githolon 0.90.0 → 0.91.0

package/dist/cli.mjs

@@ -418,6 +418,7 @@ __export(engine_exports, {
   readPosture: () => readPosture,
   readShape: () => readShape,
   rebirthCompact: () => rebirthCompact,
+  reconcileBornPacks: () => reconcileBornPacks,
   refreshProjection: () => refreshProjection,
   refusedSummary: () => refusedSummary,
   replicateIntents: () => replicateIntents,
@@ -1172,7 +1173,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
       if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
-      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 8 * 1024 * 1024;
+      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
       if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
         rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry intentB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
         continue;
@@ -1816,6 +1817,25 @@ function packBornChildren(eng, born) {
     }
   });
 }
+function reconcileBornPacks(eng, children) {
+  const born = [];
+  const missing = [];
+  for (const child of Array.isArray(children) ? children : []) {
+    if (typeof child !== "string" || !child) continue;
+    const head = kgit.resolveRef(eng, gitdirOf(child), BRANCH);
+    if (!head || !/^[0-9a-f]{40}$/i.test(head)) {
+      missing.push(child);
+      continue;
+    }
+    const pack = packDelta(eng, child, "", head);
+    if (!pack || !pack.length) {
+      missing.push(child);
+      continue;
+    }
+    born.push({ workspace: child, head, packB64: b64Bytes(pack), packBytes: pack.length });
+  }
+  return { born, missing };
+}
 async function ingestPackAsCustody(eng, ws, packBytes, head) {
   if (!packBytes || !packBytes.length) throw new Error(`ingestPackAsCustody: empty pack for '${ws}'`);
   if (!/^[0-9a-f]{40}$/i.test(head || "")) throw new Error(`ingestPackAsCustody: bad head '${head}' for '${ws}'`);
@@ -3144,7 +3164,7 @@ async function signAndPostOffer(ws, domain, directiveId, payload, opts) {
     }
     err2(`this cloud has no /v2/stage content-addressed lane \u2014 relaying the ${sealed.intentBytes.length}-char sealed offer inline (a 413 here means the worker needs upgrading to accept law this large signed)`);
   }
-  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws });
+  const verdict = await holon.postGovernanceOffer({ directiveId, intentBytes: sealed.intentBytes, ws, domain: resolvedDomain });
   return { ...verdict, principal };
 }
 async function relaySealedOfferViaStage(cloud, ws, directiveId, intentBytesB64, fetchImpl) {
@@ -3504,7 +3524,7 @@ async function governanceOffer(ws, directiveId, opts) {
       const domain = await discoverSigningDomain(holon, ws, directiveId, opts.domain);
       const device = await ensureDeviceKey(holon, principal);
       const sealed = await holon.signGovernanceOffer({ domain, directiveId, payload, authorSecret: device.secret, actor: canonicalPrincipal(principal) });
-      writeFileSync4(opts.save, JSON.stringify({ ws, directiveId, principal, intentBytes: sealed.intentBytes }, null, 2) + "\n");
+      writeFileSync4(opts.save, JSON.stringify({ ws, domain, directiveId, principal, intentBytes: sealed.intentBytes }, null, 2) + "\n");
     } catch (e) {
       err2(e.message);
       return 1;
@@ -3536,15 +3556,16 @@ async function governanceRelay(ws, file, opts) {
     err2(`cannot read offer file ${file}: ${e.message}`);
     return 1;
   }
-  const { directiveId, intentBytes } = saved;
+  const { directiveId, intentBytes, domain } = saved;
   if (typeof directiveId !== "string" || typeof intentBytes !== "string") {
     err2(`${file} is not a saved offer (expected { directiveId, intentBytes })`);
     return 1;
   }
   const cloud = cloudBase(opts.cloud);
+  const route = typeof domain === "string" && domain.length > 0 ? `${encodeURIComponent(domain)}/${encodeURIComponent(directiveId)}` : encodeURIComponent(directiveId);
   let r;
   try {
-    r = await fetch(`${cloud}/v2/workspaces/${ws}/${directiveId}`, {
+    r = await fetch(`${cloud}/v2/workspaces/${ws}/${route}`, {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ intentBytes })
@@ -3555,6 +3576,10 @@ async function governanceRelay(ws, file, opts) {
   }
   const text = await r.text();
   if (!r.ok) {
+    if (r.status === 409 && domain === void 0) {
+      err2(`${directiveId} is declared by more than one domain on ${ws} \u2014 re-run \`gov --save\` (it now records the signing domain), or the worker's candidates were: ${text}`);
+      return 1;
+    }
     err2(`${directiveId} refused (${r.status}): ${text}`);
     return 1;
   }
@@ -4766,6 +4791,97 @@ var init_lifecycle = __esm({
   }
 });
 
+// src/capabilities.ts
+var capabilities_exports = {};
+__export(capabilities_exports, {
+  INLINE_OFFER_CAP_CHARS: () => INLINE_OFFER_CAP_CHARS,
+  negotiateDeployRoute: () => negotiateDeployRoute,
+  openapiRoutesDirective: () => openapiRoutesDirective,
+  probeCloudCapabilities: () => probeCloudCapabilities,
+  probeOfferLane: () => probeOfferLane,
+  probeStageLane: () => probeStageLane
+});
+async function probeStageLane(cloud, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud}/v2/stage/${ZERO_SHA}`, { method: "GET" });
+    const body = await r.json().catch(() => void 0);
+    return typeof body?.staged === "boolean";
+  } catch {
+    return void 0;
+  }
+}
+function openapiRoutesDirective(spec, domain, directiveId) {
+  const paths = spec?.paths ?? {};
+  const wantPath = `/${domain}/${directiveId}`;
+  const wantBare = `/${directiveId}`;
+  const wantOp = `${domain}__${directiveId}`;
+  for (const [p, ops] of Object.entries(paths)) {
+    if (p === wantPath || p === wantBare) return true;
+    for (const method of Object.values(ops ?? {})) {
+      if (method?.operationId === wantOp) return true;
+    }
+  }
+  return false;
+}
+async function probeOfferLane(cloud, ws, route, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud}/v2/workspaces/${ws}/openapi.json`, { method: "GET" });
+    if (!r.ok) return { served: false, routesTarget: void 0 };
+    const spec = await r.json().catch(() => void 0);
+    if (spec === void 0 || typeof spec !== "object") return { served: false, routesTarget: void 0 };
+    const served = true;
+    const routesTarget = route === void 0 ? void 0 : openapiRoutesDirective(spec, route.domain, route.directiveId);
+    return { served, routesTarget };
+  } catch {
+    return { served: void 0, routesTarget: void 0 };
+  }
+}
+async function probeCloudCapabilities(cloud, ws, route, fetchImpl = fetch) {
+  const [stage, offer] = await Promise.all([
+    probeStageLane(cloud, fetchImpl),
+    probeOfferLane(cloud, ws, route, fetchImpl)
+  ]);
+  return {
+    cloud,
+    stage,
+    offerLane: offer.served,
+    routesTarget: offer.routesTarget,
+    openDeploy: void 0
+    // the open /domains lane is universal in every worker/dev-server; not separately probed
+  };
+}
+function negotiateDeployRoute(caps, opts) {
+  if (opts.signed) {
+    if (caps.offerLane === false) {
+      return {
+        fail: `${caps.cloud} does not serve the SIGNED OFFER lane \u2014 POST /v2/workspaces/${opts.ws}/${opts.route.domain}/${opts.route.directiveId} is not routed (the workspace serves no self-describing OpenAPI, so this cloud has no gateway to route a signed offer). This is often a lightweight cloud (e.g. \`githolon cloud dev\`) without the offer gateway.
+  \u2192 deploy the OPEN (unsigned) lane instead (drop --as/--principal) if this workspace is unwarranted, or target a cloud that serves the offer gateway.`
+      };
+    }
+    if (caps.offerLane === true && caps.routesTarget === false) {
+      return {
+        fail: `${caps.cloud} serves the offer gateway for ${opts.ws}, but its OpenAPI does not name the route ${opts.route.domain}/${opts.route.directiveId} \u2014 the ${opts.route.domain} controller is not installed here, so a signed ${opts.route.directiveId} would 404.
+  \u2192 confirm the workspace is born and the controller is deployed, or deploy the OPEN lane (drop --as).`
+      };
+    }
+    if (opts.sealedSizeChars > INLINE_OFFER_CAP_CHARS && caps.stage === false) {
+      return {
+        fail: `this signed package is ~${Math.round(opts.sealedSizeChars / (1024 * 1024))} MiB sealed \u2014 over the ${INLINE_OFFER_CAP_CHARS / (1024 * 1024)} MiB inline offer cap \u2014 and ${caps.cloud} has no /v2/stage content-addressed lane to carry it.
+  \u2192 target a cloud that serves /v2/stage, or shrink the package (githolon compile --compact).`
+      };
+    }
+  }
+  return void 0;
+}
+var INLINE_OFFER_CAP_CHARS, ZERO_SHA;
+var init_capabilities = __esm({
+  "src/capabilities.ts"() {
+    "use strict";
+    INLINE_OFFER_CAP_CHARS = 8 * 1024 * 1024;
+    ZERO_SHA = "0".repeat(64);
+  }
+});
+
 // src/cloud.ts
 var cloud_exports = {};
 __export(cloud_exports, {
@@ -5189,6 +5305,15 @@ async function deploy2(ws, opts) {
       return 1;
     }
     const targetHash2 = createHash3("sha256").update(Buffer.from(packageUsda, "utf8")).digest("hex");
+    const { probeCloudCapabilities: probeCloudCapabilities2, negotiateDeployRoute: negotiateDeployRoute2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+    const route = { domain: "nomos", directiveId: "installDomain" };
+    const caps = await probeCloudCapabilities2(cloud, ws, route);
+    const refusal = negotiateDeployRoute2(caps, { signed: true, ws, sealedSizeChars: packageUsda.length, route });
+    if (refusal !== void 0) {
+      err4(`signed deploy '${ws}' cannot proceed on ${cloud}:
+  ${refusal.fail}`);
+      return 1;
+    }
     const { signAndPostOffer: signAndPostOffer2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
     let v;
     try {

package/dist/dev-server.mjs

@@ -631,7 +631,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
       if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
-      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 8 * 1024 * 1024;
+      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
       if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
         rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry intentB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
         continue;
@@ -1622,6 +1622,46 @@ function resolveGatewayOperation(spec, opName, method) {
   return { op: null, ambiguous: null };
 }
 
+// ../cloud/cloudflare-shell/src/staged-intents.mjs
+var STAGE_THRESHOLD_CHARS = 4 * 1024 * 1024;
+var MAX_INLINE_INTENT_CHARS = 8 * 1024 * 1024;
+var MAX_STAGED_INTENT_BYTES = 64 * 1024 * 1024;
+var stagedIntentKey = (sha256) => typeof sha256 === "string" && /^[0-9a-f]{64}$/.test(sha256) ? `staged-intents/${sha256}` : null;
+async function sha256hexBytes(bytes) {
+  const d = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+var b64OfBytes = (bytes) => {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode.apply(null, bytes.subarray(i, i + 32768));
+  return btoa(s);
+};
+async function stagePut(bucket, sha256, bytes) {
+  const key = stagedIntentKey(sha256);
+  if (key === null) return { status: 400, body: { ok: false, error: "stage-bad-ref: the path must name sha256 as 64 lowercase hex" } };
+  if (!(bytes instanceof Uint8Array) || bytes.length === 0) return { status: 400, body: { ok: false, error: "stage-empty: PUT a non-empty raw body (the sealed intent bytes)" } };
+  if (bytes.length > MAX_STAGED_INTENT_BYTES) return { status: 413, body: { ok: false, error: `stage-too-large: staged bytes are capped at ${MAX_STAGED_INTENT_BYTES} bytes` } };
+  const got = await sha256hexBytes(bytes);
+  if (got !== sha256) return { status: 400, body: { ok: false, error: `stage-hash-mismatch: sha256(body) is ${got}, not the named ${sha256} \u2014 stage bytes under their own hash` } };
+  const existing = typeof bucket.head === "function" ? await bucket.head(key) : await bucket.get(key);
+  if (existing) return { status: 200, body: { ok: true, sha256, size: bytes.length, alreadyStaged: true } };
+  await bucket.put(key, bytes);
+  return { status: 200, body: { ok: true, sha256, size: bytes.length, staged: true } };
+}
+async function resolveStagedIntent(bucket, ref) {
+  const sha256 = ref && typeof ref === "object" && typeof ref.sha256 === "string" ? ref.sha256 : "";
+  const key = stagedIntentKey(sha256);
+  if (key === null) return { ok: false, status: 400, error: "staged-intent-bad-ref: intentRef must be { sha256: <64 lowercase hex>, size? }" };
+  const obj = await bucket.get(key);
+  if (!obj) return { ok: false, status: 422, error: `staged-intent-missing: no staged bytes for sha256 ${sha256} \u2014 PUT /v2/stage/${sha256} (raw sealed intent bytes) first, then re-offer { intentRef }` };
+  const bytes = new Uint8Array(await obj.arrayBuffer());
+  if (bytes.length > MAX_STAGED_INTENT_BYTES) return { ok: false, status: 413, error: `staged-intent-too-large: staged bytes exceed the ${MAX_STAGED_INTENT_BYTES}-byte cap` };
+  if (typeof ref.size === "number" && ref.size !== bytes.length) return { ok: false, status: 422, error: `staged-intent-size-mismatch: the ref names ${ref.size} bytes but ${bytes.length} are staged` };
+  const got = await sha256hexBytes(bytes);
+  if (got !== sha256) return { ok: false, status: 422, error: `staged-intent-hash-mismatch: staged bytes hash to ${got}, not the offered ${sha256} \u2014 the signed offer's hash is the binding; refuse` };
+  return { ok: true, intentB64: b64OfBytes(bytes), sha256, size: bytes.length };
+}
+
 // ../cloud/dev-server/custody.mjs
 import { spawn, execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, rmSync, readdirSync } from "node:fs";
@@ -1893,6 +1933,20 @@ async function startDevCloud(opts = {}) {
   replica &= (1n << 63n) - 1n;
   const eng = await createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy: "nomos-cloud-dev" });
   const custody = new FilesystemGitCustody(dataDir, origin);
+  const stagedBytes = /* @__PURE__ */ new Map();
+  const stageBucket = {
+    async get(k) {
+      const b = stagedBytes.get(k);
+      return b ? { arrayBuffer: async () => b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength) } : null;
+    },
+    async put(k, bytes) {
+      stagedBytes.set(k, bytes);
+    },
+    async head(k) {
+      const b = stagedBytes.get(k);
+      return b ? { size: b.length } : null;
+    }
+  };
   let chain = Promise.resolve();
   const serialize = (fn) => {
     const r = chain.then(fn, fn);
@@ -1956,9 +2010,25 @@ async function startDevCloud(opts = {}) {
   const authTokenOf = (req) => String(req.headers["x-nomos-auth"] || "").replace(/^Bearer\s+/i, "");
   function openapiFor(ws) {
     const merged = { openapi: "3.1.0", info: { title: `${ws} (nomos workspace)`, version: "0", "x-nomos-workspace": ws }, paths: {} };
+    const domOf = (o) => String(o && o["x-nomos"] && o["x-nomos"].domain ? o["x-nomos"].domain : "domain");
+    const mergeInto = (frag) => {
+      for (const [p, methods] of Object.entries(frag.paths || {})) {
+        for (const [m, op] of Object.entries(methods)) {
+          const existing = merged.paths[p] && merged.paths[p][m];
+          if (existing === void 0) {
+            (merged.paths[p] ||= {})[m] = op;
+          } else if (JSON.stringify(existing) !== JSON.stringify(op)) {
+            (merged.paths[`/${domOf(existing)}${p}`] ||= {})[m] = existing;
+            (merged.paths[`/${domOf(op)}${p}`] ||= {})[m] = op;
+            delete merged.paths[p][m];
+            if (Object.keys(merged.paths[p]).length === 0) delete merged.paths[p];
+          }
+        }
+      }
+    };
     try {
       const spec = describe(eng, ws);
-      if (spec && spec.paths) merged.paths = spec.paths;
+      if (spec && spec.paths) mergeInto(spec);
     } catch {
     }
     merged.paths["/openapi.json"] = {
@@ -1982,6 +2052,22 @@ async function startDevCloud(opts = {}) {
       if (url.pathname === "/v1/runtime/packages") {
         return sendJson(res, { bootstrap: bootstrapPkg, nomos: nomosPkg });
       }
+      {
+        const m = url.pathname.match(/^\/v2\/stage\/([0-9a-f]{64})$/);
+        if (m) {
+          const sha = m[1];
+          if (req.method === "PUT" || req.method === "POST") {
+            const bytes = new Uint8Array(await readBody(req));
+            const r = await stagePut(stageBucket, sha, bytes);
+            return sendJson(res, r.body, r.status);
+          }
+          if (req.method === "GET" || req.method === "HEAD") {
+            const head = await stageBucket.head(`staged-intents/${sha}`);
+            if (!head) return sendJson(res, { ok: false, staged: false, sha256: sha }, 404);
+            return sendJson(res, { ok: true, staged: true, sha256: sha, size: head.size }, 200);
+          }
+        }
+      }
       if (seg[0] === "git" && seg[1] === "nomos") {
         return await gitBackend(req, res, seg.slice(2).join("/"), null);
       }
@@ -2209,8 +2295,8 @@ async function startDevCloud(opts = {}) {
         if (sub[0] === "subscribe") {
           return sendJson(res, { ok: false, error: "subscribe requires a WebSocket upgrade" }, 426);
         }
-        if (sub.length === 1 && (req.method === "POST" || req.method === "GET")) {
-          const opName = sub[0];
+        if ((sub.length === 1 || sub.length === 2) && (req.method === "POST" || req.method === "GET")) {
+          const opName = sub.join("/");
           const method = req.method.toLowerCase();
           return serialize(async () => {
             const ledger = ledgerFor(ws);
@@ -2234,6 +2320,11 @@ async function startDevCloud(opts = {}) {
             const authToken = authTokenOf(req);
             if (x.kind === "offer" && method === "post") {
               const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+              if (body.intentRef && typeof body.intentRef === "object") {
+                const resolved2 = await resolveStagedIntent(stageBucket, body.intentRef);
+                if (!resolved2.ok) return sendJson(res, { ok: false, refused: true, error: resolved2.error }, resolved2.status);
+                body.intentBytes = resolved2.intentB64;
+              }
               try {
                 let out;
                 if (typeof body.intentBytes === "string" && body.intentBytes) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.90.0",
+  "version": "0.91.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.90.0",
-    "@githolon/dsl": "^0.90.0",
+    "@githolon/client": "^0.91.0",
+    "@githolon/dsl": "^0.91.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {