githolon 0.4.0 → 0.5.1

package/dist/cli.mjs

@@ -1,197 +1,40 @@
 #!/usr/bin/env node
-
-// src/cli.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "node:fs";
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname4, join as join9, resolve as resolve2 } from "node:path";
-import { pathToFileURL as pathToFileURL4 } from "node:url";
-
-// src/generate.ts
-import { mkdirSync, existsSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-// src/naming.ts
-function words(raw) {
-  return raw.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_\-\s]+/g, " ").trim().toLowerCase().split(" ").filter((w) => w.length > 0);
-}
-var cap = (w) => w.length === 0 ? w : w[0].toUpperCase() + w.slice(1);
-function pascalCase(raw) {
-  return words(raw).map(cap).join("");
-}
-function camelCase(raw) {
-  return words(raw).map((w, i) => i === 0 ? w : cap(w)).join("");
-}
-function snakeCase(raw) {
-  return words(raw).join("_");
-}
-function screamingSnakeCase(raw) {
-  return words(raw).join("_").toUpperCase();
-}
-function assertValidName(raw) {
-  const ws = words(raw);
-  if (ws.length === 0) {
-    throw new Error(`Invalid name: '${raw}' \u2014 give at least one word, e.g. 'work_order'.`);
-  }
-  for (const w of ws) {
-    if (!/^[a-z][a-z0-9]*$/.test(w)) {
-      throw new Error(
-        `Invalid name token '${w}' in '${raw}' \u2014 words must be alphanumeric and start with a letter (got after normalisation: ${ws.join(", ")}).`
-      );
-    }
-  }
-  return ws;
-}
-
-// src/templates.ts
-function namesFor(raw) {
-  return {
-    raw,
-    pascal: pascalCase(raw),
-    camel: camelCase(raw),
-    statusesConst: `${screamingSnakeCase(raw)}_STATUSES`
-  };
-}
-var HEADER = (raw, kind) => `/**
- * The \`${raw}\` ${kind} \u2014 scaffolded by \`githolon generate\`.
- *
- * Authoring rules (see @githolon/dsl): write ONLY aggregates (typed fields, each
- * tagged with a merge Driver) and directives (Zod payload + declarative plan).
- * You never write apply/fold/merge \u2014 the kernel owns the merge algebra.
- *
- * Convention: the fail-closed \`Conflict\` driver is the default for scalars.
- * Relax only what differs: \`.merge(Lww)\`, \`.merge(AddWins)\`, \`.merge(MapOf(Lww))\`.
- */`;
-function aggregateBlock(n) {
-  return `export const ${n.statusesConst} = ["active", "retired"] as const;
-
-export const ${n.pascal} = aggregate("${n.pascal}", {
-  // Default driver is the fail-closed \`Conflict\`: concurrent edits surface
-  // as a conflict rather than silently coalescing. Declare only what differs.
-  label: t.string().merge(Conflict),
-  // Overrides \u2014 last-write-wins / set-union / per-key map:
-  pos: t.int().merge(Lww),
-  status: t.enum(${n.statusesConst}).merge(Lww),
-  tags: t.set(t.string()).merge(AddWins),
-  customFields: t.map(t.string()).merge(MapOf(Lww)),
-});`;
-}
-function domainTemplate(raw) {
-  const n = namesFor(raw);
-  return `${HEADER(raw, "domain")}
-import {
-  z,
-  aggregate,
-  directive,
-  t,
-  Conflict,
-  Lww,
-  AddWins,
-  MapOf,
-  set,
-  addToSet,
-  setEntry,
-} from "@githolon/dsl";
-
-${aggregateBlock(n)}
-
-/** create${n.pascal} \u2014 .creates the aggregate; seeds label/pos/status. */
-export const create${n.pascal} = directive("create${n.pascal}")
-  .creates(${n.pascal})
-  .payload(
-    z.object({
-      label: z.string(),
-      pos: z.number().int(),
-      status: z.enum(${n.statusesConst}),
-    }),
-  )
-  .plan((p) => [
-    set(${n.pascal}, "label", p.label),
-    set(${n.pascal}, "pos", p.pos),
-    set(${n.pascal}, "status", p.status),
-  ]);
-
-/** move${n.pascal} \u2014 .mutates pos. */
-export const move${n.pascal} = directive("move${n.pascal}")
-  .mutates(${n.pascal})
-  .payload(z.object({ pos: z.number().int() }))
-  .plan((p) => [set(${n.pascal}, "pos", p.pos)]);
-
-/** tag${n.pascal} \u2014 .mutates tags (add-wins union). */
-export const tag${n.pascal} = directive("tag${n.pascal}")
-  .mutates(${n.pascal})
-  .payload(z.object({ tags: z.array(z.string()) }))
-  .plan((p) => [addToSet(${n.pascal}, "tags", p.tags)]);
-
-/** setCustomFieldOn${n.pascal} \u2014 .mutates customFields (a map entry). */
-export const setCustomFieldOn${n.pascal} = directive("setCustomFieldOn${n.pascal}")
-  .mutates(${n.pascal})
-  .payload(z.object({ key: z.string(), value: z.string() }))
-  .plan((p) => [setEntry(${n.pascal}, "customFields", p.key, p.value)]);
-`;
-}
-function aggregateTemplate(raw) {
-  const n = namesFor(raw);
-  return `${HEADER(raw, "aggregate")}
-import { aggregate, t, Conflict, Lww, AddWins, MapOf } from "@githolon/dsl";
-
-${aggregateBlock(n)}
-`;
-}
-function intentTemplate(raw) {
-  const n = namesFor(raw);
-  return `${HEADER(raw, "intent (directive)")}
-import { z, aggregate, directive, t, Conflict, set } from "@githolon/dsl";
-
-// Stub target \u2014 in a real domain, import the existing aggregate handle instead.
-export const ${n.pascal} = aggregate("${n.pascal}", {
-  label: t.string().merge(Conflict),
-});
-
-/** ${n.camel} \u2014 .mutates the target aggregate. */
-export const ${n.camel} = directive("${n.camel}")
-  .mutates(${n.pascal})
-  .payload(z.object({ label: z.string() }))
-  .plan((p) => [set(${n.pascal}, "label", p.label)]);
-`;
-}
-
-// src/generate.ts
-var RENDERERS = {
-  domain: domainTemplate,
-  aggregate: aggregateTemplate,
-  intent: intentTemplate
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-function renderScaffold(kind, name) {
-  assertValidName(name);
-  const render = RENDERERS[kind];
-  if (!render) {
-    throw new Error(`Unknown generator kind '${kind}'. Use: domain | aggregate | intent.`);
-  }
-  return render(name);
-}
-function generate(opts) {
-  const contents = renderScaffold(opts.kind, opts.name);
-  const fileName = `${snakeCase(opts.name)}.ts`;
-  const path = join(opts.outDir, fileName);
-  if (existsSync(path) && !opts.force) {
-    throw new Error(
-      `Refusing to overwrite existing file: ${path}
-Re-run with --force to replace it.`
-    );
-  }
-  mkdirSync(opts.outDir, { recursive: true });
-  writeFileSync(path, contents, "utf8");
-  return { path, contents };
-}
 
 // src/cloud.ts
+var cloud_exports = {};
+__export(cloud_exports, {
+  cloudBase: () => cloudBase,
+  configDir: () => configDir,
+  deploy: () => deploy,
+  describeLawMove: () => describeLawMove,
+  discoverDeployJson: () => discoverDeployJson,
+  getSecret: () => getSecret,
+  loadCreds: () => loadCreds,
+  login: () => login,
+  logout: () => logout,
+  principalHeaders: () => principalHeaders,
+  secretRotate: () => secretRotate,
+  secretSet: () => secretSet,
+  sessionToken: () => sessionToken,
+  setPrincipal: () => setPrincipal,
+  setSecret: () => setSecret,
+  whoami: () => whoami,
+  wsCreate: () => wsCreate,
+  wsRetire: () => wsRetire,
+  wsStatus: () => wsStatus
+});
 import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 import { homedir } from "node:os";
-var DEFAULT_CLOUD = "https://nomos.captainapp.co.uk";
-var DEFAULT_AUTH_URL = "https://kjbcjkihxskuwwfdqklt.supabase.co";
-var DEFAULT_AUTH_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtqYmNqa2loeHNrdXd3ZmRxa2x0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTA3MDU2OTAsImV4cCI6MjA2NjI4MTY5MH0.V9e7XsuTlTOLqefOIedTqlBiTxUSn4O5FZSPWwAxiSI";
 function cloudBase(flag) {
   return (flag ?? process.env["NOMOS_CLOUD"] ?? DEFAULT_CLOUD).replace(/\/+$/, "");
 }
@@ -216,7 +59,6 @@ function saveCreds(c) {
   writeFileSync2(credsPath(), JSON.stringify(c, null, 2) + "\n", "utf8");
   chmodSync(credsPath(), 384);
 }
-var secretKey = (cloud, ws) => `${cloud} ${ws}`;
 function getSecret(cloud, ws) {
   return loadCreds().secrets[secretKey(cloud, ws)];
 }
@@ -289,8 +131,6 @@ function discoverDeployJson(cwd, explicit) {
   }
   return join2(buildDir, bodies[0]);
 }
-var out = (s) => void process.stdout.write(s + "\n");
-var err = (s) => void process.stderr.write("error: " + s + "\n");
 async function login(opts) {
   if (opts.agent !== true && opts.token === void 0) {
     err(
@@ -483,65 +323,18 @@ async function secretRotate(ws, opts) {
   out(`\u2713 secret for ${ws} rotated and saved \u2192 ${credsPath()}`);
   return 0;
 }
-
-// src/compile.ts
-import { spawn, spawnSync } from "node:child_process";
-import { createRequire } from "node:module";
-import { dirname, join as join3 } from "node:path";
-import { pathToFileURL } from "node:url";
-function resolveCompileLauncher(cwd) {
-  const resolveDslPkg = (fromDir) => {
-    try {
-      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join3(fromDir, "noop.js")));
-      return req.resolve("@githolon/dsl/package.json");
-    } catch {
-      return void 0;
-    }
-  };
-  const dslPkg = resolveDslPkg(cwd) ?? resolveDslPkg(void 0);
-  return dslPkg === void 0 ? void 0 : join3(dirname(dslPkg), "compile_package.mjs");
-}
-var NO_DSL_REMEDY = "@githolon/dsl not found \u2014 add it to your project's dependencies";
-function runCompile(args) {
-  const launcher = resolveCompileLauncher(process.cwd());
-  if (launcher === void 0) {
-    process.stderr.write(`error: ${NO_DSL_REMEDY}
-`);
-    return 1;
-  }
-  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
-  return r.status ?? 1;
-}
-function compileAsync(cwd, args = []) {
-  const launcher = resolveCompileLauncher(cwd);
-  const t0 = performance.now();
-  if (launcher === void 0) {
-    return Promise.resolve({ ok: false, ms: 0, output: NO_DSL_REMEDY });
+var DEFAULT_CLOUD, DEFAULT_AUTH_URL, DEFAULT_AUTH_ANON_KEY, secretKey, out, err;
+var init_cloud = __esm({
+  "src/cloud.ts"() {
+    "use strict";
+    DEFAULT_CLOUD = "https://nomos.captainapp.co.uk";
+    DEFAULT_AUTH_URL = "https://kjbcjkihxskuwwfdqklt.supabase.co";
+    DEFAULT_AUTH_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtqYmNqa2loeHNrdXd3ZmRxa2x0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTA3MDU2OTAsImV4cCI6MjA2NjI4MTY5MH0.V9e7XsuTlTOLqefOIedTqlBiTxUSn4O5FZSPWwAxiSI";
+    secretKey = (cloud, ws) => `${cloud} ${ws}`;
+    out = (s) => void process.stdout.write(s + "\n");
+    err = (s) => void process.stderr.write("error: " + s + "\n");
   }
-  return new Promise((resolveRun) => {
-    const chunks = [];
-    const dec3 = new TextDecoder();
-    const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    child.stdout?.on("data", (c) => chunks.push(dec3.decode(c)));
-    child.stderr?.on("data", (c) => chunks.push(dec3.decode(c)));
-    child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
-    child.on(
-      "close",
-      (code) => resolveRun({ ok: code === 0, ms: performance.now() - t0, output: chunks.join("") })
-    );
-  });
-}
-
-// src/dev.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, watch } from "node:fs";
-import { createServer } from "node:http";
-import { dirname as dirname3, join as join6, resolve } from "node:path";
-import { pathToFileURL as pathToFileURL3 } from "node:url";
-
-// vendor/engine/engine.mjs
-import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
-import git from "isomorphic-git";
-import http from "isomorphic-git/http/web";
+});
 
 // vendor/engine/git-fs.mjs
 function fsErr(code, p) {
@@ -640,21 +433,26 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
   };
   return { promises };
 }
+var init_git_fs = __esm({
+  "vendor/engine/git-fs.mjs"() {
+    "use strict";
+  }
+});
 
 // vendor/engine/tree.mjs
-var enc = new TextEncoder();
-var dec = new TextDecoder();
+var enc, dec;
+var init_tree = __esm({
+  "vendor/engine/tree.mjs"() {
+    "use strict";
+    enc = new TextEncoder();
+    dec = new TextDecoder();
+  }
+});
 
 // vendor/engine/engine.mjs
-var enc2 = new TextEncoder();
-var dec2 = new TextDecoder();
-var BRANCH = "main";
-var repoArgOf = (ws) => `/work/ws/${ws}`;
-var gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
-var unpack = (p) => {
-  const v = typeof p === "bigint" ? p : BigInt(p);
-  return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
-};
+import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
+import git from "isomorphic-git";
+import http from "isomorphic-git/http/web";
 async function sha256hex(t) {
   const b = await crypto.subtle.digest("SHA-256", enc2.encode(t));
   return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
@@ -662,13 +460,13 @@ async function sha256hex(t) {
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out8 = new Array(n), T = 2 ** 53;
+  const out9 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z = 0n;
     for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out8[i] = Number(z >> 11n) / T;
+    out9[i] = Number(z >> 11n) / T;
   }
-  return out8;
+  return out9;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
@@ -694,7 +492,6 @@ function seedManifests(m, strings) {
   m.set("domain_manifests.json", new File(enc2.encode(strings.read)));
   m.set("identity-manifests.json", new File(enc2.encode(strings.identity)));
 }
-var installPayload = (hash, usda, installedBy) => ({ domainHash: hash, packageUsda: usda, installedBy, authorityScope: "workspace/root", dependencies: [], finalizers: [] });
 async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, manifestStrings, replica, installedBy = "nomos-cloud" }) {
   const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
   const root = /* @__PURE__ */ new Map();
@@ -780,6 +577,9 @@ function unmount(eng, ws) {
 function writeWork(eng, name, bytes) {
   eng.preopen.dir.contents.set(name, new File(bytes));
 }
+function mintId(eng, typeTag) {
+  return JSON.parse(call(eng.ex, "mint", { typeTag, nowMillis: Date.now() }, eng.STDERR)).id;
+}
 function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   const envelope = { payload: { domain, directiveId, payload }, captured_ports: { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) }, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
@@ -791,10 +591,6 @@ function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
-var qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
-var query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
-var count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
-var sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
 function applyIntentBytes(eng, ws, bytes) {
   const name = `intent-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
@@ -803,14 +599,34 @@ function applyIntentBytes(eng, ws, bytes) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
 }
+var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, count, sum;
+var init_engine = __esm({
+  "vendor/engine/engine.mjs"() {
+    "use strict";
+    init_git_fs();
+    init_tree();
+    enc2 = new TextEncoder();
+    dec2 = new TextDecoder();
+    BRANCH = "main";
+    repoArgOf = (ws) => `/work/ws/${ws}`;
+    gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
+    unpack = (p) => {
+      const v = typeof p === "bigint" ? p : BigInt(p);
+      return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
+    };
+    installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, authorityScope: "workspace/root", dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
+    qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
+    query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
+    count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
+    sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
+  }
+});
 
 // src/local_holon.ts
 import { randomBytes } from "node:crypto";
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname2, join as join4 } from "node:path";
 import { File as File2, Directory as Directory2 } from "@bjorn3/browser_wasi_shim";
-var out2 = (s) => void process.stdout.write(s + "\n");
-var err2 = (s) => void process.stderr.write("error: " + s + "\n");
 async function fetchJsonCached(url, cacheFile) {
   try {
     const r = await fetch(url);
@@ -856,62 +672,620 @@ function mergeManifests(baked, overlay) {
       }
     }
   }
-  return { read: JSON.stringify(read), identity: JSON.stringify(identity) };
-}
-function writeTreeToDisk(dir, diskPath) {
-  mkdirSync3(diskPath, { recursive: true });
-  for (const [name, inode] of dir.contents) {
-    const p = join4(diskPath, name);
-    if (inode.contents instanceof Map) writeTreeToDisk(inode, p);
-    else writeFileSync3(p, inode.data ?? new Uint8Array(0));
+  return { read: JSON.stringify(read), identity: JSON.stringify(identity) };
+}
+function writeTreeToDisk(dir, diskPath) {
+  mkdirSync3(diskPath, { recursive: true });
+  for (const [name, inode] of dir.contents) {
+    const p = join4(diskPath, name);
+    if (inode.contents instanceof Map) writeTreeToDisk(inode, p);
+    else writeFileSync3(p, inode.data ?? new Uint8Array(0));
+  }
+}
+function readTreeFromDisk(diskPath) {
+  const contents = /* @__PURE__ */ new Map();
+  for (const name of readdirSync2(diskPath)) {
+    const p = join4(diskPath, name);
+    if (statSync(p).isDirectory()) contents.set(name, readTreeFromDisk(p));
+    else contents.set(name, new File2(readFileSync2(p)));
+  }
+  return new Directory2(contents);
+}
+async function holonEngine(cloud, overlay, installedBy) {
+  const runtime = await fetchRuntime(cloud);
+  const manifestStrings = overlay === void 0 ? { read: runtime.manifests.domainManifests, identity: runtime.manifests.identityManifests } : mergeManifests(runtime.manifests, overlay);
+  const replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
+  const eng = await createEngine({
+    wasmModule: await WebAssembly.compile(runtime.wasmBytes),
+    bootstrapPkg: runtime.packages.bootstrap,
+    nomosPkg: runtime.packages.nomos,
+    manifestStrings,
+    replica,
+    installedBy
+  });
+  return { eng, runtime };
+}
+async function mountFresh(eng, ws) {
+  await mountWorkspace(eng, ws, { remote: "https://unborn.invalid/", headers: {} });
+}
+function sealedIntentOf(eng, ws, res) {
+  if (typeof res.intentOut !== "string") return void 0;
+  const f = eng.preopen.dir.contents.get("ws").contents.get(ws)?.contents.get(res.intentOut);
+  if (f === void 0 || !(f.data instanceof Uint8Array)) return void 0;
+  try {
+    return JSON.parse(new TextDecoder().decode(f.data));
+  } catch {
+    return void 0;
+  }
+}
+function printVerdict(v) {
+  if (v["valid"] === true) {
+    out3(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
+    out3(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
+    return true;
+  }
+  err3(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
+  return false;
+}
+var out3, err3;
+var init_local_holon = __esm({
+  "src/local_holon.ts"() {
+    "use strict";
+    init_engine();
+    init_cloud();
+    out3 = (s) => void process.stdout.write(s + "\n");
+    err3 = (s) => void process.stderr.write("error: " + s + "\n");
+  }
+});
+
+// src/proof_offline.ts
+var proof_offline_exports = {};
+__export(proof_offline_exports, {
+  parseOfflineLegs: () => parseOfflineLegs,
+  runOfflineLegs: () => runOfflineLegs,
+  runOfflineProofStandalone: () => runOfflineProofStandalone
+});
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
+import { basename, dirname as dirname3, join as join6 } from "node:path";
+function parseOfflineLegs(proofSource) {
+  if (!proofSource.includes("AUTO-GENERATED by nomos-compile")) {
+    throw new Error("not a generated proof (missing the AUTO-GENERATED header) \u2014 run `githolon compile` to (re)generate build/<name>.proof.mts");
+  }
+  const marker = proofSource.match(/^\/\/ @nomos-proof-legs (\{.*\})$/m);
+  if (marker !== null) {
+    return JSON.parse(marker[1]);
+  }
+  const dispatch = proofSource.match(/^await app\.(\w+)\((\{.*\})\);$/m);
+  if (dispatch === null) {
+    throw new Error("generated proof has no `await app.<directive>({...})` dispatch \u2014 regenerate with `githolon compile` (a creating directive is required)");
+  }
+  const directiveId = dispatch[1];
+  const payload = JSON.parse(dispatch[2]);
+  const dom = proofSource.match(/dispatch (\w+)\/(\w+) — offline write/);
+  if (dom === null || dom[2] !== directiveId) {
+    throw new Error("generated proof names no `dispatch <domain>/<directive> \u2014 offline write` \u2014 regenerate with `githolon compile`");
+  }
+  const domain = dom[1];
+  const autoStamped = [];
+  const stampLine = proofSource.split("\n").find((l) => l.includes("omitted \u2014 the client auto-stamps ISO now()"));
+  if (stampLine !== void 0) {
+    for (const m of stampLine.matchAll(/`(\w+)`/g)) autoStamped.push(m[1]);
+  }
+  let queryLeg;
+  const q = proofSource.match(/local declared query (\w+):/);
+  if (q !== null) {
+    const call2 = proofSource.match(/^const rows = await app\.\w+\((\{.*\})\);$/m);
+    if (call2 === null) throw new Error(`generated proof names query '${q[1]}' but its accessor call is missing \u2014 regenerate with \`githolon compile\``);
+    queryLeg = { id: q[1], params: JSON.parse(call2[1]) };
+  }
+  let countLeg;
+  const c = proofSource.match(/local declared count (\w+):/);
+  if (c !== null) {
+    const call2 = proofSource.match(/^const localCount = await app\.\w+\((.*?)\);$/m);
+    if (call2 === null) throw new Error(`generated proof names count '${c[1]}' but its accessor call is missing \u2014 regenerate with \`githolon compile\``);
+    const arg = call2[1].trim();
+    countLeg = { id: c[1], group: arg.length === 0 ? "" : JSON.parse(arg) };
+  }
+  return {
+    domain,
+    directiveId,
+    payload,
+    autoStamped,
+    ...queryLeg !== void 0 ? { query: queryLeg } : {},
+    ...countLeg !== void 0 ? { count: countLeg } : {}
+  };
+}
+function runOfflineLegs(eng, ws, lawHash, legs) {
+  const t0 = performance.now();
+  const done = (ok, lines2, error) => ({
+    ok,
+    ms: performance.now() - t0,
+    legs: lines2,
+    ...error !== void 0 ? { error } : {}
+  });
+  const lines = [];
+  const payload = { ...legs.payload };
+  const stamp = (/* @__PURE__ */ new Date()).toISOString();
+  for (const f of legs.autoStamped) payload[f] = stamp;
+  if (legs.mintField !== void 0 && legs.aggregateId !== void 0) {
+    payload[legs.mintField] = mintId(eng, legs.aggregateId);
+  }
+  const res = author(eng, ws, legs.domain, legs.directiveId, payload, lawHash);
+  if (res.ok === false) {
+    return done(false, lines, `dispatch ${legs.domain}/${legs.directiveId} refused: ${res.error ?? "unknown"} \u2014 the law itself rejected its own synthesized sample; check the directive's plan/payload schema`);
+  }
+  const createdId = (sealedIntentOf(eng, ws, res)?.events ?? []).find((e) => e.marker === "Create")?.aggregate;
+  lines.push(`\u2713 dispatch ${legs.domain}/${legs.directiveId} \u2014 offline write under the new law${createdId !== void 0 ? ` (${createdId.slice(0, 28)}\u2026)` : ""}`);
+  if (legs.query !== void 0) {
+    const rows = query(eng, ws, legs.query.id, JSON.stringify(legs.query.params));
+    if (rows.length !== 1 || createdId !== void 0 && rows[0].id !== createdId) {
+      return done(false, lines, `declared query ${legs.query.id} expected the 1 created row, got ${JSON.stringify(rows.map((r) => r.id))} \u2014 check the query's key fields against the directive's payload`);
+    }
+    lines.push(`\u2713 declared query ${legs.query.id} answers locally \u2014 1 row`);
+  }
+  if (legs.count !== void 0) {
+    const c = count(eng, ws, legs.count.id, legs.count.group).count;
+    if (c !== 1) {
+      return done(false, lines, `declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) expected 1, got ${c} \u2014 check the count's grouping against the created row`);
+    }
+    lines.push(`\u2713 declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) = 1 locally`);
+  }
+  return done(true, lines);
+}
+async function runOfflineProofStandalone(proofPath, cloud, domain) {
+  const src = readFileSync3(proofPath, "utf8");
+  const packageName = basename(proofPath).replace(/\.proof\.mts$/, "");
+  const deployFile = join6(dirname3(proofPath), `${packageName}.deploy.json`);
+  if (!existsSync5(deployFile)) {
+    throw new Error(`missing ${deployFile} \u2014 run \`githolon compile\` (the proof and the deploy body are built together)`);
+  }
+  let legs;
+  const legsFile = join6(dirname3(proofPath), `${packageName}.proof-legs.json`);
+  if (existsSync5(legsFile)) {
+    const index = JSON.parse(readFileSync3(legsFile, "utf8"));
+    const keys = Object.keys(index.domains);
+    const chosen = domain ?? index.default;
+    if (index.domains[chosen] === void 0) {
+      throw new Error(`no provable domain '${chosen}' in this package \u2014 it proves: ${keys.join(", ")} (pick one: githolon proof --domain <key>)`);
+    }
+    legs = index.domains[chosen];
+    if (keys.length > 1) console.log(`githolon proof \u2014 domain '${chosen}' (of ${keys.length}: ${keys.join(", ")}; --domain <key> to switch)`);
+  } else {
+    if (domain !== void 0) throw new Error(`--domain needs a per-domain legs index (build/${packageName}.proof-legs.json) \u2014 recompile with \`githolon compile\` to emit it`);
+    legs = parseOfflineLegs(src);
+  }
+  const deployBody = JSON.parse(readFileSync3(deployFile, "utf8"));
+  const lawHash = await sha256hex(deployBody.packageUsda);
+  console.log(`githolon proof \u2014 OFFLINE legs on a local holon (the cloud loop: githolon proof --live)`);
+  const { eng } = await holonEngine(cloud, deployBody, "githolon-proof");
+  const ws = "proof-offline";
+  await mountFresh(eng, ws);
+  author(eng, ws, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, "githolon-proof"), "");
+  author(eng, ws, "nomos", "installDomain", installPayload(lawHash, deployBody.packageUsda, "githolon-proof"), eng.hashes.nomos);
+  const v = runOfflineLegs(eng, ws, lawHash, legs);
+  for (const l of v.legs) console.log(l);
+  if (!v.ok) {
+    console.error(`\u2717 ${v.error}`);
+    return 1;
+  }
+  console.log(`
+OFFLINE PROOF GREEN (${Math.round(v.ms)}ms) \u2014 the same legs rerun on every save in \`githolon dev\`.`);
+  console.log(`Deploy with confidence when ready: githolon ws create <ws> && githolon deploy <ws>   (or the full cloud proof: githolon proof --live)`);
+  return 0;
+}
+var init_proof_offline = __esm({
+  "src/proof_offline.ts"() {
+    "use strict";
+    init_engine();
+    init_local_holon();
+  }
+});
+
+// src/cli.ts
+import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname5, join as join10, resolve as resolve2 } from "node:path";
+import { pathToFileURL as pathToFileURL4 } from "node:url";
+
+// src/generate.ts
+import { mkdirSync, existsSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+// src/naming.ts
+function words(raw) {
+  return raw.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_\-\s]+/g, " ").trim().toLowerCase().split(" ").filter((w) => w.length > 0);
+}
+var cap = (w) => w.length === 0 ? w : w[0].toUpperCase() + w.slice(1);
+function pascalCase(raw) {
+  return words(raw).map(cap).join("");
+}
+function camelCase(raw) {
+  return words(raw).map((w, i) => i === 0 ? w : cap(w)).join("");
+}
+function snakeCase(raw) {
+  return words(raw).join("_");
+}
+function screamingSnakeCase(raw) {
+  return words(raw).join("_").toUpperCase();
+}
+function assertValidName(raw) {
+  const ws = words(raw);
+  if (ws.length === 0) {
+    throw new Error(`Invalid name: '${raw}' \u2014 give at least one word, e.g. 'work_order'.`);
+  }
+  for (const w of ws) {
+    if (!/^[a-z][a-z0-9]*$/.test(w)) {
+      throw new Error(
+        `Invalid name token '${w}' in '${raw}' \u2014 words must be alphanumeric and start with a letter (got after normalisation: ${ws.join(", ")}).`
+      );
+    }
+  }
+  return ws;
+}
+
+// src/templates.ts
+function namesFor(raw) {
+  return {
+    raw,
+    pascal: pascalCase(raw),
+    camel: camelCase(raw),
+    statusesConst: `${screamingSnakeCase(raw)}_STATUSES`
+  };
+}
+var HEADER = (raw, kind) => `/**
+ * The \`${raw}\` ${kind} \u2014 scaffolded by \`githolon generate\`.
+ *
+ * Authoring rules (see @githolon/dsl): write ONLY aggregates (typed fields, each
+ * tagged with a merge Driver) and directives (Zod payload + declarative plan).
+ * You never write apply/fold/merge \u2014 the kernel owns the merge algebra.
+ *
+ * Convention: the fail-closed \`Conflict\` driver is the default for scalars.
+ * Relax only what differs: \`.merge(Lww)\`, \`.merge(AddWins)\`, \`.merge(MapOf(Lww))\`.
+ */`;
+function aggregateBlock(n) {
+  return `export const ${n.statusesConst} = ["active", "retired"] as const;
+
+export const ${n.pascal} = aggregate("${n.pascal}", {
+  // Default driver is the fail-closed \`Conflict\`: concurrent edits surface
+  // as a conflict rather than silently coalescing. Declare only what differs.
+  label: t.string().merge(Conflict),
+  // Overrides \u2014 last-write-wins / set-union / per-key map:
+  pos: t.int().merge(Lww),
+  status: t.enum(${n.statusesConst}).merge(Lww),
+  tags: t.set(t.string()).merge(AddWins),
+  customFields: t.map(t.string()).merge(MapOf(Lww)),
+});`;
+}
+function domainTemplate(raw) {
+  const n = namesFor(raw);
+  return `${HEADER(raw, "domain")}
+import {
+  z,
+  aggregate,
+  directive,
+  t,
+  Conflict,
+  Lww,
+  AddWins,
+  MapOf,
+  set,
+  addToSet,
+  setEntry,
+} from "@githolon/dsl";
+
+${aggregateBlock(n)}
+
+/** create${n.pascal} \u2014 .creates the aggregate; seeds label/pos/status. */
+export const create${n.pascal} = directive("create${n.pascal}")
+  .creates(${n.pascal})
+  .payload(
+    z.object({
+      label: z.string(),
+      pos: z.number().int(),
+      status: z.enum(${n.statusesConst}),
+    }),
+  )
+  .plan((p) => [
+    set(${n.pascal}, "label", p.label),
+    set(${n.pascal}, "pos", p.pos),
+    set(${n.pascal}, "status", p.status),
+  ]);
+
+/** move${n.pascal} \u2014 .mutates pos. */
+export const move${n.pascal} = directive("move${n.pascal}")
+  .mutates(${n.pascal})
+  .payload(z.object({ pos: z.number().int() }))
+  .plan((p) => [set(${n.pascal}, "pos", p.pos)]);
+
+/** tag${n.pascal} \u2014 .mutates tags (add-wins union). */
+export const tag${n.pascal} = directive("tag${n.pascal}")
+  .mutates(${n.pascal})
+  .payload(z.object({ tags: z.array(z.string()) }))
+  .plan((p) => [addToSet(${n.pascal}, "tags", p.tags)]);
+
+/** setCustomFieldOn${n.pascal} \u2014 .mutates customFields (a map entry). */
+export const setCustomFieldOn${n.pascal} = directive("setCustomFieldOn${n.pascal}")
+  .mutates(${n.pascal})
+  .payload(z.object({ key: z.string(), value: z.string() }))
+  .plan((p) => [setEntry(${n.pascal}, "customFields", p.key, p.value)]);
+`;
+}
+function aggregateTemplate(raw) {
+  const n = namesFor(raw);
+  return `${HEADER(raw, "aggregate")}
+import { aggregate, t, Conflict, Lww, AddWins, MapOf } from "@githolon/dsl";
+
+${aggregateBlock(n)}
+`;
+}
+function intentTemplate(raw) {
+  const n = namesFor(raw);
+  return `${HEADER(raw, "intent (directive)")}
+import { z, aggregate, directive, t, Conflict, set } from "@githolon/dsl";
+
+// Stub target \u2014 in a real domain, import the existing aggregate handle instead.
+export const ${n.pascal} = aggregate("${n.pascal}", {
+  label: t.string().merge(Conflict),
+});
+
+/** ${n.camel} \u2014 .mutates the target aggregate. */
+export const ${n.camel} = directive("${n.camel}")
+  .mutates(${n.pascal})
+  .payload(z.object({ label: z.string() }))
+  .plan((p) => [set(${n.pascal}, "label", p.label)]);
+`;
+}
+
+// src/generate.ts
+var RENDERERS = {
+  domain: domainTemplate,
+  aggregate: aggregateTemplate,
+  intent: intentTemplate
+};
+function renderScaffold(kind, name) {
+  assertValidName(name);
+  const render = RENDERERS[kind];
+  if (!render) {
+    throw new Error(`Unknown generator kind '${kind}'. Use: domain | aggregate | intent.`);
+  }
+  return render(name);
+}
+function generate(opts) {
+  const contents = renderScaffold(opts.kind, opts.name);
+  const fileName = `${snakeCase(opts.name)}.ts`;
+  const path = join(opts.outDir, fileName);
+  if (existsSync(path) && !opts.force) {
+    throw new Error(
+      `Refusing to overwrite existing file: ${path}
+Re-run with --force to replace it.`
+    );
+  }
+  mkdirSync(opts.outDir, { recursive: true });
+  writeFileSync(path, contents, "utf8");
+  return { path, contents };
+}
+
+// src/capability.ts
+init_cloud();
+import { spawnSync } from "node:child_process";
+var out2 = (s) => void process.stdout.write(s + "\n");
+var err2 = (s) => void process.stderr.write("error: " + s + "\n");
+var CAP_NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+function readStdin() {
+  if (process.stdin.isTTY === true) {
+    process.stderr.write(
+      "paste the credential value, then Ctrl-D (it never rides argv \u2014 ps/history are hosts too):\n"
+    );
+  }
+  return new Promise((resolveValue) => {
+    let buf = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      buf += chunk;
+    });
+    process.stdin.on("end", () => resolveValue(buf.trim()));
+    process.stdin.resume();
+  });
+}
+function readGcloud(name) {
+  const r = spawnSync("gcloud", ["secrets", "versions", "access", "latest", `--secret=${name}`], {
+    encoding: "utf8",
+    maxBuffer: 1024 * 1024
+  });
+  if (r.error !== void 0 || r.status !== 0) {
+    throw new Error(
+      `gcloud secret read failed (${r.error?.message ?? r.stderr?.trim() ?? `exit ${r.status}`}) \u2014 is gcloud installed + authed, and does secret '${name}' exist?`
+    );
+  }
+  const v = r.stdout.trim();
+  if (v === "") throw new Error(`gcloud secret '${name}' is empty`);
+  return v;
+}
+function parseExpiresAt(s) {
+  const n = /^\d+$/.test(s) ? Number(s) : Date.parse(s);
+  if (!Number.isInteger(n) || n <= 0) throw new Error(`--expires-at '${s}' is neither epoch-ms nor an ISO date`);
+  return n;
+}
+async function bindLane(lane, ws, capability, opts) {
+  const cloud = cloudBase(opts.cloud);
+  if (!CAP_NAME.test(capability)) {
+    err2(`capability must be a lowercase law name matching [a-z0-9][a-z0-9._-]{0,63} \u2014 e.g. cf-analytics, openai`);
+    return 1;
+  }
+  const secret = getSecret(cloud, ws);
+  if (secret === void 0) {
+    err2(
+      `no stored secret for ${ws} on ${cloud} \u2014 capability ${lane} is owner-gated
+  githolon secret set ${ws} <secret>  (import the workspaceSecret you hold)`
+    );
+    return 1;
+  }
+  let value;
+  try {
+    value = opts.fromGcloud !== void 0 ? readGcloud(opts.fromGcloud) : await readStdin();
+  } catch (e) {
+    err2(e.message);
+    return 1;
+  }
+  if (value === "") {
+    err2("no credential value arrived \u2014 pipe it on stdin, or pass --from-gcloud <secret-name>");
+    return 1;
+  }
+  let expiresAt;
+  try {
+    expiresAt = opts.expiresAt !== void 0 ? parseExpiresAt(opts.expiresAt) : void 0;
+  } catch (e) {
+    err2(e.message);
+    return 1;
+  }
+  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities/${lane}`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
+    body: JSON.stringify({
+      capability,
+      secret: value,
+      ...opts.scope !== void 0 ? { scope: opts.scope } : {},
+      ...expiresAt !== void 0 ? { expiresAt } : {}
+    })
+  });
+  const d = await r.json().catch(() => void 0);
+  if (r.status === 401) {
+    err2(`${lane} refused (401) \u2014 the stored secret for ${ws} is not the workspace's. githolon secret set ${ws} <secret>`);
+    return 1;
+  }
+  if (!r.ok || d?.ok !== true) {
+    err2(`capability ${lane} '${capability}' on ${ws} failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
+    return 1;
   }
+  out2(`\u2713 ${capability} ${lane === "rotate" ? "rotated" : "bound"} on ${ws} (epoch ${d.epoch})`);
+  out2(`  the VALUE lives host-side only (the workspace's holon) \u2014 it never enters the ledger`);
+  out2(`  the law fact: keyHash ${(d.keyHash ?? "").slice(0, 16)}\u2026 status ${d.status}`);
+  return 0;
 }
-function readTreeFromDisk(diskPath) {
-  const contents = /* @__PURE__ */ new Map();
-  for (const name of readdirSync2(diskPath)) {
-    const p = join4(diskPath, name);
-    if (statSync(p).isDirectory()) contents.set(name, readTreeFromDisk(p));
-    else contents.set(name, new File2(readFileSync2(p)));
+async function capabilityBind(ws, capability, opts) {
+  return bindLane("bind", ws, capability, opts);
+}
+async function capabilityRotate(ws, capability, opts) {
+  return bindLane("rotate", ws, capability, opts);
+}
+async function capabilityList(ws, opts) {
+  const cloud = cloudBase(opts.cloud);
+  const secret = getSecret(cloud, ws);
+  if (secret === void 0) {
+    err2(`no stored secret for ${ws} on ${cloud} \u2014 the binding facts are owner-gated
+  githolon secret set ${ws} <secret>`);
+    return 1;
   }
-  return new Directory2(contents);
+  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities`, {
+    headers: { authorization: `Bearer ${secret}` }
+  });
+  const d = await r.json().catch(() => void 0);
+  if (!r.ok || d?.ok !== true) {
+    err2(`capability list '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
+    return 1;
+  }
+  const bindings = d.bindings ?? [];
+  if (bindings.length === 0) {
+    out2(`no capability bindings on ${ws} \u2014 bind one: githolon capability bind ${ws} <capability>`);
+    return 0;
+  }
+  for (const b of bindings) {
+    const bits = [
+      `epoch ${b.epoch}`,
+      `${b.status}`,
+      `keyHash ${(b.keyHash ?? "").slice(0, 16)}\u2026`,
+      ...b.scope !== void 0 ? [`scope ${b.scope}`] : [],
+      ...b.expiresAt !== void 0 ? [`expires ${new Date(b.expiresAt).toISOString()}`] : [],
+      ...b.held !== void 0 ? [b.held ? "value held" : "VALUE MISSING (rotate to restore)"] : []
+    ];
+    out2(`${b.capability}  ${bits.join(" \xB7 ")}`);
+  }
+  out2(`(facts about authority \u2014 the values live host-side and are never listed)`);
+  return 0;
 }
-async function holonEngine(cloud, overlay, installedBy) {
-  const runtime = await fetchRuntime(cloud);
-  const manifestStrings = overlay === void 0 ? { read: runtime.manifests.domainManifests, identity: runtime.manifests.identityManifests } : mergeManifests(runtime.manifests, overlay);
-  const replica = BigInt(`0x${randomBytes(8).toString("hex")}`) & (1n << 63n) - 1n;
-  const eng = await createEngine({
-    wasmModule: await WebAssembly.compile(runtime.wasmBytes),
-    bootstrapPkg: runtime.packages.bootstrap,
-    nomosPkg: runtime.packages.nomos,
-    manifestStrings,
-    replica,
-    installedBy
+async function capabilityUnbind(ws, capability, opts) {
+  const cloud = cloudBase(opts.cloud);
+  const secret = getSecret(cloud, ws);
+  if (secret === void 0) {
+    err2(`no stored secret for ${ws} on ${cloud} \u2014 unbind is owner-gated
+  githolon secret set ${ws} <secret>`);
+    return 1;
+  }
+  const r = await fetch(`${cloud}/v1/workspaces/${ws}/capabilities/unbind`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${secret}` },
+    body: JSON.stringify({ capability })
   });
-  return { eng, runtime };
+  const d = await r.json().catch(() => void 0);
+  if (!r.ok || d?.ok !== true) {
+    err2(`capability unbind '${capability}' on ${ws} failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}`);
+    return 1;
+  }
+  out2(`\u2713 ${capability} unbound on ${ws} \u2014 the law fact is revoked (the record stays) and the host forgot the value`);
+  return 0;
 }
-async function mountFresh(eng, ws) {
-  await mountWorkspace(eng, ws, { remote: "https://unborn.invalid/", headers: {} });
+
+// src/cli.ts
+init_cloud();
+
+// src/compile.ts
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { createRequire } from "node:module";
+import { dirname, join as join3 } from "node:path";
+import { pathToFileURL } from "node:url";
+function resolveCompileLauncher(cwd) {
+  const resolveDslPkg = (fromDir) => {
+    try {
+      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join3(fromDir, "noop.js")));
+      return req.resolve("@githolon/dsl/package.json");
+    } catch {
+      return void 0;
+    }
+  };
+  const dslPkg = resolveDslPkg(cwd) ?? resolveDslPkg(void 0);
+  return dslPkg === void 0 ? void 0 : join3(dirname(dslPkg), "compile_package.mjs");
 }
-function sealedIntentOf(eng, ws, res) {
-  if (typeof res.intentOut !== "string") return void 0;
-  const f = eng.preopen.dir.contents.get("ws").contents.get(ws)?.contents.get(res.intentOut);
-  if (f === void 0 || !(f.data instanceof Uint8Array)) return void 0;
-  try {
-    return JSON.parse(new TextDecoder().decode(f.data));
-  } catch {
-    return void 0;
+var NO_DSL_REMEDY = "@githolon/dsl not found \u2014 add it to your project's dependencies";
+function runCompile(args) {
+  const launcher = resolveCompileLauncher(process.cwd());
+  if (launcher === void 0) {
+    process.stderr.write(`error: ${NO_DSL_REMEDY}
+`);
+    return 1;
   }
+  const r = spawnSync2(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  return r.status ?? 1;
 }
-function printVerdict(v) {
-  if (v["valid"] === true) {
-    out2(`\u2713 chain VALID \u2014 head ${String(v["head"]).slice(0, 12)}\u2026, ${v["intents"]} intent(s), ${v["plansRerun"]} plan(s) re-run`);
-    out2(`  controller ${String(v["controllerHash"]).slice(0, 12)}\u2026 | installed: ${v["installedDomains"]?.map((h) => h.slice(0, 12) + "\u2026").join(", ") ?? "\u2014"}`);
-    return true;
+function compileAsync(cwd, args = []) {
+  const launcher = resolveCompileLauncher(cwd);
+  const t0 = performance.now();
+  if (launcher === void 0) {
+    return Promise.resolve({ ok: false, ms: 0, output: NO_DSL_REMEDY });
   }
-  err2(`chain INVALID at ${v["check"]}${v["atIndex"] !== void 0 ? ` (intent ${v["atIndex"]})` : ""}: ${v["error"]}`);
-  return false;
+  return new Promise((resolveRun) => {
+    const chunks = [];
+    const dec3 = new TextDecoder();
+    const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => chunks.push(dec3.decode(c)));
+    child.stderr?.on("data", (c) => chunks.push(dec3.decode(c)));
+    child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
+    child.on(
+      "close",
+      (code) => resolveRun({ ok: code === 0, ms: performance.now() - t0, output: chunks.join("") })
+    );
+  });
 }
 
+// src/dev.ts
+init_engine();
+init_cloud();
+import { existsSync as existsSync6, readFileSync as readFileSync4, watch } from "node:fs";
+import { createServer } from "node:http";
+import { dirname as dirname4, join as join7, resolve } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
+init_local_holon();
+
 // src/project.ts
 import { existsSync as existsSync4, statSync as statSync2 } from "node:fs";
 import { join as join5 } from "node:path";
@@ -997,89 +1371,10 @@ async function resolveWorkspace(explicit, cwd, target, usageHint) {
   return resolveWorkspaceDecl(project.workspace, target, project.configPath);
 }
 
-// src/proof_offline.ts
-function parseOfflineLegs(proofSource) {
-  if (!proofSource.includes("AUTO-GENERATED by nomos-compile")) {
-    throw new Error("not a generated proof (missing the AUTO-GENERATED header) \u2014 run `githolon compile` to (re)generate build/<name>.proof.mts");
-  }
-  const dispatch = proofSource.match(/^await app\.(\w+)\((\{.*\})\);$/m);
-  if (dispatch === null) {
-    throw new Error("generated proof has no `await app.<directive>({...})` dispatch \u2014 regenerate with `githolon compile` (a creating directive is required)");
-  }
-  const directiveId = dispatch[1];
-  const payload = JSON.parse(dispatch[2]);
-  const dom = proofSource.match(/dispatch (\w+)\/(\w+) — offline write/);
-  if (dom === null || dom[2] !== directiveId) {
-    throw new Error("generated proof names no `dispatch <domain>/<directive> \u2014 offline write` \u2014 regenerate with `githolon compile`");
-  }
-  const domain = dom[1];
-  const autoStamped = [];
-  const stampLine = proofSource.split("\n").find((l) => l.includes("omitted \u2014 the client auto-stamps ISO now()"));
-  if (stampLine !== void 0) {
-    for (const m of stampLine.matchAll(/`(\w+)`/g)) autoStamped.push(m[1]);
-  }
-  let queryLeg;
-  const q = proofSource.match(/local declared query (\w+):/);
-  if (q !== null) {
-    const call2 = proofSource.match(/^const rows = await app\.\w+\((\{.*\})\);$/m);
-    if (call2 === null) throw new Error(`generated proof names query '${q[1]}' but its accessor call is missing \u2014 regenerate with \`githolon compile\``);
-    queryLeg = { id: q[1], params: JSON.parse(call2[1]) };
-  }
-  let countLeg;
-  const c = proofSource.match(/local declared count (\w+):/);
-  if (c !== null) {
-    const call2 = proofSource.match(/^const localCount = await app\.\w+\((.*?)\);$/m);
-    if (call2 === null) throw new Error(`generated proof names count '${c[1]}' but its accessor call is missing \u2014 regenerate with \`githolon compile\``);
-    const arg = call2[1].trim();
-    countLeg = { id: c[1], group: arg.length === 0 ? "" : JSON.parse(arg) };
-  }
-  return {
-    domain,
-    directiveId,
-    payload,
-    autoStamped,
-    ...queryLeg !== void 0 ? { query: queryLeg } : {},
-    ...countLeg !== void 0 ? { count: countLeg } : {}
-  };
-}
-function runOfflineLegs(eng, ws, lawHash, legs) {
-  const t0 = performance.now();
-  const done = (ok, lines2, error) => ({
-    ok,
-    ms: performance.now() - t0,
-    legs: lines2,
-    ...error !== void 0 ? { error } : {}
-  });
-  const lines = [];
-  const payload = { ...legs.payload };
-  const stamp = (/* @__PURE__ */ new Date()).toISOString();
-  for (const f of legs.autoStamped) payload[f] = stamp;
-  const res = author(eng, ws, legs.domain, legs.directiveId, payload, lawHash);
-  if (res.ok === false) {
-    return done(false, lines, `dispatch ${legs.domain}/${legs.directiveId} refused: ${res.error ?? "unknown"} \u2014 the law itself rejected its own synthesized sample; check the directive's plan/payload schema`);
-  }
-  const createdId = (sealedIntentOf(eng, ws, res)?.events ?? []).find((e) => e.marker === "Create")?.aggregate;
-  lines.push(`\u2713 dispatch ${legs.domain}/${legs.directiveId} \u2014 offline write under the new law${createdId !== void 0 ? ` (${createdId.slice(0, 28)}\u2026)` : ""}`);
-  if (legs.query !== void 0) {
-    const rows = query(eng, ws, legs.query.id, JSON.stringify(legs.query.params));
-    if (rows.length !== 1 || createdId !== void 0 && rows[0].id !== createdId) {
-      return done(false, lines, `declared query ${legs.query.id} expected the 1 created row, got ${JSON.stringify(rows.map((r) => r.id))} \u2014 check the query's key fields against the directive's payload`);
-    }
-    lines.push(`\u2713 declared query ${legs.query.id} answers locally \u2014 1 row`);
-  }
-  if (legs.count !== void 0) {
-    const c = count(eng, ws, legs.count.id, legs.count.group).count;
-    if (c !== 1) {
-      return done(false, lines, `declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) expected 1, got ${c} \u2014 check the count's grouping against the created row`);
-    }
-    lines.push(`\u2713 declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) = 1 locally`);
-  }
-  return done(true, lines);
-}
-
 // src/dev.ts
-var out3 = (s) => void process.stdout.write(s + "\n");
-var err3 = (s) => void process.stderr.write("error: " + s + "\n");
+init_proof_offline();
+var out4 = (s) => void process.stdout.write(s + "\n");
+var err4 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS = "dev";
 var DEFAULT_PORT = 7700;
 var DEBOUNCE_MS = 200;
@@ -1163,11 +1458,11 @@ function startServer(s) {
   });
 }
 function readDeployBody(cwd, packageName) {
-  const file = join6(cwd, "build", `${packageName}.deploy.json`);
-  if (!existsSync5(file)) {
+  const file = join7(cwd, "build", `${packageName}.deploy.json`);
+  if (!existsSync6(file)) {
     throw new Error(`compile produced no ${file} \u2014 check the compile output above`);
   }
-  return JSON.parse(readFileSync3(file, "utf8"));
+  return JSON.parse(readFileSync4(file, "utf8"));
 }
 async function installLaw(s, deployBody, installedBy) {
   const newHash = await sha256hex(deployBody.packageUsda);
@@ -1186,11 +1481,11 @@ async function installLaw(s, deployBody, installedBy) {
   return { ok: true };
 }
 async function runProofCycle(s, cwd, deployBody, installedBy) {
-  const proofPath = join6(cwd, "build", `${s.packageName}.proof.mts`);
-  if (!existsSync5(proofPath)) return void 0;
+  const proofPath = join7(cwd, "build", `${s.packageName}.proof.mts`);
+  if (!existsSync6(proofPath)) return void 0;
   const scratch = `proof-${s.cycle}`;
   try {
-    const legs = parseOfflineLegs(readFileSync3(proofPath, "utf8"));
+    const legs = parseOfflineLegs(readFileSync4(proofPath, "utf8"));
     await mountFresh(s.eng, scratch);
     author(s.eng, scratch, "bootstrap", "installDomain", installPayload(s.eng.hashes.nomos, s.eng.nomosPkg, installedBy), "");
     author(s.eng, scratch, "nomos", "installDomain", installPayload(s.lawHash, deployBody.packageUsda, installedBy), s.eng.hashes.nomos);
@@ -1205,21 +1500,21 @@ async function dev(opts) {
   const cwd = process.cwd();
   const cloud = cloudBase(opts.cloud);
   const project = await loadProject(cwd).catch((e) => {
-    err3(e.message);
+    err4(e.message);
     return void 0;
   });
   if (project === void 0) {
-    if (!existsSync5(join6(cwd, CONFIG_FILE))) {
-      err3(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
+    if (!existsSync6(join7(cwd, CONFIG_FILE))) {
+      err4(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
     }
     return 1;
   }
   const creds = loadCreds();
   const installedBy = creds.session?.uid ?? creds.principal ?? "githolon-dev";
-  out3(`githolon dev \u2014 ${project.name}: compiling\u2026`);
+  out4(`githolon dev \u2014 ${project.name}: compiling\u2026`);
   const firstCompile = await compileAsync(cwd);
   if (!firstCompile.ok) {
-    err3(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
+    err4(`compile failed \u2014 the dev loop needs one green compile to mint the holon:
 ${firstCompile.output}`);
     return 1;
   }
@@ -1227,14 +1522,14 @@ ${firstCompile.output}`);
   try {
     deployBody = readDeployBody(cwd, project.name);
   } catch (e) {
-    err3(e.message);
+    err4(e.message);
     return 1;
   }
   let engBoot;
   try {
     engBoot = await holonEngine(cloud, deployBody, installedBy);
   } catch (e) {
-    err3(`cannot boot the local holon: ${String(e.message ?? e)}
+    err4(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* and is cached in ~/.holon/runtime after one fetch \u2014 connect once, then dev runs offline`);
     return 1;
   }
@@ -1257,31 +1552,31 @@ ${firstCompile.output}`);
   s.intents++;
   const installed = await installLaw(s, deployBody, installedBy);
   if (!installed.ok) {
-    err3(installed.error ?? "law install failed");
+    err4(installed.error ?? "law install failed");
     return 1;
   }
   s.proof = await runProofCycle(s, cwd, deployBody, installedBy);
   if (opts.once === true) {
-    out3(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
+    out4(statusScreen({ ...s, watchRoots: ["(--once: no watch)"] }));
     return s.proof === void 0 || s.proof.ok ? 0 : 1;
   }
   let server;
   try {
     server = await startServer(s);
   } catch (e) {
-    err3(e.message);
+    err4(e.message);
     return 1;
   }
   const moduleDirs = /* @__PURE__ */ new Set();
   try {
     const cfgModule = await import(pathToFileURL3(project.configPath).href);
     for (const d of cfgModule.default?.domains ?? []) {
-      for (const m of d.modules ?? []) moduleDirs.add(dirname3(resolve(cwd, m)));
+      for (const m of d.modules ?? []) moduleDirs.add(dirname4(resolve(cwd, m)));
     }
   } catch {
-    moduleDirs.add(join6(cwd, "domains"));
+    moduleDirs.add(join7(cwd, "domains"));
   }
-  if (moduleDirs.size === 0) moduleDirs.add(join6(cwd, "domains"));
+  if (moduleDirs.size === 0) moduleDirs.add(join7(cwd, "domains"));
   let timer;
   let cycling = false;
   let queued = false;
@@ -1297,7 +1592,7 @@ ${firstCompile.output}`);
     s.compileMs = run.ms;
     if (!run.ok) {
       s.lastError = run.output.trim() || "compile failed";
-      out3(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
+      out4(`\u2717 cycle ${s.cycle}: compile failed \u2014 the previous law keeps serving
 ${run.output}`);
     } else {
       s.lastError = void 0;
@@ -1306,16 +1601,16 @@ ${run.output}`);
         const inst = await installLaw(s, body, installedBy);
         if (!inst.ok) {
           s.lastError = inst.error ?? "install failed";
-          out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+          out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
         } else {
           s.proof = await runProofCycle(s, cwd, body, installedBy);
           const total = performance.now() - t0;
-          out3(statusScreen(s));
-          out3(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
+          out4(statusScreen(s));
+          out4(`  cycle      edit \u2192 law-live \u2192 proof in ${total.toFixed(0)} ms total`);
         }
       } catch (e) {
         s.lastError = String(e.message ?? e);
-        out3(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
+        out4(`\u2717 cycle ${s.cycle}: ${s.lastError}`);
       }
     }
     cycling = false;
@@ -1331,7 +1626,7 @@ ${run.output}`);
   };
   const watchers = [];
   for (const d of moduleDirs) {
-    if (!existsSync5(d)) continue;
+    if (!existsSync6(d)) continue;
     watchers.push(watch(d, { recursive: true }, (_evt, f) => onChange(f)));
     s.watchRoots.push(d.startsWith(cwd) ? d.slice(cwd.length + 1) + "/" : d);
   }
@@ -1341,8 +1636,8 @@ ${run.output}`);
     })
   );
   s.watchRoots.push(CONFIG_FILE);
-  out3(statusScreen(s));
-  out3("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
+  out4(statusScreen(s));
+  out4("  (ctrl-c stops; edits in the watched paths recompile + re-prove automatically)");
   return new Promise((resolveExit) => {
     const stop = () => {
       for (const w of watchers) w.close();
@@ -1355,13 +1650,14 @@ ${run.output}`);
 }
 
 // src/git.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+init_cloud();
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { readFileSync as readFileSync4 } from "node:fs";
-var out4 = (s) => void process.stdout.write(s + "\n");
-var err4 = (s) => void process.stderr.write("error: " + s + "\n");
+import { readFileSync as readFileSync5 } from "node:fs";
+var out5 = (s) => void process.stdout.write(s + "\n");
+var err5 = (s) => void process.stderr.write("error: " + s + "\n");
 function git2(args, opts = {}) {
-  const r = spawnSync2("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
+  const r = spawnSync3("git", args, { stdio: opts.quiet === true ? "ignore" : "inherit" });
   return r.status ?? 1;
 }
 function ensureSecret(cloud, ws) {
@@ -1386,36 +1682,36 @@ function workspaceFromPath(path) {
 }
 async function gitCredential(action) {
   if (action !== "get") return 0;
-  const kv = parseCredentialInput(readFileSync4(0, "utf8"));
+  const kv = parseCredentialInput(readFileSync5(0, "utf8"));
   const ws = workspaceFromPath(kv["path"]);
   if (kv["protocol"] !== "https" || ws === void 0) return 0;
   const cloud = `https://${kv["host"]}`;
   const token = await sessionToken().catch(() => void 0);
-  out4(`username=${token ?? "nomos"}`);
-  out4(`password=${ensureSecret(cloud, ws)}`);
-  out4("");
+  out5(`username=${token ?? "nomos"}`);
+  out5(`password=${ensureSecret(cloud, ws)}`);
+  out5("");
   return 0;
 }
 async function gitSetup(opts) {
   const cloud = cloudBase(opts.cloud);
   const self = process.argv[1];
   if (self === void 0) {
-    err4("cannot locate the githolon CLI entry to install as a credential helper");
+    err5("cannot locate the githolon CLI entry to install as a credential helper");
     return 1;
   }
   const helper = `!"${process.execPath}" "${self}" git-credential`;
   if (git2(["config", "--global", `credential.${cloud}.helper`, helper]) !== 0 || git2(["config", "--global", `credential.${cloud}.useHttpPath`, "true"]) !== 0) {
-    err4("git config failed \u2014 is git installed?");
+    err5("git config failed \u2014 is git installed?");
     return 1;
   }
-  out4(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
-  out4(`  pushes/clones of ${cloud}/v1/workspaces/<ws>/git now authenticate from ~/.holon`);
+  out5(`\u2713 git credential helper installed for ${cloud} (global gitconfig)`);
+  out5(`  pushes/clones of ${cloud}/v1/workspaces/<ws>/git now authenticate from ~/.holon`);
   return 0;
 }
 async function gitRemote(ws, name, opts) {
   const cloud = cloudBase(opts.cloud);
   if (git2(["rev-parse", "--git-dir"], { quiet: true }) !== 0) {
-    err4("not a git repository \u2014 run inside your repo (git init first)");
+    err5("not a git repository \u2014 run inside your repo (git init first)");
     return 1;
   }
   const setupRc = await gitSetup(opts);
@@ -1424,7 +1720,7 @@ async function gitRemote(ws, name, opts) {
   const url = `${cloud}/v1/workspaces/${ws}/git`;
   if (git2(["remote", "add", name, url], { quiet: true }) !== 0) {
     if (git2(["remote", "set-url", name, url], { quiet: true }) !== 0) {
-      err4(`could not add or update remote '${name}'`);
+      err5(`could not add or update remote '${name}'`);
       return 1;
     }
   }
@@ -1432,7 +1728,7 @@ async function gitRemote(ws, name, opts) {
   if (token === void 0) {
     const principal = loadCreds().principal;
     if (principal === void 0) {
-      err4(
+      err5(
         `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
   githolon login --agent   (then just push)
   \u2014 or re-run after githolon ws create/login so a principal is on file`
@@ -1440,13 +1736,13 @@ async function gitRemote(ws, name, opts) {
       return 1;
     }
     if (git2(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
-      err4("git config failed setting the principal header");
+      err5("git config failed setting the principal header");
       return 1;
     }
   }
-  out4(`\u2713 remote '${name}' \u2192 ${url}`);
-  out4(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
-  out4(`  birth/deploy by push:  git push ${name} main`);
+  out5(`\u2713 remote '${name}' \u2192 ${url}`);
+  out5(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
+  out5(`  birth/deploy by push:  git push ${name} main`);
   return 0;
 }
 
@@ -1462,9 +1758,9 @@ var HELP = {
     examples: ["githolon compile", "githolon compile nomos.package.mjs --layered"]
   },
   proof: {
-    usage: "githolon proof [build/<name>.proof.mts]",
-    what: "Run the proof GENERATED from your law, live against the cloud (throwaway workspace \u2192\ndeploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence). ALL GREEN or it names the jam.\nThe offline half of the same proof reruns automatically inside `githolon dev`.",
-    examples: ["githolon proof", "githolon proof build/guestbook.proof.mts"]
+    usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live] [--keep]",
+    what: "Run the proof GENERATED from your law. DEFAULT: the OFFLINE legs on a LOCAL holon \u2014 the\nsame engine plane the cloud edge runs; no cloud workspace is touched (develop/play/understand\nhere, deploy with confidence after). --domain <key> proves a SPECIFIC domain of a multi-domain\npackage (offline; the default is the first). --live runs the full cloud loop (throwaway\nworkspace \u2192 deploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence), RETIRED on every\nexit; --keep keeps it and prints the secret once. ALL GREEN or it names the jam. The offline\nlegs also rerun on every save in `githolon dev`.",
+    examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live", "githolon proof --live --keep"]
   },
   dev: {
     usage: "githolon dev [--port <n>] [--cloud <url>] [--once]",
@@ -1550,6 +1846,22 @@ var HELP = {
     what: "The workspace-secret store (~/.holon/credentials.json, 0600). `set` imports one you already\nhold; `rotate` mints a fresh one (and claims a legacy workspace).",
     examples: ["githolon secret set my-ws nws_v1_\u2026", "githolon secret rotate my-ws"]
   },
+  capability: {
+    usage: "githolon capability <bind|rotate|unbind> <ws> <capability> | list <ws>  [--from-gcloud <name>] [--scope <s>] [--expires-at <iso|ms>] [--cloud <url>]",
+    what: "Capability credentials (architecture/capability_credentials.md): the ledger holds FACTS ABOUT\nAUTHORITY (the CapabilityBinding record \u2014 keyHash/scope/expiry/epoch), the credential VALUE\nlives at exactly ONE host (the workspace's holon). `bind` ships the value over the owner-gated\nlane ONCE \u2014 from stdin (pipe it) or Google Secret Manager, NEVER argv (ps/history are hosts\ntoo). `rotate` = revoke + re-bind at epoch+1; `unbind` revokes the fact and the host forgets\nthe value; `list` shows facts only.",
+    flags: [
+      ["--from-gcloud <name>", "read the value from `gcloud secrets versions access latest --secret=<name>`"],
+      ["--scope <s>", "a narrowing label recorded on the law fact (e.g. read-only)"],
+      ["--expires-at <t>", "expiry recorded on the law fact (ISO date/datetime or epoch-ms; fail-closed at the host)"],
+      ["--cloud <url>", "target cloud (default: $NOMOS_CLOUD or the public cloud)"]
+    ],
+    examples: [
+      "cat token.txt | githolon capability bind nomos-usage cf-analytics",
+      "githolon capability bind my-ws openai --from-gcloud openai-api-key --scope read-only",
+      "githolon capability list nomos-usage",
+      "githolon capability rotate nomos-usage cf-analytics --from-gcloud cf-analytics-token"
+    ]
+  },
   git: {
     usage: "githolon git <setup | remote [<ws>] [<remoteName>]> [--cloud <url>] [--target <name>]",
     what: "Stock git push as deploy/birth. `setup` installs the credential helper for the cloud host;\n`remote` wires this repo to a workspace (then: git push nomos main). With no <ws>, the\nproject's `workspace` binding resolves it.",
@@ -1578,34 +1890,37 @@ function commandHelp(cmd) {
 }
 
 // src/ledger.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join7 } from "node:path";
-var out5 = (s) => void process.stdout.write(s + "\n");
-var err5 = (s) => void process.stderr.write("error: " + s + "\n");
+init_engine();
+init_cloud();
+init_local_holon();
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join8 } from "node:path";
+var out6 = (s) => void process.stdout.write(s + "\n");
+var err6 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS2 = "local";
 async function ledgerInit(dir, opts) {
   const cloud = cloudBase(opts.cloud);
-  if (existsSync6(dir) && readdirSync3(dir).length > 0) {
-    err5(`refusing to mint into non-empty directory: ${dir}`);
+  if (existsSync7(dir) && readdirSync3(dir).length > 0) {
+    err6(`refusing to mint into non-empty directory: ${dir}`);
     return 1;
   }
   let deployFile;
   try {
     deployFile = discoverDeployJson(process.cwd(), opts.file);
   } catch (e) {
-    err5(e.message);
+    err6(e.message);
     return 1;
   }
-  const deployBody = JSON.parse(readFileSync5(deployFile, "utf8"));
+  const deployBody = JSON.parse(readFileSync6(deployFile, "utf8"));
   const domainHash = await sha256hex(deployBody.packageUsda);
   const c = loadCreds();
   const principal = await sessionToken().catch(() => void 0) !== void 0 ? c.session.uid : c.principal;
   if (principal === void 0) {
-    err5("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
+    err6("a holon is born OF someone \u2014 githolon login --agent first (or githolon ws create --principal <uid> once)");
     return 1;
   }
-  out5(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
+  out6(`minting a holon locally (law ${domainHash.slice(0, 12)}\u2026, installedBy ${principal})`);
   const { eng } = await holonEngine(cloud, deployBody, principal);
   await mountFresh(eng, WS2);
   author(eng, WS2, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, principal), "");
@@ -1613,21 +1928,21 @@ async function ledgerInit(dir, opts) {
   const verdict = verifyChainLocal(eng, WS2);
   if (!printVerdict(verdict)) return 1;
   const gitTree = eng.preopen.dir.contents.get("ws").contents.get(WS2).contents.get("nomos.git");
-  const gitDir = join7(dir, ".git");
+  const gitDir = join8(dir, ".git");
   writeTreeToDisk(gitTree, gitDir);
-  const cfgPath = join7(gitDir, "config");
-  writeFileSync4(cfgPath, readFileSync5(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
-  spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
-  out5(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
-  out5(`
+  const cfgPath = join8(gitDir, "config");
+  writeFileSync4(cfgPath, readFileSync6(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
+  spawnSync4("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
+  out6(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
+  out6(`
 Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
-  out5(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
+  out6(`  cd ${dir} && npx githolon git remote <ws> && git push nomos main`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
-  const gitDir = existsSync6(join7(dir, ".git")) ? join7(dir, ".git") : dir;
-  if (!existsSync6(join7(gitDir, "HEAD"))) {
-    err5(`${dir} is not a git repo (no HEAD)`);
+  const gitDir = existsSync7(join8(dir, ".git")) ? join8(dir, ".git") : dir;
+  if (!existsSync7(join8(gitDir, "HEAD"))) {
+    err6(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
   const { eng } = await holonEngine(cloudBase(opts.cloud), void 0, "verify");
@@ -1638,11 +1953,15 @@ async function ledgerVerify(dir, opts) {
 }
 
 // src/replay.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
-import { join as join8 } from "node:path";
+init_engine();
+init_engine();
+init_cloud();
+init_local_holon();
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
+import { join as join9 } from "node:path";
 import git3 from "isomorphic-git";
-var out6 = (s) => void process.stdout.write(s + "\n");
-var err6 = (s) => void process.stderr.write("error: " + s + "\n");
+var out7 = (s) => void process.stdout.write(s + "\n");
+var err7 = (s) => void process.stderr.write("error: " + s + "\n");
 var SOURCE = "source";
 var REPLAY = "replay";
 function summarizePayload(payload, max = 100) {
@@ -1678,9 +1997,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out8 = {};
-    for (const [k, x] of Object.entries(v)) out8[k] = capJsonStrings(x, max);
-    return out8;
+    const out9 = {};
+    for (const [k, x] of Object.entries(v)) out9[k] = capJsonStrings(x, max);
+    return out9;
   }
   return v;
 }
@@ -1727,10 +2046,10 @@ function readKey() {
 async function replay(target, opts) {
   const cloud = cloudBase(opts.cloud);
   const json = opts.json === true;
-  const emit = (o) => out6(JSON.stringify(o));
+  const emit = (o) => out7(JSON.stringify(o));
   let overlay;
   try {
-    overlay = JSON.parse(readFileSync6(discoverDeployJson(process.cwd(), opts.file), "utf8"));
+    overlay = JSON.parse(readFileSync7(discoverDeployJson(process.cwd(), opts.file), "utf8"));
   } catch {
     overlay = void 0;
   }
@@ -1738,15 +2057,15 @@ async function replay(target, opts) {
   try {
     ({ eng } = await holonEngine(cloud, overlay, "githolon-replay"));
   } catch (e) {
-    err6(`cannot boot the local holon: ${String(e.message ?? e)}
+    err7(`cannot boot the local holon: ${String(e.message ?? e)}
   the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);
     return 1;
   }
-  const isDir = existsSync7(target) || target.includes("/") || target.startsWith(".");
+  const isDir = existsSync8(target) || target.includes("/") || target.startsWith(".");
   if (isDir) {
-    const gitDir = existsSync7(join8(target, ".git")) ? join8(target, ".git") : target;
-    if (!existsSync7(join8(gitDir, "HEAD"))) {
-      err6(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
+    const gitDir = existsSync8(join9(target, ".git")) ? join9(target, ".git") : target;
+    if (!existsSync8(join9(gitDir, "HEAD"))) {
+      err7(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
       return 1;
     }
     await mountFresh(eng, SOURCE);
@@ -1754,7 +2073,7 @@ async function replay(target, opts) {
   } else {
     const m = await mountWorkspace(eng, SOURCE, { remote: `${cloud}/v1/workspaces/${target}/git`, headers: {} });
     if (m.restored !== true) {
-      err6(
+      err7(
         `workspace '${target}' has no refs/heads/main on ${cloud} \u2014 nothing to replay` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : "") + `
   check the name (githolon ws status ${target}), or pass a local holon directory instead`
       );
@@ -1763,7 +2082,7 @@ async function replay(target, opts) {
   }
   const chain = await walkChain(eng, SOURCE);
   if (chain.length === 0) {
-    err6(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
+    err7(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
     return 1;
   }
   await mountFresh(eng, REPLAY);
@@ -1772,8 +2091,8 @@ async function replay(target, opts) {
   const tallies = /* @__PURE__ */ new Map();
   let autoRun = !interactive;
   if (!json) {
-    out6(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
-    if (interactive) out6("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
+    out7(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
+    if (interactive) out7("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
   }
   for (let i = 0; i < chain.length; i++) {
     const { oid, bytes, doc } = chain[i];
@@ -1787,8 +2106,8 @@ async function replay(target, opts) {
     if (res.ok === false) {
       const msg = `replay REFUSED at intent ${i} (${domain}/${directive}, ${oid.slice(0, 10)}): ${res.error ?? "unknown"}`;
       if (json) emit({ step: i, oid, domain, directive, refused: true, error: res.error ?? "unknown" });
-      else err6(msg);
-      err6("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
+      else err7(msg);
+      err7("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
       printVerdict(verifyChainLocal(eng, SOURCE));
       return 1;
     }
@@ -1809,31 +2128,31 @@ async function replay(target, opts) {
         tallies: Object.fromEntries(tallies)
       });
     } else {
-      out6(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
-      out6(`      payload  ${summarizePayload(doc.payload?.payload)}`);
+      out7(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
+      out7(`      payload  ${summarizePayload(doc.payload?.payload)}`);
       for (const ev of doc.events ?? []) {
         const id = ev.aggregate ?? "?";
         const was = before.get(id);
         const verb = ev.marker === "Create" ? "+ created" : ev.marker === "Delete" ? "- deleted" : was === void 0 ? "~ touched" : "~ updated";
-        out6(`      ${verb}  ${id}`);
+        out7(`      ${verb}  ${id}`);
         const ops = summarizeOps(ev);
-        if (ops.length > 0) out6(`                ${ops}`);
+        if (ops.length > 0) out7(`                ${ops}`);
       }
       const tallyLine = [...tallies.entries()].map(([t, n]) => `${t}:${n}`).join("  ");
       const showTally = stepEvery > 0 ? (i + 1) % stepEvery === 0 || i === chain.length - 1 : true;
-      if (showTally && tallyLine.length > 0) out6(`      rows     ${tallyLine}`);
+      if (showTally && tallyLine.length > 0) out7(`      rows     ${tallyLine}`);
     }
     if (interactive && !autoRun && i < chain.length - 1) {
       const key = await readKey();
       if (key === "quit") {
-        out6(`
+        out7(`
 stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below covers the WHOLE chain as delivered`);
         break;
       }
       if (key === "all") autoRun = true;
     }
   }
-  if (!json) out6("");
+  if (!json) out7("");
   const verdict = verifyChainLocal(eng, SOURCE);
   if (json) {
     emit({ finale: true, verdict });
@@ -1843,65 +2162,89 @@ stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below cover
 }
 
 // src/status.ts
-import { readFileSync as readFileSync7 } from "node:fs";
-var out7 = (s) => void process.stdout.write(s + "\n");
-var err7 = (s) => void process.stderr.write("error: " + s + "\n");
+init_engine();
+init_cloud();
+import { readFileSync as readFileSync8 } from "node:fs";
+var out8 = (s) => void process.stdout.write(s + "\n");
+var err8 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws) {
   const active = installed.filter((d) => d.phase === "Active" && typeof d.domainHash === "string");
-  const match = active.find((d) => d.domainHash === localHash);
-  if (match !== void 0) {
-    return { inSync: true, lines: [`\u2713 in sync \u2014 the deployed law IS your local build (${localHash.slice(0, 16)}\u2026)`] };
-  }
+  const currents = active.filter((d) => d.current === true);
+  const priors = active.filter((d) => d.current !== true);
+  const localActive = active.find((d) => d.domainHash === localHash);
+  const localIsCurrent = currents.some((d) => d.domainHash === localHash);
   const lines = [];
+  if (localIsCurrent || currents.length === 0 && localActive !== void 0) {
+    lines.push(`\u2713 in sync \u2014 the deployed law IS your local build (${localHash.slice(0, 16)}\u2026)`);
+    if (priors.length > 0) lines.push(`  (${priors.length} prior deploy(s) remain Active under install-beside; yours is the current one resolution serves)`);
+    return { inSync: true, lines };
+  }
   if (active.length === 0) {
     lines.push(`\u2717 workspace '${ws}' has NO active tenant law \u2014 your local build is not deployed`);
+  } else if (localActive !== void 0) {
+    lines.push(`~ your build (${localHash.slice(0, 16)}\u2026) is an ACTIVE install on '${ws}', but SUPERSEDED \u2014 a newer deploy is current:`);
+    for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
+    lines.push(`  redeploy to make your build current: githolon deploy ${ws}`);
+    return { inSync: false, lines };
+  } else if (currents.length > 0) {
+    lines.push(`\u2717 local law differs from the current install${currents.length > 1 ? "s" : ""} on '${ws}':`);
+    for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
+    if (priors.length > 0) lines.push(`    + ${priors.length} prior active install(s) (install-beside \u2014 historical, not served)`);
   } else {
-    lines.push(`\u2717 local law differs from every active installation on '${ws}':`);
+    lines.push(`\u2717 local law differs from every active installation on '${ws}' (${active.length}):`);
     for (const d of active) lines.push(`    deployed ${d.domainHash.slice(0, 16)}\u2026  (${d.installedBy ?? "?"})`);
   }
-  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026)`);
+  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026 and makes it current)`);
   return { inSync: false, lines };
 }
+var CONTROL_PLANE_KEYS = ["nomos", "bootstrap", "workspaces"];
 async function status(wsArg, opts) {
   const cloud = cloudBase(opts.cloud);
   let ws;
   try {
     ws = await resolveWorkspace(wsArg, process.cwd(), opts.target, "githolon status <ws>");
   } catch (e) {
-    err7(e.message);
+    err8(e.message);
     return 1;
   }
   let localHash;
   try {
-    const body = JSON.parse(readFileSync7(discoverDeployJson(process.cwd(), opts.file), "utf8"));
+    const body = JSON.parse(readFileSync8(discoverDeployJson(process.cwd(), opts.file), "utf8"));
     if (typeof body.packageUsda === "string") localHash = await sha256hex(body.packageUsda);
   } catch {
     localHash = void 0;
   }
   const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).catch(() => void 0);
   if (r === void 0) {
-    err7(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
+    err8(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
     return 1;
   }
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
-    err7(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
+    err8(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
   is the workspace born? githolon ws create ${ws}`);
     return 1;
   }
-  out7(`workspace  ${ws} on ${cloud}`);
-  const domains = d.domains ?? [];
-  if (domains.length === 0) out7(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  out8(`workspace  ${ws} on ${cloud}`);
+  const allDomains = d.domains ?? [];
+  const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
+  const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
+  const controllerCount = allDomains.length - domains.length;
+  if (allDomains.length === 0) out8(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
   for (const dom of domains) {
-    out7(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}`);
+    const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
+    out8(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
   }
+  if (controllerCount > 0) out8(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
+  if (tenantActive > 1) out8(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
   if (localHash === void 0) {
-    out7(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
+    out8(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;
   }
-  out7(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
+  out8(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
   const verdict = lawDiffVerdict(localHash, domains, ws);
-  for (const line of verdict.lines) out7(line);
+  for (const line of verdict.lines) out8(line);
   return verdict.inSync ? 0 : 2;
 }
 
@@ -1943,6 +2286,15 @@ a bare <ws> resolves from nomos.package.mjs's optional \`workspace\` binding):
   githolon secret set <ws> <secret>                       import a secret you already hold
   githolon secret rotate <ws>                             rotate (and re-save) the workspace secret
 
+Capability credentials (facts on the ledger, values host-side \u2014 the value NEVER rides argv;
+stdin or --from-gcloud only; architecture/capability_credentials.md):
+  githolon capability bind <ws> <capability>              bind a credential: value from stdin (or
+                                                       --from-gcloud <name>) \u2192 the workspace's holon;
+                                                       sha256(value) \u2192 the law-state binding fact
+  githolon capability list <ws>                           the binding FACTS (never the values)
+  githolon capability rotate <ws> <capability>            revoke + re-bind at epoch+1 (new value)
+  githolon capability unbind <ws> <capability>            revoke the fact; the host forgets the value
+
 Git lane (stock git push as deploy/birth \u2014 see also: push-to-create):
   githolon git setup                                      install the credential helper for the cloud host
   githolon git remote [<ws>] [<remoteName>]               wire this repo to a workspace (default name: nomos)
@@ -2021,23 +2373,71 @@ ${USAGE}`);
   if (sub === "rotate" && ws !== void 0) return secretRotate(ws, opts);
   return usageFail("expected: githolon secret <set <ws> <secret> | rotate <ws>>");
 }
+async function runCapability(argv) {
+  const usageFail = (m) => {
+    process.stderr.write(`error: ${m}
+
+${commandHelp("capability")}`);
+    return 1;
+  };
+  const pos = [];
+  const opts = {};
+  const rest = argv.slice(1);
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--cloud" || a === "--from-gcloud" || a === "--scope" || a === "--expires-at") {
+      const v = rest[++i];
+      if (v === void 0) return usageFail(`${a} requires a value`);
+      if (a === "--cloud") opts.cloud = v;
+      else if (a === "--from-gcloud") opts.fromGcloud = v;
+      else if (a === "--scope") opts.scope = v;
+      else opts.expiresAt = v;
+    } else if (a.startsWith("--")) {
+      return usageFail(`unknown flag '${a}'`);
+    } else {
+      pos.push(a);
+    }
+  }
+  const [sub, ws, capability] = pos;
+  if (sub === "bind" && ws !== void 0 && capability !== void 0) return capabilityBind(ws, capability, opts);
+  if (sub === "rotate" && ws !== void 0 && capability !== void 0) return capabilityRotate(ws, capability, opts);
+  if (sub === "unbind" && ws !== void 0 && capability !== void 0) return capabilityUnbind(ws, capability, opts);
+  if (sub === "list" && ws !== void 0) return capabilityList(ws, opts);
+  return usageFail("expected: githolon capability <bind|rotate|unbind> <ws> <capability> | list <ws>");
+}
 function isKind(s) {
   return s !== void 0 && KINDS.includes(s);
 }
-function runProof(args) {
+async function runProof(args) {
   const refuse = (m) => {
     process.stderr.write(`error: ${m}
 `);
     return 1;
   };
-  const explicit = args.find((a) => !a.startsWith("--"));
+  const live = args.includes("--live");
+  const keep = args.includes("--keep");
+  if (keep && !live) return refuse("--keep only applies to --live (the offline proof creates no cloud workspace to keep)");
+  let domain;
+  let domainValueIdx = -1;
+  const di = args.findIndex((a) => a === "--domain" || a.startsWith("--domain="));
+  if (di >= 0) {
+    const a = args[di];
+    if (a.includes("=")) domain = a.slice(a.indexOf("=") + 1);
+    else {
+      domain = args[di + 1];
+      domainValueIdx = di + 1;
+    }
+    if (domain === void 0 || domain === "" || domain.startsWith("--")) return refuse("--domain needs a domain key: githolon proof --domain <key>");
+  }
+  if (domain !== void 0 && live) return refuse("--domain is an OFFLINE-lane selector (the --live proof runs the package's primary domain end-to-end); drop --live or drop --domain");
+  const explicit = args.find((a, i) => !a.startsWith("--") && i !== domainValueIdx);
   let proofPath;
   if (explicit !== void 0) {
     proofPath = resolve2(process.cwd(), explicit);
-    if (!existsSync8(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    if (!existsSync9(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
-    const buildDir = join9(process.cwd(), "build");
-    if (!existsSync8(buildDir)) {
+    const buildDir = join10(process.cwd(), "build");
+    if (!existsSync9(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
     const proofs = readdirSync4(buildDir).filter((f) => f.endsWith(".proof.mts"));
@@ -2047,21 +2447,30 @@ function runProof(args) {
     if (proofs.length > 1) {
       return refuse(`found ${proofs.length} proofs (${proofs.join(", ")}) \u2014 name one: githolon proof build/<name>.proof.mts`);
     }
-    proofPath = join9(buildDir, proofs[0]);
+    proofPath = join10(buildDir, proofs[0]);
+  }
+  if (!live) {
+    try {
+      const { runOfflineProofStandalone: runOfflineProofStandalone2 } = await Promise.resolve().then(() => (init_proof_offline(), proof_offline_exports));
+      const { cloudBase: cloudBase2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
+      return await runOfflineProofStandalone2(proofPath, cloudBase2(), domain);
+    } catch (e) {
+      return refuse(`${e.message ?? e}`);
+    }
   }
   const resolvePkgDir = (name, fromDir) => {
     try {
-      return dirname4(createRequire2(pathToFileURL4(join9(fromDir, "noop.js"))).resolve(`${name}/package.json`));
+      return dirname5(createRequire2(pathToFileURL4(join10(fromDir, "noop.js"))).resolve(`${name}/package.json`));
     } catch {
       return void 0;
     }
   };
   const dslDir = (() => {
     try {
-      return dirname4(createRequire2(pathToFileURL4(join9(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
+      return dirname5(createRequire2(pathToFileURL4(join10(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
     } catch {
       try {
-        return dirname4(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
+        return dirname5(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
       } catch {
         return void 0;
       }
@@ -2071,17 +2480,22 @@ function runProof(args) {
   if (tsxDir === void 0) {
     return refuse("tsx not found \u2014 add @githolon/dsl to your project's dependencies (tsx rides along) and npm install");
   }
-  const tsxPkg = JSON.parse(readFileSync8(join9(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync9(join10(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
-  const tsxCli = join9(tsxDir, tsxBinRel ?? "dist/cli.mjs");
-  const r = spawnSync4(process.execPath, [tsxCli, proofPath], { stdio: "inherit", cwd: process.cwd() });
+  const tsxCli = join10(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+  console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept, secret printed once" : "") + ")");
+  const r = spawnSync5(process.execPath, [tsxCli, proofPath], {
+    stdio: "inherit",
+    cwd: process.cwd(),
+    env: { ...process.env, ...keep ? { PROOF_KEEP: "1" } : {} }
+  });
   return r.status ?? 1;
 }
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== "generate" && command !== "g") {
     throw new Error(
-      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | status | generate | ws | deploy | secret.`
+      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | status | generate | ws | deploy | secret | capability.`
     );
   }
   let outDir = DEFAULT_OUT;
@@ -2209,6 +2623,9 @@ ${commandHelp("status")}`);
   if (argv[0] === "ws" || argv[0] === "deploy" || argv[0] === "secret") {
     return runCloud(argv);
   }
+  if (argv[0] === "capability") {
+    return runCapability(argv);
+  }
   if (argv[0] === "login") {
     const agent = argv.includes("--agent");
     const tokenAt = argv.indexOf("--token");
@@ -2265,8 +2682,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err8) {
-    process.stderr.write(`error: ${err8.message}
+  } catch (err9) {
+    process.stderr.write(`error: ${err9.message}
 
 ${USAGE}`);
     return 1;
@@ -2285,8 +2702,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path}
 `);
     return 0;
-  } catch (err8) {
-    process.stderr.write(`error: ${err8.message}
+  } catch (err9) {
+    process.stderr.write(`error: ${err9.message}
 `);
     return 1;
   }