githolon 0.84.1 → 0.86.0

package/dist/cli.mjs

@@ -1778,7 +1778,17 @@ function servePack(eng, ws, base = "") {
   try {
     r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base, branch: BRANCH }, eng.STDERR));
   } catch (e) {
-    if (/nothing to pack|head == base/.test(String(e))) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
+    const msg = String(e);
+    if (/nothing to pack|head == base/.test(msg)) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
+    if (base && /reached root|before base|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
+      try {
+        const full = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base: "", branch: BRANCH }, eng.STDERR));
+        if (full && full.ok === true && typeof full.packB64 === "string") {
+          return { packB64: full.packB64, bytes: full.bytes, divergent: true, ...head ? { head } : {} };
+        }
+      } catch {
+      }
+    }
     throw e;
   }
   if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");

package/dist/dev-server.mjs

@@ -594,6 +594,126 @@ function summaryOfCapture(ctx, fromOid, toOid) {
     rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1))
   };
 }
+async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
+  const main = await mainIntentIds(eng, ws);
+  const sessions = /* @__PURE__ */ new Map();
+  const deadLetters = [];
+  let admittedTotal = 0;
+  const born = [];
+  const birthOutcomes = [];
+  const timings = { spans: [], intents: 0, sessions: 0 };
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0 ? { reads: scopedReads(eng), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) {
+      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const gitdir0 = gitdirOf(ws);
+  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir0, BRANCH) : null;
+  const t0 = Date.now();
+  let seq = 0;
+  const span = (name, kind, depth = 1, extra = {}) => {
+    const s0 = Date.now();
+    return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
+  };
+  for (const offer of Array.isArray(offers) ? offers : []) {
+    const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
+    const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
+    sessions.set(cid, rec);
+    const done = span(`intent offer ${cid.slice(0, 14)}`, "cadmit", 1, { client: cid });
+    let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+    try {
+      if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
+      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 8 * 1024 * 1024;
+      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry intentB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+        continue;
+      }
+      let doc = null;
+      try {
+        doc = JSON.parse(dec3.decode(blob));
+      } catch {
+      }
+      const intentId = typeof doc?.id === "string" ? doc.id : null;
+      const dom = typeof doc?.payload?.domain === "string" ? doc.payload.domain : null;
+      const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
+      const oid = String(offer?.oid || intentId || "").slice(0, 10);
+      if (!dom) {
+        rec.rejected.push({ oid, error: "non-authored intent \u2014 governance enters its own admin lane" });
+        continue;
+      }
+      if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+        const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+        continue;
+      }
+      if (intentId && main.ids.has(intentId)) {
+        rec.skipped.push({ oid, intent: intentId.slice(0, 12), alreadyOnMain: true });
+        continue;
+      }
+      const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
+      const _tOffer = Date.now();
+      const res = offerAdmit(eng, ws, blob, { defer: !summaryCtx });
+      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: !summaryCtx, ok: res.ok });
+      if (res.ok) {
+        if (intentId) main.ids.add(intentId);
+        main.oids.add(res.head);
+        main.head = res.head;
+        rec.admitted.push({ oid, head: res.head });
+        admittedTotal += 1;
+        if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
+        if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
+        if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head, intentId);
+      } else {
+        const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+      }
+    } catch (e) {
+      rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: String(e).slice(0, 200) });
+    } finally {
+      done();
+    }
+  }
+  timings.sessions = sessions.size;
+  timings.intents = admittedTotal;
+  if (admittedTotal && !summaryCtx) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
+  if (deadLetters.length) {
+    try {
+      await materializeRefused(eng, ws, ledger, deadLetters);
+    } catch (e) {
+      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const deferDurability = defer && !summaryCtx;
+  if (admittedTotal && !deferDurability) {
+    const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
+    await commitAndPush(eng, ws, ledger);
+    sealDone();
+  }
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, head) : null;
+  let resultPackB64 = null;
+  if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
+    try {
+      const p = servePack(eng, ws, clientBase);
+      if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
+    } catch {
+    }
+  }
+  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
+  const bornPacked = born.length ? packBornChildren(eng, born) : born;
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, ...summary ? { summary } : {}, ...bornPacked.length ? { born: bornPacked } : {}, ...birthOutcomes.length ? { birthOutcomes } : {}, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}, ...deferDurability && admittedTotal && head ? { deferred: true, head } : {} };
+}
 async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash, opts = {}) {
   await mountWorkspace(eng, ws, ledger);
   let res;
@@ -794,7 +914,17 @@ function servePack(eng, ws, base = "") {
   try {
     r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base, branch: BRANCH }, eng.STDERR));
   } catch (e) {
-    if (/nothing to pack|head == base/.test(String(e))) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
+    const msg = String(e);
+    if (/nothing to pack|head == base/.test(msg)) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
+    if (base && /reached root|before base|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
+      try {
+        const full = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base: "", branch: BRANCH }, eng.STDERR));
+        if (full && full.ok === true && typeof full.packB64 === "string") {
+          return { packB64: full.packB64, bytes: full.bytes, divergent: true, ...head ? { head } : {} };
+        }
+      } catch {
+      }
+    }
     throw e;
   }
   if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");
@@ -1166,6 +1296,35 @@ async function writeRefusedRef(eng, ws, dl) {
   });
   return ref;
 }
+async function listRefusedRefs(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
+  const out = [];
+  for (const { ref, oid } of refs) {
+    try {
+      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json");
+      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json");
+      const v = JSON.parse(dec3.decode(vb));
+      out.push({ ref, ...v, intentB64: b64Bytes(ib) });
+    } catch {
+    }
+  }
+  return out;
+}
+async function refusedSummary(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
+  let count2 = 0, latestParkedAt = null;
+  for (const { oid } of refs) {
+    try {
+      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json")));
+      count2++;
+      if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
+    } catch {
+    }
+  }
+  return { count: count2, latestParkedAt };
+}
 async function materializeRefused(eng, ws, ledger, deadLetters) {
   const refs = [];
   const unparkedSessions = /* @__PURE__ */ new Set();
@@ -1181,6 +1340,20 @@ async function materializeRefused(eng, ws, ledger, deadLetters) {
   }
   return { refs, unparkedSessions };
 }
+async function deleteRefusedRef(eng, ws, ledger, offerId) {
+  const gitdir = gitdirOf(ws);
+  const ref = refusedRefName(offerId);
+  try {
+    kgit.deleteRef(eng, gitdir, ref);
+  } catch {
+  }
+  try {
+    await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
+  } catch (e) {
+    log("refused-ref-delete-push-failed", { ws, ref, error: String(e).slice(0, 200) });
+  }
+  return ref;
+}
 async function boot(eng, ws, ledger) {
   const m = await mountWorkspace(eng, ws, ledger);
   if (nomosActive(eng, ws)) {
@@ -1578,6 +1751,34 @@ function receivePackCommands(raw) {
 // ../cloud/dev-server/server.mjs
 var DIR = path.dirname(fileURLToPath(import.meta.url));
 var REPO_ROOT = path.resolve(DIR, "../..");
+var RECOGNIZED_UNSUPPORTED = /* @__PURE__ */ new Set([
+  "container-status",
+  "recycle-container",
+  "hostnames",
+  "rebirth-custody",
+  "upload-begin",
+  "upload-gate",
+  "upload-verify",
+  "drain-reclaims",
+  "drain-rebirths",
+  "git-read-lease",
+  "poke-admit",
+  "clear-checkpoint",
+  "domain-package",
+  "capabilities"
+]);
+var UNSUPPORTED_WHY = {
+  "container-status": "the heavy container tier is Cloudflare-only (the dev cloud is one in-process engine)",
+  "recycle-container": "the heavy container tier is Cloudflare-only (the dev cloud is one in-process engine)",
+  "hostnames": "platform custom-hostname routing is a multi-tenant edge concern",
+  "rebirth-custody": "the custodian rebirth lane is bound to Cloudflare Artifacts custody",
+  "upload-begin": "the staged-upload birth variant \u2014 push to /v2/workspaces/<ws>/git instead (the upload-birth lane works locally)",
+  "upload-gate": "the staged-upload birth variant \u2014 push to /v2/workspaces/<ws>/git instead",
+  "upload-verify": "the staged-upload birth variant \u2014 push to /v2/workspaces/<ws>/git instead",
+  "drain-reclaims": "an operator lawful-recovery drain (multi-node lifecycle)",
+  "drain-rebirths": "an operator lawful-recovery drain (multi-node lifecycle)",
+  "capabilities": "retired everywhere \u2014 host-side capability storage is gone (capabilities are holon-offered obligations now)"
+};
 var _realFetch = globalThis.fetch;
 globalThis.fetch = (input, init) => {
   const u = typeof input === "string" ? input : input && input.url || "";
@@ -1893,13 +2094,101 @@ async function startDevCloud(opts = {}) {
             sendJson(res, { ok: true, ws, sessions: out.sessions, main: out.main, ...out.timings ? { timings: out.timings } : {} });
           });
         }
+        if (sub[0] === "intent-offers" && req.method === "POST") {
+          return serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+            const offers = Array.isArray(body.offers) ? body.offers.slice(0, 100) : [];
+            if (!offers.length) return sendJson(res, { ok: false, error: "body must be { offers:[{session, oid, intentB64}] }" }, 400);
+            const clientBase = /^[0-9a-f]{40}$/i.test(body.base || "") ? body.base : null;
+            const out = await admitIntentOffers(eng, ws, ledger, offers, { ...clientBase ? { clientBase } : {} });
+            if (Array.isArray(out.born) && out.born.length) await persistBorn(out.born);
+            const bornOut = Array.isArray(out.born) ? out.born.map(({ packB64, packBytes, ...b }) => b) : null;
+            sendJson(res, {
+              ok: true,
+              ws,
+              sessions: out.sessions,
+              main: out.main,
+              ...bornOut ? { born: bornOut } : {},
+              ...out.birthOutcomes ? { birthOutcomes: out.birthOutcomes } : {},
+              ...out.mainDelta ? { mainDelta: out.mainDelta } : {},
+              ...out.resultPackB64 ? { resultPackB64: out.resultPackB64, resultBase: out.resultBase } : {},
+              ...out.deadLetters && out.deadLetters.length ? { deadLetters: out.deadLetters.map(({ blob, ...m }) => m) } : {}
+            });
+          });
+        }
+        if (sub[0] === "dead-letters" && sub.length === 1 && req.method === "GET") {
+          return serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            sendJson(res, { ok: true, ws, deadLetters: await listRefusedRefs(eng, ws) });
+          });
+        }
+        if (sub[0] === "dlq-summary" && req.method === "GET") {
+          return serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            sendJson(res, { ok: true, ws, ...await refusedSummary(eng, ws) });
+          });
+        }
+        if (sub[0] === "dead-letters" && sub[1] === "retry" && req.method === "POST") {
+          return serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+            const only = body.id || null;
+            const refs = await listRefusedRefs(eng, ws);
+            const retried = [], failed = [];
+            for (const e of refs) {
+              if (only && e.offerId !== only && e.oid !== only) continue;
+              if (!e.intentB64) {
+                failed.push({ intentId: e.offerId, error: "refused ref carries no intent bytes" });
+                continue;
+              }
+              try {
+                const r2 = offerAdmit(eng, ws, unb64(e.intentB64));
+                if (r2.ok) retried.push({ intentId: e.offerId, head: r2.head });
+                else failed.push({ intentId: e.offerId, error: String(r2.error || "").slice(0, 300) });
+              } catch (err) {
+                failed.push({ intentId: e.offerId, error: String(err).slice(0, 300) });
+              }
+            }
+            if (retried.length) await commitAndPush(eng, ws, ledger);
+            for (const r2 of retried) await deleteRefusedRef(eng, ws, ledger, r2.intentId);
+            sendJson(res, { ok: true, ws, retried, failed, remaining: (await listRefusedRefs(eng, ws)).length });
+          });
+        }
+        if (sub[0] === "dead-letters" && (sub[1] === "discard" || req.method === "DELETE")) {
+          return serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const body = req.method === "DELETE" ? {} : JSON.parse((await readBody(req)).toString("utf8") || "{}");
+            const only = body.id || url.searchParams.get("id") || null;
+            const targets = (await listRefusedRefs(eng, ws)).filter((e) => !only || e.offerId === only || e.oid === only);
+            for (const e of targets) await deleteRefusedRef(eng, ws, ledger, e.offerId || e.oid);
+            sendJson(res, { ok: true, ws, discarded: targets.length });
+          });
+        }
+        if (sub[0] === "rotate-secret" && req.method === "POST") {
+          return sendJson(res, { ok: false, retired: true, error: "rotate-secret is retired \u2014 ownership is a ledger fact (sha256 of the push password on the law record); re-own by re-birthing via the upload lane" }, 410);
+        }
         if (sub[0] === "pack" && req.method === "GET") {
           return serialize(async () => {
             await mountWorkspace(eng, ws, ledgerFor(ws));
             const have = url.searchParams.get("have") || "";
-            const r = servePack(eng, ws, have);
+            let r;
+            try {
+              r = servePack(eng, ws, have);
+            } catch (e) {
+              return sendJson(res, { ok: false, custodyBreak: true, error: String(e && e.message || e).slice(0, 400), have }, 409);
+            }
             if (!r.packB64) return sendBytes(res, Buffer.alloc(0), 204, r.head ? { "x-nomos-head": r.head } : {});
-            sendBytes(res, unb64(r.packB64), 200, { "content-type": "application/x-git-packfile", "x-nomos-pack": have ? "delta" : "full", ...r.head ? { "x-nomos-head": r.head } : {} });
+            const kind = r.divergent ? "full" : have ? "delta" : "full";
+            sendBytes(res, unb64(r.packB64), 200, {
+              "content-type": "application/x-git-packfile",
+              "x-nomos-pack": kind,
+              ...r.divergent ? { "x-nomos-divergent": "1" } : {},
+              ...r.head ? { "x-nomos-head": r.head } : {}
+            });
           });
         }
         if (sub[0] === "snapshot" && req.method === "GET") {
@@ -1930,7 +2219,17 @@ async function startDevCloud(opts = {}) {
             const resolved = resolveGatewayOperation(spec, opName, method);
             if (resolved.ambiguous) return sendJson(res, { ok: false, error: "ambiguous operation", candidates: resolved.ambiguous }, 409);
             const x = resolved.op && resolved.op["x-nomos"];
-            if (!x) return sendJson(res, { ok: false, error: "unknown operation", see: `GET /v2/workspaces/${ws}` }, 404);
+            if (!x) {
+              if (RECOGNIZED_UNSUPPORTED.has(opName)) {
+                return sendJson(res, {
+                  ok: false,
+                  unsupported: true,
+                  route: opName,
+                  error: `'${opName}' is a recognized Nomos Cloud route that 'githolon cloud dev' (single-node local) does not serve \u2014 ${UNSUPPORTED_WHY[opName] || "a multi-node / Cloudflare-infra concern"}. This is NOT an app bug; if you need it locally, ask the Nomos devs.`
+                }, 501);
+              }
+              return sendJson(res, { ok: false, error: "unknown operation", see: `GET /v2/workspaces/${ws}` }, 404);
+            }
             const principal = principalOf(req);
             const authToken = authTokenOf(req);
             if (x.kind === "offer" && method === "post") {
@@ -2044,6 +2343,15 @@ Sec-WebSocket-Accept: ${accept}\r
     socket.on("error", () => {
     });
   });
+  if (!globalThis.__nomosDevGuards) {
+    globalThis.__nomosDevGuards = true;
+    process.on("unhandledRejection", (e) => {
+      console.error("[dev-cloud] unhandledRejection (kept alive):", String(e && e.stack || e && e.message || e).slice(0, 500));
+    });
+    process.on("uncaughtException", (e) => {
+      console.error("[dev-cloud] uncaughtException (kept alive):", String(e && e.stack || e && e.message || e).slice(0, 500));
+    });
+  }
   await new Promise((resolve) => server.listen(port, host, resolve));
   return { server, origin, dataDir, kernelSha, eng, custody, ledgerFor, serialize, persistBorn, close: () => new Promise((r) => server.close(r)) };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.84.1",
+  "version": "0.86.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.84.1",
-    "@githolon/dsl": "^0.84.1",
+    "@githolon/client": "^0.86.0",
+    "@githolon/dsl": "^0.86.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {