githolon 0.34.1 → 0.36.0

package/dist/cli.mjs

@@ -1540,11 +1540,38 @@ function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}
     capPorts.principal_verified = !!opts.principalVerified;
   }
   const envelope = { payload: { domain, directiveId, payload }, captured_ports: capPorts, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
+  if (opts.attestations !== void 0) envelope.attestations = opts.attestations;
   writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
   writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
   const genesis = !controllerHash;
+  const attestorSecretFor = (from) => {
+    const s = opts.attestorSecrets;
+    if (!s) return null;
+    if (typeof s === "string") return s;
+    return typeof s[from] === "string" ? s[from] : null;
+  };
   const defer = opts.deferProjection !== false;
-  const v = JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  const offerOnce = () => JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  let v = offerOnce();
+  for (let pass = 0; pass < 8 && v.outcome === "refused"; pass++) {
+    const need = parseAttestedReadNeed(v.verdict?.reason ?? v.error);
+    if (!need || !eng.mounted.has(need.from)) break;
+    const secret = attestorSecretFor(need.from);
+    if (!secret) break;
+    const served = attestedRead(eng, need.from, {
+      queryId: need.queryId,
+      paramsJson: JSON.stringify(need.args),
+      attestorSecret: secret,
+      nowMs: opts.attestNowMs ?? Date.now(),
+      // K3 (§1.5.3): colocated custody is in-memory — always ask for the carried enrollment
+      // proof; the kernel produces-or-omits under its own bounds (the adapter decides nothing).
+      includeRosterProof: true
+    });
+    if (!served || served.ok !== true) break;
+    envelope.attestations = [...envelope.attestations ?? [], { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
+    writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
+    v = offerOnce();
+  }
   const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, ...v.born ? { born: v.born } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
@@ -1577,6 +1604,19 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
+function parseAttestedReadNeed(error) {
+  const m = /attested-read-unreachable: read\('([^']+)', \{from: '([^']+)'\}\) args=(.*?) has no injected attestation/.exec(String(error || ""));
+  if (!m) return null;
+  let blob = m[3];
+  for (let i = 0; i < 4; i++) {
+    try {
+      return { queryId: m[1], from: m[2], args: JSON.parse(blob) };
+    } catch {
+      blob = blob.replace(/\\(["\\])/g, "$1");
+    }
+  }
+  return null;
+}
 function offerIntent(eng, ws, bytes, opts) {
   const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
@@ -1594,7 +1634,7 @@ function applyIntentBytes(eng, ws, bytes, opts) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, cryptoUnwrapKey, count, sum;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, attestedRead, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
@@ -1651,6 +1691,12 @@ var init_engine = __esm({
     custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
     qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
     query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
+    attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs, includeRosterProof }) => JSON.parse(call(eng.ex, "query", {
+      repoArg: repoArgOf(ws),
+      workspace: ws,
+      branch: BRANCH,
+      queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...includeRosterProof ? { includeRosterProof: true } : {} })
+    }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng.STDERR)).scopeKey;
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.34.1",
+  "version": "0.36.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.34.1",
-    "@githolon/dsl": "^0.34.1",
+    "@githolon/client": "^0.36.0",
+    "@githolon/dsl": "^0.36.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {