githolon 0.24.0 → 0.25.0

package/dist/cli.mjs

@@ -25,10 +25,14 @@ __export(governance_exports, {
 });
 import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
 import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { connect } from "@githolon/client";
+async function clientConnect() {
+  const mod = await import("@githolon/client");
+  return mod.connect;
+}
 async function connectGovernance(cloud, parent) {
   const authToken = await sessionToken().catch(() => void 0);
   const clientId = `githolon-cli-${Date.now().toString(16)}`;
+  const connect = await clientConnect();
   return await connect({
     cloud,
     workspace: parent,
@@ -49,7 +53,7 @@ async function ensureDeviceKey(holon, principal) {
   return key;
 }
 function resolveGovernancePrincipal(opts) {
-  const principal = opts.principal ?? currentPrincipal();
+  const principal = opts.principal ?? activePrincipal();
   if (principal === void 0) {
     throw new Error(
       "signed governance needs a principal \u2014 githolon login --agent (self-onboarding), or pass --principal <your-auth-uid>"
@@ -120,7 +124,7 @@ async function grantOrRevoke(verb, kind, subject, opts) {
 }
 async function keyEnroll(opts) {
   const cloud = cloudBase(opts.cloud);
-  const principal = opts.principal ?? currentPrincipal();
+  const principal = opts.principal ?? activePrincipal();
   if (principal === void 0) {
     err("enroll needs a principal \u2014 githolon login --agent first (or --principal <uid>)");
     return 1;
@@ -151,7 +155,7 @@ async function keyEnroll(opts) {
   return 0;
 }
 async function keyShow(opts) {
-  const principal = opts.principal ?? currentPrincipal();
+  const principal = opts.principal ?? activePrincipal();
   if (principal === void 0) {
     out("no principal on file \u2014 githolon login --agent, or pass --principal <uid>");
     return 0;
@@ -188,7 +192,7 @@ function seedFromInput(input, opts) {
   );
 }
 async function keyImport(opts) {
-  const principal = opts.principal ?? currentPrincipal();
+  const principal = opts.principal ?? activePrincipal();
   if (principal === void 0) {
     err("key import needs --principal <uid> (the auth-uid this key authors as)");
     return 1;
@@ -217,7 +221,7 @@ async function keyImport(opts) {
   return 0;
 }
 async function keyExport(opts) {
-  const principal = opts.principal ?? currentPrincipal();
+  const principal = opts.principal ?? activePrincipal();
   if (principal === void 0) {
     err("key export needs --principal <uid>");
     return 1;
@@ -347,6 +351,9 @@ var init_governance = __esm({
 // src/cloud.ts
 var cloud_exports = {};
 __export(cloud_exports, {
+  activePrincipal: () => activePrincipal,
+  authUse: () => authUse,
+  clearActAs: () => clearActAs,
   cloudBase: () => cloudBase,
   configDir: () => configDir,
   currentPrincipal: () => currentPrincipal,
@@ -362,6 +369,7 @@ __export(cloud_exports, {
   secretRotate: () => secretRotate,
   secretSet: () => secretSet,
   sessionToken: () => sessionToken,
+  setActAs: () => setActAs,
   setDeviceKey: () => setDeviceKey,
   setPrincipal: () => setPrincipal,
   setSecret: () => setSecret,
@@ -416,6 +424,43 @@ function currentPrincipal() {
   const c = loadCreds();
   return c.session?.uid ?? c.principal;
 }
+function activePrincipal() {
+  return loadCreds().actAs ?? currentPrincipal();
+}
+function setActAs(principal) {
+  const c = loadCreds();
+  c.actAs = principal;
+  saveCreds(c);
+}
+function clearActAs() {
+  const c = loadCreds();
+  delete c.actAs;
+  saveCreds(c);
+}
+async function authUse(principal, opts = {}) {
+  if (opts.clear === true) {
+    clearActAs();
+    out2("\u2713 cleared the active signing principal \u2014 signed lanes fall back to the session / bare default");
+    return 0;
+  }
+  if (principal === void 0) {
+    const c = loadCreds();
+    const active = c.actAs;
+    out2(active !== void 0 ? `acting as  ${active}${getDeviceKey(active) ? "  (key on file \u2713)" : "  \u26A0 no signing key \u2014 githolon key import --principal " + active}` : "no active signing principal set (githolon use <uid>) \u2014 signed lanes use the session / bare default");
+    const keyed = Object.keys(c.devices ?? {});
+    if (keyed.length > 0) {
+      out2(`keys on file:`);
+      for (const p of keyed) out2(`  ${p}${p === active ? "  \u2190 active" : ""}`);
+    }
+    return 0;
+  }
+  setActAs(principal);
+  out2(`\u2713 now acting as ${principal} (signed deploy/gov/grant/key author as this principal)`);
+  if (getDeviceKey(principal) === void 0) {
+    out2(`  \u26A0 no signing key on file for ${principal} yet \u2014 import it: githolon key import --principal ${principal} --secret <key>`);
+  }
+  return 0;
+}
 function getDeviceKey(principal) {
   return loadCreds().devices?.[principal];
 }
@@ -506,13 +551,21 @@ async function whoami() {
   const c = loadCreds();
   if (c.session !== void 0) {
     out2(`session: ${c.session.anonymous ? "anonymous agent" : "account"} uid ${c.session.uid} (auth ${c.session.url})`);
-    return 0;
-  }
-  if (c.principal !== void 0) {
+  } else if (c.principal !== void 0) {
     out2(`bare principal (transitional, unverified): ${c.principal}`);
-    return 0;
+  } else {
+    out2("not logged in \u2014 githolon login --agent, or pass --principal <uid> per birth");
+  }
+  const active = activePrincipal();
+  if (c.actAs !== void 0) {
+    out2(`acting as: ${c.actAs}${getDeviceKey(c.actAs) ? " (key on file \u2713)" : " \u26A0 no signing key"}  [githolon use <uid> to switch]`);
+  } else if (active !== void 0) {
+    out2(`signed lanes act as: ${active} (the session/bare default \u2014 githolon use <uid> to switch)`);
+  }
+  const keyed = Object.keys(c.devices ?? {});
+  if (keyed.length > 0) {
+    out2(`signing keys on file: ${keyed.map((p) => p === active ? `${p} \u2190active` : p).join(", ")}`);
   }
-  out2("not logged in \u2014 githolon login --agent, or pass --principal <uid> per birth");
   return 0;
 }
 async function logout() {
@@ -653,7 +706,7 @@ async function deploy(ws, opts) {
   }
   const fileName = file.split("/").pop();
   const before = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd.domains ?? [] : []).catch(() => []);
-  const principal = opts.principal ?? currentPrincipal();
+  const principal = opts.principal ?? activePrincipal();
   const signed = opts.principal !== void 0 || principal !== void 0 && getDeviceKey(principal) !== void 0;
   let phaseSuffix = "";
   let deployedHash;
@@ -1493,7 +1546,43 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   if (cb.lawHashField !== void 0) payload[cb.lawHashField] = lawHash;
   const stamp = (/* @__PURE__ */ new Date()).toISOString();
   for (const f of cb.birthAutoStamped) payload[f] = stamp;
-  const res = author(eng, ws, cb.parentDomain, cb.birthDirectiveId, payload, lawHash);
+  const actor = actorFromPayload(payload, cb.birthActorField);
+  if (cb.birthRequiresRelation !== void 0 && actor === void 0) {
+    return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} is gated by .requires("${cb.birthRequiresRelation}") but the proof could not discover an actor field from the birth recipe \u2014 route the genesis step actor from a payload subject field`);
+  }
+  let parentWs = ws;
+  if (cb.parentSetup !== void 0) {
+    const setup = cb.parentSetup;
+    const setupPayload = { ...setup.birthPayload };
+    if (setup.frameworkHashField !== void 0) setupPayload[setup.frameworkHashField] = fw;
+    if (setup.lawHashField !== void 0) setupPayload[setup.lawHashField] = lawHash;
+    for (const f of setup.birthAutoStamped) setupPayload[f] = stamp;
+    if (setup.birthActorField !== void 0 && cb.birthActorField !== void 0 && payload[cb.birthActorField] !== void 0) {
+      setupPayload[setup.birthActorField] = payload[cb.birthActorField];
+    }
+    const setupActor = actorFromPayload(setupPayload, setup.birthActorField) ?? actor;
+    const setupOpts = setupActor !== void 0 ? { actor: setupActor } : {};
+    const setupRes = author(
+      eng,
+      ws,
+      setup.parentDomain,
+      setup.birthDirectiveId,
+      setupPayload,
+      lawHash,
+      setupOpts
+    );
+    if (setupRes.ok === false) {
+      return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: ${setupRes.error ?? "unknown"} \u2014 the proof could not birth the parent workspace needed before gated child birth`);
+    }
+    const bornParent = (setupRes.born ?? []).map((b) => b?.workspace).find((w) => typeof w === "string" && w.length > 0);
+    if (bornParent === void 0) {
+      return done(false, `parent setup ${setup.parentDomain}/${setup.birthDirectiveId} admitted but spawned no parent workspace (born=${JSON.stringify(setupRes.born ?? [])})`);
+    }
+    parentWs = bornParent;
+    lines.push(`\u2713 parent setup ${setup.parentDomain}/${setup.birthDirectiveId} \u2014 ${parentWs} born before gated child birth`);
+  }
+  const opts = actor !== void 0 ? { actor } : {};
+  const res = author(eng, parentWs, cb.parentDomain, cb.birthDirectiveId, payload, lawHash, opts);
   if (res.ok === false) {
     return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} refused: ${res.error ?? "unknown"} \u2014 the parent's own gate rejected the birth offer (check the .births() plan + payload)`);
   }
@@ -1547,6 +1636,11 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
   return done(true);
 }
+function actorFromPayload(payload, field) {
+  if (field === void 0) return void 0;
+  const value = payload[field];
+  return typeof value === "string" && value.trim().length > 0 ? value : void 0;
+}
 async function runOfflineProofStandalone(proofPath, cloud, domain) {
   const src = readFileSync4(proofPath, "utf8");
   const packageName = basename(proofPath).replace(/\.proof\.mts$/, "");
@@ -1789,7 +1883,6 @@ Re-run with --force to replace it.`
 
 // src/cli.ts
 init_cloud();
-init_governance();
 
 // src/compile.ts
 import { spawn, spawnSync } from "node:child_process";
@@ -2374,7 +2467,16 @@ var HELP = {
   },
   whoami: {
     usage: "githolon whoami",
-    what: "Show the principal births will ride (session uid, or the transitional bare uid)."
+    what: "Show the principal births will ride (session uid, or the transitional bare uid), the ACTIVE\nsigning principal (githolon use), and the signing keys on file."
+  },
+  use: {
+    usage: "githolon use [<uid>] [--clear]",
+    what: "Set, show, or clear the ACTIVE signing principal \u2014 the one the signed lanes (deploy, gov, grant,\nkey) author as by DEFAULT, without an explicit --as. Pair with `githolon key import` to hold an\nenrolled key per principal (a platform admin key, your own uid, \u2026) and switch which one acts with\none command. `--as`/`--principal` still overrides per-command. No argument shows the active\nprincipal + keys on file; `--clear` falls back to the session/bare default. Stored in ~/.holon.",
+    flags: [
+      ["<uid>", "the auth-uid to act as (must have a signing key \u2014 githolon key import)"],
+      ["--clear", "clear the active principal (signed lanes use the session/bare default)"]
+    ],
+    examples: ["githolon use d205ca94-...", "githolon use", "githolon use --clear"]
   },
   logout: {
     usage: "githolon logout",
@@ -2450,14 +2552,15 @@ var HELP = {
     examples: ["githolon revoke creation 32c7100e-\u2026", "githolon revoke admin 32c7100e-\u2026"]
   },
   deploy: {
-    usage: "githolon deploy [<ws>] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
-    what: "POST build/*.deploy.json on the OPEN deploy lane (kernel-gated \u2014 no host secret). Prints what\nMOVED (old \u2192 new law hash). With no <ws>, the project's `workspace` binding in nomos.package.mjs\nresolves it.",
+    usage: "githolon deploy [<ws>] [--as <uid>] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
+    what: "Deploy build/*.deploy.json \u2014 kernel-gated, no host secret. TWO lanes, picked automatically:\n\u2022 SIGNED (a WARRANTED ws, or when --as / the active `githolon use` principal has a signing key on\n  file): signs a `nomos/installDomain` offer with that key and relays it; the kernel re-verifies the\n  signature + judges the installDomain relation. Required for warranted platforms (co2, tbx) \u2014 an\n  unsigned install is refused there.\n\u2022 OPEN (unwarranted ws / no key): the open POST /domains, still kernel-judged.\nAfter the POST it re-reads the workspace and CONFIRMS the deployed hash is the CURRENT serving law\n(exit 2 if committed-but-not-current). Prints what MOVED (old \u2192 new law hash). With no <ws>, the\nproject's `workspace` binding in nomos.package.mjs resolves it.",
     flags: [
+      ["--as <uid>", "deploy as this principal via the SIGNED lane (needs its key \u2014 githolon key import; else githolon use)"],
       ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"],
       ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
       ["--cloud <url>", "target cloud"]
     ],
-    examples: ["githolon deploy", "githolon deploy my-guestbook", "githolon deploy --target prod"]
+    examples: ["githolon deploy", "githolon deploy my-guestbook", "githolon use <admin-uid> && githolon deploy co2-platform", "githolon deploy tbx --as <admin-uid>"]
   },
   secret: {
     usage: "githolon secret <set <ws> <push-password> | rotate <ws>> [--cloud <url>]",
@@ -2944,7 +3047,9 @@ Authoring:
 Identity (~/.holon/credentials.json \u2014 sessions auto-refresh):
   githolon login --agent                                  anonymous sign-in: a verified self-onboarded identity
   githolon login --token <refresh_token>                  adopt an existing captain app session
-  githolon whoami                                         show the principal births will ride
+  githolon whoami                                         show the principal births will ride + keys on file
+  githolon use [<uid>] [--clear]                          set/show/clear the ACTIVE signing principal: the one
+                                                       deploy/gov/grant/key author as (--as overrides per-cmd)
   githolon logout                                         clear the session (workspace secrets kept)
   githolon key enroll [--principal <uid>] [--parent <ws>] mint a signing device key + enroll it on-chain
                                                        (secret stays local; warrants SIGNED governance)
@@ -3000,12 +3105,13 @@ function cloudArgs(rest) {
   const pos = [];
   const opts = {};
   const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format"];
-  const BOOL_FLAGS = ["--sha256", "--stamp", "--yes"];
+  const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear"];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     if (BOOL_FLAGS.includes(a)) {
       if (a === "--sha256") opts.sha256 = true;
       else if (a === "--stamp") opts.stamp = true;
+      else if (a === "--clear") opts.clear = true;
       else opts.yes = true;
     } else if (VALUE_FLAGS.includes(a)) {
       const v = rest[++i];
@@ -3332,6 +3438,7 @@ ${commandHelp("status")}`);
     return runCloud(argv);
   }
   if (argv[0] === "key") {
+    const { keyEnroll: keyEnroll2, keyExport: keyExport2, keyImport: keyImport2, keyShow: keyShow2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
       process.stderr.write(`error: ${bad}
@@ -3340,16 +3447,17 @@ ${USAGE}`);
       return 1;
     }
     const [sub] = pos;
-    if (sub === "enroll") return keyEnroll(opts);
-    if (sub === "show") return keyShow(opts);
-    if (sub === "import") return keyImport(opts);
-    if (sub === "export") return keyExport(opts);
+    if (sub === "enroll") return keyEnroll2(opts);
+    if (sub === "show") return keyShow2(opts);
+    if (sub === "import") return keyImport2(opts);
+    if (sub === "export") return keyExport2(opts);
     process.stderr.write(`error: expected: githolon key <enroll|show|import|export> [--principal <uid>]
 
 ${USAGE}`);
     return 1;
   }
   if (argv[0] === "gov") {
+    const { governanceOffer: governanceOffer2, governanceRelay: governanceRelay2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
       process.stderr.write(`error: ${bad}
@@ -3365,7 +3473,7 @@ ${commandHelp("gov") ?? USAGE}`);
 ${commandHelp("gov") ?? USAGE}`);
         return 1;
       }
-      return governanceRelay(ws2, file, opts);
+      return governanceRelay2(ws2, file, opts);
     }
     const [ws, directiveId] = pos;
     if (ws === void 0 || directiveId === void 0) {
@@ -3374,9 +3482,10 @@ ${commandHelp("gov") ?? USAGE}`);
 ${commandHelp("gov") ?? USAGE}`);
       return 1;
     }
-    return governanceOffer(ws, directiveId, opts);
+    return governanceOffer2(ws, directiveId, opts);
   }
   if (argv[0] === "grant" || argv[0] === "revoke") {
+    const { grantOrRevoke: grantOrRevoke2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     const verb = argv[0];
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
@@ -3392,7 +3501,7 @@ ${USAGE}`);
 ${USAGE}`);
       return 1;
     }
-    return grantOrRevoke(verb, kind, subject, opts);
+    return grantOrRevoke2(verb, kind, subject, opts);
   }
   if (argv[0] === "login") {
     const agent = argv.includes("--agent");
@@ -3406,6 +3515,16 @@ ${USAGE}`);
   }
   if (argv[0] === "whoami") return whoami();
   if (argv[0] === "logout") return logout();
+  if (argv[0] === "use") {
+    const { pos, opts, bad } = cloudArgs(argv.slice(1));
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${USAGE}`);
+      return 1;
+    }
+    return authUse(pos[0], { clear: opts.clear === true });
+  }
   if (argv[0] === "ledger") {
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -21,14 +21,16 @@
   "scripts": {
     "build": "node build.mjs",
     "prepare": "npm run build",
+    "pretest": "npm run build",
     "holon": "tsx src/cli.ts",
     "test": "vitest run",
+    "pretypecheck": "npm run build",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.24.0",
-    "@githolon/dsl": "^0.24.0",
+    "@githolon/client": "^0.25.0",
+    "@githolon/dsl": "^0.25.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {