githolon 0.98.1 → 0.98.3

package/dist/cli.mjs

@@ -2527,6 +2527,11 @@ async function boot(eng, ws, ledger) {
 }
 async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
   const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
+  if (result.ok === false) {
+    throw new Error(
+      `deploy-refused: installing ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+    );
+  }
   const installation = qById(eng, ws, `domain-installation:${domainHash}`);
   const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
   if (keys.length > 0) {

package/dist/dev-server.mjs

@@ -1377,6 +1377,11 @@ async function boot(eng, ws, ledger) {
 }
 async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
   const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...opts.authToken ? { authToken: opts.authToken } : {} });
+  if (result.ok === false) {
+    throw new Error(
+      `deploy-refused: installing ${domainHash.slice(0, 12)}\u2026 was REFUSED by the one gate (custody unchanged): ${result.error ?? "unknown refusal"}`
+    );
+  }
   const installation = qById(eng, ws, `domain-installation:${domainHash}`);
   const keys = installation[0]?.data?.domainKeys ?? installation[0]?.domainKeys ?? [];
   if (keys.length > 0) {
@@ -1807,8 +1812,9 @@ var HDR = Object.freeze({
 function bulkReadForbidden(ws, kind, verdict) {
   const v = verdict || {};
   const caps = v.requiredRelationAnyOf || v.caps || [];
-  const premise = v.tokenError ? `token-verification-failed:${v.tokenError}` : v.resolvedPrincipal ? "principal-lacks-workspace-read-cap" : "no-principal-presented";
-  const why = v.tokenError ? `the presented ${HDR.AUTH} token did NOT verify (${v.tokenError}) against the workspace's declared issuer ${v.issuer || "?"}${v.audience ? ` / audience ${v.audience}` : ""}.` : v.resolvedPrincipal ? `resolved principal '${v.resolvedPrincipal}'${v.principalVerified ? " (token-verified)" : ` (unverified bare ${HDR.PRINCIPAL} claim)`} holds none of the required read capabilities.` : `no principal was presented \u2014 send a verified ${HDR.AUTH} token for a principal the owner granted a read capability.`;
+  const schemaUnresolvable = v.schemaResolved === false;
+  const premise = v.tokenError ? `token-verification-failed:${v.tokenError}` : schemaUnresolvable ? "relation-schema-unresolvable" : v.resolvedPrincipal ? "principal-lacks-workspace-read-cap" : "no-principal-presented";
+  const why = v.tokenError ? `the presented ${HDR.AUTH} token did NOT verify (${v.tokenError}) against the workspace's declared issuer ${v.issuer || "?"}${v.audience ? ` / audience ${v.audience}` : ""}.` : schemaUnresolvable ? `the workspace's relation SCHEMA did not resolve \u2014 no principal can hold any read capability until the law's relation declarations merge cleanly (check for a cross-domain (type, relation) rewrite conflict on the shared 'workspace' type).` : v.resolvedPrincipal ? `resolved principal '${v.resolvedPrincipal}'${v.principalVerified ? " (token-verified)" : ` (unverified bare ${HDR.PRINCIPAL} claim)`} holds none of the required read capabilities.` : `no principal was presented \u2014 send a verified ${HDR.AUTH} token for a principal the owner granted a read capability.`;
   return {
     ok: false,
     ws,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.98.1",
+  "version": "0.98.3",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.98.1",
-    "@githolon/dsl": "^0.98.1",
+    "@githolon/client": "^0.98.3",
+    "@githolon/dsl": "^0.98.3",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {