@astrale-os/kernel-dsl 0.2.0-beta.42 → 0.2.0-beta.43

package/dist/v1/compiled/admission/semantics.js

@@ -6,6 +6,7 @@ import { isMethodExecutable } from '../../language/callable/executable.js';
 import { policyObjectKey, policyObjectOrigin, policyVariableClass, projectedMemberClass, } from '../../language/index.js';
 import { branchesOf, branchProduct, capBranches, isConnected, targetMode, termKey, } from '../../language/policy/analysis/branches.js';
 import { BRANCH_OVERFLOW, MAX_BRANCHES, MAX_CHECK_DEPTH, MAX_CHECK_LEAVES, MAX_DOMAINS, MAX_EDGES, MAX_PATTERN_DEPTH, MAX_REPEAT, MAX_VARIABLES, measureChecks, } from '../../language/policy/analysis/budgets.js';
+import { admittedCheckClasses, neverAdmittedClasses, } from '../../language/policy/analysis/checks.js';
 import { normalizePolicyExpression } from '../../language/policy/normalization/normalize.js';
 import { bindValueProgram } from '../../language/value/compile/load.js';
 import { validateValueProgram } from '../../language/value/evaluate/program.js';
@@ -538,6 +539,7 @@ function validateCallablePolicyTyping(context, typing, entry, expression, input,
         measure.leaves > MAX_CHECK_LEAVES) {
         fail(path, 'Callable Policy checks exceed the V1 depth, branch, or leaf budget.');
     }
+    const leaves = new Map();
     const visit = (value, pointer) => {
         if ('sameNode' in value)
             return;
@@ -547,12 +549,23 @@ function validateCallablePolicyTyping(context, typing, entry, expression, input,
             return;
         }
         const contracts = callableObjectContracts(context, entry, input, receiver, value.object);
-        if (contracts !== undefined &&
-            contracts.some((contract) => !typing.policyAccepts(value.check.name, contract))) {
+        if (contracts === undefined)
+            return;
+        const typings = new Map(contracts.map((contract) => [
+            contract.kind === 'exact' ? Key.of(contract.ref) : 'default',
+            typing.policyBranchTyping(value.check.name, contract),
+        ]));
+        const admitted = admittedCheckClasses(typings);
+        if (admitted === undefined) {
             fail(pointer, 'Named Policy is incompatible with the callable object contract.');
         }
+        leaves.set(value, { accepted: [...typings.keys()], admitted });
     };
     visit(expression, path);
+    const [never] = neverAdmittedClasses(expression, leaves);
+    if (never !== undefined) {
+        fail(path, `Callable Policy checks can never admit ${never[0]} of Class ${never[1]}.`);
+    }
 }
 function callableObjectContracts(context, entry, input, receiver, object) {
     if (object.kind === 'self') {
@@ -629,9 +642,11 @@ class CompiledPolicyTyping {
         return 'allOf' in declaration ? branchProduct(children) : capBranches(children.flat());
     }
     policyAccepts(name, object) {
+        return this.policyBranchTyping(name, object)?.every(Boolean) ?? false;
+    }
+    policyBranchTyping(name, object) {
         const branches = this.expandedBranches(name, new Set(), `$use:${name}`);
-        return (branches !== undefined &&
-            branches.every((branch) => this.branchIsTyped(branch, { kind: 'object', object })));
+        return branches?.map((branch) => this.branchIsTyped(branch, { kind: 'object', object }));
     }
     policyAcceptsEdge(name, source, target) {
         const branches = this.expandedBranches(name, new Set(), `$edge-use:${name}`);

package/dist/v1/language/policy/analysis/checks.d.ts

@@ -0,0 +1,28 @@
+import type { PolicyCheckExpression } from '../model/policy.js';
+export type PolicyCheckLeaf = Extract<PolicyCheckExpression, {
+    readonly check: unknown;
+}>;
+/** How one check leaf types against the Classes its object accepts. */
+export interface CheckLeafClasses {
+    /** Every Class the leaf's object accepts. */
+    readonly accepted: readonly string[];
+    /** The accepted Classes at least one normalized branch of the leaf's Policy is typed for. */
+    readonly admitted: ReadonlySet<string>;
+}
+/**
+ * The Classes a leaf admits, from the typing of each normalized branch of its Policy for each
+ * accepted Class of its object. `undefined` when the Policy does not expand, or when one branch is
+ * typed for no accepted Class: that branch can never match this object, so it is refused rather
+ * than silently erased.
+ */
+export declare function admittedCheckClasses(typing: ReadonlyMap<string, readonly boolean[] | undefined>): ReadonlySet<string> | undefined;
+/**
+ * The accepted Classes of each object that the whole check tree can never admit.
+ *
+ * The tree is read in disjunctive normal form. A conjunction admits Class C of object O when every
+ * leaf over O in it admits C and every other object it checks keeps a Class that all of its leaves
+ * over that object admit; an object the conjunction does not check keeps every accepted Class.
+ * `sameNode` compares identities, not Classes, so it never removes a Class here. A tree over the
+ * check budget is already refused, so it is not expanded.
+ */
+export declare function neverAdmittedClasses(expression: PolicyCheckExpression, leaves: ReadonlyMap<PolicyCheckLeaf, CheckLeafClasses>): readonly (readonly [object: string, className: string])[];

package/dist/v1/language/policy/analysis/checks.js

@@ -0,0 +1,80 @@
+import { policyObjectKey } from '../model/policy.js';
+import { MAX_BRANCHES, measureChecks } from './budgets.js';
+/** Names a callable check object. Every leaf over one object sees the same Node at runtime. */
+function checkObjectName(object) {
+    if (object.kind === 'self')
+        return 'self';
+    if (object.kind === 'input')
+        return `input.${object.field}`;
+    return policyObjectKey(object.ref);
+}
+/**
+ * The Classes a leaf admits, from the typing of each normalized branch of its Policy for each
+ * accepted Class of its object. `undefined` when the Policy does not expand, or when one branch is
+ * typed for no accepted Class: that branch can never match this object, so it is refused rather
+ * than silently erased.
+ */
+export function admittedCheckClasses(typing) {
+    const rows = [...typing];
+    if (!rows.every((row) => row[1] !== undefined)) {
+        return undefined;
+    }
+    const branches = Math.max(0, ...rows.map(([, row]) => row.length));
+    for (let index = 0; index < branches; index++) {
+        if (!rows.some(([, row]) => row[index] === true))
+            return undefined;
+    }
+    return new Set(rows.filter(([, row]) => row.some(Boolean)).map(([name]) => name));
+}
+/**
+ * The accepted Classes of each object that the whole check tree can never admit.
+ *
+ * The tree is read in disjunctive normal form. A conjunction admits Class C of object O when every
+ * leaf over O in it admits C and every other object it checks keeps a Class that all of its leaves
+ * over that object admit; an object the conjunction does not check keeps every accepted Class.
+ * `sameNode` compares identities, not Classes, so it never removes a Class here. A tree over the
+ * check budget is already refused, so it is not expanded.
+ */
+export function neverAdmittedClasses(expression, leaves) {
+    if (measureChecks(expression).branches > MAX_BRANCHES)
+        return [];
+    const accepted = new Map();
+    for (const [leaf, classes] of leaves)
+        accepted.set(checkObjectName(leaf.object), classes.accepted);
+    const admitted = new Map();
+    for (const conjunction of disjunctiveForm(expression)) {
+        const constrained = new Map();
+        for (const leaf of conjunction) {
+            if (!('check' in leaf))
+                continue;
+            const classes = leaves.get(leaf);
+            if (classes === undefined)
+                continue;
+            const object = checkObjectName(leaf.object);
+            const previous = constrained.get(object);
+            constrained.set(object, previous === undefined
+                ? classes.admitted
+                : new Set([...previous].filter((name) => classes.admitted.has(name))));
+        }
+        if ([...constrained.values()].some((classes) => classes.size === 0))
+            continue;
+        for (const [object, all] of accepted) {
+            const reached = admitted.get(object) ?? new Set();
+            for (const name of constrained.get(object) ?? all)
+                reached.add(name);
+            admitted.set(object, reached);
+        }
+    }
+    return [...accepted].flatMap(([object, all]) => all
+        .filter((name) => admitted.get(object)?.has(name) !== true)
+        .map((name) => [object, name]));
+}
+function disjunctiveForm(expression) {
+    if ('check' in expression || 'sameNode' in expression)
+        return [[expression]];
+    if ('anyOf' in expression)
+        return expression.anyOf.flatMap(disjunctiveForm);
+    return expression.allOf
+        .map(disjunctiveForm)
+        .reduce((left, right) => left.flatMap((prefix) => right.map((suffix) => [...prefix, ...suffix])), [[]]);
+}

package/dist/v1/schema/validation/policy/typing.d.ts

@@ -12,6 +12,8 @@ export declare class PolicyTyping {
     constructor(context: PolicyValidationContext);
     validatePolicies(): void;
     policyAccepts(name: string, object: ObjectContract): boolean;
+    /** Whether each normalized branch of the Policy is typed for an object of this contract. */
+    policyBranchTyping(name: string, object: ObjectContract): readonly boolean[] | undefined;
     policyAcceptsEdge(name: string, source: ObjectContract, target: ObjectContract): boolean;
     concreteEndpointClasses(accepts: readonly ClassRef[]): readonly ClassRef[];
     endpointsOverlap(left: readonly ClassRef[], right: readonly ClassRef[]): boolean;

package/dist/v1/schema/validation/policy/typing.js

@@ -35,9 +35,13 @@ export class PolicyTyping {
         }
     }
     policyAccepts(name, object) {
+        return this.policyBranchTyping(name, object)?.every(Boolean) ?? false;
+    }
+    /** Whether each normalized branch of the Policy is typed for an object of this contract. */
+    policyBranchTyping(name, object) {
         const branches = this.#expandedBranches(name, new Set(), `$use:${name}`);
         const use = { kind: 'object', object };
-        return branches !== undefined && branches.every((branch) => this.#branchIsTyped(branch, use));
+        return branches?.map((branch) => this.#branchIsTyped(branch, use));
     }
     policyAcceptsEdge(name, source, target) {
         const branches = this.#expandedBranches(name, new Set(), `$edge-use:${name}`);

package/dist/v1/schema/validation/policy/uses.js

@@ -1,6 +1,7 @@
 import { Key } from '../../../addressing/index.js';
 import { definitionRefIndex } from '../../../addressing/ordering.js';
 import { isBinaryInput } from '../../../language/callable/model/callable.js';
+import { admittedCheckClasses, neverAdmittedClasses, } from '../../../language/policy/analysis/checks.js';
 import { normalizePolicyChecks } from '../../../language/policy/normalization/normalize.js';
 import { GRAPH_NODE_PATH_SCHEMA_ID } from '../../../language/value/syntax/node-path/schema.js';
 import { MAX_BRANCHES, MAX_CHECK_DEPTH, MAX_CHECK_LEAVES, measureChecks } from './budgets.js';
@@ -89,9 +90,13 @@ function validateChecks(validation, typing, expression, context) {
         measure.leaves > MAX_CHECK_LEAVES) {
         validation.add('PL_BUDGET', context.pointer, `Callable checks require depth <= ${MAX_CHECK_DEPTH}, branches <= ${MAX_BRANCHES}, and leaves <= ${MAX_CHECK_LEAVES}; got ${measure.depth}, ${measure.branches}, ${measure.leaves}.`);
     }
-    visitChecks(validation, typing, normalized, context, context.pointer);
+    const leaves = new Map();
+    visitChecks(validation, typing, normalized, context, context.pointer, leaves);
+    for (const [object, className] of neverAdmittedClasses(normalized, leaves)) {
+        validation.add('PL_USE', context.pointer, `Callable checks can never admit ${object} of Class ${className}.`, className);
+    }
 }
-function visitChecks(validation, typing, expression, context, pointer) {
+function visitChecks(validation, typing, expression, context, pointer, leaves) {
     if ('sameNode' in expression) {
         for (const [side, object] of Object.entries(expression.sameNode)) {
             const objectPointer = `${pointer}/sameNode/${side}`;
@@ -115,19 +120,26 @@ function visitChecks(validation, typing, expression, context, pointer) {
                 : referenceContracts(validation, expression.object.ref, objectPointer);
         if (contracts === undefined)
             return;
-        for (const contract of contracts) {
-            if (!typing.policyAccepts(expression.check.name, contract)) {
-                validation.add('PL_USE', pointer, `${formatDefinitionRef(expression.check)} is incompatible with the callable object contract.`, formatDefinitionRef(expression.check));
-                break;
-            }
+        const typings = new Map(contracts.map((contract) => [
+            contractName(contract),
+            typing.policyBranchTyping(expression.check.name, contract),
+        ]));
+        const admitted = admittedCheckClasses(typings);
+        if (admitted === undefined) {
+            validation.add('PL_USE', pointer, `${formatDefinitionRef(expression.check)} is incompatible with the callable object contract.`, formatDefinitionRef(expression.check));
+            return;
         }
+        leaves.set(expression, { accepted: [...typings.keys()], admitted });
         return;
     }
     const { key, values } = checkOperands(expression);
     if (values.length === 0) {
         validation.add('PL_COMPOSITION', `${pointer}/${key}`, `${key} must be non-empty.`);
     }
-    values.forEach((child, index) => visitChecks(validation, typing, child, context, `${pointer}/${key}/${index}`));
+    values.forEach((child, index) => visitChecks(validation, typing, child, context, `${pointer}/${key}/${index}`, leaves));
+}
+function contractName(contract) {
+    return contract.kind === 'exact' ? formatDefinitionRef(contract.ref) : 'default';
 }
 function selfContracts(validation, context, pointer) {
     if (!context.instanceMethod || context.receiver === undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-dsl",
-  "version": "0.2.0-beta.42",
+  "version": "0.2.0-beta.43",
   "description": "Astrale Kernel DSL - Schema authoring, inference, and IR serialization",
   "license": "Apache-2.0",
   "repository": {