@agoric/swingset-liveslots 0.10.3-other-dev-1f26562.0 → 0.10.3-other-dev-3eb1a1d.0

package/src/message.js

@@ -1,9 +1,9 @@
-import { assert, Fail } from '@agoric/assert';
+import { assert, Fail } from '@endo/errors';
 import { insistCapData } from './capdata.js';
 
 /**
  * @typedef {{
- * methargs: import('./types').SwingSetCapData, // of [method, args]
+ * methargs: import('./types.js').SwingSetCapData, // of [method, args]
  * result: string | undefined | null,
  * }} Message
  */
@@ -32,7 +32,7 @@ export function insistMessage(message) {
 
 /**
  * @param {unknown} vdo
- * @returns {asserts vdo is VatDeliveryObject}
+ * @returns {asserts vdo is import('./types').VatDeliveryObject}
  */
 
 export function insistVatDeliveryObject(vdo) {
@@ -114,7 +114,7 @@ export function insistVatDeliveryResult(vdr) {
 
 /**
  * @param {unknown} vso
- * @returns {asserts vso is VatSyscallObject}
+ * @returns {asserts vso is import('./types').VatSyscallObject}
  */
 
 export function insistVatSyscallObject(vso) {
@@ -194,7 +194,7 @@ export function insistVatSyscallObject(vso) {
 
 /**
  * @param {unknown} vsr
- * @returns {asserts vsr is VatSyscallResult}
+ * @returns {asserts vsr is import('./types').VatSyscallResult}
  */
 
 export function insistVatSyscallResult(vsr) {

package/src/parseVatSlots.js

@@ -1,5 +1,5 @@
 import { Nat } from '@endo/nat';
-import { assert, Fail } from '@agoric/assert';
+import { assert, Fail } from '@endo/errors';
 
 // NOTE: confusing terminology: "slot" vs. "reference".  All these things
 // called "slots" are references, but the word "slot" suggests something into

package/src/types-index.d.ts

@@ -0,0 +1,4 @@
+// Export all the types this package provides
+// eslint-disable-next-line import/export
+export type * from './types.js';
+export type * from './vatDataTypes.js';

package/src/types-index.js

@@ -0,0 +1,2 @@
+// Empty JS file to correspond with its .d.ts twin
+export {};

package/src/types.js

@@ -1,3 +1,6 @@
+// Ensure this is a module.
+export {};
+
 /**
  * @callback makeLiveSlots
  */
@@ -79,5 +82,8 @@
  *
  */
 
-// Ensure this is a module.
-export {};
+/**
+ * @template V fulfilled value
+ * @template {any[]} [A=unknown[]] arguments
+ * @typedef { {onFulfilled?: (value: V, ...args: A) => void, onRejected?: (reason: unknown, ...args: A) => void} } PromiseWatcher
+ */

package/src/vatstore-iterators.js

@@ -18,6 +18,7 @@ export function* enumerateKeysStartEnd(syscall, start, end, checkF) {
     dbKey = syscall.vatstoreGetNextKey(dbKey);
   }
 }
+harden(enumerateKeysStartEnd);
 
 // return an iterator of all existing keys that start with 'prefix'
 // (excluding the prefix itself)
@@ -32,6 +33,7 @@ export function* enumerateKeysWithPrefix(syscall, prefix) {
     yield key;
   }
 }
+harden(enumerateKeysWithPrefix);
 
 export function prefixedKeysExist(syscall, prefix) {
   const nextKey = syscall.vatstoreGetNextKey(prefix);

package/src/virtualObjectManager.js

@@ -1,7 +1,8 @@
 /* global globalThis */
-/* eslint-disable no-use-before-define, jsdoc/require-returns-type */
+/* eslint-disable jsdoc/require-returns-type */
 
-import { assert, Fail } from '@agoric/assert';
+import { environmentOptionsListHas } from '@endo/env-options';
+import { assert, Fail, q, b } from '@endo/errors';
 import { assertPattern, mustMatch } from '@agoric/store';
 import { defendPrototype, defendPrototypeKit } from '@endo/exo/tools.js';
 import { Far, passStyleOf } from '@endo/marshal';
@@ -14,17 +15,22 @@ import {
   checkAndUpdateFacetiousness,
 } from './facetiousness.js';
 
-/** @template T @typedef {import('@agoric/vat-data').DefineKindOptions<T>} DefineKindOptions */
+/**
+ * @import {DurableKindHandle} from '@agoric/swingset-liveslots'
+ * @import {DefineKindOptions} from '@agoric/swingset-liveslots'
+ * @import {ClassContextProvider, KitContextProvider} from '@endo/exo'
+ * @import {ToCapData, FromCapData} from '@endo/marshal';
+ */
 
-const { hasOwn, defineProperty, getOwnPropertyNames } = Object;
+const {
+  hasOwn,
+  defineProperty,
+  getOwnPropertyNames,
+  values,
+  entries,
+  fromEntries,
+} = Object;
 const { ownKeys } = Reflect;
-const { quote: q } = assert;
-
-// import { kdebug } from './kdebug.js';
-
-// TODO Use environment-options.js currently in ses/src after factoring it out
-// to a new package.
-const env = (globalThis.process || {}).env || {};
 
 // Turn on to give each exo instance its own toStringTag value which exposes
 // the SwingSet vref.
@@ -33,9 +39,7 @@ const env = (globalThis.process || {}).env || {};
 // confidential object-creation activity, so this must not be something
 // that unprivileged vat code (including unprivileged contracts) can do
 // for themselves.
-const LABEL_INSTANCES = (env.DEBUG || '')
-  .split(':')
-  .includes('label-instances');
+const LABEL_INSTANCES = environmentOptionsListHas('DEBUG', 'label-instances');
 
 // This file implements the "Virtual Objects" system, currently documented in
 // {@link https://github.com/Agoric/agoric-sdk/blob/master/packages/SwingSet/docs/virtual-objects.md})
@@ -132,40 +136,6 @@ const makeContextCache = (makeState, makeContext) => {
   return makeCache(readBacking, writeBacking, deleteBacking);
 };
 
-/**
- * @typedef {import('@endo/exo/src/exo-tools.js').ContextProvider } ContextProvider
- */
-
-/**
- * @param {*} contextCache
- * @param {*} getSlotForVal
- * @returns {ContextProvider}
- */
-const makeContextProvider = (contextCache, getSlotForVal) => {
-  return harden(rep => contextCache.get(getSlotForVal(rep)));
-};
-
-const makeContextProviderKit = (contextCache, getSlotForVal, facetNames) => {
-  /** @type { Record<string, any> } */
-  const contextProviderKit = {};
-  for (const [index, name] of facetNames.entries()) {
-    contextProviderKit[name] = rep => {
-      const vref = getSlotForVal(rep);
-      const { baseRef, facet } = parseVatSlot(vref);
-
-      // Without this check, an attacker (with access to both cohort1.facetA
-      // and cohort2.facetB) could effectively forge access to cohort1.facetB
-      // and cohort2.facetA. They could not forge the identity of those two
-      // objects, but they could invoke all their equivalent methods, by using
-      // e.g. cohort1.facetA.foo.apply(cohort2.facetB, [...args])
-      Number(facet) === index || Fail`illegal cross-facet access`;
-
-      return harden(contextCache.get(baseRef));
-    };
-  }
-  return harden(contextProviderKit);
-};
-
 // The management of single Representatives (i.e. defineKind) is very similar
 // to that of a cohort of facets (i.e. defineKindMulti). In this description,
 // we use "self/facets" to refer to either 'self' or 'facets', as appropriate
@@ -260,15 +230,15 @@ const makeFacets = (
 };
 
 const insistDurableCapdata = (vrm, what, capdata, valueFor) => {
-  capdata.slots.forEach((vref, idx) => {
+  for (const [idx, vref] of entries(capdata.slots)) {
     if (!vrm.isDurable(vref)) {
       if (valueFor) {
-        Fail`value for ${what} is not durable: slot ${q(idx)} of ${capdata}`;
+        Fail`value for ${what} is not durable: slot ${b(idx)} of ${capdata}`;
       } else {
-        Fail`${what} is not durable: slot ${q(idx)} of ${capdata}`;
+        Fail`${what} is not durable: slot ${b(idx)} of ${capdata}`;
       }
     }
-  });
+  }
 };
 
 const insistSameCapData = (oldCD, newCD) => {
@@ -281,11 +251,11 @@ const insistSameCapData = (oldCD, newCD) => {
   if (oldCD.slots.length !== newCD.slots.length) {
     Fail`durable Kind stateShape mismatch (slots.length)`;
   }
-  oldCD.slots.forEach((oldVref, idx) => {
+  for (const [idx, oldVref] of entries(oldCD.slots)) {
     if (newCD.slots[idx] !== oldVref) {
       Fail`durable Kind stateShape mismatch (slot[${idx}])`;
     }
-  });
+  }
 };
 
 /**
@@ -302,11 +272,11 @@ const insistSameCapData = (oldCD, newCD) => {
  * @param {(slot: string) => object} requiredValForSlot
  * @param {*} registerValue  Function to register a new slot+value in liveSlot's
  *   various tables
- * @param {import('@endo/marshal').ToCapData<string>} serialize  Serializer for this vat
- * @param {import('@endo/marshal').FromCapData<string>} unserialize  Unserializer for this vat
+ * @param {ToCapData<string>} serialize  Serializer for this vat
+ * @param {FromCapData<string>} unserialize  Unserializer for this vat
  * @param {*} assertAcceptableSyscallCapdataSize  Function to check for oversized
  *   syscall params
- * @param {import('./types').LiveSlotsOptions} [liveSlotsOptions]
+ * @param {import('./types.js').LiveSlotsOptions} [liveSlotsOptions]
  * @param {{ WeakMap: typeof WeakMap, WeakSet: typeof WeakSet }} [powers]
  * Specifying the underlying WeakMap/WeakSet objects to wrap with
  * VirtualObjectAwareWeakMap/Set.  By default, capture the ones currently
@@ -314,7 +284,7 @@ const insistSameCapData = (oldCD, newCD) => {
  * recursion if our returned WeakMap/WeakSet wrappers are subsequently installed
  * on globalThis.
  *
- * @returns {object} a new virtual object manager.
+ * @returns a new virtual object manager.
  *
  * The virtual object manager allows the creation of persistent objects that do
  * not need to occupy memory when they are not in use.  It provides five
@@ -707,10 +677,18 @@ export const makeVirtualObjectManager = (
     durableKindDescriptor = undefined, // only for durables
   ) => {
     const {
-      finish,
+      finish = undefined,
       stateShape = undefined,
+      receiveAmplifier = undefined,
+      receiveInstanceTester = undefined,
       thisfulMethods = false,
+    } = options;
+    let {
+      // These are "let" rather than "const" only to accommodate code
+      // below that tolerates an old version of the vat-data package.
+      // See there for more explanation.
       interfaceGuard = undefined,
+      interfaceGuardKit = undefined,
     } = options;
 
     const statePrototype = {}; // Not frozen yet
@@ -731,11 +709,35 @@ export const makeVirtualObjectManager = (
     switch (assessFacetiousness(behavior)) {
       case 'one': {
         assert(!multifaceted);
+        interfaceGuardKit === undefined ||
+          Fail`Use an interfaceGuard, not interfaceGuardKit, to protect class ${q(
+            tag,
+          )}`;
         proposedFacetNames = undefined;
         break;
       }
       case 'many': {
         assert(multifaceted);
+
+        if (interfaceGuard && interfaceGuardKit === undefined) {
+          // This if clause is for the purpose of tolerating versions
+          // of the vata-data package that precede
+          // https://github.com/Agoric/agoric-sdk/pull/8220 .
+          // Before that PR, the options name `interfaceGuard` would
+          // actually carry the InterfaceGuardKit.
+          //
+          // Tolerating the old vat-data with the new types.
+          // @ts-expect-error
+          interfaceGuardKit = interfaceGuard;
+          interfaceGuard = undefined;
+          // The rest of the code from here makes no further compromise
+          // for that old version of the vat-data package.
+        }
+
+        interfaceGuard === undefined ||
+          Fail`Use an interfaceGuardKit, not an interfaceGuard, to protect class kit ${q(
+            tag,
+          )}`;
         proposedFacetNames = ownKeys(behavior).sort();
         break;
       }
@@ -763,6 +765,11 @@ export const makeVirtualObjectManager = (
       Fail`A stateShape must be a copyRecord: ${q(stateShape)}`;
     assertPattern(stateShape);
 
+    if (!multifaceted) {
+      receiveAmplifier === undefined ||
+        Fail`Only facets of an exo class kit can be amplified, not ${q(tag)}`;
+    }
+
     let facetNames;
 
     if (isDurable) {
@@ -850,7 +857,9 @@ export const makeVirtualObjectManager = (
       return harden({
         get() {
           const baseRef = getBaseRef(this);
-          const { valueMap, capdatas } = dataCache.get(baseRef);
+          const record = dataCache.get(baseRef);
+          assert(record !== undefined);
+          const { valueMap, capdatas } = record;
           if (!valueMap.has(prop)) {
             const value = harden(unserialize(capdatas[prop]));
             checkStatePropertyValue(value, prop);
@@ -867,6 +876,7 @@ export const makeVirtualObjectManager = (
             insistDurableCapdata(vrm, prop, capdata, true);
           }
           const record = dataCache.get(baseRef); // mutable
+          assert(record !== undefined);
           const oldSlots = record.capdatas[prop].slots;
           const newSlots = capdata.slots;
           vrm.updateReferenceCounts(oldSlots, newSlots);
@@ -890,7 +900,9 @@ export const makeVirtualObjectManager = (
     const makeState = baseRef => {
       const state = { __proto__: statePrototype };
       if (stateShape === undefined) {
-        for (const prop of ownKeys(dataCache.get(baseRef).capdatas)) {
+        const record = dataCache.get(baseRef);
+        assert(record !== undefined);
+        for (const prop of ownKeys(record.capdatas)) {
           assert(typeof prop === 'string');
           checkStateProperty(prop);
           defineProperty(state, prop, makeFieldDescriptor(prop));
@@ -940,18 +952,57 @@ export const makeVirtualObjectManager = (
     // and into method-invocation time (which is not).
 
     let proto;
+    /** @type {ClassContextProvider | undefined} */
+    let contextProviderVar;
+    /** @type { Record<string, KitContextProvider> | undefined } */
+    let contextProviderKitVar;
+
     if (multifaceted) {
+      contextProviderKitVar = fromEntries(
+        facetNames.map((name, index) => [
+          name,
+          rep => {
+            const vref = getSlotForVal(rep);
+            if (vref === undefined) {
+              return undefined;
+            }
+            const { baseRef, facet } = parseVatSlot(vref);
+
+            // Without this check, an attacker (with access to both
+            // cohort1.facetA and cohort2.facetB)
+            // could effectively forge access to
+            // cohort1.facetB and cohort2.facetA.
+            // They could not forge the identity of those two
+            // objects, but they could invoke all their equivalent methods,
+            // by using e.g.
+            // cohort1.facetA.foo.apply(cohort2.facetB, [...args])
+            if (Number(facet) !== index) {
+              return undefined;
+            }
+
+            return harden(contextCache.get(baseRef));
+          },
+        ]),
+      );
+
       proto = defendPrototypeKit(
         tag,
-        makeContextProviderKit(contextCache, getSlotForVal, facetNames),
+        harden(contextProviderKitVar),
         behavior,
         thisfulMethods,
-        interfaceGuard,
+        interfaceGuardKit,
       );
     } else {
+      contextProviderVar = rep => {
+        const slot = getSlotForVal(rep);
+        if (slot === undefined) {
+          return undefined;
+        }
+        return harden(contextCache.get(slot));
+      };
       proto = defendPrototype(
         tag,
-        makeContextProvider(contextCache, getSlotForVal),
+        harden(contextProviderVar),
         behavior,
         thisfulMethods,
         interfaceGuard,
@@ -959,6 +1010,10 @@ export const makeVirtualObjectManager = (
     }
     harden(proto);
 
+    // All this to let typescript know that it won't vary during a closure
+    const contextProvider = contextProviderVar;
+    const contextProviderKit = contextProviderKitVar;
+
     // this builds new Representatives, both when creating a new instance and
     // for reanimating an existing one when the old rep gets GCed
 
@@ -973,10 +1028,11 @@ export const makeVirtualObjectManager = (
     const deleteStoredVO = baseRef => {
       let doMoreGC = false;
       const record = dataCache.get(baseRef);
+      assert(record !== undefined);
       for (const valueCD of Object.values(record.capdatas)) {
-        valueCD.slots.forEach(vref => {
+        for (const vref of valueCD.slots) {
           doMoreGC = vrm.removeReachableVref(vref) || doMoreGC;
-        });
+        }
       }
       dataCache.delete(baseRef);
       return doMoreGC;
@@ -1015,6 +1071,7 @@ export const makeVirtualObjectManager = (
         if (isDurable) {
           insistDurableCapdata(vrm, prop, valueCD, true);
         }
+        // eslint-disable-next-line github/array-foreach
         valueCD.slots.forEach(vrm.addReachableVref);
         capdatas[prop] = valueCD;
         valueMap.set(prop, value);
@@ -1030,10 +1087,63 @@ export const makeVirtualObjectManager = (
         val = makeRepresentative(proto, baseRef);
       }
       registerValue(baseRef, val, multifaceted);
-      finish?.(contextCache.get(baseRef));
+      finish && finish(contextCache.get(baseRef));
       return val;
     };
 
+    if (receiveAmplifier) {
+      assert(contextProviderKit);
+
+      // Amplify a facet to a cohort
+      const amplify = exoFacet => {
+        for (const cp of values(contextProviderKit)) {
+          const context = cp(exoFacet);
+          if (context !== undefined) {
+            return context.facets;
+          }
+        }
+        throw Fail`Must be a facet of ${q(tag)}: ${exoFacet}`;
+      };
+      harden(amplify);
+      receiveAmplifier(amplify);
+    }
+
+    if (receiveInstanceTester) {
+      if (multifaceted) {
+        assert(contextProviderKit);
+
+        const isInstance = (exoFacet, facetName = undefined) => {
+          if (facetName === undefined) {
+            // Is exoFacet and instance of any facet of this class kit?
+            return values(contextProviderKit).some(
+              cp => cp(exoFacet) !== undefined,
+            );
+          }
+          // Is this exoFacet an instance of this specific facet column
+          // of this class kit?
+          assert.typeof(facetName, 'string');
+          const cp = contextProviderKit[facetName];
+          cp !== undefined ||
+            Fail`exo class kit ${q(tag)} has no facet named ${q(facetName)}`;
+          return cp(exoFacet) !== undefined;
+        };
+        harden(isInstance);
+        receiveInstanceTester(isInstance);
+      } else {
+        assert(contextProvider);
+        // Is this exo an instance of this class?
+        const isInstance = (exo, facetName = undefined) => {
+          facetName === undefined ||
+            Fail`facetName can only be used with an exo class kit: ${q(
+              tag,
+            )} has no facet ${q(facetName)}`;
+          return contextProvider(exo) !== undefined;
+        };
+        harden(isInstance);
+        receiveInstanceTester(isInstance);
+      }
+    }
+
     return makeNewInstance;
   };
 
@@ -1082,6 +1192,7 @@ export const makeVirtualObjectManager = (
     return id;
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineKind']} */
   const defineKind = (tag, init, behavior, options) => {
     const kindID = `${allocateExportID()}`;
     saveVirtualKindDescriptor(kindID, { kindID, tag });
@@ -1097,6 +1208,7 @@ export const makeVirtualObjectManager = (
     );
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineKindMulti']} */
   const defineKindMulti = (tag, init, behavior, options) => {
     const kindID = `${allocateExportID()}`;
     saveVirtualKindDescriptor(kindID, { kindID, tag });
@@ -1115,7 +1227,7 @@ export const makeVirtualObjectManager = (
   /**
    *
    * @param {string} tag
-   * @returns {import('@agoric/vat-data').DurableKindHandle}
+   * @returns {DurableKindHandle}
    */
   const makeKindHandle = tag => {
     assert(kindIDID, 'initializeKindHandleKind not called yet');
@@ -1126,9 +1238,9 @@ export const makeVirtualObjectManager = (
     nextInstanceIDs.set(kindID, nextInstanceID);
     saveDurableKindDescriptor(durableKindDescriptor);
     saveNextInstanceID(kindID);
-    /** @type {import('@agoric/vat-data').DurableKindHandle} */
-    // eslint-disable-next-line @typescript-eslint/prefer-ts-expect-error -- https://github.com/Agoric/agoric-sdk/issues/4620
-    // @ts-ignore cast
+    /** @type {DurableKindHandle} */
+
+    // @ts-expect-error cast
     const kindHandle = Far('kind', {});
     kindHandleToID.set(kindHandle, kindID);
     const kindIDvref = makeBaseRef(kindIDID, kindID, true);
@@ -1136,6 +1248,7 @@ export const makeVirtualObjectManager = (
     return kindHandle;
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineDurableKind']} */
   const defineDurableKind = (kindHandle, init, behavior, options) => {
     kindHandleToID.has(kindHandle) || Fail`unknown handle ${kindHandle}`;
     const kindID = kindHandleToID.get(kindHandle);
@@ -1158,6 +1271,7 @@ export const makeVirtualObjectManager = (
     return maker;
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineDurableKindMulti']} */
   const defineDurableKindMulti = (kindHandle, init, behavior, options) => {
     kindHandleToID.has(kindHandle) || Fail`unknown handle ${kindHandle}`;
     const kindID = kindHandleToID.get(kindHandle);