@ball-lang/cli 1.42.0 → 1.43.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli_core.d.ts +16 -0
- package/dist/cli_core.d.ts.map +1 -1
- package/dist/cli_core.js +144 -1
- package/dist/cli_core.js.map +1 -1
- package/dist/compiled_cli.d.ts +64 -0
- package/dist/compiled_cli.d.ts.map +1 -1
- package/dist/compiled_cli.js +1574 -7
- package/dist/compiled_cli.js.map +1 -1
- package/dist/index.js +18 -6
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
- package/src/cli_core.ts +159 -3
- package/src/compiled_cli.ts +1571 -7
- package/src/index.ts +25 -12
- package/dist/capability_analyzer.d.ts +0 -123
- package/dist/capability_analyzer.d.ts.map +0 -1
- package/dist/capability_analyzer.js +0 -314
- package/dist/capability_analyzer.js.map +0 -1
- package/dist/capability_table.d.ts +0 -24
- package/dist/capability_table.d.ts.map +0 -1
- package/dist/capability_table.js +0 -337
- package/dist/capability_table.js.map +0 -1
- package/src/capability_analyzer.ts +0 -470
- package/src/capability_table.ts +0 -382
package/src/index.ts
CHANGED
|
@@ -12,12 +12,13 @@
|
|
|
12
12
|
import { readFileSync, writeFileSync } from 'node:fs';
|
|
13
13
|
import { fileURLToPath } from 'node:url';
|
|
14
14
|
import { dirname, join } from 'node:path';
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
15
|
+
// `audit` now self-hosts through the compiled cli-core (issue #362): its
|
|
16
|
+
// capability + termination analyzers are compiled from `cli_core.dart` into
|
|
17
|
+
// `compiled_cli.ts`, so it imports `./cli_core.ts` lazily inside `cmdAudit`
|
|
18
|
+
// (like the other self-hosted verbs) rather than a hand-ported analyzer. Only
|
|
19
|
+
// the `Program` type is needed at the top level, and `import type` is erased at
|
|
20
|
+
// runtime so it never triggers the compiled artifact's module-load side effect.
|
|
21
|
+
import type { Program } from './cli_core.ts';
|
|
21
22
|
|
|
22
23
|
// `@ball-lang/engine` (compiled_engine.ts) and `./cli_core.ts`
|
|
23
24
|
// (compiled_cli.ts) are BOTH auto-generated by compiling a self-hosted Ball
|
|
@@ -289,7 +290,7 @@ async function cmdVersion(): Promise<number> {
|
|
|
289
290
|
return 0;
|
|
290
291
|
}
|
|
291
292
|
|
|
292
|
-
function cmdAudit(args: ParsedArgs): number {
|
|
293
|
+
async function cmdAudit(args: ParsedArgs): Promise<number> {
|
|
293
294
|
const programPath = args.positional[0];
|
|
294
295
|
if (!programPath) {
|
|
295
296
|
process.stderr.write('ball: audit requires a program path\n\n');
|
|
@@ -297,9 +298,10 @@ function cmdAudit(args: ParsedArgs): number {
|
|
|
297
298
|
return 1;
|
|
298
299
|
}
|
|
299
300
|
|
|
300
|
-
const
|
|
301
|
+
const cliCore: CliCoreModule = await import('./cli_core.ts');
|
|
302
|
+
const program = loadProgram(programPath) as Program;
|
|
301
303
|
const reachableOnly = args.flags['reachable-only'] === true;
|
|
302
|
-
const report = analyzeCapabilities(program, { reachableOnly });
|
|
304
|
+
const report = cliCore.analyzeCapabilities(program, { reachableOnly });
|
|
303
305
|
|
|
304
306
|
const denyRaw = args.flags['deny'];
|
|
305
307
|
const denySet =
|
|
@@ -325,12 +327,23 @@ function cmdAudit(args: ParsedArgs): number {
|
|
|
325
327
|
const asJson = args.flags['json'] === true;
|
|
326
328
|
if (asJson) {
|
|
327
329
|
process.stdout.write(JSON.stringify(report, null, 2) + '\n');
|
|
330
|
+
} else if (reachableOnly) {
|
|
331
|
+
// Scoped text report: the capability report over the reachable closure
|
|
332
|
+
// only (auditReport always analyzes the whole program, so it can't render
|
|
333
|
+
// the `--reachable-only` view).
|
|
334
|
+
process.stdout.write(cliCore.formatCapabilityReport(report));
|
|
328
335
|
} else {
|
|
329
|
-
|
|
336
|
+
// Default `ball audit <path>`: the full self-hosted report — capability
|
|
337
|
+
// analysis PLUS termination analysis — byte-identical to the native Dart
|
|
338
|
+
// CLI's default fast path (`cli_core.auditReport`), which the subprocess
|
|
339
|
+
// parity gate (test/cli_core_parity.test.ts) locks. Emitting only the
|
|
340
|
+
// capability report here silently dropped the self-hosted termination
|
|
341
|
+
// section the native CLI includes.
|
|
342
|
+
process.stdout.write(cliCore.auditReport(program));
|
|
330
343
|
}
|
|
331
344
|
|
|
332
345
|
if (denySet.size > 0) {
|
|
333
|
-
const violations = checkPolicy(report, denySet);
|
|
346
|
+
const violations = cliCore.checkPolicy(report, denySet);
|
|
334
347
|
if (violations.length > 0) {
|
|
335
348
|
process.stderr.write('\nPolicy violations:\n');
|
|
336
349
|
for (const v of violations) process.stderr.write(` - ${v}\n`);
|
|
@@ -366,7 +379,7 @@ async function main(argv: string[]): Promise<number> {
|
|
|
366
379
|
case 'tree':
|
|
367
380
|
return await cmdTree(args);
|
|
368
381
|
case 'audit':
|
|
369
|
-
return cmdAudit(args);
|
|
382
|
+
return await cmdAudit(args);
|
|
370
383
|
case 'version':
|
|
371
384
|
return await cmdVersion();
|
|
372
385
|
case undefined:
|
|
@@ -1,123 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Static capability analysis for Ball programs.
|
|
3
|
-
*
|
|
4
|
-
* Walks the expression tree of every function in a Program and reports
|
|
5
|
-
* which base functions are called, categorized by side-effect capability.
|
|
6
|
-
* Since every side effect in Ball flows through a named base function,
|
|
7
|
-
* this analysis is provably complete — not heuristic.
|
|
8
|
-
*
|
|
9
|
-
* Ported from `dart/shared/lib/capability_analyzer.dart`.
|
|
10
|
-
*/
|
|
11
|
-
import type { Capability } from './capability_table.ts';
|
|
12
|
-
export interface Program {
|
|
13
|
-
name?: string;
|
|
14
|
-
version?: string;
|
|
15
|
-
modules: Module[];
|
|
16
|
-
entryModule: string;
|
|
17
|
-
entryFunction: string;
|
|
18
|
-
}
|
|
19
|
-
export interface Module {
|
|
20
|
-
name: string;
|
|
21
|
-
functions: FunctionDef[];
|
|
22
|
-
}
|
|
23
|
-
export interface FunctionDef {
|
|
24
|
-
name: string;
|
|
25
|
-
isBase?: boolean;
|
|
26
|
-
body?: Expression;
|
|
27
|
-
}
|
|
28
|
-
export interface Expression {
|
|
29
|
-
call?: FunctionCall;
|
|
30
|
-
literal?: Literal;
|
|
31
|
-
reference?: {
|
|
32
|
-
name: string;
|
|
33
|
-
};
|
|
34
|
-
fieldAccess?: {
|
|
35
|
-
object?: Expression;
|
|
36
|
-
field: string;
|
|
37
|
-
};
|
|
38
|
-
messageCreation?: {
|
|
39
|
-
fields: FieldValuePair[];
|
|
40
|
-
};
|
|
41
|
-
block?: Block;
|
|
42
|
-
lambda?: Lambda;
|
|
43
|
-
}
|
|
44
|
-
export interface FunctionCall {
|
|
45
|
-
module?: string;
|
|
46
|
-
function: string;
|
|
47
|
-
input?: Expression;
|
|
48
|
-
}
|
|
49
|
-
export interface Literal {
|
|
50
|
-
listValue?: {
|
|
51
|
-
elements: Expression[];
|
|
52
|
-
};
|
|
53
|
-
}
|
|
54
|
-
export interface FieldValuePair {
|
|
55
|
-
name: string;
|
|
56
|
-
value: Expression;
|
|
57
|
-
}
|
|
58
|
-
export interface Block {
|
|
59
|
-
statements: Statement[];
|
|
60
|
-
result?: Expression;
|
|
61
|
-
}
|
|
62
|
-
export interface Statement {
|
|
63
|
-
let?: {
|
|
64
|
-
name: string;
|
|
65
|
-
value: Expression;
|
|
66
|
-
};
|
|
67
|
-
expression?: Expression;
|
|
68
|
-
}
|
|
69
|
-
export interface Lambda {
|
|
70
|
-
body: Expression;
|
|
71
|
-
}
|
|
72
|
-
export interface CallSite {
|
|
73
|
-
module: string;
|
|
74
|
-
function: string;
|
|
75
|
-
calleeModule: string;
|
|
76
|
-
calleeFunction: string;
|
|
77
|
-
}
|
|
78
|
-
export interface FunctionCapability {
|
|
79
|
-
module: string;
|
|
80
|
-
function: string;
|
|
81
|
-
capabilities: Capability[];
|
|
82
|
-
}
|
|
83
|
-
export interface CapabilityEntry {
|
|
84
|
-
capability: Capability;
|
|
85
|
-
riskLevel: string;
|
|
86
|
-
callSites: CallSite[];
|
|
87
|
-
}
|
|
88
|
-
export interface CapabilitySummary {
|
|
89
|
-
isPure: boolean;
|
|
90
|
-
readsFilesystem: boolean;
|
|
91
|
-
writesFilesystem: boolean;
|
|
92
|
-
readsStdin: boolean;
|
|
93
|
-
writesStdout: boolean;
|
|
94
|
-
writesStderr: boolean;
|
|
95
|
-
readsEnvironment: boolean;
|
|
96
|
-
controlsProcess: boolean;
|
|
97
|
-
usesMemory: boolean;
|
|
98
|
-
usesTime: boolean;
|
|
99
|
-
usesRandom: boolean;
|
|
100
|
-
usesConcurrency: boolean;
|
|
101
|
-
usesNetwork: boolean;
|
|
102
|
-
totalFunctions: number;
|
|
103
|
-
pureFunctions: number;
|
|
104
|
-
effectfulFunctions: number;
|
|
105
|
-
}
|
|
106
|
-
export interface BallCapabilityReport {
|
|
107
|
-
programName: string;
|
|
108
|
-
programVersion: string;
|
|
109
|
-
capabilities: CapabilityEntry[];
|
|
110
|
-
functions: FunctionCapability[];
|
|
111
|
-
summary: CapabilitySummary;
|
|
112
|
-
}
|
|
113
|
-
export interface AnalyzeOptions {
|
|
114
|
-
/** If true, only analyze functions transitively reachable from the entry. */
|
|
115
|
-
reachableOnly?: boolean;
|
|
116
|
-
}
|
|
117
|
-
/** Analyze a Ball program and return a structured capability report. */
|
|
118
|
-
export declare function analyzeCapabilities(program: Program, options?: AnalyzeOptions): BallCapabilityReport;
|
|
119
|
-
/** Format a capability report as human-readable text. */
|
|
120
|
-
export declare function formatCapabilityReport(report: BallCapabilityReport): string;
|
|
121
|
-
/** Check a report against a deny list. Returns list of violations (empty = pass). */
|
|
122
|
-
export declare function checkPolicy(report: BallCapabilityReport, deny: ReadonlySet<string>): string[];
|
|
123
|
-
//# sourceMappingURL=capability_analyzer.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"capability_analyzer.d.ts","sourceRoot":"","sources":["../src/capability_analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAOxD,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,WAAW,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,eAAe,CAAC,EAAE;QAAE,MAAM,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC;IAC/C,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;CAExC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAC1C,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,CAAC;CAClB;AAID,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAID,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,cAAmB,GAC3B,oBAAoB,CAEtB;AAyPD,yDAAyD;AACzD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CA2D3E;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CACzB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GACxB,MAAM,EAAE,CAWV"}
|
|
@@ -1,314 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Static capability analysis for Ball programs.
|
|
3
|
-
*
|
|
4
|
-
* Walks the expression tree of every function in a Program and reports
|
|
5
|
-
* which base functions are called, categorized by side-effect capability.
|
|
6
|
-
* Since every side effect in Ball flows through a named base function,
|
|
7
|
-
* this analysis is provably complete — not heuristic.
|
|
8
|
-
*
|
|
9
|
-
* Ported from `dart/shared/lib/capability_analyzer.dart`.
|
|
10
|
-
*/
|
|
11
|
-
import { ALL_CAPABILITIES, capabilityRiskLevel, lookupCapability, } from "./capability_table.js";
|
|
12
|
-
/** Analyze a Ball program and return a structured capability report. */
|
|
13
|
-
export function analyzeCapabilities(program, options = {}) {
|
|
14
|
-
return new Analyzer(program, options.reachableOnly ?? false).analyze();
|
|
15
|
-
}
|
|
16
|
-
class Analyzer {
|
|
17
|
-
program;
|
|
18
|
-
reachableOnly;
|
|
19
|
-
fnCaps = new Map();
|
|
20
|
-
capCallSites = new Map();
|
|
21
|
-
baseModules = new Set();
|
|
22
|
-
constructor(program, reachableOnly) {
|
|
23
|
-
this.program = program;
|
|
24
|
-
this.reachableOnly = reachableOnly;
|
|
25
|
-
}
|
|
26
|
-
analyze() {
|
|
27
|
-
this.identifyBaseModules();
|
|
28
|
-
if (this.reachableOnly) {
|
|
29
|
-
this.analyzeReachable();
|
|
30
|
-
}
|
|
31
|
-
else {
|
|
32
|
-
this.analyzeAll();
|
|
33
|
-
}
|
|
34
|
-
return this.buildReport();
|
|
35
|
-
}
|
|
36
|
-
identifyBaseModules() {
|
|
37
|
-
for (const mod of this.program.modules) {
|
|
38
|
-
if (mod.functions.length === 0)
|
|
39
|
-
continue;
|
|
40
|
-
const allBase = mod.functions.every((f) => f.isBase === true);
|
|
41
|
-
if (allBase)
|
|
42
|
-
this.baseModules.add(mod.name);
|
|
43
|
-
}
|
|
44
|
-
}
|
|
45
|
-
analyzeAll() {
|
|
46
|
-
for (const mod of this.program.modules) {
|
|
47
|
-
if (this.baseModules.has(mod.name))
|
|
48
|
-
continue;
|
|
49
|
-
for (const fn of mod.functions) {
|
|
50
|
-
if (fn.isBase)
|
|
51
|
-
continue;
|
|
52
|
-
const caps = new Set();
|
|
53
|
-
if (fn.body)
|
|
54
|
-
this.walkExpression(fn.body, mod.name, fn.name, caps);
|
|
55
|
-
this.fnCaps.set(`${mod.name}.${fn.name}`, caps);
|
|
56
|
-
}
|
|
57
|
-
}
|
|
58
|
-
}
|
|
59
|
-
analyzeReachable() {
|
|
60
|
-
const visited = new Set();
|
|
61
|
-
const entryKey = `${this.program.entryModule}.${this.program.entryFunction}`;
|
|
62
|
-
this.analyzeFunction(entryKey, visited);
|
|
63
|
-
}
|
|
64
|
-
analyzeFunction(key, visited) {
|
|
65
|
-
if (visited.has(key))
|
|
66
|
-
return;
|
|
67
|
-
visited.add(key);
|
|
68
|
-
const parts = key.split('.');
|
|
69
|
-
// Unreachable: both call sites (the entry key above and the callee key
|
|
70
|
-
// built in walkCall) construct `key` via a template literal with a
|
|
71
|
-
// literal "." join, so it always has at least one dot.
|
|
72
|
-
if (parts.length < 2)
|
|
73
|
-
return;
|
|
74
|
-
const moduleName = parts[0];
|
|
75
|
-
const fnName = parts.slice(1).join('.');
|
|
76
|
-
if (this.baseModules.has(moduleName))
|
|
77
|
-
return;
|
|
78
|
-
for (const mod of this.program.modules) {
|
|
79
|
-
if (mod.name !== moduleName)
|
|
80
|
-
continue;
|
|
81
|
-
for (const fn of mod.functions) {
|
|
82
|
-
if (fn.name !== fnName)
|
|
83
|
-
continue;
|
|
84
|
-
if (fn.isBase)
|
|
85
|
-
return;
|
|
86
|
-
const caps = new Set();
|
|
87
|
-
const callees = new Set();
|
|
88
|
-
if (fn.body) {
|
|
89
|
-
this.walkExpression(fn.body, moduleName, fnName, caps, callees);
|
|
90
|
-
}
|
|
91
|
-
this.fnCaps.set(key, caps);
|
|
92
|
-
for (const callee of callees) {
|
|
93
|
-
this.analyzeFunction(callee, visited);
|
|
94
|
-
const calleeCaps = this.fnCaps.get(callee);
|
|
95
|
-
if (calleeCaps)
|
|
96
|
-
for (const c of calleeCaps)
|
|
97
|
-
caps.add(c);
|
|
98
|
-
}
|
|
99
|
-
return;
|
|
100
|
-
}
|
|
101
|
-
}
|
|
102
|
-
}
|
|
103
|
-
walkExpression(expr, ctxModule, ctxFunction, caps, callees) {
|
|
104
|
-
if (expr.call) {
|
|
105
|
-
this.walkCall(expr.call, ctxModule, ctxFunction, caps, callees);
|
|
106
|
-
return;
|
|
107
|
-
}
|
|
108
|
-
if (expr.literal) {
|
|
109
|
-
if (expr.literal.listValue) {
|
|
110
|
-
for (const elem of expr.literal.listValue.elements) {
|
|
111
|
-
this.walkExpression(elem, ctxModule, ctxFunction, caps, callees);
|
|
112
|
-
}
|
|
113
|
-
}
|
|
114
|
-
return;
|
|
115
|
-
}
|
|
116
|
-
if (expr.block) {
|
|
117
|
-
for (const stmt of expr.block.statements) {
|
|
118
|
-
if (stmt.let) {
|
|
119
|
-
this.walkExpression(stmt.let.value, ctxModule, ctxFunction, caps, callees);
|
|
120
|
-
}
|
|
121
|
-
if (stmt.expression) {
|
|
122
|
-
this.walkExpression(stmt.expression, ctxModule, ctxFunction, caps, callees);
|
|
123
|
-
}
|
|
124
|
-
}
|
|
125
|
-
if (expr.block.result) {
|
|
126
|
-
this.walkExpression(expr.block.result, ctxModule, ctxFunction, caps, callees);
|
|
127
|
-
}
|
|
128
|
-
return;
|
|
129
|
-
}
|
|
130
|
-
if (expr.lambda) {
|
|
131
|
-
this.walkExpression(expr.lambda.body, ctxModule, ctxFunction, caps, callees);
|
|
132
|
-
return;
|
|
133
|
-
}
|
|
134
|
-
if (expr.messageCreation) {
|
|
135
|
-
for (const field of expr.messageCreation.fields) {
|
|
136
|
-
this.walkExpression(field.value, ctxModule, ctxFunction, caps, callees);
|
|
137
|
-
}
|
|
138
|
-
return;
|
|
139
|
-
}
|
|
140
|
-
if (expr.fieldAccess?.object) {
|
|
141
|
-
this.walkExpression(expr.fieldAccess.object, ctxModule, ctxFunction, caps, callees);
|
|
142
|
-
return;
|
|
143
|
-
}
|
|
144
|
-
// reference or unset: nothing to walk
|
|
145
|
-
}
|
|
146
|
-
walkCall(call, ctxModule, ctxFunction, caps, callees) {
|
|
147
|
-
const moduleName = call.module && call.module.length > 0 ? call.module : ctxModule;
|
|
148
|
-
const fnName = call.function;
|
|
149
|
-
const cap = lookupCapability(moduleName, fnName);
|
|
150
|
-
if (cap !== undefined) {
|
|
151
|
-
caps.add(cap);
|
|
152
|
-
if (cap !== 'pure') {
|
|
153
|
-
const list = this.capCallSites.get(cap) ?? [];
|
|
154
|
-
list.push({
|
|
155
|
-
module: ctxModule,
|
|
156
|
-
function: ctxFunction,
|
|
157
|
-
calleeModule: moduleName,
|
|
158
|
-
calleeFunction: fnName,
|
|
159
|
-
});
|
|
160
|
-
this.capCallSites.set(cap, list);
|
|
161
|
-
}
|
|
162
|
-
}
|
|
163
|
-
else {
|
|
164
|
-
callees?.add(`${moduleName}.${fnName}`);
|
|
165
|
-
}
|
|
166
|
-
if (call.input) {
|
|
167
|
-
this.walkExpression(call.input, ctxModule, ctxFunction, caps, callees);
|
|
168
|
-
}
|
|
169
|
-
}
|
|
170
|
-
buildReport() {
|
|
171
|
-
const allCaps = new Set();
|
|
172
|
-
let totalFns = 0;
|
|
173
|
-
let pureFns = 0;
|
|
174
|
-
let effectfulFns = 0;
|
|
175
|
-
const functions = [];
|
|
176
|
-
for (const [key, caps] of this.fnCaps) {
|
|
177
|
-
const dot = key.indexOf('.');
|
|
178
|
-
const mod = key.substring(0, dot);
|
|
179
|
-
const fn = key.substring(dot + 1);
|
|
180
|
-
functions.push({
|
|
181
|
-
module: mod,
|
|
182
|
-
function: fn,
|
|
183
|
-
capabilities: Array.from(caps),
|
|
184
|
-
});
|
|
185
|
-
for (const c of caps)
|
|
186
|
-
allCaps.add(c);
|
|
187
|
-
totalFns++;
|
|
188
|
-
const onlyPure = Array.from(caps).every((c) => c === 'pure');
|
|
189
|
-
if (onlyPure)
|
|
190
|
-
pureFns++;
|
|
191
|
-
else
|
|
192
|
-
effectfulFns++;
|
|
193
|
-
}
|
|
194
|
-
const capabilities = [];
|
|
195
|
-
for (const cap of ALL_CAPABILITIES) {
|
|
196
|
-
if (!allCaps.has(cap) && cap !== 'pure')
|
|
197
|
-
continue;
|
|
198
|
-
const sites = this.capCallSites.get(cap) ?? [];
|
|
199
|
-
if (cap === 'pure' && sites.length === 0 && allCaps.has(cap)) {
|
|
200
|
-
capabilities.push({
|
|
201
|
-
capability: cap,
|
|
202
|
-
riskLevel: capabilityRiskLevel[cap],
|
|
203
|
-
callSites: [],
|
|
204
|
-
});
|
|
205
|
-
continue;
|
|
206
|
-
}
|
|
207
|
-
if (sites.length > 0) {
|
|
208
|
-
capabilities.push({
|
|
209
|
-
capability: cap,
|
|
210
|
-
riskLevel: capabilityRiskLevel[cap],
|
|
211
|
-
callSites: sites.slice(),
|
|
212
|
-
});
|
|
213
|
-
}
|
|
214
|
-
}
|
|
215
|
-
const ioSites = this.capCallSites.get('io') ?? [];
|
|
216
|
-
const summary = {
|
|
217
|
-
isPure: Array.from(allCaps).every((c) => c === 'pure'),
|
|
218
|
-
readsFilesystem: allCaps.has('fs'),
|
|
219
|
-
writesFilesystem: allCaps.has('fs'),
|
|
220
|
-
readsStdin: ioSites.some((s) => s.calleeFunction === 'read_line'),
|
|
221
|
-
writesStdout: ioSites.some((s) => s.calleeFunction === 'print' || s.calleeFunction === 'print_error'),
|
|
222
|
-
writesStderr: ioSites.some((s) => s.calleeFunction === 'print_error'),
|
|
223
|
-
readsEnvironment: ioSites.some((s) => s.calleeFunction === 'env_get' || s.calleeFunction === 'args_get'),
|
|
224
|
-
controlsProcess: allCaps.has('process'),
|
|
225
|
-
usesMemory: allCaps.has('memory'),
|
|
226
|
-
usesTime: allCaps.has('time'),
|
|
227
|
-
usesRandom: allCaps.has('random'),
|
|
228
|
-
usesConcurrency: allCaps.has('concurrency'),
|
|
229
|
-
usesNetwork: allCaps.has('network'),
|
|
230
|
-
totalFunctions: totalFns,
|
|
231
|
-
pureFunctions: pureFns,
|
|
232
|
-
effectfulFunctions: effectfulFns,
|
|
233
|
-
};
|
|
234
|
-
return {
|
|
235
|
-
programName: this.program.name ?? '',
|
|
236
|
-
programVersion: this.program.version ?? '',
|
|
237
|
-
capabilities,
|
|
238
|
-
functions,
|
|
239
|
-
summary,
|
|
240
|
-
};
|
|
241
|
-
}
|
|
242
|
-
}
|
|
243
|
-
// ── Formatting & policy helpers ─────────────────────────────────────────────
|
|
244
|
-
/** Format a capability report as human-readable text. */
|
|
245
|
-
export function formatCapabilityReport(report) {
|
|
246
|
-
const lines = [];
|
|
247
|
-
const name = report.programName || '<unnamed>';
|
|
248
|
-
const version = report.programVersion || '0.0.0';
|
|
249
|
-
lines.push(`Ball Capability Audit: ${name} v${version}`);
|
|
250
|
-
lines.push('='.repeat(60));
|
|
251
|
-
lines.push('');
|
|
252
|
-
lines.push('Capabilities:');
|
|
253
|
-
for (const entry of report.capabilities) {
|
|
254
|
-
const icon = entry.riskLevel === 'none' ? '\u2713' : '\u26A0';
|
|
255
|
-
const siteCount = entry.callSites.length;
|
|
256
|
-
if (siteCount === 0) {
|
|
257
|
-
lines.push(` ${icon} ${entry.capability} (pure computation)`);
|
|
258
|
-
}
|
|
259
|
-
else {
|
|
260
|
-
const sites = entry.callSites
|
|
261
|
-
.map((s) => `${s.module}.${s.function} \u2192 ${s.calleeModule}.${s.calleeFunction}`)
|
|
262
|
-
.join(', ');
|
|
263
|
-
lines.push(` ${icon} ${entry.capability} (${siteCount} call sites: ${sites})`);
|
|
264
|
-
}
|
|
265
|
-
}
|
|
266
|
-
const absent = [];
|
|
267
|
-
const s = report.summary;
|
|
268
|
-
if (!s.readsFilesystem && !s.writesFilesystem)
|
|
269
|
-
absent.push('filesystem');
|
|
270
|
-
if (!s.usesNetwork)
|
|
271
|
-
absent.push('network');
|
|
272
|
-
if (!s.controlsProcess)
|
|
273
|
-
absent.push('process');
|
|
274
|
-
if (!s.usesMemory)
|
|
275
|
-
absent.push('memory');
|
|
276
|
-
if (!s.usesConcurrency)
|
|
277
|
-
absent.push('concurrency');
|
|
278
|
-
if (!s.usesRandom)
|
|
279
|
-
absent.push('random');
|
|
280
|
-
if (absent.length > 0) {
|
|
281
|
-
lines.push(` \u2717 NONE: ${absent.join(', ')}`);
|
|
282
|
-
}
|
|
283
|
-
lines.push('');
|
|
284
|
-
const risk = s.isPure
|
|
285
|
-
? 'NO RISK \u2014 pure computation only'
|
|
286
|
-
: s.controlsProcess || s.usesMemory || s.usesNetwork
|
|
287
|
-
? 'HIGH RISK'
|
|
288
|
-
: s.readsFilesystem || s.writesFilesystem || s.usesConcurrency
|
|
289
|
-
? 'MEDIUM RISK'
|
|
290
|
-
: 'LOW RISK';
|
|
291
|
-
lines.push(`Summary: ${risk}`);
|
|
292
|
-
lines.push(` ${s.totalFunctions} functions: ${s.pureFunctions} pure, ${s.effectfulFunctions} effectful`);
|
|
293
|
-
lines.push('');
|
|
294
|
-
lines.push('Per-function breakdown:');
|
|
295
|
-
for (const fn of report.functions) {
|
|
296
|
-
const caps = fn.capabilities.filter((c) => c !== 'pure');
|
|
297
|
-
const label = caps.length === 0 ? 'pure' : caps.join(', ');
|
|
298
|
-
lines.push(` ${fn.module}.${fn.function} \u2192 ${label}`);
|
|
299
|
-
}
|
|
300
|
-
return lines.join('\n') + '\n';
|
|
301
|
-
}
|
|
302
|
-
/** Check a report against a deny list. Returns list of violations (empty = pass). */
|
|
303
|
-
export function checkPolicy(report, deny) {
|
|
304
|
-
const violations = [];
|
|
305
|
-
for (const entry of report.capabilities) {
|
|
306
|
-
if (!deny.has(entry.capability))
|
|
307
|
-
continue;
|
|
308
|
-
for (const site of entry.callSites) {
|
|
309
|
-
violations.push(`${entry.capability}: ${site.module}.${site.function} calls ${site.calleeModule}.${site.calleeFunction}`);
|
|
310
|
-
}
|
|
311
|
-
}
|
|
312
|
-
return violations;
|
|
313
|
-
}
|
|
314
|
-
//# sourceMappingURL=capability_analyzer.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"capability_analyzer.js","sourceRoot":"","sources":["../src/capability_analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AA0H/B,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,UAA0B,EAAE;IAE5B,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,QAAQ;IACK,OAAO,CAAU;IACjB,aAAa,CAAU;IACvB,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjD,YAAY,OAAgB,EAAE,aAAsB;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,mBAAmB;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACzC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;YAC9D,IAAI,OAAO;gBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7C,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAC/B,IAAI,EAAE,CAAC,MAAM;oBAAE,SAAS;gBACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAc,CAAC;gBACnC,IAAI,EAAE,CAAC,IAAI;oBAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEO,eAAe,CAAC,GAAW,EAAE,OAAoB;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,uEAAuE;QACvE,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO;QAE7C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;gBAAE,SAAS;YACtC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAC/B,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAS;gBACjC,IAAI,EAAE,CAAC,MAAM;oBAAE,OAAO;gBACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAc,CAAC;gBACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;gBAClC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;oBACZ,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC3C,IAAI,UAAU;wBAAE,KAAK,MAAM,CAAC,IAAI,UAAU;4BAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,IAAgB,EAChB,SAAiB,EACjB,WAAmB,EACnB,IAAqB,EACrB,OAAqB;QAErB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;oBACnD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAChF,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;gBAChD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,sCAAsC;IACxC,CAAC;IAEO,QAAQ,CACd,IAAkB,EAClB,SAAiB,EACjB,WAAmB,EACnB,IAAqB,EACrB,OAAqB;QAErB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC;oBACR,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,WAAW;oBACrB,YAAY,EAAE,UAAU;oBACxB,cAAc,EAAE,MAAM;iBACvB,CAAC,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,GAAG,CAAC,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;QACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,MAAM,SAAS,GAAyB,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC;gBACb,MAAM,EAAE,GAAG;gBACX,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;aAC/B,CAAC,CAAC;YAEH,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrC,QAAQ,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBAAE,OAAO,EAAE,CAAC;;gBACnB,YAAY,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,YAAY,GAAsB,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,MAAM;gBAAE,SAAS;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,YAAY,CAAC,IAAI,CAAC;oBAChB,UAAU,EAAE,GAAG;oBACf,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC;oBACnC,SAAS,EAAE,EAAE;iBACd,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,YAAY,CAAC,IAAI,CAAC;oBAChB,UAAU,EAAE,GAAG;oBACf,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;YACtD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACnC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC;YACjE,YAAY,EAAE,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,IAAI,CAAC,CAAC,cAAc,KAAK,aAAa,CAC1E;YACD,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,aAAa,CAAC;YACrE,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,KAAK,UAAU,CACzE;YACD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAC7B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAC3C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YACnC,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,OAAO;YACtB,kBAAkB,EAAE,YAAY;SACjC,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;YACpC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE;YAC1C,YAAY;YACZ,SAAS;YACT,OAAO;SACR,CAAC;IACJ,CAAC;CACF;AAED,+EAA+E;AAE/E,yDAAyD;AACzD,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,WAAW,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,OAAO,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,qBAAqB,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS;iBAC1B,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,cAAc,EAAE,CAC3E;iBACA,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,gBAAgB,KAAK,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,gBAAgB;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,CAAC,eAAe;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,eAAe;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,CAAC,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM;QACnB,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW;YACpD,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe;gBAC9D,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,UAAU,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,CAAC,cAAc,eAAe,CAAC,CAAC,aAAa,UAAU,CAAC,CAAC,kBAAkB,YAAY,CAC9F,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,QAAQ,WAAW,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CACzB,MAA4B,EAC5B,IAAyB;IAEzB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CACb,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,cAAc,EAAE,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
|
|
@@ -1,24 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Static mapping of every Ball base function to its capability category.
|
|
3
|
-
*
|
|
4
|
-
* Since every side effect in Ball flows through a named base function in a
|
|
5
|
-
* known module, this table is provably complete. No function can perform I/O,
|
|
6
|
-
* access the filesystem, or spawn threads without appearing here.
|
|
7
|
-
*
|
|
8
|
-
* Ported from `dart/shared/lib/capability_table.dart`.
|
|
9
|
-
*/
|
|
10
|
-
/** Capability categories for Ball base functions. */
|
|
11
|
-
export type Capability = 'pure' | 'io' | 'fs' | 'process' | 'time' | 'random' | 'memory' | 'concurrency' | 'network' | 'async';
|
|
12
|
-
/** Canonical ordering of capabilities (matches the Dart enum order). */
|
|
13
|
-
export declare const ALL_CAPABILITIES: readonly Capability[];
|
|
14
|
-
/** Risk level associated with each capability. */
|
|
15
|
-
export declare const capabilityRiskLevel: Record<Capability, string>;
|
|
16
|
-
/**
|
|
17
|
-
* Lookup the capability of a base function call.
|
|
18
|
-
*
|
|
19
|
-
* Returns `undefined` for non-base / user-defined functions (which are pure
|
|
20
|
-
* by construction — they can only call other functions in this table).
|
|
21
|
-
*/
|
|
22
|
-
export declare function lookupCapability(module: string, fn: string): Capability | undefined;
|
|
23
|
-
export declare const CAPABILITY_TABLE: Readonly<Record<string, Capability>>;
|
|
24
|
-
//# sourceMappingURL=capability_table.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"capability_table.d.ts","sourceRoot":"","sources":["../src/capability_table.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,IAAI,GACJ,IAAI,GACJ,SAAS,GACT,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,SAAS,GACT,OAAO,CAAC;AAEZ,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAWjD,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAW1D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,UAAU,GAAG,SAAS,CAExB;AAED,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CA6TjE,CAAC"}
|