@altopelago/aeos-core 0.9.6 → 0.11.0

package/dist/validate.js

@@ -13,6 +13,7 @@ import { checkTypes } from './rules/typeCheck.js';
 import { checkReferenceForms } from './rules/referenceForm.js';
 import { checkNumericForm } from './rules/numericForm.js';
 import { checkStringForm, checkPatterns, matchesPortablePattern } from './rules/stringForm.js';
+import { parseAddress, resolveAddress, } from '@altopelago/sansa';
 const TYPE_ALIASES = {
     NumberLiteral: ['NumberLiteral'],
     StringLiteral: ['StringLiteral'],
@@ -29,6 +30,7 @@ const TYPE_ALIASES = {
     RadixLiteral: ['RadixLiteral'],
     EncodingLiteral: ['EncodingLiteral'],
     SeparatorLiteral: ['SeparatorLiteral'],
+    SansaAddressLiteral: ['SansaAddressLiteral'],
     DateLiteral: ['DateLiteral'],
     TimeLiteral: ['TimeLiteral'],
     DateTimeLiteral: ['DateTimeLiteral'],
@@ -40,6 +42,15 @@ const TYPE_ALIASES = {
 function formatQuotedMemberSegment(key) {
     return `.[${JSON.stringify(String(key))}]`;
 }
+function formatMemberSelector(key) {
+    const value = String(key);
+    return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(value)
+        ? `.${value}`
+        : formatQuotedMemberSegment(value);
+}
+function appendAttributePath(basePath, key) {
+    return `${basePath}.@${formatMemberSelector(key)}`;
+}
 const DEFAULT_RESOURCE_POLICY = {
     max_events: 100_000,
     max_rules: 10_000,
@@ -89,6 +100,7 @@ const STRING_LIKE_VALUE_TYPES = new Set([
     'StringLiteral',
     'TrimtickLiteral',
     'SeparatorLiteral',
+    'SansaAddressLiteral',
     'HexLiteral',
     'EncodingLiteral',
     'NullLiteral',
@@ -109,7 +121,7 @@ function enforceStringLengthResourceBudget(info, path, policy, ctx) {
         emitResourceError(ctx, path, `String-like payload length ${payloadLength} exceeds max_string_length_default ${policy.max_string_length_default}`, info.span);
     }
     for (const [key, attribute] of info.attributes ?? []) {
-        enforceStringLengthResourceBudget(attribute, `${path}@${key}`, policy, ctx);
+        enforceStringLengthResourceBudget(attribute, appendAttributePath(path, key), policy, ctx);
     }
 }
 function inspectSchemaResourceShape(schema, policy, ctx) {
@@ -143,7 +155,7 @@ function inspectConstraintResourceShape(constraints, path, depth, policy, ctx) {
     }
     if (constraints.attributes !== undefined) {
         for (const [key, child] of Object.entries(constraints.attributes)) {
-            inspectConstraintResourceShape(child, `${path}@${key}`, depth + 1, policy, ctx);
+            inspectConstraintResourceShape(child, appendAttributePath(path, key), depth + 1, policy, ctx);
         }
     }
 }
@@ -274,6 +286,7 @@ export function validate(aes, schema, options = {}) {
                 ...(attributes ? { attributes } : {}),
             };
             eventsByPath.set(elementPath, info);
+            addAttributeEvents(elementPath, attributes);
         }
     }
     function buildAttributeInfoMap(attributes) {
@@ -300,6 +313,22 @@ export function validate(aes, schema, options = {}) {
         }
         return mapped;
     }
+    function addAttributeEvents(basePath, attributes) {
+        if (!attributes)
+            return;
+        for (const [key, attribute] of attributes.entries()) {
+            const attributePath = appendAttributePath(basePath, key);
+            eventsByPath.set(attributePath, {
+                type: attribute.type,
+                raw: attribute.raw,
+                value: attribute.value,
+                ...(attribute.datatype !== undefined ? { datatype: attribute.datatype } : {}),
+                span: attribute.span,
+                ...(attribute.attributes ? { attributes: attribute.attributes } : {}),
+            });
+            addAttributeEvents(attributePath, attribute.attributes);
+        }
+    }
     for (let i = 0; i < aes.length; i++) {
         const event = aes[i];
         const pathStr = formatCanonicalPath(event.path);
@@ -338,6 +367,7 @@ export function validate(aes, schema, options = {}) {
                     ...(attributes ? { attributes } : {}),
                 };
                 eventsByPath.set(pathStr, info);
+                addAttributeEvents(pathStr, attributes);
                 if ((event.value.type === 'TupleLiteral' || event.value.type === 'ListLiteral' || event.value.type === 'ListNode')
                     && Array.isArray(event.value.elements)) {
                     containerArity.set(pathStr, event.value.elements.length);
@@ -391,12 +421,12 @@ export function validate(aes, schema, options = {}) {
     // Phase 3: Build rule index from schema (run after baseline invariants)
     const ruleIndex = buildRuleIndex(schema, ctx);
     const selectorExpansionBudget = { count: 0 };
-    const expandedRuleIndex = expandWildcardRules(expandSelectorRules(ruleIndex, schema, eventsByPath, ctx, resourcePolicy, selectorExpansionBudget), eventsByPath, ctx, resourcePolicy, selectorExpansionBudget);
+    const expandedRuleIndex = expandSelectorRules(ruleIndex, schema, eventsByPath, ctx, resourcePolicy, selectorExpansionBudget);
     const effectiveRuleIndex = mergeDatatypeRules(expandedRuleIndex, schema.datatype_rules, eventsByPath);
     // Phase 4: Presence checks (required fields)
-    const boundPaths = new Set(seen.keys());
+    const boundPaths = new Set(eventsByPath.keys());
     checkPresence(effectiveRuleIndex, boundPaths, ctx);
-    checkWorldPolicy(schema, aes, boundPaths, ctx);
+    checkWorldPolicy(schema, aes, boundPaths, eventsByPath, ctx);
     // Phase 5: Type checks (literal kind)
     checkReferenceForms(schema, effectiveRuleIndex, eventsByPath, ctx);
     const effectiveEventsByPath = resolveReferenceFormEvents(effectiveRuleIndex, eventsByPath, resourcePolicy, ctx);
@@ -494,7 +524,7 @@ export function validate(aes, schema, options = {}) {
     }
     return createPassingEnvelope(guarantees, ctx.warnings);
 }
-function checkWorldPolicy(schema, aes, boundPaths, ctx) {
+function checkWorldPolicy(schema, aes, boundPaths, eventsByPath, ctx) {
     if ((schema.world ?? 'open') !== 'closed')
         return;
     const allowedRules = schema.rules
@@ -504,6 +534,12 @@ function checkWorldPolicy(schema, aes, boundPaths, ctx) {
             ? { kind: 'selector', value: rule.selector }
             : null)
         .filter((rule) => rule !== null);
+    const selectorMatches = new Map();
+    for (const rule of allowedRules) {
+        if (rule.kind !== 'selector' || selectorMatches.has(rule.value))
+            continue;
+        selectorMatches.set(rule.value, resolveSansaSelectorPathSet(rule.value, eventsByPath, ctx));
+    }
     for (const event of aes) {
         const key = typeof event.key === 'string' ? event.key : '';
         if (key.startsWith('aeon:'))
@@ -512,7 +548,7 @@ function checkWorldPolicy(schema, aes, boundPaths, ctx) {
         if (!boundPaths.has(path))
             continue;
         if (allowedRules.some((rule) => rule.kind === 'selector'
-            ? matchesSelectorPath(path, rule.value)
+            ? selectorMatches.get(rule.value)?.has(path) === true
             : matchesAllowedPath(path, rule.value)))
             continue;
         emitError(ctx, createDiag(path, toTupleLocal(event.span), `Binding '${path}' is not allowed by closed-world schema`, ErrorCodes.UNEXPECTED_BINDING));
@@ -549,10 +585,11 @@ function expandSelectorRules(ruleIndex, schema, eventsByPath, ctx, resourcePolic
             continue;
         if (typeof rule.path === 'string' && rule.path.length > 0)
             continue;
+        const resolvedPaths = resolveSansaSelectorPathSet(rule.selector, eventsByPath, ctx);
+        if (resolvedPaths === null)
+            continue;
         let matched = false;
-        for (const actualPath of eventsByPath.keys()) {
-            if (!matchesSelectorPath(actualPath, rule.selector))
-                continue;
+        for (const actualPath of resolvedPaths) {
             matched = true;
             expansionBudget.count += 1;
             if (expansionBudget.count > resourcePolicy.max_selector_expansions) {
@@ -569,25 +606,6 @@ function expandSelectorRules(ruleIndex, schema, eventsByPath, ctx, resourcePolic
     }
     return expanded;
 }
-function expandWildcardRules(ruleIndex, eventsByPath, ctx, resourcePolicy, expansionBudget) {
-    const expanded = new Map(ruleIndex);
-    for (const [path, rule] of ruleIndex.entries()) {
-        if (!path.includes('[*]'))
-            continue;
-        expanded.delete(path);
-        for (const actualPath of eventsByPath.keys()) {
-            if (matchesAllowedPath(actualPath, path)) {
-                expansionBudget.count += 1;
-                if (expansionBudget.count > resourcePolicy.max_selector_expansions) {
-                    emitResourceError(ctx, path, `Wildcard expansion count exceeds max_selector_expansions ${resourcePolicy.max_selector_expansions}`);
-                    return expanded;
-                }
-                expanded.set(actualPath, { ...rule, path: actualPath });
-            }
-        }
-    }
-    return expanded;
-}
 function selectAnyOfRules(ruleIndex, eventsByPath, ctx) {
     const selected = new Map(ruleIndex);
     for (const [path, rule] of ruleIndex.entries()) {
@@ -701,156 +719,93 @@ function formatReferenceLookupPath(segments) {
                 : formatQuotedMemberSegment(segment);
             continue;
         }
-        out += /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(segment.key)
-            ? `@${segment.key}`
-            : `@[${JSON.stringify(segment.key)}]`;
+        out = appendAttributePath(out, segment.key);
     }
     return out;
 }
 function matchesAllowedPath(actualPath, allowedPath) {
-    if (actualPath === allowedPath)
-        return true;
-    // Closed-world schemas may allow list descendants via canonical wildcard paths
-    // such as `$.items[*]` or `$.items[*].x`.
-    if (!allowedPath.includes('[*]'))
-        return false;
-    const escaped = allowedPath
-        .split('[*]')
-        .map((part) => part.replace(/[|\\{}()[\]^$+?.]/g, '\\$&'))
-        .join('\\[\\d+\\]');
-    const pattern = `^${escaped}$`;
-    return new RegExp(pattern).test(actualPath);
+    return actualPath === allowedPath;
 }
-function tokenizeCanonicalLikePath(path) {
-    if (!path.startsWith('$'))
-        return null;
-    const segments = [];
-    let index = 1;
-    while (index < path.length) {
-        const marker = path[index];
-        if (marker === '.') {
-            index += 1;
-            if (path[index] === '[') {
-                const end = findBracketEnd(path, index);
-                if (end < 0)
-                    return null;
-                segments.push(path.slice(index, end + 1));
-                index = end + 1;
-                continue;
-            }
-            const start = index;
-            while (index < path.length && !['.', '[', '@'].includes(path[index])) {
-                index += 1;
-            }
-            if (start === index)
-                return null;
-            segments.push(path.slice(start, index));
-            continue;
-        }
-        if (marker === '[') {
-            const end = findBracketEnd(path, index);
-            if (end < 0)
-                return null;
-            segments.push(path.slice(index, end + 1));
-            index = end + 1;
-            continue;
-        }
-        if (marker === '@') {
-            index += 1;
-            if (path[index] === '[') {
-                const end = findBracketEnd(path, index);
-                if (end < 0)
-                    return null;
-                segments.push(`@${path.slice(index, end + 1)}`);
-                index = end + 1;
-                continue;
-            }
-            const start = index;
-            while (index < path.length && !['.', '[', '@'].includes(path[index])) {
-                index += 1;
-            }
-            if (start === index)
-                return null;
-            segments.push(`@${path.slice(start, index)}`);
-            continue;
-        }
+function resolveSansaSelectorPathSet(selector, eventsByPath, ctx) {
+    const result = resolveAddress(selector, createAeosSansaResolveNamespace(eventsByPath));
+    if (!result.ok) {
+        const first = result.errors[0];
+        emitError(ctx, createDiag(selector, null, first ? `Invalid or unsupported SANSA selector: ${first.message}` : `Invalid or unsupported SANSA selector: ${selector}`, ErrorCodes.INVALID_SCHEMA_POLICY));
         return null;
     }
-    return segments;
+    return new Set(result.bindings.map((binding) => binding.path).filter((path) => eventsByPath.has(path)));
 }
-function findBracketEnd(path, start) {
-    let quote = null;
-    let escaped = false;
-    for (let index = start + 1; index < path.length; index++) {
-        const ch = path[index];
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (quote) {
-            if (ch === '\\') {
-                escaped = true;
-            }
-            else if (ch === quote) {
-                quote = null;
-            }
-            continue;
-        }
-        if (ch === '"' || ch === "'") {
-            quote = ch;
-            continue;
-        }
-        if (ch === ']')
-            return index;
+function createAeosSansaResolveNamespace(eventsByPath) {
+    const root = buildAeosSansaResolveTree(eventsByPath);
+    return {
+        root,
+        children: (binding) => binding.children,
+        member: (binding, name) => binding.children.find((child) => child.name === name),
+        position: (binding, index) => binding.children.find((child) => child.index === index),
+        attributeSpace: (binding) => binding.attributeSpace,
+        name: (binding) => binding.name,
+        index: (binding) => binding.index,
+        semanticType: (binding) => binding.info?.datatype,
+        representationKind: (binding) => binding.info?.type,
+    };
+}
+function buildAeosSansaResolveTree(eventsByPath) {
+    const root = { path: '$', children: [] };
+    for (const [path, info] of [...eventsByPath.entries()].sort((a, b) => a[0].length - b[0].length)) {
+        insertAeosSansaResolvePath(root, path, info);
     }
-    return -1;
+    return root;
 }
-function matchesSelectorPath(actualPath, selector) {
-    if (actualPath === selector)
-        return true;
-    const actualSegments = tokenizeCanonicalLikePath(actualPath);
-    const selectorSegments = tokenizeCanonicalLikePath(selector);
-    if (!actualSegments || !selectorSegments)
-        return false;
-    const matchFrom = (actualIndex, selectorIndex) => {
-        if (selectorIndex === selectorSegments.length) {
-            return actualIndex === actualSegments.length;
-        }
-        const selectorSegment = selectorSegments[selectorIndex];
-        if (selectorSegment === '**') {
-            if (selectorIndex === selectorSegments.length - 1)
-                return true;
-            for (let nextActual = actualIndex; nextActual <= actualSegments.length; nextActual++) {
-                if (matchFrom(nextActual, selectorIndex + 1))
-                    return true;
-            }
-            return false;
-        }
-        if (actualIndex >= actualSegments.length)
-            return false;
-        if (selectorSegment === '*') {
-            return matchFrom(actualIndex + 1, selectorIndex + 1);
-        }
-        if (selectorSegment === '[*]') {
-            return /^\[\d+\]$/.test(actualSegments[actualIndex])
-                && matchFrom(actualIndex + 1, selectorIndex + 1);
+function insertAeosSansaResolvePath(root, path, info) {
+    const parsed = parseAddress(path);
+    if (!parsed.ok)
+        return;
+    if (parsed.address.root.kind !== 'absolute')
+        return;
+    let current = root;
+    let currentPath = '$';
+    for (const selector of parsed.address.selectors) {
+        switch (selector.type) {
+            case 'member':
+                currentPath += formatMemberSelector(selector.name);
+                current = getOrCreateChildBinding(current, currentPath, { name: selector.name });
+                break;
+            case 'position':
+                currentPath += `[${selector.index}]`;
+                current = getOrCreateChildBinding(current, currentPath, { index: selector.index });
+                break;
+            case 'attributeSpace':
+                currentPath += '.@';
+                current.attributeSpace ??= { path: currentPath, children: [] };
+                current = current.attributeSpace;
+                break;
+            default:
+                return;
         }
-        return selectorSegment === actualSegments[actualIndex]
-            && matchFrom(actualIndex + 1, selectorIndex + 1);
-    };
-    return matchFrom(0, 0);
+    }
+    current.info = info;
+}
+function getOrCreateChildBinding(parent, path, identity) {
+    const existing = parent.children.find((child) => identity.name !== undefined
+        ? child.name === identity.name
+        : child.index === identity.index);
+    if (existing)
+        return existing;
+    const child = { path, children: [], ...identity };
+    parent.children.push(child);
+    return child;
 }
 function collectAllowedAttributePaths(ruleIndex) {
     const allowed = [];
     function visit(basePath, constraints) {
-        if (basePath.includes('@')) {
+        if (basePath.includes('.@.')) {
             allowed.push(basePath);
         }
         const attributes = constraints.attributes;
         if (!attributes)
             return;
         for (const [key, childConstraints] of Object.entries(attributes)) {
-            visit(`${basePath}@${key}`, childConstraints);
+            visit(appendAttributePath(basePath, key), childConstraints);
         }
     }
     for (const [path, rule] of ruleIndex) {
@@ -864,7 +819,7 @@ function collectAttributeEntries(eventsByPath) {
         if (!attributes)
             return;
         for (const [key, entry] of attributes.entries()) {
-            const path = `${basePath}@${key}`;
+            const path = appendAttributePath(basePath, key);
             entries.push({ path, span: entry.span });
             visit(path, entry.attributes);
         }
@@ -974,7 +929,7 @@ function checkAttributeConstraints(ruleIndex, eventsByPath, datatypeRules, ctx)
 function validateAttributeMap(basePath, attributes, constraints, datatypeRules, ctx) {
     const requiredAttributes = constraints.attributes ?? {};
     for (const [key, childConstraints] of Object.entries(requiredAttributes)) {
-        const childPath = `${basePath}@${key}`;
+        const childPath = appendAttributePath(basePath, key);
         const entry = attributes?.get(key);
         if (childConstraints.required === true && !entry) {
             emitError(ctx, createDiag(childPath, null, `Missing required field: ${childPath}`, ErrorCodes.MISSING_REQUIRED_FIELD));
@@ -989,7 +944,7 @@ function validateAttributeMap(basePath, attributes, constraints, datatypeRules,
         for (const key of attributes.keys()) {
             if (allowed.has(key))
                 continue;
-            const childPath = `${basePath}@${key}`;
+            const childPath = appendAttributePath(basePath, key);
             emitError(ctx, createDiag(childPath, attributes.get(key)?.span ?? null, `Attribute '${childPath}' is not allowed by closed attribute constraints`, ErrorCodes.UNEXPECTED_ATTRIBUTE_ENTRY));
         }
     }
@@ -1217,6 +1172,7 @@ function isStringType(type) {
         || type === 'TrimtickLiteral'
         || type === 'TrimtickStringLiteral'
         || type === 'SeparatorLiteral'
+        || type === 'SansaAddressLiteral'
         || type === 'NullLiteral'
         || type === 'EncodingLiteral'
         || type === 'DateLiteral'