githolon 0.5.1 → 0.6.0

package/dist/cli.mjs

@@ -460,13 +460,13 @@ async function sha256hex(t) {
 function osEntropyBuffer(n) {
   const bytes = new Uint8Array(n * 8);
   for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out9 = new Array(n), T = 2 ** 53;
+  const out10 = new Array(n), T = 2 ** 53;
   for (let i = 0; i < n; i++) {
     let z = 0n;
     for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out9[i] = Number(z >> 11n) / T;
+    out10[i] = Number(z >> 11n) / T;
   }
-  return out9;
+  return out10;
 }
 function stringifyBig(o) {
   return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
@@ -599,7 +599,7 @@ function applyIntentBytes(eng, ws, bytes) {
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "verify_chain", { repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH }, eng.STDERR));
 }
-var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, count, sum;
+var enc2, dec2, BRANCH, repoArgOf, gitdirOf, unpack, installPayload, qById, query, cryptoUnwrapKey, count, sum;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
@@ -615,8 +615,9 @@ var init_engine = __esm({
       return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
     };
     installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, authorityScope: "workspace/root", dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
-    qById = (eng, ws, id) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, branch: BRANCH }, eng.STDERR));
-    query = (eng, ws, queryId, paramsJson) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, branch: BRANCH }, eng.STDERR));
+    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query_by_id", { repoArg: repoArgOf(ws), workspace: ws, aggregateId: id, principal, keys, branch: BRANCH }, eng.STDERR));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryId, paramsJson, principal, keys, branch: BRANCH }, eng.STDERR));
+    cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
     count = (eng, ws, countId, groupKey) => JSON.parse(call(eng.ex, "count", { repoArg: repoArgOf(ws), workspace: ws, countId, groupKey, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey) => JSON.parse(call(eng.ex, "sum", { repoArg: repoArgOf(ws), workspace: ws, sumId, groupKey, branch: BRANCH }, eng.STDERR));
   }
@@ -644,6 +645,13 @@ async function fetchRuntime(cloud) {
   const cache = join4(configDir(), "runtime");
   let wasmBytes;
   const wasmCache = join4(cache, "holon.wasm");
+  const localWasm = process.env["NOMOS_LOCAL_WASM"];
+  if (localWasm) {
+    const bytes = readFileSync2(localWasm);
+    const manifests2 = await fetchJsonCached(`${cloud}/v1/runtime/manifests`, join4(cache, "manifests.json"));
+    const packages2 = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join4(cache, "packages.json"));
+    return { wasmBytes: bytes, manifests: manifests2, packages: packages2 };
+  }
   try {
     const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
     if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
@@ -1997,9 +2005,9 @@ function capJsonStrings(v, max = 2048) {
   if (typeof v === "string") return v.length > max ? `${v.slice(0, max)}\u2026(${v.length} chars)` : v;
   if (Array.isArray(v)) return v.map((x) => capJsonStrings(x, max));
   if (typeof v === "object" && v !== null) {
-    const out9 = {};
-    for (const [k, x] of Object.entries(v)) out9[k] = capJsonStrings(x, max);
-    return out9;
+    const out10 = {};
+    for (const [k, x] of Object.entries(v)) out10[k] = capJsonStrings(x, max);
+    return out10;
   }
   return v;
 }
@@ -2161,12 +2169,76 @@ stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below cover
   return printVerdict(verdict) ? 0 : 1;
 }
 
+// src/decrypt.ts
+init_local_holon();
+init_cloud();
+init_engine();
+var SOURCE2 = "source";
+var out8 = (s) => {
+  process.stdout.write(s + "\n");
+};
+var err8 = (s) => {
+  process.stderr.write(`error: ${s}
+`);
+};
+async function decrypt(ws, opts) {
+  const cloud = cloudBase(opts.cloud);
+  if (!opts.as) {
+    err8("--as <principal> is required (who to decrypt as)");
+    return 1;
+  }
+  if (!opts.secret) {
+    err8("--secret <base64 X25519 device secret> is required");
+    return 1;
+  }
+  if (!opts.query) {
+    err8("--query <queryId> is required (the read to decrypt)");
+    return 1;
+  }
+  let eng;
+  try {
+    ({ eng } = await holonEngine(cloud, opts.overlay, "githolon-decrypt"));
+  } catch (e) {
+    err8(`cannot boot the local holon: ${String(e.message ?? e)}`);
+    return 1;
+  }
+  const m = await mountWorkspace(eng, SOURCE2, {
+    remote: `${cloud}/v1/workspaces/${ws}/git`,
+    headers: { "x-nomos-principal": opts.as }
+  });
+  if (m.restored !== true) {
+    err8(`workspace '${ws}' has no main on ${cloud}, or its clone was refused for '${opts.as}'` + (m.restoreError ? ` (${String(m.restoreError).split(" | ")[0]})` : ""));
+    return 1;
+  }
+  const wraps = query(eng, SOURCE2, "wrappedKeysByRecipient", JSON.stringify({ recipientPrincipal: opts.as }), opts.as);
+  const keys = [];
+  if (Array.isArray(wraps)) {
+    for (const w of wraps) {
+      const d = w.data ?? {};
+      try {
+        const key = cryptoUnwrapKey(eng, { secret: opts.secret, hpkeEpk: d.hpkeEpk, ct: d.ct });
+        keys.push({ scope: d.scope, epoch: Number(d.epoch), key });
+      } catch {
+      }
+    }
+  }
+  if (opts.json !== true) out8(`# resolved ${keys.length} scope key(s) for '${opts.as}': ${keys.map((k) => `${k.scope}@${k.epoch}`).join(", ") || "(none)"}`);
+  const rows = query(eng, SOURCE2, opts.query, JSON.stringify(opts.params ?? {}), opts.as, keys);
+  if (rows && !Array.isArray(rows) && rows.ok === false) {
+    err8(`the read was refused: ${rows.error}` + (String(rows.error).startsWith("read-forbidden") ? `
+  '${opts.as}' is not granted this scope's read capability` : ""));
+    return 1;
+  }
+  out8(JSON.stringify(rows, null, opts.json === true ? 0 : 2));
+  return 0;
+}
+
 // src/status.ts
 init_engine();
 init_cloud();
 import { readFileSync as readFileSync8 } from "node:fs";
-var out8 = (s) => void process.stdout.write(s + "\n");
-var err8 = (s) => void process.stderr.write("error: " + s + "\n");
+var out9 = (s) => void process.stdout.write(s + "\n");
+var err9 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws) {
   const active = installed.filter((d) => d.phase === "Active" && typeof d.domainHash === "string");
   const currents = active.filter((d) => d.current === true);
@@ -2204,7 +2276,7 @@ async function status(wsArg, opts) {
   try {
     ws = await resolveWorkspace(wsArg, process.cwd(), opts.target, "githolon status <ws>");
   } catch (e) {
-    err8(e.message);
+    err9(e.message);
     return 1;
   }
   let localHash;
@@ -2216,35 +2288,35 @@ async function status(wsArg, opts) {
   }
   const r = await fetch(`${cloud}/v1/workspaces/${ws}/domains`).catch(() => void 0);
   if (r === void 0) {
-    err8(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
+    err9(`cannot reach ${cloud} \u2014 githolon status compares against the DEPLOYED law and needs the cloud (local-only: githolon dev)`);
     return 1;
   }
   const d = await r.json().catch(() => void 0);
   if (!r.ok || d?.ok !== true) {
-    err8(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
+    err9(`status '${ws}' failed (${r.status}): ${d ? JSON.stringify(d) : "no body"}
   is the workspace born? githolon ws create ${ws}`);
     return 1;
   }
-  out8(`workspace  ${ws} on ${cloud}`);
+  out9(`workspace  ${ws} on ${cloud}`);
   const allDomains = d.domains ?? [];
   const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
   const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
   const controllerCount = allDomains.length - domains.length;
-  if (allDomains.length === 0) out8(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  if (allDomains.length === 0) out9(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
   for (const dom of domains) {
     const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
-    out8(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
+    out9(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
   }
-  if (controllerCount > 0) out8(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  if (controllerCount > 0) out9(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
   const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
-  if (tenantActive > 1) out8(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
+  if (tenantActive > 1) out9(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
   if (localHash === void 0) {
-    out8(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
+    out9(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;
   }
-  out8(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
+  out9(`local      ${localHash.slice(0, 16)}\u2026  (build/*.deploy.json)`);
   const verdict = lawDiffVerdict(localHash, domains, ws);
-  for (const line of verdict.lines) out8(line);
+  for (const line of verdict.lines) out9(line);
   return verdict.inSync ? 0 : 2;
 }
 
@@ -2260,6 +2332,8 @@ The inner loop:
   githolon status [<ws>]                                  local law hash vs the DEPLOYED law, remedy named
   githolon replay <ws|dir>                                the ledger as film: step the chain intent-by-
                                                        intent; finale = the verify_chain verdict
+  githolon decrypt <ws> --as <p> --secret <b64>          clone + decrypt as a principal: unwrap their scope
+            --query <id> [--param k=v]                   keys from the chain, read private fields in cleartext
 
 Authoring:
   githolon compile  [compiler args]                       compile the package by ./nomos.package.mjs
@@ -2610,6 +2684,44 @@ ${commandHelp("replay")}`);
     }
     return replay(target, { ...opts, ...step !== void 0 ? { step } : {}, ...json ? { json: true } : {} });
   }
+  if (argv[0] === "decrypt") {
+    const rest = argv.slice(1);
+    const pull = (flag) => {
+      const at = rest.indexOf(flag);
+      return at >= 0 ? rest[at + 1] : void 0;
+    };
+    const as = pull("--as"), secret = pull("--secret"), q = pull("--query");
+    const json = rest.includes("--json");
+    const params = {};
+    rest.forEach((a, i) => {
+      if (a === "--param" && rest[i + 1]) {
+        const [k, ...v] = rest[i + 1].split("=");
+        params[k] = v.join("=");
+      }
+    });
+    const consumed = /* @__PURE__ */ new Set();
+    rest.forEach((a, i) => {
+      if (["--as", "--secret", "--query", "--param"].includes(a)) {
+        consumed.add(i);
+        consumed.add(i + 1);
+      } else if (a === "--json") consumed.add(i);
+    });
+    const cleaned = rest.filter((_, i) => !consumed.has(i));
+    const { pos, opts, bad } = cloudArgs(cleaned);
+    if (bad !== void 0) {
+      process.stderr.write(`error: ${bad}
+
+${commandHelp("decrypt") ?? ""}`);
+      return 1;
+    }
+    const ws = pos[0];
+    if (ws === void 0 || as === void 0 || secret === void 0 || q === void 0) {
+      process.stderr.write(`error: usage: githolon decrypt <ws> --as <principal> --secret <b64> --query <id> [--param k=v ...]
+`);
+      return 1;
+    }
+    return decrypt(ws, { ...opts, as, secret, query: q, params, ...json ? { json: true } : {} });
+  }
   if (argv[0] === "status") {
     const { pos, opts, bad } = cloudArgs(argv.slice(1));
     if (bad !== void 0) {
@@ -2682,8 +2794,8 @@ ${USAGE}`);
   let parsed;
   try {
     parsed = parseArgs(argv);
-  } catch (err9) {
-    process.stderr.write(`error: ${err9.message}
+  } catch (err10) {
+    process.stderr.write(`error: ${err10.message}
 
 ${USAGE}`);
     return 1;
@@ -2702,8 +2814,8 @@ ${USAGE}`);
     process.stdout.write(`created ${path}
 `);
     return 0;
-  } catch (err9) {
-    process.stderr.write(`error: ${err9.message}
+  } catch (err10) {
+    process.stderr.write(`error: ${err10.message}
 `);
     return 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/dsl": "^0.5.1",
+    "@githolon/dsl": "^0.6.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {