githolon 0.51.0 → 0.53.0

package/dist/cli.mjs

@@ -1195,6 +1195,179 @@ var init_cloud = __esm({
   }
 });
 
+// src/editor.ts
+var editor_exports = {};
+__export(editor_exports, {
+  INIT_EDITOR_HINT: () => INIT_EDITOR_HINT,
+  NOMOS_LAW_EXTENSION_ID: () => NOMOS_LAW_EXTENSION_ID,
+  hasEditorRecommendation: () => hasEditorRecommendation,
+  initEditor: () => initEditor,
+  writeEditorRecommendation: () => writeEditorRecommendation
+});
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname, join as join3 } from "node:path";
+function hasEditorRecommendation(cwd) {
+  const p = join3(cwd, ".vscode", "extensions.json");
+  if (!existsSync3(p)) return false;
+  try {
+    const json = JSON.parse(readFileSync4(p, "utf8"));
+    return Array.isArray(json.recommendations) && json.recommendations.includes(NOMOS_LAW_EXTENSION_ID);
+  } catch {
+    return true;
+  }
+}
+function writeEditorRecommendation(cwd) {
+  const dir = join3(cwd, ".vscode");
+  const path = join3(dir, "extensions.json");
+  let json = {};
+  let existed = false;
+  if (existsSync3(path)) {
+    existed = true;
+    try {
+      const parsed = JSON.parse(readFileSync4(path, "utf8"));
+      if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+        json = parsed;
+      } else {
+        throw new Error("extensions.json is not a JSON object");
+      }
+    } catch (e) {
+      throw new Error(
+        `${path} exists but could not be parsed as JSON (${e.message}) \u2014 fix or remove it, then rerun`
+      );
+    }
+  }
+  const recs = Array.isArray(json.recommendations) ? [...json.recommendations] : [];
+  if (recs.includes(NOMOS_LAW_EXTENSION_ID)) {
+    return { path, action: "unchanged" };
+  }
+  recs.push(NOMOS_LAW_EXTENSION_ID);
+  json.recommendations = recs;
+  mkdirSync3(dirname(path), { recursive: true });
+  writeFileSync4(path, JSON.stringify(json, null, 2) + "\n", "utf8");
+  return { path, action: existed ? "updated" : "created" };
+}
+function initEditor(cwd = process.cwd()) {
+  let res;
+  try {
+    res = writeEditorRecommendation(cwd);
+  } catch (e) {
+    process.stderr.write(`error: ${e.message}
+`);
+    return 1;
+  }
+  if (res.action === "unchanged") {
+    process.stdout.write(`${res.path} already recommends the Nomos Law extension \u2014 nothing to do
+`);
+  } else {
+    process.stdout.write(
+      `${res.action} ${res.path} \u2014 VS Code will now suggest the Nomos Law extension when this project is opened
+(install it from the marketplace, or search "Nomos Law"; it surfaces \`githolon check\` as you type)
+`
+    );
+  }
+  return 0;
+}
+var NOMOS_LAW_EXTENSION_ID, INIT_EDITOR_HINT;
+var init_editor = __esm({
+  "src/editor.ts"() {
+    "use strict";
+    NOMOS_LAW_EXTENSION_ID = "captain-app.nomos-law";
+    INIT_EDITOR_HINT = "tip: the Nomos Law VS Code extension gives you these checks as you type \u2014 npx githolon init-editor";
+  }
+});
+
+// src/compile.ts
+import { spawn, spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { dirname as dirname2, join as join4 } from "node:path";
+import { pathToFileURL } from "node:url";
+function resolveCompileLauncher(cwd) {
+  const resolveDslPkg = (fromDir) => {
+    try {
+      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join4(fromDir, "noop.js")));
+      return req.resolve("@githolon/dsl/package.json");
+    } catch {
+      return void 0;
+    }
+  };
+  const dslPkg = resolveDslPkg(cwd) ?? resolveDslPkg(void 0);
+  return dslPkg === void 0 ? void 0 : join4(dirname2(dslPkg), "compile_package.mjs");
+}
+function runCompile(args) {
+  const launcher = resolveCompileLauncher(process.cwd());
+  if (launcher === void 0) {
+    process.stderr.write(`error: ${NO_DSL_REMEDY}
+`);
+    return 1;
+  }
+  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  const status2 = r.status ?? 1;
+  if (status2 === 0 && process.stdout.isTTY) {
+    try {
+      if (!hasEditorRecommendation(process.cwd())) process.stdout.write(`
+${INIT_EDITOR_HINT}
+`);
+    } catch {
+    }
+  }
+  return status2;
+}
+function resolveCheckLauncher(cwd) {
+  const launcher = resolveCompileLauncher(cwd);
+  return launcher === void 0 ? void 0 : join4(dirname2(launcher), "check_package.mjs");
+}
+function runCheck(args) {
+  const launcher = resolveCheckLauncher(process.cwd());
+  if (launcher === void 0) {
+    process.stderr.write(`error: ${NO_DSL_REMEDY}
+`);
+    return 1;
+  }
+  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  return r.status ?? 1;
+}
+function resolveLspLauncher(cwd) {
+  const launcher = resolveCompileLauncher(cwd);
+  return launcher === void 0 ? void 0 : join4(dirname2(launcher), "lsp_server.mjs");
+}
+function runLsp(args) {
+  const launcher = resolveLspLauncher(process.cwd());
+  if (launcher === void 0) {
+    process.stderr.write(`error: ${NO_DSL_REMEDY}
+`);
+    return 1;
+  }
+  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
+  return r.status ?? 1;
+}
+function compileAsync(cwd, args = []) {
+  const launcher = resolveCompileLauncher(cwd);
+  const t0 = performance.now();
+  if (launcher === void 0) {
+    return Promise.resolve({ ok: false, ms: 0, output: NO_DSL_REMEDY });
+  }
+  return new Promise((resolveRun) => {
+    const chunks = [];
+    const dec4 = new TextDecoder();
+    const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => chunks.push(dec4.decode(c)));
+    child.stderr?.on("data", (c) => chunks.push(dec4.decode(c)));
+    child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
+    child.on(
+      "close",
+      (code) => resolveRun({ ok: code === 0, ms: performance.now() - t0, output: chunks.join("") })
+    );
+  });
+}
+var NO_DSL_REMEDY;
+var init_compile = __esm({
+  "src/compile.ts"() {
+    "use strict";
+    init_editor();
+    NO_DSL_REMEDY = "@githolon/dsl not found \u2014 add it to your project's dependencies";
+  }
+});
+
 // vendor/engine/git-fs.mjs
 function fsErr(code, p) {
   const e = new Error(`${code}: ${p}`);
@@ -1210,7 +1383,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
     const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
     return rel === "" ? [] : rel.split("/");
   }
-  function resolve4(ps) {
+  function resolve5(ps) {
     let cur = root;
     for (const part of ps) {
       if (!isDir(cur)) return null;
@@ -1220,11 +1393,11 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
     }
     return cur;
   }
-  const parent = (ps) => resolve4(ps.slice(0, -1));
+  const parent = (ps) => resolve5(ps.slice(0, -1));
   const leaf = (ps) => ps[ps.length - 1];
   const promises = {
     async readFile(p, opts) {
-      const n = resolve4(parts(p));
+      const n = resolve5(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (isDir(n)) throw fsErr("EISDIR", p);
       const data = n.data ?? new Uint8Array(0);
@@ -1243,7 +1416,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
       if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
     },
     async readdir(p) {
-      const n = resolve4(parts(p));
+      const n = resolve5(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       if (!isDir(n)) throw fsErr("ENOTDIR", p);
       return [...n.contents.keys()];
@@ -1263,7 +1436,7 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
       return promises.lstat(p);
     },
     async lstat(p) {
-      const n = resolve4(parts(p));
+      const n = resolve5(parts(p));
       if (n === null) throw fsErr("ENOENT", p);
       const dir = isDir(n);
       return {
@@ -1776,59 +1949,59 @@ var init_engine = __esm({
 
 // src/local_holon.ts
 import { randomBytes } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname2, join as join4 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
 import { File as File2, Directory as Directory2 } from "@bjorn3/browser_wasi_shim";
 async function fetchJsonCached(url, cacheFile) {
   try {
     const r = await fetch(url);
     if (!r.ok) throw new Error(`${url} \u2192 ${r.status}`);
     const text = await r.text();
-    mkdirSync3(dirname2(cacheFile), { recursive: true });
-    writeFileSync4(cacheFile, text, "utf8");
+    mkdirSync4(dirname3(cacheFile), { recursive: true });
+    writeFileSync5(cacheFile, text, "utf8");
     return JSON.parse(text);
   } catch (e) {
-    if (existsSync3(cacheFile)) return JSON.parse(readFileSync4(cacheFile, "utf8"));
+    if (existsSync4(cacheFile)) return JSON.parse(readFileSync5(cacheFile, "utf8"));
     throw e;
   }
 }
 async function fetchRuntime(cloud) {
-  const cache = join4(configDir(), "runtime");
+  const cache = join5(configDir(), "runtime");
   let wasmBytes;
-  const wasmCache = join4(cache, "holon.wasm");
+  const wasmCache = join5(cache, "holon.wasm");
   const localWasm = process.env["NOMOS_LOCAL_WASM"];
   if (localWasm) {
-    const bytes = readFileSync4(localWasm);
-    const packages2 = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join4(cache, "packages.json"));
+    const bytes = readFileSync5(localWasm);
+    const packages2 = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join5(cache, "packages.json"));
     return { wasmBytes: bytes, packages: packages2 };
   }
   try {
     const r = await fetch(`${cloud}/v1/runtime/holon.wasm`);
     if (!r.ok) throw new Error(`runtime wasm \u2192 ${r.status}`);
     wasmBytes = new Uint8Array(await r.arrayBuffer());
-    mkdirSync3(cache, { recursive: true });
-    writeFileSync4(wasmCache, wasmBytes);
+    mkdirSync4(cache, { recursive: true });
+    writeFileSync5(wasmCache, wasmBytes);
   } catch (e) {
-    if (!existsSync3(wasmCache)) throw e;
-    wasmBytes = readFileSync4(wasmCache);
+    if (!existsSync4(wasmCache)) throw e;
+    wasmBytes = readFileSync5(wasmCache);
   }
-  const packages = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join4(cache, "packages.json"));
+  const packages = await fetchJsonCached(`${cloud}/v1/runtime/packages`, join5(cache, "packages.json"));
   return { wasmBytes, packages };
 }
 function writeTreeToDisk(dir, diskPath) {
-  mkdirSync3(diskPath, { recursive: true });
+  mkdirSync4(diskPath, { recursive: true });
   for (const [name, inode] of dir.contents) {
-    const p = join4(diskPath, name);
+    const p = join5(diskPath, name);
     if (inode.contents instanceof Map) writeTreeToDisk(inode, p);
-    else writeFileSync4(p, inode.data ?? new Uint8Array(0));
+    else writeFileSync5(p, inode.data ?? new Uint8Array(0));
   }
 }
 function readTreeFromDisk(diskPath) {
   const contents = /* @__PURE__ */ new Map();
   for (const name of readdirSync2(diskPath)) {
-    const p = join4(diskPath, name);
+    const p = join5(diskPath, name);
     if (statSync(p).isDirectory()) contents.set(name, readTreeFromDisk(p));
-    else contents.set(name, new File2(readFileSync4(p)));
+    else contents.set(name, new File2(readFileSync5(p)));
   }
   return new Directory2(contents);
 }
@@ -1886,8 +2059,8 @@ __export(proof_offline_exports, {
   runOfflineProofStandalone: () => runOfflineProofStandalone,
   runRelationBootstrapLeg: () => runRelationBootstrapLeg
 });
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import { basename, dirname as dirname3, join as join6 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { basename, dirname as dirname4, join as join7 } from "node:path";
 function parseOfflineLegs(proofSource) {
   if (!proofSource.includes("AUTO-GENERATED by nomos-compile")) {
     throw new Error("not a generated proof (missing the AUTO-GENERATED header) \u2014 run `githolon compile` to (re)generate build/<name>.proof.mts");
@@ -2252,16 +2425,16 @@ function actorFromPayload(payload, field) {
   return typeof value === "string" && value.trim().length > 0 ? value : void 0;
 }
 async function runOfflineProofStandalone(proofPath, cloud, domain) {
-  const src = readFileSync5(proofPath, "utf8");
+  const src = readFileSync6(proofPath, "utf8");
   const packageName = basename(proofPath).replace(/\.proof\.mts$/, "");
-  const deployFile = join6(dirname3(proofPath), `${packageName}.deploy.json`);
-  if (!existsSync5(deployFile)) {
+  const deployFile = join7(dirname4(proofPath), `${packageName}.deploy.json`);
+  if (!existsSync6(deployFile)) {
     throw new Error(`missing ${deployFile} \u2014 run \`githolon compile\` (the proof and the deploy body are built together)`);
   }
   let legs;
-  const legsFile = join6(dirname3(proofPath), `${packageName}.proof-legs.json`);
-  if (existsSync5(legsFile)) {
-    const index = JSON.parse(readFileSync5(legsFile, "utf8"));
+  const legsFile = join7(dirname4(proofPath), `${packageName}.proof-legs.json`);
+  if (existsSync6(legsFile)) {
+    const index = JSON.parse(readFileSync6(legsFile, "utf8"));
     const keys = Object.keys(index.domains);
     const chosen = domain ?? index.default;
     if (index.domains[chosen] === void 0) {
@@ -2279,7 +2452,7 @@ async function runOfflineProofStandalone(proofPath, cloud, domain) {
     if (domain !== void 0) throw new Error(`--domain needs a per-domain legs index (build/${packageName}.proof-legs.json) \u2014 recompile with \`githolon compile\` to emit it`);
     legs = parseOfflineLegs(src);
   }
-  const deployBody = JSON.parse(readFileSync5(deployFile, "utf8"));
+  const deployBody = JSON.parse(readFileSync6(deployFile, "utf8"));
   const lawHash = await sha256hex(deployBody.packageUsda);
   console.log(`githolon proof \u2014 OFFLINE legs on a local holon (the cloud loop: githolon proof --live)`);
   const { eng } = await holonEngine(cloud, deployBody, "githolon-proof");
@@ -2306,27 +2479,295 @@ var init_proof_offline = __esm({
   }
 });
 
+// src/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  callTool: () => callTool,
+  extractDispositions: () => extractDispositions,
+  handleRequest: () => handleRequest,
+  runMcpServer: () => runMcpServer,
+  summarize: () => summarize,
+  toolCheck: () => toolCheck,
+  toolEvolvePreview: () => toolEvolvePreview
+});
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync10 } from "node:fs";
+import { dirname as dirname6, isAbsolute, resolve as resolve2 } from "node:path";
+function resolveConfig(config) {
+  const arg = config ?? "nomos.package.mjs";
+  const configPath = isAbsolute(arg) ? arg : resolve2(process.cwd(), arg);
+  return { configPath, cfgDir: dirname6(configPath) };
+}
+function runCheckLauncher(configPath, extraArgs) {
+  const cfgDir = dirname6(configPath);
+  const launcher = resolveCheckLauncher(cfgDir) ?? resolveCheckLauncher(process.cwd());
+  if (launcher === void 0) {
+    return { findings: [], stdout: "", stderr: "", status: 1, error: NO_DSL_REMEDY };
+  }
+  const r = spawnSync4(process.execPath, [launcher, configPath, ...extraArgs], {
+    cwd: cfgDir,
+    encoding: "utf8"
+  });
+  return {
+    findings: [],
+    stdout: r.stdout ?? "",
+    stderr: r.stderr ?? "",
+    status: r.status ?? 1
+  };
+}
+function runCheckJson(configPath, extraArgs) {
+  const base = runCheckLauncher(configPath, [...extraArgs, "--json"]);
+  if (base.error !== void 0) return base;
+  const line = base.stdout.trim().split("\n").filter(Boolean).pop() ?? "";
+  let findings;
+  try {
+    const parsed = JSON.parse(line);
+    if (!Array.isArray(parsed)) throw new Error("not an array");
+    findings = parsed;
+  } catch (e) {
+    return {
+      ...base,
+      error: `could not parse check --json output: ${e.message}
+${base.stdout}${base.stderr}`
+    };
+  }
+  return { ...base, findings };
+}
+function summarize(findings) {
+  const n = { refuse: 0, warn: 0, note: 0 };
+  for (const f of findings) n[f.level]++;
+  if (findings.length === 0) return "githolon check: all clear \u2014 no static twin flagged anything.";
+  const head = `githolon check: ${findings.length} finding(s) \u2014 ${n.refuse} refuse, ${n.warn} warn, ${n.note} note.`;
+  const lines = findings.map((f) => {
+    const where = f.file !== void 0 ? ` (${f.file}:${f.line ?? 1})` : "";
+    const who = f.directiveId !== void 0 ? `${f.domain}/${f.directiveId}` : f.domain;
+    return `  ${f.level.toUpperCase()} ${who}${where}: ${f.what} \u2014 fix: ${f.fix}`;
+  });
+  return [head, ...lines].join("\n");
+}
+function extractDispositions(humanReport) {
+  const marker = "add `dispositions` to the domain's deploy JSON:";
+  const at = humanReport.indexOf(marker);
+  if (at < 0) return void 0;
+  const rest = humanReport.slice(at + marker.length);
+  const start = rest.indexOf("{");
+  if (start < 0) return void 0;
+  let depth = 0;
+  for (let i = start; i < rest.length; i++) {
+    if (rest[i] === "{") depth++;
+    else if (rest[i] === "}") {
+      depth--;
+      if (depth === 0) {
+        try {
+          return JSON.parse(rest.slice(start, i + 1));
+        } catch {
+          return void 0;
+        }
+      }
+    }
+  }
+  return void 0;
+}
+function toolCheck(args) {
+  const { configPath } = resolveConfig(args.config);
+  if (!existsSync10(configPath)) {
+    return { text: `nomos_check: config not found: ${configPath}`, isError: true };
+  }
+  const extra = args.against !== void 0 ? ["--against", args.against] : [];
+  const run = runCheckJson(configPath, extra);
+  if (run.error !== void 0) {
+    return { text: `nomos_check: ${run.error}${run.stderr ? `
+${run.stderr}` : ""}`, isError: true };
+  }
+  const summary = summarize(run.findings);
+  const payload = { summary, findings: run.findings };
+  return { text: `${summary}
+
+${JSON.stringify(payload, null, 2)}`, isError: false };
+}
+function toolEvolvePreview(args) {
+  const { configPath } = resolveConfig(args.config);
+  if (!existsSync10(configPath)) {
+    return { text: `nomos_evolve_preview: config not found: ${configPath}`, isError: true };
+  }
+  const againstPath = isAbsolute(args.against) ? args.against : resolve2(dirname6(configPath), args.against);
+  const priorArg = existsSync10(againstPath) ? againstPath : args.against;
+  const jsonRun = runCheckJson(configPath, ["--against", priorArg]);
+  if (jsonRun.error !== void 0) {
+    return {
+      text: `nomos_evolve_preview: ${jsonRun.error}${jsonRun.stderr ? `
+${jsonRun.stderr}` : ""}`,
+      isError: true
+    };
+  }
+  const humanRun = runCheckLauncher(configPath, ["--against", priorArg]);
+  const dispositions = extractDispositions(humanRun.stdout);
+  const summary = summarize(jsonRun.findings);
+  const dispLine = dispositions !== void 0 ? "A DESTRUCTIVE evolve was detected. Add this `dispositions` block to the domain's deploy JSON before deploying:" : "No destructive evolve \u2014 the diff admits without dispositions.";
+  const payload = { summary, findings: jsonRun.findings, dispositions: dispositions ?? null };
+  return {
+    text: `${summary}
+
+${dispLine}
+
+${JSON.stringify(payload, null, 2)}`,
+    isError: false
+  };
+}
+function callTool(name, argsIn) {
+  const a = argsIn ?? {};
+  const config = typeof a.config === "string" ? a.config : void 0;
+  if (name === "nomos_check") {
+    return toolCheck({
+      ...config !== void 0 ? { config } : {},
+      ...typeof a.against === "string" ? { against: a.against } : {}
+    });
+  }
+  if (name === "nomos_evolve_preview") {
+    if (typeof a.against !== "string" || a.against.length === 0) {
+      return { text: "nomos_evolve_preview: `against` is required (a prior deploy.json / lockfile).", isError: true };
+    }
+    return toolEvolvePreview({ against: a.against, ...config !== void 0 ? { config } : {} });
+  }
+  return { text: `unknown tool: ${name}`, isError: true };
+}
+function handleRequest(req) {
+  const reply = (result) => ({ jsonrpc: "2.0", id: req.id ?? null, result });
+  const fail = (code, message) => ({
+    jsonrpc: "2.0",
+    id: req.id ?? null,
+    error: { code, message }
+  });
+  switch (req.method) {
+    case "initialize": {
+      const clientVersion = req.params?.protocolVersion;
+      return reply({
+        protocolVersion: clientVersion ?? PROTOCOL_VERSION,
+        capabilities: { tools: {} },
+        serverInfo: { name: SERVER_NAME, version: SERVER_VERSION }
+      });
+    }
+    case "notifications/initialized":
+    case "initialized":
+      return void 0;
+    // notification — no response
+    case "ping":
+      return reply({});
+    case "tools/list":
+      return reply({ tools: TOOLS });
+    case "tools/call": {
+      const p = req.params ?? {};
+      if (typeof p.name !== "string") return fail(-32602, "tools/call requires a string `name`");
+      const res = callTool(p.name, p.arguments);
+      return reply({ content: [{ type: "text", text: res.text }], isError: res.isError });
+    }
+    default:
+      if (req.id === void 0 || req.id === null) return void 0;
+      return fail(-32601, `method not found: ${req.method}`);
+  }
+}
+function runMcpServer() {
+  return new Promise((resolveRun) => {
+    let buf = "";
+    const write = (obj) => {
+      process.stdout.write(JSON.stringify(obj) + "\n");
+    };
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      buf += chunk;
+      let nl;
+      while ((nl = buf.indexOf("\n")) >= 0) {
+        const line = buf.slice(0, nl).trim();
+        buf = buf.slice(nl + 1);
+        if (line.length === 0) continue;
+        let req;
+        try {
+          req = JSON.parse(line);
+        } catch {
+          write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } });
+          continue;
+        }
+        try {
+          const res = handleRequest(req);
+          if (res !== void 0) write(res);
+        } catch (e) {
+          write({ jsonrpc: "2.0", id: req.id ?? null, error: { code: -32603, message: e.message } });
+        }
+      }
+    });
+    process.stdin.on("end", () => resolveRun(0));
+    process.stdin.on("close", () => resolveRun(0));
+  });
+}
+var SERVER_NAME, SERVER_VERSION, PROTOCOL_VERSION, TOOLS;
+var init_mcp = __esm({
+  "src/mcp.ts"() {
+    "use strict";
+    init_compile();
+    SERVER_NAME = "nomos";
+    SERVER_VERSION = "0.1.0";
+    PROTOCOL_VERSION = "2024-11-05";
+    TOOLS = [
+      {
+        name: "nomos_check",
+        description: "Run the Nomos author-time gate (githolon check static twins) over a nomos.package.mjs and return the findings (refuse/warn/note) plus a human summary. Optionally diff against a prior deployed law for evolve-safety. Call before compiling or deploying domain law.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            config: {
+              type: "string",
+              description: "Path to nomos.package.mjs (default: ./nomos.package.mjs, relative to the server working dir)."
+            },
+            against: {
+              type: "string",
+              description: "Optional prior law to diff evolve-safety against: a build/<name>.deploy.json, a build/ dir, or a nomos.stable-ids.json lockfile."
+            }
+          }
+        }
+      },
+      {
+        name: "nomos_evolve_preview",
+        description: "Preview a Nomos LAW EVOLUTION: diff the current build against a prior deployed law and return the evolve findings plus the pasteable `dispositions` block a destructive change (removal/retype) requires. Call before deploying a change to already-deployed law.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            against: {
+              type: "string",
+              description: "REQUIRED prior law: a build/<name>.deploy.json, a build/ dir, or a nomos.stable-ids.json lockfile."
+            },
+            config: {
+              type: "string",
+              description: "Path to nomos.package.mjs (default: ./nomos.package.mjs)."
+            }
+          },
+          required: ["against"]
+        }
+      }
+    ];
+  }
+});
+
 // src/harness.ts
 var harness_exports = {};
 __export(harness_exports, {
   harnessInstall: () => harnessInstall
 });
-import { existsSync as existsSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join12 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 async function harnessInstall(opts) {
   const { deploy: deployPaths, workspace, out: outPath } = opts;
   if (deployPaths.length === 0) die("no --deploy JSON path(s) given");
-  const runtimeDir = opts.runtime || process.env["NOMOS_OFFLINE_RUNTIME"] || join10(configDir(), "runtime");
-  const wasmFile = join10(runtimeDir, "holon.wasm");
-  const pkgsFile = join10(runtimeDir, "packages.json");
-  if (!existsSync9(wasmFile) || !existsSync9(pkgsFile)) {
+  const runtimeDir = opts.runtime || process.env["NOMOS_OFFLINE_RUNTIME"] || join12(configDir(), "runtime");
+  const wasmFile = join12(runtimeDir, "holon.wasm");
+  const pkgsFile = join12(runtimeDir, "packages.json");
+  if (!existsSync11(wasmFile) || !existsSync11(pkgsFile)) {
     die(
       `runtime cache missing at ${runtimeDir} (holon.wasm + packages.json). Warm it once with a \`githolon\` run (it fetches + caches the runtime), then re-run offline.`
     );
   }
-  const wasm = readFileSync11(wasmFile);
-  const pkgs = JSON.parse(readFileSync11(pkgsFile, "utf8"));
+  const wasm = readFileSync12(wasmFile);
+  const pkgs = JSON.parse(readFileSync12(pkgsFile, "utf8"));
   const replica = BigInt(`0x${randomBytes3(8).toString("hex")}`) & (1n << 63n) - 1n;
   const eng = await createEngine({
     wasmModule: await WebAssembly.compile(wasm),
@@ -2339,8 +2780,8 @@ async function harnessInstall(opts) {
   author(eng, workspace, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, "nomos-test-harness"), "");
   const lawHashes = [];
   for (const p of deployPaths) {
-    if (!existsSync9(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
-    const deploy2 = JSON.parse(readFileSync11(p, "utf8"));
+    if (!existsSync11(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
+    const deploy2 = JSON.parse(readFileSync12(p, "utf8"));
     const usda = deploy2.packageUsda;
     if (typeof usda !== "string" || !usda.startsWith("#usda")) die(`${p} has no #usda packageUsda`);
     const lawHash = await sha256hex(usda);
@@ -2352,7 +2793,7 @@ async function harnessInstall(opts) {
   const wsNode = eng.preopen.dir.contents.get("ws").contents.get(workspace);
   if (!wsNode) die(`internal: workspace tree '${workspace}' not found after install`);
   const treeBytes = serializeTree(wsNode);
-  writeFileSync6(outPath, treeBytes);
+  writeFileSync7(outPath, treeBytes);
   process.stderr.write(`harness-install: snapshot written (${treeBytes.length} bytes) \u2192 ${outPath}
 `);
   process.stdout.write(JSON.stringify({ ok: true, snapshot: outPath, workspace, lawHashes }) + "\n");
@@ -3430,8 +3871,8 @@ var scene_exports = {};
 __export(scene_exports, {
   scene: () => scene
 });
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join11, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join13, resolve as resolve3 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 import git3 from "isomorphic-git";
 async function walkChain2(eng, ws) {
@@ -3452,8 +3893,8 @@ async function projectOnce(cloud, target, isDir, name) {
   const { eng } = await holonEngine(cloud, void 0, "githolon-scene");
   const SOURCE3 = "source";
   if (isDir) {
-    const gitDir = existsSync10(join11(target, ".git")) ? join11(target, ".git") : target;
-    if (!existsSync10(join11(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
+    const gitDir = existsSync12(join13(target, ".git")) ? join13(target, ".git") : target;
+    if (!existsSync12(join13(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
     await mountFresh(eng, SOURCE3);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE3).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
@@ -3512,9 +3953,9 @@ async function projectOnce(cloud, target, isDir, name) {
 }
 async function scene(target, opts) {
   const cloud = cloudBase(opts.cloud);
-  const isDir = existsSync10(target) || target.includes("/") || target.startsWith(".");
-  const name = isDir ? (resolve2(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
-  out11(`scene \u2014 ${name} (${isDir ? resolve2(target) : `${cloud} :: ${target}`})`);
+  const isDir = existsSync12(target) || target.includes("/") || target.startsWith(".");
+  const name = isDir ? (resolve3(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
+  out11(`scene \u2014 ${name} (${isDir ? resolve3(target) : `${cloud} :: ${target}`})`);
   let first, second;
   try {
     first = await projectOnce(cloud, target, isDir, name);
@@ -3532,13 +3973,13 @@ async function scene(target, opts) {
     err11(`the emitted stage violates the portable profile: ${violations.join("; ")}`);
     return 1;
   }
-  const outDir = resolve2(opts.out ?? join11("scene", name));
-  mkdirSync4(outDir, { recursive: true });
-  const usdaPath = join11(outDir, `${name}.usda`);
-  const usdzPath = join11(outDir, `${name}.usdz`);
+  const outDir = resolve3(opts.out ?? join13("scene", name));
+  mkdirSync5(outDir, { recursive: true });
+  const usdaPath = join13(outDir, `${name}.usda`);
+  const usdzPath = join13(outDir, `${name}.usdz`);
   const usdaBytes = new TextEncoder().encode(first.usda);
-  writeFileSync7(usdaPath, usdaBytes);
-  writeFileSync7(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));
+  writeFileSync8(usdaPath, usdaBytes);
+  writeFileSync8(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));
   const s = first.stats;
   out11(`  verify_chain ${s.verdictLine}`);
   out11(`  law canopy   ${s.nodes} node(s), ${s.edges} edge(s) \u2014 from the chain's own installed packages`);
@@ -3564,10 +4005,10 @@ var init_scene = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync12 } from "node:fs";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname5, join as join12, resolve as resolve3 } from "node:path";
+import { dirname as dirname7, join as join14, resolve as resolve4 } from "node:path";
 import { pathToFileURL as pathToFileURL4 } from "node:url";
 
 // src/generate.ts
@@ -3750,86 +4191,26 @@ Re-run with --force to replace it.`
 
 // src/cli.ts
 init_cloud();
-
-// src/compile.ts
-import { spawn, spawnSync } from "node:child_process";
-import { createRequire } from "node:module";
-import { dirname, join as join3 } from "node:path";
-import { pathToFileURL } from "node:url";
-function resolveCompileLauncher(cwd) {
-  const resolveDslPkg = (fromDir) => {
-    try {
-      const req = fromDir === void 0 ? createRequire(import.meta.url) : createRequire(pathToFileURL(join3(fromDir, "noop.js")));
-      return req.resolve("@githolon/dsl/package.json");
-    } catch {
-      return void 0;
-    }
-  };
-  const dslPkg = resolveDslPkg(cwd) ?? resolveDslPkg(void 0);
-  return dslPkg === void 0 ? void 0 : join3(dirname(dslPkg), "compile_package.mjs");
-}
-var NO_DSL_REMEDY = "@githolon/dsl not found \u2014 add it to your project's dependencies";
-function runCompile(args) {
-  const launcher = resolveCompileLauncher(process.cwd());
-  if (launcher === void 0) {
-    process.stderr.write(`error: ${NO_DSL_REMEDY}
-`);
-    return 1;
-  }
-  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
-  return r.status ?? 1;
-}
-function resolveCheckLauncher(cwd) {
-  const launcher = resolveCompileLauncher(cwd);
-  return launcher === void 0 ? void 0 : join3(dirname(launcher), "check_package.mjs");
-}
-function runCheck(args) {
-  const launcher = resolveCheckLauncher(process.cwd());
-  if (launcher === void 0) {
-    process.stderr.write(`error: ${NO_DSL_REMEDY}
-`);
-    return 1;
-  }
-  const r = spawnSync(process.execPath, [launcher, ...args], { stdio: "inherit", cwd: process.cwd() });
-  return r.status ?? 1;
-}
-function compileAsync(cwd, args = []) {
-  const launcher = resolveCompileLauncher(cwd);
-  const t0 = performance.now();
-  if (launcher === void 0) {
-    return Promise.resolve({ ok: false, ms: 0, output: NO_DSL_REMEDY });
-  }
-  return new Promise((resolveRun) => {
-    const chunks = [];
-    const dec4 = new TextDecoder();
-    const child = spawn(process.execPath, [launcher, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    child.stdout?.on("data", (c) => chunks.push(dec4.decode(c)));
-    child.stderr?.on("data", (c) => chunks.push(dec4.decode(c)));
-    child.on("error", (e) => resolveRun({ ok: false, ms: performance.now() - t0, output: String(e) }));
-    child.on(
-      "close",
-      (code) => resolveRun({ ok: code === 0, ms: performance.now() - t0, output: chunks.join("") })
-    );
-  });
-}
+init_compile();
 
 // src/dev.ts
 init_engine();
 init_cloud();
-import { existsSync as existsSync6, readFileSync as readFileSync6, watch } from "node:fs";
+init_compile();
+init_local_holon();
+import { existsSync as existsSync7, readFileSync as readFileSync7, watch } from "node:fs";
 import { createServer } from "node:http";
-import { dirname as dirname4, join as join7, resolve } from "node:path";
+import { dirname as dirname5, join as join8, resolve } from "node:path";
 import { pathToFileURL as pathToFileURL3 } from "node:url";
-init_local_holon();
 
 // src/project.ts
-import { existsSync as existsSync4, statSync as statSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
+import { join as join6 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 var CONFIG_FILE = "nomos.package.mjs";
 async function loadProject(cwd, opts = {}) {
-  const configPath = join5(cwd, CONFIG_FILE);
-  if (!existsSync4(configPath)) return void 0;
+  const configPath = join6(cwd, CONFIG_FILE);
+  if (!existsSync5(configPath)) return void 0;
   const href = pathToFileURL2(configPath).href + (opts.bust === true ? `?v=${statSync2(configPath).mtimeMs}-${Date.now()}` : "");
   const mod = await import(href);
   const cfg = mod.default;
@@ -3994,11 +4375,11 @@ function startServer(s) {
   });
 }
 function readDeployBody2(cwd, packageName) {
-  const file = join7(cwd, "build", `${packageName}.deploy.json`);
-  if (!existsSync6(file)) {
+  const file = join8(cwd, "build", `${packageName}.deploy.json`);
+  if (!existsSync7(file)) {
     throw new Error(`compile produced no ${file} \u2014 check the compile output above`);
   }
-  return JSON.parse(readFileSync6(file, "utf8"));
+  return JSON.parse(readFileSync7(file, "utf8"));
 }
 async function installLaw(s, deployBody, installedBy) {
   const newHash = await sha256hex(deployBody.packageUsda);
@@ -4014,11 +4395,11 @@ async function installLaw(s, deployBody, installedBy) {
   return { ok: true };
 }
 async function runProofCycle(s, cwd, deployBody, installedBy) {
-  const proofPath = join7(cwd, "build", `${s.packageName}.proof.mts`);
-  if (!existsSync6(proofPath)) return void 0;
+  const proofPath = join8(cwd, "build", `${s.packageName}.proof.mts`);
+  if (!existsSync7(proofPath)) return void 0;
   const scratch = `proof-${s.cycle}`;
   try {
-    const legs = parseOfflineLegs(readFileSync6(proofPath, "utf8"));
+    const legs = parseOfflineLegs(readFileSync7(proofPath, "utf8"));
     await mountFresh(s.eng, scratch);
     author(s.eng, scratch, "bootstrap", "installDomain", installPayload(s.eng.hashes.nomos, s.eng.nomosPkg, installedBy), "");
     author(s.eng, scratch, "nomos", "installDomain", installPayload(s.lawHash, deployBody.packageUsda, installedBy), s.eng.hashes.nomos);
@@ -4037,7 +4418,7 @@ async function dev(opts) {
     return void 0;
   });
   if (project === void 0) {
-    if (!existsSync6(join7(cwd, CONFIG_FILE))) {
+    if (!existsSync7(join8(cwd, CONFIG_FILE))) {
       err5(`no ${CONFIG_FILE} here (${cwd}) \u2014 \`githolon dev\` runs inside a project; scaffold one from examples/guestbook or \`githolon generate domain <name>\``);
     }
     return 1;
@@ -4104,12 +4485,12 @@ ${firstCompile.output}`);
   try {
     const cfgModule = await import(pathToFileURL3(project.configPath).href);
     for (const d of cfgModule.default?.domains ?? []) {
-      for (const m of d.modules ?? []) moduleDirs.add(dirname4(resolve(cwd, m)));
+      for (const m of d.modules ?? []) moduleDirs.add(dirname5(resolve(cwd, m)));
     }
   } catch {
-    moduleDirs.add(join7(cwd, "domains"));
+    moduleDirs.add(join8(cwd, "domains"));
   }
-  if (moduleDirs.size === 0) moduleDirs.add(join7(cwd, "domains"));
+  if (moduleDirs.size === 0) moduleDirs.add(join8(cwd, "domains"));
   let timer;
   let cycling = false;
   let queued = false;
@@ -4159,7 +4540,7 @@ ${run.output}`);
   };
   const watchers = [];
   for (const d of moduleDirs) {
-    if (!existsSync6(d)) continue;
+    if (!existsSync7(d)) continue;
     watchers.push(watch(d, { recursive: true }, (_evt, f) => onChange(f)));
     s.watchRoots.push(d.startsWith(cwd) ? d.slice(cwd.length + 1) + "/" : d);
   }
@@ -4186,7 +4567,7 @@ ${run.output}`);
 init_cloud();
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 var out6 = (s) => void process.stdout.write(s + "\n");
 var err6 = (s) => void process.stderr.write("error: " + s + "\n");
 function git(args, opts = {}) {
@@ -4215,7 +4596,7 @@ function workspaceFromPath(path) {
 }
 async function gitCredential(action) {
   if (action !== "get") return 0;
-  const kv = parseCredentialInput(readFileSync7(0, "utf8"));
+  const kv = parseCredentialInput(readFileSync8(0, "utf8"));
   const ws = workspaceFromPath(kv["path"]);
   if (kv["protocol"] !== "https" || ws === void 0) return 0;
   const cloud = `https://${kv["host"]}`;
@@ -4503,14 +4884,14 @@ init_engine();
 init_cloud();
 init_local_holon();
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join9 } from "node:path";
 var out7 = (s) => void process.stdout.write(s + "\n");
 var err7 = (s) => void process.stderr.write("error: " + s + "\n");
 var WS2 = "local";
 async function ledgerInit(dir, opts) {
   const cloud = cloudBase(opts.cloud);
-  if (existsSync7(dir) && readdirSync3(dir).length > 0) {
+  if (existsSync8(dir) && readdirSync3(dir).length > 0) {
     err7(`refusing to mint into non-empty directory: ${dir}`);
     return 1;
   }
@@ -4521,7 +4902,7 @@ async function ledgerInit(dir, opts) {
     err7(e.message);
     return 1;
   }
-  const deployBody = JSON.parse(readFileSync8(deployFile, "utf8"));
+  const deployBody = JSON.parse(readFileSync9(deployFile, "utf8"));
   const domainHash = await sha256hex(deployBody.packageUsda);
   const c = loadCreds();
   const principal = await sessionToken().catch(() => void 0) !== void 0 ? c.session.uid : c.principal;
@@ -4537,10 +4918,10 @@ async function ledgerInit(dir, opts) {
   const verdict = verifyChainLocal(eng, WS2);
   if (!printVerdict(verdict)) return 1;
   const gitTree = eng.preopen.dir.contents.get("ws").contents.get(WS2).contents.get("nomos.git");
-  const gitDir = join8(dir, ".git");
+  const gitDir = join9(dir, ".git");
   writeTreeToDisk(gitTree, gitDir);
-  const cfgPath = join8(gitDir, "config");
-  writeFileSync5(cfgPath, readFileSync8(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
+  const cfgPath = join9(gitDir, "config");
+  writeFileSync6(cfgPath, readFileSync9(cfgPath, "utf8").replace(/bare = true/, "bare = false"), "utf8");
   spawnSync3("git", ["-C", dir, "reset", "--hard", "main"], { stdio: "ignore" });
   out7(`\u2713 holon written \u2192 ${dir} (a normal git repo; git log IS the audit trail)`);
   out7(`
@@ -4549,8 +4930,8 @@ Birth it on Nomos Cloud (the cloud re-derives this exact verdict):`);
   return 0;
 }
 async function ledgerVerify(dir, opts) {
-  const gitDir = existsSync7(join8(dir, ".git")) ? join8(dir, ".git") : dir;
-  if (!existsSync7(join8(gitDir, "HEAD"))) {
+  const gitDir = existsSync8(join9(dir, ".git")) ? join9(dir, ".git") : dir;
+  if (!existsSync8(join9(gitDir, "HEAD"))) {
     err7(`${dir} is not a git repo (no HEAD)`);
     return 1;
   }
@@ -4566,8 +4947,8 @@ init_engine();
 init_engine();
 init_cloud();
 init_local_holon();
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join10 } from "node:path";
 import git2 from "isomorphic-git";
 var out8 = (s) => void process.stdout.write(s + "\n");
 var err8 = (s) => void process.stderr.write("error: " + s + "\n");
@@ -4663,10 +5044,10 @@ async function replay(target, opts) {
   the runtime rides ${cloud}/v1/runtime/* (cached in ~/.holon/runtime after one fetch)`);
     return 1;
   }
-  const isDir = existsSync8(target) || target.includes("/") || target.startsWith(".");
+  const isDir = existsSync9(target) || target.includes("/") || target.startsWith(".");
   if (isDir) {
-    const gitDir = existsSync8(join9(target, ".git")) ? join9(target, ".git") : target;
-    if (!existsSync8(join9(gitDir, "HEAD"))) {
+    const gitDir = existsSync9(join10(target, ".git")) ? join10(target, ".git") : target;
+    if (!existsSync9(join10(gitDir, "HEAD"))) {
       err8(`${target} is not a git repo (no HEAD) \u2014 pass a holon directory (githolon ledger init <dir>) or a workspace name`);
       return 1;
     }
@@ -4830,7 +5211,7 @@ async function decrypt(ws, opts) {
 init_engine();
 init_cloud();
 init_lifecycle();
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 var out10 = (s) => void process.stdout.write(s + "\n");
 var err10 = (s) => void process.stderr.write("error: " + s + "\n");
 function lawDiffVerdict(localHash, installed, ws, hasCurrencyData) {
@@ -4885,7 +5266,7 @@ async function status(wsArg, opts) {
   }
   let localHash;
   try {
-    const body = JSON.parse(readFileSync10(discoverDeployJson(process.cwd(), opts.file), "utf8"));
+    const body = JSON.parse(readFileSync11(discoverDeployJson(process.cwd(), opts.file), "utf8"));
     if (typeof body.packageUsda === "string") localHash = await sha256hex(body.packageUsda);
   } catch {
     localHash = void 0;
@@ -4948,10 +5329,19 @@ The inner loop:
             --query <id> [--param k=v]                   keys from the chain, read private fields in cleartext
 
 Authoring:
-  githolon check    [config]                              run the author-time gate (static twins) on
+  githolon check    [config] [--json] [--against <p>]     run the author-time gate (static twins) on
                                                        ./nomos.package.mjs \u2014 the unified report; exits
-                                                       non-zero on any REFUSE (compile runs it implicitly)
+                                                       non-zero on any REFUSE (compile runs it implicitly).
+                                                       --json emits the findings (with file:line) as an array
+  githolon lsp                                            the author-time gate as a stdio Language Server:
+                                                       red squiggles while you write law (VS Code/Neovim/\u2026)
+  githolon mcp                                            the author-time gate as a stdio MCP server for AI
+                                                       agents (Codex/Claude): tools nomos_check +
+                                                       nomos_evolve_preview. Setup: codex mcp add nomos -- githolon mcp
   githolon compile  [compiler args]                       compile the package by ./nomos.package.mjs
+  githolon init-editor                                     write .vscode/extensions.json recommending the
+                                                       Nomos Law extension \u2014 the check gate as red
+                                                       squiggles while you type (idempotent)
   githolon proof    [build/<name>.proof.mts]              run the proof GENERATED from your law, live
                                                        (every compile emits it; ALL GREEN or it names the jam)
   githolon harness-install --deploy <deploy.json[,...]>  offline install for the headless TEST HARNESS:
@@ -5136,11 +5526,11 @@ async function runProof(args) {
   const explicit = args.find((a, i) => !a.startsWith("--") && i !== domainValueIdx);
   let proofPath;
   if (explicit !== void 0) {
-    proofPath = resolve3(process.cwd(), explicit);
-    if (!existsSync11(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    proofPath = resolve4(process.cwd(), explicit);
+    if (!existsSync13(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
-    const buildDir = join12(process.cwd(), "build");
-    if (!existsSync11(buildDir)) {
+    const buildDir = join14(process.cwd(), "build");
+    if (!existsSync13(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
     const proofs = readdirSync4(buildDir).filter((f) => f.endsWith(".proof.mts"));
@@ -5150,7 +5540,7 @@ async function runProof(args) {
     if (proofs.length > 1) {
       return refuse(`found ${proofs.length} proofs (${proofs.join(", ")}) \u2014 name one: githolon proof build/<name>.proof.mts`);
     }
-    proofPath = join12(buildDir, proofs[0]);
+    proofPath = join14(buildDir, proofs[0]);
   }
   if (!live) {
     try {
@@ -5163,17 +5553,17 @@ async function runProof(args) {
   }
   const resolvePkgDir = (name, fromDir) => {
     try {
-      return dirname5(createRequire2(pathToFileURL4(join12(fromDir, "noop.js"))).resolve(`${name}/package.json`));
+      return dirname7(createRequire2(pathToFileURL4(join14(fromDir, "noop.js"))).resolve(`${name}/package.json`));
     } catch {
       return void 0;
     }
   };
   const dslDir = (() => {
     try {
-      return dirname5(createRequire2(pathToFileURL4(join12(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
+      return dirname7(createRequire2(pathToFileURL4(join14(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
     } catch {
       try {
-        return dirname5(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
+        return dirname7(createRequire2(import.meta.url).resolve("@githolon/dsl/package.json"));
       } catch {
         return void 0;
       }
@@ -5183,9 +5573,9 @@ async function runProof(args) {
   if (tsxDir === void 0) {
     return refuse("tsx not found \u2014 add @githolon/dsl to your project's dependencies (tsx rides along) and npm install");
   }
-  const tsxPkg = JSON.parse(readFileSync12(join12(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync13(join14(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
-  const tsxCli = join12(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+  const tsxCli = join14(tsxDir, tsxBinRel ?? "dist/cli.mjs");
   console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
   const { wsCreate: wsCreate2, wsRetire: wsRetire2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
   const { resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
@@ -5214,7 +5604,7 @@ async function runProof(args) {
       );
     }
   }
-  const r = spawnSync4(process.execPath, [tsxCli, proofPath], {
+  const r = spawnSync5(process.execPath, [tsxCli, proofPath], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: {
@@ -5243,7 +5633,7 @@ function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== "generate" && command !== "g") {
     throw new Error(
-      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | proof | replay | scene | status | generate | ws | deploy | domains | secret.`
+      `Unknown command '${command ?? "(none)"}'. Expected dev | compile | check | lsp | mcp | init-editor | proof | replay | scene | status | generate | ws | deploy | domains | secret.`
     );
   }
   let outDir = DEFAULT_OUT;
@@ -5296,6 +5686,17 @@ async function main(argv) {
   if (argv[0] === "check") {
     return runCheck(argv.slice(1));
   }
+  if (argv[0] === "lsp") {
+    return runLsp(argv.slice(1));
+  }
+  if (argv[0] === "mcp") {
+    const { runMcpServer: runMcpServer2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
+    return runMcpServer2();
+  }
+  if (argv[0] === "init-editor") {
+    const { initEditor: initEditor2 } = await Promise.resolve().then(() => (init_editor(), editor_exports));
+    return initEditor2(process.cwd());
+  }
   if (argv[0] === "proof") {
     return runProof(argv.slice(1));
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.51.0",
+  "version": "0.53.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.51.0",
-    "@githolon/dsl": "^0.51.0",
+    "@githolon/client": "^0.53.0",
+    "@githolon/dsl": "^0.53.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {