@astrale-os/kernel-dsl 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/v1/schema/validation/policy/typing.js

@@ -1,366 +1,32 @@
-import { definitionRefIndex } from '../../../addressing/ordering.js';
-import { branchesOf, branchProduct, capBranches, targetMode, termKey, } from '../../../language/policy/analysis/branches.js';
-import { MAX_REPEAT } from './budgets.js';
-import { escapePointer } from './context.js';
-import { referenceContracts } from './objects.js';
-export class PolicyTyping {
-    context;
-    // Expanded branches of each named Policy, cached by node identity. A Policy's expansion is reused
-    // across every composition path that reaches it (and across every use site and object contract,
-    // none of which the expansion depends on), so a shared-child composition DAG is expanded in work
-    // linear in the number of Policies instead of enumerating every path. The expansion result is
-    // independent of the reaching path up to the opaque term-namespace labels, which only ever
-    // disambiguate variables within one branch and leave targetMode and branch typing unchanged.
-    #expansions = new Map();
-    constructor(context) {
-        this.context = context;
-    }
-    validatePolicies() {
-        for (const name of Object.keys(this.context.environment.candidate.policies)) {
-            const branches = this.#expandedBranches(name, new Set(), `$${name}`);
-            if (branches === undefined)
-                continue;
-            for (const [index, branch] of branches.entries()) {
-                const mode = targetMode(branch);
-                if (mode === undefined) {
-                    if (!('match' in this.context.environment.candidate.policies[name].expression)) {
-                        this.context.add('PL_TARGET', `/policies/${escapePointer(name)}`, `Expanded normalized branch ${index} must use object or at least one of source and target, without mixing target modes.`);
-                    }
-                    continue;
-                }
-                const use = mode === 'object'
-                    ? { kind: 'object', object: { kind: 'default' } }
-                    : {
-                        kind: 'edge',
-                        source: { kind: 'default' },
-                        target: { kind: 'default' },
-                    };
-                if (!this.#branchIsTyped(branch, use)) {
-                    this.context.add('PL_TYPING', `/policies/${escapePointer(name)}`, `Expanded normalized branch ${index} has contradictory endpoint or repeat contracts.`);
+import { targetMode } from '../../../language/policy/analysis/branches.js';
+import { escapePointerToken } from '../../../language/value/syntax/pointer.js';
+/** Type every expanded branch of each named Policy at its own default use. */
+export function validatePolicyTyping(context, typing) {
+    for (const name of Object.keys(context.environment.candidate.policies)) {
+        const branches = typing.expandedBranches(name, `$${name}`);
+        if (branches === undefined)
+            continue;
+        for (const [index, branch] of branches.entries()) {
+            const mode = targetMode(branch);
+            if (mode === undefined) {
+                if (!('match' in context.environment.candidate.policies[name].expression)) {
+                    context.add('PL_TARGET', `/policies/${escapePointerToken(name)}`, `Expanded normalized branch ${index} must use object or at least one of source and target, without mixing target modes.`);
                 }
-            }
-        }
-    }
-    policyAccepts(name, object) {
-        return this.policyBranchTyping(name, object)?.every(Boolean) ?? false;
-    }
-    /** Whether each normalized branch of the Policy is typed for an object of this contract. */
-    policyBranchTyping(name, object) {
-        const branches = this.#expandedBranches(name, new Set(), `$use:${name}`);
-        const use = { kind: 'object', object };
-        return branches?.map((branch) => this.#branchIsTyped(branch, use));
-    }
-    policyAcceptsEdge(name, source, target) {
-        const branches = this.#expandedBranches(name, new Set(), `$edge-use:${name}`);
-        const use = { kind: 'edge', source, target };
-        return branches !== undefined && branches.every((branch) => this.#branchIsTyped(branch, use));
-    }
-    concreteEndpointClasses(accepts) {
-        return this.context.concreteNodeClasses.filter((candidate) => this.#classSatisfiesEndpoint(candidate, accepts));
-    }
-    endpointsOverlap(left, right) {
-        const seed = [{ kind: 'open', requirements: [] }];
-        const afterLeft = this.#applyEndpoint(seed, left);
-        return this.#applyEndpoint(afterLeft, right).length > 0;
-    }
-    #expandedBranches(name, visiting, namespace) {
-        if (visiting.has(name))
-            return undefined;
-        const cached = this.#expansions.get(name);
-        if (cached !== undefined || this.#expansions.has(name))
-            return cached;
-        const expanded = this.#expandDeclaration(name, visiting, namespace);
-        this.#expansions.set(name, expanded);
-        return expanded;
-    }
-    #expandDeclaration(name, visiting, namespace) {
-        const declaration = this.context.normalized.get(name);
-        if (declaration === undefined)
-            return undefined;
-        if ('match' in declaration)
-            return branchesOf(declaration.match, namespace);
-        const nested = new Set(visiting);
-        nested.add(name);
-        const refs = 'allOf' in declaration ? declaration.allOf : declaration.anyOf;
-        const children = [];
-        for (const [index, ref] of refs.entries()) {
-            if (!this.context.isLocalPolicy(ref))
-                return undefined;
-            const expanded = this.#expandedBranches(ref.name, nested, `${namespace}/${index}:${ref.name}`);
-            if (expanded === undefined)
-                return undefined;
-            children.push(expanded);
-        }
-        return 'allOf' in declaration ? branchProduct(children) : capBranches(children.flat());
-    }
-    #branchIsTyped(branch, use) {
-        if (targetMode(branch) !== use.kind)
-            return false;
-        const alternatives = edgeAlternatives(branch.edges, this);
-        return alternatives.some((variants) => this.#constraintsAreSatisfiable(branch, variants, use));
-    }
-    #constraintsAreSatisfiable(branch, variants, use) {
-        const terms = new Set(use.kind === 'object' ? ['subject', 'object'] : ['subject', 'source', 'target']);
-        for (const key of branch.variables.keys())
-            terms.add(key);
-        for (const key of branch.terms.keys())
-            terms.add(key);
-        for (const edge of branch.edges) {
-            terms.add(termKey(edge.pattern.source, edge.namespace));
-            terms.add(termKey(edge.pattern.target, edge.namespace));
-        }
-        const union = new UnionFind(terms);
-        for (const [left, right] of branch.equalities)
-            union.join(left, right);
-        for (const variant of variants) {
-            for (const [left, right] of variant.equalities)
-                union.join(left, right);
-        }
-        const constraints = new Map();
-        for (const variant of variants) {
-            for (const [term, accepts] of variant.constraints) {
-                const root = union.find(term);
-                const values = constraints.get(root) ?? [];
-                values.push(accepts);
-                constraints.set(root, values);
-            }
-        }
-        const groups = new Map();
-        for (const term of terms) {
-            const root = union.find(term);
-            const members = groups.get(root) ?? [];
-            members.push(term);
-            groups.set(root, members);
-        }
-        for (const [root, members] of groups) {
-            const endpointConstraints = constraints.get(root) ?? [];
-            let candidates = [{ kind: 'open', requirements: [] }];
-            for (const member of members) {
-                candidates = this.#applyInitial(candidates, member, branch, use);
-                if (candidates.length === 0)
-                    return false;
-            }
-            for (const endpoint of endpointConstraints) {
-                candidates = this.#applyEndpoint(candidates, endpoint);
-                if (candidates.length === 0)
-                    return false;
-            }
-        }
-        return true;
-    }
-    #applyInitial(candidates, term, branch, use) {
-        if (term === 'subject')
-            return this.#applyAnyNodeClass(candidates);
-        const contract = targetContract(term, use);
-        if (contract !== undefined) {
-            if (contract.kind === 'exact')
-                return this.#applyExact(candidates, contract.ref);
-            if (contract.kind === 'default') {
-                return uniqueCandidates(this.context.allNodeClasses.flatMap((ref) => this.#applyExact(candidates, ref)));
-            }
-            return candidates;
-        }
-        const referenced = branch.terms.get(term);
-        if (referenced?.kind === 'ref') {
-            const contract = referenceContracts(this.context, referenced.ref, '/policies')?.[0];
-            return contract?.kind === 'exact' ? this.#applyExact(candidates, contract.ref) : [];
-        }
-        const selector = branch.variables.get(term);
-        if (selector === undefined)
-            return [];
-        if (selector.kind === 'exact')
-            return this.#applyExact(candidates, selector.class);
-        if (selector.kind === 'any')
-            return candidates;
-        return this.#applyRequirement(candidates, selector.class);
-    }
-    #applyExact(candidates, exact) {
-        const result = [];
-        for (const candidate of candidates) {
-            if (candidate.kind === 'exact') {
-                if (definitionRefIndex(candidate.ref) === definitionRefIndex(exact))
-                    result.push(candidate);
-            }
-            else if (candidate.requirements.every((required) => this.context.classExtends(exact, required))) {
-                result.push({ kind: 'exact', ref: exact });
-            }
-        }
-        return uniqueCandidates(result);
-    }
-    #applyAnyNodeClass(candidates) {
-        return uniqueCandidates(candidates.flatMap((candidate) => candidate.kind === 'exact'
-            ? [candidate]
-            : this.context.allNodeClasses
-                .filter((ref) => candidate.requirements.every((required) => this.context.classExtends(ref, required)))
-                .map((ref) => ({ kind: 'exact', ref }))));
-    }
-    #applyRequirement(candidates, required) {
-        const result = [];
-        for (const candidate of candidates) {
-            if (candidate.kind === 'exact') {
-                if (this.context.classExtends(candidate.ref, required))
-                    result.push(candidate);
-            }
-            else {
-                result.push({
-                    kind: 'open',
-                    requirements: uniqueClasses([...candidate.requirements, required]),
-                });
-            }
-        }
-        return uniqueCandidates(result);
-    }
-    #applyEndpoint(candidates, accepts) {
-        const result = [];
-        for (const candidate of candidates) {
-            if (candidate.kind === 'exact') {
-                if (this.#classSatisfiesEndpoint(candidate.ref, accepts))
-                    result.push(candidate);
                 continue;
             }
-            for (const accept of accepts) {
-                result.push({
-                    kind: 'open',
-                    requirements: uniqueClasses([...candidate.requirements, accept]),
-                });
+            const use = mode === 'object'
+                ? { kind: 'object', object: { kind: 'default' } }
+                : {
+                    kind: 'edge',
+                    source: { kind: 'default' },
+                    target: { kind: 'default' },
+                };
+            if (!typing.branchIsTyped(branch, use)) {
+                context.add('PL_TYPING', `/policies/${escapePointerToken(name)}`, `Expanded normalized branch ${index} has contradictory endpoint or repeat contracts.`);
             }
         }
-        return uniqueCandidates(result);
     }
-    #classSatisfiesEndpoint(candidate, accepts) {
-        return accepts.some((accept) => this.context.classExtends(candidate, accept));
-    }
-}
-function targetContract(term, use) {
-    if (use.kind === 'object')
-        return term === 'object' ? use.object : undefined;
-    if (term === 'source')
-        return use.source;
-    if (term === 'target')
-        return use.target;
-    return undefined;
 }
 export function contractOfNodeDefinition(ref) {
     return { kind: 'exact', ref };
 }
-function edgeAlternatives(edges, typing) {
-    let result = [[]];
-    for (const edge of edges) {
-        const variants = variantsForEdge(edge, typing);
-        if (variants.length === 0)
-            return [];
-        const next = [];
-        for (const prefix of result) {
-            for (const variant of variants)
-                next.push([...prefix, variant]);
-        }
-        result = next;
-    }
-    return result;
-}
-function variantsForEdge(use, typing) {
-    const edge = use.pattern;
-    const declaration = typing.context.edgeDeclaration(edge.class);
-    if (declaration === undefined)
-        return [];
-    const endpoints = declaration.orientation === 'directed'
-        ? [declaration.endpoints.source, declaration.endpoints.target]
-        : declaration.endpoints;
-    const bounds = edge.repeat ?? { min: 1, max: 1 };
-    if (!Number.isInteger(bounds.min) ||
-        !Number.isInteger(bounds.max) ||
-        bounds.min < 0 ||
-        bounds.max < bounds.min ||
-        bounds.max > MAX_REPEAT) {
-        return [];
-    }
-    const sourceKey = termKey(edge.source, use.namespace);
-    const targetKey = termKey(edge.target, use.namespace);
-    const variants = [];
-    for (let length = bounds.min; length <= bounds.max; length++) {
-        if (length === 0) {
-            variants.push({ constraints: [], equalities: [[sourceKey, targetKey]] });
-            continue;
-        }
-        const orientationCount = declaration.orientation === 'undirected' ? 2 ** length : 1;
-        for (let mask = 0; mask < orientationCount; mask++) {
-            const orientations = Array.from({ length }, (_, index) => declaration.orientation === 'undirected' && (mask & (1 << index)) !== 0);
-            let transitionsValid = true;
-            for (let index = 0; index + 1 < length; index++) {
-                const incoming = endEndpoint(endpoints, orientations[index] ?? false);
-                const outgoing = startEndpoint(endpoints, orientations[index + 1] ?? false);
-                if (!typing.endpointsOverlap(incoming.accepts, outgoing.accepts)) {
-                    transitionsValid = false;
-                    break;
-                }
-            }
-            if (!transitionsValid)
-                continue;
-            const first = startEndpoint(endpoints, orientations[0] ?? false);
-            const last = endEndpoint(endpoints, orientations[length - 1] ?? false);
-            variants.push({
-                constraints: [
-                    [sourceKey, first.accepts],
-                    [targetKey, last.accepts],
-                ],
-                equalities: [],
-            });
-        }
-    }
-    return uniqueEdgeVariants(variants);
-}
-function startEndpoint(endpoints, reversed) {
-    return reversed ? endpoints[1] : endpoints[0];
-}
-function endEndpoint(endpoints, reversed) {
-    return reversed ? endpoints[0] : endpoints[1];
-}
-function uniqueEdgeVariants(values) {
-    const result = new Map();
-    for (const value of values) {
-        const key = `${value.constraints
-            .map(([term, accepts]) => `${term}:${accepts.map(definitionRefIndex).sort().join(',')}`)
-            .join('|')}=${value.equalities.map(([left, right]) => `${left}:${right}`).join('|')}`;
-        result.set(key, value);
-    }
-    return [...result.values()];
-}
-function uniqueCandidates(values) {
-    const result = new Map();
-    for (const value of values) {
-        const key = value.kind === 'exact'
-            ? `exact:${definitionRefIndex(value.ref)}`
-            : `open:${value.requirements.map(definitionRefIndex).sort().join('|')}`;
-        result.set(key, value);
-    }
-    return [...result.values()];
-}
-function uniqueClasses(values) {
-    return [...new Map(values.map((value) => [definitionRefIndex(value), value])).values()];
-}
-class UnionFind {
-    #parents = new Map();
-    constructor(values) {
-        for (const value of values)
-            this.add(value);
-    }
-    add(value) {
-        if (!this.#parents.has(value))
-            this.#parents.set(value, value);
-    }
-    find(value) {
-        this.add(value);
-        const parent = this.#parents.get(value);
-        if (parent === value)
-            return value;
-        const root = this.find(parent);
-        this.#parents.set(value, root);
-        return root;
-    }
-    join(left, right) {
-        const a = this.find(left);
-        const b = this.find(right);
-        if (a !== b)
-            this.#parents.set(b, a);
-    }
-}

package/dist/v1/schema/validation/policy/uses.d.ts

@@ -1,5 +1,42 @@
+import type { CallableDefinition } from '../../../language/callable/model/callable.js';
+import type { EdgeContract } from '../../../language/class/model/edge.js';
+import type { PolicyTyping } from '../../../language/policy/analysis/typing.js';
+import type { PolicyCheckExpression } from '../../../language/policy/model/policy.js';
+import type { JsonSchema } from '../../../language/value/model/schema.js';
 import type { PolicyValidationContext } from './context.js';
-import { type PolicyTyping } from './typing.js';
-export declare function validateReadUses(context: PolicyValidationContext, typing: PolicyTyping): void;
-export declare function validateTraverseUses(context: PolicyValidationContext, typing: PolicyTyping): void;
+import { type ClassRef } from '../../../addressing/index.js';
+interface CheckContext {
+    readonly site: keyof typeof SITE;
+    readonly pointer: string;
+    readonly input: JsonSchema;
+    /** The Node Class that receives the call, which the checks name `self`; none, and none is named. */
+    readonly receiver?: ClassRef;
+    /** In an Edge Class rule, the Edge `self` names, in place of a receiver. */
+    readonly edge?: EdgeUse;
+}
+/** One Edge Class, whose declaration fixes the concrete Node Classes of its endpoints. */
+interface EdgeUse {
+    readonly ref: ClassRef;
+    readonly declaration: EdgeContract;
+}
+/** How a refusal names the checks of each site and the contract of their objects. */
+export declare const SITE: {
+    readonly callable: {
+        readonly checks: 'Callable checks';
+        readonly objects: 'the callable object contract';
+    };
+    readonly class: {
+        readonly checks: 'Class rule checks';
+        readonly objects: 'the Class rule object contract';
+    };
+};
+/** Type every Class slot: its Policy against the instance it decides, or its Policy checks. */
+export declare function validateClassUses(context: PolicyValidationContext, typing: PolicyTyping): void;
 export declare function validateCallableUses(context: PolicyValidationContext, typing: PolicyTyping): void;
+/**
+ * Validate the Policy of one callable contract written at `pointer`, wherever it is declared:
+ * `self` names the Node of the `receiver` Class, and nothing where the call has no receiver.
+ */
+export declare function validateContractPolicy(context: PolicyValidationContext, typing: PolicyTyping, contract: CallableDefinition, pointer: string, receiver: ClassRef | undefined): void;
+export declare function validateChecks(validation: PolicyValidationContext, typing: PolicyTyping, expression: PolicyCheckExpression, context: CheckContext): void;
+export {};