githolon 0.27.1 → 0.29.0

package/dist/cli.mjs

@@ -1435,7 +1435,8 @@ __export(proof_offline_exports, {
   parseOfflineLegs: () => parseOfflineLegs,
   runChildBirthLeg: () => runChildBirthLeg,
   runOfflineLegs: () => runOfflineLegs,
-  runOfflineProofStandalone: () => runOfflineProofStandalone
+  runOfflineProofStandalone: () => runOfflineProofStandalone,
+  runRelationBootstrapLeg: () => runRelationBootstrapLeg
 });
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
 import { basename, dirname as dirname3, join as join6 } from "node:path";
@@ -1530,7 +1531,12 @@ function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash) {
     lines.push(...v.legs);
     if (!v.ok) return done(false, lines, v.error);
   }
-  if (legs.directiveId === void 0 && legs.childBirth === void 0) {
+  if (legs.relationBootstrap !== void 0) {
+    const v = runRelationBootstrapLeg(eng, ws, lawHash, legs.relationBootstrap);
+    lines.push(...v.legs);
+    if (!v.ok) return done(false, lines, v.error);
+  }
+  if (legs.directiveId === void 0 && legs.childBirth === void 0 && legs.relationBootstrap === void 0) {
     lines.push(`\u2713 ${legs.domain} \u2014 compile-valid (the law compiled; no standalone create or .births() to prove a write)${kinds.length ? ` [${kinds.join(", ")}]` : ""}`);
   }
   return done(true, lines);
@@ -1635,6 +1641,46 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   lines.push(`\u2713 verify_chain GREEN on the born child ${childWs} (${verdict.plansRerun ?? "?"} plans re-run \u2014 it self-validates from intent 0 through its OWN gate)`);
   return done(true);
 }
+function runRelationBootstrapLeg(eng, ws, lawHash, rb) {
+  const t0 = performance.now();
+  const lines = [];
+  const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
+  const ACTOR = "user:proof-conformance";
+  const actorOpts = { actor: ACTOR };
+  const stamp = (/* @__PURE__ */ new Date()).toISOString();
+  const grantedRelation = rb.grantedRelation ?? rb.relation;
+  const computed = grantedRelation !== rb.relation;
+  const speculative = rb.seedSpeculative === true;
+  const grantPayload = { ...rb.grantPayload };
+  const overwrite = /* @__PURE__ */ new Set([...rb.grantSubjectFields, ...rb.grantGrantedByFields]);
+  for (const k of Object.keys(grantPayload)) {
+    if (overwrite.has(k) || /^(subject|principal|grantedBy|grantee|member|user|owner)$/i.test(k)) grantPayload[k] = ACTOR;
+  }
+  for (const f of rb.grantAutoStamped) grantPayload[f] = stamp;
+  const grantRes = author(eng, ws, rb.domain, rb.grantDirectiveId, grantPayload, lawHash, actorOpts);
+  if (grantRes.ok === false) {
+    if (speculative) {
+      lines.push(`\u2013 relation-bootstrap leg SKIPPED (layer-3 seed-path) \u2014 the declared seed ${rb.domain}/${rb.grantDirectiveId} could not be replayed (${grantRes.error ?? "refused"}); the gate ${rb.gatedDirectiveId} .requires("${rb.relation}") stays proven negatively by the conformance leg`);
+      return done(true);
+    }
+    return done(false, `relation bootstrap grant ${rb.domain}/${rb.grantDirectiveId} refused: ${grantRes.error ?? "unknown"} \u2014 the grant that should seat "${grantedRelation}" on the proof actor was rejected (is ${rb.grantDirectiveId} itself gated? add .grants("${grantedRelation}") + an ungated bootstrap, or prove by hand)`);
+  }
+  const seatDesc = speculative ? `replayed the declared seed ${rb.domain}/${rb.grantDirectiveId} (seats [${(rb.seedWritesRelations ?? [grantedRelation]).join(", ")}]) on ${ACTOR} \u2014 deferring to the real gate to authorize "${rb.relation}"` : `${rb.domain}/${rb.grantDirectiveId} granted "${grantedRelation}" to ${ACTOR} (${rb.via})${computed ? ` \u21D2 satisfies "${rb.relation}" via the rewrite` : ``}`;
+  lines.push(`\u2713 relation bootstrap (${speculative ? "seed" : "grant"}) \u2014 ${seatDesc}`);
+  const gatedPayload = { ...rb.gatedPayload };
+  for (const f of rb.gatedAutoStamped) gatedPayload[f] = stamp;
+  if (rb.gatedMintField !== void 0 && rb.gatedAggregateId !== void 0) gatedPayload[rb.gatedMintField] = mintId(eng, rb.gatedAggregateId);
+  const gatedRes = author(eng, ws, rb.domain, rb.gatedDirectiveId, gatedPayload, lawHash, actorOpts);
+  if (gatedRes.ok === false) {
+    if (speculative) {
+      lines.push(`\u2013 relation-bootstrap leg SKIPPED (layer-3 seed-path) \u2014 replaying the declared seed ${rb.domain}/${rb.grantDirectiveId} did NOT authorize ${rb.gatedDirectiveId} .requires("${rb.relation}") on the real gate (${gatedRes.error ?? "refused"}); no seed-path is provable, so no positive leg is emitted (the conformance leg still proves the gate refuses an actorless offer)`);
+      return done(true);
+    }
+    return done(false, `relation bootstrap prove ${rb.domain}/${rb.gatedDirectiveId} refused: ${gatedRes.error ?? "unknown"} \u2014 the gated write did NOT succeed even after granting "${grantedRelation}" to the actor${computed ? ` (which should satisfy "${rb.relation}" via the rewrite)` : ``} (the gate is not honoring the seeded relation, OR the grant did not seat it on ${ACTOR})`);
+  }
+  lines.push(speculative ? `\u2713 relation bootstrap (prove) \u2014 ${rb.domain}/${rb.gatedDirectiveId} authored under the replayed seed (gated write SUCCEEDS \u2014 the REAL kernel gate confirmed the replayed seed establishes authority for "${rb.relation}")` : `\u2713 relation bootstrap (prove) \u2014 ${rb.domain}/${rb.gatedDirectiveId} authored under the seeded holder of "${rb.relation}" (gated write SUCCEEDS once granted)`);
+  return done(true);
+}
 function actorFromPayload(payload, field) {
   if (field === void 0) return void 0;
   const value = payload[field];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.27.1",
+  "version": "0.29.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.27.1",
-    "@githolon/dsl": "^0.27.1",
+    "@githolon/client": "^0.29.0",
+    "@githolon/dsl": "^0.29.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {