githolon 0.77.1 → 0.78.0

package/dist/cli.mjs

@@ -3012,6 +3012,7 @@ __export(governance_exports, {
   buildRebirthPlan: () => buildRebirthPlan,
   certifyEra: () => certifyEra,
   consentRebirth: () => consentRebirth,
+  discoverSigningDomain: () => discoverSigningDomain,
   executeRepairRebirth: () => executeRepairRebirth,
   governanceOffer: () => governanceOffer,
   governanceRelay: () => governanceRelay,
@@ -3044,6 +3045,33 @@ async function clientConnect() {
   const mod = await import("@githolon/client");
   return mod.connect;
 }
+async function discoverSigningDomain(holon, parent, directiveId, explicit) {
+  if (explicit !== void 0 && explicit !== "") return explicit;
+  try {
+    const offer = typeof holon.interfaceOffer === "function" ? await holon.interfaceOffer() : null;
+    const declaring = [];
+    for (const [domain, iface] of Object.entries(offer ?? {})) {
+      if (iface?.directives !== void 0 && Object.prototype.hasOwnProperty.call(iface.directives, directiveId)) declaring.push(domain);
+    }
+    if (declaring.length === 1) return declaring[0];
+    if (declaring.length > 1) {
+      throw new Error(
+        `'${directiveId}' is declared by ${declaring.length} installed domains on ${parent} (${declaring.join(", ")}) \u2014 pass --domain <one of them>`
+      );
+    }
+  } catch (e) {
+    if (/pass --domain/.test(e.message)) throw e;
+  }
+  if (typeof holon.discoverDirectiveDomain === "function") {
+    try {
+      const r = await holon.discoverDirectiveDomain({ ws: parent, directiveId });
+      return r.domain;
+    } catch (e) {
+      throw new Error(`${e.message} (override with --domain <d> [--directive <id>])`);
+    }
+  }
+  return "workspaces";
+}
 async function connectGovernance(cloud, parent) {
   const authToken = await sessionToken().catch(() => void 0);
   const clientId = `githolon-cli-${Date.now().toString(16)}`;
@@ -3307,20 +3335,29 @@ async function keyEnroll(opts) {
     err2(`could not connect to ${parent} on ${cloud} to enroll: ${e.message}`);
     return 1;
   }
+  const directiveId = opts.directive ?? "enrollSigner";
+  let domain;
+  try {
+    domain = await discoverSigningDomain(holon, parent, directiveId, opts.domain);
+  } catch (e) {
+    err2(`could not resolve the signing directive on ${parent}: ${e.message}`);
+    return 1;
+  }
   const device = await ensureDeviceKey(holon, principal);
   const enrollPayload = await holon.enrollSignerPayload({ principal, publicKey: device.public });
   const sealed = await holon.signGovernanceOffer({
-    directiveId: "enrollSigner",
+    domain,
+    directiveId,
     payload: enrollPayload,
     authorSecret: device.secret,
     actor: `user:${principal}`
   });
-  const v = await holon.postGovernanceOffer({ directiveId: "enrollSigner", intentBytes: sealed.intentBytes, ws: parent });
+  const v = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws: parent });
   if (!v.ok) {
-    err2(`enrollSigner refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    err2(`${domain}/${directiveId} refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
     return 1;
   }
-  out2(`\u2713 device key enrolled for ${principal} at ${parent} on ${cloud}`);
+  out2(`\u2713 device key enrolled for ${principal} at ${parent} on ${cloud} (via ${domain}/${directiveId})`);
   out2(`  keyHash ${device.keyHash.slice(0, 16)}\u2026 (secret stays local; signed governance is now warranted)`);
   return 0;
 }
@@ -3727,6 +3764,28 @@ async function buildRebirthPlan(cloud, ws, reason) {
     }
   } catch {
   }
+  const signerTuplesRaw = [];
+  try {
+    const rows2 = query2(eng, ws, "aggregatesByType", JSON.stringify({ __type: "RelationTuple" }));
+    for (const r of rows2) {
+      const data = r?.data ?? {};
+      if (data.relation !== "signer" || typeof data.object !== "string" || !data.object.startsWith("identity:")) continue;
+      const principal = data.object.slice("identity:".length);
+      for (const [subject, leafRaw] of Object.entries(data.subjects ?? {})) {
+        if (!subject.startsWith("key:")) continue;
+        let status2 = leafRaw;
+        if (typeof leafRaw === "string") {
+          try {
+            status2 = JSON.parse(leafRaw).status;
+          } catch {
+            status2 = leafRaw;
+          }
+        } else if (leafRaw !== null && typeof leafRaw === "object") status2 = leafRaw.status;
+        signerTuplesRaw.push({ principal, keyHash: subject.slice(4), status: status2 === "revoked" ? "revoked" : "active" });
+      }
+    }
+  } catch {
+  }
   let compaction = { carried: null, parked: null, scarShape: "unknown" };
   let parkedAllLawInstalls = false;
   try {
@@ -3793,6 +3852,12 @@ async function buildRebirthPlan(cloud, ws, reason) {
     compaction,
     repairs,
     posture: { posture, consent: consentState },
+    ...signerTuplesRaw.length > 0 ? {
+      signerEnrollments: signerTuplesRaw.map((t) => ({
+        ...t,
+        recovery: mode === "state-seed" ? "re-enroll-required" : "carried-by-replay"
+      }))
+    } : {},
     clientImpact: CLIENT_IMPACT,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -3849,6 +3914,23 @@ function renderRebirthImpact(plan, ledgerCommits) {
     L.push("  \u2192 preserved by lineage continuity; their birth-cert chains stay valid (same founding key + self-id).");
   }
   L.push("");
+  const se = plan.signerEnrollments ?? [];
+  L.push(`SIGNER ENROLLMENTS (${se.length})`);
+  if (se.length === 0) L.push("  (none on this chain \u2014 no device\u2192principal bindings to recover)");
+  else {
+    for (const s of se) {
+      L.push(`  \u2022 identity:${s.principal}#signer @ key:${s.keyHash.slice(0, 16)}\u2026   [${s.status}] \u2192 ${s.recovery}`);
+    }
+    if (se.some((s) => s.recovery === "re-enroll-required")) {
+      L.push("  \u2192 a state-seed re-genesis does NOT carry these tuples: every device that authors against this");
+      L.push("    workspace (e.g. for sibling births) must be lawfully re-enrolled AFTER the rebirth \u2014 client");
+      L.push("    ensureParentSignerEnrollment / NomosScope.home's reopen repair / `githolon key enroll --parent <ws>`.");
+    } else {
+      L.push("  \u2192 replay-compact re-folds the enrolling intents; a PARKED enrolling intent would still strand its");
+      L.push("    binding until re-admitted \u2014 verify with the parked list, or re-enroll idempotently (a no-op when live).");
+    }
+  }
+  L.push("");
   L.push(`REPAIRS (${plan.repairs.length})`);
   if (plan.repairs.length === 0) L.push("  (none matched \u2014 a plain compaction; no corrective verb declared for this refusal)");
   else {
@@ -8283,6 +8365,8 @@ var HELP = {
       ["--sha256", "import: derive the seed as sha256(--secret) (a passphrase/preimage)"],
       ["--format <f>", "import: force hex|base64 interpretation (default: auto-detect)"],
       ["--parent <ws>", "enroll: the governance workspace to enroll at (default root)"],
+      ["--domain <d>", "enroll: the domain declaring the signing directive (default: DISCOVERED from the parent's installed law \u2014 never assume 'workspaces')"],
+      ["--directive <id>", "enroll: the signing directive id (default enrollSigner)"],
       ["--yes", "export: confirm printing the secret to stdout"]
     ],
     examples: [
@@ -8930,7 +9014,7 @@ Identity (~/.holon/credentials.json \u2014 sessions auto-refresh):
   githolon use [<uid>] [--clear]                          set/show/clear the ACTIVE signing principal: the one
                                                        deploy/gov/grant/key author as (--as overrides per-cmd)
   githolon logout                                         clear the session (workspace secrets kept)
-  githolon key enroll [--principal <uid>] [--parent <ws>] mint a signing device key + enroll it on-chain
+  githolon key enroll [--principal <uid>] [--parent <ws>] [--domain <d>] [--directive <id>] mint a signing device key + enroll it on-chain (the signing directive is DISCOVERED from the parent's installed law; the flags override)
                                                        (secret stays local; warrants SIGNED governance)
   githolon key import --principal <uid> --secret <key>    bring an EXISTING admin key into ~/.holon (accepts
                                                        hex / base64 seed, or --sha256 <passphrase>)
@@ -8997,7 +9081,7 @@ Options:
 function cloudArgs(rest) {
   const pos = [];
   const opts = {};
-  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--controller-hash", "--plan", "--depth"];
+  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--controller-hash", "--plan", "--depth", "--domain", "--directive"];
   const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear", "--keep-beside", "--retire-replaced", "--explain-current-interface", "--dry-run", "--json", "--full"];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
@@ -9027,6 +9111,8 @@ function cloudArgs(rest) {
       else if (a === "--save") opts.save = v;
       else if (a === "--format") opts.format = v;
       else if (a === "--with") opts.with = v;
+      else if (a === "--domain") opts.domain = v;
+      else if (a === "--directive") opts.directive = v;
       else if (a === "--out") opts.out = v;
       else if (a === "--max") {
         const n = Number(v);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.77.1",
+  "version": "0.78.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.77.1",
-    "@githolon/dsl": "^0.77.1",
+    "@githolon/client": "^0.78.0",
+    "@githolon/dsl": "^0.78.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {