githolon 0.97.0 → 0.97.1

package/dist/dev-server.mjs

@@ -0,0 +1,2829 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../adapter/git-fs.ts
+function fsErr(code, p) {
+  const e = new Error(`${code}: ${p}`);
+  e.code = code;
+  return e;
+}
+function makeGitFs(preopen, mount, { File: File2, Directory: Directory2 }) {
+  const root = preopen.dir;
+  const isDir = (n) => !!n && n.contents instanceof Map;
+  function parts(p) {
+    if (p === mount) return [];
+    if (!p.startsWith(mount + "/")) throw fsErr("ENOENT", p);
+    const rel = p.slice(mount.length + 1).replace(/\/+$/, "");
+    return rel === "" ? [] : rel.split("/");
+  }
+  function resolve(ps) {
+    let cur = root;
+    for (const part of ps) {
+      if (!isDir(cur)) return null;
+      const next = cur.contents.get(part);
+      if (next === void 0) return null;
+      cur = next;
+    }
+    return cur;
+  }
+  const parent = (ps) => resolve(ps.slice(0, -1));
+  const leaf = (ps) => ps[ps.length - 1];
+  const promises = {
+    async readFile(p, opts) {
+      const n = resolve(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      if (isDir(n)) throw fsErr("EISDIR", p);
+      const data = n.data ?? new Uint8Array(0);
+      const encoding = typeof opts === "string" ? opts : opts && opts.encoding;
+      return encoding ? new TextDecoder().decode(data) : new Uint8Array(data);
+    },
+    async writeFile(p, data) {
+      const ps = parts(p);
+      const par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      const bytes = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+      par.contents.set(leaf(ps), new File2(bytes));
+    },
+    async unlink(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par) || !par.contents.delete(leaf(ps))) throw fsErr("ENOENT", p);
+    },
+    async readdir(p) {
+      const n = resolve(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      if (!isDir(n)) throw fsErr("ENOTDIR", p);
+      return [...n.contents.keys()];
+    },
+    async mkdir(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      if (par.contents.has(leaf(ps))) throw fsErr("EEXIST", p);
+      par.contents.set(leaf(ps), new Directory2(/* @__PURE__ */ new Map()));
+    },
+    async rmdir(p) {
+      const ps = parts(p), par = parent(ps);
+      if (!isDir(par)) throw fsErr("ENOENT", p);
+      par.contents.delete(leaf(ps));
+    },
+    async stat(p) {
+      return promises.lstat(p);
+    },
+    async lstat(p) {
+      const n = resolve(parts(p));
+      if (n === null) throw fsErr("ENOENT", p);
+      const dir = isDir(n);
+      return {
+        type: dir ? "dir" : "file",
+        mode: dir ? 16384 : 33188,
+        size: dir ? 0 : n.data ? n.data.length : 0,
+        ino: 0,
+        mtimeMs: 0,
+        ctimeMs: 0,
+        uid: 1,
+        gid: 1,
+        dev: 1,
+        isFile: () => !dir,
+        isDirectory: () => dir,
+        isSymbolicLink: () => false
+      };
+    },
+    async readlink(p) {
+      throw fsErr("EINVAL", p);
+    },
+    async symlink() {
+      throw fsErr("EPERM", "symlink unsupported");
+    },
+    async chmod() {
+    }
+  };
+  return { promises };
+}
+var init_git_fs = __esm({
+  "../adapter/git-fs.ts"() {
+    "use strict";
+  }
+});
+
+// ../adapter/tree.ts
+function flatten(dir, prefix, out) {
+  for (const [name, inode] of dir.contents ?? /* @__PURE__ */ new Map()) {
+    const path2 = prefix ? prefix + "/" + name : name;
+    if (inode.contents instanceof Map) {
+      out.push({ path: path2, dir: true });
+      flatten(inode, path2, out);
+    } else {
+      out.push({ path: path2, dir: false, bytes: inode.data ?? new Uint8Array(0) });
+    }
+  }
+}
+function serializeTree(workTree) {
+  const entries = [];
+  flatten(workTree, "", entries);
+  const chunks = [];
+  const header = new Uint8Array(4);
+  new DataView(header.buffer).setUint32(0, entries.length, true);
+  chunks.push(header);
+  for (const e of entries) {
+    const pathBytes = enc.encode(e.path);
+    const body = e.dir ? new Uint8Array(0) : e.bytes ?? new Uint8Array(0);
+    const meta = new Uint8Array(9);
+    const dv = new DataView(meta.buffer);
+    dv.setUint8(0, e.dir ? 1 : 0);
+    dv.setUint32(1, pathBytes.length, true);
+    dv.setUint32(5, body.length, true);
+    chunks.push(meta, pathBytes, body);
+  }
+  let total = 0;
+  for (const c of chunks) total += c.length;
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const c of chunks) {
+    out.set(c, off);
+    off += c.length;
+  }
+  return out;
+}
+var enc, dec;
+var init_tree = __esm({
+  "../adapter/tree.ts"() {
+    "use strict";
+    enc = new TextEncoder();
+    dec = new TextDecoder();
+  }
+});
+
+// ../adapter/custody-transport.ts
+function concatBytes(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  const out = new Uint8Array(n);
+  let o = 0;
+  for (const c of chunks) {
+    out.set(c, o);
+    o += c.length;
+  }
+  return out;
+}
+function pkt(payload) {
+  const body = typeof payload === "string" ? enc2.encode(payload) : payload;
+  const len = (body.length + 4).toString(16).padStart(4, "0");
+  return concatBytes([enc2.encode(len), body]);
+}
+function readPktLines(buf, off = 0) {
+  const lines = [];
+  while (off + 4 <= buf.length) {
+    const hex = dec2.decode(buf.subarray(off, off + 4));
+    if (!/^[0-9a-f]{4}$/.test(hex)) break;
+    const len = parseInt(hex, 16);
+    if (len === 0) {
+      off += 4;
+      break;
+    }
+    if (len < 4 || off + len > buf.length) break;
+    lines.push(buf.subarray(off + 4, off + len));
+    off += len;
+  }
+  return { lines, rest: off };
+}
+async function lsRefs(remote, headers = {}, { service = "git-upload-pack", prefix = null } = {}) {
+  const r = await fetch(`${remote}/info/refs?service=${service}`, { headers });
+  if (!r.ok) {
+    if (r.status === 404) return {};
+    throw new Error(`info/refs ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  }
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const banner = readPktLines(buf, 0);
+  const { lines } = readPktLines(buf, banner.rest);
+  const refs = {};
+  for (const line of lines) {
+    let s = dec2.decode(line).replace(/\n$/, "");
+    if (s.startsWith("#")) continue;
+    const nul = s.indexOf("\0");
+    if (nul >= 0) s = s.slice(0, nul);
+    const sp = s.indexOf(" ");
+    if (sp !== 40) continue;
+    const oid = s.slice(0, 40), name = s.slice(41);
+    if (!/^[0-9a-f]{40}$/.test(oid)) continue;
+    if (prefix && !name.startsWith(prefix)) continue;
+    refs[name] = oid;
+  }
+  return refs;
+}
+async function fetchPack(remote, headers = {}, { wants = [], haves = [] } = {}) {
+  wants = wants.filter((w) => /^[0-9a-f]{40}$/.test(w) && w !== ZERO_OID);
+  if (!wants.length) return null;
+  const caps = "thin-pack ofs-delta agent=nomos-cloud";
+  const parts = [];
+  wants.forEach((w, i) => parts.push(pkt(`want ${w}${i === 0 ? " " + caps : ""}
+`)));
+  parts.push(FLUSH);
+  for (const h of haves) if (/^[0-9a-f]{40}$/.test(h) && h !== ZERO_OID) parts.push(pkt(`have ${h}
+`));
+  parts.push(pkt("done\n"));
+  const r = await fetch(`${remote}/git-upload-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-upload-pack-request", "accept": "application/x-git-upload-pack-result", ...headers },
+    body: concatBytes(parts)
+  });
+  if (!r.ok) throw new Error(`upload-pack ${r.status}: ${(await r.text()).slice(0, 180)}`);
+  const buf = new Uint8Array(await r.arrayBuffer());
+  const { lines, rest } = readPktLines(buf, 0);
+  const packChunks = [];
+  let sideband = false;
+  for (const line of lines) {
+    if (line.length === 0) continue;
+    const head = dec2.decode(line.subarray(0, Math.min(line.length, 3)));
+    if (head === "NAK" || head === "ACK" || head === "ERR" || head.startsWith("sha")) continue;
+    const band = line[0];
+    if (band === 1) {
+      packChunks.push(line.subarray(1));
+      sideband = true;
+    } else if (band === 2) {
+    } else if (band === 3) {
+      throw new Error("upload-pack fatal: " + dec2.decode(line.subarray(1)).slice(0, 180));
+    }
+  }
+  const pack = sideband ? concatBytes(packChunks) : buf.subarray(rest);
+  if (pack.length < 12 || dec2.decode(pack.subarray(0, 4)) !== "PACK") {
+    throw new Error(`upload-pack: no pack in response (${pack.length}B, sideband=${sideband})`);
+  }
+  return pack;
+}
+async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}) {
+  if (!updates.length) return { ok: true, noop: true };
+  const cmds = [];
+  updates.forEach((u, i) => {
+    const old = u.oldOid || ZERO_OID;
+    const neu = u.newOid || ZERO_OID;
+    const caps = i === 0 ? "\0report-status" : "";
+    cmds.push(pkt(`${old} ${neu} ${u.ref}${caps}
+`));
+  });
+  cmds.push(FLUSH);
+  const body = concatBytes([...cmds, pack && pack.length ? pack : EMPTY_PACK]);
+  const r = await fetch(`${remote}/git-receive-pack`, {
+    method: "POST",
+    headers: { "content-type": "application/x-git-receive-pack-request", ...headers },
+    body
+  });
+  const txt = dec2.decode(new Uint8Array(await r.arrayBuffer()));
+  const unpacked = /unpack ok/.test(txt);
+  const everyRefOk = updates.every((u) => new RegExp(`ok ${u.ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(txt));
+  if (!(r.ok && unpacked && everyRefOk && !/\bng /.test(txt))) {
+    throw new Error(`receive-pack ${r.status}: ${txt.replace(/[^\x20-\x7e]/g, " ").trim().slice(0, 200)}`);
+  }
+  return { ok: true };
+}
+var enc2, dec2, ZERO_OID, EMPTY_PACK, FLUSH;
+var init_custody_transport = __esm({
+  "../adapter/custody-transport.ts"() {
+    "use strict";
+    enc2 = new TextEncoder();
+    dec2 = new TextDecoder();
+    ZERO_OID = "0".repeat(40);
+    EMPTY_PACK = new Uint8Array([
+      80,
+      65,
+      67,
+      75,
+      0,
+      0,
+      0,
+      2,
+      0,
+      0,
+      0,
+      0,
+      // "PACK", ver 2, 0 objects
+      2,
+      157,
+      8,
+      130,
+      59,
+      216,
+      168,
+      234,
+      181,
+      16,
+      173,
+      106,
+      // sha1(the 12 header bytes)
+      199,
+      92,
+      130,
+      60,
+      253,
+      62,
+      211,
+      30
+    ]);
+    FLUSH = enc2.encode("0000");
+  }
+});
+
+// ../adapter/engine.ts
+import { WASI, File, Directory, OpenFile, ConsoleStdout, PreopenDirectory } from "@bjorn3/browser_wasi_shim";
+function b64Bytes(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(s);
+}
+function b64Json(o) {
+  return b64Bytes(enc3.encode(JSON.stringify(o)));
+}
+async function sha256hex(t) {
+  const b = await crypto.subtle.digest("SHA-256", enc3.encode(t));
+  return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+function osEntropyBuffer(n) {
+  const bytes = new Uint8Array(n * 8);
+  for (let o = 0; o < bytes.length; o += 65536) crypto.getRandomValues(bytes.subarray(o, Math.min(o + 65536, bytes.length)));
+  const out = new Array(n), T = 2 ** 53;
+  for (let i = 0; i < n; i++) {
+    let z = 0n;
+    for (let b = 7; b >= 0; b--) z = z << 8n | BigInt(bytes[i * 8 + b]);
+    out[i] = Number(z >> 11n) / T;
+  }
+  return out;
+}
+function stringifyBig(o) {
+  return JSON.stringify(o, (_k, v) => typeof v === "bigint" ? `@@B:${v}@@` : v).replace(/"@@B:(\d+)@@"/g, "$1");
+}
+function call(ex, mode, fields, STDERR) {
+  const req = enc3.encode(JSON.stringify({ mode, ...fields }));
+  const reqPtr = ex.git_holon_alloc(req.length);
+  try {
+    new Uint8Array(ex.memory.buffer, reqPtr, req.length).set(req);
+    let packed;
+    try {
+      packed = ex.git_holon_call(reqPtr, req.length);
+    } catch (e) {
+      const tail = STDERR.length ? ` | stderr: ${STDERR.slice(-8).join(" / ")}` : "";
+      throw new Error(`${String(e?.stack || e)}${tail}`);
+    }
+    const { ptr, len } = unpack(packed);
+    try {
+      const e = JSON.parse(dec3.decode(new Uint8Array(ex.memory.buffer, ptr, len).slice()));
+      if (!e.ok) throw new Error((e.error || "holon error") + (STDERR.length ? ` | ${STDERR.slice(-4).join(" / ")}` : ""));
+      return e.result;
+    } finally {
+      ex.git_holon_dealloc(ptr, len);
+    }
+  } finally {
+    ex.git_holon_dealloc(reqPtr, req.length);
+  }
+}
+async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy = "nomos-cloud" }) {
+  const hashes = { bootstrap: await sha256hex(bootstrapPkg), nomos: await sha256hex(nomosPkg) };
+  const root = /* @__PURE__ */ new Map();
+  root.set("domain.package.usda", new File(enc3.encode(bootstrapPkg)));
+  root.set("ws", new Directory(/* @__PURE__ */ new Map()));
+  const preopen = new PreopenDirectory("/work", root);
+  const STDERR = [];
+  const pushStderr = (l) => {
+    if (STDERR.length >= 500) STDERR.splice(0, STDERR.length - 499);
+    STDERR.push(l);
+  };
+  const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {
+  }), ConsoleStdout.lineBuffered(pushStderr), preopen];
+  const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
+  const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
+  const code = wasi.start(inst);
+  if (code !== 0) throw new Error(`reactor init exited ${code}; stderr=${STDERR.join("\n")}`);
+  const instExports = inst.exports;
+  for (const n of ["memory", "git_holon_alloc", "git_holon_dealloc", "git_holon_call"]) if (!instExports[n]) throw new Error(`missing export ${n}`);
+  const eng = {
+    ex: instExports,
+    preopen,
+    STDERR,
+    seq: 0,
+    replica,
+    hashes,
+    bootstrapPkg,
+    nomosPkg,
+    installedBy,
+    fs: makeGitFs(preopen, "/work", { File, Directory }),
+    mounted: /* @__PURE__ */ new Map(),
+    // ws -> { restored, remoteMain, restoreError }
+    mainIntents: /* @__PURE__ */ new Map()
+    // ws -> { head, ids:Set, oids:Set } (admission idempotence)
+  };
+  return eng;
+}
+function directiveRoutes(eng) {
+  return /* @__PURE__ */ new Map();
+}
+function routeTagHexOfMintedId(id) {
+  const i = id.indexOf("_");
+  if (i <= 0) return void 0;
+  const body = id.slice(i + 1).replace(/-/g, "").toLowerCase();
+  return /^[0-9a-f]{32}$/.test(body) ? body.slice(0, 12) : void 0;
+}
+async function wrongHomeVerdict(shardRouting, route, payload) {
+  const value = payload ? payload[route.key] : void 0;
+  if (typeof value !== "string" || !value) return null;
+  const rows = await shardRouting.assignments() || [];
+  let assignment = null;
+  if (route.via === "axis") {
+    assignment = rows.find((a) => a.homeKey === value) || null;
+  } else {
+    const tag = routeTagHexOfMintedId(value);
+    if (tag !== void 0) {
+      for (const a of rows) {
+        if (await routeTagHexOfHomeKey(String(a.homeKey)) === tag) {
+          assignment = a;
+          break;
+        }
+      }
+    }
+  }
+  if (!assignment) {
+    return {
+      error: `no shard placement for this write's home ('${route.key}': ${value.slice(0, 80)}) \u2014 author the derived placement intent (birth<Type>) on the coordinator '${shardRouting.coordinatorWs}' first, then POST /dead-letters/retry`,
+      deadLettered: true
+    };
+  }
+  const movingTo = typeof assignment.status === "string" && assignment.status.startsWith("moving:") ? assignment.status.slice("moving:".length) : null;
+  if (movingTo) {
+    return {
+      error: `home-moving: home '${value.slice(0, 80)}' is migrating ${assignment.shard} -> ${movingTo} (shard map v${assignment.mapVersion ?? 1}) \u2014 parked; a routed client retries automatically after the handoff seals`,
+      homeMoving: { homeKey: value, from: assignment.shard, target: movingTo, workspace: `${shardRouting.coordinatorWs}--${movingTo}` },
+      deadLettered: true
+    };
+  }
+  if (shardRouting.selfLabel === assignment.shard) return null;
+  const correct = `${shardRouting.coordinatorWs}--${assignment.shard}`;
+  return {
+    error: `wrong-home: this write's home is assigned to '${correct}' (shard map v${assignment.mapVersion ?? 1}) \u2014 the client's shard map is stale; a routed client re-routes and retries automatically`,
+    wrongHome: { workspace: correct, ...assignment.mapVersion !== void 0 ? { mapVersion: assignment.mapVersion } : {} }
+  };
+}
+function tenantTypes(eng) {
+  return /* @__PURE__ */ new Set();
+}
+function placementDirectives(eng) {
+  return /* @__PURE__ */ new Map();
+}
+function scopedReads(eng) {
+  return [];
+}
+function globalAggregates(eng) {
+  return /* @__PURE__ */ new Set();
+}
+function parseIntentEvents(blob) {
+  let doc;
+  try {
+    doc = JSON.parse(dec3.decode(blob));
+  } catch {
+    return [];
+  }
+  const events = Array.isArray(doc && doc.events) ? doc.events : [];
+  return events.map((ev) => {
+    const sets = /* @__PURE__ */ new Map();
+    for (const op of ev.ops || []) {
+      const v = op && op.op && op.op.Set;
+      if (v === void 0) continue;
+      if (typeof v.Str === "string") sets.set(op.field, v.Str);
+      else if (typeof v.Int === "number") sets.set(op.field, v.Int);
+    }
+    return { aggregate: String(ev.aggregate || ""), sets };
+  });
+}
+function beginSummaryCapture(eng, ws, ctx, blob) {
+  const events = parseIntentEvents(blob);
+  if (events.length === 0) return null;
+  const pre = /* @__PURE__ */ new Map();
+  const candidates = /* @__PURE__ */ new Set();
+  for (const ev of events) {
+    if (!pre.has(ev.aggregate)) {
+      const rows = qById(eng, ws, ev.aggregate);
+      pre.set(ev.aggregate, rows.length ? { type: rows[0].type, data: rows[0].data || {} } : null);
+    }
+    const before = pre.get(ev.aggregate);
+    const evType = ev.sets.get("__type") ?? (before ? before.type : void 0);
+    for (const read of ctx.reads) {
+      if (read.of !== evType) continue;
+      const oldGroup = before ? groupOf(read, before.data) : void 0;
+      if (oldGroup !== void 0) candidates.add(summaryKey(read.id, oldGroup));
+      if (read.by === null) candidates.add(summaryKey(read.id, ""));
+      else if (ev.sets.has(read.by)) candidates.add(summaryKey(read.id, String(ev.sets.get(read.by))));
+    }
+  }
+  const preTallies = /* @__PURE__ */ new Map();
+  for (const key of candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const v = tallyOf(eng, ws, read, group);
+    preTallies.set(key, v);
+    if (!ctx.prevs.has(key)) ctx.prevs.set(key, { read, group, value: v });
+  }
+  return { events, pre, candidates, preTallies };
+}
+function finishSummaryCapture(eng, ws, ctx, cap, oid, intentId) {
+  const deltas = [];
+  for (const key of cap.candidates) {
+    const [readId, group] = splitSummaryKey(key);
+    const read = ctx.reads.find((r) => r.id === readId);
+    const after = tallyOf(eng, ws, read, group);
+    if (isExtremumRead(read)) {
+      const before = cap.preTallies.has(key) ? cap.preTallies.get(key) : null;
+      if (after !== before) {
+        deltas.push({ readId, group, delta: after });
+        if (!extremumMonotone(read, before, after)) ctx.rederived.add(key);
+      }
+    } else {
+      const before = cap.preTallies.get(key) ?? 0;
+      if (after !== before) deltas.push({ readId, group, delta: after - before });
+    }
+    ctx.values.set(key, { read, group, value: after });
+  }
+  let rowsDelta = 0;
+  for (const [aggregateId, before] of cap.pre) {
+    const rows = qById(eng, ws, aggregateId);
+    const type = rows.length ? rows[0].type : before ? before.type : void 0;
+    if (type === void 0 || !tenantTypes(eng).has(type)) continue;
+    const existsAfter = rows.length > 0;
+    const flip = !before && existsAfter ? 1 : before && !existsAfter ? -1 : 0;
+    if (flip === 0) continue;
+    rowsDelta += flip;
+    const homeKey = ctx.homeKeySet && ctx.homeKeySet.has(aggregateId) ? aggregateId : ctx.homeTags ? ctx.homeTags.get(routeTagHexOfMintedId(aggregateId) ?? "") : void 0;
+    if (homeKey !== void 0) {
+      deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: homeKey, delta: flip });
+      ctx.rowsByHome.set(homeKey, (ctx.rowsByHome.get(homeKey) ?? 0) + flip);
+    }
+  }
+  if (rowsDelta !== 0) {
+    deltas.push({ readId: NOMOS_SHARD_ROWS_READ, group: "", delta: rowsDelta });
+    ctx.rowsDelta += rowsDelta;
+  }
+  if (deltas.length > 0) ctx.events.push({ oid, intentId: intentId || "", deltas });
+}
+function summaryOfCapture(ctx, fromOid, toOid) {
+  if (ctx.events.length === 0 || !toOid || fromOid === toOid) return null;
+  const touched = /* @__PURE__ */ new Set();
+  for (const ev of ctx.events) for (const d of ev.deltas) touched.add(summaryKey(d.readId, d.group));
+  const subtotals = [];
+  for (const [key, cur] of ctx.values) {
+    const extremum2 = isExtremumRead(cur.read);
+    const prev = ctx.prevs.get(key);
+    const prevValue = prev ? prev.value : extremum2 ? null : 0;
+    if (cur.value === prevValue && !touched.has(key)) continue;
+    subtotals.push({
+      readId: cur.read.id,
+      group: cur.group,
+      kind: cur.read.kind,
+      prev: prevValue,
+      value: cur.value,
+      ...extremum2 && ctx.rederived.has(key) ? { rederived: true } : {}
+    });
+  }
+  if (subtotals.length === 0 && ctx.rowsDelta === 0 && ctx.rowsByHome.size === 0) return null;
+  return {
+    fromOid: fromOid || "",
+    toOid,
+    subtotals: subtotals.sort((a, b) => summaryKey(a.readId, a.group) < summaryKey(b.readId, b.group) ? -1 : 1),
+    events: ctx.events,
+    rowsDelta: ctx.rowsDelta,
+    // SLICE 8: the exact per-home row deltas — the adapter closes each against the
+    // coordinator-held per-home subtotal exactly like the "" grand total.
+    rowsByHome: Object.fromEntries([...ctx.rowsByHome.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1))
+  };
+}
+async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
+  const main = await mainIntentIds(eng, ws);
+  const sessions = /* @__PURE__ */ new Map();
+  const deadLetters = [];
+  let admittedTotal = 0;
+  const born = [];
+  const birthOutcomes = [];
+  const timings = { spans: [], intents: 0, sessions: 0 };
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0 ? { reads: scopedReads(eng), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) {
+      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const gitdir0 = gitdirOf(ws);
+  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir0, BRANCH) : null;
+  const t0 = Date.now();
+  let seq = 0;
+  const span = (name, kind, depth = 1, extra = {}) => {
+    const s0 = Date.now();
+    return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
+  };
+  for (const offer of Array.isArray(offers) ? offers : []) {
+    const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
+    const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
+    sessions.set(cid, rec);
+    const done = span(`intent offer ${cid.slice(0, 14)}`, "cadmit", 1, { client: cid });
+    let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+    try {
+      if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
+      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
+      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry intentB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+        continue;
+      }
+      let doc = null;
+      try {
+        doc = JSON.parse(dec3.decode(blob));
+      } catch {
+      }
+      const intentId = typeof doc?.id === "string" ? doc.id : null;
+      const dom = typeof doc?.payload?.domain === "string" ? doc.payload.domain : null;
+      const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
+      const oid = String(offer?.oid || intentId || "").slice(0, 10);
+      if (!dom) {
+        rec.rejected.push({ oid, error: "non-authored intent \u2014 governance enters its own admin lane" });
+        continue;
+      }
+      if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+        const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+        continue;
+      }
+      if (intentId && main.ids.has(intentId)) {
+        rec.skipped.push({ oid, intent: intentId.slice(0, 12), alreadyOnMain: true });
+        continue;
+      }
+      const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
+      const _tOffer = Date.now();
+      const res = offerAdmit(eng, ws, blob, { defer: !summaryCtx });
+      log("offer-admit-ms", { ws, ms: Date.now() - _tOffer, deferred: !summaryCtx, ok: res.ok });
+      if (res.ok) {
+        if (intentId) main.ids.add(intentId);
+        main.oids.add(res.head);
+        main.head = res.head;
+        rec.admitted.push({ oid, head: res.head });
+        admittedTotal += 1;
+        if (Array.isArray(res.born) && res.born.length) born.push(...res.born);
+        if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) birthOutcomes.push(...res.birthOutcomes);
+        if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head ?? "", intentId);
+      } else {
+        const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+        rec.rejected.push({ oid, error, deadLettered: true });
+        deadLetters.push({ intentId, oid, session: cid, error, blob, domain: dom, directiveId: dirId });
+      }
+    } catch (e) {
+      rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: String(e).slice(0, 200) });
+    } finally {
+      done();
+    }
+  }
+  timings.sessions = sessions.size;
+  timings.intents = admittedTotal;
+  if (admittedTotal && !summaryCtx) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
+  if (deadLetters.length) {
+    try {
+      await materializeRefused(eng, ws, ledger, deadLetters);
+    } catch (e) {
+      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const deferDurability = defer && !summaryCtx;
+  if (admittedTotal && !deferDurability) {
+    const sealDone = span("seal offered intents", "cseal", 1, { admitted: admittedTotal });
+    await commitAndPush(eng, ws, ledger);
+    sealDone();
+  }
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH) ?? main.head;
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, head) : null;
+  let resultPackB64 = null;
+  if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
+    try {
+      const p = servePack(eng, ws, clientBase ?? "");
+      if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
+    } catch {
+    }
+  }
+  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
+  const bornPacked = born.length ? packBornChildren(eng, born) : born;
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}, ...deferDurability && admittedTotal && head ? { deferred: true, head } : {} };
+}
+async function authorOn(eng, ws, ledger, domain, directiveId, payload, lawHash, opts = {}) {
+  await mountWorkspace(eng, ws, ledger);
+  let res;
+  try {
+    res = author(eng, ws, domain, directiveId, payload, lawHash, opts);
+  } catch (e) {
+    return { ok: false, error: String(e?.message || e).slice(0, 500) };
+  }
+  if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
+  await commitAndPush(eng, ws, ledger);
+  const bornPacked = Array.isArray(res.born) && res.born.length ? packBornChildren(eng, res.born) : res.born;
+  return { ok: true, head: res.head, born: bornPacked ?? [], birthOutcomes: res.birthOutcomes ?? [] };
+}
+function stageWorkspaceDir(eng, ws) {
+  const wsContents = /* @__PURE__ */ new Map();
+  dirOf(eng.preopen.dir.contents.get("ws")).contents.set(ws, new Directory(wsContents));
+}
+async function mountWorkspace(eng, ws, ledger) {
+  if (eng.mounted.has(ws)) return eng.mounted.get(ws);
+  stageWorkspaceDir(eng, ws);
+  const gitdir = gitdirOf(ws);
+  let restored = false, remoteMain = null, restoreError = null;
+  try {
+    await custodySkeleton(eng, gitdir);
+    remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+    if (remoteMain) {
+      kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
+      restored = true;
+    }
+  } catch (e) {
+    restoreError = String(e?.stack || e).split("\n").slice(0, 5).join(" | ");
+  }
+  const m = { restored, remoteMain, restoreError };
+  eng.mounted.set(ws, m);
+  return m;
+}
+function unmount(eng, ws) {
+  eng.mounted.delete(ws);
+  eng.mainIntents.delete(ws);
+  const wsRoot = dirOf(eng.preopen.dir.contents.get("ws"));
+  if (wsRoot) wsRoot.contents.delete(ws);
+}
+function writeWork(eng, name, bytes) {
+  eng.preopen.dir.contents.set(name, new File(bytes));
+}
+function currentLaw(eng, ws) {
+  const out = JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "currentLaw" }), branch: BRANCH }, eng.STDERR));
+  return out.keyMap || {};
+}
+function installedLaw(eng, ws) {
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "installedLaw" }), branch: BRANCH }, eng.STDERR));
+}
+function domainPackage(eng, ws, hash) {
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "domainPackage", hash }), branch: BRANCH }, eng.STDERR));
+}
+function evolveDryRun(eng, ws, usda, domainHash, dispositions = null) {
+  const r = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { dryRun: true, deferProjection: false });
+  return r.ok ? { admits: true } : { admits: false, detail: r.error };
+}
+function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
+  const seq = eng.seq++;
+  const capPorts = { clock: { physical: Date.now(), logical: 0, replica: eng.replica }, rng: osEntropyBuffer(opts.rngDraws ?? 64) };
+  if (opts.validFromEpoch !== void 0) capPorts.valid_from_epoch = opts.validFromEpoch;
+  if (opts.principalVerified !== void 0) {
+    capPorts.principal = opts.actor ?? "";
+    capPorts.principal_verified = !!opts.principalVerified;
+  }
+  const envelope = { payload: { domain, directiveId, payload }, captured_ports: capPorts, policy_version: 1, policy_domain: "Nomos", policy_gas: 0, policy_memory: 0 };
+  if (opts.attestations !== void 0) envelope.attestations = opts.attestations;
+  writeWork(eng, `payload-${seq}.json`, enc3.encode(JSON.stringify(payload)));
+  writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
+  const genesis = !controllerHash;
+  const attestorSecretFor = (from) => {
+    const s = opts.attestorSecrets;
+    if (!s) return null;
+    if (typeof s === "string") return s;
+    return typeof s[from] === "string" ? s[from] : null;
+  };
+  const defer = opts.deferProjection !== false;
+  const offerOnce = () => JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, domain, directiveId, payloadFile: `/work/payload-${seq}.json`, envelopeFile: `/work/envelope-${seq}.json`, seq, actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {}, domainFile: genesis ? "/work/domain.package.usda" : "", domainHash: genesis ? "" : controllerHash, branch: BRANCH, ...opts.authorSecret ? { authorSecret: opts.authorSecret } : {}, ...opts.spans ? { spans: true } : {}, ...opts.dryRun ? { dryRun: true } : defer ? { deferProjection: true } : {} }, eng.STDERR));
+  let v = offerOnce();
+  for (let pass = 0; pass < 8 && v.outcome === "refused"; pass++) {
+    const need = parseAttestedReadNeed(v.verdict?.reason ?? v.error);
+    if (!need || !eng.mounted.has(need.from)) break;
+    const secret = attestorSecretFor(need.from);
+    if (!secret) break;
+    const served = attestedRead(eng, need.from, {
+      queryId: need.queryId,
+      paramsJson: JSON.stringify(need.args),
+      attestorSecret: secret,
+      nowMs: opts.attestNowMs ?? Date.now(),
+      // K3 (§1.5.3): colocated custody is in-memory — always ask for the carried enrollment
+      // proof; the kernel produces-or-omits under its own bounds (the adapter decides nothing).
+      includeRosterProof: true
+    });
+    if (!served || served.ok !== true) break;
+    envelope.attestations = [...envelope.attestations ?? [], { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
+    writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
+    v = offerOnce();
+  }
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, born: v.born ?? [], birthOutcomes: v.birthOutcomes ?? [], ...v.kernelSpans ? { kernelSpans: v.kernelSpans } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
+  if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
+  return res;
+}
+function setTestKRoot(eng, kRootPublicB64) {
+  return JSON.parse(call(eng.ex, "set_test_k_root", { kRootPublicB64 }, eng.STDERR));
+}
+function refreshProjection(eng, ws) {
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "refresh" }), branch: BRANCH }, eng.STDERR));
+}
+async function custodySkeleton(eng, gitdir) {
+  const p = eng.fs.promises;
+  for (const d of ["", "/objects", "/objects/pack", "/objects/info", "/refs", "/refs/heads"]) {
+    try {
+      await p.mkdir(`${gitdir}${d}`);
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+    }
+  }
+  try {
+    await p.writeFile(`${gitdir}/HEAD`, `ref: refs/heads/${BRANCH}
+`);
+  } catch {
+  }
+  try {
+    await p.writeFile(`${gitdir}/config`, "[core]\n	repositoryformatversion = 0\n	bare = true\n");
+  } catch {
+  }
+}
+async function custodyFetch(eng, ws, ledger, { remoteRef = "refs/heads/main", localRef = null, have = null } = {}) {
+  const remoteRefFull = fullRef(remoteRef);
+  const refs = await custodyLsRefs(ledger, remoteRefFull);
+  const tip = refs[remoteRefFull] || null;
+  if (!tip) return null;
+  if (tip !== have) {
+    const pk = await fetchPack(ledger.remote, ledger.headers || {}, { wants: [tip], haves: have ? [have] : [] });
+    if (pk) applyPackInto(eng, ws, pk);
+  }
+  kgit.writeRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
+  return tip;
+}
+async function custodyPush(eng, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
+  const headers = ledger.headers || {};
+  const remoteRefFull = fullRef(remoteRef);
+  const remote = await lsRefs(ledger.remote, headers, { service: "git-receive-pack", prefix: remoteRefFull });
+  const oldOid = remote[remoteRefFull] || ZERO_OID;
+  if (del) {
+    if (oldOid === ZERO_OID) return;
+    return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: ZERO_OID }] }));
+  }
+  const tgt = newOid || kgit.resolveRef(eng, gitdirOf(ws), fullRef(localRef || remoteRef));
+  if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
+  if (tgt === oldOid) return;
+  let pack = null;
+  if (!pointer) {
+    pack = oldOid !== ZERO_OID ? packDelta(eng, ws, oldOid, tgt) : null;
+    if (!pack) pack = packDelta(eng, ws, "", tgt);
+  }
+  return pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+}
+async function commitAndPush(eng, ws, ledger) {
+  try {
+    await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+  } catch (e) {
+    unmount(eng, ws);
+    throw new Error(`ledger push failed \u2014 write NOT durable, rolled back to ledger: ${e}`);
+  }
+}
+function describe(eng, ws) {
+  return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "describe", workspace: ws }), branch: BRANCH }, eng.STDERR));
+}
+function parseAttestedReadNeed(error) {
+  const m = /attested-read-unreachable: read\('([^']+)', \{from: '([^']+)'\}\) args=(.*?) has no injected attestation/.exec(String(error || ""));
+  if (!m) return null;
+  let blob = m[3];
+  for (let i = 0; i < 4; i++) {
+    try {
+      return { queryId: m[1], from: m[2], args: JSON.parse(blob) };
+    } catch {
+      blob = blob.replace(/\\(["\\])/g, "$1");
+    }
+  }
+  return null;
+}
+function packDelta(eng, ws, base, head) {
+  try {
+    const r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), base, head }, eng.STDERR));
+    if (!r || r.ok !== true || typeof r.packB64 !== "string") return null;
+    return Uint8Array.from(atob(r.packB64), (c) => c.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+function servePack(eng, ws, base = "") {
+  let head = null;
+  try {
+    head = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  } catch {
+  }
+  let r;
+  try {
+    r = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base, branch: BRANCH }, eng.STDERR));
+  } catch (e) {
+    const msg = String(e);
+    if (/nothing to pack|head == base/.test(msg)) return { packB64: "", bytes: 0, upToDate: true, ...head ? { head } : {} };
+    if (base && /reached root|before base|not found|unknown|no (?:merge )?base|missing|invalid/i.test(msg)) {
+      try {
+        const full = JSON.parse(call(eng.ex, "pack_delta", { repoArg: repoArgOf(ws), workspace: ws, base: "", branch: BRANCH }, eng.STDERR));
+        if (full && full.ok === true && typeof full.packB64 === "string") {
+          return { packB64: full.packB64, bytes: full.bytes, divergent: true, ...head ? { head } : {} };
+        }
+      } catch {
+      }
+    }
+    throw e;
+  }
+  if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");
+  return { packB64: r.packB64, bytes: r.bytes, ...head ? { head } : {} };
+}
+function packBornChildren(eng, born) {
+  if (!Array.isArray(born) || !born.length) return born;
+  return born.map((b) => {
+    const child = b && typeof b.workspace === "string" ? b.workspace : null;
+    const head = b && typeof b.head === "string" ? b.head : null;
+    if (!child || !/^[0-9a-f]{40}$/i.test(head || "")) {
+      log("born-pack-skipped", { workspace: child, head, reason: "malformed born entry" });
+      return b;
+    }
+    try {
+      const pack = packDelta(eng, child, "", head);
+      if (!pack || !pack.length) {
+        log("born-pack-empty", { workspace: child, head });
+        return b;
+      }
+      return { ...b, packB64: b64Bytes(pack), packBytes: pack.length };
+    } catch (e) {
+      log("born-pack-failed", { workspace: child, head, error: String(e).slice(0, 200) });
+      return b;
+    }
+  });
+}
+function offerIntent(eng, ws, bytes, opts = {}) {
+  const name = `offer-in-${eng.seq++}.json`;
+  writeWork(eng, name, bytes);
+  const deferProjection = !!(opts && opts.defer);
+  const branch = opts && opts.branch || BRANCH;
+  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
+}
+function offerAdmit(eng, ws, bytes, opts = {}) {
+  const v = offerIntent(eng, ws, bytes, opts);
+  return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
+}
+async function mainIntentIds(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const head = kgit.resolveRef(eng, gitdir, BRANCH);
+  if (!head) return { head: null, ids: /* @__PURE__ */ new Set(), oids: /* @__PURE__ */ new Set() };
+  const cached = eng.mainIntents.get(ws);
+  if (cached && cached.head === head) return cached;
+  const ids = /* @__PURE__ */ new Set(), oids = /* @__PURE__ */ new Set();
+  for (const c of kgit.intentsAbove(eng, gitdir, head, "", 500)) {
+    oids.add(c.oid);
+    try {
+      const id = JSON.parse(dec3.decode(bytesFromB64(c.intentB64))).id;
+      if (typeof id === "string" && id) ids.add(id);
+    } catch {
+    }
+  }
+  const m = { head, ids, oids };
+  eng.mainIntents.set(ws, m);
+  return m;
+}
+async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = null, defer = false } = {}) {
+  const routes = shardRouting ? directiveRoutes(eng) : null;
+  const gitdir = gitdirOf(ws);
+  const H = () => ({ ...ledger.headers || {} });
+  const _t0 = Date.now();
+  let _fetchMs = 0, _sealMs = 0, _intents = 0;
+  const _spans = [];
+  let _traceSeq = 0;
+  const _span = (name, kind, depth = 1, extra = {}) => {
+    const t0 = Date.now();
+    return (end = {}) => {
+      const t1 = Date.now();
+      _spans.push({ id: `admit-${_t0}-${_traceSeq++}`, track: "cloud", name, kind, depth, t0, t1, ...extra, ...end });
+    };
+  };
+  const sessionRefPrefix = "refs/heads/session/";
+  const sessions = {};
+  const _scanDone = _span("scan session refs", "cscan", 1);
+  for (const [ref, oid] of Object.entries(await custodyLsRefs(ledger, sessionRefPrefix))) {
+    if (ref.startsWith(sessionRefPrefix) && oid) sessions[ref.slice(sessionRefPrefix.length)] = oid;
+  }
+  _scanDone({ sessions: Object.keys(sessions).length });
+  const _scanMs = Date.now() - _t0;
+  const results = [], deadLetters = [], placements = [], splits = [], globalsOut = [];
+  const consumed = [];
+  let totalAdmitted = 0;
+  const globalsDeclared = shardRouting && !shardRouting.selfLabel ? globalAggregates(eng) : null;
+  const summaryCtx = shardRouting && shardRouting.selfLabel && scopedReads(eng).length > 0 ? { reads: scopedReads(eng), prevs: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), events: [], rowsDelta: 0, rederived: /* @__PURE__ */ new Set(), rowsByHome: /* @__PURE__ */ new Map(), homeTags: /* @__PURE__ */ new Map(), homeKeySet: /* @__PURE__ */ new Set() } : null;
+  const canDeferProjection = !summaryCtx && !(globalsDeclared && globalsDeclared.size > 0);
+  if (summaryCtx) {
+    try {
+      for (const r of query(eng, ws, "aggregatesByType", JSON.stringify({ __type: "NomosHomeReceipt" }))) {
+        const hk = r.data && typeof r.data.homeKey === "string" ? r.data.homeKey : null;
+        if (!hk) continue;
+        summaryCtx.homeKeySet.add(hk);
+        summaryCtx.homeTags.set(await routeTagHexOfHomeKey(hk), hk);
+      }
+    } catch (e) {
+      log("home-tag-table-error", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const headBefore = summaryCtx ? kgit.resolveRef(eng, gitdir, BRANCH) : null;
+  for (const [cid, head] of Object.entries(sessions)) {
+    const ref = `refs/heads/session/${cid}`;
+    const shortCid = cid.length > 14 ? `${cid.slice(0, 14)}...` : cid;
+    const _sessionDone = _span(`session ${shortCid}`, "csession", 1, { client: cid });
+    try {
+      const _fetchDone = _span(`fetch ${shortCid}`, "cfetch", 2, { client: cid });
+      const _f = Date.now();
+      try {
+        const localMain = kgit.resolveRef(eng, gitdir, BRANCH);
+        try {
+          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: localMain });
+        } catch (thinErr) {
+          log("thin-fetch-fallback", { ws, cid, error: String(thinErr?.message || thinErr).slice(0, 160) });
+          await custodyFetch(eng, ws, ledger, { remoteRef: ref, have: null });
+        }
+      } finally {
+        _fetchMs += Date.now() - _f;
+        _fetchDone();
+      }
+      const _walkDone = _span(`walk ${shortCid}`, "cwalk", 2, { client: cid });
+      const main = await mainIntentIds(eng, ws);
+      const recent = kgit.intentsAbove(eng, gitdir, head ?? "", "", 100);
+      const chain = [];
+      for (let i = recent.length - 1; i >= 0; i--) {
+        if (main.oids.has(recent[i].oid)) break;
+        chain.push(recent[i]);
+      }
+      chain.reverse();
+      _walkDone({ intents: chain.length });
+      const admitted = [], rejected = [], skipped = [];
+      const _gateDone = _span(`gate+fold ${shortCid}`, "cgate", 2, { client: cid, intents: chain.length });
+      for (const c of chain) {
+        const oid = c.oid;
+        try {
+          const blob = bytesFromB64(c.intentB64);
+          let dom = null, intentId = null, dirId = null;
+          try {
+            const doc = JSON.parse(dec3.decode(blob));
+            intentId = typeof doc.id === "string" ? doc.id : null;
+            dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null;
+            dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null;
+          } catch {
+          }
+          if (!dom) {
+            rejected.push({ oid: oid.slice(0, 10), error: "non-authored intent \u2014 governance enters its own admin lane" });
+            continue;
+          }
+          if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+            const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or \u2014 if this parked receipt is sanctioned \u2014 the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+            continue;
+          }
+          if (routes && dom && dirId) {
+            if (dirId === "nomosSealHome" || dirId === "nomosSealHandoff") {
+              rejected.push({ oid: oid.slice(0, 10), error: `session lane refuses '${dirId}' \u2014 the \xA76 handoff seals are authored by the adapter after migration verifies (begin a move with nomosSplitShard, or POST /v1/workspaces/<coordinator>/split)` });
+              continue;
+            }
+            const route = routes.get(`${dom} ${dirId}`);
+            if (route) {
+              let payloadObj = null;
+              try {
+                payloadObj = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+              } catch {
+              }
+              const verdict2 = await wrongHomeVerdict(shardRouting, route, payloadObj);
+              if (verdict2) {
+                rejected.push({ oid: oid.slice(0, 10), error: verdict2.error, ...verdict2.wrongHome ? { wrongHome: verdict2.wrongHome } : {}, ...verdict2.homeMoving ? { homeMoving: verdict2.homeMoving } : {}, ...verdict2.deadLettered ? { deadLettered: true } : {} });
+                if (verdict2.deadLettered) deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error: verdict2.error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+            }
+            if (dirId === "nomosReceiveAssignment" && shardRouting) {
+              let p = null;
+              try {
+                p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+              } catch {
+              }
+              const homeKey = p && typeof p.homeKey === "string" ? p.homeKey : null;
+              const rows = homeKey ? await shardRouting.assignments() || [] : [];
+              const a = homeKey ? rows.find((x) => x.homeKey === homeKey) : null;
+              if (!a) {
+                const error = `assignment receipt for home '${String(homeKey).slice(0, 80)}' has NO placement on the coordinator '${shardRouting.coordinatorWs}' \u2014 author the derived placement intent (birth<Type>) first, then POST /dead-letters/retry`;
+                rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+                deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+                continue;
+              }
+              if (a.shard !== shardRouting.selfLabel || p && p.shard !== shardRouting.selfLabel) {
+                const correct = `${shardRouting.coordinatorWs}--${a.shard}`;
+                rejected.push({
+                  oid: oid.slice(0, 10),
+                  error: `wrong-home: the coordinator's shard map assigns home '${homeKey.slice(0, 80)}' to '${correct}' (not this workspace) \u2014 a routed client re-routes and retries automatically`,
+                  wrongHome: { workspace: correct, ...a.mapVersion !== void 0 ? { mapVersion: a.mapVersion } : {} }
+                });
+                continue;
+              }
+            }
+          }
+          if (intentId && main.ids.has(intentId)) {
+            skipped.push({ oid: oid.slice(0, 10), intent: intentId.slice(0, 12), alreadyOnMain: true });
+            continue;
+          }
+          const cap = summaryCtx ? beginSummaryCapture(eng, ws, summaryCtx, blob) : null;
+          const verdict = offerIntent(eng, ws, blob, { defer: canDeferProjection });
+          const res = verdict.outcome === "admitted" ? { ok: true, head: verdict.head } : { ok: false, error: verdict.verdict?.reason ?? verdict.error ?? "the offer was refused" };
+          if (res.ok) {
+            main.ids.add(intentId);
+            main.oids.add(res.head);
+            main.head = res.head;
+            admitted.push({ oid: oid.slice(0, 10), head: res.head });
+            if (cap) finishSummaryCapture(eng, ws, summaryCtx, cap, res.head ?? "", intentId);
+            if (shardRouting && dirId) {
+              const placement = placementDirectives(eng).get(dirId);
+              if (placement) {
+                let p = null;
+                try {
+                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+                } catch {
+                }
+                const homeKey = p ? p[String(placement.keyField)] : void 0;
+                if (typeof homeKey === "string" && typeof p?.shard === "string") {
+                  placements.push({ directive: dirId, homeKey, shard: p.shard, mapVersion: 1 });
+                }
+              }
+              if (dirId === "nomosSplitShard" && !shardRouting.selfLabel) {
+                let p = null;
+                try {
+                  p = JSON.parse(dec3.decode(blob)).payload?.payload ?? null;
+                } catch {
+                }
+                if (p && typeof p.fromShard === "string" && typeof p.toShard === "string" && Array.isArray(p.homeKeys)) {
+                  splits.push({ fromShard: p.fromShard, toShard: p.toShard, homeKeys: p.homeKeys.filter((k) => typeof k === "string") });
+                }
+              }
+            }
+            if (globalsDeclared && globalsDeclared.size > 0) {
+              let touchesGlobal = false;
+              for (const ev of parseIntentEvents(blob)) {
+                const rows = qById(eng, ws, ev.aggregate);
+                const t = ev.sets.get("__type") ?? (rows.length ? rows[0].type : void 0);
+                if (t !== void 0 && globalsDeclared.has(t)) {
+                  touchesGlobal = true;
+                  break;
+                }
+              }
+              if (touchesGlobal) globalsOut.push({ intentId: intentId || "", oid: oid.slice(0, 10), blob });
+            }
+          } else {
+            const wh = String(res.error || "").match(/wrong-home:(s\d+)/);
+            if (wh) {
+              const coordinator = shardRouting && shardRouting.coordinatorWs || (ws.match(/^(.*)--s\d+$/) || [])[1] || ws;
+              rejected.push({
+                oid: oid.slice(0, 10),
+                error: `wrong-home: this write's home is assigned to '${coordinator}--${wh[1]}' \u2014 the chain gate's homing invariant refused it; a routed client re-routes and retries automatically`,
+                wrongHome: { workspace: `${coordinator}--${wh[1]}` }
+              });
+              continue;
+            }
+            const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+          }
+        } catch (e) {
+          rejected.push({ oid: oid.slice(0, 10), error: String(e).slice(0, 200) });
+        }
+      }
+      _gateDone({ admitted: admitted.length, rejected: rejected.length, skipped: skipped.length });
+      _intents += admitted.length;
+      totalAdmitted += admitted.length;
+      consumed.push({ cid, ref });
+      results.push({ session: cid, admitted, rejected, ...skipped.length ? { skipped } : {} });
+    } catch (e) {
+      results.push({ session: cid, error: String(e).slice(0, 200) });
+    } finally {
+      _sessionDone();
+    }
+  }
+  if (canDeferProjection && totalAdmitted) {
+    const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
+    try {
+      refreshProjection(eng, ws);
+    } catch (e) {
+      log("admit-projection-flush-failed", { ws, error: String(e).slice(0, 200) });
+    } finally {
+      _projDone();
+    }
+  }
+  let unparkedSessions = /* @__PURE__ */ new Set();
+  if (deadLetters.length) {
+    try {
+      unparkedSessions = (await materializeRefused(eng, ws, ledger, deadLetters)).unparkedSessions;
+    } catch (e) {
+      unparkedSessions = new Set(deadLetters.map((dl) => dl.session).filter(Boolean));
+      log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
+    }
+  }
+  const prunable = unparkedSessions.size ? consumed.filter((c) => !unparkedSessions.has(c.cid)) : consumed;
+  const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
+  const deferDurability = defer && !hasCoordination;
+  let _sealed = true;
+  if (totalAdmitted && !deferDurability) {
+    const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
+    const _s = Date.now();
+    try {
+      await commitAndPush(eng, ws, ledger);
+    } catch (e) {
+      _sealed = false;
+      log("admit-batch-push-failed", { ws, sessions: consumed.length, admitted: totalAdmitted, error: String(e).slice(0, 200) });
+    } finally {
+      _sealMs += Date.now() - _s;
+      _sealDone();
+    }
+  }
+  if (_sealed && !deferDurability) {
+    for (const { ref } of prunable) {
+      try {
+        await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
+      } catch {
+      }
+    }
+  }
+  const newMain = kgit.resolveRef(eng, gitdir, BRANCH);
+  log("admit", { ws, sessions: results.length, main: newMain });
+  const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, newMain) : null;
+  const _total = Date.now() - _t0;
+  const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
+  return {
+    sessions: results,
+    main: newMain,
+    deadLetters,
+    timings,
+    ...summary ? { summary } : {},
+    ...placements.length ? { placements } : {},
+    ...splits.length ? { splits } : {},
+    ...globalsOut.length ? { globals: globalsOut } : {},
+    // The adapter's backup lane consumes these: `deferred` ⇒ resident main carries totalAdmitted
+    // un-backed-up commits and `consumed` are the session branches to delete AFTER the push lands.
+    ...deferDurability && totalAdmitted ? { deferred: true, consumed: prunable, admitted: totalAdmitted } : {}
+  };
+}
+async function writeRefusedRef(eng, ws, dl) {
+  const gitdir = gitdirOf(ws);
+  const blob = dl.blob instanceof Uint8Array ? dl.blob : enc3.encode(String(dl.blob || ""));
+  const refForStamp = refusedRefName(dl.intentId || dl.oid);
+  let parkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const prevOid = kgit.resolveRef(eng, gitdir, refForStamp);
+    if (prevOid) {
+      const prev = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, prevOid, "verdict.json") ?? new Uint8Array()));
+      if (prev && typeof prev.parkedAt === "string") parkedAt = prev.parkedAt;
+    }
+  } catch {
+  }
+  const verdict = enc3.encode(JSON.stringify({
+    offerId: dl.intentId || null,
+    oid: dl.oid || null,
+    domain: dl.domain || null,
+    directiveId: dl.directiveId || null,
+    session: dl.session || null,
+    parkedAt,
+    verdict: { reason: String(dl.error || "refused") }
+  }));
+  const ref = refusedRefName(dl.intentId || dl.oid);
+  kgit.writeMetaCommit(eng, gitdir, {
+    parents: [],
+    files: [{ path: "intent.json", bytes: blob }, { path: "verdict.json", bytes: verdict }],
+    message: `refused: ${dl.domain || "?"}/${dl.directiveId || "?"} \u2014 ${String(dl.error || "").slice(0, 120)}`,
+    timeSecs: 0,
+    ref
+  });
+  return ref;
+}
+async function listRefusedRefs(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
+  const out = [];
+  for (const { ref, oid } of refs) {
+    try {
+      const vb = kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array();
+      const ib = kgit.readBlob(eng, gitdir, oid, "intent.json") ?? new Uint8Array();
+      const v = JSON.parse(dec3.decode(vb));
+      out.push({ ref, ...v, intentB64: b64Bytes(ib) });
+    } catch {
+    }
+  }
+  return out;
+}
+async function refusedSummary(eng, ws) {
+  const gitdir = gitdirOf(ws);
+  const refs = kgit.listRefs(eng, gitdir, "refs/heads/refused/");
+  let count2 = 0, latestParkedAt = null;
+  for (const { oid } of refs) {
+    try {
+      const v = JSON.parse(dec3.decode(kgit.readBlob(eng, gitdir, oid, "verdict.json") ?? new Uint8Array()));
+      count2++;
+      if (v && typeof v.parkedAt === "string" && (!latestParkedAt || v.parkedAt > latestParkedAt)) latestParkedAt = v.parkedAt;
+    } catch {
+    }
+  }
+  return { count: count2, latestParkedAt };
+}
+async function materializeRefused(eng, ws, ledger, deadLetters) {
+  const refs = [];
+  const unparkedSessions = /* @__PURE__ */ new Set();
+  for (const dl of deadLetters || []) {
+    try {
+      const ref = await writeRefusedRef(eng, ws, dl);
+      await custodyPush(eng, ws, ledger, { remoteRef: ref });
+      refs.push(ref);
+    } catch (e) {
+      if (dl && dl.session) unparkedSessions.add(dl.session);
+      log("refused-ref-materialize-failed", { ws, intentId: dl?.intentId, error: String(e).slice(0, 200) });
+    }
+  }
+  return { refs, unparkedSessions };
+}
+async function deleteRefusedRef(eng, ws, ledger, offerId) {
+  const gitdir = gitdirOf(ws);
+  const ref = refusedRefName(offerId);
+  try {
+    kgit.deleteRef(eng, gitdir, ref);
+  } catch {
+  }
+  try {
+    await custodyPush(eng, ws, ledger, { remoteRef: ref, del: true });
+  } catch (e) {
+    log("refused-ref-delete-push-failed", { ws, ref, error: String(e).slice(0, 200) });
+  }
+  return ref;
+}
+async function boot(eng, ws, ledger) {
+  const m = await mountWorkspace(eng, ws, ledger);
+  if (nomosActive(eng, ws)) {
+    if (ws !== "root" && !isWarranted(eng, ws)) {
+      throw new Error(
+        `unwarranted-workspace: '${ws}' is booted but its genesis never landed a GenesisWarrant \u2014 an era-0 workspace is born ONLY by its parent's warranted+attested birth. This is a host-authored/legacy orphan and will not serve (author its birth on its parent to bring it into the holarchy lawfully).`
+      );
+    }
+    return { status: "already-initialized", head: m.remoteMain ?? void 0, controllerHash: eng.hashes.nomos, rows: qById(eng, ws, `domain-installation:${eng.hashes.nomos}`), mount: m };
+  }
+  throw new Error(
+    `unborn-workspace: '${ws}' has no genesis and the host does not create workspaces \u2014 author its birth on its PARENT (birthChild/birthHome/an estate .births()); the parent's offer-effect materializes it in custody, then it serves from here. (root self-adopts via _ensureRootGenesis; this is not that path.)`
+  );
+}
+async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
+  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
+  const installation = qById(eng, ws, `domain-installation:${domainHash}`);
+  const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
+  if (keys.length > 0) {
+    const law = installedLaw(eng, ws);
+    const currentLaw2 = law?.currentLaw ?? {};
+    const stale = keys.filter((k) => currentLaw2[k] !== void 0 && currentLaw2[k] !== domainHash);
+    if (stale.length > 0) {
+      throw new Error(
+        `deploy-did-not-advance: the install of ${domainHash.slice(0, 12)}\u2026 ADMITTED but the workspace's current law still serves ${stale.map((k) => `'${k}' from ${String(currentLaw2[k]).slice(0, 12)}\u2026`).join(", ")} \u2014 refusing (custody unchanged) instead of a silent no-op. This usually means the existing installation's era/lineage prevents supersession: run \`githolon deploy --dry-run=evolve\` for the gate's verdict, supply #58 dispositions for a true removal/retype, or re-forge the workspace onto the current lineage.`
+      );
+    }
+  }
+  await commitAndPush(eng, ws, ledger);
+  return { head: result.head, installation };
+}
+function snapshot(eng, ws) {
+  const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
+  return serializeTree(wsDir);
+}
+async function ledgerStats(eng, ws, ledger = null) {
+  const gitdir = gitdirOf(ws);
+  let head = kgit.resolveRef(eng, gitdir, BRANCH);
+  if (!head && ledger?.remote) {
+    try {
+      await custodySkeleton(eng, gitdir);
+      const remoteMain = await custodyFetch(eng, ws, ledger, { remoteRef: "refs/heads/main" });
+      if (!remoteMain) return { head: null, commits: 0 };
+      kgit.writeRef(eng, gitdir, "HEAD", `ref: refs/heads/${BRANCH}`);
+      head = kgit.resolveRef(eng, gitdir, BRANCH);
+      const mounted2 = eng.mounted.get(ws);
+      if (mounted2) {
+        mounted2.restored = true;
+        mounted2.remoteMain = remoteMain;
+        mounted2.restoreError = null;
+      }
+    } catch {
+    }
+  }
+  if (!head) return { head: null, commits: 0 };
+  const mounted = eng.mounted.get(ws);
+  if (mounted && mounted.ledgerStats?.head === head) return mounted.ledgerStats;
+  const commits = kgit.intentsAbove(eng, gitdir, head).length;
+  const out = { head, commits };
+  if (mounted) mounted.ledgerStats = out;
+  return out;
+}
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, dirOf, repoArgOf, gitdirOf, unpack, log, repoArgOfGitdir, bytesFromB64, kgit, installPayload, routeTagHexOfHomeKey, SUMMARY_SEP, summaryKey, splitSummaryKey, NOMOS_SHARD_ROWS_READ, groupOf, tallyOf, isExtremumRead, extremumMonotone, pushVia, fullRef, applyPackInto, custodyLsRefs, qById, query, authorKeygen, attestedRead, certSign, readPosture, count, sum, pendingConflicts, spatialBboxParams, spatialWithin, extremum, nomosActive, refusedRefName, GENESIS_WARRANT_ID, isWarranted;
+var init_engine = __esm({
+  "../adapter/engine.ts"() {
+    "use strict";
+    init_git_fs();
+    init_tree();
+    init_custody_transport();
+    enc3 = new TextEncoder();
+    dec3 = new TextDecoder();
+    BRANCH = "main";
+    RESULT_PACK_INLINE_MAX = 256 * 1024;
+    dirOf = (n) => n;
+    repoArgOf = (ws) => `/work/ws/${ws}`;
+    gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
+    unpack = (p) => {
+      const v = typeof p === "bigint" ? p : BigInt(p);
+      return { ptr: Number(v >> 32n), len: Number(v & 0xffffffffn) };
+    };
+    log = (evt, fields = {}) => console.log(JSON.stringify({ evt, t: Date.now(), ...fields }));
+    repoArgOfGitdir = (gitdir) => gitdir.replace(/\/nomos\.git$/, "");
+    bytesFromB64 = (b64) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+    kgit = {
+      // resolveRef → tip oid hex, or null if the ref is absent (replaces git.resolveRef(...).catch(()=>null)).
+      resolveRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "resolve_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)).oid,
+      // readBlob → the blob bytes at `path` inside commit `oid`, or null if not found (no throw).
+      readBlob: (eng, gitdir, oid, path2) => {
+        const r = JSON.parse(call(eng.ex, "read_blob", { repoArg: repoArgOfGitdir(gitdir), oid, path: path2 }, eng.STDERR));
+        return r.ok ? bytesFromB64(r.blobB64) : null;
+      },
+      // intentsAbove → [{ oid, intentB64 }] oldest→newest over (base, head] (replaces log + readBlob intent.json).
+      // `limit` (0 = all) caps to the most-recent N intent commits (replaces git.log depth).
+      intentsAbove: (eng, gitdir, head, base = "", limit = 0) => JSON.parse(call(eng.ex, "intents_above", { repoArg: repoArgOfGitdir(gitdir), head, base, limit }, eng.STDERR)).intents,
+      // listRefs → [{ ref, oid }] under prefix (replaces git.listRefs for LOCAL refs).
+      listRefs: (eng, gitdir, prefix) => JSON.parse(call(eng.ex, "list_refs", { repoArg: repoArgOfGitdir(gitdir), prefix }, eng.STDERR)).refs,
+      // writeRef → force-point a ref (plain oid or `ref:`-symbolic) (replaces git.writeRef).
+      writeRef: (eng, gitdir, ref, value) => JSON.parse(call(eng.ex, "write_ref", { repoArg: repoArgOfGitdir(gitdir), ref, value }, eng.STDERR)),
+      // deleteRef → remove a local ref, idempotent (replaces git.deleteRef).
+      deleteRef: (eng, gitdir, ref) => JSON.parse(call(eng.ex, "delete_ref", { repoArg: repoArgOfGitdir(gitdir), ref }, eng.STDERR)),
+      // applyPack → ingest a pack's objects into ws's repo (kernel apply_pack; refs are the caller's job).
+      applyPack: (eng, ws, packBytes) => applyPackInto(eng, ws, packBytes),
+      // writeMetaCommit → blobs→tree→commit→ref for a CUSTODY-META fact (checkpoint/refused/outbox/shape).
+      // `files`: [{ path, bytes:Uint8Array }]; returns the commit oid (replaces writeBlob+writeTree+writeCommit[+writeRef]).
+      writeMetaCommit: (eng, gitdir, { parents = [], files, message = "nomos custody meta", timeSecs = 0, ref = "" }) => JSON.parse(call(eng.ex, "write_meta_commit", {
+        repoArg: repoArgOfGitdir(gitdir),
+        parents,
+        files: files.map((f) => ({ path: f.path, blobB64: b64Bytes(f.bytes) })),
+        message,
+        timeSecs,
+        ref
+      }, eng.STDERR)).oid
+    };
+    installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, dependencies: [], finalizers: [], ...dispositions ? { dispositions } : {} });
+    routeTagHexOfHomeKey = async (homeKey) => (await sha256hex(`nomos-route:${homeKey}`)).slice(0, 12);
+    SUMMARY_SEP = "";
+    summaryKey = (readId, group) => `${readId}${SUMMARY_SEP}${group}`;
+    splitSummaryKey = (key) => {
+      const i = key.indexOf(SUMMARY_SEP);
+      return [key.slice(0, i), key.slice(i + 1)];
+    };
+    NOMOS_SHARD_ROWS_READ = "nomosShardRows";
+    groupOf = (read, data) => {
+      if (read.by === null) return "";
+      const v = data ? data[read.by] : void 0;
+      return v === void 0 || v === null ? void 0 : String(v);
+    };
+    tallyOf = (eng, ws, read, group) => read.kind === "count" ? count(eng, ws, read.id, group).count : read.kind === "sum" ? sum(eng, ws, read.id, group).sum : extremum(eng, ws, read.id, read.kind, group).value;
+    isExtremumRead = (read) => read.kind === "min" || read.kind === "max";
+    extremumMonotone = (read, prev, next) => next === null && prev === null || next !== null && (prev === null || (read.kind === "min" ? next <= prev : next >= prev));
+    pushVia = (ledger, fn) => ledger && ledger.pushLane ? ledger.pushLane(fn) : fn();
+    fullRef = (r) => r === "HEAD" || r.startsWith("refs/") ? r : `refs/heads/${r}`;
+    applyPackInto = (eng, ws, pack) => {
+      if (!pack || !pack.length) return;
+      const r = JSON.parse(call(eng.ex, "apply_pack", { repoArg: repoArgOf(ws), packB64: b64Bytes(pack) }, eng.STDERR));
+      if (!r || r.ok !== true) throw new Error(`apply_pack: ${r && r.error}`);
+    };
+    custodyLsRefs = (ledger, prefix = null) => lsRefs(ledger.remote, ledger.headers || {}, { service: "git-upload-pack", prefix });
+    qById = (eng, ws, id, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "byId", aggregateId: id }), principal, keys, branch: BRANCH }, eng.STDERR));
+    query = (eng, ws, queryId, paramsJson, principal = "", keys = []) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ kind: "query", queryId, paramsJson }), principal, keys, branch: BRANCH }, eng.STDERR));
+    authorKeygen = (eng) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "authorKeygen" }) }, eng.STDERR));
+    attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs, includeRosterProof }) => JSON.parse(call(eng.ex, "query", {
+      repoArg: repoArgOf(ws),
+      workspace: ws,
+      branch: BRANCH,
+      queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...includeRosterProof ? { includeRosterProof: true } : {} })
+    }, eng.STDERR));
+    certSign = (eng, {
+      child,
+      founder,
+      verified,
+      parentKey,
+      parentId,
+      epoch,
+      secret,
+      verifiedVia,
+      idpToken,
+      capturedClock,
+      authProviderIssuer,
+      authProviderJwks,
+      authProviderAudience
+    }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({
+      op: "certSign",
+      child,
+      founder,
+      verified,
+      parentKey,
+      parentId,
+      epoch,
+      secret,
+      // forwarded only when present (the op reads them optionally; absent ⇒ classic cert bytes).
+      ...verifiedVia !== void 0 ? { verifiedVia } : {},
+      ...idpToken !== void 0 ? { idpToken } : {},
+      ...capturedClock !== void 0 ? { capturedClock } : {},
+      ...authProviderIssuer !== void 0 ? { authProviderIssuer } : {},
+      ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
+      ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
+    }) }, eng.STDERR)).cert;
+    readPosture = (eng, ws, principal = "", authToken = "", nowUnix = 0) => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "readPosture", authToken, nowUnix }), principal, branch: BRANCH }, eng.STDERR));
+    count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+    sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+    pendingConflicts = (eng, ws, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "pendingConflicts" }), principal, branch: BRANCH }, eng.STDERR));
+    spatialBboxParams = (bbox) => {
+      const minX = bbox.minX ?? bbox.minLng, minY = bbox.minY ?? bbox.minLat, maxX = bbox.maxX ?? bbox.maxLng, maxY = bbox.maxY ?? bbox.maxLat;
+      return { minX, minY, maxX, maxY, minLng: minX, minLat: minY, maxLng: maxX, maxLat: maxY };
+    };
+    spatialWithin = (eng, ws, spatialId, bbox, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "spatial", spatialId, ...spatialBboxParams(bbox) }), principal, branch: BRANCH }, eng.STDERR));
+    extremum = (eng, ws, extremumId, kind, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "extremum", extremumId, kind, groupKey: groupKey ?? "" }), principal, branch: BRANCH }, eng.STDERR));
+    nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
+    refusedRefName = (offerId) => `refs/heads/refused/${String(offerId || "unknown").replace(/[^A-Za-z0-9._-]/g, "_")}`;
+    GENESIS_WARRANT_ID = "genesis-warrant:self";
+    isWarranted = (eng, ws) => qById(eng, ws, GENESIS_WARRANT_ID).length > 0;
+  }
+});
+
+// ../cloud/dev-server/types.ts
+function errMsg(e) {
+  return String(e && e.message || e);
+}
+function errStack(e) {
+  const x = e;
+  return String(x && x.stack || x && x.message || e);
+}
+var init_types = __esm({
+  "../cloud/dev-server/types.ts"() {
+    "use strict";
+  }
+});
+
+// ../cloud/dev-server/bootstrap.ts
+var bootstrap_exports = {};
+__export(bootstrap_exports, {
+  bootstrapPlatform: () => bootstrapPlatform,
+  homeDomainOf: () => homeDomainOf,
+  isTestMint: () => isTestMint
+});
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+function isTestMint(eng) {
+  try {
+    setTestKRoot(eng, "");
+    return true;
+  } catch (e) {
+    return !/poisoned|unknown|adapter-visible API/.test(errMsg(e));
+  }
+}
+function homeDomainOf(opts) {
+  if (!opts || !opts.deploy) return null;
+  try {
+    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
+    const domains = body.summary && body.summary.domains || [];
+    const hit = domains.find((d) => Array.isArray(d.directives) && d.directives.includes("seedBirthAttestation"));
+    return hit ? hit.domain : null;
+  } catch {
+    return null;
+  }
+}
+async function bootstrapPlatform(dev, opts) {
+  const { eng, custody, ledgerFor, serialize, origin } = dev;
+  const platform = opts.platform || "co2-platform-local";
+  log2(`standing up platform '${platform}' on ${origin}`);
+  await serialize(async () => {
+    custody.create(`holon-${platform}`);
+    await mountWorkspace(eng, platform, ledgerFor(platform));
+    if (!nomosActive(eng, platform)) {
+      const r = author(
+        eng,
+        platform,
+        "bootstrap",
+        "installDomain",
+        installPayload(eng.hashes.nomos, eng.nomosPkg, "dev-bootstrap"),
+        "",
+        {}
+      );
+      if (r && r.ok === false) throw new Error(`platform genesis (framework install) REFUSED: ${String(r.error).slice(0, 300)}`);
+    }
+    log2(`platform '${platform}' genesis'd via the operator anchor lane (framework ${eng.hashes.nomos.slice(0, 12)})`);
+  });
+  if (opts.deploy) {
+    const body = JSON.parse(readFileSync(opts.deploy, "utf8"));
+    const usda = body.packageUsda || body.usda;
+    if (!usda) throw new Error(`--deploy ${opts.deploy} has no packageUsda (nothing to install)`);
+    const deployErr = await serialize(async () => {
+      const ledger = ledgerFor(platform);
+      const domainHash = await sha256hex(usda);
+      try {
+        const out = await deploy(eng, platform, ledger, usda, domainHash, body.dispositions || null, { actor: "user:dev-admin" });
+        if (out && out.ok === false) return String(out.error || "the law refused the platform package");
+        log2(`platform law deployed: ${domainHash.slice(0, 12)} (head ${String(out.head).slice(0, 12)})`);
+        return null;
+      } catch (e) {
+        return errMsg(e);
+      }
+    });
+    if (deployErr) throw new Error(`platform law deploy REFUSED: ${deployErr.slice(0, 400)}`);
+  } else {
+    log2("no --deploy given; platform runs framework law only (deploy your platform package to enable births)");
+  }
+  const testMint = isTestMint(eng);
+  if (!testMint) {
+    throw new Error(
+      "dev bootstrap: `--platform` needs the test-mint kernel (set_test_k_root is poisoned in this one). The bundled cloud/dev-server/kernel-testmint.wasm is used automatically when reachable; otherwise build one (./git-holon/build_wasm.sh --release --features test-mint --bin wasm_git_holon) and set NOMOS_LOCAL_WASM."
+    );
+  } else {
+    const OPERATOR = opts.operator || "user:dev-operator";
+    const kRoot = authorKeygen(eng);
+    setTestKRoot(eng, kRoot.public);
+    log2(`K_root ceremony: pinned LOCAL test K_root ${kRoot.public.slice(0, 16)}\u2026`);
+    const sP = authorKeygen(eng);
+    const platformCert = certSign(eng, {
+      child: platform,
+      founder: OPERATOR,
+      verified: true,
+      parentKey: sP.public,
+      // P_P — the onboarding signer the platform vouches for
+      parentId: "root",
+      epoch: 0,
+      secret: kRoot.secret
+      // signed by S_root
+    });
+    const certChain = JSON.stringify({ links: [platformCert] });
+    const homeDomain = homeDomainOf(opts) || "home";
+    const lawKeys = await serialize(async () => {
+      await mountWorkspace(eng, platform, ledgerFor(platform));
+      return currentLaw(eng, platform);
+    });
+    const lawHash = (lawKeys || {})[homeDomain] || "";
+    if (!lawHash) {
+      throw new Error(
+        `dev bootstrap: the deployed platform law declares no '${homeDomain}' framework domain (seedBirthAttestation/enrollSigner/seedGenesis absent) \u2014 an era-0 platform must be born WARRANTED. Deploy a law that composes the home framework (export the birth machinery from @githolon/dsl) via --deploy.`
+      );
+    } else {
+      let devIdP;
+      {
+        const { generateKeyPairSync, sign: nodeSign } = await import("node:crypto");
+        const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+        const jwk = publicKey.export({ format: "jwk" });
+        const ISS = `https://dev-idp.local/${platform}`;
+        const AUD = `${platform}-app`;
+        const JWKS = JSON.stringify({ keys: [{ kty: "EC", crv: "P-256", kid: "dev-idp", alg: "ES256", use: "sig", x: jwk.x, y: jwk.y }] });
+        const b64url = (b) => Buffer.from(b).toString("base64url");
+        const mint = (claims) => {
+          const header = b64url(JSON.stringify({ alg: "ES256", typ: "JWT", kid: "dev-idp" }));
+          const payload = b64url(JSON.stringify({ iss: ISS, aud: AUD, nbf: 0, exp: 4102444800, ...claims }));
+          const si = `${header}.${payload}`;
+          return `${si}.${b64url(nodeSign("sha256", Buffer.from(si), { key: privateKey, dsaEncoding: "ieee-p1363" }))}`;
+        };
+        const ap = await serialize(async () => authorOn(
+          eng,
+          platform,
+          ledgerFor(platform),
+          homeDomain,
+          "setAuthProvider",
+          { issuer: ISS, keys: JWKS, audience: AUD, principalClaim: "sub", deviceBindingClaim: "nonce" },
+          lawHash,
+          { actor: OPERATOR, principalVerified: true }
+        ));
+        if (ap.ok) {
+          devIdP = { issuer: ISS, audience: AUD, jwks: JWKS, mint };
+          log2(`dev test IdP registered (setAuthProvider ${ISS}, aud ${AUD}) \u2014 mint tokens via POST /dev/mint-token`);
+        } else {
+          log2(`dev test IdP NOT registered \u2014 the law composes no setAuthProvider (${String(ap.error).slice(0, 120)}); /dev/mint-token will refuse`);
+        }
+      }
+      const sOp = authorKeygen(eng);
+      const opKeyHash = createHash("sha256").update(Buffer.from(sOp.public, "base64")).digest("hex");
+      const A = (directiveId, payload) => serialize(async () => authorOn(
+        eng,
+        platform,
+        ledgerFor(platform),
+        homeDomain,
+        directiveId,
+        payload,
+        lawHash,
+        { actor: OPERATOR, principalVerified: true }
+      ));
+      const en = await A("enrollSigner", { keyHash: opKeyHash, grantedBy: OPERATOR, grantedAt: 1 });
+      if (!en.ok) throw new Error(`platform founding enrollSigner REFUSED: ${String(en.error).slice(0, 400)}`);
+      const seed = await A("seedBirthAttestation", {
+        child: platform,
+        founder: OPERATOR,
+        verified: "true",
+        parentId: "root",
+        parentKey: sP.public,
+        epoch: 0,
+        certChain
+      });
+      if (!seed.ok) throw new Error(`platform BirthAttestation seed REFUSED: ${String(seed.error).slice(0, 400)}`);
+      const warrant = await A("seedGenesis", {
+        principal: OPERATOR,
+        workspaceId: platform,
+        bornAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      if (!warrant.ok) throw new Error(`platform WARRANT (seedGenesis) REFUSED: ${String(warrant.error).slice(0, 400)}`);
+      dev.operatorDevice = sOp;
+      dev.testIdP = devIdP;
+      log2(`root-attested platform: enrolled founding device ${opKeyHash.slice(0, 12)}\u2026, seeded BirthAttestation (platform_cert signed by K_root, P_P=${sP.public.slice(0, 12)}\u2026), WARRANTED (self-id ${platform})`);
+      log2("  a birthHome under this platform now assembles [home_cert, u_delegation(S_P), platform_cert(K_root)] \u2014 no unwarranted-cert.");
+      log2("  ENROLL each user via the warranted lane: enrollFirstDevice (AuthProvider) or enrollDelegation (S_P-signed cert).");
+      dev.testKRoot = kRoot;
+      dev.onboardingSigner = sP;
+      dev.platformCert = platformCert;
+      dev.platformBirthAttestation = { child: platform, parentKey: sP.public, certChain };
+      dev.homeDomain = homeDomain;
+    }
+  }
+  if (opts.authProvider || opts.firebaseProject) {
+    log2(`AuthProvider: ${opts.authProvider || `firebase:${opts.firebaseProject}`} \u2014 register it via the platform's setAuthProvider governance offer;`);
+    log2("  the kernel verifies x-nomos-auth JWTs against the law-declared key (host stays blind).");
+  }
+  const attested = testMint && !!dev.platformBirthAttestation;
+  log2(attested ? "bootstrap complete \u2014 platform law deployed + ROOT-ATTESTED (BirthAttestation certChain seeded; birthHome assembles a valid travelling cert)." : "bootstrap complete (platform law deployed; attested-birth legs gated as noted above \u2014 need the test-mint wasm).");
+  return { platform, testMint, attested };
+}
+var log2;
+var init_bootstrap = __esm({
+  "../cloud/dev-server/bootstrap.ts"() {
+    "use strict";
+    init_engine();
+    init_types();
+    log2 = (m) => console.log(`[bootstrap] ${m}`);
+  }
+});
+
+// ../cloud/dev-server/server.ts
+init_engine();
+init_custody_transport();
+import http from "node:http";
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import os from "node:os";
+
+// ../adapter/pack_auth_contract.ts
+var HDR = Object.freeze({
+  /** The verified PROOF: an IdP access token (JWT), kernel-verified against the workspace's AuthProvider. */
+  AUTH: "x-nomos-auth",
+  /** The bare CLAIM (transitional / unverified fallback when no token is presented). */
+  PRINCIPAL: "x-nomos-principal"
+});
+function bulkReadForbidden(ws, kind, verdict) {
+  const v = verdict || {};
+  const caps = v.requiredRelationAnyOf || v.caps || [];
+  const premise = v.tokenError ? `token-verification-failed:${v.tokenError}` : v.resolvedPrincipal ? "principal-lacks-workspace-read-cap" : "no-principal-presented";
+  const why = v.tokenError ? `the presented ${HDR.AUTH} token did NOT verify (${v.tokenError}) against the workspace's declared issuer ${v.issuer || "?"}${v.audience ? ` / audience ${v.audience}` : ""}.` : v.resolvedPrincipal ? `resolved principal '${v.resolvedPrincipal}'${v.principalVerified ? " (token-verified)" : ` (unverified bare ${HDR.PRINCIPAL} claim)`} holds none of the required read capabilities.` : `no principal was presented \u2014 send a verified ${HDR.AUTH} token for a principal the owner granted a read capability.`;
+  return {
+    ok: false,
+    ws,
+    error: `${kind}-forbidden`,
+    forbidden: {
+      premise,
+      workspace: ws,
+      resolvedPrincipal: v.resolvedPrincipal || null,
+      principalVerified: !!v.principalVerified,
+      tokenError: v.tokenError || null,
+      requiredObject: v.requiredObject || "workspace:self",
+      requiredRelationAnyOf: caps,
+      issuer: v.issuer || null,
+      audience: v.audience || null
+    },
+    hint: `this workspace is private (read visibility) \u2014 a ${kind} reads the whole ledger, so it requires a principal granted ANY of its read capabilities (${caps.join(", ") || "a read cap"}) on ${v.requiredObject || "workspace:self"}: ${why}`
+  };
+}
+
+// ../cloud/cloudflare-shell/src/gateway-route-resolver.ts
+function aliasIdsFor(x, path2) {
+  const ids = [];
+  for (const key of ["directiveId", "queryId", "countId", "sumId", "extremumId", "spatialId"]) {
+    const value = x && x[key];
+    if (typeof value === "string" && value) ids.push(value);
+  }
+  const leaf = String(path2 || "").replace(/^\/+/, "").split("/").filter(Boolean).at(-1);
+  if (leaf) ids.push(leaf);
+  return new Set(ids);
+}
+function resolveGatewayOperation(spec, opName, method) {
+  if (!spec || !spec.paths || !opName || !method) return { op: null };
+  const normalizedMethod = String(method).toLowerCase();
+  const exactPath = `/${String(opName).replace(/^\/+/, "")}`;
+  const exact = spec.paths[exactPath]?.[normalizedMethod];
+  if (exact) return { op: exact, path: exactPath, ambiguous: null };
+  if (String(opName).includes("/")) return { op: null };
+  const matches = [];
+  for (const [path2, methods] of Object.entries(spec.paths)) {
+    const op = methods?.[normalizedMethod];
+    const x = op?.["x-nomos"];
+    if (!op || !x) continue;
+    if (aliasIdsFor(x, path2).has(opName)) matches.push({ op, path: path2 });
+  }
+  if (matches.length === 1) return { ...matches[0], ambiguous: null };
+  if (matches.length > 1) {
+    return { op: null, ambiguous: matches.map((m) => m.path).sort() };
+  }
+  return { op: null, ambiguous: null };
+}
+
+// ../cloud/cloudflare-shell/src/staged-intents.ts
+var STAGE_THRESHOLD_CHARS = 4 * 1024 * 1024;
+var MAX_INLINE_INTENT_CHARS = 8 * 1024 * 1024;
+var MAX_STAGED_INTENT_BYTES = 64 * 1024 * 1024;
+var stagedIntentKey = (sha256) => typeof sha256 === "string" && /^[0-9a-f]{64}$/.test(sha256) ? `staged-intents/${sha256}` : null;
+async function sha256hexBytes(bytes) {
+  const d = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+var b64OfBytes = (bytes) => {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode.apply(null, bytes.subarray(i, i + 32768));
+  return btoa(s);
+};
+async function stagePut(bucket, sha256, bytes) {
+  const key = stagedIntentKey(sha256);
+  if (key === null) return { status: 400, body: { ok: false, error: "stage-bad-ref: the path must name sha256 as 64 lowercase hex" } };
+  if (!(bytes instanceof Uint8Array) || bytes.length === 0) return { status: 400, body: { ok: false, error: "stage-empty: PUT a non-empty raw body (the sealed intent bytes)" } };
+  if (bytes.length > MAX_STAGED_INTENT_BYTES) return { status: 413, body: { ok: false, error: `stage-too-large: staged bytes are capped at ${MAX_STAGED_INTENT_BYTES} bytes` } };
+  const got = await sha256hexBytes(bytes);
+  if (got !== sha256) return { status: 400, body: { ok: false, error: `stage-hash-mismatch: sha256(body) is ${got}, not the named ${sha256} \u2014 stage bytes under their own hash` } };
+  const existing = typeof bucket.head === "function" ? await bucket.head(key) : await bucket.get(key);
+  if (existing) return { status: 200, body: { ok: true, sha256, size: bytes.length, alreadyStaged: true } };
+  await bucket.put(key, bytes);
+  return { status: 200, body: { ok: true, sha256, size: bytes.length, staged: true } };
+}
+async function resolveStagedIntent(bucket, ref) {
+  const sha256 = ref && typeof ref === "object" && typeof ref.sha256 === "string" ? ref.sha256 : "";
+  const key = stagedIntentKey(sha256);
+  if (key === null) return { ok: false, status: 400, error: "staged-intent-bad-ref: intentRef must be { sha256: <64 lowercase hex>, size? }" };
+  const obj = await bucket.get(key);
+  if (!obj) return { ok: false, status: 422, error: `staged-intent-missing: no staged bytes for sha256 ${sha256} \u2014 PUT /v2/stage/${sha256} (raw sealed intent bytes) first, then re-offer { intentRef }` };
+  const bytes = new Uint8Array(await obj.arrayBuffer());
+  if (bytes.length > MAX_STAGED_INTENT_BYTES) return { ok: false, status: 413, error: `staged-intent-too-large: staged bytes exceed the ${MAX_STAGED_INTENT_BYTES}-byte cap` };
+  if (typeof ref?.size === "number" && ref.size !== bytes.length) return { ok: false, status: 422, error: `staged-intent-size-mismatch: the ref names ${ref.size} bytes but ${bytes.length} are staged` };
+  const got = await sha256hexBytes(bytes);
+  if (got !== sha256) return { ok: false, status: 422, error: `staged-intent-hash-mismatch: staged bytes hash to ${got}, not the offered ${sha256} \u2014 the signed offer's hash is the binding; refuse` };
+  return { ok: true, intentB64: b64OfBytes(bytes), sha256, size: bytes.length };
+}
+
+// ../cloud/dev-server/custody.ts
+import { spawn, execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, rmSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+var GIT_HTTP_BACKEND = join(
+  execFileSync("git", ["--exec-path"], { encoding: "utf8" }).trim(),
+  "git-http-backend"
+);
+var FilesystemGitRepository = class {
+  constructor(name, dir, origin) {
+    this.name = name;
+    this.dir = dir;
+    this.remote = `${origin}/git/nomos/${name}.git`;
+  }
+  // Dev custody is open (git-http-backend export-all): a token is inert but we keep the
+  // production SHAPE so callers that thread `createToken(...).plaintext` are unchanged.
+  createToken(_scope = "read", ttlSec = 3600) {
+    return { plaintext: "dev-inert-token", expiresAt: Date.now() + ttlSec * 1e3 };
+  }
+};
+var FilesystemGitCustody = class {
+  /** @param dataDir  the --data root; repos live under <dataDir>/custody */
+  constructor(dataDir, origin) {
+    this.root = join(dataDir, "custody");
+    this.origin = origin;
+    mkdirSync(this.root, { recursive: true });
+  }
+  _dirOf(name) {
+    return join(this.root, `${name}.git`);
+  }
+  get(name) {
+    const dir = this._dirOf(name);
+    return existsSync(dir) ? new FilesystemGitRepository(name, dir, this.origin) : null;
+  }
+  /** Idempotent: init a bare repo (with http.receivepack so the client can push). */
+  create(name) {
+    const dir = this._dirOf(name);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+      execFileSync("git", ["init", "--bare", "--quiet", dir]);
+      execFileSync("git", ["--git-dir", dir, "config", "http.receivepack", "true"]);
+      execFileSync("git", ["--git-dir", dir, "config", "http.uploadpack", "true"]);
+    }
+    return new FilesystemGitRepository(name, dir, this.origin);
+  }
+  delete(name) {
+    const dir = this._dirOf(name);
+    if (existsSync(dir)) rmSync(dir, { recursive: true, force: true });
+  }
+  list() {
+    if (!existsSync(this.root)) return [];
+    return readdirSync(this.root).filter((f) => f.endsWith(".git")).map((f) => f.slice(0, -4));
+  }
+};
+function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2, contentType, body }) {
+  return new Promise((resolve, reject) => {
+    const env = {
+      ...process.env,
+      GIT_PROJECT_ROOT: projectRoot,
+      GIT_HTTP_EXPORT_ALL: "1",
+      PATH_INFO: pathInfo,
+      REQUEST_METHOD: method,
+      QUERY_STRING: query2 || "",
+      CONTENT_TYPE: contentType || "",
+      CONTENT_LENGTH: String(body ? body.length : 0),
+      REMOTE_ADDR: "127.0.0.1",
+      REMOTE_USER: "nomos-dev",
+      GIT_HTTP_MAX_REQUEST_BUFFER: String(64 * 1024 * 1024)
+    };
+    const cgi = spawn(GIT_HTTP_BACKEND, [], { env });
+    const chunks = [];
+    cgi.stdout.on("data", (d) => chunks.push(d));
+    cgi.stderr.on("data", () => {
+    });
+    cgi.on("error", reject);
+    cgi.on("close", () => {
+      const out = Buffer.concat(chunks);
+      let sep = out.indexOf("\r\n\r\n");
+      let sepLen = 4;
+      if (sep < 0) {
+        sep = out.indexOf("\n\n");
+        sepLen = 2;
+      }
+      const headerText = sep >= 0 ? out.slice(0, sep).toString("utf8") : out.toString("utf8");
+      const payload = sep >= 0 ? out.slice(sep + sepLen) : Buffer.alloc(0);
+      const headers = {};
+      let status = 200;
+      for (const line of headerText.split(/\r?\n/)) {
+        const i = line.indexOf(":");
+        if (i < 0) continue;
+        const k = line.slice(0, i).trim();
+        const v = line.slice(i + 1).trim();
+        if (/^status$/i.test(k)) {
+          status = parseInt(v, 10) || 200;
+          continue;
+        }
+        headers[k] = v;
+      }
+      resolve({ status, headers, body: payload });
+    });
+    if (body && body.length) cgi.stdin.write(body);
+    cgi.stdin.end();
+  });
+}
+function receivePackCommands(raw) {
+  const cmds = [];
+  let off = 0;
+  const dec4 = new TextDecoder();
+  while (off + 4 <= raw.length) {
+    const hex = dec4.decode(raw.subarray(off, off + 4));
+    if (!/^[0-9a-f]{4}$/.test(hex)) break;
+    const len = parseInt(hex, 16);
+    if (len === 0) {
+      off += 4;
+      break;
+    }
+    let line = dec4.decode(raw.subarray(off + 4, off + len));
+    off += len;
+    const nul = line.indexOf("\0");
+    if (nul >= 0) line = line.slice(0, nul);
+    const m = line.match(/^([0-9a-f]{40}) ([0-9a-f]{40}) (.+?)\s*$/);
+    if (m) cmds.push({ oldOid: m[1], newOid: m[2], ref: m[3] });
+  }
+  return cmds;
+}
+
+// ../cloud/dev-server/server.ts
+init_types();
+var DIR = path.dirname(fileURLToPath(import.meta.url));
+var REPO_ROOT = path.resolve(DIR, "../..");
+var RECOGNIZED_UNSUPPORTED = /* @__PURE__ */ new Set([
+  "container-status",
+  "recycle-container",
+  "hostnames",
+  "rebirth-custody",
+  "upload-begin",
+  "upload-gate",
+  "upload-verify",
+  "drain-reclaims",
+  "drain-rebirths",
+  "git-read-lease",
+  "poke-admit",
+  "clear-checkpoint",
+  "domain-package",
+  "capabilities"
+]);
+var UNSUPPORTED_WHY = {
+  "container-status": "the heavy container tier is Cloudflare-only (the dev cloud is one in-process engine)",
+  "recycle-container": "the heavy container tier is Cloudflare-only (the dev cloud is one in-process engine)",
+  "hostnames": "platform custom-hostname routing is a multi-tenant edge concern",
+  "rebirth-custody": "the custodian rebirth lane is bound to Cloudflare Artifacts custody",
+  "upload-begin": "the upload-birth lane is DELETED \u2014 there is no push-to-create; a workspace is born by its PARENT authoring its birth (birthHome/birthChild/your .births() directive) and syncing the parent",
+  "upload-gate": "the upload-birth lane is DELETED \u2014 author the birth on its parent and sync the parent",
+  "upload-verify": "the upload-birth lane is DELETED \u2014 author the birth on its parent and sync the parent",
+  "drain-reclaims": "an operator lawful-recovery drain (multi-node lifecycle)",
+  "drain-rebirths": "an operator lawful-recovery drain (multi-node lifecycle)",
+  "capabilities": "retired everywhere \u2014 host-side capability storage is gone (capabilities are holon-offered obligations now)"
+};
+var _realFetch = globalThis.fetch;
+globalThis.fetch = (input, init) => {
+  const u = typeof input === "string" ? input : input?.url || "";
+  if (/artifacts\.cloudflare\.net|\.workers\.dev/i.test(u)) {
+    throw new Error(`REMOTE CUSTODY FORBIDDEN in dev cloud: refused fetch to ${u}`);
+  }
+  return _realFetch(input, init);
+};
+var unb64 = (s) => new Uint8Array(Buffer.from(s, "base64"));
+function configDir() {
+  return process.env.HOLON_CONFIG_DIR || path.join(os.homedir(), ".holon");
+}
+function firstExisting(...paths) {
+  for (const p of paths) {
+    if (p && existsSync2(p)) return p;
+  }
+  return null;
+}
+var TEST_MINT_MARKER = Buffer.from("set_test_k_root");
+var isTestMintBytes = (bytes) => bytes.includes(TEST_MINT_MARKER);
+var KERNEL_CAPABILITY_REGISTRY = [
+  {
+    prefix: "846c6bf8",
+    version: "kernel-846c6bf8",
+    note: "production (accepts compound-key law)",
+    features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
+  },
+  {
+    prefix: "f6e44b3a",
+    version: "kernel-f6e44b3a",
+    note: "test-mint (DEV) \u2014 current, feature-equivalent to production",
+    features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
+  },
+  {
+    prefix: "f81cb952",
+    version: "kernel-f81cb952",
+    note: "test-mint (DEV ONLY \u2014 STALE: predates compound-key read router; superseded by f6e44b3a)",
+    features: ["capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads"]
+  }
+];
+function capabilitiesForKernelHash(hash) {
+  const h = String(hash || "").toLowerCase();
+  const hit = KERNEL_CAPABILITY_REGISTRY.find((e) => h.startsWith(e.prefix) || e.prefix.startsWith(h.slice(0, 8)));
+  return hit ? { hash: h, version: hit.version, note: hit.note, features: hit.features, known: true } : { hash: h, version: null, note: "UNKNOWN kernel \u2014 not in the capability registry", features: [], known: false };
+}
+var DEFAULT_KERNEL_SOURCE = "https://nomos.captainapp.co.uk";
+async function resolveTestMintWasm(kernelSource) {
+  const runtimeCache = path.join(configDir(), "runtime");
+  const cachePath = path.join(runtimeCache, "holon-testmint.wasm");
+  const local = process.env.NOMOS_LOCAL_WASM;
+  if (local && existsSync2(local)) {
+    const bytes = readFileSync2(local);
+    if (isTestMintBytes(bytes)) return { wasmPath: local, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "NOMOS_LOCAL_WASM" };
+  }
+  const bundled = path.join(DIR, "kernel-testmint.wasm");
+  if (existsSync2(bundled)) {
+    const bytes = readFileSync2(bundled);
+    if (isTestMintBytes(bytes)) return { wasmPath: bundled, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "bundled" };
+  }
+  if (existsSync2(cachePath)) {
+    const bytes = readFileSync2(cachePath);
+    if (isTestMintBytes(bytes)) return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: "cache" };
+  }
+  const src = String(kernelSource || process.env.NOMOS_KERNEL_SOURCE || DEFAULT_KERNEL_SOURCE).replace(/\/+$/, "");
+  const url = `${src}/v1/runtime/holon-testmint.wasm`;
+  try {
+    const resp = await _realFetch(url);
+    if (resp.ok) {
+      const bytes = Buffer.from(await resp.arrayBuffer());
+      if (isTestMintBytes(bytes)) {
+        mkdirSync2(runtimeCache, { recursive: true });
+        writeFileSync(cachePath, bytes);
+        return { wasmPath: cachePath, wasmBytes: bytes, kernelKind: "test-mint", kernelSource: `fetched ${url}` };
+      }
+    }
+  } catch {
+  }
+  throw new Error(
+    `attested births need the test-mint kernel; it couldn't be fetched from ${src} (offline?) \u2014 build one: git-holon/build_wasm.sh --release --features test-mint --bin wasm_git_holon and set NOMOS_LOCAL_WASM`
+  );
+}
+async function loadRuntime(opts = {}) {
+  const runtimeCache = path.join(configDir(), "runtime");
+  const repoDomainsDir = path.join(REPO_ROOT, "cloud/cloudflare-shell/container/domains");
+  const vendoredFrameworkDir = path.join(DIR, "framework");
+  let wasmPath, wasmBytes, kernelKind, kernelSource;
+  if (opts.attested) {
+    ({ wasmPath, wasmBytes, kernelKind, kernelSource } = await resolveTestMintWasm(opts.kernelSource));
+  } else {
+    wasmPath = firstExisting(
+      process.env.NOMOS_LOCAL_WASM,
+      path.join(REPO_ROOT, "cloud/cloudflare-shell/container/vendor/wasm_git_holon.wasm"),
+      path.join(runtimeCache, "holon.wasm")
+    );
+    if (!wasmPath) {
+      throw new Error(
+        "no kernel wasm found. Warm the kernel first:\n  \u2022 set NOMOS_LOCAL_WASM=<path to holon.wasm>, OR\n  \u2022 run any `githolon` cloud command once (e.g. `githolon ledger verify \u2026`) to cache ~/.holon/runtime/holon.wasm\n  (attested births additionally require a test-mint wasm \u2014 pass --bootstrap or --attested)"
+      );
+    }
+    wasmBytes = readFileSync2(wasmPath);
+    kernelKind = isTestMintBytes(wasmBytes) ? "test-mint" : "production";
+    kernelSource = wasmPath === process.env.NOMOS_LOCAL_WASM ? "NOMOS_LOCAL_WASM" : wasmPath.startsWith(runtimeCache) ? "cache" : "repo-vendor";
+  }
+  const repoBootstrap = firstExisting(path.join(repoDomainsDir, "domain_bootstrap.package.usda"));
+  const repoNomos = firstExisting(path.join(repoDomainsDir, "domain_nomos.package.usda"));
+  let bootstrapPkg, nomosPkg;
+  if (repoBootstrap && repoNomos) {
+    bootstrapPkg = readFileSync2(repoBootstrap, "utf8");
+    nomosPkg = readFileSync2(repoNomos, "utf8");
+  } else if (existsSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"))) {
+    bootstrapPkg = readFileSync2(path.join(vendoredFrameworkDir, "domain_bootstrap.package.usda"), "utf8");
+    nomosPkg = readFileSync2(path.join(vendoredFrameworkDir, "domain_nomos.package.usda"), "utf8");
+  } else {
+    const pkgsCache = path.join(runtimeCache, "packages.json");
+    if (!existsSync2(pkgsCache)) {
+      throw new Error(
+        "no framework packages found (domain_bootstrap/domain_nomos). Warm the runtime cache by running any `githolon` cloud command once, or run from the monorepo checkout."
+      );
+    }
+    const pkgs = JSON.parse(readFileSync2(pkgsCache, "utf8"));
+    bootstrapPkg = pkgs.bootstrap;
+    nomosPkg = pkgs.nomos;
+  }
+  return { wasmPath, wasmBytes, bootstrapPkg, nomosPkg, kernelKind, kernelSource };
+}
+async function startDevCloud(opts = {}) {
+  let devSelf = null;
+  const port = opts.port || 8787;
+  const host = opts.host || "127.0.0.1";
+  const origin = `http://${host}:${port}`;
+  const ephemeral = !!opts.ephemeral;
+  const dataDir = ephemeral ? mkdtempSync(path.join(os.tmpdir(), "nomos-dev-cloud-")) : path.resolve(opts.data || ".nomos/dev-cloud");
+  mkdirSync2(dataDir, { recursive: true });
+  const attested = !!(opts.attested || opts.bootstrap || opts.platform);
+  const { wasmPath, wasmBytes, bootstrapPkg, nomosPkg, kernelKind, kernelSource } = await loadRuntime({ attested, kernelSource: opts.kernelSource });
+  console.log(`[dev-cloud]   kernel   : ${kernelKind} (from ${kernelSource})`);
+  const wasmModule = await WebAssembly.compile(wasmBytes);
+  const kernelSha = createHash2("sha256").update(wasmBytes).digest("hex");
+  const enc4 = new TextEncoder();
+  const replicaDigest = new Uint8Array(await crypto.subtle.digest("SHA-256", enc4.encode(`dev:${randomBytes(8).toString("hex")}`)));
+  let replica = 0n;
+  for (let i = 0; i < 8; i++) replica = replica << 8n | BigInt(replicaDigest[i]);
+  replica &= (1n << 63n) - 1n;
+  const eng = await createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, installedBy: "nomos-cloud-dev" });
+  const custody = new FilesystemGitCustody(dataDir, origin);
+  const stagedBytes = /* @__PURE__ */ new Map();
+  const stageBucket = {
+    async get(k) {
+      const b = stagedBytes.get(k);
+      return b ? { arrayBuffer: async () => b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength) } : null;
+    },
+    async put(k, bytes) {
+      stagedBytes.set(k, bytes);
+    },
+    async head(k) {
+      const b = stagedBytes.get(k);
+      return b ? { size: b.length } : null;
+    }
+  };
+  let chain = Promise.resolve();
+  const serialize = (fn) => {
+    const r = chain.then(fn, fn);
+    chain = r.then(() => {
+    }, () => {
+    });
+    return r;
+  };
+  const pushChains = /* @__PURE__ */ new Map();
+  const pushLaneFor = (ws) => (fn) => {
+    const prev = pushChains.get(ws) || Promise.resolve();
+    const r = prev.then(fn, fn);
+    pushChains.set(ws, r.then(() => {
+    }, () => {
+    }));
+    return r;
+  };
+  const ledgerFor = (ws) => ({
+    remote: `${origin}/git/nomos/holon-${ws}.git`,
+    headers: {},
+    pushLane: pushLaneFor(ws)
+  });
+  async function persistBorn(born) {
+    if (!Array.isArray(born)) return [];
+    const out = [];
+    for (const b of born) {
+      const child = b && b.workspace;
+      const head = b && b.head;
+      out.push({ workspace: child, head });
+      if (!child || !/^[0-9a-f]{40}$/i.test(head || "") || !b.packB64) continue;
+      const repo = custody.create(`holon-${child}`);
+      const refs = await lsRefs(repo.remote, {}, { service: "git-receive-pack", prefix: "refs/heads/main" }).catch(() => ({}));
+      const oldOid = refs["refs/heads/main"] || ZERO_OID;
+      if (oldOid === head) continue;
+      await pushLaneFor(child)(
+        () => pushPack(repo.remote, {}, { updates: [{ ref: "refs/heads/main", oldOid, newOid: head }], pack: unb64(b.packB64) })
+      );
+    }
+    return out;
+  }
+  const CORS = {
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET,POST,PUT,DELETE,OPTIONS",
+    "access-control-allow-headers": "content-type,x-nomos-auth,x-nomos-principal,authorization"
+  };
+  const sendJson = (res, obj, status = 200) => {
+    const body = JSON.stringify(obj, null, 2) + "\n";
+    res.writeHead(status, { "content-type": "application/json", ...CORS });
+    res.end(body);
+  };
+  const sendBytes = (res, bytes, status = 200, headers = {}) => {
+    res.writeHead(status, { ...CORS, ...headers });
+    res.end(Buffer.from(bytes));
+  };
+  const readBody = (req) => new Promise((resolve) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+  });
+  const principalOf = (req) => String(req.headers["x-nomos-principal"] || "").slice(0, 128);
+  const authTokenOf = (req) => String(req.headers["x-nomos-auth"] || "").replace(/^Bearer\s+/i, "");
+  const postureGate = (res, ws, req, kind) => {
+    let posture;
+    try {
+      posture = readPosture(eng, ws, principalOf(req), authTokenOf(req), Math.floor(Date.now() / 1e3));
+    } catch {
+      return false;
+    }
+    if (posture && posture.private && !posture.allowedAny) {
+      sendJson(res, bulkReadForbidden(ws, kind, posture), 403);
+      return true;
+    }
+    return false;
+  };
+  function openapiFor(ws) {
+    const merged = { openapi: "3.1.0", info: { title: `${ws} (nomos workspace)`, version: "0", "x-nomos-workspace": ws }, paths: {} };
+    const domOf = (o) => {
+      const x = o;
+      return String(x && x["x-nomos"] && x["x-nomos"].domain ? x["x-nomos"].domain : "domain");
+    };
+    const mergeInto = (frag) => {
+      for (const [p, methods] of Object.entries(frag.paths || {})) {
+        for (const [m, op] of Object.entries(methods)) {
+          const existing = merged.paths[p] && merged.paths[p][m];
+          if (existing === void 0) {
+            (merged.paths[p] ||= {})[m] = op;
+          } else if (JSON.stringify(existing) !== JSON.stringify(op)) {
+            (merged.paths[`/${domOf(existing)}${p}`] ||= {})[m] = existing;
+            (merged.paths[`/${domOf(op)}${p}`] ||= {})[m] = op;
+            delete merged.paths[p][m];
+            if (Object.keys(merged.paths[p]).length === 0) delete merged.paths[p];
+          }
+        }
+      }
+    };
+    try {
+      const spec = describe(eng, ws);
+      if (spec && spec.paths) mergeInto(spec);
+    } catch {
+    }
+    merged.paths["/openapi.json"] = {
+      get: { operationId: "nomos__openapi", summary: "this workspace's live OpenAPI", responses: { "200": { description: "ok" } } }
+    };
+    return merged;
+  }
+  const server = http.createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url ?? "", origin);
+      const seg = url.pathname.split("/").filter(Boolean);
+      if (req.method === "OPTIONS") {
+        res.writeHead(204, CORS);
+        return res.end();
+      }
+      if (url.pathname === "/health") {
+        return sendJson(res, {
+          ok: true,
+          kernelSha,
+          dataDir,
+          wasmPath,
+          workspaces: custody.list(),
+          ...devSelf?.platformReady !== void 0 ? { platformReady: devSelf.platformReady } : {}
+        });
+      }
+      if (url.pathname === "/dev/mint-token" && req.method === "POST") {
+        const idp = devSelf?.testIdP;
+        if (!idp) {
+          return sendJson(res, {
+            ok: false,
+            error: "no dev test IdP \u2014 start with `--platform` and deploy a law that composes setAuthProvider (the warranted-onboard surface)"
+          }, 409);
+        }
+        const b = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+        if (!b.sub) return sendJson(res, { ok: false, error: "mint-token: 'sub' (the bare uid) is required" }, 400);
+        const token = idp.mint({ sub: b.sub, ...b.nonce ? { nonce: b.nonce } : {} });
+        return sendJson(res, { ok: true, token, issuer: idp.issuer, audience: idp.audience });
+      }
+      if (url.pathname === "/v1/runtime/holon.wasm" || url.pathname === "/v1/runtime/holon-testmint.wasm") {
+        res.writeHead(200, { ...CORS, "content-type": "application/wasm", "cache-control": "no-store", "x-nomos-kernel": kernelKind, "x-nomos-kernel-sha": kernelSha });
+        return res.end(Buffer.from(wasmBytes));
+      }
+      if (url.pathname === "/v1/runtime/capabilities") {
+        const stamp = capabilitiesForKernelHash(kernelSha);
+        return sendJson(res, {
+          ok: true,
+          prod: stamp,
+          // the dev cloud serves ONE kernel; it is what holon.wasm returns
+          testmint: kernelKind === "test-mint" ? stamp : null,
+          kernelKind,
+          expectedBundleVersion: 1,
+          vocabulary: KERNEL_CAPABILITY_REGISTRY.flatMap((e) => e.features).filter((f, i, a) => a.indexOf(f) === i).sort()
+        });
+      }
+      if (url.pathname === "/v1/runtime/packages") {
+        return sendJson(res, { bootstrap: bootstrapPkg, nomos: nomosPkg });
+      }
+      {
+        const m = url.pathname.match(/^\/v2\/stage\/([0-9a-f]{64})$/);
+        if (m) {
+          const sha = m[1];
+          if (req.method === "PUT" || req.method === "POST") {
+            const bytes = new Uint8Array(await readBody(req));
+            const r = await stagePut(stageBucket, sha, bytes);
+            return sendJson(res, r.body, r.status);
+          }
+          if (req.method === "GET" || req.method === "HEAD") {
+            const head = await stageBucket.head(`staged-intents/${sha}`);
+            if (!head) return sendJson(res, { ok: false, staged: false, sha256: sha }, 404);
+            return sendJson(res, { ok: true, staged: true, sha256: sha, size: head.size }, 200);
+          }
+        }
+      }
+      if (seg[0] === "git" && seg[1] === "nomos") {
+        return await gitBackend(req, res, seg.slice(2).join("/"), null);
+      }
+      if (seg[0] === "repositories" && seg[1]) {
+        const name = decodeURIComponent(seg[1]);
+        if (req.method === "PUT") {
+          const r2 = custody.create(name);
+          return sendJson(res, { ok: true, name, remote: r2.remote }, 201);
+        }
+        if (req.method === "DELETE") {
+          custody.delete(name);
+          return sendJson(res, { ok: true, name, deleted: true });
+        }
+        const r = custody.get(name);
+        return r ? sendJson(res, { ok: true, name, remote: r.remote }) : sendJson(res, { ok: false, error: "no such repository" }, 404);
+      }
+      if (seg[0] === "v2" && seg[1] === "workspaces" && seg[2]) {
+        const ws = decodeURIComponent(seg[2]);
+        const sub = seg.slice(3);
+        if (sub[0] === "git") {
+          return await gitBackend(req, res, `holon-${ws}.git/${sub.slice(1).join("/")}`, ws);
+        }
+        if (sub.length === 0 && req.method === "POST") {
+          return await serialize(async () => {
+            if (!custody.get(`holon-${ws}`)) {
+              sendJson(res, { ok: false, ws, error: `workspace '${ws}' is unborn \u2014 the host does not create workspaces; author its birth on its PARENT (birthChild/birthHome).` }, 409);
+              return;
+            }
+            const ledger = ledgerFor(ws);
+            const out = await boot(eng, ws, ledger);
+            sendJson(res, { ok: true, ws, tier: "heavy", status: out.status, ledger: ledger.remote, head: out.head, controller: { domainHash: out.controllerHash, rows: out.rows } }, out.status === "already-initialized" ? 200 : 201);
+          });
+        }
+        if (sub.length === 0 && req.method === "GET") {
+          return await serialize(async () => {
+            const ledger = ledgerFor(ws);
+            let initialized = false, ledgerState = null;
+            if (custody.get(`holon-${ws}`)) {
+              await mountWorkspace(eng, ws, ledger);
+              try {
+                initialized = nomosActive(eng, ws);
+              } catch {
+              }
+              ledgerState = await ledgerStats(eng, ws, ledger).catch(() => null);
+            }
+            sendJson(res, { ok: true, ws, tier: "heavy", initialized, ledger: ledger.remote, ledgerState, kernelSha });
+          });
+        }
+        if (sub[0] === "domains" && sub.length === 1) {
+          if (req.method === "GET") {
+            return await serialize(async () => {
+              await mountWorkspace(eng, ws, ledgerFor(ws));
+              sendJson(res, { ok: true, ws, ...installedLaw(eng, ws) });
+            });
+          }
+          if (req.method === "POST") {
+            const raw = await readBody(req);
+            return await serialize(async () => {
+              const ledger = ledgerFor(ws);
+              await mountWorkspace(eng, ws, ledger);
+              if (!nomosActive(eng, ws)) return sendJson(res, { ok: false, error: `workspace '${ws}' is not initialized \u2014 POST /v2/workspaces/${ws} first` }, 409);
+              let usda, dispositions = null;
+              const text = raw.toString("utf8");
+              if (text.trimStart().startsWith("#usda")) {
+                usda = text;
+              } else {
+                const body = JSON.parse(text || "{}");
+                usda = body.packageUsda || body.usda;
+                dispositions = body.dispositions || null;
+              }
+              if (!usda) return sendJson(res, { ok: false, error: "deploy body must be raw #usda or JSON with packageUsda" }, 400);
+              const domainHash = await sha256hex(usda);
+              const dryRun = url.searchParams.get("dryRun");
+              if (dryRun === "evolve") {
+                const verdict = evolveDryRun(eng, ws, usda, domainHash, dispositions);
+                return sendJson(res, { ok: true, dryRun: "evolve", verdict });
+              }
+              if (dryRun) return sendJson(res, { ok: true, dryRun: true, wouldInstall: domainHash, bytes: usda.length });
+              const actor = principalOf(req);
+              const authToken = authTokenOf(req);
+              try {
+                const out = await deploy(eng, ws, ledger, usda, domainHash, dispositions, { actor, ...authToken ? { authToken } : {} });
+                sendJson(res, { ok: true, ws, domainHash, head: out.head, installation: out.installation }, 201);
+              } catch (e) {
+                const msg = errMsg(e);
+                const status = /deploy-did-not-advance/.test(msg) ? 409 : 422;
+                sendJson(res, { ok: false, refused: true, error: msg.slice(0, 600) }, status);
+              }
+            });
+          }
+        }
+        if (sub[0] === "domains" && sub.length === 3 && sub[2] === "package.usda") {
+          return await serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            const pkg = domainPackage(eng, ws, sub[1]);
+            if (!pkg || !pkg.usda) return sendJson(res, { ok: false, error: "no such package" }, 404);
+            res.writeHead(200, { "content-type": "text/plain", ...CORS });
+            res.end(pkg.usda);
+          });
+        }
+        if (sub[0] === "openapi.json" && req.method === "GET") {
+          return await serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            sendJson(res, openapiFor(ws));
+          });
+        }
+        if (sub[0] === "admit" && req.method === "POST") {
+          return await serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const out = await admitAll(eng, ws, ledger, {});
+            if (Array.isArray(out.born) && out.born.length) await persistBorn(packBornChildren(eng, out.born));
+            sendJson(res, { ok: true, ws, sessions: out.sessions, main: out.main, ...out.timings ? { timings: out.timings } : {} });
+          });
+        }
+        if (sub[0] === "intent-offers" && req.method === "POST") {
+          return await serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+            const offers = Array.isArray(body.offers) ? body.offers.slice(0, 100) : [];
+            if (!offers.length) return sendJson(res, { ok: false, error: "body must be { offers:[{session, oid, intentB64}] }" }, 400);
+            const clientBase = /^[0-9a-f]{40}$/i.test(body.base || "") ? body.base : null;
+            const out = await admitIntentOffers(eng, ws, ledger, offers, { ...clientBase ? { clientBase } : {} });
+            if (Array.isArray(out.born) && out.born.length) await persistBorn(out.born);
+            const bornOut = Array.isArray(out.born) ? out.born.map(({ packB64, packBytes, ...b }) => b) : null;
+            sendJson(res, {
+              ok: true,
+              ws,
+              sessions: out.sessions,
+              main: out.main,
+              ...bornOut ? { born: bornOut } : {},
+              ...out.birthOutcomes ? { birthOutcomes: out.birthOutcomes } : {},
+              ...out.mainDelta ? { mainDelta: out.mainDelta } : {},
+              ...out.resultPackB64 ? { resultPackB64: out.resultPackB64, resultBase: out.resultBase } : {},
+              ...out.deadLetters && out.deadLetters.length ? { deadLetters: out.deadLetters.map(({ blob, ...m }) => m) } : {}
+            });
+          });
+        }
+        if (sub[0] === "dead-letters" && sub.length === 1 && req.method === "GET") {
+          return await serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            sendJson(res, { ok: true, ws, deadLetters: await listRefusedRefs(eng, ws) });
+          });
+        }
+        if (sub[0] === "dlq-summary" && req.method === "GET") {
+          return await serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            sendJson(res, { ok: true, ws, ...await refusedSummary(eng, ws) });
+          });
+        }
+        if (sub[0] === "dead-letters" && sub[1] === "retry" && req.method === "POST") {
+          return await serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+            const only = body.id || null;
+            const refs = await listRefusedRefs(eng, ws);
+            const retried = [], failed = [];
+            for (const e of refs) {
+              if (only && e.offerId !== only && e.oid !== only) continue;
+              if (!e.intentB64) {
+                failed.push({ intentId: e.offerId, error: "refused ref carries no intent bytes" });
+                continue;
+              }
+              try {
+                const r2 = offerAdmit(eng, ws, unb64(e.intentB64), {});
+                if (r2.ok) retried.push({ intentId: e.offerId, head: r2.head });
+                else failed.push({ intentId: e.offerId, error: String(r2.error || "").slice(0, 300) });
+              } catch (err) {
+                failed.push({ intentId: e.offerId, error: String(err).slice(0, 300) });
+              }
+            }
+            if (retried.length) await commitAndPush(eng, ws, ledger);
+            for (const r2 of retried) await deleteRefusedRef(eng, ws, ledger, r2.intentId);
+            sendJson(res, { ok: true, ws, retried, failed, remaining: (await listRefusedRefs(eng, ws)).length });
+          });
+        }
+        if (sub[0] === "dead-letters" && (sub[1] === "discard" || req.method === "DELETE")) {
+          return await serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const body = req.method === "DELETE" ? {} : JSON.parse((await readBody(req)).toString("utf8") || "{}");
+            const only = body.id || url.searchParams.get("id") || null;
+            const targets = (await listRefusedRefs(eng, ws)).filter((e) => !only || e.offerId === only || e.oid === only);
+            for (const e of targets) await deleteRefusedRef(eng, ws, ledger, e.offerId || e.oid);
+            sendJson(res, { ok: true, ws, discarded: targets.length });
+          });
+        }
+        if (sub[0] === "rotate-secret" && req.method === "POST") {
+          return sendJson(res, { ok: false, retired: true, error: "rotate-secret is retired \u2014 ownership is a ledger fact (sha256 of the push password on the law record); re-own by re-birthing the workspace via its parent" }, 410);
+        }
+        if (sub[0] === "pack" && req.method === "GET") {
+          return await serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            if (postureGate(res, ws, req, "pack")) return;
+            const have = url.searchParams.get("have") || "";
+            let r;
+            try {
+              r = servePack(eng, ws, have);
+            } catch (e) {
+              return sendJson(res, { ok: false, custodyBreak: true, error: errMsg(e).slice(0, 400), have }, 409);
+            }
+            if (!r.packB64) return sendBytes(res, Buffer.alloc(0), 204, r.head ? { "x-nomos-head": r.head } : {});
+            const kind = r.divergent ? "full" : have ? "delta" : "full";
+            sendBytes(res, unb64(r.packB64), 200, {
+              "content-type": "application/x-git-packfile",
+              "x-nomos-pack": kind,
+              ...r.divergent ? { "x-nomos-divergent": "1" } : {},
+              ...r.head ? { "x-nomos-head": r.head } : {}
+            });
+          });
+        }
+        if (sub[0] === "snapshot" && req.method === "GET") {
+          return await serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            if (postureGate(res, ws, req, "snapshot")) return;
+            const bytes = snapshot(eng, ws);
+            sendBytes(res, bytes, 200, { "content-type": "application/octet-stream", "x-nomos-layout": "flat-manifest-v1" });
+          });
+        }
+        if (sub[0] === "aggregates" && sub[1] || sub[0] === "qbyid" && req.method === "GET") {
+          const id = sub[0] === "aggregates" ? decodeURIComponent(sub.slice(1).join("/")) : url.searchParams.get("id");
+          return await serialize(async () => {
+            await mountWorkspace(eng, ws, ledgerFor(ws));
+            const rows = qById(eng, ws, id, principalOf(req));
+            sendJson(res, { ok: true, ws, rows });
+          });
+        }
+        if (sub[0] === "subscribe") {
+          return sendJson(res, { ok: false, error: "subscribe requires a WebSocket upgrade" }, 426);
+        }
+        if ((sub.length === 1 || sub.length === 2) && (req.method === "POST" || req.method === "GET")) {
+          const opName = sub.join("/");
+          const method = req.method.toLowerCase();
+          return await serialize(async () => {
+            const ledger = ledgerFor(ws);
+            await mountWorkspace(eng, ws, ledger);
+            const spec = openapiFor(ws);
+            const resolved = resolveGatewayOperation(spec, opName, method);
+            if (resolved.ambiguous) return sendJson(res, { ok: false, error: "ambiguous operation", candidates: resolved.ambiguous }, 409);
+            const x = resolved.op && resolved.op["x-nomos"];
+            if (!x) {
+              if (RECOGNIZED_UNSUPPORTED.has(opName)) {
+                return sendJson(res, {
+                  ok: false,
+                  unsupported: true,
+                  route: opName,
+                  error: `'${opName}' is a recognized Nomos Cloud route that 'githolon cloud dev' (single-node local) does not serve \u2014 ${UNSUPPORTED_WHY[opName] || "a multi-node / Cloudflare-infra concern"}. This is NOT an app bug; if you need it locally, ask the Nomos devs.`
+                }, 501);
+              }
+              return sendJson(res, { ok: false, error: "unknown operation", see: `GET /v2/workspaces/${ws}` }, 404);
+            }
+            const principal = principalOf(req);
+            const authToken = authTokenOf(req);
+            if (x.kind === "offer" && method === "post") {
+              const body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+              if (body.intentRef && typeof body.intentRef === "object") {
+                const resolved2 = await resolveStagedIntent(stageBucket, body.intentRef);
+                if (!resolved2.ok) return sendJson(res, { ok: false, refused: true, error: resolved2.error }, resolved2.status);
+                body.intentBytes = resolved2.intentB64;
+              }
+              try {
+                let out;
+                if (typeof body.intentBytes === "string" && body.intentBytes) {
+                  out = offerAdmit(eng, ws, unb64(body.intentBytes), {});
+                  if (out.ok) await commitAndPush(eng, ws, ledger);
+                } else {
+                  const { actor, authorSecret, attestations, ...payload } = body;
+                  const effectiveActor = actor || principal || "";
+                  const lawHash = (currentLaw(eng, ws) || {})[x.domain] || "";
+                  out = await authorOn(eng, ws, ledger, x.domain, x.directiveId, payload, lawHash, {
+                    actor: effectiveActor,
+                    ...effectiveActor ? { principalVerified: true } : {},
+                    ...authToken ? { authToken } : {},
+                    ...authorSecret ? { authorSecret } : {},
+                    ...Array.isArray(attestations) ? { attestations } : {}
+                  });
+                }
+                if (!out.ok) return sendJson(res, { ok: false, refused: true, error: String(out.error).slice(0, 600) }, 422);
+                const born = out.born ? await persistBorn(out.born) : void 0;
+                sendJson(res, { ok: true, ws, head: out.head, ...born ? { born } : {}, ...out.birthOutcomes ? { birthOutcomes: out.birthOutcomes } : {} });
+              } catch (e) {
+                sendJson(res, { ok: false, refused: true, error: errMsg(e).slice(0, 600) }, 422);
+              }
+              return;
+            }
+            if (method === "get") {
+              const group = url.searchParams.get("group") || "";
+              try {
+                if (x.kind === "query") {
+                  const params = {};
+                  for (const k of x.key || []) {
+                    const v = url.searchParams.get(k);
+                    if (v != null) params[k] = v;
+                  }
+                  const rows = query(eng, ws, x.queryId, JSON.stringify(params), principal);
+                  return sendJson(res, { ok: true, ws, rows });
+                }
+                if (x.kind === "count") return sendJson(res, { ok: true, ws, ...count(eng, ws, x.countId, group, principal) });
+                if (x.kind === "sum") return sendJson(res, { ok: true, ws, ...sum(eng, ws, x.sumId, group, principal) });
+                if (x.kind === "extremum") return sendJson(res, { ok: true, ws, ...extremum(eng, ws, x.extremumId, x.extremumKind || url.searchParams.get("kind") || "", group, principal) });
+                if (x.kind === "spatial") return sendJson(res, { ok: true, ws, ...spatialWithin(eng, ws, x.spatialId, url.searchParams.get("bbox") || {}, principal) });
+                if (x.kind === "pendingConflicts") return sendJson(res, { ok: true, ws, rows: pendingConflicts(eng, ws, principal) });
+              } catch (e) {
+                return sendJson(res, { ok: false, error: errMsg(e).slice(0, 600) }, 403);
+              }
+            }
+            sendJson(res, { ok: false, error: "unroutable operation" }, 404);
+          });
+        }
+      }
+      sendJson(res, { ok: false, error: "not found", path: url.pathname }, 404);
+    } catch (e) {
+      sendJson(res, { ok: false, error: errMsg(e).slice(0, 600) }, 500);
+    }
+  });
+  async function gitBackend(req, res, repoPathInfo, ws) {
+    const body = await readBody(req);
+    let sessionPush = false;
+    if (ws && req.method === "POST" && /git-receive-pack/.test(repoPathInfo)) {
+      try {
+        const cmds = receivePackCommands(body);
+        if (cmds.some((c) => c.ref === "refs/heads/main")) {
+          res.writeHead(403, { "content-type": "text/plain", ...CORS });
+          res.end("refs/heads/main is not writable \u2014 there is no push-to-create; a workspace is born by its PARENT (birthHome/birthChild/your .births() directive) and synced. Push work to refs/heads/session/<client-id>.");
+          return;
+        }
+        sessionPush = cmds.some((c) => c.ref.startsWith("refs/heads/session/"));
+      } catch {
+      }
+    }
+    const out = await runGitHttpBackend(custody.root, {
+      method: req.method ?? "",
+      pathInfo: "/" + repoPathInfo,
+      query: new URL(req.url ?? "", origin).search.replace(/^\?/, ""),
+      contentType: req.headers["content-type"],
+      body
+    });
+    res.writeHead(out.status, { ...out.headers, ...CORS });
+    res.end(out.body);
+    if (sessionPush && ws) scheduleAdmit(ws);
+  }
+  const admitTimers = /* @__PURE__ */ new Map();
+  function scheduleAdmit(ws) {
+    const existing = admitTimers.get(ws);
+    if (existing) clearTimeout(existing);
+    admitTimers.set(ws, setTimeout(() => {
+      admitTimers.delete(ws);
+      serialize(async () => {
+        try {
+          const ledger = ledgerFor(ws);
+          await mountWorkspace(eng, ws, ledger);
+          const out = await admitAll(eng, ws, ledger, {});
+          if (Array.isArray(out.born) && out.born.length) await persistBorn(packBornChildren(eng, out.born));
+        } catch (e) {
+          console.error(`[dev-cloud] admit ${ws} failed:`, errMsg(e));
+        }
+      });
+    }, 350));
+  }
+  server.on("upgrade", (req, socket) => {
+    const key = req.headers["sec-websocket-key"];
+    if (!key) return socket.destroy();
+    const accept = createHash2("sha1").update(key + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11").digest("base64");
+    socket.write(
+      `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${accept}\r
+\r
+`
+    );
+    socket.on("data", () => {
+    });
+    socket.on("error", () => {
+    });
+  });
+  if (!globalThis.__nomosDevGuards) {
+    globalThis.__nomosDevGuards = true;
+    process.on("unhandledRejection", (e) => {
+      console.error("[dev-cloud] unhandledRejection (kept alive):", errStack(e).slice(0, 500));
+    });
+    process.on("uncaughtException", (e) => {
+      console.error("[dev-cloud] uncaughtException (kept alive):", errStack(e).slice(0, 500));
+    });
+  }
+  await new Promise((resolve) => server.listen(port, host, () => resolve()));
+  devSelf = {
+    server,
+    origin,
+    dataDir,
+    kernelSha,
+    eng,
+    custody,
+    ledgerFor,
+    serialize,
+    persistBorn,
+    // `--platform` requested ⇒ NOT ready until the boot-time ceremony completes (main flips it true).
+    ...opts.platform ? { platformReady: false } : {},
+    close: () => new Promise((resolve) => server.close(() => resolve()))
+  };
+  return devSelf;
+}
+function parseArgs(argv) {
+  const o = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--ephemeral") o.ephemeral = true;
+    else if (a === "--port") o.port = parseInt(argv[++i], 10);
+    else if (a === "--data") o.data = argv[++i];
+    else if (a === "--firebase-project") o.firebaseProject = argv[++i];
+    else if (a === "--platform") o.platform = argv[++i];
+    else if (a === "--deploy") o.deploy = argv[++i];
+    else if (a === "--auth-provider") o.authProvider = argv[++i];
+    else if (a === "--bootstrap") o.bootstrap = true;
+    else if (a === "--attested") o.attested = true;
+    else if (a === "--kernel-source") o.kernelSource = argv[++i];
+  }
+  return o;
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const opts = parseArgs(process.argv.slice(2));
+  const dev = await startDevCloud(opts);
+  console.log(`[dev-cloud] Nomos dev cloud listening on ${dev.origin}`);
+  console.log(`[dev-cloud]   data dir : ${dev.dataDir}`);
+  console.log(`[dev-cloud]   kernel   : ${dev.kernelSha.slice(0, 16)}\u2026`);
+  {
+    const stamp = capabilitiesForKernelHash(dev.kernelSha);
+    if (stamp.known) {
+      console.log(`[dev-cloud]   caps     : ${stamp.version} \u2014 [${stamp.features.join(", ")}]`);
+      if (/STALE/.test(stamp.note || "")) {
+        console.log(`[dev-cloud]   \u26A0 STALE KERNEL: ${stamp.note}. Law using compound-key queries will be REFUSED here.`);
+        console.log(`[dev-cloud]     Update the dev kernel (holon-testmint.wasm) to a build coherent with your compiler/release.`);
+      }
+    } else {
+      console.log(`[dev-cloud]   \u26A0 caps  : kernel ${dev.kernelSha.slice(0, 8)} is UNKNOWN to the capability registry \u2014 coherence cannot be verified.`);
+    }
+    console.log(`[dev-cloud]   coherence: GET ${dev.origin}/v1/runtime/capabilities`);
+  }
+  console.log(`[dev-cloud]   point your Flutter app's cloud: base URL at ${dev.origin}`);
+  if (opts.bootstrap || opts.platform) {
+    const { bootstrapPlatform: bootstrapPlatform2 } = await Promise.resolve().then(() => (init_bootstrap(), bootstrap_exports));
+    try {
+      await bootstrapPlatform2(dev, opts);
+      dev.platformReady = true;
+    } catch (e) {
+      console.error("[dev-cloud] bootstrap FAILED:", errMsg(e));
+      await dev.close().catch(() => {
+      });
+      process.exit(1);
+    }
+  }
+  process.on("SIGINT", async () => {
+    await dev.close();
+    process.exit(0);
+  });
+}
+export {
+  startDevCloud
+};