githolon 0.92.0 → 0.94.0

package/dist/dev-server.mjs

@@ -1,2484 +0,0 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// ../adapter/git-fs.mjs
-function fsErr(code, p) {
-  const e = new Error(`${code}: ${p}`);
-  e.code = code;
-  return e;
-}
-function makeGitFs(preopen, mount, { File: File2, Directory: Directory2 }) {
-  const root = preopen.dir;
-  const isDir = (n) => n && n.contents instanceof Map;
-  function parts(p) {
-    if (p === mount) return [];
-    if (!p.startsWith(mount + "/")) throw fsErr("ENOENT", p);
-    const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
-    return rel === "" ? [] : rel.split("/");
-  }
-  function resolve(ps) {
-    let cur = root;
-    for (const part of ps) {
-      if (!isDir(cur)) return null;
-      const next = cur.contents.get(part);
-      if (next === void 0) return null;
-      cur = next;
-    }
-    return cur;
-  }
-  const parent = (ps) => resolve(ps.slice(0, -1));
-  const leaf = (ps) => ps[ps.length - 1];
-  const promises = {
-    async readFile(p, opts) {
-      const n = resolve(parts(p));
-      if (n === null) throw fsErr("ENOENT", p);
-      if (isDir(n)) throw fsErr("EISDIR", p);
-      const data = n.data ?? new Uint8Array(0);
-      const encoding = typeof opts === "string" ? opts : opts && opts.encoding;
-      return encoding ? new TextDecoder().decode(data) : new Uint8Array(data);
-    },
-    async writeFile(p, data) {
-      const ps = parts(p);
-      const par = parent(ps);
-      if (!isDir(par)) throw fsErr("ENOENT", p);
-      const bytes = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
-      par.contents.set(leaf(ps), new File2(bytes));
-    },
-    async unlink(p) {
-      const ps = parts(p), par = parent(ps);
-      if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
-    },
-    async readdir(p) {
-      const n = resolve(parts(p));
-      if (n === null) throw fsErr("ENOENT", p);
-      if (!isDir(n)) throw fsErr("ENOTDIR", p);
-      return [...n.contents.keys()];
-    },
-    async mkdir(p) {
-      const ps = parts(p), par = parent(ps);
-      if (!isDir(par)) throw fsErr("ENOENT", p);
-      if (par.contents.has(leaf(ps))) throw fsErr("EEXIST", p);
-      par.contents.set(leaf(ps), new Directory2(/* @__PURE__ */ new Map()));
-    },
-    async rmdir(p) {
-      const ps = parts(p), par = parent(ps);
-      if (!isDir(par)) throw fsErr("ENOENT", p);
-      par.contents.delete(leaf(ps));
-    },
-    async stat(p) {
-      return promises.lstat(p);
-    },
-    async lstat(p) {
-      const n = resolve(parts(p));
-      if (n === null) throw fsErr("ENOENT", p);
-      const dir = isDir(n);
-      return {
-        type: dir ? "dir" : "file",
-        mode: dir ? 16384 : 33188,
-        size: dir ? 0 : n.data ? n.data.length : 0,
-        ino: 0,
-        mtimeMs: 0,
-        ctimeMs: 0,
-        uid: 1,
-        gid: 1,
-        dev: 1,
-        isFile: () => !dir,
-        isDirectory: () => dir,
-        isSymbolicLink: () => false
-      };
-    },
-    async readlink(p) {
-      throw fsErr("EINVAL", p);
-    },
-    async symlink() {
-      throw fsErr("EPERM", "symlink unsupported");
-    },
-    async chmod() {
-    }
-  };
-  return { promises };
-}
-var init_git_fs = __esm({
-  "../adapter/git-fs.mjs"() {
-  }
-});
-
-// ../adapter/tree.mjs
-function flatten(dir, prefix, out) {
-  for (const [name, inode] of dir.contents) {
-    const path2 = prefix ? prefix + "/" + name : name;
-    if (inode.contents instanceof Map) {
-      out.push({ path: path2, dir: true });
-      flatten(inode, path2, out);
-    } else {
-      out.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
-    }
-  }
-}
-function serializeTree(workTree) {
-  const entries = [];
-  flatten(workTree, "", entries);
-  const chunks = [];
-  const header = new Uint8Array(4);
-  new DataView(header.buffer).setUint32(0, entries.length, true);
-  chunks.push(header);
-  for (const e of entries) {
-    const pathBytes = enc.encode(e.path);
-    const body = e.dir ? new Uint8Array(0) : e.bytes ?? new Uint8Array(0);
-    const meta = new Uint8Array(9);
-    const dv = new DataView(meta.buffer);
-    dv.setUint8(0, e.dir ? 1 : 0);
-    dv.setUint32(1, pathBytes.length, true);
-    dv.setUint32(5, body.length, true);
-    chunks.push(meta, pathBytes, body);
-  }
-  let total = 0;
-  for (const c of chunks) total += c.length;
-  const out = new Uint8Array(total);
-  let off = 0;
-  for (const c of chunks) {
-    out.set(c, off);
-    off += c.length;
-  }
-  return out;
-}
-var enc, dec;
-var init_tree = __esm({
-  "../adapter/tree.mjs"() {
-    enc = new TextEncoder();
-    dec = new TextDecoder();
-  }
-});
-
-// ../adapter/custody-transport.mjs
-function concatBytes(chunks) {
-  let n = 0;
-  for (const c of chunks) n += c.length;
-  const out = new Uint8Array(n);
-  let o = 0;
-  for (const c of chunks) {
-    out.set(c, o);
-    o += c.length;
-  }
-  return out;
-}
-function pkt(payload) {
-  const body = typeof payload === "string" ? enc2.encode(payload) : payload;
-  const len = (body.length + 4).toString(16).padStart(4, "0");
-  return concatBytes([enc2.encode(len), body]);
-}
-function readPktLines(buf, off = 0) {
-  const lines = [];
-  while (off + 4 <= buf.length) {
-    const hex = dec2.decode(buf.subarray(off, off + 4));
-    if (!/^[0-9a-f]{4}$/.test(hex)) break;
-    const len = parseInt(hex, 16);
-    if (len === 0) {
-      off += 4;
-      break;
-    }
-    if (len < 4 || off + len > buf.length) break;
-    lines.push(buf.subarray(off + 4, off + len));
-    off += len;
-  }
-  return { lines, rest: off };
-}
-async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) {
-  const r = await fetch(`${remote}/info/refs?service=${service}`, { headers });
-  if (!r.ok) {
-    if (r.status === 404) return {};
-    throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
-  }
-  const buf = new Uint8Array(await r.arrayBuffer());
-  const banner = readPktLines(buf, 0);
-  const { lines } = readPktLines(buf, banner.rest);
-  const refs = {};
-  for (const line of lines) {
-    let s = dec2.decode(line).replace(/\n$/, "");
-    if (s.startsWith("#")) continue;
-    const nul = s.indexOf("\0");
-    if (nul >= 0) s = s.slice(0, nul);
-    const sp = s.indexOf(" ");
-    if (sp !== 40) continue;
-    const oid = s.slice(0, 40), name = s.slice(41);
-    if (!/^[0-9a-f]{40}$/.test(oid)) continue;
-    if (prefix && !name.startsWith(prefix)) continue;
-    refs[name] = oid;
-  }
-  return refs;
-}
-async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
-  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
-  if (!wants.length) return null;
-  const caps = "thin-pack ofs-delta agent=nomos-cloud";
-  const parts = [];
-  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
-`)));
-  parts.push(FLUSH);
-  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
-`));
-  parts.push(pkt("done\n"));
-  const r = await fetch(`${remote}/git-upload-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
-    body: concatBytes(parts)
-  });
-  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
-  const buf = new Uint8Array(await r.arrayBuffer());
-  const { lines, rest } = readPktLines(buf, 0);
-  const packChunks = [];
-  let sideband = false;
-  for (const line of lines) {
-    if (line.length === 0) continue;
-    const head = dec2.decode(line.subarray(0, Math.min(line.length, 3)));
-    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
-    const band = line[0];
-    if (band === 1) {
-      packChunks.push(line.subarray(1));
-      sideband = true;
-    } else if (band === 2) {
-    } else if (band === 3) {
-      throw new Error("upload-pack fatal: " + dec2.decode(line.subarray(1)).slice(0, 180));
-    }
-  }
-  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
-  if (pack.length < 12 || dec2.decode(pack.subarray(0, 4)) !== "PACK") {
-    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
-  }
-  return pack;
-}
-async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}) {
-  if (!updates.length) return { ok: true, noop: true };
-  const cmds = [];
-  updates.forEach((u, i) => {
-    const old = u.oldOid || ZERO_OID;
-    const neu = u.newOid || ZERO_OID;
-    const caps = i === 0 ? "\0report-status" : "";
-    cmds.push(pkt(`${old} ${neu} ${u.ref}${caps}
-`));
-  });
-  cmds.push(FLUSH);
-  const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
-  const r = await fetch(`${remote}/git-receive-pack`, {
-    method: "POST",
-    headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
-    body
-  });
-  const txt = dec2.decode(new Uint8Array(await r.arrayBuffer()));
-  const unpacked = /unpack ok/.test(txt);
-  const everyRefOk = updates.every((u) => new RegExp(`ok ${u.ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(txt));
-  if (!(r.ok && unpacked && everyRefOk && !/\bng /.test(txt))) {
-    throw new Error(`receive-pack ${r.status}: ${txt.replace(/[^\x20-\x7e]/g, " ").trim().slice(0, 200)}`);
-  }
-  return { ok: true };
-}
-var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
-var init_custody_transport = __esm({
-  "../adapter/custody-transport.mjs"() {
-    enc2 = new TextEncoder();
-    dec2 = new TextDecoder();
-    ZERO_OID = "0".repeat(40);
-    EMPTY_PACK = new Uint8Array([
-      80,
-      65,
-      67,
-      75,
-      0,
-      0,
-      0,
-      2,
-      0,
-      0,
-      0,
-      0,
-      // "PACK", ver 2, 0 objects
-      2,
-      157,
-      8,
-      130,
-      59,
-      216,
-      168,
-      234,
-      181,
-      16,
-      173,
-      106,
-      // sha1(the 12 header bytes)
-      199,
-      92,
-      130,
-      60,
-      253,
-      62,
-      211,
-      30
-    ]);
-    FLUSH = enc2.encode("0000");
-  }
-});
-
-// ../adapter/engine.mjs
-import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
-function b64Bytes(bytes) {
-  let s = "";
-  for (let i = 0; i < bytes.length; i += 32768) {
-    s += String.fromCharCode(...bytes.subarray(i, i + 32768));
-  }
-  return btoa(s);
-}
-function b64Json(o) {
-  return b64Bytes(enc3.encode(JSON.stringify(o)));
-}
-async function sha256hex(t) {
-  const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
-  return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
-}
-function osEntropyBuffer(n) {
-  const bytes = new Uint8Array(n * 8);
-  for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
-  const out = new Array(n), T = 2 ** 53;
-  for (let i = 0; i < n; i++) {
-    let z = 0n;
-    for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
-    out[i] = Number(z >> 11n) / T;
-  }
-  return out;
-}
-function stringifyBig(o) {
-  return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
-}
-function call(ex, mode, fields, STDERR) {
-  const req = enc3.encode(JSON.stringify({ mode, ...fields }));
-  const reqPtr = ex.git_holon_alloc(req.length);
-  try {
-    new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
-    let packed;
-    try {
-      packed = ex.git_holon_call(reqPtr, req.length);
-    } catch (e) {
-      const tail = STDERR.length ? ` | stderr: ${STDERR.slice(-8).join(" / ")}` : "";
-      throw new Error(`${String(e && e.stack || e)}${tail}`);
-    }
-    const { ptr, len } = unpack(packed);
-    try {
-      const e = JSON.parse(dec3.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
-      if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
-      return e.result;
-    } finally {
-      ex.git_holon_dealloc(ptr, len);
-    }
-  } finally {
-    ex.git_holon_dealloc(reqPtr, req.length);
-  }
-}
-async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy = "nomos-cloud" }) {
-  const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
-  const root = /* @__PURE__ */ new Map();
-  root.set("domain.package.usda", new File(enc3.encode(bootstrapPkg)));
-  root.set("ws", new Directory(/* @__PURE__ */ new Map()));
-  const preopen = new PreopenDirectory("/work", root);
-  const STDERR = [];
-  const pushStderr = (l) => {
-    if (STDERR.length >= 500) STDERR.splice(0, STDERR.length - 499);
-    STDERR.push(l);
-  };
-  const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {
-  }), ConsoleStdout.lineBuffered(pushStderr), preopen];
-  const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
-  const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
-  const code = wasi.start(inst);
-  if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
-  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!inst.exports[n]) throw new Error(`missing export ${n}`);
-  const eng = {
-    ex: inst.exports,
-    preopen,
-    STDERR,
-    seq: 0,
-    replica,
-    hashes,
-    bootstrapPkg,
-    nomosPkg,
-    installedBy,
-    fs: makeGitFs(preopen, "/work", { File, Directory }),
-    mounted: /* @__PURE__ */ new Map(),
-    // ws -> { restored, remoteMain, restoreError }
-    mainIntents: /* @__PURE__ */ new Map()
-    // ws -> { head, ids:Set, oids:Set } (admission idempotence)
-  };
-  return eng;
-}
-function directiveRoutes(eng) {
-  return /* @__PURE__ */ new Map();
-}
-function routeTagHexOfMintedId(id) {
-  const i = id.indexOf("_");
-  if (i <= 0) return void 0;
-  const body = id.slice(i + 1).replace(/-/g, "").toLowerCase();
-  return /^[0-9a-f]{32}$/.test(body) ? body.slice(0, 12) : void 0;
-}
-async function wrongHomeVerdict(shardRouting, route, payload) {
-  const value = payload ? payload[route.key] : void 0;
-  if (typeof value !== "string" || !value) return null;
-  const rows = await shardRouting.assignments() || [];
-  let assignment = null;
-  if (route.via === "axis") {
-    assignment = rows.find((a) => a.homeKey === value) || null;
-  } else {
-    const tag = routeTagHexOfMintedId(value);
-    if (tag !== void 0) {
-      for (const a of rows) {
-        if (await routeTagHexOfHomeKey(a.homeKey) === tag) {
-          assignment = a;
-          break;
-        }
-      }
-    }
-  }
-  if (!assignment) {
-    return {
-      error: `no shard placement for this write's home ('${route.key}': ${value.slice(0, 80)}) \u2014 author the derived placement intent (birth<Type>) on the coordinator '${shardRouting.coordinatorWs}' first, then POST /dead-letters/retry`,
-      deadLettered: true
-    };
-  }
-  const movingTo = typeof assignment.status === "string" && assignment.status.startsWith("moving:") ? assignment.status.slice("moving:".length) : null;
-  if (movingTo) {
-    return {
-      error: `home-moving: home '${value.slice(0, 80)}' is migrating ${assignment.shard} -> ${movingTo} (shard map v${assignment.mapVersion ?? 1}) \u2014 parked; a routed client retries automatically after the handoff seals`,
-      homeMoving: { homeKey: value, from: assignment.shard, target: movingTo, workspace: `${shardRouting.coordinatorWs}--${movingTo}` },
-      deadLettered: true
-    };
-  }
-  if (shardRouting.selfLabel === assignment.shard) return null;
-  const correct = `${shardRouting.coordinatorWs}--${assignment.shard}`;
-  return {
-    error: `wrong-home: this write's home is assigned to '${correct}' (shard map v${assignment.mapVersion ?? 1}) \u2014 the client's shard map is stale; a routed client re-routes and retries automatically`,
-    wrongHome: { workspace: correct, ...assignment.mapVersion !== void 0 ? { mapVersion: assignment.mapVersion } : {} }
-  };
-}
-function tenantTypes(eng) {
-  return /* @__PURE__ */ new Set();
-}
-function placementDirectives(eng) {
-  return /* @__PURE__ */ new Map();
-}
-function scopedReads(eng) {
-  return [];
-}
-function globalAggregates(eng) {
-  return /* @__PURE__ */ new Set();
-}
-function parseIntentEvents(blob) {
-  let doc;
-  try {
-    doc = JSON.parse(dec3.decode(blob));
-  } catch {
-    return [];
-  }
-  const events = Array.isArray(doc && doc.events) ? doc.events : [];
-  return events.map((ev) => {
-    const sets = /* @__PURE__ */ new Map();
-    for (const op of ev.ops || []) {
-      const v = op && op.op && op.op.Set;
-      if (v === void 0) continue;
-      if (typeof v.Str === "string") sets.set(op.field, v.Str);
-      else if (typeof v.Int === "number") sets.set(op.field, v.Int);
-    }
-    return { aggregate: String(ev.aggregate || ""), sets };
-  });
-}
-function beginSummaryCapture(eng, ws, ctx, blob) {
-  const events = parseIntentEvents(blob);
-  if (events.length === 0) return null;
-  const pre = /* @__PURE__ */ new Map();
-  const candidates = /* @__PURE__ */ new Set();
-  for (const ev of events) {
-    if (!pre.has(ev.aggregate)) {
-      const rows = qById(eng, ws, ev.aggregate);
-      pre.set(ev.aggregate, rows.length ? { type: rows[0].type, data: rows[0].data || {} } : null);
-    }
-    const before = pre.get(ev.aggregate);
-    const evType = ev.sets.get("__type") ?? (before ? before.type : void 0);
-    for (const read of ctx.reads) {
-      if (read.of !== evType) continue;
-      const oldGroup = before ? groupOf(read, before.data) : void 0;
-      if (oldGroup !== void 0) candidates.add(summaryKey(read.id, oldGroup));
-      if (read.by === null) candidates.add(summaryKey(read.id, ""));
-      else if (ev.sets.has(read.by)) candidates.add(summaryKey(read.id, String(ev.sets.get(read.by))));
-    }
-  }
-  const preTallies = /* @__PURE__ */ new Map();
-  for (const key of candidates) {
-    const [readId, group] = splitSummaryKey(key);
-    const read = ctx.reads.find((r) => r.id === readId);
-    const v = tallyOf(eng, ws, read, group);
-    preTallies.set(key, v);
-    if (!ctx.prevs.has(key)) ctx.prevs.set(key, { read, group, value: v });
-  }
-  return { events, pre, candidates, preTallies };
-}
-function finishSummaryCapture(eng, ws, ctx, cap, oid, intentId) {
-  const deltas = [];
-  for (const key of cap.candidates) {
-    const [readId, group] = splitSummaryKey(key);
-    const read = ctx.reads.find((r) => r.id === readId);
-    const after = tallyOf(eng, ws, read, group);
-    if (isExtremumRead(read)) {
-      const before = cap.preTallies.has(key) ? cap.preTallies.get(key) : null;
-      if (after !== before) {
-        deltas.push({ readId, group, delta: after });
-        if (!extremumMonotone(read, before, after)) ctx.rederived.add(key);
-      }
-    } else {
-      const before = cap.preTallies.get(key) ?? 0;
-      if (after !== before) deltas.push({ readId, group, delta: after - before });
-    }
-    ctx.values.set(key, { read, group, value: after });
-  }
-  let rowsDelta = 0;
-  for (const [aggregateId, before] of cap.pre) {
-    const rows = qById(eng, ws, aggregateId);
-    const type = rows.length ? rows[0].type : before ? before.type : void 0;
-    if (type === void 0 || !tenantTypes(eng).has(type)) continue;
-    const existsAfter = rows.length > 0;
-    const flip = !before && existsAfter ? 1 : before && !existsAfter ? -1 : 0;
-    if (flip === 0) continue;
-    rowsDelta += flip;
-    const homeKey = ctx.homeKeySet && ctx.homeKeySet.has(aggregateId) ? aggregateId : ctx.homeTags ? ctx.homeTags.get(routeTagHexOfMintedId(aggregateId) ?? "") : void 0;
-    if (homeKey !== void 0) {
-      deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: homeKey, delta: flip });
-      ctx.rowsByHome.set(homeKey, (ctx.rowsByHome.get(homeKey) ?? 0) + flip);
-    }
-  }
-  if (rowsDelta !== 0) {
-    deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: rowsDelta });
-    ctx.rowsDelta += rowsDelta;
-  }
-  if (deltas.length > 0) ctx.events.push({ oid, intentId: intentId || "", deltas });
-}
-function summaryOfCapture(ctx, fromOid, toOid) {
-  if (ctx.events.length === 0 || !toOid || fromOid === toOid) return null;
-  const touched = /* @__PURE__ */ new Set();
-  for (const ev of ctx.events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
-  const subtotals = [];
-  for (const [key, cur] of ctx.values) {
-    const extremum2 = isExtremumRead(cur.read);
-    const prev = ctx.prevs.get(key);
-    const prevValue = prev ? prev.value : extremum2 ? null : 0;
-    if (cur.value === prevValue && !touched.has(key)) continue;
-    subtotals.push({
-      readId: cur.read.id,
-      group: cur.group,
-      kind: cur.read.kind,
-      prev: prevValue,
-      value: cur.value,
-      ...extremum2 && ctx.rederived.has(key) ? { rederived: true } : {}
-    });
-  }
-  if (subtotals.length === 0 && ctx.rowsDelta === 0 && ctx.rowsByHome.size === 0) return null;
-  return {
-    fromOid: fromOid || "",
-    toOid,
-    subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
-    events: ctx.events,
-    rowsDelta: ctx.rowsDelta,
-    // SLICE 8: the exact per-home row deltas — the adapter closes each against the
-    // coordinator-held per-home subtotal exactly like the "" grand total.
-    rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1))
-  };
-}
-async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
-  const main = await mainIntentIds(eng, ws);
-  const sessions = /* @__PURE__ */ new Map();
-  const deadLetters = [];
-  let admittedTotal = 0;
-  const born = [];
-  const birthOutcomes = [];
-  const timings = { spans: [], intents: 0, sessions: 0 };
-  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0 ? { reads: scopedReads(eng), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
-  if (summaryCtx) {
-    try {
-      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
-        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
-        if (!hk) continue;
-        summaryCtx.homeKeySet.add(hk);
-        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
-      }
-    } catch (e) {
-      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
-    }
-  }
-  const gitdir0 = gitdirOf(ws);
-  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir0, BRANCH) : null;
-  const t0 = Date.now();
-  let seq = 0;
-  const span = (name, kind, depth = 1, extra = {}) => {
-    const s0 = Date.now();
-    return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
-  };
-  for (const offer of Array.isArray(offers) ? offers : []) {
-    const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
-    const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
-    sessions.set(cid, rec);
-    const done = span(`intent offer ${cid.slice(0, 14)}`, "cadmit", 1, { client: cid });
-    let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
-    try {
-      if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
-      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
-      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
-        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry intentB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
-        continue;
-      }
-      let doc = null;
-      try {
-        doc = JSON.parse(dec3.decode(blob));
-      } catch {
-      }
-      const intentId = typeof doc?.id === "string" ? doc.id : null;
-      const dom = typeof doc?.payload?.domain === "string" ? doc.payload.domain : null;
-      const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
-      const oid = String(offer?.oid || intentId || "").slice(0, 10);
-      if (!dom) {
-        rec.rejected.push({ oid, error: "non-authored intent \u2014 governance enters its own admin lane" });
-        continue;
-      }
-      if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
-        const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
-        rec.rejected.push({ oid, error, deadLettered: true });
-        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
-        continue;
-      }
-      if (intentId && main.ids.has(intentId)) {
-        rec.skipped.push({ oid, intent: intentId.slice(0, 12), alreadyOnMain: true });
-        continue;
-      }
-      const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
-      const _tOffer = Date.now();
-      const res = offerAdmit(eng, ws, blob, { defer: !summaryCtx });
-      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: !summaryCtx, ok: res.ok });
-      if (res.ok) {
-        if (intentId) main.ids.add(intentId);
-        main.oids.add(res.head);
-        main.head = res.head;
-        rec.admitted.push({ oid, head: res.head });
-        admittedTotal += 1;
-        if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
-        if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
-        if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head, intentId);
-      } else {
-        const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
-        rec.rejected.push({ oid, error, deadLettered: true });
-        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
-      }
-    } catch (e) {
-      rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: String(e).slice(0, 200) });
-    } finally {
-      done();
-    }
-  }
-  timings.sessions = sessions.size;
-  timings.intents = admittedTotal;
-  if (admittedTotal && !summaryCtx) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
-  if (deadLetters.length) {
-    try {
-      await materializeRefused(eng, ws, ledger, deadLetters);
-    } catch (e) {
-      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
-    }
-  }
-  const deferDurability = defer && !summaryCtx;
-  if (admittedTotal && !deferDurability) {
-    const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
-    await commitAndPush(eng, ws, ledger);
-    sealDone();
-  }
-  const gitdir = gitdirOf(ws);
-  const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
-  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, head) : null;
-  let resultPackB64 = null;
-  if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
-    try {
-      const p = servePack(eng, ws, clientBase);
-      if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
-    } catch {
-    }
-  }
-  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
-  const bornPacked = born.length ? packBornChildren(eng, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, ...summary ? { summary } : {}, ...bornPacked.length ? { born: bornPacked } : {}, ...birthOutcomes.length ? { birthOutcomes } : {}, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}, ...deferDurability && admittedTotal && head ? { deferred: true, head } : {} };
-}
-async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash, opts = {}) {
-  await mountWorkspace(eng, ws, ledger);
-  let res;
-  try {
-    res = author(eng, ws, domain, directiveId, payload, lawHash, opts);
-  } catch (e) {
-    return { ok: false, error: String(e && e.message || e).slice(0, 500) };
-  }
-  if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
-  await commitAndPush(eng, ws, ledger);
-  const bornPacked = Array.isArray(res.born) && res.born.length ? packBornChildren(eng, res.born) : res.born;
-  return { ok: true, head: res.head, ...bornPacked ? { born: bornPacked } : {}, ...res.birthOutcomes ? { birthOutcomes: res.birthOutcomes } : {} };
-}
-function stageWorkspaceDir(eng, ws) {
-  const wsContents = /* @__PURE__ */ new Map();
-  eng.preopen.dir.contents.get("ws").contents.set(ws, new Directory(wsContents));
-}
-async function mountWorkspace(eng, ws, ledger) {
-  if (eng.mounted.has(ws)) return eng.mounted.get(ws);
-  stageWorkspaceDir(eng, ws);
-  const gitdir = gitdirOf(ws);
-  let restored = false, remoteMain = null, restoreError = null;
-  try {
-    await custodySkeleton(eng, gitdir);
-    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
-    if (remoteMain) {
-      kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
-      restored = true;
-    }
-  } catch (e) {
-    restoreError = String(e && e.stack || e).split("\n").slice(0, 5).join(" | ");
-  }
-  const m = { restored, remoteMain, restoreError };
-  eng.mounted.set(ws, m);
-  return m;
-}
-function unmount(eng, ws) {
-  eng.mounted.delete(ws);
-  eng.mainIntents.delete(ws);
-  const wsRoot = eng.preopen.dir.contents.get("ws");
-  if (wsRoot) wsRoot.contents.delete(ws);
-}
-function writeWork(eng, name, bytes) {
-  eng.preopen.dir.contents.set(name, new File(bytes));
-}
-function currentLaw(eng, ws) {
-  const out = JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "currentLaw" }), branch: BRANCH }, eng.STDERR));
-  return out.keyMap || {};
-}
-function installedLaw(eng, ws) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "installedLaw" }), branch: BRANCH }, eng.STDERR));
-}
-function domainPackage(eng, ws, hash) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "domainPackage", hash }), branch: BRANCH }, eng.STDERR));
-}
-function evolveDryRun(eng, ws, usda, domainHash, dispositions = null) {
-  const r = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { dryRun: true, deferProjection: false });
-  return r.ok ? { admits: true } : { admits: false, detail: r.error };
-}
-function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
-  const seq = eng.seq++;
-  const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
-  if (opts.validFromEpoch !== void 0) capPorts.valid_from_epoch = opts.validFromEpoch;
-  if (opts.principalVerified !== void 0) {
-    capPorts.principal = opts.actor ?? "";
-    capPorts.principal_verified = !!opts.principalVerified;
-  }
-  const envelope = { payload: { domain, directiveId, payload }, captured_ports: capPorts, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
-  if (opts.attestations !== void 0) envelope.attestations = opts.attestations;
-  writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
-  writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
-  const genesis = !controllerHash;
-  const attestorSecretFor = (from) => {
-    const s = opts.attestorSecrets;
-    if (!s) return null;
-    if (typeof s === "string") return s;
-    return typeof s[from] === "string" ? s[from] : null;
-  };
-  const defer = opts.deferProjection !== false;
-  const offerOnce = () => JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.spans ? { spans: true } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
-  let v = offerOnce();
-  for (let pass = 0; pass < 8 && v.outcome === "refused"; pass++) {
-    const need = parseAttestedReadNeed(v.verdict?.reason ?? v.error);
-    if (!need || !eng.mounted.has(need.from)) break;
-    const secret = attestorSecretFor(need.from);
-    if (!secret) break;
-    const served = attestedRead(eng, need.from, {
-      queryId: need.queryId,
-      paramsJson: JSON.stringify(need.args),
-      attestorSecret: secret,
-      nowMs: opts.attestNowMs ?? Date.now(),
-      // K3 (§1.5.3): colocated custody is in-memory — always ask for the carried enrollment
-      // proof; the kernel produces-or-omits under its own bounds (the adapter decides nothing).
-      includeRosterProof: true
-    });
-    if (!served || served.ok !== true) break;
-    envelope.attestations = [...envelope.attestations ?? [], { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
-    writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
-    v = offerOnce();
-  }
-  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, ...v.born ? { born: v.born } : {}, ...v.birthOutcomes ? { birthOutcomes: v.birthOutcomes } : {}, ...v.kernelSpans ? { kernelSpans: v.kernelSpans } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
-  if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
-  return res;
-}
-function setTestKRoot(eng, kRootPublicB64) {
-  return JSON.parse(call(eng.ex, "set_test_k_root", { kRootPublicB64 }, eng.STDERR));
-}
-function refreshProjection(eng, ws) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "refresh" }), branch: BRANCH }, eng.STDERR));
-}
-async function custodySkeleton(eng, gitdir) {
-  const p = eng.fs.promises;
-  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
-    try {
-      await p.mkdir(`${gitdir}${d}`);
-    } catch (e) {
-      if (e && e.code !== "EEXIST") throw e;
-    }
-  }
-  try {
-    await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}
-`);
-  } catch {
-  }
-  try {
-    await p.writeFile(`${gitdir}/config`, "[core]\n	repositoryformatversion = 0\n	bare = true\n");
-  } catch {
-  }
-}
-async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
-  const remoteRefFull = fullRef(remoteRef);
-  const refs = await custodyLsRefs(ledger, remoteRefFull);
-  const tip = refs[remoteRefFull] || null;
-  if (!tip) return null;
-  if (tip !== have) applyPackInto(eng, ws, await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] }));
-  kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
-  return tip;
-}
-async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null } = {}) {
-  const headers = ledger.headers || {};
-  const remoteRefFull = fullRef(remoteRef);
-  const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
-  const oldOid = remote[remoteRefFull] || ZERO_OID;
-  if (del) {
-    if (oldOid === ZERO_OID) return;
-    return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: ZERO_OID }] }));
-  }
-  const tgt = newOid || kgit.resolveRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef));
-  if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
-  if (tgt === oldOid) return;
-  let pack = null;
-  if (!pointer) {
-    pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null;
-    if (!pack) pack = packDelta(eng, ws, "", tgt);
-  }
-  return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
-}
-async function commitAndPush(eng, ws, ledger) {
-  try {
-    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
-  } catch (e) {
-    unmount(eng, ws);
-    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${e}`);
-  }
-}
-function describe(eng, ws) {
-  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "describe", workspace: ws }), branch: BRANCH }, eng.STDERR));
-}
-function parseAttestedReadNeed(error) {
-  const m = /attested-read-unreachable: read\('([^']+)', \{from: '([^']+)'\}\) args=(.*?) has no injected attestation/.exec(String(error || ""));
-  if (!m) return null;
-  let blob = m[3];
-  for (let i = 0; i < 4; i++) {
-    try {
-      return { queryId: m[1], from: m[2], args: JSON.parse(blob) };
-    } catch {
-      blob = blob.replace(/\\(["\\])/g, "$1");
-    }
-  }
-  return null;
-}
-function packDelta(eng, ws, base, head) {
-  try {
-    const r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), base, head }, eng.STDERR));
-    if (!r || r.ok !== true || typeof r.packB64 !== "string") return null;
-    return Uint8Array.from(atob(r.packB64), (c) => c.charCodeAt(0));
-  } catch {
-    return null;
-  }
-}
-function servePack(eng, ws, base = "") {
-  let head = null;
-  try {
-    head = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
-  } catch {
-  }
-  let r;
-  try {
-    r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base, branch: BRANCH }, eng.STDERR));
-  } catch (e) {
-    const msg = String(e);
-    if (/nothing to pack|head == base/.test(msg)) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
-    if (base && /reached root|before base|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
-      try {
-        const full = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base: "", branch: BRANCH }, eng.STDERR));
-        if (full && full.ok === true && typeof full.packB64 === "string") {
-          return { packB64: full.packB64, bytes: full.bytes, divergent: true, ...head ? { head } : {} };
-        }
-      } catch {
-      }
-    }
-    throw e;
-  }
-  if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");
-  return { packB64: r.packB64, bytes: r.bytes, ...head ? { head } : {} };
-}
-function packBornChildren(eng, born) {
-  if (!Array.isArray(born) || !born.length) return born;
-  return born.map((b) => {
-    const child = b && typeof b.workspace === "string" ? b.workspace : null;
-    const head = b && typeof b.head === "string" ? b.head : null;
-    if (!child || !/^[0-9a-f]{40}$/i.test(head || "")) {
-      log("born-pack-skipped", { workspace: child, head, reason: "malformed born entry" });
-      return b;
-    }
-    try {
-      const pack = packDelta(eng, child, "", head);
-      if (!pack || !pack.length) {
-        log("born-pack-empty", { workspace: child, head });
-        return b;
-      }
-      return { ...b, packB64: b64Bytes(pack), packBytes: pack.length };
-    } catch (e) {
-      log("born-pack-failed", { workspace: child, head, error: String(e).slice(0, 200) });
-      return b;
-    }
-  });
-}
-function offerIntent(eng, ws, bytes, opts) {
-  const name = `offer-in-${eng.seq++}.json`;
-  writeWork(eng, name, bytes);
-  const deferProjection = !!(opts && opts.defer);
-  const branch = opts && opts.branch || BRANCH;
-  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
-}
-function offerAdmit(eng, ws, bytes, opts) {
-  const v = offerIntent(eng, ws, bytes, opts);
-  return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
-}
-async function mainIntentIds(eng, ws) {
-  const gitdir = gitdirOf(ws);
-  const head = kgit.resolveRef(eng, gitdir, BRANCH);
-  if (!head) return { head: null, ids: /* @__PURE__ */ new Set(), oids: /* @__PURE__ */ new Set() };
-  const cached = eng.mainIntents.get(ws);
-  if (cached && cached.head === head) return cached;
-  const ids = /* @__PURE__ */ new Set(), oids = /* @__PURE__ */ new Set();
-  for (const c of kgit.intentsAbove(eng, gitdir, head, "", 500)) {
-    oids.add(c.oid);
-    try {
-      const id = JSON.parse(dec3.decode(bytesFromB64(c.intentB64))).id;
-      if (typeof id === "string" && id) ids.add(id);
-    } catch {
-    }
-  }
-  const m = { head, ids, oids };
-  eng.mainIntents.set(ws, m);
-  return m;
-}
-async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = null, defer = false } = {}) {
-  const routes = shardRouting ? directiveRoutes(eng) : null;
-  const gitdir = gitdirOf(ws);
-  const H = () => ({ ...ledger.headers || {} });
-  const _t0 = Date.now();
-  let _fetchMs = 0, _sealMs = 0, _intents = 0;
-  const _spans = [];
-  let _traceSeq = 0;
-  const _span = (name, kind, depth = 1, extra = {}) => {
-    const t0 = Date.now();
-    return (end = {}) => {
-      const t1 = Date.now();
-      _spans.push({ id: `admit-${_t0}-${_traceSeq++}`, track: "cloud", name, kind, depth, t0, t1, ...extra, ...end });
-    };
-  };
-  const sessionRefPrefix = "refs/heads/session/";
-  const sessions = {};
-  const _scanDone = _span("scan session refs", "cscan", 1);
-  for (const [ref, oid] of Object.entries(await custodyLsRefs(ledger, sessionRefPrefix))) {
-    if (ref.startsWith(sessionRefPrefix) && oid) sessions[ref.slice(sessionRefPrefix.length)] = oid;
-  }
-  _scanDone({ sessions: Object.keys(sessions).length });
-  const _scanMs = Date.now() - _t0;
-  const results = [], deadLetters = [], placements = [], splits = [], globalsOut = [];
-  const consumed = [];
-  let totalAdmitted = 0;
-  const globalsDeclared = shardRouting && !shardRouting.selfLabel ? globalAggregates(eng) : null;
-  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0 ? { reads: scopedReads(eng), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
-  const canDeferProjection = !summaryCtx && !(globalsDeclared && globalsDeclared.size > 0);
-  if (summaryCtx) {
-    try {
-      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
-        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
-        if (!hk) continue;
-        summaryCtx.homeKeySet.add(hk);
-        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
-      }
-    } catch (e) {
-      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
-    }
-  }
-  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir, BRANCH) : null;
-  for (const [cid, head] of Object.entries(sessions)) {
-    const ref = `refs/heads/session/${cid}`;
-    const shortCid = cid.length > 14 ? `${cid.slice(0, 14)}...` : cid;
-    const _sessionDone = _span(`session ${shortCid}`, "csession", 1, { client: cid });
-    try {
-      const _fetchDone = _span(`fetch ${shortCid}`, "cfetch", 2, { client: cid });
-      const _f = Date.now();
-      try {
-        const localMain = kgit.resolveRef(eng, gitdir, BRANCH);
-        try {
-          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: localMain });
-        } catch (thinErr) {
-          log("thin-fetch-fallback", { ws, cid, error: String(thinErr && thinErr.message || thinErr).slice(0, 160) });
-          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: null });
-        }
-      } finally {
-        _fetchMs += Date.now() - _f;
-        _fetchDone();
-      }
-      const _walkDone = _span(`walk ${shortCid}`, "cwalk", 2, { client: cid });
-      const main = await mainIntentIds(eng, ws);
-      const recent = kgit.intentsAbove(eng, gitdir, head, "", 100);
-      const chain = [];
-      for (let i = recent.length - 1; i >= 0; i--) {
-        if (main.oids.has(recent[i].oid)) break;
-        chain.push(recent[i]);
-      }
-      chain.reverse();
-      _walkDone({ intents: chain.length });
-      const admitted = [], rejected = [], skipped = [];
-      const _gateDone = _span(`gate+fold ${shortCid}`, "cgate", 2, { client: cid, intents: chain.length });
-      for (const c of chain) {
-        const oid = c.oid;
-        try {
-          const blob = bytesFromB64(c.intentB64);
-          let dom = null, intentId = null, dirId = null;
-          try {
-            const doc = JSON.parse(dec3.decode(blob));
-            intentId = typeof doc.id === "string" ? doc.id : null;
-            dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null;
-            dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null;
-          } catch {
-          }
-          if (!dom) {
-            rejected.push({ oid: oid.slice(0, 10), error: "non-authored intent \u2014 governance enters its own admin lane" });
-            continue;
-          }
-          if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
-            const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
-            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
-            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
-            continue;
-          }
-          if (routes && dom && dirId) {
-            if (dirId === "nomosSealHome" || dirId === "nomosSealHandoff") {
-              rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses '${dirId}' \u2014 the \xA76 handoff seals are authored by the adapter after migration verifies (begin a move with nomosSplitShard, or POST /v1/workspaces/<coordinator>/split)` });
-              continue;
-            }
-            const route = routes.get(`${dom} ${dirId}`);
-            if (route) {
-              let payloadObj = null;
-              try {
-                payloadObj = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-              } catch {
-              }
-              const verdict2 = await wrongHomeVerdict(shardRouting, route, payloadObj);
-              if (verdict2) {
-                rejected.push({ oid: oid.slice(0, 10), error: verdict2.error, ...verdict2.wrongHome ? { wrongHome: verdict2.wrongHome } : {}, ...verdict2.homeMoving ? { homeMoving: verdict2.homeMoving } : {}, ...verdict2.deadLettered ? { deadLettered: true } : {} });
-                if (verdict2.deadLettered) deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error: verdict2.error, blob, domain: dom, directiveId: dirId });
-                continue;
-              }
-            }
-            if (dirId === "nomosReceiveAssignment" && shardRouting) {
-              let p = null;
-              try {
-                p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-              } catch {
-              }
-              const homeKey = p && typeof p.homeKey === "string" ? p.homeKey : null;
-              const rows = homeKey ? await shardRouting.assignments() || [] : [];
-              const a = homeKey ? rows.find((x) => x.homeKey === homeKey) : null;
-              if (!a) {
-                const error = `assignment receipt for home '${String(homeKey).slice(0, 80)}' has NO placement on the coordinator '${shardRouting.coordinatorWs}' \u2014 author the derived placement intent (birth<Type>) first, then POST /dead-letters/retry`;
-                rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
-                deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
-                continue;
-              }
-              if (a.shard !== shardRouting.selfLabel || p && p.shard !== shardRouting.selfLabel) {
-                const correct = `${shardRouting.coordinatorWs}--${a.shard}`;
-                rejected.push({
-                  oid: oid.slice(0, 10),
-                  error: `wrong-home: the coordinator's shard map assigns home '${homeKey.slice(0, 80)}' to '${correct}' (not this workspace) \u2014 a routed client re-routes and retries automatically`,
-                  wrongHome: { workspace: correct, ...a.mapVersion !== void 0 ? { mapVersion: a.mapVersion } : {} }
-                });
-                continue;
-              }
-            }
-          }
-          if (intentId && main.ids.has(intentId)) {
-            skipped.push({ oid: oid.slice(0, 10), intent: intentId.slice(0, 12), alreadyOnMain: true });
-            continue;
-          }
-          const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
-          const verdict = offerIntent(eng, ws, blob, { defer: canDeferProjection });
-          const res = verdict.outcome === "admitted" ? { ok: true, head: verdict.head } : { ok: false, error: verdict.verdict?.reason ?? verdict.error ?? "the offer was refused" };
-          if (res.ok) {
-            main.ids.add(intentId);
-            main.oids.add(res.head);
-            main.head = res.head;
-            admitted.push({ oid: oid.slice(0, 10), head: res.head });
-            if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head, intentId);
-            if (shardRouting && dirId) {
-              const placement = placementDirectives(eng).get(dirId);
-              if (placement) {
-                let p = null;
-                try {
-                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-                } catch {
-                }
-                const homeKey = p ? p[placement.keyField] : void 0;
-                if (typeof homeKey === "string" && typeof p?.shard === "string") {
-                  placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
-                }
-              }
-              if (dirId === "nomosSplitShard" && !shardRouting.selfLabel) {
-                let p = null;
-                try {
-                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
-                } catch {
-                }
-                if (p && typeof p.fromShard === "string" && typeof p.toShard === "string" && Array.isArray(p.homeKeys)) {
-                  splits.push({ fromShard: p.fromShard, toShard: p.toShard, homeKeys: p.homeKeys.filter((k) => typeof k === "string") });
-                }
-              }
-            }
-            if (globalsDeclared && globalsDeclared.size > 0) {
-              let touchesGlobal = false;
-              for (const ev of parseIntentEvents(blob)) {
-                const rows = qById(eng, ws, ev.aggregate);
-                const t = ev.sets.get("__type") ?? (rows.length ? rows[0].type : void 0);
-                if (t !== void 0 && globalsDeclared.has(t)) {
-                  touchesGlobal = true;
-                  break;
-                }
-              }
-              if (touchesGlobal) globalsOut.push({ intentId: intentId || "", oid: oid.slice(0, 10), blob });
-            }
-          } else {
-            const wh = String(res.error || "").match(/wrong-home:(s\d+)/);
-            if (wh) {
-              const coordinator = shardRouting && shardRouting.coordinatorWs || (ws.match(/^(.*)--s\d+$/) || [])[1] || ws;
-              rejected.push({
-                oid: oid.slice(0, 10),
-                error: `wrong-home: this write's home is assigned to '${coordinator}--${wh[1]}' \u2014 the chain gate's homing invariant refused it; a routed client re-routes and retries automatically`,
-                wrongHome: { workspace: `${coordinator}--${wh[1]}` }
-              });
-              continue;
-            }
-            const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
-            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
-            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
-          }
-        } catch (e) {
-          rejected.push({ oid: oid.slice(0, 10), error: String(e).slice(0, 200) });
-        }
-      }
-      _gateDone({ admitted: admitted.length, rejected: rejected.length, skipped: skipped.length });
-      _intents += admitted.length;
-      totalAdmitted += admitted.length;
-      consumed.push({ cid, ref });
-      results.push({ session: cid, admitted, rejected, ...skipped.length ? { skipped } : {} });
-    } catch (e) {
-      results.push({ session: cid, error: String(e).slice(0, 200) });
-    } finally {
-      _sessionDone();
-    }
-  }
-  if (canDeferProjection && totalAdmitted) {
-    const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
-    try {
-      refreshProjection(eng, ws);
-    } catch (e) {
-      log("admit-projection-flush-failed", { ws, error: String(e).slice(0, 200) });
-    } finally {
-      _projDone();
-    }
-  }
-  let unparkedSessions = /* @__PURE__ */ new Set();
-  if (deadLetters.length) {
-    try {
-      unparkedSessions = (await materializeRefused(eng, ws, ledger, deadLetters)).unparkedSessions;
-    } catch (e) {
-      unparkedSessions = new Set(deadLetters.map((dl) => dl.session).filter(Boolean));
-      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
-    }
-  }
-  const prunable = unparkedSessions.size ? consumed.filter((c) => !unparkedSessions.has(c.cid)) : consumed;
-  const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
-  const deferDurability = defer && !hasCoordination;
-  let _sealed = true;
-  if (totalAdmitted && !deferDurability) {
-    const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
-    const _s = Date.now();
-    try {
-      await commitAndPush(eng, ws, ledger);
-    } catch (e) {
-      _sealed = false;
-      log("admit-batch-push-failed", { ws, sessions: consumed.length, admitted: totalAdmitted, error: String(e).slice(0, 200) });
-    } finally {
-      _sealMs += Date.now() - _s;
-      _sealDone();
-    }
-  }
-  if (_sealed && !deferDurability) {
-    for (const { ref } of prunable) {
-      try {
-        await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
-      } catch {
-      }
-    }
-  }
-  const newMain = kgit.resolveRef(eng, gitdir, BRANCH);
-  log("admit", { ws, sessions: results.length, main: newMain });
-  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, newMain) : null;
-  const _total = Date.now() - _t0;
-  const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
-  return {
-    sessions: results,
-    main: newMain,
-    deadLetters,
-    timings,
-    ...summary ? { summary } : {},
-    ...placements.length ? { placements } : {},
-    ...splits.length ? { splits } : {},
-    ...globalsOut.length ? { globals: globalsOut } : {},
-    // The adapter's backup lane consumes these: `deferred` ⇒ resident main carries totalAdmitted
-    // un-backed-up commits and `consumed` are the session branches to delete AFTER the push lands.
-    ...deferDurability && totalAdmitted ? { deferred: true, consumed: prunable, admitted: totalAdmitted } : {}
-  };
-}
-async function writeRefusedRef(eng, ws, dl) {
-  const gitdir = gitdirOf(ws);
-  const blob = dl.blob instanceof Uint8Array ? dl.blob : enc3.encode(String(dl.blob || ""));
-  const refForStamp = refusedRefName(dl.intentId || dl.oid);
-  let parkedAt = (/* @__PURE__ */ new Date()).toISOString();
-  try {
-    const prevOid = kgit.resolveRef(eng, gitdir, refForStamp);
-    if (prevOid) {
-      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, prevOid, "verdict.json")));
-      if (prev && typeof prev.parkedAt === "string") parkedAt = prev.parkedAt;
-    }
-  } catch {
-  }
-  const verdict = enc3.encode(JSON.stringify({
-    offerId: dl.intentId || null,
-    oid: dl.oid || null,
-    domain: dl.domain || null,
-    directiveId: dl.directiveId || null,
-    session: dl.session || null,
-    parkedAt,
-    verdict: { reason: String(dl.error || "refused") }
-  }));
-  const ref = refusedRefName(dl.intentId || dl.oid);
-  kgit.writeMetaCommit(eng, gitdir, {
-    parents: [],
-    files: [{ path: "intent.json", bytes: blob }, { path: "verdict.json", bytes: verdict }],
-    message: `refused: ${dl.domain || "?"}/${dl.directiveId || "?"} \u2014 ${String(dl.error || "").slice(0, 120)}`,
-    timeSecs: 0,
-    ref
-  });
-  return ref;
-}
-async function listRefusedRefs(eng, ws) {
-  const gitdir = gitdirOf(ws);
-  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
-  const out = [];
-  for (const { ref, oid } of refs) {
-    try {
-      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json");
-      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json");
-      const v = JSON.parse(dec3.decode(vb));
-      out.push({ ref, ...v, intentB64: b64Bytes(ib) });
-    } catch {
-    }
-  }
-  return out;
-}
-async function refusedSummary(eng, ws) {
-  const gitdir = gitdirOf(ws);
-  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
-  let count2 = 0, latestParkedAt = null;
-  for (const { oid } of refs) {
-    try {
-      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json")));
-      count2++;
-      if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
-    } catch {
-    }
-  }
-  return { count: count2, latestParkedAt };
-}
-async function materializeRefused(eng, ws, ledger, deadLetters) {
-  const refs = [];
-  const unparkedSessions = /* @__PURE__ */ new Set();
-  for (const dl of deadLetters || []) {
-    try {
-      const ref = await writeRefusedRef(eng, ws, dl);
-      await custodyPush(eng, ws, ledger, { remoteRef: ref });
-      refs.push(ref);
-    } catch (e) {
-      if (dl && dl.session) unparkedSessions.add(dl.session);
-      log("refused-ref-materialize-failed", { ws, intentId: dl?.intentId, error: String(e).slice(0, 200) });
-    }
-  }
-  return { refs, unparkedSessions };
-}
-async function deleteRefusedRef(eng, ws, ledger, offerId) {
-  const gitdir = gitdirOf(ws);
-  const ref = refusedRefName(offerId);
-  try {
-    kgit.deleteRef(eng, gitdir, ref);
-  } catch {
-  }
-  try {
-    await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
-  } catch (e) {
-    log("refused-ref-delete-push-failed", { ws, ref, error: String(e).slice(0, 200) });
-  }
-  return ref;
-}
-async function boot(eng, ws, ledger) {
-  const m = await mountWorkspace(eng, ws, ledger);
-  if (nomosActive(eng, ws)) {
-    return { status: "already-initialized", controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
-  }
-  const result = author(eng, ws, "bootstrap", "installDomain", installPayload(eng.hashes.nomos, eng.nomosPkg, eng.installedBy), "");
-  await commitAndPush(eng, ws, ledger);
-  return { status: "created", head: result.head, controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
-}
-async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
-  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
-  const installation = qById(eng, ws, `domain-installation:${domainHash}`);
-  const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
-  if (keys.length > 0) {
-    const law = installedLaw(eng, ws);
-    const currentLaw2 = law?.currentLaw ?? {};
-    const stale = keys.filter((k) => currentLaw2[k] !== void 0 && currentLaw2[k] !== domainHash);
-    if (stale.length > 0) {
-      throw new Error(
-        `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw2[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
-      );
-    }
-  }
-  await commitAndPush(eng, ws, ledger);
-  return { head: result.head, installation };
-}
-function snapshot(eng, ws) {
-  const wsDir = eng.preopen.dir.contents.get("ws").contents.get(ws);
-  return serializeTree(wsDir);
-}
-async function ledgerStats(eng, ws, ledger = null) {
-  const gitdir = gitdirOf(ws);
-  let head = kgit.resolveRef(eng, gitdir, BRANCH);
-  if (!head && ledger?.remote) {
-    try {
-      await custodySkeleton(eng, gitdir);
-      const remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
-      if (!remoteMain) return { head: null, commits: 0 };
-      kgit.writeRef(eng, gitdir, "HEAD", `ref: refs/heads/${BRANCH}`);
-      head = kgit.resolveRef(eng, gitdir, BRANCH);
-      const mounted2 = eng.mounted.get(ws);
-      if (mounted2) {
-        mounted2.restored = true;
-        mounted2.remoteMain = remoteMain;
-        mounted2.restoreError = null;
-      }
-    } catch {
-    }
-  }
-  if (!head) return { head: null, commits: 0 };
-  const mounted = eng.mounted.get(ws);
-  if (mounted?.ledgerStats?.head === head) return mounted.ledgerStats;
-  const commits = kgit.intentsAbove(eng, gitdir, head).length;
-  const out = { head, commits };
-  if (mounted) mounted.ledgerStats = out;
-  return out;
-}
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, authorKeygen, attestedRead, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName;
-var init_engine = __esm({
-  "../adapter/engine.mjs"() {
-    init_git_fs();
-    init_tree();
-    init_custody_transport();
-    enc3 = new TextEncoder();
-    dec3 = new TextDecoder();
-    BRANCH = "main";
-    RESULT_PACK_INLINE_MAX = 256 * 1024;
-    repoArgOf = (ws) => `/work/ws/${ws}`;
-    gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
-    unpack = (p) => {
-      const v = typeof p === "bigint" ? p : BigInt(p);
-      return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
-    };
-    log = (evt, fields = {}) => console.log(JSON.stringify({ evt, t: Date.now(), ...fields }));
-    repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
-    bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
-    kgit = {
-      // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
-      resolveRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)).oid,
-      // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
-      readBlob: (eng, gitdir, oid, path2) => {
-        const r = JSON.parse(call(eng.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path: path2 }, eng.STDERR));
-        return r.ok ? bytesFromB64(r.blobB64) : null;
-      },
-      // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
-      // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
-      intentsAbove: (eng, gitdir, head, base = "", limit = 0) => JSON.parse(call(eng.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng.STDERR)).intents,
-      // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
-      listRefs: (eng, gitdir, prefix) => JSON.parse(call(eng.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng.STDERR)).refs,
-      // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
-      writeRef: (eng, gitdir, ref, value) => JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
-      // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
-      deleteRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
-      // applyPack → ingest a pack's objects into ws's repo (kernel apply_pack; refs are the caller's job).
-      applyPack: (eng, ws, packBytes) => applyPackInto(eng, ws, packBytes),
-      // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
-      // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
-      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng.ex, "write_meta_commit", {
-        repoArg: repoArgOfGitdir(gitdir),
-        parents,
-        files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
-        message,
-        timeSecs,
-        ref
-      }, eng.STDERR)).oid
-    };
-    installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
-    routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
-    SUMMARY_SEP = "";
-    summaryKey = (readId, group) => `${readId}${SUMMARY_SEP}${group}`;
-    splitSummaryKey = (key) => {
-      const i = key.indexOf(SUMMARY_SEP);
-      return [key.slice(0, i), key.slice(i + 1)];
-    };
-    NOMOS_SHARD_ROWS_READ = "nomosShardRows";
-    groupOf = (read, data) => {
-      if (read.by === null) return "";
-      const v = data ? data[read.by] : void 0;
-      return v === void 0 || v === null ? void 0 : String(v);
-    };
-    tallyOf = (eng, ws, read, group) => read.kind === "count" ? count(eng, ws, read.id, group).count : read.kind === "sum" ? sum(eng, ws, read.id, group).sum : extremum(eng, ws, read.id, read.kind, group).value;
-    isExtremumRead = (read) => read.kind === "min" || read.kind === "max";
-    extremumMonotone = (read, prev, next) => next === null && prev === null || next !== null && (prev === null || (read.kind === "min" ? next <= prev : next >= prev));
-    pushVia = (ledger, fn) => ledger && ledger.pushLane ? ledger.pushLane(fn) : fn();
-    fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
-    applyPackInto = (eng, ws, pack) => {
-      if (!pack || !pack.length) return;
-      const r = JSON.parse(call(eng.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng.STDERR));
-      if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
-    };
-    custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
-    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
-    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
-    authorKeygen = (eng) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "authorKeygen" }) }, eng.STDERR));
-    attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs, includeRosterProof }) => JSON.parse(call(eng.ex, "query", {
-      repoArg: repoArgOf(ws),
-      workspace: ws,
-      branch: BRANCH,
-      queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...includeRosterProof ? { includeRosterProof: true } : {} })
-    }, eng.STDERR));
-    count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
-    sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
-    pendingConflicts = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts" }), principal, branch: BRANCH }, eng.STDERR));
-    spatialBboxParams = (bbox) => {
-      const minX = bbox.minX ?? bbox.minLng, minY = bbox.minY ?? bbox.minLat, maxX = bbox.maxX ?? bbox.maxLng, maxY = bbox.maxY ?? bbox.maxLat;
-      return { minX, minY, maxX, maxY, minLng: minX, minLat: minY, maxLng: maxX, maxLat: maxY };
-    };
-    spatialWithin = (eng, ws, spatialId, bbox, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "spatial", spatialId, ...spatialBboxParams(bbox) }), principal, branch: BRANCH }, eng.STDERR));
-    extremum = (eng, ws, extremumId, kind, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "extremum", extremumId, kind, groupKey: groupKey ?? "" }), principal, branch: BRANCH }, eng.STDERR));
-    nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
-    refusedRefName = (offerId) => `refs/heads/refused/${String(offerId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
-  }
-});
-
-// ../cloud/dev-server/bootstrap.mjs
-var bootstrap_exports = {};
-__export(bootstrap_exports, {
-  bootstrapPlatform: () => bootstrapPlatform,
-  isTestMint: () => isTestMint
-});
-import { readFileSync } from "node:fs";
-function isTestMint(eng) {
-  try {
-    setTestKRoot(eng, "");
-    return true;
-  } catch (e) {
-    return !/poisoned|unknown|adapter-visible API/.test(String(e && e.message || e));
-  }
-}
-async function bootstrapPlatform(dev, opts) {
-  const { eng, custody, ledgerFor, serialize, origin } = dev;
-  const platform = opts.platform || "co2-platform-local";
-  log2(`standing up platform '${platform}' on ${origin}`);
-  await serialize(async () => {
-    custody.create(`holon-${platform}`);
-    const out = await boot(eng, platform, ledgerFor(platform));
-    log2(`platform workspace boot: ${out.status} (head ${String(out.head || "").slice(0, 12)})`);
-  });
-  if (opts.deploy) {
-    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
-    const usda = body.packageUsda || body.usda;
-    if (!usda) {
-      log2(`WARN --deploy ${opts.deploy} has no packageUsda; skipping law deploy`);
-    } else {
-      await serialize(async () => {
-        const ledger = ledgerFor(platform);
-        const domainHash = await sha256hex(usda);
-        try {
-          const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, { actor: "user:dev-admin" });
-          log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
-        } catch (e) {
-          log2(`WARN platform law deploy refused: ${String(e && e.message || e).slice(0, 200)}`);
-        }
-      });
-    }
-  } else {
-    log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
-  }
-  const testMint = isTestMint(eng);
-  if (!testMint) {
-    log2("ATTESTED BIRTHS: this kernel is NOT test-mint (set_test_k_root is poisoned).");
-    log2("  \u2192 build one:  ./git-holon/build_wasm.sh --release --features test-mint --bin wasm_git_holon");
-    log2("  \u2192 re-run:     NOMOS_LOCAL_WASM=<that.wasm> githolon cloud dev --platform " + platform + " --bootstrap");
-    log2("  Without it the platform cannot roots-at-K_root-attest home births (LEG rejected by design).");
-  } else {
-    const kRoot = authorKeygen(eng);
-    setTestKRoot(eng, kRoot.public);
-    log2(`K_root ceremony: pinned LOCAL test K_root ${kRoot.public.slice(0, 16)}\u2026`);
-    log2("  (deliver signed DelegationCerts via the platform's grant directives; see home_delegated_estate.smoke.mjs)");
-    dev.testKRoot = kRoot;
-  }
-  if (opts.authProvider || opts.firebaseProject) {
-    log2(`AuthProvider: ${opts.authProvider || `firebase:${opts.firebaseProject}`} \u2014 register it via the platform's setAuthProvider governance offer;`);
-    log2("  the kernel verifies x-nomos-auth JWTs against the law-declared key (host stays blind).");
-  }
-  log2("bootstrap complete (verifiable local legs done; attested-birth + Firebase legs gated as noted above).");
-  return { platform, testMint };
-}
-var log2;
-var init_bootstrap = __esm({
-  "../cloud/dev-server/bootstrap.mjs"() {
-    init_engine();
-    log2 = (m) => console.log(`[bootstrap] ${m}`);
-  }
-});
-
-// ../cloud/dev-server/server.mjs
-init_engine();
-init_custody_transport();
-import http from "node:http";
-import { createHash, randomBytes } from "node:crypto";
-import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-import os from "node:os";
-
-// ../cloud/cloudflare-shell/src/gateway-route-resolver.mjs
-function aliasIdsFor(x, path2) {
-  const ids = [];
-  for (const key of ["directiveId", "queryId", "countId", "sumId", "extremumId", "spatialId"]) {
-    const value = x && x[key];
-    if (typeof value === "string" && value) ids.push(value);
-  }
-  const leaf = String(path2 || "").replace(/^\/+/, "").split("/").filter(Boolean).at(-1);
-  if (leaf) ids.push(leaf);
-  return new Set(ids);
-}
-function resolveGatewayOperation(spec, opName, method) {
-  if (!spec || !spec.paths || !opName || !method) return { op: null };
-  const normalizedMethod = String(method).toLowerCase();
-  const exactPath = `/${String(opName).replace(/^\/+/, "")}`;
-  const exact = spec.paths[exactPath]?.[normalizedMethod];
-  if (exact) return { op: exact, path: exactPath, ambiguous: null };
-  if (String(opName).includes("/")) return { op: null };
-  const matches = [];
-  for (const [path2, methods] of Object.entries(spec.paths)) {
-    const op = methods?.[normalizedMethod];
-    const x = op?.["x-nomos"];
-    if (!x) continue;
-    if (aliasIdsFor(x, path2).has(opName)) matches.push({ op, path: path2 });
-  }
-  if (matches.length === 1) return { ...matches[0], ambiguous: null };
-  if (matches.length > 1) {
-    return { op: null, ambiguous: matches.map((m) => m.path).sort() };
-  }
-  return { op: null, ambiguous: null };
-}
-
-// ../cloud/cloudflare-shell/src/staged-intents.mjs
-var STAGE_THRESHOLD_CHARS = 4 * 1024 * 1024;
-var MAX_INLINE_INTENT_CHARS = 8 * 1024 * 1024;
-var MAX_STAGED_INTENT_BYTES = 64 * 1024 * 1024;
-var stagedIntentKey = (sha256) => typeof sha256 === "string" && /^[0-9a-f]{64}$/.test(sha256) ? `staged-intents/${sha256}` : null;
-async function sha256hexBytes(bytes) {
-  const d = await crypto.subtle.digest("SHA-256", bytes);
-  return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, "0")).join("");
-}
-var b64OfBytes = (bytes) => {
-  let s = "";
-  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode.apply(null, bytes.subarray(i, i + 32768));
-  return btoa(s);
-};
-async function stagePut(bucket, sha256, bytes) {
-  const key = stagedIntentKey(sha256);
-  if (key === null) return { status: 400, body: { ok: false, error: "stage-bad-ref: the path must name sha256 as 64 lowercase hex" } };
-  if (!(bytes instanceof Uint8Array) || bytes.length === 0) return { status: 400, body: { ok: false, error: "stage-empty: PUT a non-empty raw body (the sealed intent bytes)" } };
-  if (bytes.length > MAX_STAGED_INTENT_BYTES) return { status: 413, body: { ok: false, error: `stage-too-large: staged bytes are capped at ${MAX_STAGED_INTENT_BYTES} bytes` } };
-  const got = await sha256hexBytes(bytes);
-  if (got !== sha256) return { status: 400, body: { ok: false, error: `stage-hash-mismatch: sha256(body) is ${got}, not the named ${sha256} \u2014 stage bytes under their own hash` } };
-  const existing = typeof bucket.head === "function" ? await bucket.head(key) : await bucket.get(key);
-  if (existing) return { status: 200, body: { ok: true, sha256, size: bytes.length, alreadyStaged: true } };
-  await bucket.put(key, bytes);
-  return { status: 200, body: { ok: true, sha256, size: bytes.length, staged: true } };
-}
-async function resolveStagedIntent(bucket, ref) {
-  const sha256 = ref && typeof ref === "object" && typeof ref.sha256 === "string" ? ref.sha256 : "";
-  const key = stagedIntentKey(sha256);
-  if (key === null) return { ok: false, status: 400, error: "staged-intent-bad-ref: intentRef must be { sha256: <64 lowercase hex>, size? }" };
-  const obj = await bucket.get(key);
-  if (!obj) return { ok: false, status: 422, error: `staged-intent-missing: no staged bytes for sha256 ${sha256} \u2014 PUT /v2/stage/${sha256} (raw sealed intent bytes) first, then re-offer { intentRef }` };
-  const bytes = new Uint8Array(await obj.arrayBuffer());
-  if (bytes.length > MAX_STAGED_INTENT_BYTES) return { ok: false, status: 413, error: `staged-intent-too-large: staged bytes exceed the ${MAX_STAGED_INTENT_BYTES}-byte cap` };
-  if (typeof ref.size === "number" && ref.size !== bytes.length) return { ok: false, status: 422, error: `staged-intent-size-mismatch: the ref names ${ref.size} bytes but ${bytes.length} are staged` };
-  const got = await sha256hexBytes(bytes);
-  if (got !== sha256) return { ok: false, status: 422, error: `staged-intent-hash-mismatch: staged bytes hash to ${got}, not the offered ${sha256} \u2014 the signed offer's hash is the binding; refuse` };
-  return { ok: true, intentB64: b64OfBytes(bytes), sha256, size: bytes.length };
-}
-
-// ../cloud/dev-server/custody.mjs
-import { spawn, execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, rmSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-var GIT_HTTP_BACKEND = join(
-  execFileSync("git", ["--exec-path"], { encoding: "utf8" }).trim(),
-  "git-http-backend"
-);
-var FilesystemGitRepository = class {
-  constructor(name, dir, origin) {
-    this.name = name;
-    this.dir = dir;
-    this.remote = `${origin}/git/nomos/${name}.git`;
-  }
-  // Dev custody is open (git-http-backend export-all): a token is inert but we keep the
-  // production SHAPE so callers that thread `createToken(...).plaintext` are unchanged.
-  createToken(_scope = "read", ttlSec = 3600) {
-    return { plaintext: "dev-inert-token", expiresAt: Date.now() + ttlSec * 1e3 };
-  }
-};
-var FilesystemGitCustody = class {
-  /** @param {string} dataDir  the --data root; repos live under <dataDir>/custody */
-  constructor(dataDir, origin) {
-    this.root = join(dataDir, "custody");
-    this.origin = origin;
-    mkdirSync(this.root, { recursive: true });
-  }
-  _dirOf(name) {
-    return join(this.root, `${name}.git`);
-  }
-  get(name) {
-    const dir = this._dirOf(name);
-    return existsSync(dir) ? new FilesystemGitRepository(name, dir, this.origin) : null;
-  }
-  /** Idempotent: init a bare repo (with http.receivepack so the client can push). */
-  create(name) {
-    const dir = this._dirOf(name);
-    if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true });
-      execFileSync("git", ["init", "--bare", "--quiet", dir]);
-      execFileSync("git", ["--git-dir", dir, "config", "http.receivepack", "true"]);
-      execFileSync("git", ["--git-dir", dir, "config", "http.uploadpack", "true"]);
-    }
-    return new FilesystemGitRepository(name, dir, this.origin);
-  }
-  delete(name) {
-    const dir = this._dirOf(name);
-    if (existsSync(dir)) rmSync(dir, { recursive: true, force: true });
-  }
-  list() {
-    if (!existsSync(this.root)) return [];
-    return readdirSync(this.root).filter((f) => f.endsWith(".git")).map((f) => f.slice(0, -4));
-  }
-};
-function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2, contentType, body }) {
-  return new Promise((resolve, reject) => {
-    const env = {
-      ...process.env,
-      GIT_PROJECT_ROOT: projectRoot,
-      GIT_HTTP_EXPORT_ALL: "1",
-      PATH_INFO: pathInfo,
-      REQUEST_METHOD: method,
-      QUERY_STRING: query2 || "",
-      CONTENT_TYPE: contentType || "",
-      CONTENT_LENGTH: String(body ? body.length : 0),
-      REMOTE_ADDR: "127.0.0.1",
-      REMOTE_USER: "nomos-dev",
-      GIT_HTTP_MAX_REQUEST_BUFFER: String(64 * 1024 * 1024)
-    };
-    const cgi = spawn(GIT_HTTP_BACKEND, [], { env });
-    const chunks = [];
-    cgi.stdout.on("data", (d) => chunks.push(d));
-    cgi.stderr.on("data", () => {
-    });
-    cgi.on("error", reject);
-    cgi.on("close", () => {
-      const out = Buffer.concat(chunks);
-      let sep = out.indexOf("\r\n\r\n");
-      let sepLen = 4;
-      if (sep < 0) {
-        sep = out.indexOf("\n\n");
-        sepLen = 2;
-      }
-      const headerText = sep >= 0 ? out.slice(0, sep).toString("utf8") : out.toString("utf8");
-      const payload = sep >= 0 ? out.slice(sep + sepLen) : Buffer.alloc(0);
-      const headers = {};
-      let status = 200;
-      for (const line of headerText.split(/\r?\n/)) {
-        const i = line.indexOf(":");
-        if (i < 0) continue;
-        const k = line.slice(0, i).trim();
-        const v = line.slice(i + 1).trim();
-        if (/^status$/i.test(k)) {
-          status = parseInt(v, 10) || 200;
-          continue;
-        }
-        headers[k] = v;
-      }
-      resolve({ status, headers, body: payload });
-    });
-    if (body && body.length) cgi.stdin.write(body);
-    cgi.stdin.end();
-  });
-}
-function receivePackCommands(raw) {
-  const cmds = [];
-  let off = 0;
-  const dec4 = new TextDecoder();
-  while (off + 4 <= raw.length) {
-    const hex = dec4.decode(raw.subarray(off, off + 4));
-    if (!/^[0-9a-f]{4}$/.test(hex)) break;
-    const len = parseInt(hex, 16);
-    if (len === 0) {
-      off += 4;
-      break;
-    }
-    let line = dec4.decode(raw.subarray(off + 4, off + len));
-    off += len;
-    const nul = line.indexOf("\0");
-    if (nul >= 0) line = line.slice(0, nul);
-    const m = line.match(/^([0-9a-f]{40}) ([0-9a-f]{40}) (.+?)\s*$/);
-    if (m) cmds.push({ oldOid: m[1], newOid: m[2], ref: m[3] });
-  }
-  return cmds;
-}
-
-// ../cloud/dev-server/server.mjs
-var DIR = path.dirname(fileURLToPath(import.meta.url));
-var REPO_ROOT = path.resolve(DIR, "../..");
-var RECOGNIZED_UNSUPPORTED = /* @__PURE__ */ new Set([
-  "container-status",
-  "recycle-container",
-  "hostnames",
-  "rebirth-custody",
-  "upload-begin",
-  "upload-gate",
-  "upload-verify",
-  "drain-reclaims",
-  "drain-rebirths",
-  "git-read-lease",
-  "poke-admit",
-  "clear-checkpoint",
-  "domain-package",
-  "capabilities"
-]);
-var UNSUPPORTED_WHY = {
-  "container-status": "the heavy container tier is Cloudflare-only (the dev cloud is one in-process engine)",
-  "recycle-container": "the heavy container tier is Cloudflare-only (the dev cloud is one in-process engine)",
-  "hostnames": "platform custom-hostname routing is a multi-tenant edge concern",
-  "rebirth-custody": "the custodian rebirth lane is bound to Cloudflare Artifacts custody",
-  "upload-begin": "the staged-upload birth variant \u2014 push to /v2/workspaces/<ws>/git instead (the upload-birth lane works locally)",
-  "upload-gate": "the staged-upload birth variant \u2014 push to /v2/workspaces/<ws>/git instead",
-  "upload-verify": "the staged-upload birth variant \u2014 push to /v2/workspaces/<ws>/git instead",
-  "drain-reclaims": "an operator lawful-recovery drain (multi-node lifecycle)",
-  "drain-rebirths": "an operator lawful-recovery drain (multi-node lifecycle)",
-  "capabilities": "retired everywhere \u2014 host-side capability storage is gone (capabilities are holon-offered obligations now)"
-};
-var _realFetch = globalThis.fetch;
-globalThis.fetch = (input, init) => {
-  const u = typeof input === "string" ? input : input && input.url || "";
-  if (/artifacts\.cloudflare\.net|\.workers\.dev/i.test(u)) {
-    throw new Error(`REMOTE CUSTODY FORBIDDEN in dev cloud: refused fetch to ${u}`);
-  }
-  return _realFetch(input, init);
-};
-var unb64 = (s) => new Uint8Array(Buffer.from(s, "base64"));
-function configDir() {
-  return process.env.HOLON_CONFIG_DIR || path.join(os.homedir(), ".holon");
-}
-function firstExisting(...paths) {
-  for (const p of paths) {
-    if (p && existsSync2(p)) return p;
-  }
-  return null;
-}
-var TEST_MINT_MARKER = Buffer.from("set_test_k_root");
-var isTestMintBytes = (bytes) => bytes.includes(TEST_MINT_MARKER);
-var DEFAULT_KERNEL_SOURCE = "https://nomos.captainapp.co.uk";
-async function resolveTestMintWasm(kernelSource) {
-  const runtimeCache = path.join(configDir(), "runtime");
-  const cachePath = path.join(runtimeCache, "holon-testmint.wasm");
-  const local = process.env.NOMOS_LOCAL_WASM;
-  if (local && existsSync2(local)) {
-    const bytes = readFileSync2(local);
-    if (isTestMintBytes(bytes)) return { wasmPath: local, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "NOMOS_LOCAL_WASM" };
-  }
-  if (existsSync2(cachePath)) {
-    const bytes = readFileSync2(cachePath);
-    if (isTestMintBytes(bytes)) return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "cache" };
-  }
-  const src = String(kernelSource || process.env.NOMOS_KERNEL_SOURCE || DEFAULT_KERNEL_SOURCE).replace(/\/+$/, "");
-  const url = `${src}/v1/runtime/holon-testmint.wasm`;
-  try {
-    const resp = await _realFetch(url);
-    if (resp.ok) {
-      const bytes = Buffer.from(await resp.arrayBuffer());
-      if (isTestMintBytes(bytes)) {
-        mkdirSync2(runtimeCache, { recursive: true });
-        writeFileSync(cachePath, bytes);
-        return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: `fetched ${url}` };
-      }
-    }
-  } catch {
-  }
-  throw new Error(
-    `attested births need the test-mint kernel; it couldn't be fetched from ${src} (offline?) \u2014 build one: git-holon/build_wasm.sh --release --features test-mint --bin wasm_git_holon and set NOMOS_LOCAL_WASM`
-  );
-}
-async function loadRuntime(opts = {}) {
-  const runtimeCache = path.join(configDir(), "runtime");
-  const repoDomainsDir = path.join(REPO_ROOT, "cloud/cloudflare-shell/container/domains");
-  const vendoredFrameworkDir = path.join(DIR, "framework");
-  let wasmPath, wasmBytes, kernelKind, kernelSource;
-  if (opts.attested) {
-    ({ wasmPath, wasmBytes, kernelKind, kernelSource } = await resolveTestMintWasm(opts.kernelSource));
-  } else {
-    wasmPath = firstExisting(
-      process.env.NOMOS_LOCAL_WASM,
-      path.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
-      path.join(runtimeCache, "holon.wasm")
-    );
-    if (!wasmPath) {
-      throw new Error(
-        "no kernel wasm found. Warm the kernel first:\n  \u2022 set NOMOS_LOCAL_WASM=<path to holon.wasm>, OR\n  \u2022 run any `githolon` cloud command once (e.g. `githolon ledger verify \u2026`) to cache ~/.holon/runtime/holon.wasm\n  (attested births additionally require a test-mint wasm \u2014 pass --bootstrap or --attested)"
-      );
-    }
-    wasmBytes = readFileSync2(wasmPath);
-    kernelKind = isTestMintBytes(wasmBytes) ? "test-mint" : "production";
-    kernelSource = wasmPath === process.env.NOMOS_LOCAL_WASM ? "NOMOS_LOCAL_WASM" : wasmPath.startsWith(runtimeCache) ? "cache" : "repo-vendor";
-  }
-  const repoBootstrap = firstExisting(path.join(repoDomainsDir, "domain_bootstrap.package.usda"));
-  const repoNomos = firstExisting(path.join(repoDomainsDir, "domain_nomos.package.usda"));
-  let bootstrapPkg, nomosPkg;
-  if (repoBootstrap && repoNomos) {
-    bootstrapPkg = readFileSync2(repoBootstrap, "utf8");
-    nomosPkg = readFileSync2(repoNomos, "utf8");
-  } else if (existsSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"))) {
-    bootstrapPkg = readFileSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"), "utf8");
-    nomosPkg = readFileSync2(path.join(vendoredFrameworkDir, "domain_nomos.package.usda"), "utf8");
-  } else {
-    const pkgsCache = path.join(runtimeCache, "packages.json");
-    if (!existsSync2(pkgsCache)) {
-      throw new Error(
-        "no framework packages found (domain_bootstrap/domain_nomos). Warm the runtime cache by running any `githolon` cloud command once, or run from the monorepo checkout."
-      );
-    }
-    const pkgs = JSON.parse(readFileSync2(pkgsCache, "utf8"));
-    bootstrapPkg = pkgs.bootstrap;
-    nomosPkg = pkgs.nomos;
-  }
-  return { wasmPath, wasmBytes, bootstrapPkg, nomosPkg, kernelKind, kernelSource };
-}
-async function startDevCloud(opts = {}) {
-  const port = opts.port || 8787;
-  const host = opts.host || "127.0.0.1";
-  const origin = `http://${host}:${port}`;
-  const ephemeral = !!opts.ephemeral;
-  const dataDir = ephemeral ? mkdtempSync(path.join(os.tmpdir(), "nomos-dev-cloud-")) : path.resolve(opts.data || ".nomos/dev-cloud");
-  mkdirSync2(dataDir, { recursive: true });
-  const attested = !!(opts.attested || opts.bootstrap);
-  const { wasmPath, wasmBytes, bootstrapPkg, nomosPkg, kernelKind, kernelSource } = await loadRuntime({ attested, kernelSource: opts.kernelSource });
-  console.log(`[dev-cloud]   kernel   : ${kernelKind} (from ${kernelSource})`);
-  const wasmModule = await WebAssembly.compile(wasmBytes);
-  const kernelSha = createHash("sha256").update(wasmBytes).digest("hex");
-  const enc4 = new TextEncoder();
-  const replicaDigest = new Uint8Array(await crypto.subtle.digest("SHA-256", enc4.encode(`dev:${randomBytes(8).toString("hex")}`)));
-  let replica = 0n;
-  for (let i = 0; i < 8; i++) replica = replica << 8n | BigInt(replicaDigest[i]);
-  replica &= (1n << 63n) - 1n;
-  const eng = await createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy: "nomos-cloud-dev" });
-  const custody = new FilesystemGitCustody(dataDir, origin);
-  const stagedBytes = /* @__PURE__ */ new Map();
-  const stageBucket = {
-    async get(k) {
-      const b = stagedBytes.get(k);
-      return b ? { arrayBuffer: async () => b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength) } : null;
-    },
-    async put(k, bytes) {
-      stagedBytes.set(k, bytes);
-    },
-    async head(k) {
-      const b = stagedBytes.get(k);
-      return b ? { size: b.length } : null;
-    }
-  };
-  let chain = Promise.resolve();
-  const serialize = (fn) => {
-    const r = chain.then(fn, fn);
-    chain = r.then(() => {
-    }, () => {
-    });
-    return r;
-  };
-  const pushChains = /* @__PURE__ */ new Map();
-  const pushLaneFor = (ws) => (fn) => {
-    const prev = pushChains.get(ws) || Promise.resolve();
-    const r = prev.then(fn, fn);
-    pushChains.set(ws, r.then(() => {
-    }, () => {
-    }));
-    return r;
-  };
-  const ledgerFor = (ws) => ({
-    remote: `${origin}/git/nomos/holon-${ws}.git`,
-    headers: {},
-    pushLane: pushLaneFor(ws)
-  });
-  async function persistBorn(born) {
-    if (!Array.isArray(born)) return [];
-    const out = [];
-    for (const b of born) {
-      const child = b && b.workspace;
-      const head = b && b.head;
-      out.push({ workspace: child, head });
-      if (!child || !/^[0-9a-f]{40}$/i.test(head || "") || !b.packB64) continue;
-      const repo = custody.create(`holon-${child}`);
-      const refs = await lsRefs(repo.remote, {}, { service: "git-receive-pack", prefix: "refs/heads/main" }).catch(() => ({}));
-      const oldOid = refs["refs/heads/main"] || ZERO_OID;
-      if (oldOid === head) continue;
-      await pushLaneFor(child)(
-        () => pushPack(repo.remote, {}, { updates: [{ ref: "refs/heads/main", oldOid, newOid: head }], pack: unb64(b.packB64) })
-      );
-    }
-    return out;
-  }
-  const CORS = {
-    "access-control-allow-origin": "*",
-    "access-control-allow-methods": "GET,POST,PUT,DELETE,OPTIONS",
-    "access-control-allow-headers": "content-type,x-nomos-auth,x-nomos-principal,authorization"
-  };
-  const sendJson = (res, obj, status = 200) => {
-    const body = JSON.stringify(obj, null, 2) + "\n";
-    res.writeHead(status, { "content-type": "application/json", ...CORS });
-    res.end(body);
-  };
-  const sendBytes = (res, bytes, status = 200, headers = {}) => {
-    res.writeHead(status, { ...CORS, ...headers });
-    res.end(Buffer.from(bytes));
-  };
-  const readBody = (req) => new Promise((resolve) => {
-    const chunks = [];
-    req.on("data", (c) => chunks.push(c));
-    req.on("end", () => resolve(Buffer.concat(chunks)));
-  });
-  const principalOf = (req) => String(req.headers["x-nomos-principal"] || "").slice(0, 128);
-  const authTokenOf = (req) => String(req.headers["x-nomos-auth"] || "").replace(/^Bearer\s+/i, "");
-  function openapiFor(ws) {
-    const merged = { openapi: "3.1.0", info: { title: `${ws} (nomos workspace)`, version: "0", "x-nomos-workspace": ws }, paths: {} };
-    const domOf = (o) => String(o && o["x-nomos"] && o["x-nomos"].domain ? o["x-nomos"].domain : "domain");
-    const mergeInto = (frag) => {
-      for (const [p, methods] of Object.entries(frag.paths || {})) {
-        for (const [m, op] of Object.entries(methods)) {
-          const existing = merged.paths[p] && merged.paths[p][m];
-          if (existing === void 0) {
-            (merged.paths[p] ||= {})[m] = op;
-          } else if (JSON.stringify(existing) !== JSON.stringify(op)) {
-            (merged.paths[`/${domOf(existing)}${p}`] ||= {})[m] = existing;
-            (merged.paths[`/${domOf(op)}${p}`] ||= {})[m] = op;
-            delete merged.paths[p][m];
-            if (Object.keys(merged.paths[p]).length === 0) delete merged.paths[p];
-          }
-        }
-      }
-    };
-    try {
-      const spec = describe(eng, ws);
-      if (spec && spec.paths) mergeInto(spec);
-    } catch {
-    }
-    merged.paths["/openapi.json"] = {
-      get: { operationId: "nomos__openapi", summary: "this workspace's live OpenAPI", responses: { "200": { description: "ok" } } }
-    };
-    return merged;
-  }
-  const server = http.createServer(async (req, res) => {
-    try {
-      const url = new URL(req.url, origin);
-      const seg = url.pathname.split("/").filter(Boolean);
-      if (req.method === "OPTIONS") {
-        res.writeHead(204, CORS);
-        return res.end();
-      }
-      if (url.pathname === "/health") return sendJson(res, { ok: true, kernelSha, dataDir, wasmPath, workspaces: custody.list() });
-      if (url.pathname === "/v1/runtime/holon.wasm" || url.pathname === "/v1/runtime/holon-testmint.wasm") {
-        res.writeHead(200, { ...CORS, "content-type": "application/wasm", "cache-control": "no-store", "x-nomos-kernel": kernelKind, "x-nomos-kernel-sha": kernelSha });
-        return res.end(Buffer.from(wasmBytes));
-      }
-      if (url.pathname === "/v1/runtime/packages") {
-        return sendJson(res, { bootstrap: bootstrapPkg, nomos: nomosPkg });
-      }
-      {
-        const m = url.pathname.match(/^\/v2\/stage\/([0-9a-f]{64})$/);
-        if (m) {
-          const sha = m[1];
-          if (req.method === "PUT" || req.method === "POST") {
-            const bytes = new Uint8Array(await readBody(req));
-            const r = await stagePut(stageBucket, sha, bytes);
-            return sendJson(res, r.body, r.status);
-          }
-          if (req.method === "GET" || req.method === "HEAD") {
-            const head = await stageBucket.head(`staged-intents/${sha}`);
-            if (!head) return sendJson(res, { ok: false, staged: false, sha256: sha }, 404);
-            return sendJson(res, { ok: true, staged: true, sha256: sha, size: head.size }, 200);
-          }
-        }
-      }
-      if (seg[0] === "git" && seg[1] === "nomos") {
-        return await gitBackend(req, res, seg.slice(2).join("/"), null);
-      }
-      if (seg[0] === "repositories" && seg[1]) {
-        const name = decodeURIComponent(seg[1]);
-        if (req.method === "PUT") {
-          const r2 = custody.create(name);
-          return sendJson(res, { ok: true, name, remote: r2.remote }, 201);
-        }
-        if (req.method === "DELETE") {
-          custody.delete(name);
-          return sendJson(res, { ok: true, name, deleted: true });
-        }
-        const r = custody.get(name);
-        return r ? sendJson(res, { ok: true, name, remote: r.remote }) : sendJson(res, { ok: false, error: "no such repository" }, 404);
-      }
-      if (seg[0] === "v2" && seg[1] === "workspaces" && seg[2]) {
-        const ws = decodeURIComponent(seg[2]);
-        const sub = seg.slice(3);
-        if (sub[0] === "git") {
-          return await gitBackend(req, res, `holon-${ws}.git/${sub.slice(1).join("/")}`, ws);
-        }
-        if (sub.length === 0 && req.method === "POST") {
-          return serialize(async () => {
-            custody.create(`holon-${ws}`);
-            const ledger = ledgerFor(ws);
-            const out = await boot(eng, ws, ledger);
-            sendJson(res, { ok: true, ws, tier: "heavy", status: out.status, ledger: ledger.remote, head: out.head, controller: { domainHash: out.controllerHash, rows: out.rows } }, out.status === "already-initialized" ? 200 : 201);
-          });
-        }
-        if (sub.length === 0 && req.method === "GET") {
-          return serialize(async () => {
-            const ledger = ledgerFor(ws);
-            let initialized = false, ledgerState = null;
-            if (custody.get(`holon-${ws}`)) {
-              await mountWorkspace(eng, ws, ledger);
-              try {
-                initialized = nomosActive(eng, ws);
-              } catch {
-              }
-              ledgerState = await ledgerStats(eng, ws, ledger).catch(() => null);
-            }
-            sendJson(res, { ok: true, ws, tier: "heavy", initialized, ledger: ledger.remote, ledgerState, kernelSha });
-          });
-        }
-        if (sub[0] === "domains" && sub.length === 1) {
-          if (req.method === "GET") {
-            return serialize(async () => {
-              await mountWorkspace(eng, ws, ledgerFor(ws));
-              sendJson(res, { ok: true, ws, ...installedLaw(eng, ws) });
-            });
-          }
-          if (req.method === "POST") {
-            const raw = await readBody(req);
-            return serialize(async () => {
-              const ledger = ledgerFor(ws);
-              await mountWorkspace(eng, ws, ledger);
-              if (!nomosActive(eng, ws)) return sendJson(res, { ok: false, error: `workspace '${ws}' is not initialized \u2014 POST /v2/workspaces/${ws} first` }, 409);
-              let usda, dispositions = null;
-              const text = raw.toString("utf8");
-              if (text.trimStart().startsWith("#usda")) {
-                usda = text;
-              } else {
-                const body = JSON.parse(text || "{}");
-                usda = body.packageUsda || body.usda;
-                dispositions = body.dispositions || null;
-              }
-              if (!usda) return sendJson(res, { ok: false, error: "deploy body must be raw #usda or JSON with packageUsda" }, 400);
-              const domainHash = await sha256hex(usda);
-              const dryRun = url.searchParams.get("dryRun");
-              if (dryRun === "evolve") {
-                const verdict = evolveDryRun(eng, ws, usda, domainHash, dispositions);
-                return sendJson(res, { ok: true, dryRun: "evolve", verdict });
-              }
-              if (dryRun) return sendJson(res, { ok: true, dryRun: true, wouldInstall: domainHash, bytes: usda.length });
-              const actor = principalOf(req);
-              const authToken = authTokenOf(req);
-              try {
-                const out = await deploy(eng, ws, ledger, usda, domainHash, dispositions, { actor, ...authToken ? { authToken } : {} });
-                sendJson(res, { ok: true, ws, domainHash, head: out.head, installation: out.installation }, 201);
-              } catch (e) {
-                const msg = String(e && e.message || e);
-                const status = /deploy-did-not-advance/.test(msg) ? 409 : 422;
-                sendJson(res, { ok: false, refused: true, error: msg.slice(0, 600) }, status);
-              }
-            });
-          }
-        }
-        if (sub[0] === "domains" && sub.length === 3 && sub[2] === "package.usda") {
-          return serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            const pkg = domainPackage(eng, ws, sub[1]);
-            if (!pkg || !pkg.usda) return sendJson(res, { ok: false, error: "no such package" }, 404);
-            res.writeHead(200, { "content-type": "text/plain", ...CORS });
-            res.end(pkg.usda);
-          });
-        }
-        if (sub[0] === "openapi.json" && req.method === "GET") {
-          return serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            sendJson(res, openapiFor(ws));
-          });
-        }
-        if (sub[0] === "admit" && req.method === "POST") {
-          return serialize(async () => {
-            const ledger = ledgerFor(ws);
-            await mountWorkspace(eng, ws, ledger);
-            const out = await admitAll(eng, ws, ledger, {});
-            if (Array.isArray(out.born) && out.born.length) await persistBorn(packBornChildren(eng, out.born));
-            sendJson(res, { ok: true, ws, sessions: out.sessions, main: out.main, ...out.timings ? { timings: out.timings } : {} });
-          });
-        }
-        if (sub[0] === "intent-offers" && req.method === "POST") {
-          return serialize(async () => {
-            const ledger = ledgerFor(ws);
-            await mountWorkspace(eng, ws, ledger);
-            const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
-            const offers = Array.isArray(body.offers) ? body.offers.slice(0, 100) : [];
-            if (!offers.length) return sendJson(res, { ok: false, error: "body must be { offers:[{session, oid, intentB64}] }" }, 400);
-            const clientBase = /^[0-9a-f]{40}$/i.test(body.base || "") ? body.base : null;
-            const out = await admitIntentOffers(eng, ws, ledger, offers, { ...clientBase ? { clientBase } : {} });
-            if (Array.isArray(out.born) && out.born.length) await persistBorn(out.born);
-            const bornOut = Array.isArray(out.born) ? out.born.map(({ packB64, packBytes, ...b }) => b) : null;
-            sendJson(res, {
-              ok: true,
-              ws,
-              sessions: out.sessions,
-              main: out.main,
-              ...bornOut ? { born: bornOut } : {},
-              ...out.birthOutcomes ? { birthOutcomes: out.birthOutcomes } : {},
-              ...out.mainDelta ? { mainDelta: out.mainDelta } : {},
-              ...out.resultPackB64 ? { resultPackB64: out.resultPackB64, resultBase: out.resultBase } : {},
-              ...out.deadLetters && out.deadLetters.length ? { deadLetters: out.deadLetters.map(({ blob, ...m }) => m) } : {}
-            });
-          });
-        }
-        if (sub[0] === "dead-letters" && sub.length === 1 && req.method === "GET") {
-          return serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            sendJson(res, { ok: true, ws, deadLetters: await listRefusedRefs(eng, ws) });
-          });
-        }
-        if (sub[0] === "dlq-summary" && req.method === "GET") {
-          return serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            sendJson(res, { ok: true, ws, ...await refusedSummary(eng, ws) });
-          });
-        }
-        if (sub[0] === "dead-letters" && sub[1] === "retry" && req.method === "POST") {
-          return serialize(async () => {
-            const ledger = ledgerFor(ws);
-            await mountWorkspace(eng, ws, ledger);
-            const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
-            const only = body.id || null;
-            const refs = await listRefusedRefs(eng, ws);
-            const retried = [], failed = [];
-            for (const e of refs) {
-              if (only && e.offerId !== only && e.oid !== only) continue;
-              if (!e.intentB64) {
-                failed.push({ intentId: e.offerId, error: "refused ref carries no intent bytes" });
-                continue;
-              }
-              try {
-                const r2 = offerAdmit(eng, ws, unb64(e.intentB64));
-                if (r2.ok) retried.push({ intentId: e.offerId, head: r2.head });
-                else failed.push({ intentId: e.offerId, error: String(r2.error || "").slice(0, 300) });
-              } catch (err) {
-                failed.push({ intentId: e.offerId, error: String(err).slice(0, 300) });
-              }
-            }
-            if (retried.length) await commitAndPush(eng, ws, ledger);
-            for (const r2 of retried) await deleteRefusedRef(eng, ws, ledger, r2.intentId);
-            sendJson(res, { ok: true, ws, retried, failed, remaining: (await listRefusedRefs(eng, ws)).length });
-          });
-        }
-        if (sub[0] === "dead-letters" && (sub[1] === "discard" || req.method === "DELETE")) {
-          return serialize(async () => {
-            const ledger = ledgerFor(ws);
-            await mountWorkspace(eng, ws, ledger);
-            const body = req.method === "DELETE" ? {} : JSON.parse((await readBody(req)).toString("utf8") || "{}");
-            const only = body.id || url.searchParams.get("id") || null;
-            const targets = (await listRefusedRefs(eng, ws)).filter((e) => !only || e.offerId === only || e.oid === only);
-            for (const e of targets) await deleteRefusedRef(eng, ws, ledger, e.offerId || e.oid);
-            sendJson(res, { ok: true, ws, discarded: targets.length });
-          });
-        }
-        if (sub[0] === "rotate-secret" && req.method === "POST") {
-          return sendJson(res, { ok: false, retired: true, error: "rotate-secret is retired \u2014 ownership is a ledger fact (sha256 of the push password on the law record); re-own by re-birthing via the upload lane" }, 410);
-        }
-        if (sub[0] === "pack" && req.method === "GET") {
-          return serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            const have = url.searchParams.get("have") || "";
-            let r;
-            try {
-              r = servePack(eng, ws, have);
-            } catch (e) {
-              return sendJson(res, { ok: false, custodyBreak: true, error: String(e && e.message || e).slice(0, 400), have }, 409);
-            }
-            if (!r.packB64) return sendBytes(res, Buffer.alloc(0), 204, r.head ? { "x-nomos-head": r.head } : {});
-            const kind = r.divergent ? "full" : have ? "delta" : "full";
-            sendBytes(res, unb64(r.packB64), 200, {
-              "content-type": "application/x-git-packfile",
-              "x-nomos-pack": kind,
-              ...r.divergent ? { "x-nomos-divergent": "1" } : {},
-              ...r.head ? { "x-nomos-head": r.head } : {}
-            });
-          });
-        }
-        if (sub[0] === "snapshot" && req.method === "GET") {
-          return serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            const bytes = snapshot(eng, ws);
-            sendBytes(res, bytes, 200, { "content-type": "application/octet-stream", "x-nomos-layout": "flat-manifest-v1" });
-          });
-        }
-        if (sub[0] === "aggregates" && sub[1] || sub[0] === "qbyid" && req.method === "GET") {
-          const id = sub[0] === "aggregates" ? decodeURIComponent(sub.slice(1).join("/")) : url.searchParams.get("id");
-          return serialize(async () => {
-            await mountWorkspace(eng, ws, ledgerFor(ws));
-            const rows = qById(eng, ws, id, principalOf(req));
-            sendJson(res, { ok: true, ws, rows });
-          });
-        }
-        if (sub[0] === "subscribe") {
-          return sendJson(res, { ok: false, error: "subscribe requires a WebSocket upgrade" }, 426);
-        }
-        if ((sub.length === 1 || sub.length === 2) && (req.method === "POST" || req.method === "GET")) {
-          const opName = sub.join("/");
-          const method = req.method.toLowerCase();
-          return serialize(async () => {
-            const ledger = ledgerFor(ws);
-            await mountWorkspace(eng, ws, ledger);
-            const spec = openapiFor(ws);
-            const resolved = resolveGatewayOperation(spec, opName, method);
-            if (resolved.ambiguous) return sendJson(res, { ok: false, error: "ambiguous operation", candidates: resolved.ambiguous }, 409);
-            const x = resolved.op && resolved.op["x-nomos"];
-            if (!x) {
-              if (RECOGNIZED_UNSUPPORTED.has(opName)) {
-                return sendJson(res, {
-                  ok: false,
-                  unsupported: true,
-                  route: opName,
-                  error: `'${opName}' is a recognized Nomos Cloud route that 'githolon cloud dev' (single-node local) does not serve \u2014 ${UNSUPPORTED_WHY[opName] || "a multi-node / Cloudflare-infra concern"}. This is NOT an app bug; if you need it locally, ask the Nomos devs.`
-                }, 501);
-              }
-              return sendJson(res, { ok: false, error: "unknown operation", see: `GET /v2/workspaces/${ws}` }, 404);
-            }
-            const principal = principalOf(req);
-            const authToken = authTokenOf(req);
-            if (x.kind === "offer" && method === "post") {
-              const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
-              if (body.intentRef && typeof body.intentRef === "object") {
-                const resolved2 = await resolveStagedIntent(stageBucket, body.intentRef);
-                if (!resolved2.ok) return sendJson(res, { ok: false, refused: true, error: resolved2.error }, resolved2.status);
-                body.intentBytes = resolved2.intentB64;
-              }
-              try {
-                let out;
-                if (typeof body.intentBytes === "string" && body.intentBytes) {
-                  out = offerAdmit(eng, ws, unb64(body.intentBytes), {});
-                  if (out.ok) await commitAndPush(eng, ws, ledger);
-                } else {
-                  const { actor, authorSecret, attestations, ...payload } = body;
-                  const effectiveActor = actor || principal || "";
-                  const lawHash = (currentLaw(eng, ws) || {})[x.domain] || "";
-                  out = await authorOn(eng, ws, ledger, x.domain, x.directiveId, payload, lawHash, {
-                    actor: effectiveActor,
-                    ...effectiveActor ? { principalVerified: true } : {},
-                    ...authToken ? { authToken } : {},
-                    ...authorSecret ? { authorSecret } : {},
-                    ...Array.isArray(attestations) ? { attestations } : {}
-                  });
-                }
-                if (!out.ok) return sendJson(res, { ok: false, refused: true, error: String(out.error).slice(0, 600) }, 422);
-                const born = out.born ? await persistBorn(out.born) : void 0;
-                sendJson(res, { ok: true, ws, head: out.head, ...born ? { born } : {}, ...out.birthOutcomes ? { birthOutcomes: out.birthOutcomes } : {} });
-              } catch (e) {
-                sendJson(res, { ok: false, refused: true, error: String(e && e.message || e).slice(0, 600) }, 422);
-              }
-              return;
-            }
-            if (method === "get") {
-              const group = url.searchParams.get("group") || "";
-              try {
-                if (x.kind === "query") {
-                  const params = {};
-                  for (const k of x.key || []) {
-                    const v = url.searchParams.get(k);
-                    if (v != null) params[k] = v;
-                  }
-                  const rows = query(eng, ws, x.queryId, JSON.stringify(params), principal);
-                  return sendJson(res, { ok: true, ws, rows });
-                }
-                if (x.kind === "count") return sendJson(res, { ok: true, ws, ...count(eng, ws, x.countId, group, principal) });
-                if (x.kind === "sum") return sendJson(res, { ok: true, ws, ...sum(eng, ws, x.sumId, group, principal) });
-                if (x.kind === "extremum") return sendJson(res, { ok: true, ws, ...extremum(eng, ws, x.extremumId, x.extremumKind || url.searchParams.get("kind") || "", group, principal) });
-                if (x.kind === "spatial") return sendJson(res, { ok: true, ws, ...spatialWithin(eng, ws, x.spatialId, url.searchParams.get("bbox") || {}, principal) });
-                if (x.kind === "pendingConflicts") return sendJson(res, { ok: true, ws, rows: pendingConflicts(eng, ws, principal) });
-              } catch (e) {
-                return sendJson(res, { ok: false, error: String(e && e.message || e).slice(0, 600) }, 403);
-              }
-            }
-            sendJson(res, { ok: false, error: "unroutable operation" }, 404);
-          });
-        }
-      }
-      sendJson(res, { ok: false, error: "not found", path: url.pathname }, 404);
-    } catch (e) {
-      sendJson(res, { ok: false, error: String(e && e.message || e).slice(0, 600) }, 500);
-    }
-  });
-  async function gitBackend(req, res, repoPathInfo, ws) {
-    const body = await readBody(req);
-    let sessionPush = false;
-    if (ws && req.method === "POST" && /git-receive-pack/.test(repoPathInfo)) {
-      try {
-        sessionPush = receivePackCommands(body).some((c) => c.ref.startsWith("refs/heads/session/"));
-      } catch {
-      }
-    }
-    const out = await runGitHttpBackend(custody.root, {
-      method: req.method,
-      pathInfo: "/" + repoPathInfo,
-      query: new URL(req.url, origin).search.replace(/^\?/, ""),
-      contentType: req.headers["content-type"],
-      body
-    });
-    res.writeHead(out.status, { ...out.headers, ...CORS });
-    res.end(out.body);
-    if (sessionPush) scheduleAdmit(ws);
-  }
-  const admitTimers = /* @__PURE__ */ new Map();
-  function scheduleAdmit(ws) {
-    if (admitTimers.has(ws)) clearTimeout(admitTimers.get(ws));
-    admitTimers.set(ws, setTimeout(() => {
-      admitTimers.delete(ws);
-      serialize(async () => {
-        try {
-          const ledger = ledgerFor(ws);
-          await mountWorkspace(eng, ws, ledger);
-          const out = await admitAll(eng, ws, ledger, {});
-          if (Array.isArray(out.born) && out.born.length) await persistBorn(packBornChildren(eng, out.born));
-        } catch (e) {
-          console.error(`[dev-cloud] admit ${ws} failed:`, String(e && e.message || e));
-        }
-      });
-    }, 350));
-  }
-  server.on("upgrade", (req, socket) => {
-    const key = req.headers["sec-websocket-key"];
-    if (!key) return socket.destroy();
-    const accept = createHash("sha1").update(key + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11").digest("base64");
-    socket.write(
-      `HTTP/1.1 101 Switching Protocols\r
-Upgrade: websocket\r
-Connection: Upgrade\r
-Sec-WebSocket-Accept: ${accept}\r
-\r
-`
-    );
-    socket.on("data", () => {
-    });
-    socket.on("error", () => {
-    });
-  });
-  if (!globalThis.__nomosDevGuards) {
-    globalThis.__nomosDevGuards = true;
-    process.on("unhandledRejection", (e) => {
-      console.error("[dev-cloud] unhandledRejection (kept alive):", String(e && e.stack || e && e.message || e).slice(0, 500));
-    });
-    process.on("uncaughtException", (e) => {
-      console.error("[dev-cloud] uncaughtException (kept alive):", String(e && e.stack || e && e.message || e).slice(0, 500));
-    });
-  }
-  await new Promise((resolve) => server.listen(port, host, resolve));
-  return { server, origin, dataDir, kernelSha, eng, custody, ledgerFor, serialize, persistBorn, close: () => new Promise((r) => server.close(r)) };
-}
-function parseArgs(argv) {
-  const o = {};
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === "--ephemeral") o.ephemeral = true;
-    else if (a === "--port") o.port = parseInt(argv[++i], 10);
-    else if (a === "--data") o.data = argv[++i];
-    else if (a === "--firebase-project") o.firebaseProject = argv[++i];
-    else if (a === "--platform") o.platform = argv[++i];
-    else if (a === "--deploy") o.deploy = argv[++i];
-    else if (a === "--auth-provider") o.authProvider = argv[++i];
-    else if (a === "--bootstrap") o.bootstrap = true;
-    else if (a === "--attested") o.attested = true;
-    else if (a === "--kernel-source") o.kernelSource = argv[++i];
-  }
-  return o;
-}
-if (import.meta.url === `file://${process.argv[1]}`) {
-  const opts = parseArgs(process.argv.slice(2));
-  const dev = await startDevCloud(opts);
-  console.log(`[dev-cloud] Nomos dev cloud listening on ${dev.origin}`);
-  console.log(`[dev-cloud]   data dir : ${dev.dataDir}`);
-  console.log(`[dev-cloud]   kernel   : ${dev.kernelSha.slice(0, 16)}\u2026`);
-  console.log(`[dev-cloud]   point your Flutter app's cloud: base URL at ${dev.origin}`);
-  if (opts.bootstrap || opts.platform) {
-    const { bootstrapPlatform: bootstrapPlatform2 } = await Promise.resolve().then(() => (init_bootstrap(), bootstrap_exports));
-    await bootstrapPlatform2(dev, opts).catch((e) => console.error("[dev-cloud] bootstrap failed:", e));
-  }
-  process.on("SIGINT", async () => {
-    await dev.close();
-    process.exit(0);
-  });
-}
-export {
-  startDevCloud
-};