githolon 0.86.0 → 0.87.0

package/dist/cli.mjs

@@ -5628,16 +5628,17 @@ async function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash, deployUsda)
     lines.push(...v.legs);
     if (!v.ok) return done(false, lines, v.error);
   }
-  if (legs.relationBootstrap !== void 0) {
+  const rbLegs = legs.relationBootstraps ?? (legs.relationBootstrap !== void 0 ? [legs.relationBootstrap] : []);
+  for (const rbLeg of rbLegs) {
     let rbWs = ws;
-    if (legs.relationBootstrap.bornContext === void 0 && deployUsda !== void 0) {
+    if (rbLeg.bornContext === void 0 && deployUsda !== void 0) {
       rbWs = await mountIsolatedProofWs(eng, ws, lawHash, deployUsda);
     }
-    const v = runRelationBootstrapLeg(eng, rbWs, lawHash, legs.relationBootstrap);
+    const v = runRelationBootstrapLeg(eng, rbWs, lawHash, rbLeg);
     lines.push(...v.legs);
     if (!v.ok) return done(false, lines, v.error);
   }
-  if (legs.directiveId === void 0 && birthLegs.length === 0 && legs.relationBootstrap === void 0) {
+  if (legs.directiveId === void 0 && birthLegs.length === 0 && rbLegs.length === 0) {
     lines.push(`\u2713 ${legs.domain} \u2014 compile-valid (the law compiled; no standalone create or .births() to prove a write)${kinds.length ? ` [${kinds.join(", ")}]` : ""}`);
   }
   return done(true, lines);
@@ -5873,6 +5874,15 @@ function runRelationBootstrapLeg(eng, ws, lawHash, rb) {
   }
   const seatDesc = speculative ? `replayed the declared seed ${rb.domain}/${rb.grantDirectiveId} (seats [${(rb.seedWritesRelations ?? [grantedRelation]).join(", ")}]) on ${ACTOR} \u2014 deferring to the real gate to authorize "${rb.relation}"` : `${rb.domain}/${rb.grantDirectiveId} granted "${grantedRelation}" to ${ACTOR} (${rb.via})${computed ? ` \u21D2 satisfies "${rb.relation}" via the rewrite` : ``}`;
   lines.push(`\u2713 relation bootstrap (${speculative ? "seed" : "grant"}) \u2014 ${seatDesc}`);
+  for (const setup of rb.preconditionSetups ?? []) {
+    const setupPayload = { ...setup.payload };
+    for (const f of setup.autoStamped) setupPayload[f] = stamp;
+    const setupRes = author(eng, ws, rb.domain, setup.directiveId, setupPayload, lawHash, actorOpts);
+    if (setupRes.ok === false) {
+      return done(false, `relation bootstrap precondition ${rb.domain}/${setup.directiveId} refused: ${setupRes.error ?? "unknown"} \u2014 the parent state ${rb.gatedDirectiveId} requires could not be established (is ${setup.directiveId} gated by a relation not seated by this leg? it needs "${setup.requiresRelation ?? rb.relation}")`);
+    }
+    lines.push(`\u2713 relation bootstrap (precondition) \u2014 ${rb.domain}/${setup.directiveId} established before ${rb.gatedDirectiveId} (real parent state, not a shell)`);
+  }
   const gatedPayload = { ...rb.gatedPayload };
   for (const f of rb.gatedAutoStamped) gatedPayload[f] = stamp;
   if (rb.gatedMintField !== void 0 && rb.gatedAggregateId !== void 0) gatedPayload[rb.gatedMintField] = mintId(eng, rb.gatedAggregateId);
@@ -5984,6 +5994,62 @@ var init_proof_offline = __esm({
   }
 });
 
+// src/mountability.ts
+var mountability_exports = {};
+__export(mountability_exports, {
+  assertCompiledMountable: () => assertCompiledMountable
+});
+import { existsSync as existsSync11, readdirSync as readdirSync5, readFileSync as readFileSync13 } from "node:fs";
+import { join as join13 } from "node:path";
+async function assertCompiledMountable(cwd, cloud) {
+  const buildDir = join13(cwd, "build");
+  if (!existsSync11(buildDir)) return { ok: true, checked: [] };
+  const deploys = readdirSync5(buildDir).filter((f) => f.endsWith(".deploy.json"));
+  if (deploys.length === 0) return { ok: true, checked: [] };
+  let mount;
+  let engine;
+  try {
+    mount = await Promise.resolve().then(() => (init_local_holon(), local_holon_exports));
+    engine = await Promise.resolve().then(() => (init_engine(), engine_exports));
+  } catch {
+    return { ok: true, checked: [], skipped: "the vendored kernel engine is not present \u2014 mountability gate skipped (compile still emitted the package)" };
+  }
+  const { holonEngine: holonEngine2, mountFresh: mountFresh2 } = mount;
+  const { author: author2, installPayload: installPayload2, sha256hex: sha256hex2 } = engine;
+  const checked = [];
+  for (const f of deploys) {
+    let deploy3;
+    try {
+      deploy3 = JSON.parse(readFileSync13(join13(buildDir, f), "utf8"));
+    } catch {
+      continue;
+    }
+    if (typeof deploy3.packageUsda !== "string" || deploy3.packageUsda.length === 0) continue;
+    const name = deploy3.summary?.name ?? f.replace(/\.deploy\.json$/, "");
+    const ws = `mountcheck-${name}`.replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 100);
+    try {
+      const lh = await sha256hex2(deploy3.packageUsda);
+      const { eng } = await holonEngine2(cloud, deploy3, `${ws}-eng`);
+      await mountFresh2(eng, ws);
+      author2(eng, ws, "bootstrap", "installDomain", installPayload2(eng.hashes.nomos, eng.nomosPkg, `${ws}-eng`), "");
+      const r = author2(eng, ws, "nomos", "installDomain", installPayload2(lh, deploy3.packageUsda, `${ws}-eng`), eng.hashes.nomos);
+      if (r && r.ok === false) {
+        return { ok: false, checked, error: `${name}: the read router REFUSED the compiled law at mount \u2014 ${r.error ?? "install refused"}` };
+      }
+      checked.push(name);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return { ok: false, checked, error: `${name}: the compiled package is NOT mountable on the real kernel \u2014 ${msg}` };
+    }
+  }
+  return { ok: true, checked };
+}
+var init_mountability = __esm({
+  "src/mountability.ts"() {
+    "use strict";
+  }
+});
+
 // src/mcp.ts
 var mcp_exports = {};
 __export(mcp_exports, {
@@ -5996,7 +6062,7 @@ __export(mcp_exports, {
   toolEvolvePreview: () => toolEvolvePreview
 });
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 import { dirname as dirname8, isAbsolute as isAbsolute2, resolve as resolve3 } from "node:path";
 function resolveConfig(config) {
   const arg = config ?? "nomos.package.mjs";
@@ -6075,7 +6141,7 @@ function extractDispositions(humanReport) {
 }
 function toolCheck(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync11(configPath)) {
+  if (!existsSync12(configPath)) {
     return { text: `nomos_check: config not found: ${configPath}`, isError: true };
   }
   const extra = args.against !== void 0 ? ["--against", args.against] : [];
@@ -6092,11 +6158,11 @@ ${JSON.stringify(payload, null, 2)}`, isError: false };
 }
 function toolEvolvePreview(args) {
   const { configPath } = resolveConfig(args.config);
-  if (!existsSync11(configPath)) {
+  if (!existsSync12(configPath)) {
     return { text: `nomos_evolve_preview: config not found: ${configPath}`, isError: true };
   }
   const againstPath = isAbsolute2(args.against) ? args.against : resolve3(dirname8(configPath), args.against);
-  const priorArg = existsSync11(againstPath) ? againstPath : args.against;
+  const priorArg = existsSync12(againstPath) ? againstPath : args.against;
   const jsonRun = runCheckJson(configPath, ["--against", priorArg]);
   if (jsonRun.error !== void 0) {
     return {
@@ -6259,8 +6325,8 @@ __export(harness_exports, {
   harnessInstall: () => harnessInstall,
   looksLikeStaleRuntime: () => looksLikeStaleRuntime
 });
-import { existsSync as existsSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join15 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
 function looksLikeStaleRuntime(msg) {
   return /\bbbox param\b|missing.*param|non-numeric|unknown (op|query op)|unsupported op|unexpected (field|key)|no such op/i.test(
@@ -6270,19 +6336,19 @@ function looksLikeStaleRuntime(msg) {
 async function harnessInstall(opts) {
   const { deploy: deployPaths, workspace, out: outPath } = opts;
   if (deployPaths.length === 0) die("no --deploy JSON path(s) given");
-  const runtimeDir = opts.runtime || process.env["NOMOS_OFFLINE_RUNTIME"] || join14(configDir(), "runtime");
+  const runtimeDir = opts.runtime || process.env["NOMOS_OFFLINE_RUNTIME"] || join15(configDir(), "runtime");
   const refreshed = await refreshRuntimeDir(cloudBase(), runtimeDir);
   if (refreshed) process.stderr.write(`harness-install: refreshed runtime cache from the cloud \u2192 ${runtimeDir}
 `);
-  const wasmFile = join14(runtimeDir, "holon.wasm");
-  const pkgsFile = join14(runtimeDir, "packages.json");
-  if (!existsSync12(wasmFile) || !existsSync12(pkgsFile)) {
+  const wasmFile = join15(runtimeDir, "holon.wasm");
+  const pkgsFile = join15(runtimeDir, "packages.json");
+  if (!existsSync13(wasmFile) || !existsSync13(pkgsFile)) {
     die(
       `runtime cache missing at ${runtimeDir} (holon.wasm + packages.json). Warm it once with a \`githolon\` run (it fetches + caches the runtime), then re-run offline.`
     );
   }
-  const wasm = readFileSync13(wasmFile);
-  const pkgs = JSON.parse(readFileSync13(pkgsFile, "utf8"));
+  const wasm = readFileSync14(wasmFile);
+  const pkgs = JSON.parse(readFileSync14(pkgsFile, "utf8"));
   const guarded = async (fn) => {
     try {
       return await fn();
@@ -6304,8 +6370,8 @@ async function harnessInstall(opts) {
   await guarded(() => author(eng, workspace, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, "nomos-test-harness"), ""));
   const lawHashes = [];
   for (const p of deployPaths) {
-    if (!existsSync12(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
-    const deploy3 = JSON.parse(readFileSync13(p, "utf8"));
+    if (!existsSync13(p)) die(`deploy JSON not found: ${p} \u2014 run \`npx githolon compile\` first`);
+    const deploy3 = JSON.parse(readFileSync14(p, "utf8"));
     const usda = deploy3.packageUsda;
     if (typeof usda !== "string" || !usda.startsWith("#usda")) die(`${p} has no #usda packageUsda`);
     const lawHash = await sha256hex(usda);
@@ -7396,8 +7462,8 @@ var scene_exports = {};
 __export(scene_exports, {
   scene: () => scene
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join15, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join16, resolve as resolve4 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 import git3 from "isomorphic-git";
 async function walkChain2(eng, ws) {
@@ -7418,8 +7484,8 @@ async function projectOnce(cloud, target, isDir, name) {
   const { eng } = await holonEngine(cloud, void 0, "githolon-scene");
   const SOURCE3 = "source";
   if (isDir) {
-    const gitDir = existsSync13(join15(target, ".git")) ? join15(target, ".git") : target;
-    if (!existsSync13(join15(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
+    const gitDir = existsSync14(join16(target, ".git")) ? join16(target, ".git") : target;
+    if (!existsSync14(join16(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
     await mountFresh(eng, SOURCE3);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE3).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
@@ -7478,7 +7544,7 @@ async function projectOnce(cloud, target, isDir, name) {
 }
 async function scene(target, opts) {
   const cloud = cloudBase(opts.cloud);
-  const isDir = existsSync13(target) || target.includes("/") || target.startsWith(".");
+  const isDir = existsSync14(target) || target.includes("/") || target.startsWith(".");
   const name = isDir ? (resolve4(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
   out11(`scene \u2014 ${name} (${isDir ? resolve4(target) : `${cloud} :: ${target}`})`);
   let first, second;
@@ -7498,10 +7564,10 @@ async function scene(target, opts) {
     err11(`the emitted stage violates the portable profile: ${violations.join("; ")}`);
     return 1;
   }
-  const outDir = resolve4(opts.out ?? join15("scene", name));
+  const outDir = resolve4(opts.out ?? join16("scene", name));
   mkdirSync6(outDir, { recursive: true });
-  const usdaPath = join15(outDir, `${name}.usda`);
-  const usdzPath = join15(outDir, `${name}.usdz`);
+  const usdaPath = join16(outDir, `${name}.usda`);
+  const usdzPath = join16(outDir, `${name}.usdz`);
   const usdaBytes = new TextEncoder().encode(first.usda);
   writeFileSync9(usdaPath, usdaBytes);
   writeFileSync9(usdzPath, usdzPack([[`${name}.usda`, usdaBytes]]));
@@ -7589,10 +7655,10 @@ var init_dlq = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync14, readdirSync as readdirSync5, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync15, readdirSync as readdirSync6, readFileSync as readFileSync15 } from "node:fs";
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname9, join as join16, resolve as resolve5 } from "node:path";
+import { dirname as dirname9, join as join17, resolve as resolve5 } from "node:path";
 import { pathToFileURL as pathToFileURL5, fileURLToPath } from "node:url";
 
 // src/generate.ts
@@ -9223,20 +9289,20 @@ async function runProof(args) {
   let proofPath;
   if (explicit !== void 0) {
     proofPath = resolve5(process.cwd(), explicit);
-    if (!existsSync14(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    if (!existsSync15(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
-    const buildDir = join16(process.cwd(), "build");
-    if (!existsSync14(buildDir)) {
+    const buildDir = join17(process.cwd(), "build");
+    if (!existsSync15(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
-    const proofs = readdirSync5(buildDir).filter((f) => f.endsWith(".proof.mts"));
+    const proofs = readdirSync6(buildDir).filter((f) => f.endsWith(".proof.mts"));
     if (proofs.length === 0) {
       return refuse("no build/*.proof.mts found \u2014 run `githolon compile` (every compile generates the proof from your law; the compile summary says why when it can't)");
     }
     if (proofs.length > 1) {
       return refuse(`found ${proofs.length} proofs (${proofs.join(", ")}) \u2014 name one: githolon proof build/<name>.proof.mts`);
     }
-    proofPath = join16(buildDir, proofs[0]);
+    proofPath = join17(buildDir, proofs[0]);
   }
   if (!live) {
     try {
@@ -9249,14 +9315,14 @@ async function runProof(args) {
   }
   const resolvePkgDir = (name, fromDir) => {
     try {
-      return dirname9(createRequire3(pathToFileURL5(join16(fromDir, "noop.js"))).resolve(`${name}/package.json`));
+      return dirname9(createRequire3(pathToFileURL5(join17(fromDir, "noop.js"))).resolve(`${name}/package.json`));
     } catch {
       return void 0;
     }
   };
   const dslDir = (() => {
     try {
-      return dirname9(createRequire3(pathToFileURL5(join16(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
+      return dirname9(createRequire3(pathToFileURL5(join17(process.cwd(), "noop.js"))).resolve("@githolon/dsl/package.json"));
     } catch {
       try {
         return dirname9(createRequire3(import.meta.url).resolve("@githolon/dsl/package.json"));
@@ -9269,9 +9335,9 @@ async function runProof(args) {
   if (tsxDir === void 0) {
     return refuse("tsx not found \u2014 add @githolon/dsl to your project's dependencies (tsx rides along) and npm install");
   }
-  const tsxPkg = JSON.parse(readFileSync14(join16(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync15(join17(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
-  const tsxCli = join16(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+  const tsxCli = join17(tsxDir, tsxBinRel ?? "dist/cli.mjs");
   console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
   const { wsCreate: wsCreate2, wsRetire: wsRetire2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
   const { resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
@@ -9377,7 +9443,28 @@ async function main(argv) {
     return 0;
   }
   if (argv[0] === "compile") {
-    return runCompile(argv.slice(1));
+    const status2 = runCompile(argv.slice(1));
+    if (status2 !== 0) return status2;
+    if (argv.includes("--no-mount-check")) return status2;
+    try {
+      const { assertCompiledMountable: assertCompiledMountable2 } = await Promise.resolve().then(() => (init_mountability(), mountability_exports));
+      const { cloudBase: cloudBase2 } = await Promise.resolve().then(() => (init_cloud(), cloud_exports));
+      const v = await assertCompiledMountable2(process.cwd(), cloudBase2());
+      if (v.skipped !== void 0) process.stderr.write(`note: ${v.skipped}
+`);
+      else if (!v.ok) {
+        process.stderr.write(`
+\u2717 compile emitted an UNMOUNTABLE package \u2014 ${v.error}
+  (compile-valid must mean mountable; fix the law or re-run with --no-mount-check to emit anyway)
+`);
+        return 1;
+      } else if (v.checked.length > 0) process.stdout.write(`  mountable  \u2713 ${v.checked.join(", ")} mount on the real read router
+`);
+    } catch (e) {
+      process.stderr.write(`note: mountability gate could not run (${e instanceof Error ? e.message : e}) \u2014 package emitted
+`);
+    }
+    return status2;
   }
   if (argv[0] === "check") {
     return runCheck(argv.slice(1));
@@ -9473,7 +9560,7 @@ usage: githolon cloud dev [--port <n>] [--data <dir>] [--ephemeral]
       resolve5(here, "../../../cloud/dev-server/server.mjs"),
       resolve5(process.cwd(), "cloud/dev-server/server.mjs")
     ];
-    const serverPath = candidates.find((p) => existsSync14(p));
+    const serverPath = candidates.find((p) => existsSync15(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.86.0",
-    "@githolon/dsl": "^0.86.0",
+    "@githolon/client": "^0.87.0",
+    "@githolon/dsl": "^0.87.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {