githolon 0.92.0 → 0.94.0

package/dist/cli.mjs

@@ -9,7 +9,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// vendor/engine/git-fs.mjs
+// vendor/engine/git-fs.ts
 function fsErr(code, p) {
   const e = new Error(`${code}: ${p}`);
   e.code = code;
@@ -17,7 +17,7 @@ function fsErr(code, p) {
 }
 function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
   const root = preopen.dir;
-  const isDir = (n) => n && n.contents instanceof Map;
+  const isDir = (n) => !!n && n.contents instanceof Map;
   function parts(p) {
     if (p === mount) return [];
     if (!p.startsWith(mount + "/")) throw fsErr("ENOENT", p);
@@ -107,14 +107,14 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
   return { promises };
 }
 var init_git_fs = __esm({
-  "vendor/engine/git-fs.mjs"() {
+  "vendor/engine/git-fs.ts"() {
     "use strict";
   }
 });
 
-// vendor/engine/tree.mjs
+// vendor/engine/tree.ts
 function flatten(dir, prefix, out13) {
-  for (const [name, inode] of dir.contents) {
+  for (const [name, inode] of dir.contents ?? /* @__PURE__ */ new Map()) {
     const path = prefix ? prefix + "/" + name : name;
     if (inode.contents instanceof Map) {
       out13.push({ path, dir: true });
@@ -153,14 +153,14 @@ function serializeTree(workTree) {
 }
 var enc, dec;
 var init_tree = __esm({
-  "vendor/engine/tree.mjs"() {
+  "vendor/engine/tree.ts"() {
     "use strict";
     enc = new TextEncoder();
     dec = new TextDecoder();
   }
 });
 
-// vendor/engine/custody-transport.mjs
+// vendor/engine/custody-transport.ts
 function concatBytes(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
@@ -284,7 +284,7 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 }
 var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
 var init_custody_transport = __esm({
-  "vendor/engine/custody-transport.mjs"() {
+  "vendor/engine/custody-transport.ts"() {
     "use strict";
     enc2 = new TextEncoder();
     dec2 = new TextDecoder();
@@ -329,7 +329,7 @@ var init_custody_transport = __esm({
   }
 });
 
-// vendor/engine/engine.mjs
+// vendor/engine/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
   NOMOS_SHARD_ROWS_READ: () => NOMOS_SHARD_ROWS_READ,
@@ -485,7 +485,7 @@ function call(ex, mode, fields, STDERR) {
       packed = ex.git_holon_call(reqPtr, req.length);
     } catch (e) {
       const tail = STDERR.length ? ` | stderr: ${STDERR.slice(-8).join(" / ")}` : "";
-      throw new Error(`${String(e && e.stack || e)}${tail}`);
+      throw new Error(`${String(e?.stack || e)}${tail}`);
     }
     const { ptr, len } = unpack(packed);
     try {
@@ -516,9 +516,10 @@ async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, insta
   const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
   const code = wasi.start(inst);
   if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
-  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!inst.exports[n]) throw new Error(`missing export ${n}`);
+  const instExports = inst.exports;
+  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!instExports[n]) throw new Error(`missing export ${n}`);
   const eng = {
-    ex: inst.exports,
+    ex: instExports,
     preopen,
     STDERR,
     seq: 0,
@@ -555,7 +556,7 @@ async function wrongHomeVerdict(shardRouting, route, payload) {
     const tag = routeTagHexOfMintedId(value);
     if (tag !== void 0) {
       for (const a of rows) {
-        if (await routeTagHexOfHomeKey(a.homeKey) === tag) {
+        if (await routeTagHexOfHomeKey(String(a.homeKey)) === tag) {
           assignment = a;
           break;
         }
@@ -827,7 +828,7 @@ async function deriveSummarySuffix(eng, ws, fromOid) {
               touchedBuckets.add(ak);
             }
             for (const bk of touchedBuckets) {
-              const ov = extRunning.has(bk) ? extRunning.get(bk) : null;
+              const ov = extRunning.has(bk) ? extRunning.get(bk) ?? null : null;
               const nv = recomputeExt(read, bk);
               if (nv === ov) continue;
               extRunning.set(bk, nv);
@@ -839,7 +840,7 @@ async function deriveSummarySuffix(eng, ws, fromOid) {
             }
           } else {
             for (const d of contributionDiff(read, before, after)) {
-              bump(summaryKey(d.readId, d.group), d.delta);
+              bump(summaryKey(d.readId, d.group), d.delta ?? 0);
               deltas.push(d);
             }
           }
@@ -872,6 +873,7 @@ async function deriveSummarySuffix(eng, ws, fromOid) {
     }
   }
   if (!sawFrom) return { ok: false, error: `fromOid ${String(fromOid).slice(0, 12)} is not on this shard's main \u2014 cannot derive the suffix` };
+  if (!prevs) prevs = /* @__PURE__ */ new Map();
   const touched = /* @__PURE__ */ new Set();
   for (const ev of events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
   const subtotals = [];
@@ -1213,7 +1215,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
         admittedTotal += 1;
         if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
         if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
-        if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head, intentId);
+        if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head ?? "", intentId);
       } else {
         const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
         rec.rejected.push({ oid, error, deadLettered: true });
@@ -1247,7 +1249,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   let resultPackB64 = null;
   if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
     try {
-      const p = servePack(eng, ws, clientBase);
+      const p = servePack(eng, ws, clientBase ?? "");
       if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
     } catch {
     }
@@ -1270,7 +1272,7 @@ async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash,
   try {
     res = author(eng, ws, domain, directiveId, payload, lawHash, opts);
   } catch (e) {
-    return { ok: false, error: String(e && e.message || e).slice(0, 500) };
+    return { ok: false, error: String(e?.message || e).slice(0, 500) };
   }
   if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
   await commitAndPush(eng, ws, ledger);
@@ -1322,7 +1324,7 @@ async function deepVerifyShard(eng, shardWs, shardLedger, coordinatorRows) {
 }
 function stageWorkspaceDir(eng, ws) {
   const wsContents = /* @__PURE__ */ new Map();
-  eng.preopen.dir.contents.get("ws").contents.set(ws, new Directory(wsContents));
+  dirOf(eng.preopen.dir.contents.get("ws")).contents.set(ws, new Directory(wsContents));
 }
 async function mountWorkspace(eng, ws, ledger) {
   if (eng.mounted.has(ws)) return eng.mounted.get(ws);
@@ -1337,7 +1339,7 @@ async function mountWorkspace(eng, ws, ledger) {
       restored = true;
     }
   } catch (e) {
-    restoreError = String(e && e.stack || e).split("\n").slice(0, 5).join(" | ");
+    restoreError = String(e?.stack || e).split("\n").slice(0, 5).join(" | ");
   }
   const m = { restored, remoteMain, restoreError };
   eng.mounted.set(ws, m);
@@ -1379,7 +1381,7 @@ async function queryEphemeral(eng, ws, mountOpts, queryId, paramsJson, principal
 function unmount(eng, ws) {
   eng.mounted.delete(ws);
   eng.mainIntents.delete(ws);
-  const wsRoot = eng.preopen.dir.contents.get("ws");
+  const wsRoot = dirOf(eng.preopen.dir.contents.get("ws"));
   if (wsRoot) wsRoot.contents.delete(ws);
 }
 function writeWork(eng, name, bytes) {
@@ -1540,7 +1542,7 @@ async function readCheckpointBlob(eng, ws, commitOid) {
   let codec = "gzip";
   let stateRoot = null;
   try {
-    const m = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, commitOid, "meta")));
+    const m = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, commitOid, "meta") ?? new Uint8Array()));
     codec = m.codec ?? "gzip";
     stateRoot = m.stateRoot ?? null;
   } catch {
@@ -1571,7 +1573,7 @@ async function lawParity(eng, ws, lawHash) {
 }
 async function pushCheckpoint(eng, ws, ledger, lawHash) {
   try {
-    lawHash = await lawParity(eng, ws, lawHash);
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
     if (!lawHash) return { pushed: false, reason: "no-law" };
     const gitdir = gitdirOf(ws);
     const head = kgit.resolveRef(eng, gitdir, "refs/heads/main");
@@ -1588,12 +1590,12 @@ async function pushCheckpoint(eng, ws, ledger, lawHash) {
     eng._ckptPushed.set(ws, tag);
     return { pushed: true, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
   } catch (e) {
-    return { pushed: false, reason: String(e && e.message || e).slice(0, 160) };
+    return { pushed: false, reason: String(e?.message || e).slice(0, 160) };
   }
 }
 async function stageCheckpoint(eng, ws, lawHash) {
   try {
-    lawHash = await lawParity(eng, ws, lawHash);
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
     if (!lawHash) return null;
     eng._ckptPushed ??= /* @__PURE__ */ new Map();
     const ex = exportCheckpoint(eng, ws);
@@ -1631,7 +1633,7 @@ async function restoreCheckpointFromCustody(eng, ws, ledger, lawHash) {
     if (mounted?.checkpoint?.restored) {
       return { restored: false, reason: "already-mounted-checkpoint" };
     }
-    lawHash = await lawParity(eng, ws, lawHash);
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
     if (!lawHash) return { restored: false, reason: "no-law" };
     const ref = CKPT_REF(lawHash);
     const serverRefs = await custodyLsRefs(ledger, ref);
@@ -1646,7 +1648,7 @@ async function restoreCheckpointFromCustody(eng, ws, ledger, lawHash) {
     }
     return { restored: r && r.restored === true, frontierSeeded: r && r.frontierSeeded === true, cursor: r && r.cursor, reason: r && r.reason };
   } catch (e) {
-    return { restored: false, reason: String(e && e.message || e).slice(0, 160) };
+    return { restored: false, reason: String(e?.message || e).slice(0, 160) };
   }
 }
 async function custodySkeleton(eng, gitdir) {
@@ -1655,7 +1657,7 @@ async function custodySkeleton(eng, gitdir) {
     try {
       await p.mkdir(`${gitdir}${d}`);
     } catch (e) {
-      if (e && e.code !== "EEXIST") throw e;
+      if (e?.code !== "EEXIST") throw e;
     }
   }
   try {
@@ -1673,11 +1675,14 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   const refs = await custodyLsRefs(ledger, remoteRefFull);
   const tip = refs[remoteRefFull] || null;
   if (!tip) return null;
-  if (tip !== have) applyPackInto(eng, ws, await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] }));
+  if (tip !== have) {
+    const pk = await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
+    if (pk) applyPackInto(eng, ws, pk);
+  }
   kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
-async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null } = {}) {
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
   const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
@@ -1849,18 +1854,18 @@ async function ingestPackAsCustody(eng, ws, packBytes, head) {
   eng.mounted.set(ws, { restored: true, remoteMain: head, restoreError: null });
   return { ok: true, head: kgit.resolveRef(eng, gitdir, "refs/heads/main") };
 }
-function offerIntent(eng, ws, bytes, opts) {
+function offerIntent(eng, ws, bytes, opts = {}) {
   const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
   const deferProjection = !!(opts && opts.defer);
   const branch = opts && opts.branch || BRANCH;
   return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
 }
-function offerAdmit(eng, ws, bytes, opts) {
+function offerAdmit(eng, ws, bytes, opts = {}) {
   const v = offerIntent(eng, ws, bytes, opts);
   return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
 }
-function applyIntentBytes(eng, ws, bytes, opts) {
+function applyIntentBytes(eng, ws, bytes, opts = {}) {
   return offerAdmit(eng, ws, bytes, opts);
 }
 async function mainIntentIds(eng, ws) {
@@ -1936,7 +1941,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
         try {
           await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: localMain });
         } catch (thinErr) {
-          log("thin-fetch-fallback", { ws, cid, error: String(thinErr && thinErr.message || thinErr).slice(0, 160) });
+          log("thin-fetch-fallback", { ws, cid, error: String(thinErr?.message || thinErr).slice(0, 160) });
           await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: null });
         }
       } finally {
@@ -1945,7 +1950,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       }
       const _walkDone = _span(`walk ${shortCid}`, "cwalk", 2, { client: cid });
       const main2 = await mainIntentIds(eng, ws);
-      const recent = kgit.intentsAbove(eng, gitdir, head, "", 100);
+      const recent = kgit.intentsAbove(eng, gitdir, head ?? "", "", 100);
       const chain = [];
       for (let i = recent.length - 1; i >= 0; i--) {
         if (main2.oids.has(recent[i].oid)) break;
@@ -2034,7 +2039,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
             main2.oids.add(res.head);
             main2.head = res.head;
             admitted.push({ oid: oid.slice(0, 10), head: res.head });
-            if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head, intentId);
+            if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head ?? "", intentId);
             if (shardRouting && dirId) {
               const placement = placementDirectives(eng).get(dirId);
               if (placement) {
@@ -2043,7 +2048,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
                   p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
                 } catch {
                 }
-                const homeKey = p ? p[placement.keyField] : void 0;
+                const homeKey = p ? p[String(placement.keyField)] : void 0;
                 if (typeof homeKey === "string" && typeof p?.shard === "string") {
                   placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
                 }
@@ -2171,7 +2176,7 @@ async function backupHead(eng, ws, ledger, head) {
     await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
     return { ok: true, head };
   } catch (e) {
-    return { ok: false, error: String(e && e.message || e).slice(0, 200), head };
+    return { ok: false, error: String(e?.message || e).slice(0, 200), head };
   }
 }
 async function backupToCustody(eng, ws, ledger, { consumed = [] } = {}) {
@@ -2227,7 +2232,7 @@ async function rebirthCompact(eng, ws, ledger, { reason = "", supersededAt = 0,
         return false;
       }
     };
-    const transformState = (sealedBytes) => sealedBytes;
+    const transformState = (sealedBytes, _ctx) => sealedBytes;
     const carried = [];
     const parkedIntents = [];
     const parkedBlobs = [];
@@ -2322,7 +2327,7 @@ async function rebirthCompact(eng, ws, ledger, { reason = "", supersededAt = 0,
       unmount(eng, incWs);
     } catch {
     }
-    return { ok: false, error: String(e && e.message || e).slice(0, 300) };
+    return { ok: false, error: String(e?.message || e).slice(0, 300) };
   }
 }
 async function archiveRefusedMain(eng, ws, ledger, label) {
@@ -2349,7 +2354,7 @@ async function writeRefusedRef(eng, ws, dl) {
   try {
     const prevOid = kgit.resolveRef(eng, gitdir, refForStamp);
     if (prevOid) {
-      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, prevOid, "verdict.json")));
+      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, prevOid, "verdict.json") ?? new Uint8Array()));
       if (prev && typeof prev.parkedAt === "string") parkedAt = prev.parkedAt;
     }
   } catch {
@@ -2379,8 +2384,8 @@ async function listRefusedRefs(eng, ws) {
   const out13 = [];
   for (const { ref, oid } of refs) {
     try {
-      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json");
-      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json");
+      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array();
+      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json") ?? new Uint8Array();
       const v = JSON.parse(dec3.decode(vb));
       out13.push({ ref, ...v, intentB64: b64Bytes(ib) });
     } catch {
@@ -2394,7 +2399,7 @@ async function refusedSummary(eng, ws) {
   let count2 = 0, latestParkedAt = null;
   for (const { oid } of refs) {
     try {
-      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json")));
+      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array()));
       count2++;
       if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
     } catch {
@@ -2532,7 +2537,7 @@ async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}
   return { head: result.head, installation };
 }
 function snapshot(eng, ws) {
-  const wsDir = eng.preopen.dir.contents.get("ws").contents.get(ws);
+  const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
   return serializeTree(wsDir);
 }
 function stats(eng) {
@@ -2562,7 +2567,7 @@ async function ledgerStats(eng, ws, ledger = null) {
   }
   if (!head) return { head: null, commits: 0 };
   const mounted = eng.mounted.get(ws);
-  if (mounted?.ledgerStats?.head === head) return mounted.ledgerStats;
+  if (mounted && mounted.ledgerStats?.head === head) return mounted.ledgerStats;
   const commits = kgit.intentsAbove(eng, gitdir, head).length;
   const out13 = { head, commits };
   if (mounted) mounted.ledgerStats = out13;
@@ -2580,7 +2585,7 @@ async function countRemoteCommits(eng, ledger) {
     return { head, commits };
   } finally {
     try {
-      eng.preopen.dir.contents.get("ws").contents.delete(scratch);
+      dirOf(eng.preopen.dir.contents.get("ws")).contents.delete(scratch);
     } catch {
     }
   }
@@ -2629,9 +2634,9 @@ function sealAttestationBatches(eng, ws, domain, controllerHash, opts = {}) {
   }
   return outcomes;
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, projectionStats;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, projectionStats;
 var init_engine = __esm({
-  "vendor/engine/engine.mjs"() {
+  "vendor/engine/engine.ts"() {
     "use strict";
     init_git_fs();
     init_tree();
@@ -2640,6 +2645,7 @@ var init_engine = __esm({
     dec3 = new TextDecoder();
     BRANCH = "main";
     RESULT_PACK_INLINE_MAX = 256 * 1024;
+    dirOf = (n) => n;
     repoArgOf = (ws) => `/work/ws/${ws}`;
     gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
     unpack = (p) => {
@@ -2724,7 +2730,7 @@ var init_engine = __esm({
     certSign = (eng, { child, founder, verified, parentKey, parentId, epoch, secret }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "certSign", child, founder, verified, parentKey, parentId, epoch, secret }) }, eng.STDERR)).cert;
     cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoWrapKey", recipientPub, scopeKey }) }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng.STDERR)).scopeKey;
-    readPosture = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture" }), principal, branch: BRANCH }, eng.STDERR));
+    readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture", authToken, nowUnix }), principal, branch: BRANCH }, eng.STDERR));
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     pendingConflicts = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts" }), principal, branch: BRANCH }, eng.STDERR));
@@ -4480,6 +4486,108 @@ var init_governance = __esm({
   }
 });
 
+// src/capabilities.ts
+var capabilities_exports = {};
+__export(capabilities_exports, {
+  INLINE_OFFER_CAP_CHARS: () => INLINE_OFFER_CAP_CHARS,
+  negotiateDeployRoute: () => negotiateDeployRoute,
+  openapiRoutesDirective: () => openapiRoutesDirective,
+  probeCloudCapabilities: () => probeCloudCapabilities,
+  probeKernelCapabilities: () => probeKernelCapabilities,
+  probeOfferLane: () => probeOfferLane,
+  probeStageLane: () => probeStageLane
+});
+async function probeStageLane(cloud, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud}/v2/stage/${ZERO_SHA}`, { method: "GET" });
+    const body = await r.json().catch(() => void 0);
+    return typeof body?.staged === "boolean";
+  } catch {
+    return void 0;
+  }
+}
+async function probeKernelCapabilities(cloud, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud.replace(/\/+$/, "")}/v1/runtime/capabilities`, { method: "GET" });
+    if (!r.ok) return void 0;
+    const body = await r.json().catch(() => void 0);
+    return body && typeof body === "object" ? body : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function openapiRoutesDirective(spec, domain, directiveId) {
+  const paths = spec?.paths ?? {};
+  const wantPath = `/${domain}/${directiveId}`;
+  const wantBare = `/${directiveId}`;
+  const wantOp = `${domain}__${directiveId}`;
+  for (const [p, ops] of Object.entries(paths)) {
+    if (p === wantPath || p === wantBare) return true;
+    for (const method of Object.values(ops ?? {})) {
+      if (method?.operationId === wantOp) return true;
+    }
+  }
+  return false;
+}
+async function probeOfferLane(cloud, ws, route, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`${cloud}/v2/workspaces/${ws}/openapi.json`, { method: "GET" });
+    if (!r.ok) return { served: false, routesTarget: void 0 };
+    const spec = await r.json().catch(() => void 0);
+    if (spec === void 0 || typeof spec !== "object") return { served: false, routesTarget: void 0 };
+    const served = true;
+    const routesTarget = route === void 0 ? void 0 : openapiRoutesDirective(spec, route.domain, route.directiveId);
+    return { served, routesTarget };
+  } catch {
+    return { served: void 0, routesTarget: void 0 };
+  }
+}
+async function probeCloudCapabilities(cloud, ws, route, fetchImpl = fetch) {
+  const [stage, offer] = await Promise.all([
+    probeStageLane(cloud, fetchImpl),
+    probeOfferLane(cloud, ws, route, fetchImpl)
+  ]);
+  return {
+    cloud,
+    stage,
+    offerLane: offer.served,
+    routesTarget: offer.routesTarget,
+    openDeploy: void 0
+    // the open /domains lane is universal in every worker/dev-server; not separately probed
+  };
+}
+function negotiateDeployRoute(caps, opts) {
+  if (opts.signed) {
+    if (caps.offerLane === false) {
+      return {
+        fail: `${caps.cloud} does not serve the SIGNED OFFER lane \u2014 POST /v2/workspaces/${opts.ws}/${opts.route.domain}/${opts.route.directiveId} is not routed (the workspace serves no self-describing OpenAPI, so this cloud has no gateway to route a signed offer). This is often a lightweight cloud (e.g. \`githolon cloud dev\`) without the offer gateway.
+  \u2192 deploy the OPEN (unsigned) lane instead (drop --as/--principal) if this workspace is unwarranted, or target a cloud that serves the offer gateway.`
+      };
+    }
+    if (caps.offerLane === true && caps.routesTarget === false) {
+      return {
+        fail: `${caps.cloud} serves the offer gateway for ${opts.ws}, but its OpenAPI does not name the route ${opts.route.domain}/${opts.route.directiveId} \u2014 the ${opts.route.domain} controller is not installed here, so a signed ${opts.route.directiveId} would 404.
+  \u2192 confirm the workspace is born and the controller is deployed, or deploy the OPEN lane (drop --as).`
+      };
+    }
+    if (opts.sealedSizeChars > INLINE_OFFER_CAP_CHARS && caps.stage === false) {
+      return {
+        fail: `this signed package is ~${Math.round(opts.sealedSizeChars / (1024 * 1024))} MiB sealed \u2014 over the ${INLINE_OFFER_CAP_CHARS / (1024 * 1024)} MiB inline offer cap \u2014 and ${caps.cloud} has no /v2/stage content-addressed lane to carry it.
+  \u2192 target a cloud that serves /v2/stage, or shrink the package (githolon compile --compact).`
+      };
+    }
+  }
+  return void 0;
+}
+var INLINE_OFFER_CAP_CHARS, ZERO_SHA;
+var init_capabilities = __esm({
+  "src/capabilities.ts"() {
+    "use strict";
+    INLINE_OFFER_CAP_CHARS = 8 * 1024 * 1024;
+    ZERO_SHA = "0".repeat(64);
+  }
+});
+
 // src/lifecycle.ts
 var lifecycle_exports = {};
 __export(lifecycle_exports, {
@@ -4791,97 +4899,6 @@ var init_lifecycle = __esm({
   }
 });
 
-// src/capabilities.ts
-var capabilities_exports = {};
-__export(capabilities_exports, {
-  INLINE_OFFER_CAP_CHARS: () => INLINE_OFFER_CAP_CHARS,
-  negotiateDeployRoute: () => negotiateDeployRoute,
-  openapiRoutesDirective: () => openapiRoutesDirective,
-  probeCloudCapabilities: () => probeCloudCapabilities,
-  probeOfferLane: () => probeOfferLane,
-  probeStageLane: () => probeStageLane
-});
-async function probeStageLane(cloud, fetchImpl = fetch) {
-  try {
-    const r = await fetchImpl(`${cloud}/v2/stage/${ZERO_SHA}`, { method: "GET" });
-    const body = await r.json().catch(() => void 0);
-    return typeof body?.staged === "boolean";
-  } catch {
-    return void 0;
-  }
-}
-function openapiRoutesDirective(spec, domain, directiveId) {
-  const paths = spec?.paths ?? {};
-  const wantPath = `/${domain}/${directiveId}`;
-  const wantBare = `/${directiveId}`;
-  const wantOp = `${domain}__${directiveId}`;
-  for (const [p, ops] of Object.entries(paths)) {
-    if (p === wantPath || p === wantBare) return true;
-    for (const method of Object.values(ops ?? {})) {
-      if (method?.operationId === wantOp) return true;
-    }
-  }
-  return false;
-}
-async function probeOfferLane(cloud, ws, route, fetchImpl = fetch) {
-  try {
-    const r = await fetchImpl(`${cloud}/v2/workspaces/${ws}/openapi.json`, { method: "GET" });
-    if (!r.ok) return { served: false, routesTarget: void 0 };
-    const spec = await r.json().catch(() => void 0);
-    if (spec === void 0 || typeof spec !== "object") return { served: false, routesTarget: void 0 };
-    const served = true;
-    const routesTarget = route === void 0 ? void 0 : openapiRoutesDirective(spec, route.domain, route.directiveId);
-    return { served, routesTarget };
-  } catch {
-    return { served: void 0, routesTarget: void 0 };
-  }
-}
-async function probeCloudCapabilities(cloud, ws, route, fetchImpl = fetch) {
-  const [stage, offer] = await Promise.all([
-    probeStageLane(cloud, fetchImpl),
-    probeOfferLane(cloud, ws, route, fetchImpl)
-  ]);
-  return {
-    cloud,
-    stage,
-    offerLane: offer.served,
-    routesTarget: offer.routesTarget,
-    openDeploy: void 0
-    // the open /domains lane is universal in every worker/dev-server; not separately probed
-  };
-}
-function negotiateDeployRoute(caps, opts) {
-  if (opts.signed) {
-    if (caps.offerLane === false) {
-      return {
-        fail: `${caps.cloud} does not serve the SIGNED OFFER lane \u2014 POST /v2/workspaces/${opts.ws}/${opts.route.domain}/${opts.route.directiveId} is not routed (the workspace serves no self-describing OpenAPI, so this cloud has no gateway to route a signed offer). This is often a lightweight cloud (e.g. \`githolon cloud dev\`) without the offer gateway.
-  \u2192 deploy the OPEN (unsigned) lane instead (drop --as/--principal) if this workspace is unwarranted, or target a cloud that serves the offer gateway.`
-      };
-    }
-    if (caps.offerLane === true && caps.routesTarget === false) {
-      return {
-        fail: `${caps.cloud} serves the offer gateway for ${opts.ws}, but its OpenAPI does not name the route ${opts.route.domain}/${opts.route.directiveId} \u2014 the ${opts.route.domain} controller is not installed here, so a signed ${opts.route.directiveId} would 404.
-  \u2192 confirm the workspace is born and the controller is deployed, or deploy the OPEN lane (drop --as).`
-      };
-    }
-    if (opts.sealedSizeChars > INLINE_OFFER_CAP_CHARS && caps.stage === false) {
-      return {
-        fail: `this signed package is ~${Math.round(opts.sealedSizeChars / (1024 * 1024))} MiB sealed \u2014 over the ${INLINE_OFFER_CAP_CHARS / (1024 * 1024)} MiB inline offer cap \u2014 and ${caps.cloud} has no /v2/stage content-addressed lane to carry it.
-  \u2192 target a cloud that serves /v2/stage, or shrink the package (githolon compile --compact).`
-      };
-    }
-  }
-  return void 0;
-}
-var INLINE_OFFER_CAP_CHARS, ZERO_SHA;
-var init_capabilities = __esm({
-  "src/capabilities.ts"() {
-    "use strict";
-    INLINE_OFFER_CAP_CHARS = 8 * 1024 * 1024;
-    ZERO_SHA = "0".repeat(64);
-  }
-});
-
 // src/cloud.ts
 var cloud_exports = {};
 __export(cloud_exports, {
@@ -5273,6 +5290,29 @@ async function deploy2(ws, opts) {
   const beforeLaw = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((br) => br.json()).then((bd) => bd.ok === true ? bd : {}).catch(() => ({}));
   const before = beforeLaw.domains ?? [];
   const currentLaw2 = beforeLaw.currentLaw ?? {};
+  try {
+    const compat = JSON.parse(readFileSync5(file, "utf8")).nomosCompat;
+    const requires = compat?.requiresKernel ?? [];
+    if (requires.length > 0) {
+      const { probeKernelCapabilities: probeKernelCapabilities2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+      const report = await probeKernelCapabilities2(cloud);
+      const kernel = report?.prod;
+      if (kernel?.features) {
+        const missing = requires.filter((f) => !kernel.features.includes(f));
+        if (missing.length > 0) {
+          const lawH = String(compat?.lawHash ?? "").slice(0, 8);
+          const kernH = String(kernel.hash ?? "").slice(0, 8);
+          err4(
+            `deploy '${ws}' REFUSED \u2014 release coherence: kernel ${kernH} lacks capability '${missing.join("', '")}' that law ${lawH} requires (the cloud runs a STALE kernel: ${kernel.note ?? kernel.version}).` + (missing.includes("compoundKeys") ? `
+  A compound-key query (\`.key(a, b, \u2026)\`) would be refused deep in a law fold ("query declares N index keys; the read router supports exactly one").` : "") + `
+  Point at a cloud whose kernel is coherent with this release, or upgrade the cloud's kernel.`
+          );
+          return 1;
+        }
+      }
+    }
+  } catch {
+  }
   const { readDeployBody: readDeployBody3, domainKeysOf: domainKeysOf2, packageHashOf: packageHashOf2, resolveDeployPlan: resolveDeployPlan2, describeDeployPlan: describeDeployPlan2 } = await Promise.resolve().then(() => (init_lifecycle(), lifecycle_exports));
   let plan;
   let targetHash;
@@ -5339,9 +5379,10 @@ async function deploy2(ws, opts) {
     }
     deployedHash = targetHash2;
   } else {
+    const presented = opts.principal ?? await sessionToken().catch(() => void 0) ?? activePrincipal();
     const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...presented !== void 0 ? principalHeaders(presented) : {} },
       body: readFileSync5(file, "utf8")
     });
     const d = await r.json().catch(() => void 0);
@@ -5645,9 +5686,9 @@ function parseOfflineLegs(proofSource) {
   }
   const domain = dom[1];
   const autoStamped = [];
-  const stampLine = proofSource.split("\n").find((l) => l.includes("omitted \u2014 the client auto-stamps ISO now()"));
-  if (stampLine !== void 0) {
-    for (const m of stampLine.matchAll(/`(\w+)`/g)) autoStamped.push(m[1]);
+  const stampLine2 = proofSource.split("\n").find((l) => l.includes("omitted \u2014 the client auto-stamps ISO now()"));
+  if (stampLine2 !== void 0) {
+    for (const m of stampLine2.matchAll(/`(\w+)`/g)) autoStamped.push(m[1]);
   }
   let queryLeg;
   const q = proofSource.match(/local declared query (\w+):/);
@@ -6553,6 +6594,84 @@ var init_harness = __esm({
   }
 });
 
+// src/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  doctor: () => doctor
+});
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
+function readLocalCompat(cwd, file) {
+  try {
+    const path = discoverDeployJson(cwd, file);
+    if (!existsSync14(path)) return void 0;
+    const body = JSON.parse(readFileSync15(path, "utf8"));
+    return body.nomosCompat;
+  } catch {
+    return void 0;
+  }
+}
+function stampLine(label, stamp) {
+  if (!stamp) return `  ${label.padEnd(12)}: (not advertised)`;
+  const h = String(stamp.hash || "").slice(0, 12);
+  const caps = stamp.features?.length ? `[${stamp.features.join(", ")}]` : "[]";
+  const known = stamp.known ? "" : "  \u26A0 UNKNOWN to registry";
+  return `  ${label.padEnd(12)}: ${h}\u2026 ${stamp.version ?? ""}${known}
+                caps ${caps}`;
+}
+async function doctor(opts = {}) {
+  const cloud = cloudBase(opts.cloud);
+  const compat = readLocalCompat(process.cwd(), opts.file);
+  const report = await probeKernelCapabilities(cloud);
+  const out13 = [];
+  out13.push(`githolon doctor \u2014 release coherence`);
+  out13.push(`  cloud       : ${cloud}`);
+  out13.push(`  compiler    : @githolon/dsl ${compat?.generator?.dsl ?? "(no local build \u2014 run `githolon compile`)"}`);
+  out13.push(`  runner      : cloud expects bundle version ${report?.expectedBundleVersion ?? "(not advertised)"}`);
+  out13.push(stampLine("prod kernel", report?.prod));
+  out13.push(stampLine("test kernel", report?.testmint));
+  const requires = compat?.requiresKernel ?? [];
+  if (!compat) {
+    out13.push(``);
+    out13.push(`  \u26A0 no local build found \u2014 cannot check the law\u2194kernel fit. Run \`githolon compile\` first.`);
+    process.stdout.write(out13.join("\n") + "\n");
+    return report ? 0 : 1;
+  }
+  if (!report?.prod) {
+    out13.push(``);
+    out13.push(`  \u26A0 cloud advertises no kernel capabilities (older worker?) \u2014 coherence UNVERIFIABLE.`);
+    out13.push(`    law ${String(compat.lawHash).slice(0, 8)} requires: [${requires.join(", ") || "none"}]`);
+    process.stdout.write(out13.join("\n") + "\n");
+    return 0;
+  }
+  const feats = report.prod.features ?? [];
+  const missing = requires.filter((f) => !feats.includes(f));
+  out13.push(``);
+  const lawH = String(compat.lawHash || "").slice(0, 8);
+  const kernH = String(report.prod.hash || "").slice(0, 8);
+  if (requires.length === 0) {
+    out13.push(`  \u2713 COHERENT \u2014 law ${lawH} requires no special kernel capabilities.`);
+  } else if (missing.length === 0) {
+    out13.push(`  \u2713 COHERENT \u2014 kernel ${kernH} supports all capabilities law ${lawH} requires: [${requires.join(", ")}].`);
+  } else {
+    out13.push(`  \u2717 SKEW \u2014 kernel ${kernH} lacks capability '${missing.join("', '")}' that law ${lawH} requires.`);
+    out13.push(`    The cloud is running a STALE kernel (${report.prod.note ?? report.prod.version ?? "unknown build"}).`);
+    if (missing.includes("compoundKeys")) {
+      out13.push(`    A compound-key query (\`.key(a, b, \u2026)\`) will be refused deep in a law fold with`);
+      out13.push(`    "query declares N index keys; the read router supports exactly one".`);
+    }
+    out13.push(`    Point at a cloud whose kernel is coherent with this release, or upgrade the cloud's kernel.`);
+  }
+  process.stdout.write(out13.join("\n") + "\n");
+  return missing.length > 0 ? 1 : 0;
+}
+var init_doctor = __esm({
+  "src/doctor.ts"() {
+    "use strict";
+    init_cloud();
+    init_capabilities();
+  }
+});
+
 // src/scene_projector.ts
 import { createHash as createHash4 } from "node:crypto";
 function fnv1a32(s) {
@@ -7609,7 +7728,7 @@ var scene_exports = {};
 __export(scene_exports, {
   scene: () => scene
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join16, resolve as resolve4 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 import git3 from "isomorphic-git";
@@ -7631,8 +7750,8 @@ async function projectOnce(cloud, target, isDir, name) {
   const { eng } = await holonEngine(cloud, void 0, "githolon-scene");
   const SOURCE3 = "source";
   if (isDir) {
-    const gitDir = existsSync14(join16(target, ".git")) ? join16(target, ".git") : target;
-    if (!existsSync14(join16(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
+    const gitDir = existsSync15(join16(target, ".git")) ? join16(target, ".git") : target;
+    if (!existsSync15(join16(gitDir, "HEAD"))) throw new Error(`${target} is not a git repo (no HEAD)`);
     await mountFresh(eng, SOURCE3);
     eng.preopen.dir.contents.get("ws").contents.get(SOURCE3).contents.set("nomos.git", readTreeFromDisk(gitDir));
   } else {
@@ -7691,7 +7810,7 @@ async function projectOnce(cloud, target, isDir, name) {
 }
 async function scene(target, opts) {
   const cloud = cloudBase(opts.cloud);
-  const isDir = existsSync14(target) || target.includes("/") || target.startsWith(".");
+  const isDir = existsSync15(target) || target.includes("/") || target.startsWith(".");
   const name = isDir ? (resolve4(target).split("/").filter(Boolean).pop() ?? "scene").replace(/\.git$/, "") : target;
   out11(`scene \u2014 ${name} (${isDir ? resolve4(target) : `${cloud} :: ${target}`})`);
   let first, second;
@@ -7802,7 +7921,7 @@ var init_dlq = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync16, readdirSync as readdirSync6, readFileSync as readFileSync16 } from "node:fs";
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { createRequire as createRequire3 } from "node:module";
 import { dirname as dirname9, join as join17, resolve as resolve5 } from "node:path";
@@ -8436,23 +8555,21 @@ async function gitRemote(ws, name, opts) {
     }
   }
   const token = await sessionToken().catch(() => void 0);
-  if (token === void 0) {
-    const principal = loadCreds().principal;
-    if (principal === void 0) {
-      err6(
-        `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
+  const principal = currentPrincipal();
+  if (principal === void 0) {
+    err6(
+      `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
   githolon login --agent   (then just push)
   \u2014 or re-run after githolon ws create/login so a principal is on file`
-      );
-      return 1;
-    }
-    if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
-      err6("git config failed setting the principal header");
-      return 1;
-    }
+    );
+    return 1;
+  }
+  if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
+    err6("git config failed setting the principal header");
+    return 1;
   }
   out6(`\u2713 remote '${name}' \u2192 ${url}`);
-  out6(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
+  out6(`  workspace secret on file; ${token !== void 0 ? "births ride your session token (verified) + x-nomos-principal claim" : "births ride x-nomos-principal (bare uid)"}`);
   out6(`  birth/deploy by push:  git push ${name} main`);
   return 0;
 }
@@ -9436,10 +9553,10 @@ async function runProof(args) {
   let proofPath;
   if (explicit !== void 0) {
     proofPath = resolve5(process.cwd(), explicit);
-    if (!existsSync15(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
+    if (!existsSync16(proofPath)) return refuse(`proof not found: ${proofPath} \u2014 run \`githolon compile\` to (re)generate it`);
   } else {
     const buildDir = join17(process.cwd(), "build");
-    if (!existsSync15(buildDir)) {
+    if (!existsSync16(buildDir)) {
       return refuse("no build/ directory here \u2014 run `githolon compile` first (every compile generates build/<name>.proof.mts from your law)");
     }
     const proofs = readdirSync6(buildDir).filter((f) => f.endsWith(".proof.mts"));
@@ -9482,7 +9599,7 @@ async function runProof(args) {
   if (tsxDir === void 0) {
     return refuse("tsx not found \u2014 add @githolon/dsl to your project's dependencies (tsx rides along) and npm install");
   }
-  const tsxPkg = JSON.parse(readFileSync15(join17(tsxDir, "package.json"), "utf8"));
+  const tsxPkg = JSON.parse(readFileSync16(join17(tsxDir, "package.json"), "utf8"));
   const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.["tsx"];
   const tsxCli = join17(tsxDir, tsxBinRel ?? "dist/cli.mjs");
   console.log("githolon proof --live \u2014 the full cloud loop (throwaway workspace, retired on exit" + (keep ? "; --keep: kept" : "") + ")");
@@ -9687,6 +9804,17 @@ ${commandHelp("dev")}`);
       ...once ? { once: true } : {}
     });
   }
+  if (argv[0] === "doctor") {
+    const rest = argv.slice(1);
+    let cloudFlag;
+    let fileFlag;
+    for (let i = 0; i < rest.length; i++) {
+      if (rest[i] === "--cloud") cloudFlag = rest[++i];
+      else if (rest[i] === "--file") fileFlag = rest[++i];
+    }
+    const { doctor: doctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
+    return doctor2({ ...cloudFlag !== void 0 ? { cloud: cloudFlag } : {}, ...fileFlag !== void 0 ? { file: fileFlag } : {} });
+  }
   if (argv[0] === "cloud") {
     const sub2 = argv[1];
     if (sub2 !== "dev") {
@@ -9707,7 +9835,7 @@ usage: githolon cloud dev [--port <n>] [--data <dir>] [--ephemeral]
       resolve5(here, "../../../cloud/dev-server/server.mjs"),
       resolve5(process.cwd(), "cloud/dev-server/server.mjs")
     ];
-    const serverPath = candidates.find((p) => existsSync15(p));
+    const serverPath = candidates.find((p) => existsSync16(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;