githolon 0.77.1 → 0.79.0

package/dist/cli.mjs

@@ -3010,8 +3010,10 @@ __export(governance_exports, {
   STAGE_THRESHOLD_CHARS: () => STAGE_THRESHOLD_CHARS,
   buildCertificate: () => buildCertificate,
   buildRebirthPlan: () => buildRebirthPlan,
+  canonicalPrincipal: () => canonicalPrincipal,
   certifyEra: () => certifyEra,
   consentRebirth: () => consentRebirth,
+  discoverSigningDomain: () => discoverSigningDomain,
   executeRepairRebirth: () => executeRepairRebirth,
   governanceOffer: () => governanceOffer,
   governanceRelay: () => governanceRelay,
@@ -3044,6 +3046,33 @@ async function clientConnect() {
   const mod = await import("@githolon/client");
   return mod.connect;
 }
+async function discoverSigningDomain(holon, parent, directiveId, explicit) {
+  if (explicit !== void 0 && explicit !== "") return explicit;
+  try {
+    const offer = typeof holon.interfaceOffer === "function" ? await holon.interfaceOffer() : null;
+    const declaring = [];
+    for (const [domain, iface] of Object.entries(offer ?? {})) {
+      if (iface?.directives !== void 0 && Object.prototype.hasOwnProperty.call(iface.directives, directiveId)) declaring.push(domain);
+    }
+    if (declaring.length === 1) return declaring[0];
+    if (declaring.length > 1) {
+      throw new Error(
+        `'${directiveId}' is declared by ${declaring.length} installed domains on ${parent} (${declaring.join(", ")}) \u2014 pass --domain <one of them>`
+      );
+    }
+  } catch (e) {
+    if (/pass --domain/.test(e.message)) throw e;
+  }
+  if (typeof holon.discoverDirectiveDomain === "function") {
+    try {
+      const r = await holon.discoverDirectiveDomain({ ws: parent, directiveId });
+      return r.domain;
+    } catch (e) {
+      throw new Error(`${e.message} (override with --domain <d> [--directive <id>])`);
+    }
+  }
+  return "workspaces";
+}
 async function connectGovernance(cloud, parent) {
   const authToken = await sessionToken().catch(() => void 0);
   const clientId = `githolon-cli-${Date.now().toString(16)}`;
@@ -3076,17 +3105,23 @@ function resolveGovernancePrincipal(opts) {
   }
   return principal;
 }
+function canonicalPrincipal(principal) {
+  const s = String(principal ?? "").trim();
+  if (s === "") return "";
+  return s.includes(":") ? s : `user:${s}`;
+}
 async function signAndPostOffer(ws, domain, directiveId, payload, opts) {
   const cloud = cloudBase(opts.cloud);
   const principal = resolveGovernancePrincipal(opts);
   const holon = await connectGovernance(cloud, ws);
+  const resolvedDomain = domain ?? await discoverSigningDomain(holon, ws, directiveId, void 0);
   const device = await ensureDeviceKey(holon, principal);
   const sealed = await holon.signGovernanceOffer({
-    domain,
+    domain: resolvedDomain,
     directiveId,
     payload,
     authorSecret: device.secret,
-    actor: `user:${principal}`
+    actor: canonicalPrincipal(principal)
   });
   if (sealed.intentBytes.length > STAGE_THRESHOLD_CHARS) {
     const staged = await relaySealedOfferViaStage(cloud, ws, directiveId, sealed.intentBytes, fetch);
@@ -3124,7 +3159,7 @@ async function relaySealedOfferViaStage(cloud, ws, directiveId, intentBytesB64,
   return { sha256: sha2562, size: raw.length, verdict: { ok: r.ok, status: r.status, body } };
 }
 async function signAndPostGovernance(parent, directiveId, payload, opts) {
-  return signAndPostOffer(parent, "workspaces", directiveId, payload, opts);
+  return signAndPostOffer(parent, opts.domain, directiveId, payload, opts);
 }
 async function grantOrRevoke(verb, kind, subject, opts) {
   const parent = opts.parent ?? "root";
@@ -3307,20 +3342,29 @@ async function keyEnroll(opts) {
     err2(`could not connect to ${parent} on ${cloud} to enroll: ${e.message}`);
     return 1;
   }
+  const directiveId = opts.directive ?? "enrollSigner";
+  let domain;
+  try {
+    domain = await discoverSigningDomain(holon, parent, directiveId, opts.domain);
+  } catch (e) {
+    err2(`could not resolve the signing directive on ${parent}: ${e.message}`);
+    return 1;
+  }
   const device = await ensureDeviceKey(holon, principal);
   const enrollPayload = await holon.enrollSignerPayload({ principal, publicKey: device.public });
   const sealed = await holon.signGovernanceOffer({
-    directiveId: "enrollSigner",
+    domain,
+    directiveId,
     payload: enrollPayload,
     authorSecret: device.secret,
-    actor: `user:${principal}`
+    actor: canonicalPrincipal(principal)
   });
-  const v = await holon.postGovernanceOffer({ directiveId: "enrollSigner", intentBytes: sealed.intentBytes, ws: parent });
+  const v = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws: parent });
   if (!v.ok) {
-    err2(`enrollSigner refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
+    err2(`${domain}/${directiveId} refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
     return 1;
   }
-  out2(`\u2713 device key enrolled for ${principal} at ${parent} on ${cloud}`);
+  out2(`\u2713 device key enrolled for ${principal} at ${parent} on ${cloud} (via ${domain}/${directiveId})`);
   out2(`  keyHash ${device.keyHash.slice(0, 16)}\u2026 (secret stays local; signed governance is now warranted)`);
   return 0;
 }
@@ -3444,8 +3488,9 @@ async function governanceOffer(ws, directiveId, opts) {
   if (opts.save !== void 0) {
     try {
       const holon = await connectGovernance(cloudBase(opts.cloud), ws);
+      const domain = await discoverSigningDomain(holon, ws, directiveId, opts.domain);
       const device = await ensureDeviceKey(holon, principal);
-      const sealed = await holon.signGovernanceOffer({ directiveId, payload, authorSecret: device.secret, actor: `user:${principal}` });
+      const sealed = await holon.signGovernanceOffer({ domain, directiveId, payload, authorSecret: device.secret, actor: canonicalPrincipal(principal) });
       writeFileSync4(opts.save, JSON.stringify({ ws, directiveId, principal, intentBytes: sealed.intentBytes }, null, 2) + "\n");
     } catch (e) {
       err2(e.message);
@@ -3727,6 +3772,28 @@ async function buildRebirthPlan(cloud, ws, reason) {
     }
   } catch {
   }
+  const signerTuplesRaw = [];
+  try {
+    const rows2 = query2(eng, ws, "aggregatesByType", JSON.stringify({ __type: "RelationTuple" }));
+    for (const r of rows2) {
+      const data = r?.data ?? {};
+      if (data.relation !== "signer" || typeof data.object !== "string" || !data.object.startsWith("identity:")) continue;
+      const principal = data.object.slice("identity:".length);
+      for (const [subject, leafRaw] of Object.entries(data.subjects ?? {})) {
+        if (!subject.startsWith("key:")) continue;
+        let status2 = leafRaw;
+        if (typeof leafRaw === "string") {
+          try {
+            status2 = JSON.parse(leafRaw).status;
+          } catch {
+            status2 = leafRaw;
+          }
+        } else if (leafRaw !== null && typeof leafRaw === "object") status2 = leafRaw.status;
+        signerTuplesRaw.push({ principal, keyHash: subject.slice(4), status: status2 === "revoked" ? "revoked" : "active" });
+      }
+    }
+  } catch {
+  }
   let compaction = { carried: null, parked: null, scarShape: "unknown" };
   let parkedAllLawInstalls = false;
   try {
@@ -3793,6 +3860,12 @@ async function buildRebirthPlan(cloud, ws, reason) {
     compaction,
     repairs,
     posture: { posture, consent: consentState },
+    ...signerTuplesRaw.length > 0 ? {
+      signerEnrollments: signerTuplesRaw.map((t) => ({
+        ...t,
+        recovery: mode === "state-seed" ? "re-enroll-required" : "carried-by-replay"
+      }))
+    } : {},
     clientImpact: CLIENT_IMPACT,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -3849,6 +3922,23 @@ function renderRebirthImpact(plan, ledgerCommits) {
     L.push("  \u2192 preserved by lineage continuity; their birth-cert chains stay valid (same founding key + self-id).");
   }
   L.push("");
+  const se = plan.signerEnrollments ?? [];
+  L.push(`SIGNER ENROLLMENTS (${se.length})`);
+  if (se.length === 0) L.push("  (none on this chain \u2014 no device\u2192principal bindings to recover)");
+  else {
+    for (const s of se) {
+      L.push(`  \u2022 identity:${s.principal}#signer @ key:${s.keyHash.slice(0, 16)}\u2026   [${s.status}] \u2192 ${s.recovery}`);
+    }
+    if (se.some((s) => s.recovery === "re-enroll-required")) {
+      L.push("  \u2192 a state-seed re-genesis does NOT carry these tuples: every device that authors against this");
+      L.push("    workspace (e.g. for sibling births) must be lawfully re-enrolled AFTER the rebirth \u2014 client");
+      L.push("    ensureParentSignerEnrollment / NomosScope.home's reopen repair / `githolon key enroll --parent <ws>`.");
+    } else {
+      L.push("  \u2192 replay-compact re-folds the enrolling intents; a PARKED enrolling intent would still strand its");
+      L.push("    binding until re-admitted \u2014 verify with the parked list, or re-enroll idempotently (a no-op when live).");
+    }
+  }
+  L.push("");
   L.push(`REPAIRS (${plan.repairs.length})`);
   if (plan.repairs.length === 0) L.push("  (none matched \u2014 a plain compaction; no corrective verb declared for this refusal)");
   else {
@@ -4051,7 +4141,7 @@ gov rebirth ${ws}:`);
       return 1;
     }
     signSecret = dk.secret;
-    actor = `user:${actorUid}`;
+    actor = canonicalPrincipal(actorUid);
   }
   const res = author2(eng, "root", "workspaces", "rebirthWorkspace", { workspaceId, reason, rebornAt }, controllerHash, { authorSecret: signSecret, actor });
   if (res.ok === false) {
@@ -8283,6 +8373,8 @@ var HELP = {
       ["--sha256", "import: derive the seed as sha256(--secret) (a passphrase/preimage)"],
       ["--format <f>", "import: force hex|base64 interpretation (default: auto-detect)"],
       ["--parent <ws>", "enroll: the governance workspace to enroll at (default root)"],
+      ["--domain <d>", "enroll: the domain declaring the signing directive (default: DISCOVERED from the parent's installed law \u2014 never assume 'workspaces')"],
+      ["--directive <id>", "enroll: the signing directive id (default enrollSigner)"],
       ["--yes", "export: confirm printing the secret to stdout"]
     ],
     examples: [
@@ -8294,8 +8386,8 @@ var HELP = {
     ]
   },
   gov: {
-    usage: "githolon gov <ws> <directiveId> [--payload <json> | --payload-file <f>] [--as <uid>] [--stamp] [--save <f>] [--cloud <url>]\n       githolon gov relay <ws> <offer-file> [--cloud <url>]",
-    what: "Author ANY `workspaces` governance directive as a SIGNED offer to <ws> and relay it \u2014 the generic\nlane the grant/ws/key verbs are sugar over. The directive is planned against <ws>'s OWN folded law\n(we connect + sign locally with your enrolled key; the host relays opaque {intentBytes} and the\nkernel re-verifies the signature). SIGNING IS LOCAL: with --save it writes the sealed offer WITHOUT\nrelaying \u2014 sign now, relay later/elsewhere with `gov relay` (the only step that touches the cloud).\nThe acting principal needs an enrolled signing key (githolon key enroll | key import).",
+    usage: "githolon gov <ws> <directiveId> [--domain <d>] [--payload <json> | --payload-file <f>] [--as <uid>] [--stamp] [--save <f>] [--cloud <url>]\n       githolon gov relay <ws> <offer-file> [--cloud <url>]",
+    what: "Author ANY governance directive as a SIGNED offer to <ws> and relay it \u2014 the generic lane. The\ndirective's DOMAIN is discovered from <ws>'s installed law (a tenant-composed domain like\n`co2_platform` routes correctly; --domain overrides; ambiguity names the candidates) \u2014 the generic\nlane the grant/ws/key verbs are sugar over. The directive is planned against <ws>'s OWN folded law\n(we connect + sign locally with your enrolled key; the host relays opaque {intentBytes} and the\nkernel re-verifies the signature). SIGNING IS LOCAL: with --save it writes the sealed offer WITHOUT\nrelaying \u2014 sign now, relay later/elsewhere with `gov relay` (the only step that touches the cloud).\nThe acting principal needs an enrolled signing key (githolon key enroll | key import).",
     flags: [
       ["--payload <json>", `the directive payload as a JSON object string ('{"name":"\u2026"}')`],
       ["--payload-file <f>", "read the payload JSON from a file instead"],
@@ -8930,14 +9022,15 @@ Identity (~/.holon/credentials.json \u2014 sessions auto-refresh):
   githolon use [<uid>] [--clear]                          set/show/clear the ACTIVE signing principal: the one
                                                        deploy/gov/grant/key author as (--as overrides per-cmd)
   githolon logout                                         clear the session (workspace secrets kept)
-  githolon key enroll [--principal <uid>] [--parent <ws>] mint a signing device key + enroll it on-chain
+  githolon key enroll [--principal <uid>] [--parent <ws>] [--domain <d>] [--directive <id>] mint a signing device key + enroll it on-chain (the signing directive is DISCOVERED from the parent's installed law; the flags override)
                                                        (secret stays local; warrants SIGNED governance)
   githolon key import --principal <uid> --secret <key>    bring an EXISTING admin key into ~/.holon (accepts
                                                        hex / base64 seed, or --sha256 <passphrase>)
   githolon key show | export [--principal <uid>]          the device key's public identity (export --yes: secret)
 
 Governance (SIGNED client-side, relayed as {intentBytes} \u2014 never a host-author endpoint):
-  githolon gov <ws> <directive> [--payload <json>]        author ANY workspaces directive as a signed offer
+  githolon gov <ws> <directive> [--domain <d>]            author ANY governance directive (domain discovered
+            [--payload <json>]                            from installed law; --domain overrides) as a signed offer
             [--as <uid>] [--stamp] [--save <file>]        to <ws> (--save signs without relaying; relay later)
   githolon gov relay <ws> <offer-file>                    relay a saved offer (the only step that hits the cloud)
   githolon gov rebirth <ws> --reason <text>               LAWFUL SUPERSESSION (recovery verb 3): supersede a
@@ -8997,7 +9090,7 @@ Options:
 function cloudArgs(rest) {
   const pos = [];
   const opts = {};
-  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--controller-hash", "--plan", "--depth"];
+  const VALUE_FLAGS = ["--cloud", "--principal", "--as", "--file", "--target", "--parent", "--via", "--max", "--label", "--secret", "--payload", "--payload-file", "--save", "--format", "--with", "--out", "--reason", "--oid", "--seed-secret", "--gcp-secret", "--controller-hash", "--plan", "--depth", "--domain", "--directive"];
   const BOOL_FLAGS = ["--sha256", "--stamp", "--yes", "--clear", "--keep-beside", "--retire-replaced", "--explain-current-interface", "--dry-run", "--json", "--full"];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
@@ -9027,6 +9120,8 @@ function cloudArgs(rest) {
       else if (a === "--save") opts.save = v;
       else if (a === "--format") opts.format = v;
       else if (a === "--with") opts.with = v;
+      else if (a === "--domain") opts.domain = v;
+      else if (a === "--directive") opts.directive = v;
       else if (a === "--out") opts.out = v;
       else if (a === "--max") {
         const n = Number(v);
@@ -9696,7 +9791,7 @@ ${commandHelp("gov") ?? USAGE}`);
     }
     const [ws, directiveId] = pos;
     if (ws === void 0 || directiveId === void 0) {
-      process.stderr.write(`error: expected: githolon gov <ws> <directiveId> [--payload <json>] [--as <uid>]
+      process.stderr.write(`error: expected: githolon gov <ws> <directiveId> [--domain <d>] [--payload <json>] [--as <uid>]
 
 ${commandHelp("gov") ?? USAGE}`);
       return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.77.1",
+  "version": "0.79.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.77.1",
-    "@githolon/dsl": "^0.77.1",
+    "@githolon/client": "^0.79.0",
+    "@githolon/dsl": "^0.79.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {