@adapt-toolkit/mufl 0.10.9 → 0.10.10

package/mufl_stdlib/config.mufl

@@ -6,6 +6,7 @@ config script {
                 $current_transaction_info->#"current_transaction_info.mm",
                 $identity_proof_document->#"identity_proof_document.mm",
                 $lists->#"lists.mm",
+                $limits->#"limits.mm",
                 $vector->#"vector.mm",
                 $platform_type_id->#"platform_type_id.mm",
                 $transaction_message_decoder->#"transaction_message_decoder.mm",
@@ -51,6 +52,7 @@ config script {
                 $current_transaction_info->#"current_transaction_info.mm",
                 $identity_proof_document->#"identity_proof_document.mm",
                 $lists->#"lists.mm",
+                $limits->#"limits.mm",
                 $vector->#"vector.mm",
                 $platform_type_id->#"platform_type_id.mm",
                 $transaction_message_decoder->#"transaction_message_decoder.mm",

package/mufl_stdlib/limits.mm

@@ -0,0 +1,67 @@
+// Governance wrapper for the per-packet limits primitive.
+//
+// The engine exposes a single dangerous primitive, _set_limits, which mutates the packet's
+// committed limits. It is DANGEROUS, so a packet's code must grab() it to use it. Authorization for
+// a limit change -- who may change limits, and under what conditions -- is entirely the packet
+// developer's policy: this library provides only the MECHANISM (the raw application path), and the
+// engine enforces the hard FLOOR (a change can never exceed the global ceilings). The wrapper does
+// NOT impose or imply any particular authorization model (no built-in signature requirement); the
+// developer composes whatever check their policy needs -- signed request, owner identity, multi-sig,
+// ... -- around set_limits before applying a change. It follows the same inject-a-grabbed-primitive
+// pattern as key_storage (the app grabs _set_limits and calls limits::init to bind it here).
+//
+// The engine primitive validates the {name -> count} dictionary shape, the canonical dimension
+// names, and the [1, ceiling] ranges.
+//
+// Named tiers (for reference; resolved by the ENGINE, not this library): a transaction's source-level
+// limits(...) clause also accepts three vetted bundles by name -- $limits::small, $limits::standard,
+// $limits::heavy -- expanded at compile time by the clause. The engine's resolver is authoritative;
+// the bundles are:
+//   $limits::small    = { fuel_ops -> 10000,  call_depth -> 64,   constructed_elems -> 4000   }
+//   $limits::standard = { fuel_ops -> 100000, call_depth -> 256,  constructed_elems -> 40000  }
+//   $limits::heavy    = { fuel_ops -> 500000, call_depth -> 1024, constructed_elems -> 200000 }
+// They bound the compute dimensions only; structural dimensions stay at the enclosing effective, and
+// explicit entries after a tier override it pairwise. A conformance unit test pins the engine's
+// value table red-on-drift; if a ratified change lands there, update this doc block to match.
+library limits {
+
+    hidden {
+        // Placeholder for the injected primitive. If a packet calls a limits function without first
+        // grabbing _set_limits and injecting it via init, this aborts loudly rather than silently
+        // doing nothing.
+        _set_limits is (any -> nil) = fn (_: any) -> nil {
+            abort "limits: _set_limits primitive was not grabbed and injected (call limits::init)." when TRUE.
+            return NIL.
+        }
+    }
+
+    // Bind the grabbed _set_limits primitive. Called once from the packet's code:
+    //   set = grab(_set_limits). limits::init ($_set_limits -> set).
+    init = fn (_:($_set_limits -> set: (any -> nil))) {
+        _set_limits -> set.
+    }
+
+    // Apply a {name -> count} limit change. This library provides the MECHANISM only -- authorization
+    // is the packet developer's responsibility: perform whatever check your policy requires (signed
+    // request, owner identity, multi-sig, ...) BEFORE calling this. The engine primitive still
+    // validates the dictionary shape, the canonical dimension names, and the [1, ceiling] ranges, so
+    // a change can never exceed the global ceilings regardless of the caller's policy.
+    set_limits = fn (new_limits: any) -> nil {
+        _set_limits new_limits.
+    }
+
+    // Packet-creation defaults. The SDK passes packet-creation options inside the init argument; by
+    // convention a packet that wants creation-time default limits reads a `limits` block ({name ->
+    // count}, the same shape as set_limits) from its init argument and applies it here, e.g. in the
+    // packet's init transaction:
+    //
+    //   set = grab(_set_limits).
+    //   limits::init ($_set_limits -> set).
+    //   if (init_arg $limits) != NIL {
+    //       limits::set_limits (init_arg $limits).
+    //   }
+    //
+    // This is a REQUEST TO THE PACKET'S CODE, not an engine feature: a packet whose code ignores the
+    // block simply keeps the global defaults. The engine still enforces the [1, ceiling] floor on
+    // whatever is applied.
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adapt-toolkit/mufl",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "description": "The MUFL toolchain: prebuilt `mufl` (REPL) and `mufl-compile` (compiler) engine binaries plus the MUFL stdlib, meta, and transactions trees they need at run time. Linux x64 only; the binaries are proprietary (AEFL) — see LICENSE and NOTICE.",

package/transactions/__t_wrapper.mm

@@ -5,7 +5,10 @@
 
 library __t_wrapper loads libraries transaction, key_storage, transaction_queue, identity_proof_document_types, e2e {
 
-    metadef t_trn: ($name->str, $targ->any).
+    // $__limits (optional): the per-call resource budget carried inside the signed message (see
+    // transaction::unsigned_message). Kept as `any+` here too so a budgeted message decodes; the
+    // engine validates and folds it. Absent = no budget.
+    metadef t_trn: ($name->str, $targ->any, $__limits->any+).
     metadef t_trn_extended: ($trn->t_trn, $is_signed->bool, $is_encrypted->bool, $is_e2e->bool+).
     metadef t_trn_message_info: (
         $decoded_envelope -> transaction::envelope::external::decoded_type || t_trn,

package/transactions/transaction.mm

@@ -13,7 +13,12 @@ library transaction loads libraries key_utils, key_storage, identity_proof_docum
     //     }
     // }
 
-    metadef unsigned_message: ($name -> str, $targ -> any).
+    // $__limits (optional) is the per-call resource budget: a {name -> count} dictionary the engine
+    // folds into this transaction's effective limits (tighten-only). It rides INSIDE the signed
+    // message, so it is authenticated input -- a post-sign edit changes the message value-id and
+    // fails signature verification. Absent means no per-call budget (unchanged behaviour). The engine
+    // validates the dictionary (canonical dimension names, [1, ceiling]); the field type is `any+`.
+    metadef unsigned_message: ($name -> str, $targ -> any, $__limits -> any+).
     metadef signed_message: ($trn -> unsigned_message, $ptsignature -> crypto_signature).
     metadef encrypted_pt_signed_message: ($encrypted_message -> crypto_message, $ptsignature -> crypto_signature).
     metadef encrypted_em_signed_message: ($encrypted_message -> crypto_message, $emsignature -> crypto_signature).
@@ -81,7 +86,7 @@ library transaction loads libraries key_utils, key_storage, identity_proof_docum
         }
 
         hidden {
-            sign = fn (_:($trn -> tn: ($name -> str, $targ -> any))) -> signed_message {
+            sign = fn (_:($trn -> tn: ($name -> str, $targ -> any, $__limits -> any+))) -> signed_message {
                 signature = key_storage::default_sign (_value_id tn |).
                 return ($trn -> tn, $ptsignature -> signature) as signed_message.
             }
@@ -179,7 +184,7 @@ library transaction loads libraries key_utils, key_storage, identity_proof_docum
         return ($result_kind -> results::kind::success, $result -> actions).
     }
 
-    encrypt = fn (_:($cid -> cid: t_container_id, $trn -> tn: ($name -> str, $targ -> any), $isemsignature -> isem: bool)
+    encrypt = fn (_:($cid -> cid: t_container_id, $trn -> tn: ($name -> str, $targ -> any, $__limits -> any+), $isemsignature -> isem: bool)
                ) -> encrypted_signed_message
     {
         encrypted_data = key_storage::default_encrypt tn cid.