githolon 0.35.0 → 0.37.0

package/dist/cli.mjs

@@ -746,7 +746,14 @@ function setDeviceKey(principal, key) {
   saveCreds(c);
 }
 function principalHeaders(principal) {
-  return /^[\w-]+\.[\w-]+\.[\w-]+$/.test(principal) ? { "x-nomos-auth": principal } : { "x-nomos-principal": principal };
+  if (!/^[\w-]+\.[\w-]+\.[\w-]+$/.test(principal)) return { "x-nomos-principal": principal };
+  const headers = { "x-nomos-auth": principal };
+  try {
+    const payload = JSON.parse(Buffer.from(principal.split(".")[1], "base64url").toString("utf8"));
+    if (typeof payload.sub === "string" && payload.sub) headers["x-nomos-principal"] = payload.sub;
+  } catch {
+  }
+  return headers;
 }
 function sessionFromGotrue(d) {
   if (typeof d.access_token !== "string" || typeof d.refresh_token !== "string") return void 0;
@@ -1562,7 +1569,10 @@ function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}
       queryId: need.queryId,
       paramsJson: JSON.stringify(need.args),
       attestorSecret: secret,
-      nowMs: opts.attestNowMs ?? Date.now()
+      nowMs: opts.attestNowMs ?? Date.now(),
+      // K3 (§1.5.3): colocated custody is in-memory — always ask for the carried enrollment
+      // proof; the kernel produces-or-omits under its own bounds (the adapter decides nothing).
+      includeRosterProof: true
     });
     if (!served || served.ok !== true) break;
     envelope.attestations = [...envelope.attestations ?? [], { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
@@ -1688,11 +1698,11 @@ var init_engine = __esm({
     custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
     qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
     query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
-    attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs }) => JSON.parse(call(eng.ex, "query", {
+    attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs, includeRosterProof }) => JSON.parse(call(eng.ex, "query", {
       repoArg: repoArgOf(ws),
       workspace: ws,
       branch: BRANCH,
-      queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws })
+      queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...includeRosterProof ? { includeRosterProof: true } : {} })
     }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng.STDERR)).scopeKey;
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.35.0",
-    "@githolon/dsl": "^0.35.0",
+    "@githolon/client": "^0.37.0",
+    "@githolon/dsl": "^0.37.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {