githolon 0.23.1 → 0.24.0

package/dist/cli.mjs

@@ -20,7 +20,8 @@ __export(governance_exports, {
   keyImport: () => keyImport,
   keyShow: () => keyShow,
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
-  signAndPostGovernance: () => signAndPostGovernance
+  signAndPostGovernance: () => signAndPostGovernance,
+  signAndPostOffer: () => signAndPostOffer
 });
 import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
 import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
@@ -56,20 +57,24 @@ function resolveGovernancePrincipal(opts) {
   }
   return principal;
 }
-async function signAndPostGovernance(parent, directiveId, payload, opts) {
+async function signAndPostOffer(ws, domain, directiveId, payload, opts) {
   const cloud = cloudBase(opts.cloud);
   const principal = resolveGovernancePrincipal(opts);
-  const holon = await connectGovernance(cloud, parent);
+  const holon = await connectGovernance(cloud, ws);
   const device = await ensureDeviceKey(holon, principal);
   const sealed = await holon.signGovernanceOffer({
+    domain,
     directiveId,
     payload,
     authorSecret: device.secret,
     actor: `user:${principal}`
   });
-  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws: parent });
+  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws });
   return { ...verdict, principal };
 }
+async function signAndPostGovernance(parent, directiveId, payload, opts) {
+  return signAndPostOffer(parent, "workspaces", directiveId, payload, opts);
+}
 async function grantOrRevoke(verb, kind, subject, opts) {
   const parent = opts.parent ?? "root";
   const now = Date.now();
@@ -367,6 +372,7 @@ __export(cloud_exports, {
   wsStatus: () => wsStatus
 });
 import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
 import { join as join2 } from "node:path";
 import { homedir } from "node:os";
 function cloudBase(flag) {
@@ -645,21 +651,68 @@ async function deploy(ws, opts) {
     err2(e.message);
     return 1;
   }
+  const fileName = file.split("/").pop();
   const before = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
-  const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: readFileSync2(file, "utf8")
-  });
-  const d = await r.json().catch(() => void 0);
-  if (!r.ok || d?.ok !== true) {
-    err2(`deploy '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
+  const principal = opts.principal ?? currentPrincipal();
+  const signed = opts.principal !== void 0 || principal !== void 0 && getDeviceKey(principal) !== void 0;
+  let phaseSuffix = "";
+  let deployedHash;
+  if (signed) {
+    let body;
+    try {
+      body = JSON.parse(readFileSync2(file, "utf8"));
+    } catch (e) {
+      err2(`deploy body ${file} is not valid JSON \u2014 recompile: ${e.message}`);
+      return 1;
+    }
+    const packageUsda = body.packageUsda;
+    if (typeof packageUsda !== "string" || packageUsda === "") {
+      err2(`deploy body ${file} is missing packageUsda \u2014 run \`githolon compile\` again`);
+      return 1;
+    }
+    const targetHash = createHash2("sha256").update(Buffer.from(packageUsda, "utf8")).digest("hex");
+    const { signAndPostOffer: signAndPostOffer2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    let v;
+    try {
+      const who = resolveGovernancePrincipal2(opts);
+      const installPayload2 = {
+        domainHash: targetHash,
+        packageUsda,
+        installedBy: `user:${who}`,
+        dependencies: [],
+        finalizers: [],
+        ...body.dispositions !== void 0 && body.dispositions !== null ? { dispositions: body.dispositions } : {}
+      };
+      v = await signAndPostOffer2(ws, "nomos", "installDomain", installPayload2, opts);
+    } catch (e) {
+      err2(e.message);
+      return 1;
+    }
+    if (!v.ok) {
+      err2(`signed deploy '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+      return 1;
+    }
+    deployedHash = targetHash;
+  } else {
+    const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: readFileSync2(file, "utf8")
+    });
+    const d = await r.json().catch(() => void 0);
+    if (!r.ok || d?.ok !== true) {
+      const txt = d ? JSON.stringify(d) : "no body";
+      err2(`deploy '${ws}' failed (${r.status}): ${txt}`);
+      if (r.status === 401 || r.status === 403 || r.status === 422 || /warrant|signed|signer|unsigned|authorship|forged|relation|installDomain/i.test(txt)) {
+        err2(`  this workspace looks WARRANTED \u2014 re-run with --as <principal> to author a SIGNED install offer`);
+        err2(`  (import the admin signing key first if needed: githolon key import --principal <uid> --secret <key>)`);
+      }
+      return 1;
+    }
+    const phase = d.installation?.[0]?.data?.["status.phase"];
+    phaseSuffix = typeof phase === "string" ? ` (${phase})` : "";
+    deployedHash = typeof d.domainHash === "string" ? d.domainHash : void 0;
   }
-  const phase = d.installation?.[0]?.data?.["status.phase"];
-  const fileName = file.split("/").pop();
-  const phaseSuffix = typeof phase === "string" ? ` (${phase})` : "";
-  const deployedHash = typeof d.domainHash === "string" ? d.domainHash : void 0;
   const after = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((ar) => ar.json()).then((ad) => ad.ok === true ? ad : {}).catch(() => ({}));
   const currentHashes = new Set(Object.values(after.currentLaw ?? {}));
   const hasCurrencyData = Object.keys(after.currentLaw ?? {}).length > 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.23.1",
+  "version": "0.24.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -27,8 +27,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.23.1",
-    "@githolon/dsl": "^0.23.1",
+    "@githolon/client": "^0.24.0",
+    "@githolon/dsl": "^0.24.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {