githolon 0.93.0 → 0.94.0

package/dist/cli.mjs

@@ -9,7 +9,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// vendor/engine/git-fs.mjs
+// vendor/engine/git-fs.ts
 function fsErr(code, p) {
   const e = new Error(`${code}: ${p}`);
   e.code = code;
@@ -17,7 +17,7 @@ function fsErr(code, p) {
 }
 function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
   const root = preopen.dir;
-  const isDir = (n) => n && n.contents instanceof Map;
+  const isDir = (n) => !!n && n.contents instanceof Map;
   function parts(p) {
     if (p === mount) return [];
     if (!p.startsWith(mount + "/")) throw fsErr("ENOENT", p);
@@ -107,14 +107,14 @@ function makeGitFs(preopen, mount, { File: File3, Directory: Directory3 }) {
   return { promises };
 }
 var init_git_fs = __esm({
-  "vendor/engine/git-fs.mjs"() {
+  "vendor/engine/git-fs.ts"() {
     "use strict";
   }
 });
 
-// vendor/engine/tree.mjs
+// vendor/engine/tree.ts
 function flatten(dir, prefix, out13) {
-  for (const [name, inode] of dir.contents) {
+  for (const [name, inode] of dir.contents ?? /* @__PURE__ */ new Map()) {
     const path = prefix ? prefix + "/" + name : name;
     if (inode.contents instanceof Map) {
       out13.push({ path, dir: true });
@@ -153,14 +153,14 @@ function serializeTree(workTree) {
 }
 var enc, dec;
 var init_tree = __esm({
-  "vendor/engine/tree.mjs"() {
+  "vendor/engine/tree.ts"() {
     "use strict";
     enc = new TextEncoder();
     dec = new TextDecoder();
   }
 });
 
-// vendor/engine/custody-transport.mjs
+// vendor/engine/custody-transport.ts
 function concatBytes(chunks) {
   let n = 0;
   for (const c of chunks) n += c.length;
@@ -284,7 +284,7 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 }
 var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
 var init_custody_transport = __esm({
-  "vendor/engine/custody-transport.mjs"() {
+  "vendor/engine/custody-transport.ts"() {
     "use strict";
     enc2 = new TextEncoder();
     dec2 = new TextDecoder();
@@ -329,7 +329,7 @@ var init_custody_transport = __esm({
   }
 });
 
-// vendor/engine/engine.mjs
+// vendor/engine/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
   NOMOS_SHARD_ROWS_READ: () => NOMOS_SHARD_ROWS_READ,
@@ -485,7 +485,7 @@ function call(ex, mode, fields, STDERR) {
       packed = ex.git_holon_call(reqPtr, req.length);
     } catch (e) {
       const tail = STDERR.length ? ` | stderr: ${STDERR.slice(-8).join(" / ")}` : "";
-      throw new Error(`${String(e && e.stack || e)}${tail}`);
+      throw new Error(`${String(e?.stack || e)}${tail}`);
     }
     const { ptr, len } = unpack(packed);
     try {
@@ -516,9 +516,10 @@ async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, insta
   const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
   const code = wasi.start(inst);
   if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
-  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!inst.exports[n]) throw new Error(`missing export ${n}`);
+  const instExports = inst.exports;
+  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!instExports[n]) throw new Error(`missing export ${n}`);
   const eng = {
-    ex: inst.exports,
+    ex: instExports,
     preopen,
     STDERR,
     seq: 0,
@@ -555,7 +556,7 @@ async function wrongHomeVerdict(shardRouting, route, payload) {
     const tag = routeTagHexOfMintedId(value);
     if (tag !== void 0) {
       for (const a of rows) {
-        if (await routeTagHexOfHomeKey(a.homeKey) === tag) {
+        if (await routeTagHexOfHomeKey(String(a.homeKey)) === tag) {
           assignment = a;
           break;
         }
@@ -827,7 +828,7 @@ async function deriveSummarySuffix(eng, ws, fromOid) {
               touchedBuckets.add(ak);
             }
             for (const bk of touchedBuckets) {
-              const ov = extRunning.has(bk) ? extRunning.get(bk) : null;
+              const ov = extRunning.has(bk) ? extRunning.get(bk) ?? null : null;
               const nv = recomputeExt(read, bk);
               if (nv === ov) continue;
               extRunning.set(bk, nv);
@@ -839,7 +840,7 @@ async function deriveSummarySuffix(eng, ws, fromOid) {
             }
           } else {
             for (const d of contributionDiff(read, before, after)) {
-              bump(summaryKey(d.readId, d.group), d.delta);
+              bump(summaryKey(d.readId, d.group), d.delta ?? 0);
               deltas.push(d);
             }
           }
@@ -872,6 +873,7 @@ async function deriveSummarySuffix(eng, ws, fromOid) {
     }
   }
   if (!sawFrom) return { ok: false, error: `fromOid ${String(fromOid).slice(0, 12)} is not on this shard's main \u2014 cannot derive the suffix` };
+  if (!prevs) prevs = /* @__PURE__ */ new Map();
   const touched = /* @__PURE__ */ new Set();
   for (const ev of events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
   const subtotals = [];
@@ -1213,7 +1215,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
         admittedTotal += 1;
         if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
         if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
-        if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head, intentId);
+        if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head ?? "", intentId);
       } else {
         const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
         rec.rejected.push({ oid, error, deadLettered: true });
@@ -1247,7 +1249,7 @@ async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null,
   let resultPackB64 = null;
   if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
     try {
-      const p = servePack(eng, ws, clientBase);
+      const p = servePack(eng, ws, clientBase ?? "");
       if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
     } catch {
     }
@@ -1270,7 +1272,7 @@ async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash,
   try {
     res = author(eng, ws, domain, directiveId, payload, lawHash, opts);
   } catch (e) {
-    return { ok: false, error: String(e && e.message || e).slice(0, 500) };
+    return { ok: false, error: String(e?.message || e).slice(0, 500) };
   }
   if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
   await commitAndPush(eng, ws, ledger);
@@ -1322,7 +1324,7 @@ async function deepVerifyShard(eng, shardWs, shardLedger, coordinatorRows) {
 }
 function stageWorkspaceDir(eng, ws) {
   const wsContents = /* @__PURE__ */ new Map();
-  eng.preopen.dir.contents.get("ws").contents.set(ws, new Directory(wsContents));
+  dirOf(eng.preopen.dir.contents.get("ws")).contents.set(ws, new Directory(wsContents));
 }
 async function mountWorkspace(eng, ws, ledger) {
   if (eng.mounted.has(ws)) return eng.mounted.get(ws);
@@ -1337,7 +1339,7 @@ async function mountWorkspace(eng, ws, ledger) {
       restored = true;
     }
   } catch (e) {
-    restoreError = String(e && e.stack || e).split("\n").slice(0, 5).join(" | ");
+    restoreError = String(e?.stack || e).split("\n").slice(0, 5).join(" | ");
   }
   const m = { restored, remoteMain, restoreError };
   eng.mounted.set(ws, m);
@@ -1379,7 +1381,7 @@ async function queryEphemeral(eng, ws, mountOpts, queryId, paramsJson, principal
 function unmount(eng, ws) {
   eng.mounted.delete(ws);
   eng.mainIntents.delete(ws);
-  const wsRoot = eng.preopen.dir.contents.get("ws");
+  const wsRoot = dirOf(eng.preopen.dir.contents.get("ws"));
   if (wsRoot) wsRoot.contents.delete(ws);
 }
 function writeWork(eng, name, bytes) {
@@ -1540,7 +1542,7 @@ async function readCheckpointBlob(eng, ws, commitOid) {
   let codec = "gzip";
   let stateRoot = null;
   try {
-    const m = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, commitOid, "meta")));
+    const m = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, commitOid, "meta") ?? new Uint8Array()));
     codec = m.codec ?? "gzip";
     stateRoot = m.stateRoot ?? null;
   } catch {
@@ -1571,7 +1573,7 @@ async function lawParity(eng, ws, lawHash) {
 }
 async function pushCheckpoint(eng, ws, ledger, lawHash) {
   try {
-    lawHash = await lawParity(eng, ws, lawHash);
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
     if (!lawHash) return { pushed: false, reason: "no-law" };
     const gitdir = gitdirOf(ws);
     const head = kgit.resolveRef(eng, gitdir, "refs/heads/main");
@@ -1588,12 +1590,12 @@ async function pushCheckpoint(eng, ws, ledger, lawHash) {
     eng._ckptPushed.set(ws, tag);
     return { pushed: true, cursor: ex.cursor, bytes: ex.bytes ?? 0 };
   } catch (e) {
-    return { pushed: false, reason: String(e && e.message || e).slice(0, 160) };
+    return { pushed: false, reason: String(e?.message || e).slice(0, 160) };
   }
 }
 async function stageCheckpoint(eng, ws, lawHash) {
   try {
-    lawHash = await lawParity(eng, ws, lawHash);
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
     if (!lawHash) return null;
     eng._ckptPushed ??= /* @__PURE__ */ new Map();
     const ex = exportCheckpoint(eng, ws);
@@ -1631,7 +1633,7 @@ async function restoreCheckpointFromCustody(eng, ws, ledger, lawHash) {
     if (mounted?.checkpoint?.restored) {
       return { restored: false, reason: "already-mounted-checkpoint" };
     }
-    lawHash = await lawParity(eng, ws, lawHash);
+    lawHash = await lawParity(eng, ws, lawHash) ?? "";
     if (!lawHash) return { restored: false, reason: "no-law" };
     const ref = CKPT_REF(lawHash);
     const serverRefs = await custodyLsRefs(ledger, ref);
@@ -1646,7 +1648,7 @@ async function restoreCheckpointFromCustody(eng, ws, ledger, lawHash) {
     }
     return { restored: r && r.restored === true, frontierSeeded: r && r.frontierSeeded === true, cursor: r && r.cursor, reason: r && r.reason };
   } catch (e) {
-    return { restored: false, reason: String(e && e.message || e).slice(0, 160) };
+    return { restored: false, reason: String(e?.message || e).slice(0, 160) };
   }
 }
 async function custodySkeleton(eng, gitdir) {
@@ -1655,7 +1657,7 @@ async function custodySkeleton(eng, gitdir) {
     try {
       await p.mkdir(`${gitdir}${d}`);
     } catch (e) {
-      if (e && e.code !== "EEXIST") throw e;
+      if (e?.code !== "EEXIST") throw e;
     }
   }
   try {
@@ -1673,11 +1675,14 @@ async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", lo
   const refs = await custodyLsRefs(ledger, remoteRefFull);
   const tip = refs[remoteRefFull] || null;
   if (!tip) return null;
-  if (tip !== have) applyPackInto(eng, ws, await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] }));
+  if (tip !== have) {
+    const pk = await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
+    if (pk) applyPackInto(eng, ws, pk);
+  }
   kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
-async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null } = {}) {
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
   const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
@@ -1849,18 +1854,18 @@ async function ingestPackAsCustody(eng, ws, packBytes, head) {
   eng.mounted.set(ws, { restored: true, remoteMain: head, restoreError: null });
   return { ok: true, head: kgit.resolveRef(eng, gitdir, "refs/heads/main") };
 }
-function offerIntent(eng, ws, bytes, opts) {
+function offerIntent(eng, ws, bytes, opts = {}) {
   const name = `offer-in-${eng.seq++}.json`;
   writeWork(eng, name, bytes);
   const deferProjection = !!(opts && opts.defer);
   const branch = opts && opts.branch || BRANCH;
   return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
 }
-function offerAdmit(eng, ws, bytes, opts) {
+function offerAdmit(eng, ws, bytes, opts = {}) {
   const v = offerIntent(eng, ws, bytes, opts);
   return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
 }
-function applyIntentBytes(eng, ws, bytes, opts) {
+function applyIntentBytes(eng, ws, bytes, opts = {}) {
   return offerAdmit(eng, ws, bytes, opts);
 }
 async function mainIntentIds(eng, ws) {
@@ -1936,7 +1941,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
         try {
           await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: localMain });
         } catch (thinErr) {
-          log("thin-fetch-fallback", { ws, cid, error: String(thinErr && thinErr.message || thinErr).slice(0, 160) });
+          log("thin-fetch-fallback", { ws, cid, error: String(thinErr?.message || thinErr).slice(0, 160) });
           await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: null });
         }
       } finally {
@@ -1945,7 +1950,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
       }
       const _walkDone = _span(`walk ${shortCid}`, "cwalk", 2, { client: cid });
       const main2 = await mainIntentIds(eng, ws);
-      const recent = kgit.intentsAbove(eng, gitdir, head, "", 100);
+      const recent = kgit.intentsAbove(eng, gitdir, head ?? "", "", 100);
       const chain = [];
       for (let i = recent.length - 1; i >= 0; i--) {
         if (main2.oids.has(recent[i].oid)) break;
@@ -2034,7 +2039,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
             main2.oids.add(res.head);
             main2.head = res.head;
             admitted.push({ oid: oid.slice(0, 10), head: res.head });
-            if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head, intentId);
+            if (cap2) finishSummaryCapture(eng, ws, summaryCtx, cap2, res.head ?? "", intentId);
             if (shardRouting && dirId) {
               const placement = placementDirectives(eng).get(dirId);
               if (placement) {
@@ -2043,7 +2048,7 @@ async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = n
                   p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
                 } catch {
                 }
-                const homeKey = p ? p[placement.keyField] : void 0;
+                const homeKey = p ? p[String(placement.keyField)] : void 0;
                 if (typeof homeKey === "string" && typeof p?.shard === "string") {
                   placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
                 }
@@ -2171,7 +2176,7 @@ async function backupHead(eng, ws, ledger, head) {
     await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
     return { ok: true, head };
   } catch (e) {
-    return { ok: false, error: String(e && e.message || e).slice(0, 200), head };
+    return { ok: false, error: String(e?.message || e).slice(0, 200), head };
   }
 }
 async function backupToCustody(eng, ws, ledger, { consumed = [] } = {}) {
@@ -2227,7 +2232,7 @@ async function rebirthCompact(eng, ws, ledger, { reason = "", supersededAt = 0,
         return false;
       }
     };
-    const transformState = (sealedBytes) => sealedBytes;
+    const transformState = (sealedBytes, _ctx) => sealedBytes;
     const carried = [];
     const parkedIntents = [];
     const parkedBlobs = [];
@@ -2322,7 +2327,7 @@ async function rebirthCompact(eng, ws, ledger, { reason = "", supersededAt = 0,
       unmount(eng, incWs);
     } catch {
     }
-    return { ok: false, error: String(e && e.message || e).slice(0, 300) };
+    return { ok: false, error: String(e?.message || e).slice(0, 300) };
   }
 }
 async function archiveRefusedMain(eng, ws, ledger, label) {
@@ -2349,7 +2354,7 @@ async function writeRefusedRef(eng, ws, dl) {
   try {
     const prevOid = kgit.resolveRef(eng, gitdir, refForStamp);
     if (prevOid) {
-      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, prevOid, "verdict.json")));
+      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, prevOid, "verdict.json") ?? new Uint8Array()));
       if (prev && typeof prev.parkedAt === "string") parkedAt = prev.parkedAt;
     }
   } catch {
@@ -2379,8 +2384,8 @@ async function listRefusedRefs(eng, ws) {
   const out13 = [];
   for (const { ref, oid } of refs) {
     try {
-      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json");
-      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json");
+      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array();
+      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json") ?? new Uint8Array();
       const v = JSON.parse(dec3.decode(vb));
       out13.push({ ref, ...v, intentB64: b64Bytes(ib) });
     } catch {
@@ -2394,7 +2399,7 @@ async function refusedSummary(eng, ws) {
   let count2 = 0, latestParkedAt = null;
   for (const { oid } of refs) {
     try {
-      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json")));
+      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array()));
       count2++;
       if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
     } catch {
@@ -2532,7 +2537,7 @@ async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}
   return { head: result.head, installation };
 }
 function snapshot(eng, ws) {
-  const wsDir = eng.preopen.dir.contents.get("ws").contents.get(ws);
+  const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
   return serializeTree(wsDir);
 }
 function stats(eng) {
@@ -2562,7 +2567,7 @@ async function ledgerStats(eng, ws, ledger = null) {
   }
   if (!head) return { head: null, commits: 0 };
   const mounted = eng.mounted.get(ws);
-  if (mounted?.ledgerStats?.head === head) return mounted.ledgerStats;
+  if (mounted && mounted.ledgerStats?.head === head) return mounted.ledgerStats;
   const commits = kgit.intentsAbove(eng, gitdir, head).length;
   const out13 = { head, commits };
   if (mounted) mounted.ledgerStats = out13;
@@ -2580,7 +2585,7 @@ async function countRemoteCommits(eng, ledger) {
     return { head, commits };
   } finally {
     try {
-      eng.preopen.dir.contents.get("ws").contents.delete(scratch);
+      dirOf(eng.preopen.dir.contents.get("ws")).contents.delete(scratch);
     } catch {
     }
   }
@@ -2629,9 +2634,9 @@ function sealAttestationBatches(eng, ws, domain, controllerHash, opts = {}) {
   }
   return outcomes;
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, projectionStats;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, CKPT_REF, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, check, expand, cryptoSealField, cryptoKeygen, authorKeygen, eraCertSign, delegationCertSign, attestationSign, attestedRead, certSign, cryptoWrapKey, cryptoUnwrapKey, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, outboxRefName, projectionStats;
 var init_engine = __esm({
-  "vendor/engine/engine.mjs"() {
+  "vendor/engine/engine.ts"() {
     "use strict";
     init_git_fs();
     init_tree();
@@ -2640,6 +2645,7 @@ var init_engine = __esm({
     dec3 = new TextDecoder();
     BRANCH = "main";
     RESULT_PACK_INLINE_MAX = 256 * 1024;
+    dirOf = (n) => n;
     repoArgOf = (ws) => `/work/ws/${ws}`;
     gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
     unpack = (p) => {
@@ -2724,7 +2730,7 @@ var init_engine = __esm({
     certSign = (eng, { child, founder, verified, parentKey, parentId, epoch, secret }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "certSign", child, founder, verified, parentKey, parentId, epoch, secret }) }, eng.STDERR)).cert;
     cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoWrapKey", recipientPub, scopeKey }) }, eng.STDERR));
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng.STDERR)).scopeKey;
-    readPosture = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture" }), principal, branch: BRANCH }, eng.STDERR));
+    readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture", authToken, nowUnix }), principal, branch: BRANCH }, eng.STDERR));
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     pendingConflicts = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts" }), principal, branch: BRANCH }, eng.STDERR));
@@ -5373,9 +5379,10 @@ async function deploy2(ws, opts) {
     }
     deployedHash = targetHash2;
   } else {
+    const presented = opts.principal ?? await sessionToken().catch(() => void 0) ?? activePrincipal();
     const r = await fetch(`${cloud}/v2/workspaces/${ws}/domains`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...presented !== void 0 ? principalHeaders(presented) : {} },
       body: readFileSync5(file, "utf8")
     });
     const d = await r.json().catch(() => void 0);
@@ -8548,23 +8555,21 @@ async function gitRemote(ws, name, opts) {
     }
   }
   const token = await sessionToken().catch(() => void 0);
-  if (token === void 0) {
-    const principal = loadCreds().principal;
-    if (principal === void 0) {
-      err6(
-        `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
+  const principal = currentPrincipal();
+  if (principal === void 0) {
+    err6(
+      `remote '${name}' \u2192 ${url} is wired, but a BIRTH push needs a principal:
   githolon login --agent   (then just push)
   \u2014 or re-run after githolon ws create/login so a principal is on file`
-      );
-      return 1;
-    }
-    if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
-      err6("git config failed setting the principal header");
-      return 1;
-    }
+    );
+    return 1;
+  }
+  if (git(["config", `http.${url}.extraHeader`, `x-nomos-principal: ${principal}`]) !== 0) {
+    err6("git config failed setting the principal header");
+    return 1;
   }
   out6(`\u2713 remote '${name}' \u2192 ${url}`);
-  out6(`  workspace secret on file; ${token !== void 0 ? "births ride your session (verified)" : "births ride x-nomos-principal (bare uid)"}`);
+  out6(`  workspace secret on file; ${token !== void 0 ? "births ride your session token (verified) + x-nomos-principal claim" : "births ride x-nomos-principal (bare uid)"}`);
   out6(`  birth/deploy by push:  git push ${name} main`);
   return 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.93.0",
+  "version": "0.94.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.93.0",
-    "@githolon/dsl": "^0.93.0",
+    "@githolon/client": "^0.94.0",
+    "@githolon/dsl": "^0.94.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {