBy) {
+  const proofPath = join6(cwd, "build", `${s.packageName}.proof.mts`);
+  if (!existsSync5(proofPath)) return void 0;
+  const scratch = `proof-${s.cycle}`;
+  try {
+    const legs = parseOfflineLegs(readFileSync3(proofPath, "utf8"));
+    await mountFresh(s.eng, scratch);
+    author(s.eng, scratch, "bootstrap", "installDomain", installPayload(s.eng.hashes.nomos, s.eng.nomosPkg, installedBy), "");
+    author(s.eng, scratch, "nomos", "installDomain", installPayload(s.lawHash, deployBody.packageUsda, installedBy), s.eng.hashes.nomos);
+    return runOfflineLegs(s.eng, scratch, s.lawHash, legs);
+  } catch (e) {
+    return { ok: false, ms: 0, legs: [], error: String(e.message ?? e) };
+  } finally {
+    unmount(s.eng, scratch);
+  }
+}
+async function dev(opts) {
+  const cwd = process.cwd();
+  const cloud = cloudBase(opts.cloud);
+  const project = await loadProject(cwd).catch((e) => {
+    err3(e.message);
+    return void 0;
+  });
+  if (project === void 0) {
+    if (!existsSync5(join6(cwd, CONFIG_FILE))) {
+      err3(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
+    }
+    return 1;
+  }
+  const creds = loadCreds();
+  const installedBy = creds.session?.uid ?? creds.principal ?? "githolon-dev";
+  out3(`githolon dev \u2014 ${project.name}: compiling\u2026`);
+  const firstCompile = await compileAsync(cwd);
+  if (!firstCompile.ok) {
+    err3(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
+${firstCompile.output}`);
+    return 1;
+  }
+  let deployBody;
+  try {
+    deployBody = readDeployBody(cwd, project.name);
+  } catch (e) {
+    err3(e.message);
+    return 1;
+  }
+  let engBoot;
+  try {
+    engBoot = await holonEngine(cloud, deployBody, installedBy);
+  } catch (e) {
+    err3(`cannot boot the local holon: ${String(e.message ?? e)}
+  the runtime rides ${cloud}/v1/runtime/* and is cached in ~/.holon/runtime after one fetch \u2014 connect once, then dev runs offline`);
+    return 1;
+  }
+  const s = {
+    eng: engBoot.eng,
+    runtime: engBoot.runtime,
+    packageName: project.name,
+    lawHash: "",
+    compileMs: firstCompile.ms,
+    installMs: 0,
+    proof: void 0,
+    cycle: 1,
+    intents: 0,
+    watchRoots: [],
+    port: opts.port ?? DEFAULT_PORT,
+    lastError: void 0
+  };
+  await mountFresh(s.eng, WS);
+  author(s.eng, WS, "bootstrap", "installDomain", installPayload(s.eng.hashes.nomos, s.eng.nomosPkg, installedBy), "");
+  s.intents++;
+  const installed = await installLaw(s, deployBody, installedBy);
+  if (!installed.ok) {
+    err3(installed.error ?? "law install failed");
+    return 1;
+  }
+  s.proof = await runProofCycle(s, cwd, deployBody, installedBy);
+  if (opts.once === true) {
+    out3(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
+    return s.proof === void 0 || s.proof.ok ? 0 : 1;
+  }
+  let server;
+  try {
+    server = await startServer(s);
+  } catch (e) {
+    err3(e.message);
+    return 1;
+  }
+  const moduleDirs = /* @__PURE__ */ new Set();
+  try {
+    const cfgModule = await import(pathToFileURL3(project.configPath).href);
+    for (const d of cfgModule.default?.domains ?? []) {
+      for (const m of d.modules ?? []) moduleDirs.add(dirname3(resolve(cwd, m)));
+    }
+  } catch {
+    moduleDirs.add(join6(cwd, "domains"));
+  }
+  if (moduleDirs.size === 0) moduleDirs.add(join6(cwd, "domains"));
+  let timer;
+  let cycling = false;
+  let queued = false;
+  const cycle = async () => {
+    if (cycling) {
+      queued = true;
+      return;
+    }
+    cycling = true;
+    s.cycle++;
+    const t0 = performance.now();
+    const run = await compileAsync(cwd);
+    s.compileMs = run.ms;
+    if (!run.ok) {
+      s.lastError = run.output.trim() || "compile failed";
+      out3(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
+${run.output}`);
+    } else {
+      s.lastError = void 0;
+      try {
+        const body = readDeployBody(cwd, s.packageName);
+        const inst = await installLaw(s, body, installedBy);
+        if (!inst.ok) {
+          s.lastError = inst.error ?? "install failed";
+          out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+        } else {
+          s.proof = await runProofCycle(s, cwd, body, installedBy);
+          const total = performance.now() - t0;
+          out3(statusScreen(s));
+          out3(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
+        }
+      } catch (e) {
+        s.lastError = String(e.message ?? e);
+        out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+      }
+    }
+    cycling = false;
+    if (queued) {
+      queued = false;
+      void cycle();
+    }
+  };
+  const onChange = (file) => {
+    if (file !== null && (file.startsWith("build") || file.includes("/build/"))) return;
+    clearTimeout(timer);
+    timer = setTimeout(() => void cycle(), DEBOUNCE_MS);
+  };
+  const watchers = [];
+  for (const d of moduleDirs) {
+    if (!existsSync5(d)) continue;
+    watchers.push(watch(d, { recursive: true }, (_evt, f) => onChange(f)));
+    s.watchRoots.push(d.startsWith(cwd) ? d.slice(cwd.length + 1) + "/" : d);
+  }
+  watchers.push(
+    watch(cwd, { recursive: false }, (_evt, f) => {
+      if (f === CONFIG_FILE) onChange(f);
+    })
+  );
+  s.watchRoots.push(CONFIG_FILE);
+  out3(statusScreen(s));
+  out3("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
+  return new Promise((resolveExit) => {
+    const stop = () => {
+      for (const w of watchers) w.close();
+      server.close();
+      resolveExit(0);
+    };
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+  });
+}
+
+// src/git.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { readFileSync as readFileSync4 } from "node:fs";
+var out4 = (s) => void process.stdout.write(s + "\n");
+var err4 = (s) => void process.stderr.write("error: " + s + "\n");
+function git2(args, opts = {}) {
+  const r = spawnSync2("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
+  return r.status ?? 1;
+}
+function ensureSecret(cloud, ws) {
+  const existing = getSecret(cloud, ws);
+  if (existing !== void 0) return existing;
+  const minted = `holon_v1_${randomBytes2(24).toString("hex")}`;
+  setSecret(cloud, ws, minted);
+  return minted;
+}
+function parseCredentialInput(input) {
+  const kv = {};
+  for (const line of input.split("\n")) {
+    if (line === "") break;
+    const i = line.indexOf("=");
+    if (i > 0) kv[line.slice(0, i)] = line.slice(i + 1);
+  }
+  return kv;
+}
+function workspaceFromPath(path) {
+  const m = (path ?? "").match(/^v1\/workspaces\/([^/]+)\/git(\/|$)/);
+  return m?.[1];
+}
+async function gitCredential(action) {
+  if (action !== "get") return 0;
+  const kv = parseCredentialInput(readFileSync4(0, "utf8"));
+  const ws = workspaceFromPath(kv["path"]);
+  if (kv["protocol"] !== "https" || ws === void 0) return 0;
+  const cloud = `https://${kv["host"]}`;
+  const token = await sessionToken().catch(() => void 0);
+  out4(`username=${token ?? "nomos"}`);
+  out4(`password=${ensureSecret(cloud, ws)}`);
+  out4("");
+  return 0;
+}
+async function gitSetup(opts) {
+  const cloud = cloudBase(opts.cloud);
+  const self = process.argv[1];
+  if (self === void 0) {
+    err4("cannot locate the githolon CLI entry to install as a credential helper");
+    return 1;
+  }
+  const helper = `!"${process.execPath}" "${self}" git-credential`;
+  if (git2(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git2(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
+    err4("git config failed \u2014 is git installed?");
+    return 1;
+  }
+  out4(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
+  out4(`  pushes/clones of ${cloud}/v1/workspaces/<ws>/git now authenticate from ~/.holon`);
+  return 0;
+}
+async function gitRemote(ws, name, opts) {
+  const cloud = cloudBase(opts.cloud);
+  if (git2(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
+    err4("not a git repository \u2014 run inside your repo (git init first)");
+    return 1;
+  }
+  const setupRc = await gitSetup(opts);
+  if (setupRc !== 0) return setupRc;
+  ensureSecret(cloud, ws);
+  const url = `${cloud}/v1/workspaces/${ws}/git`;
+  if (git2(["remote", "add", name, url], { quiet: true }) !== 0) {
+    if (git2(["remote", "set-url", name, url], { quiet: true }) !== 0) {
+      err4(`could not add or update remote '${name}'`);
+      return 1;
+    }
+  }
+  const token = await sessionToken().catch(() => void 0);
+  if (token === void 0) {
+    const principal = loadCreds().principal;
+    if (principal === void 0) {
+      err4(
+        `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
+  githolon login --agent   (then just push)
+  \u2014 or re-run after githolon ws create/login so a principal is on file`
+      );
+      return 1;
+    }
+    if (git2(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
+      err4("git config failed setting the principal header");
+      return 1;
+    }
+  }
+  out4(`\u2713 remote '${name}' \u2192 ${url}`);
+  out4(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
+  out4(`  birth/deploy by push:  git push ${name} main`);
+  return 0;
+}
+
+// src/help.ts
+var HELP = {
+  compile: {
+    usage: "githolon compile [config] [--layered]",
+    what: "Compile the package by ./nomos.package.mjs (the @githolon/dsl launcher): ONE deterministic\n.package.usda (sha256 = the law's content hash) + read/identity manifests + the deploy body +\nthe typed TS client + the generated proof \u2014 all into build/.",
+    flags: [
+      ["[config]", "an alternate config file (default: nomos.package.mjs)"],
+      ["--layered", "also emit the per-domain layered USD view"]
+    ],
+    examples: ["githolon compile", "githolon compile nomos.package.mjs --layered"]
+  },
+  proof: {
+    usage: "githolon proof [build/<name>.proof.mts]",
+    what: "Run the proof GENERATED from your law, live against the cloud (throwaway workspace \u2192\ndeploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence). ALL GREEN or it names the jam.\nThe offline half of the same proof reruns automatically inside `githolon dev`.",
+    examples: ["githolon proof", "githolon proof build/guestbook.proof.mts"]
+  },
+  dev: {
+    usage: "githolon dev [--port <n>] [--cloud <url>] [--once]",
+    what: "THE INNER LOOP: watch domains/ + nomos.package.mjs, recompile on save, install the law into\na LOCAL holon (the same engine plane the cloud edge runs \u2014 your data SURVIVES law edits),\nrerun the generated proof's OFFLINE legs, and serve local reads + dispatch on localhost.\nFully offline after the first runtime fetch (~/.holon/runtime).",
+    flags: [
+      ["--port <n>", "the local read server's port (default: 7700)"],
+      ["--cloud <url>", "where the runtime artifacts come from (default: $NOMOS_CLOUD or the public cloud)"],
+      ["--once", "one cycle (compile \u2192 law live \u2192 proof) then exit \u2014 the CI/smoke lane"]
+    ],
+    examples: [
+      "githolon dev",
+      "curl 'http://127.0.0.1:7700/status'",
+      `curl -X POST http://127.0.0.1:7700/dispatch/guestbook/signGuestbook -d '{"author":"ada","message":"hi","mood":"happy","signedAt":"2026-01-01T00:00:00.000Z"}'`,
+      "curl 'http://127.0.0.1:7700/query?queryId=entriesByAuthor&params=%7B%22author%22%3A%22ada%22%7D'"
+    ]
+  },
+  replay: {
+    usage: "githolon replay <ws|dir> [--step N] [--json] [--cloud <url>]",
+    what: "The ledger as film: walk a chain (cloud workspace or local holon directory) and re-apply it\nintent by intent through the SAME wasm gate edge admission runs \u2014 per step: directive, payload,\nthe rows it changed, running per-type tallies. Finale: the chain's verify_chain verdict.\nOn a TTY it steps interactively (enter = next, a = run to end, q = quit).",
+    flags: [
+      ["<ws|dir>", "a workspace name on the cloud, or a local holon directory (githolon ledger init)"],
+      ["--step N", "non-interactive; print the running tallies every N intents"],
+      ["--json", "one JSON line per step + the final verdict (pipe it)"],
+      ["--file <deploy.json>", "stage this deploy body's read manifests (default: the one in ./build)"]
+    ],
+    examples: ["githolon replay my-guestbook", "githolon replay ./my-holon --step 10", "githolon replay my-guestbook --json | jq .directive"]
+  },
+  status: {
+    usage: "githolon status [<ws>] [--target <name>] [--file <deploy.json>]",
+    what: "IS WHAT I BUILT WHAT IS DEPLOYED? Compares the local law hash (build/*.deploy.json) against\nthe workspace's installed law and names the remedy when they differ.\nExit codes: 0 in sync \xB7 2 drift \xB7 1 error.",
+    flags: [
+      ["[<ws>]", "explicit workspace; omitted \u21D2 the project's `workspace` binding in nomos.package.mjs"],
+      ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
+      ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"]
+    ],
+    examples: ["githolon status", "githolon status my-guestbook", "githolon status --target prod"]
+  },
+  generate: {
+    usage: "githolon generate <domain|aggregate|intent> <name> [--out <dir>] [--force] [--dry-run]",
+    what: "Rails-style scaffolds on @githolon/dsl: a full domain (aggregate + create/mutate directives),\na lone aggregate, or a lone directive. Names arrive in any casing.",
+    flags: [
+      ["--out <dir>", "target directory (default: ./domains)"],
+      ["--force", "overwrite an existing file"],
+      ["--dry-run", "print the scaffold to stdout, write nothing"]
+    ],
+    examples: ["githolon generate domain work_order", "githolon g aggregate TrackableAsset --dry-run"]
+  },
+  login: {
+    usage: "githolon login --agent | --token <refresh_token>",
+    what: "Establish the principal births ride. --agent self-onboards an anonymous VERIFIED identity\n(no human, no browser; linkable later); --token adopts an existing captain app session.\nSessions live in ~/.holon/credentials.json and auto-refresh.",
+    examples: ["githolon login --agent", "githolon login --token <refresh_token>"]
+  },
+  whoami: {
+    usage: "githolon whoami",
+    what: "Show the principal births will ride (session uid, or the transitional bare uid)."
+  },
+  logout: {
+    usage: "githolon logout",
+    what: "Clear the session. Stored workspace secrets are KEPT."
+  },
+  ws: {
+    usage: "githolon ws <create|status|retire> [<name>] [--principal <uid|token>] [--cloud <url>] [--target <name>]",
+    what: "Workspace lifecycle on Nomos Cloud. `create` births one (saves its ONE-TIME secret to\n~/.holon); `status` shows lineage/phase/verdicts; `retire` frees the quota slot (owner; nothing\nis deleted). `status` with no <name> resolves the project's `workspace` binding.",
+    flags: [
+      ["--principal <p>", "the birth's principal (uid or access token; remembered as the default)"],
+      ["--cloud <url>", "target cloud (default: $NOMOS_CLOUD or the public cloud)"],
+      ["--target <name>", "ws status: pick among the project's named workspace targets"]
+    ],
+    examples: ["githolon ws create my-guestbook", "githolon ws status", "githolon ws retire my-guestbook"]
+  },
+  deploy: {
+    usage: "githolon deploy [<ws>] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
+    what: "POST build/*.deploy.json with the stored workspace secret. Prints what MOVED (old \u2192 new law\nhash). With no <ws>, the project's `workspace` binding in nomos.package.mjs resolves it.",
+    flags: [
+      ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"],
+      ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
+      ["--cloud <url>", "target cloud"]
+    ],
+    examples: ["githolon deploy", "githolon deploy my-guestbook", "githolon deploy --target prod"]
+  },
+  secret: {
+    usage: "githolon secret <set <ws> <secret> | rotate <ws>> [--cloud <url>]",
+    what: "The workspace-secret store (~/.holon/credentials.json, 0600). `set` imports one you already\nhold; `rotate` mints a fresh one (and claims a legacy workspace).",
+    examples: ["githolon secret set my-ws nws_v1_\u2026", "githolon secret rotate my-ws"]
+  },
+  git: {
+    usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
+    what: "Stock git push as deploy/birth. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then: git push nomos main). With no <ws>, the\nproject's `workspace` binding resolves it.",
+    examples: ["githolon git setup", "githolon git remote my-guestbook", "git push nomos main"]
+  },
+  ledger: {
+    usage: "githolon ledger <init|verify> <dir> [--file <deploy.json>] [--cloud <url>]",
+    what: "Mint + assert a holon ON YOUR MACHINE. `init` writes genesis + your compiled law as a normal\ngit repo, verified by the SAME wasm gate the cloud runs; `verify` re-runs the chain's\nself-verification from disk. Push the repo to an unborn workspace to birth it.",
+    examples: ["githolon ledger init ./my-holon", "githolon ledger verify ./my-holon"]
+  }
+};
+function commandHelp(cmd) {
+  const h = cmd !== void 0 ? HELP[cmd === "g" ? "generate" : cmd] : void 0;
+  if (h === void 0) return void 0;
+  const lines = [`usage: ${h.usage}`, ``, h.what];
+  if (h.flags !== void 0 && h.flags.length > 0) {
+    lines.push(``, `flags:`);
+    const w = Math.max(...h.flags.map(([f]) => f.length));
+    for (const [flag, what] of h.flags) lines.push(`  ${flag.padEnd(w)}   ${what}`);
+  }
+  if (h.examples !== void 0 && h.examples.length > 0) {
+    lines.push(``, `examples:`);
+    for (const ex of h.examples) lines.push(`  ${ex}`);
+  }
+  return lines.join("\n") + "\n";
+}
+
+// src/ledger.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join7 } from "node:path";
+var out5 = (s) => void process.stdout.write(s + "\n");
+var err5 = (s) => void process.stderr.write("error: " + s + "\n");
+var WS2 = "local";
 async function ledgerInit(dir, opts) {
   const cloud = cloudBase(opts.cloud);
-  if (existsSync3(dir) && readdirSync2(dir).length > 0) {
-    err3(`refusing to mint into non-empty directory: ${dir}`);
+  if (existsSync6(dir) && readdirSync3(dir).length > 0) {
+    err5(`refusing to mint into non-empty directory: ${dir}`);
     return 1;
   }
   let deployFile;
   try {
     deployFile = discoverDeployJson(process.cwd(), opts.file);
   } catch (e) {
-    err3(e.message);
+    err5(e.message);
     return 1;
   }
-  const deployBody = JSON.parse(readFileSync3(deployFile, "utf8"));
+  const deployBody = JSON.parse(readFileSync5(deployFile, "utf8"));
   const domainHash = await sha256hex(deployBody.packageUsda);
   const c = loadCreds();
   const principal = await sessionToken().catch(() => void 0) !== void 0 ? c.session.uid : c.principal;
   if (principal === void 0) {
-    err3("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
+    err5("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
     return 1;
   }
-  out3(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
-  const { eng } = await engineFor(cloud, deployBody, principal);
-  author(eng, WS, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, principal), "");
-  author(eng, WS, "nomos", "installDomain", installPayload(domainHash, deployBody.packageUsda, principal), eng.hashes.nomos);
-  const verdict = verifyChainLocal(eng, WS);
+  out5(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
+  const { eng } = await holonEngine(cloud, deployBody, principal);
+  await mountFresh(eng, WS2);
+  author(eng, WS2, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, principal), "");
+  author(eng, WS2, "nomos", "installDomain", installPayload(domainHash, deployBody.packageUsda, principal), eng.hashes.nomos);
+  const verdict = verifyChainLocal(eng, WS2);
   if (!printVerdict(verdict)) return 1;
-  const gitTree = eng.preopen.dir.contents.get("ws").contents.get(WS).contents.get("nomos.git");
-  const gitDir = join3(dir, ".git");
+  const gitTree = eng.preopen.dir.contents.get("ws").contents.get(WS2).contents.get("nomos.git");
+  const gitDir = join7(dir, ".git");
   writeTreeToDisk(gitTree, gitDir);
-  const cfgPath = join3(gitDir, "config");
-  writeFileSync3(cfgPath, readFileSync3(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
-  spawnSync2("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
-  out3(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
-  out3(`
+  const cfgPath = join7(gitDir, "config");
+  writeFileSync4(cfgPath, readFileSync5(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
+  spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
+  out5(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
+  out5(`
 Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
-  out3(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
+  out5(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
-  const gitDir = existsSync3(join3(dir, ".git")) ? join3(dir, ".git") : dir;
-  if (!existsSync3(join3(gitDir, "HEAD"))) {
-    err3(`${dir} is not a git repo (no HEAD)`);
+  const gitDir = existsSync6(join7(dir, ".git")) ? join7(dir, ".git") : dir;
+  if (!existsSync6(join7(gitDir, "HEAD"))) {
+    err5(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
-  const { eng } = await engineFor(cloudBase(opts.cloud), void 0, "verify");
-  const wsDir = eng.preopen.dir.contents.get("ws").contents.get(WS);
+  const { eng } = await holonEngine(cloudBase(opts.cloud), void 0, "verify");
+  await mountFresh(eng, WS2);
+  const wsDir = eng.preopen.dir.contents.get("ws").contents.get(WS2);
   wsDir.contents.set("nomos.git", readTreeFromDisk(gitDir));
-  return printVerdict(verifyChainLocal(eng, WS)) ? 0 : 1;
+  return printVerdict(verifyChainLocal(eng, WS2)) ? 0 : 1;
+}
+
+// src/replay.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
+import { join as join8 } from "node:path";
+import git3 from "isomorphic-git";
+var out6 = (s) => void process.stdout.write(s + "\n");
+var err6 = (s) => void process.stderr.write("error: " + s + "\n");
+var SOURCE = "source";
+var REPLAY = "replay";
+function summarizePayload(payload, max = 100) {
+  if (payload === void 0) return "\u2014";
+  const parts = [];
+  for (const [k, v] of Object.entries(payload)) {
+    const lit = typeof v === "string" ? v : JSON.stringify(v) ?? "undefined";
+    parts.push(`${k}=${lit.length > 24 ? lit.slice(0, 21) + "\u2026" : lit}`);
+  }
+  const s = parts.join(" ");
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+function unwrapValue(v) {
+  if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+    const keys = Object.keys(v);
+    if (keys.length === 1 && /^[A-Z]/.test(keys[0])) return v[keys[0]];
+  }
+  return v;
+}
+function summarizeOps(ev, max = 100) {
+  const parts = [];
+  for (const o of ev.ops ?? []) {
+    if (o.field === "__type" || o.field === "__id") continue;
+    const kind = Object.keys(o.op ?? {})[0] ?? "?";
+    const val = JSON.stringify(unwrapValue(Object.values(o.op ?? {})[0]));
+    const lit = val !== void 0 && val.length > 20 ? val.slice(0, 17) + "\u2026" : val ?? "";
+    parts.push(kind === "Set" ? `${o.field}\u2190${lit}` : `${kind}(${o.field}${lit ? ` ${lit}` : ""})`);
+  }
+  const s = parts.join(" ");
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+function capJsonStrings(v, max = 2048) {
+  if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
+  if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
+  if (typeof v === "object" && v !== null) {
+    const out8 = {};
+    for (const [k, x] of Object.entries(v)) out8[k] = capJsonStrings(x, max);
+    return out8;
+  }
+  return v;
+}
+function typeOf(ev) {
+  for (const o of ev.ops ?? []) {
+    if (o.field === "__type") {
+      const v = o.op?.["Set"]?.Str;
+      if (typeof v === "string") return v;
+    }
+  }
+  return (ev.aggregate ?? "?").split(/[_:]/)[0] ?? "?";
+}
+async function walkChain(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const dec3 = new TextDecoder();
+  const entries = [];
+  for (const c of await git3.log({ fs: eng.fs, gitdir, ref: "main" })) {
+    try {
+      const { blob } = await git3.readBlob({ fs: eng.fs, gitdir, oid: c.oid, filepath: "intent.json" });
+      entries.push({ oid: c.oid, bytes: blob, doc: JSON.parse(dec3.decode(blob)) });
+    } catch {
+    }
+  }
+  entries.reverse();
+  return entries;
+}
+function readKey() {
+  return new Promise((resolveKey) => {
+    const stdin = process.stdin;
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const onData = (ch) => {
+      stdin.removeListener("data", onData);
+      stdin.setRawMode?.(false);
+      stdin.pause();
+      if (ch === "q" || ch === "") resolveKey("quit");
+      else if (ch === "a") resolveKey("all");
+      else resolveKey("next");
+    };
+    stdin.on("data", onData);
+  });
+}
+async function replay(target, opts) {
+  const cloud = cloudBase(opts.cloud);
+  const json = opts.json === true;
+  const emit = (o) => out6(JSON.stringify(o));
+  let overlay;
+  try {
+    overlay = JSON.parse(readFileSync6(discoverDeployJson(process.cwd(), opts.file), "utf8"));
+  } catch {
+    overlay = void 0;
+  }
+  let eng;
+  try {
+    ({ eng } = await holonEngine(cloud, overlay, "githolon-replay"));
+  } catch (e) {
+    err6(`cannot boot the local holon: ${String(e.message ?? e)}
+  the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);
+    return 1;
+  }
+  const isDir = existsSync7(target) || target.includes("/") || target.startsWith(".");
+  if (isDir) {
+    const gitDir = existsSync7(join8(target, ".git")) ? join8(target, ".git") : target;
+    if (!existsSync7(join8(gitDir, "HEAD"))) {
+      err6(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
+      return 1;
+    }
+    await mountFresh(eng, SOURCE);
+    eng.preopen.dir.contents.get("ws").contents.get(SOURCE).contents.set("nomos.git", readTreeFromDisk(gitDir));
+  } else {
+    const m = await mountWorkspace(eng, SOURCE, { remote: `${cloud}/v1/workspaces/${target}/git`, headers: {} });
+    if (m.restored !== true) {
+      err6(
+        `workspace '${target}' has no refs/heads/main on ${cloud} \u2014 nothing to replay` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : "") + `
+  check the name (githolon ws status ${target}), or pass a local holon directory instead`
+      );
+      return 1;
+    }
+  }
+  const chain = await walkChain(eng, SOURCE);
+  if (chain.length === 0) {
+    err6(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
+    return 1;
+  }
+  await mountFresh(eng, REPLAY);
+  const interactive = !json && opts.step === void 0 && process.stdout.isTTY === true && process.stdin.isTTY === true;
+  const stepEvery = opts.step ?? (json ? 0 : 0);
+  const tallies = /* @__PURE__ */ new Map();
+  let autoRun = !interactive;
+  if (!json) {
+    out6(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
+    if (interactive) out6("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
+  }
+  for (let i = 0; i < chain.length; i++) {
+    const { oid, bytes, doc } = chain[i];
+    const domain = doc.payload?.domain ?? "?";
+    const directive = doc.payload?.directiveId ?? "?";
+    const touched = (doc.events ?? []).map((e) => e.aggregate).filter((a) => typeof a === "string");
+    const before = new Map(touched.map((id) => [id, qById(eng, REPLAY, id)[0]?.data]));
+    const t0 = performance.now();
+    const res = applyIntentBytes(eng, REPLAY, bytes);
+    const ms = performance.now() - t0;
+    if (res.ok === false) {
+      const msg = `replay REFUSED at intent ${i} (${domain}/${directive}, ${oid.slice(0, 10)}): ${res.error ?? "unknown"}`;
+      if (json) emit({ step: i, oid, domain, directive, refused: true, error: res.error ?? "unknown" });
+      else err6(msg);
+      err6("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
+      printVerdict(verifyChainLocal(eng, SOURCE));
+      return 1;
+    }
+    for (const ev of doc.events ?? []) {
+      if (ev.marker === "Create") tallies.set(typeOf(ev), (tallies.get(typeOf(ev)) ?? 0) + 1);
+      if (ev.marker === "Delete") tallies.set(typeOf(ev), (tallies.get(typeOf(ev)) ?? 1) - 1);
+    }
+    if (json) {
+      emit({
+        step: i,
+        oid,
+        intentId: doc.id ?? null,
+        domain,
+        directive,
+        payload: capJsonStrings(doc.payload?.payload ?? null),
+        events: (doc.events ?? []).map((e) => ({ aggregate: e.aggregate, marker: e.marker, ops: summarizeOps(e) })),
+        applyMs: +ms.toFixed(1),
+        tallies: Object.fromEntries(tallies)
+      });
+    } else {
+      out6(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
+      out6(`      payload  ${summarizePayload(doc.payload?.payload)}`);
+      for (const ev of doc.events ?? []) {
+        const id = ev.aggregate ?? "?";
+        const was = before.get(id);
+        const verb = ev.marker === "Create" ? "+ created" : ev.marker === "Delete" ? "- deleted" : was === void 0 ? "~ touched" : "~ updated";
+        out6(`      ${verb}  ${id}`);
+        const ops = summarizeOps(ev);
+        if (ops.length > 0) out6(`                ${ops}`);
+      }
+      const tallyLine = [...tallies.entries()].map(([t, n]) => `${t}:${n}`).join("  ");
+      const showTally = stepEvery > 0 ? (i + 1) % stepEvery === 0 || i === chain.length - 1 : true;
+      if (showTally && tallyLine.length > 0) out6(`      rows     ${tallyLine}`);
+    }
+    if (interactive && !autoRun && i < chain.length - 1) {
+      const key = await readKey();
+      if (key === "quit") {
+        out6(`
+stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below covers the WHOLE chain as delivered`);
+        break;
+      }
+      if (key === "all") autoRun = true;
+    }
+  }
+  if (!json) out6("");
+  const verdict = verifyChainLocal(eng, SOURCE);
+  if (json) {
+    emit({ finale: true, verdict });
+    return verdict["valid"] === true ? 0 : 1;
+  }
+  return printVerdict(verdict) ? 0 : 1;
+}
+
+// src/status.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+var out7 = (s) => void process.stdout.write(s + "\n");
+var err7 = (s) => void process.stderr.write("error: " + s + "\n");
+function lawDiffVerdict(localHash, installed, ws) {
+  const active = installed.filter((d) => d.phase === "Active" && typeof d.domainHash === "string");
+  const match = active.find((d) => d.domainHash === localHash);
+  if (match !== void 0) {
+    return { inSync: true, lines: [`\u2713 in sync \u2014 the deployed law IS your local build (${localHash.slice(0, 16)}\u2026)`] };
+  }
+  const lines = [];
+  if (active.length === 0) {
+    lines.push(`\u2717 workspace '${ws}' has NO active tenant law \u2014 your local build is not deployed`);
+  } else {
+    lines.push(`\u2717 local law differs from every active installation on '${ws}':`);
+    for (const d of active) lines.push(`    deployed ${d.domainHash.slice(0, 16)}\u2026  (${d.installedBy ?? "?"})`);
+  }
+  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026)`);
+  return { inSync: false, lines };
+}
+async function status(wsArg, opts) {
+  const cloud = cloudBase(opts.cloud);
+  let ws;
+  try {
+    ws = await resolveWorkspace(wsArg, process.cwd(), opts.target, "githolon status <ws>");
+  } catch (e) {
+    err7(e.message);
+    return 1;
+  }
+  let localHash;
+  try {
+    const body = JSON.parse(readFileSync7(discoverDeployJson(process.cwd(), opts.file), "utf8"));
+    if (typeof body.packageUsda === "string") localHash = await sha256hex(body.packageUsda);
+  } catch {
+    localHash = void 0;
+  }
+  const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).catch(() => void 0);
+  if (r === void 0) {
+    err7(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
+    return 1;
+  }
+  const d = await r.json().catch(() => void 0);
+  if (!r.ok || d?.ok !== true) {
+    err7(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
+  is the workspace born? githolon ws create ${ws}`);
+    return 1;
+  }
+  out7(`workspace  ${ws} on ${cloud}`);
+  const domains = d.domains ?? [];
+  if (domains.length === 0) out7(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  for (const dom of domains) {
+    out7(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}`);
+  }
+  if (localHash === void 0) {
+    out7(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
+    return 0;
+  }
+  out7(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
+  const verdict = lawDiffVerdict(localHash, domains, ws);
+  for (const line of verdict.lines) out7(line);
+  return verdict.inSync ? 0 : 2;
 }
 
 // src/cli.ts
@@ -958,6 +1910,14 @@ var KINDS = ["domain", "aggregate", "intent"];
 var DEFAULT_OUT = "domains";
 var USAGE = `githolon \u2014 the Nomos developer CLI
 
+The inner loop:
+  githolon dev                                            watch \u2192 recompile \u2192 law LIVE in a local holon \u2192
+                                                       the generated proof's offline legs rerun \u2192 local
+                                                       reads served \u2014 sub-second, offline after warmup
+  githolon status [<ws>]                                  local law hash vs the DEPLOYED law, remedy named
+  githolon replay <ws|dir>                                the ledger as film: step the chain intent-by-
+                                                       intent; finale = the verify_chain verdict
+
 Authoring:
   githolon compile  [compiler args]                       compile the package by ./nomos.package.mjs
   githolon proof    [build/<name>.proof.mts]              run the proof GENERATED from your law, live
@@ -971,19 +1931,21 @@ Identity (~/.holon/credentials.json \u2014 sessions auto-refresh):
   githolon whoami                                         show the principal births will ride
   githolon logout                                         clear the session (workspace secrets kept)
 
-Nomos Cloud (secrets live in ~/.holon/credentials.json \u2014 never copy one by hand):
+Nomos Cloud (secrets live in ~/.holon/credentials.json \u2014 never copy one by hand;
+a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding):
   githolon ws create <name> [--principal <uid|token>]     birth a workspace; SAVES its one-time secret
                                                        (no identity on file? it self-onboards an agent login)
-  githolon ws status <name>                               workspace status (lineage, phase, verdicts)
+  githolon ws status [<name>]                             workspace status (lineage, phase, verdicts)
   githolon ws retire <name>                               retire a workspace (owner) \u2014 quota freed; data retained
                                                        per the license; reads keep serving
-  githolon deploy <ws> [--file <deploy.json>]             POST build/*.deploy.json with the stored secret
+  githolon deploy [<ws>] [--file <deploy.json>]           POST build/*.deploy.json with the stored secret;
+                                                       prints what moved (old \u2192 new law hash)
   githolon secret set <ws> <secret>                       import a secret you already hold
   githolon secret rotate <ws>                             rotate (and re-save) the workspace secret
 
 Git lane (stock git push as deploy/birth \u2014 see also: push-to-create):
   githolon git setup                                      install the credential helper for the cloud host
-  githolon git remote <ws> [<remoteName>]                 wire this repo to a workspace (default name: nomos)
+  githolon git remote [<ws>] [<remoteName>]               wire this repo to a workspace (default name: nomos)
                                                        then: git push nomos main
 
 The local-first lane (mint + assert a holon on YOUR machine, under YOUR identity):
@@ -993,21 +1955,23 @@ The local-first lane (mint + assert a holon on YOUR machine, under YOUR identity
 
 Options:
   --cloud <url>    target cloud (default: $NOMOS_CLOUD or https://nomos.captainapp.co.uk)
+  --target <name>  pick among the project's named workspace targets (workspace: { dev: \u2026, prod: \u2026 })
   --out <dir>      generate: target directory (default: ${DEFAULT_OUT})
   --force          generate: overwrite an existing file
   --dry-run        generate: print to stdout, write nothing
-  -h, --help       show this help
+  -h, --help       top level here; \`githolon <command> --help\` for that command's flags + examples
 `;
 function cloudArgs(rest) {
   const pos = [];
   const opts = {};
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--cloud" || a === "--principal" || a === "--file") {
+    if (a === "--cloud" || a === "--principal" || a === "--file" || a === "--target") {
       const v = rest[++i];
       if (v === void 0) return { pos, opts, bad: `${a} requires a value` };
       if (a === "--cloud") opts.cloud = v;
       else if (a === "--principal") opts.principal = v;
+      else if (a === "--target") opts.target = v;
       else opts.file = v;
     } else if (a.startsWith("--")) {
       return { pos, opts, bad: `unknown flag '${a}'` };
@@ -1027,17 +1991,30 @@ ${USAGE}`);
     return 1;
   };
   if (bad !== void 0) return usageFail(bad);
+  const boundWs = async (explicit, hint) => resolveWorkspace(explicit, process.cwd(), opts.target, hint);
   if (command === "ws") {
     const [sub2, name] = pos;
     if (sub2 === "create" && name !== void 0) return wsCreate(name, opts);
-    if (sub2 === "status" && name !== void 0) return wsStatus(name, opts);
+    if (sub2 === "status") {
+      try {
+        return await wsStatus(await boundWs(name, `githolon ws status <name>`), opts);
+      } catch (e) {
+        process.stderr.write(`error: ${e.message}
+`);
+        return 1;
+      }
+    }
     if (sub2 === "retire" && name !== void 0) return wsRetire(name, opts);
     return usageFail("expected: githolon ws <create|status|retire> <name>");
   }
   if (command === "deploy") {
-    const [ws2] = pos;
-    if (ws2 === void 0) return usageFail("expected: githolon deploy <ws>");
-    return deploy(ws2, opts);
+    try {
+      return await deploy(await boundWs(pos[0], `githolon deploy <ws>`), opts);
+    } catch (e) {
+      process.stderr.write(`error: ${e.message}
+`);
+      return 1;
+    }
   }
   const [sub, ws, secret] = pos;
   if (sub === "set" && ws !== void 0 && secret !== void 0) return secretSet(ws, secret, opts);
@@ -1047,24 +2024,6 @@ ${USAGE}`);
 function isKind(s) {
   return s !== void 0 && KINDS.includes(s);
 }
-function runCompile(args) {
-  const resolveDslPkg = (fromDir) => {
-    try {
-      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join4(fromDir, "noop.js")));
-      return req.resolve("@githolon/dsl/package.json");
-    } catch {
-      return void 0;
-    }
-  };
-  const dslPkg = resolveDslPkg(process.cwd()) ?? resolveDslPkg(void 0);
-  if (dslPkg === void 0) {
-    process.stderr.write("error: @githolon/dsl not found \u2014 add it to your project's dependencies\n");
-    return 1;
-  }
-  const launcher = join4(dirname2(dslPkg), "compile_package.mjs");
-  const r = spawnSync3(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
-  return r.status ?? 1;
-}
 function runProof(args) {
   const refuse = (m) => {
     process.stderr.write(`error: ${m}
@@ -1074,35 +2033,35 @@ function runProof(args) {
   const explicit = args.find((a) => !a.startsWith("--"));
   let proofPath;
   if (explicit !== void 0) {
-    proofPath = resolve(process.cwd(), explicit);
-    if (!existsSync4(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    proofPath = resolve2(process.cwd(), explicit);
+    if (!existsSync8(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
-    const buildDir = join4(process.cwd(), "build");
-    if (!existsSync4(buildDir)) {
+    const buildDir = join9(process.cwd(), "build");
+    if (!existsSync8(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
-    const proofs = readdirSync3(buildDir).filter((f) => f.endsWith(".proof.mts"));
+    const proofs = readdirSync4(buildDir).filter((f) => f.endsWith(".proof.mts"));
     if (proofs.length === 0) {
       return refuse("no build/*.proof.mts found \u2014 run `githolon compile` (every compile generates the proof from your law; the compile summary says why when it can't)");
     }
     if (proofs.length > 1) {
       return refuse(`found ${proofs.length} proofs (${proofs.join(", ")}) \u2014 name one: githolon proof build/<name>.proof.mts`);
     }
-    proofPath = join4(buildDir, proofs[0]);
+    proofPath = join9(buildDir, proofs[0]);
   }
   const resolvePkgDir = (name, fromDir) => {
     try {
-      return dirname2(createRequire(pathToFileURL(join4(fromDir, "noop.js"))).resolve(`${name}/package.json`));
+      return dirname4(createRequire2(pathToFileURL4(join9(fromDir, "noop.js"))).resolve(`${name}/package.json`));
     } catch {
       return void 0;
     }
   };
   const dslDir = (() => {
     try {
-      return dirname2(createRequire(pathToFileURL(join4(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
+      return dirname4(createRequire2(pathToFileURL4(join9(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
     } catch {
       try {
-        return dirname2(createRequire(import.meta.url).resolve("@githolon/dsl/package.json"));
+        return dirname4(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
       } catch {
         return void 0;
       }
@@ -1112,17 +2071,17 @@ function runProof(args) {
   if (tsxDir === void 0) {
     return refuse("tsx not found \u2014 add @githolon/dsl to your project's dependencies (tsx rides along) and npm install");
   }
-  const tsxPkg = JSON.parse(readFileSync4(join4(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync8(join9(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
-  const tsxCli = join4(tsxDir, tsxBinRel ?? "dist/cli.mjs");
-  const r = spawnSync3(process.execPath, [tsxCli, proofPath], { stdio: "inherit", cwd: process.cwd() });
+  const tsxCli = join9(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+  const r = spawnSync4(process.execPath, [tsxCli, proofPath], { stdio: "inherit", cwd: process.cwd() });
   return r.status ?? 1;
 }
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== "generate" && command !== "g") {
     throw new Error(
-      `Unknown command '${command ?? "(none)"}'. Expected compile | proof | generate | ws | deploy | secret.`
+      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | status | generate | ws | deploy | secret.`
     );
   }
   let outDir = DEFAULT_OUT;
@@ -1161,7 +2120,11 @@ function parseArgs(argv) {
   return { kind, name, outDir, force, dryRun };
 }
 async function main(argv) {
-  if (argv.length === 0 || argv.includes("-h") || argv.includes("--help")) {
+  if (argv.includes("-h") || argv.includes("--help")) {
+    process.stdout.write(commandHelp(argv[0]) ?? USAGE);
+    return 0;
+  }
+  if (argv.length === 0) {
     process.stdout.write(USAGE);
     return 0;
   }
@@ -1171,6 +2134,78 @@ async function main(argv) {
   if (argv[0] === "proof") {
     return runProof(argv.slice(1));
   }
+  if (argv[0] === "dev") {
+    const rest = argv.slice(1);
+    let cloud;
+    let port;
+    let once = false;
+    for (let i = 0; i < rest.length; i++) {
+      const a = rest[i];
+      if (a === "--once") once = true;
+      else if (a === "--cloud") {
+        cloud = rest[++i];
+        if (cloud === void 0) {
+          process.stderr.write("error: --cloud requires a value\n");
+          return 1;
+        }
+      } else if (a === "--port") {
+        port = Number(rest[++i]);
+        if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+          process.stderr.write("error: --port requires a port number (1-65535)\n");
+          return 1;
+        }
+      } else {
+        process.stderr.write(`error: unknown argument '${a}'
+
+${commandHelp("dev")}`);
+        return 1;
+      }
+    }
+    return dev({
+      ...cloud !== void 0 ? { cloud } : {},
+      ...port !== void 0 ? { port } : {},
+      ...once ? { once: true } : {}
+    });
+  }
+  if (argv[0] === "replay") {
+    const rest = argv.slice(1);
+    let step;
+    const sAt = rest.indexOf("--step");
+    if (sAt >= 0) {
+      step = Number(rest[sAt + 1]);
+      if (!Number.isInteger(step) || step <= 0) {
+        process.stderr.write("error: --step requires a positive intent count\n");
+        return 1;
+      }
+    }
+    const json = rest.includes("--json");
+    const cleaned = rest.filter((a, i) => a !== "--json" && a !== "--step" && !(sAt >= 0 && i === sAt + 1));
+    const { pos, opts, bad } = cloudArgs(cleaned);
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${commandHelp("replay")}`);
+      return 1;
+    }
+    const target = pos[0];
+    if (target === void 0) {
+      process.stderr.write(`error: expected: githolon replay <ws|dir>
+
+${commandHelp("replay")}`);
+      return 1;
+    }
+    return replay(target, { ...opts, ...step !== void 0 ? { step } : {}, ...json ? { json: true } : {} });
+  }
+  if (argv[0] === "status") {
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${commandHelp("status")}`);
+      return 1;
+    }
+    return status(pos[0], opts);
+  }
   if (argv[0] === "ws" || argv[0] === "deploy" || argv[0] === "secret") {
     return runCloud(argv);
   }
@@ -1213,8 +2248,16 @@ ${USAGE}`);
     }
     const [sub, ws, remoteName] = pos;
     if (sub === "setup") return gitSetup(opts);
-    if (sub === "remote" && ws !== void 0) return gitRemote(ws, remoteName ?? "nomos", opts);
-    process.stderr.write(`error: expected: githolon git <setup | remote <ws> [name]>
+    if (sub === "remote") {
+      try {
+        return await gitRemote(await resolveWorkspace(ws, process.cwd(), opts.target, "githolon git remote <ws>"), remoteName ?? "nomos", opts);
+      } catch (e) {
+        process.stderr.write(`error: ${e.message}
+`);
+        return 1;
+      }
+    }
+    process.stderr.write(`error: expected: githolon git <setup | remote [<ws>] [name]>
 
 ${USAGE}`);
     return 1;
@@ -1222,8 +2265,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err4) {
-    process.stderr.write(`error: ${err4.message}
+  } catch (err8) {
+    process.stderr.write(`error: ${err8.message}
 
 ${USAGE}`);
     return 1;
@@ -1242,8 +2285,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path}
 `);
     return 0;
-  } catch (err4) {
-    process.stderr.write(`error: ${err4.message}
+  } catch (err8) {
+    process.stderr.write(`error: ${err8.message}
 `);
     return 1;
   }