githolon 0.5.0 → 0.6.0

package/dist/cli.mjs

@@ -460,13 +460,13 @@ async function sha256hex(t) {
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out9 = new Array(n), T = 2 ** 53;
+  const out10 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z = 0n;
     for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out9[i] = Number(z >> 11n) / T;
+    out10[i] = Number(z >> 11n) / T;
   }
-  return out9;
+  return out10;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
@@ -599,7 +599,7 @@ function applyIntentBytes(eng, ws, bytes) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
 }
-var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, count, sum;
+var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
@@ -615,8 +615,9 @@ var init_engine = __esm({
       return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
     };
     installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, authorityScope: "workspace/root", dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
-    qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
-    query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
+    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+    cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
     count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
   }
@@ -644,6 +645,13 @@ async function fetchRuntime(cloud) {
   const cache = join4(configDir(), "runtime");
   let wasmBytes;
   const wasmCache = join4(cache, "holon.wasm");
+  const localWasm = process.env["NOMOS_LOCAL_WASM"];
+  if (localWasm) {
+    const bytes = readFileSync2(localWasm);
+    const manifests2 = await fetchJsonCached(`${cloud}/v1/runtime/manifests`, join4(cache, "manifests.json"));
+    const packages2 = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join4(cache, "packages.json"));
+    return { wasmBytes: bytes, manifests: manifests2, packages: packages2 };
+  }
   try {
     const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
     if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
@@ -832,14 +840,28 @@ function runOfflineLegs(eng, ws, lawHash, legs) {
   }
   return done(true, lines);
 }
-async function runOfflineProofStandalone(proofPath, cloud) {
+async function runOfflineProofStandalone(proofPath, cloud, domain) {
   const src = readFileSync3(proofPath, "utf8");
-  const legs = parseOfflineLegs(src);
   const packageName = basename(proofPath).replace(/\.proof\.mts$/, "");
   const deployFile = join6(dirname3(proofPath), `${packageName}.deploy.json`);
   if (!existsSync5(deployFile)) {
     throw new Error(`missing ${deployFile} \u2014 run \`githolon compile\` (the proof and the deploy body are built together)`);
   }
+  let legs;
+  const legsFile = join6(dirname3(proofPath), `${packageName}.proof-legs.json`);
+  if (existsSync5(legsFile)) {
+    const index = JSON.parse(readFileSync3(legsFile, "utf8"));
+    const keys = Object.keys(index.domains);
+    const chosen = domain ?? index.default;
+    if (index.domains[chosen] === void 0) {
+      throw new Error(`no provable domain '${chosen}' in this package \u2014 it proves: ${keys.join(", ")} (pick one: githolon proof --domain <key>)`);
+    }
+    legs = index.domains[chosen];
+    if (keys.length > 1) console.log(`githolon proof \u2014 domain '${chosen}' (of ${keys.length}: ${keys.join(", ")}; --domain <key> to switch)`);
+  } else {
+    if (domain !== void 0) throw new Error(`--domain needs a per-domain legs index (build/${packageName}.proof-legs.json) \u2014 recompile with \`githolon compile\` to emit it`);
+    legs = parseOfflineLegs(src);
+  }
   const deployBody = JSON.parse(readFileSync3(deployFile, "utf8"));
   const lawHash = await sha256hex(deployBody.packageUsda);
   console.log(`githolon proof \u2014 OFFLINE legs on a local holon (the cloud loop: githolon proof --live)`);
@@ -1744,9 +1766,9 @@ var HELP = {
     examples: ["githolon compile", "githolon compile nomos.package.mjs --layered"]
   },
   proof: {
-    usage: "githolon proof [build/<name>.proof.mts] [--live] [--keep]",
-    what: "Run the proof GENERATED from your law. DEFAULT: the OFFLINE legs on a LOCAL holon \u2014 the\nsame engine plane the cloud edge runs; no cloud workspace is touched (develop/play/understand\nhere, deploy with confidence after). --live runs the full cloud loop (throwaway workspace \u2192\ndeploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence), RETIRED on every exit;\n--keep keeps it and prints the secret once. ALL GREEN or it names the jam. The offline legs\nalso rerun on every save in `githolon dev`.",
-    examples: ["githolon proof", "githolon proof --live", "githolon proof --live --keep"]
+    usage: "githolon proof [build/<name>.proof.mts] [--domain <key>] [--live] [--keep]",
+    what: "Run the proof GENERATED from your law. DEFAULT: the OFFLINE legs on a LOCAL holon \u2014 the\nsame engine plane the cloud edge runs; no cloud workspace is touched (develop/play/understand\nhere, deploy with confidence after). --domain <key> proves a SPECIFIC domain of a multi-domain\npackage (offline; the default is the first). --live runs the full cloud loop (throwaway\nworkspace \u2192 deploy \u2192 offline write \u2192 admission \u2192 cloud reads \u2192 convergence), RETIRED on every\nexit; --keep keeps it and prints the secret once. ALL GREEN or it names the jam. The offline\nlegs also rerun on every save in `githolon dev`.",
+    examples: ["githolon proof", "githolon proof --domain co2_platform", "githolon proof --live", "githolon proof --live --keep"]
   },
   dev: {
     usage: "githolon dev [--port <n>] [--cloud <url>] [--once]",
@@ -1983,9 +2005,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out9 = {};
-    for (const [k, x] of Object.entries(v)) out9[k] = capJsonStrings(x, max);
-    return out9;
+    const out10 = {};
+    for (const [k, x] of Object.entries(v)) out10[k] = capJsonStrings(x, max);
+    return out10;
   }
   return v;
 }
@@ -2147,35 +2169,114 @@ stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below cover
   return printVerdict(verdict) ? 0 : 1;
 }
 
+// src/decrypt.ts
+init_local_holon();
+init_cloud();
+init_engine();
+var SOURCE2 = "source";
+var out8 = (s) => {
+  process.stdout.write(s + "\n");
+};
+var err8 = (s) => {
+  process.stderr.write(`error: ${s}
+`);
+};
+async function decrypt(ws, opts) {
+  const cloud = cloudBase(opts.cloud);
+  if (!opts.as) {
+    err8("--as <principal> is required (who to decrypt as)");
+    return 1;
+  }
+  if (!opts.secret) {
+    err8("--secret <base64 X25519 device secret> is required");
+    return 1;
+  }
+  if (!opts.query) {
+    err8("--query <queryId> is required (the read to decrypt)");
+    return 1;
+  }
+  let eng;
+  try {
+    ({ eng } = await holonEngine(cloud, opts.overlay, "githolon-decrypt"));
+  } catch (e) {
+    err8(`cannot boot the local holon: ${String(e.message ?? e)}`);
+    return 1;
+  }
+  const m = await mountWorkspace(eng, SOURCE2, {
+    remote: `${cloud}/v1/workspaces/${ws}/git`,
+    headers: { "x-nomos-principal": opts.as }
+  });
+  if (m.restored !== true) {
+    err8(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
+    return 1;
+  }
+  const wraps = query(eng, SOURCE2, "wrappedKeysByRecipient", JSON.stringify({ recipientPrincipal: opts.as }), opts.as);
+  const keys = [];
+  if (Array.isArray(wraps)) {
+    for (const w of wraps) {
+      const d = w.data ?? {};
+      try {
+        const key = cryptoUnwrapKey(eng, { secret: opts.secret, hpkeEpk: d.hpkeEpk, ct: d.ct });
+        keys.push({ scope: d.scope, epoch: Number(d.epoch), key });
+      } catch {
+      }
+    }
+  }
+  if (opts.json !== true) out8(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
+  const rows = query(eng, SOURCE2, opts.query, JSON.stringify(opts.params ?? {}), opts.as, keys);
+  if (rows && !Array.isArray(rows) && rows.ok === false) {
+    err8(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
+  '${opts.as}' is not granted this scope's read capability` : ""));
+    return 1;
+  }
+  out8(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
+  return 0;
+}
+
 // src/status.ts
 init_engine();
 init_cloud();
 import { readFileSync as readFileSync8 } from "node:fs";
-var out8 = (s) => void process.stdout.write(s + "\n");
-var err8 = (s) => void process.stderr.write("error: " + s + "\n");
+var out9 = (s) => void process.stdout.write(s + "\n");
+var err9 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws) {
   const active = installed.filter((d) => d.phase === "Active" && typeof d.domainHash === "string");
-  const match = active.find((d) => d.domainHash === localHash);
-  if (match !== void 0) {
-    return { inSync: true, lines: [`\u2713 in sync \u2014 the deployed law IS your local build (${localHash.slice(0, 16)}\u2026)`] };
-  }
+  const currents = active.filter((d) => d.current === true);
+  const priors = active.filter((d) => d.current !== true);
+  const localActive = active.find((d) => d.domainHash === localHash);
+  const localIsCurrent = currents.some((d) => d.domainHash === localHash);
   const lines = [];
+  if (localIsCurrent || currents.length === 0 && localActive !== void 0) {
+    lines.push(`\u2713 in sync \u2014 the deployed law IS your local build (${localHash.slice(0, 16)}\u2026)`);
+    if (priors.length > 0) lines.push(`  (${priors.length} prior deploy(s) remain Active under install-beside; yours is the current one resolution serves)`);
+    return { inSync: true, lines };
+  }
   if (active.length === 0) {
     lines.push(`\u2717 workspace '${ws}' has NO active tenant law \u2014 your local build is not deployed`);
+  } else if (localActive !== void 0) {
+    lines.push(`~ your build (${localHash.slice(0, 16)}\u2026) is an ACTIVE install on '${ws}', but SUPERSEDED \u2014 a newer deploy is current:`);
+    for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
+    lines.push(`  redeploy to make your build current: githolon deploy ${ws}`);
+    return { inSync: false, lines };
+  } else if (currents.length > 0) {
+    lines.push(`\u2717 local law differs from the current install${currents.length > 1 ? "s" : ""} on '${ws}':`);
+    for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
+    if (priors.length > 0) lines.push(`    + ${priors.length} prior active install(s) (install-beside \u2014 historical, not served)`);
   } else {
-    lines.push(`\u2717 local law differs from every active installation on '${ws}':`);
+    lines.push(`\u2717 local law differs from every active installation on '${ws}' (${active.length}):`);
     for (const d of active) lines.push(`    deployed ${d.domainHash.slice(0, 16)}\u2026  (${d.installedBy ?? "?"})`);
   }
-  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026)`);
+  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026 and makes it current)`);
   return { inSync: false, lines };
 }
+var CONTROL_PLANE_KEYS = ["nomos", "bootstrap", "workspaces"];
 async function status(wsArg, opts) {
   const cloud = cloudBase(opts.cloud);
   let ws;
   try {
     ws = await resolveWorkspace(wsArg, process.cwd(), opts.target, "githolon status <ws>");
   } catch (e) {
-    err8(e.message);
+    err9(e.message);
     return 1;
   }
   let localHash;
@@ -2187,28 +2288,35 @@ async function status(wsArg, opts) {
   }
   const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).catch(() => void 0);
   if (r === void 0) {
-    err8(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
+    err9(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
     return 1;
   }
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
-    err8(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
+    err9(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
   is the workspace born? githolon ws create ${ws}`);
     return 1;
   }
-  out8(`workspace  ${ws} on ${cloud}`);
-  const domains = d.domains ?? [];
-  if (domains.length === 0) out8(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  out9(`workspace  ${ws} on ${cloud}`);
+  const allDomains = d.domains ?? [];
+  const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
+  const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
+  const controllerCount = allDomains.length - domains.length;
+  if (allDomains.length === 0) out9(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
   for (const dom of domains) {
-    out8(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}`);
+    const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
+    out9(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
   }
+  if (controllerCount > 0) out9(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
+  if (tenantActive > 1) out9(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
   if (localHash === void 0) {
-    out8(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
+    out9(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;
   }
-  out8(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
+  out9(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
   const verdict = lawDiffVerdict(localHash, domains, ws);
-  for (const line of verdict.lines) out8(line);
+  for (const line of verdict.lines) out9(line);
   return verdict.inSync ? 0 : 2;
 }
 
@@ -2224,6 +2332,8 @@ The inner loop:
   githolon status [<ws>]                                  local law hash vs the DEPLOYED law, remedy named
   githolon replay <ws|dir>                                the ledger as film: step the chain intent-by-
                                                        intent; finale = the verify_chain verdict
+  githolon decrypt <ws> --as <p> --secret <b64>          clone + decrypt as a principal: unwrap their scope
+            --query <id> [--param k=v]                   keys from the chain, read private fields in cleartext
 
 Authoring:
   githolon compile  [compiler args]                       compile the package by ./nomos.package.mjs
@@ -2381,7 +2491,20 @@ async function runProof(args) {
   const live = args.includes("--live");
   const keep = args.includes("--keep");
   if (keep && !live) return refuse("--keep only applies to --live (the offline proof creates no cloud workspace to keep)");
-  const explicit = args.find((a) => !a.startsWith("--"));
+  let domain;
+  let domainValueIdx = -1;
+  const di = args.findIndex((a) => a === "--domain" || a.startsWith("--domain="));
+  if (di >= 0) {
+    const a = args[di];
+    if (a.includes("=")) domain = a.slice(a.indexOf("=") + 1);
+    else {
+      domain = args[di + 1];
+      domainValueIdx = di + 1;
+    }
+    if (domain === void 0 || domain === "" || domain.startsWith("--")) return refuse("--domain needs a domain key: githolon proof --domain <key>");
+  }
+  if (domain !== void 0 && live) return refuse("--domain is an OFFLINE-lane selector (the --live proof runs the package's primary domain end-to-end); drop --live or drop --domain");
+  const explicit = args.find((a, i) => !a.startsWith("--") && i !== domainValueIdx);
   let proofPath;
   if (explicit !== void 0) {
     proofPath = resolve2(process.cwd(), explicit);
@@ -2404,7 +2527,7 @@ async function runProof(args) {
     try {
       const { runOfflineProofStandalone: runOfflineProofStandalone2 } = await Promise.resolve().then(() => (init_proof_offline(), proof_offline_exports));
       const { cloudBase: cloudBase2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
-      return await runOfflineProofStandalone2(proofPath, cloudBase2());
+      return await runOfflineProofStandalone2(proofPath, cloudBase2(), domain);
     } catch (e) {
       return refuse(`${e.message ?? e}`);
     }
@@ -2561,6 +2684,44 @@ ${commandHelp("replay")}`);
     }
     return replay(target, { ...opts, ...step !== void 0 ? { step } : {}, ...json ? { json: true } : {} });
   }
+  if (argv[0] === "decrypt") {
+    const rest = argv.slice(1);
+    const pull = (flag) => {
+      const at = rest.indexOf(flag);
+      return at >= 0 ? rest[at + 1] : void 0;
+    };
+    const as = pull("--as"), secret = pull("--secret"), q = pull("--query");
+    const json = rest.includes("--json");
+    const params = {};
+    rest.forEach((a, i) => {
+      if (a === "--param" && rest[i + 1]) {
+        const [k, ...v] = rest[i + 1].split("=");
+        params[k] = v.join("=");
+      }
+    });
+    const consumed = /* @__PURE__ */ new Set();
+    rest.forEach((a, i) => {
+      if (["--as", "--secret", "--query", "--param"].includes(a)) {
+        consumed.add(i);
+        consumed.add(i + 1);
+      } else if (a === "--json") consumed.add(i);
+    });
+    const cleaned = rest.filter((_, i) => !consumed.has(i));
+    const { pos, opts, bad } = cloudArgs(cleaned);
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${commandHelp("decrypt") ?? ""}`);
+      return 1;
+    }
+    const ws = pos[0];
+    if (ws === void 0 || as === void 0 || secret === void 0 || q === void 0) {
+      process.stderr.write(`error: usage: githolon decrypt <ws> --as <principal> --secret <b64> --query <id> [--param k=v ...]
+`);
+      return 1;
+    }
+    return decrypt(ws, { ...opts, as, secret, query: q, params, ...json ? { json: true } : {} });
+  }
   if (argv[0] === "status") {
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
@@ -2633,8 +2794,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err9) {
-    process.stderr.write(`error: ${err9.message}
+  } catch (err10) {
+    process.stderr.write(`error: ${err10.message}
 
 ${USAGE}`);
     return 1;
@@ -2653,8 +2814,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path}
 `);
     return 0;
-  } catch (err9) {
-    process.stderr.write(`error: ${err9.message}
+  } catch (err10) {
+    process.stderr.write(`error: ${err10.message}
 `);
     return 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/dsl": "^0.5.0",
+    "@githolon/dsl": "^0.6.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {