githolon 0.23.1 → 0.24.1

package/dist/cli.mjs

@@ -20,14 +20,19 @@ __export(governance_exports, {
   keyImport: () => keyImport,
   keyShow: () => keyShow,
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
-  signAndPostGovernance: () => signAndPostGovernance
+  signAndPostGovernance: () => signAndPostGovernance,
+  signAndPostOffer: () => signAndPostOffer
 });
 import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
 import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { connect } from "@githolon/client";
+async function clientConnect() {
+  const mod = await import("@githolon/client");
+  return mod.connect;
+}
 async function connectGovernance(cloud, parent) {
   const authToken = await sessionToken().catch(() => void 0);
   const clientId = `githolon-cli-${Date.now().toString(16)}`;
+  const connect = await clientConnect();
   return await connect({
     cloud,
     workspace: parent,
@@ -56,20 +61,24 @@ function resolveGovernancePrincipal(opts) {
   }
   return principal;
 }
-async function signAndPostGovernance(parent, directiveId, payload, opts) {
+async function signAndPostOffer(ws, domain, directiveId, payload, opts) {
   const cloud = cloudBase(opts.cloud);
   const principal = resolveGovernancePrincipal(opts);
-  const holon = await connectGovernance(cloud, parent);
+  const holon = await connectGovernance(cloud, ws);
   const device = await ensureDeviceKey(holon, principal);
   const sealed = await holon.signGovernanceOffer({
+    domain,
     directiveId,
     payload,
     authorSecret: device.secret,
     actor: `user:${principal}`
   });
-  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws: parent });
+  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws });
   return { ...verdict, principal };
 }
+async function signAndPostGovernance(parent, directiveId, payload, opts) {
+  return signAndPostOffer(parent, "workspaces", directiveId, payload, opts);
+}
 async function grantOrRevoke(verb, kind, subject, opts) {
   const parent = opts.parent ?? "root";
   const now = Date.now();
@@ -367,6 +376,7 @@ __export(cloud_exports, {
   wsStatus: () => wsStatus
 });
 import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
 import { join as join2 } from "node:path";
 import { homedir } from "node:os";
 function cloudBase(flag) {
@@ -645,21 +655,68 @@ async function deploy(ws, opts) {
     err2(e.message);
     return 1;
   }
+  const fileName = file.split("/").pop();
   const before = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
-  const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: readFileSync2(file, "utf8")
-  });
-  const d = await r.json().catch(() => void 0);
-  if (!r.ok || d?.ok !== true) {
-    err2(`deploy '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
-    return 1;
+  const principal = opts.principal ?? currentPrincipal();
+  const signed = opts.principal !== void 0 || principal !== void 0 && getDeviceKey(principal) !== void 0;
+  let phaseSuffix = "";
+  let deployedHash;
+  if (signed) {
+    let body;
+    try {
+      body = JSON.parse(readFileSync2(file, "utf8"));
+    } catch (e) {
+      err2(`deploy body ${file} is not valid JSON \u2014 recompile: ${e.message}`);
+      return 1;
+    }
+    const packageUsda = body.packageUsda;
+    if (typeof packageUsda !== "string" || packageUsda === "") {
+      err2(`deploy body ${file} is missing packageUsda \u2014 run \`githolon compile\` again`);
+      return 1;
+    }
+    const targetHash = createHash2("sha256").update(Buffer.from(packageUsda, "utf8")).digest("hex");
+    const { signAndPostOffer: signAndPostOffer2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
+    let v;
+    try {
+      const who = resolveGovernancePrincipal2(opts);
+      const installPayload2 = {
+        domainHash: targetHash,
+        packageUsda,
+        installedBy: `user:${who}`,
+        dependencies: [],
+        finalizers: [],
+        ...body.dispositions !== void 0 && body.dispositions !== null ? { dispositions: body.dispositions } : {}
+      };
+      v = await signAndPostOffer2(ws, "nomos", "installDomain", installPayload2, opts);
+    } catch (e) {
+      err2(e.message);
+      return 1;
+    }
+    if (!v.ok) {
+      err2(`signed deploy '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+      return 1;
+    }
+    deployedHash = targetHash;
+  } else {
+    const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: readFileSync2(file, "utf8")
+    });
+    const d = await r.json().catch(() => void 0);
+    if (!r.ok || d?.ok !== true) {
+      const txt = d ? JSON.stringify(d) : "no body";
+      err2(`deploy '${ws}' failed (${r.status}): ${txt}`);
+      if (r.status === 401 || r.status === 403 || r.status === 422 || /warrant|signed|signer|unsigned|authorship|forged|relation|installDomain/i.test(txt)) {
+        err2(`  this workspace looks WARRANTED \u2014 re-run with --as <principal> to author a SIGNED install offer`);
+        err2(`  (import the admin signing key first if needed: githolon key import --principal <uid> --secret <key>)`);
+      }
+      return 1;
+    }
+    const phase = d.installation?.[0]?.data?.["status.phase"];
+    phaseSuffix = typeof phase === "string" ? ` (${phase})` : "";
+    deployedHash = typeof d.domainHash === "string" ? d.domainHash : void 0;
   }
-  const phase = d.installation?.[0]?.data?.["status.phase"];
-  const fileName = file.split("/").pop();
-  const phaseSuffix = typeof phase === "string" ? ` (${phase})` : "";
-  const deployedHash = typeof d.domainHash === "string" ? d.domainHash : void 0;
   const after = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((ar) => ar.json()).then((ad) => ad.ok === true ? ad : {}).catch(() => ({}));
   const currentHashes = new Set(Object.values(after.currentLaw ?? {}));
   const hasCurrencyData = Object.keys(after.currentLaw ?? {}).length > 0;
@@ -1440,7 +1497,43 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if (cb.lawHashField !== void 0) payload[cb.lawHashField] = lawHash;
   const stamp = (/* @__PURE__ */ new Date()).toISOString();
   for (const f of cb.birthAutoStamped) payload[f] = stamp;
-  const res = author(eng, ws, cb.parentDomain, cb.birthDirectiveId, payload, lawHash);
+  const actor = actorFromPayload(payload, cb.birthActorField);
+  if (cb.birthRequiresRelation !== void 0 && actor === void 0) {
+    return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} is gated by .requires("${cb.birthRequiresRelation}") but the proof could not discover an actor field from the birth recipe \u2014 route the genesis step actor from a payload subject field`);
+  }
+  let parentWs = ws;
+  if (cb.parentSetup !== void 0) {
+    const setup = cb.parentSetup;
+    const setupPayload = { ...setup.birthPayload };
+    if (setup.frameworkHashField !== void 0) setupPayload[setup.frameworkHashField] = fw;
+    if (setup.lawHashField !== void 0) setupPayload[setup.lawHashField] = lawHash;
+    for (const f of setup.birthAutoStamped) setupPayload[f] = stamp;
+    if (setup.birthActorField !== void 0 && cb.birthActorField !== void 0 && payload[cb.birthActorField] !== void 0) {
+      setupPayload[setup.birthActorField] = payload[cb.birthActorField];
+    }
+    const setupActor = actorFromPayload(setupPayload, setup.birthActorField) ?? actor;
+    const setupOpts = setupActor !== void 0 ? { actor: setupActor } : {};
+    const setupRes = author(
+      eng,
+      ws,
+      setup.parentDomain,
+      setup.birthDirectiveId,
+      setupPayload,
+      lawHash,
+      setupOpts
+    );
+    if (setupRes.ok === false) {
+      return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: ${setupRes.error ?? "unknown"} \u2014 the proof could not birth the parent workspace needed before gated child birth`);
+    }
+    const bornParent = (setupRes.born ?? []).map((b) => b?.workspace).find((w) => typeof w === "string" && w.length > 0);
+    if (bornParent === void 0) {
+      return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} admitted but spawned no parent workspace (born=${JSON.stringify(setupRes.born ?? [])})`);
+    }
+    parentWs = bornParent;
+    lines.push(`\u2713 parent setup ${setup.parentDomain}/${setup.birthDirectiveId} \u2014 ${parentWs} born before gated child birth`);
+  }
+  const opts = actor !== void 0 ? { actor } : {};
+  const res = author(eng, parentWs, cb.parentDomain, cb.birthDirectiveId, payload, lawHash, opts);
   if (res.ok === false) {
     return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} refused: ${res.error ?? "unknown"} \u2014 the parent's own gate rejected the birth offer (check the .births() plan + payload)`);
   }
@@ -1494,6 +1587,11 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
   return done(true);
 }
+function actorFromPayload(payload, field) {
+  if (field === void 0) return void 0;
+  const value = payload[field];
+  return typeof value === "string" && value.trim().length > 0 ? value : void 0;
+}
 async function runOfflineProofStandalone(proofPath, cloud, domain) {
   const src = readFileSync4(proofPath, "utf8");
   const packageName = basename(proofPath).replace(/\.proof\.mts$/, "");
@@ -1736,7 +1834,6 @@ Re-run with --force to replace it.`
 
 // src/cli.ts
 init_cloud();
-init_governance();
 
 // src/compile.ts
 import { spawn, spawnSync } from "node:child_process";
@@ -3279,6 +3376,7 @@ ${commandHelp("status")}`);
     return runCloud(argv);
   }
   if (argv[0] === "key") {
+    const { keyEnroll: keyEnroll2, keyExport: keyExport2, keyImport: keyImport2, keyShow: keyShow2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
       process.stderr.write(`error: ${bad}
@@ -3287,16 +3385,17 @@ ${USAGE}`);
       return 1;
     }
     const [sub] = pos;
-    if (sub === "enroll") return keyEnroll(opts);
-    if (sub === "show") return keyShow(opts);
-    if (sub === "import") return keyImport(opts);
-    if (sub === "export") return keyExport(opts);
+    if (sub === "enroll") return keyEnroll2(opts);
+    if (sub === "show") return keyShow2(opts);
+    if (sub === "import") return keyImport2(opts);
+    if (sub === "export") return keyExport2(opts);
     process.stderr.write(`error: expected: githolon key <enroll|show|import|export> [--principal <uid>]
 
 ${USAGE}`);
     return 1;
   }
   if (argv[0] === "gov") {
+    const { governanceOffer: governanceOffer2, governanceRelay: governanceRelay2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
       process.stderr.write(`error: ${bad}
@@ -3312,7 +3411,7 @@ ${commandHelp("gov") ?? USAGE}`);
 ${commandHelp("gov") ?? USAGE}`);
         return 1;
       }
-      return governanceRelay(ws2, file, opts);
+      return governanceRelay2(ws2, file, opts);
     }
     const [ws, directiveId] = pos;
     if (ws === void 0 || directiveId === void 0) {
@@ -3321,9 +3420,10 @@ ${commandHelp("gov") ?? USAGE}`);
 ${commandHelp("gov") ?? USAGE}`);
       return 1;
     }
-    return governanceOffer(ws, directiveId, opts);
+    return governanceOffer2(ws, directiveId, opts);
   }
   if (argv[0] === "grant" || argv[0] === "revoke") {
+    const { grantOrRevoke: grantOrRevoke2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const verb = argv[0];
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
@@ -3339,7 +3439,7 @@ ${USAGE}`);
 ${USAGE}`);
       return 1;
     }
-    return grantOrRevoke(verb, kind, subject, opts);
+    return grantOrRevoke2(verb, kind, subject, opts);
   }
   if (argv[0] === "login") {
     const agent = argv.includes("--agent");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.23.1",
+  "version": "0.24.1",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -21,14 +21,16 @@
   "scripts": {
     "build": "node build.mjs",
     "prepare": "npm run build",
+    "pretest": "npm run build",
     "holon": "tsx src/cli.ts",
     "test": "vitest run",
+    "pretypecheck": "npm run build",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.23.1",
-    "@githolon/dsl": "^0.23.1",
+    "@githolon/client": "^0.24.1",
+    "@githolon/dsl": "^0.24.1",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {