@githonllc/avouch 0.1.5 → 0.1.6

package/SPEC.md

@@ -308,13 +308,13 @@ Types:
 | 3 | `expected` is `null` | `cannot_reconcile`, `expectation_missing` |
 | 4 | `snapshot` is `null` | `cannot_reconcile`, `snapshot_missing` |
 | 5 | `decide(ont, action, snapshot, scope, bindings, actor, now)` throws | `cannot_reconcile`, `evaluator_error`; `detail` is the error message |
-| 6 | `reported.result` is neither an invocation result (`INVOCATION_RESULTS`) nor the `result` of a decision row or of `otherwise` of this action | `cannot_reconcile`, `runtime_unmapped`; `detail` is `reported.result` |
+| 6 | `reported.result` is `SCOPE_DENIED`, or is neither an invocation result (`INVOCATION_RESULTS`) nor the `result` of a decision row or of `otherwise` of this action | `cannot_reconcile`, `runtime_unmapped`; `detail` is `reported.result` |
 | 7 | the result is INDETERMINATE | `cannot_reconcile`, `indeterminate`; `detail` is its reason |
 | 8 | otherwise: `evaluator` is `externalResult` of the result without `param` (a domain result is `{result}`; `INVALID_BINDING` keeps `reason`) | `match` with `result = evaluator` when the three results are pairwise equal; else `mismatch` |
 
 Two `Reported` values are equal when `result` is equal and `reason` is equal (both absent counts as equal).
 
-A missing runtime result is never filled in from the decision table; neither is a missing expectation. The evaluator result is computed only to compare. Envelope results are not reconciled: the evaluator does not implement the envelope, and a replay does not recompute domain conditions, so a replay is not a new decision. An action without a decision table gives no domain result, so every reported result other than an invocation result is unmapped for it.
+A missing runtime result is never filled in from the decision table; neither is a missing expectation. The evaluator result is computed only to compare. Envelope results are not reconciled: the evaluator does not implement the envelope, and a replay does not recompute domain conditions, so a replay is not a new decision. An action without a decision table gives no domain result, so every reported result other than `INVALID_BINDING` and `PERMISSION_DENIED` is unmapped for it (envelope results stop at step 1).
 
 Once an invocation is inside the domain path of an action with a decision table, the runtime must report the domain result explicitly. A coarse signal, such as the status of a receipt, must not stand in for it: a coarse value can share a name with the expected result and give a false match. `runtime_missing` (nothing reported) and `runtime_unmapped` (a value the action cannot give) record the two ways this evidence fails.
 
@@ -330,7 +330,7 @@ The physical type mapping is checked here: the profile supplies `decode`, which
 
 ### Existence is not revealed
 
-`SCOPE_DENIED` is internal. `externalResult` maps it and `INVALID_BINDING` `not_found` to one value, `{result: INVALID_BINDING, param, reason: not_found}`, so a caller cannot learn that an id exists in another tenant. Other reasons, such as `type`, are reported as they are.
+`SCOPE_DENIED` is internal. `externalResult` maps it and `INVALID_BINDING` `not_found` to one value, `{result: INVALID_BINDING, param, reason: not_found}`, so a caller cannot learn that an id exists in another tenant. Other reasons, such as `type`, are reported as they are. A runtime must not report `SCOPE_DENIED`; `reconcile` gives `runtime_unmapped` for it.
 
 ### Known limit
 

package/dist/src/expr.js

@@ -9,6 +9,7 @@ export const EXPR_NODES = [
 export const DISPOSITION_CLASSES = ["rejected", "recorded", "pending", "applied"];
 // The fixed invocation result set of the format. The first two belong to the idempotency envelope. A disposition id may
 // not be one of these names.
+// Every invocation-layer result, SCOPE_DENIED included. SCOPE_DENIED is internal and never reported (SPEC section 9).
 export const INVOCATION_RESULTS = ["REPLAYED", "IDEMPOTENCY_CONFLICT", "INVALID_BINDING", "SCOPE_DENIED", "PERMISSION_DENIED"];
 export class ExprError extends Error {
     path;

package/dist/src/reconcile.d.ts

@@ -50,4 +50,5 @@ export declare function projectSnapshot(ont: Stage1Ontology, stores: Readonly<Re
     snapshot: Snapshot;
     defects: TypeDefect[];
 };
+export declare function domainResults(ont: Stage1Ontology, actionId: string): readonly string[];
 export declare function reconcile(ont: Stage1Ontology, cases: readonly RuntimeCase[]): ReconcileRow[];

package/dist/src/reconcile.js

@@ -35,12 +35,21 @@ export function projectSnapshot(ont, stores, decode) {
 const same = (a, b) => a.result === b.result && a.reason === b.reason;
 const ENVELOPE = ["REPLAYED", "IDEMPOTENCY_CONFLICT"];
 const INVOCATION = INVOCATION_RESULTS;
-// The results a runtime may report for an action: the invocation results and the results its decision table gives.
-function mapped(ont, action, result) {
-    if (INVOCATION.includes(result))
-        return true;
-    const decision = own(ont.actionTypes, action)?.decision;
-    return (decision?.rows ?? []).some((r) => r.result === result) || decision?.otherwise?.result === result;
+// The domain results of an action: each distinct result of its decision rows, in row order, then of otherwise.
+// An action without a decision table gives none. Names only; the class is ont.dispositions[name].class. For an ontology
+// that passes the check, every name is a key of dispositions and none is an invocation result (R1).
+export function domainResults(ont, actionId) {
+    const action = own(ont.actionTypes, actionId);
+    if (action === undefined)
+        throw new Error(`unknown action ${actionId}`);
+    const names = [];
+    for (const r of action.decision?.rows ?? [])
+        if (!names.includes(r.result))
+            names.push(r.result);
+    const o = action.decision?.otherwise;
+    if (o !== undefined && !names.includes(o.result))
+        names.push(o.result);
+    return names;
 }
 // One row per case, in input order. The evaluator result is computed only to compare: a missing runtime result or
 // expectation is reported as such, never filled in from the decision table. Envelope results are not decisions (the
@@ -67,7 +76,9 @@ export function reconcile(ont, cases) {
         catch (e) {
             return cannot("evaluator_error", e instanceof Error ? e.message : String(e));
         }
-        if (!mapped(ont, c.action, reported.result))
+        // SCOPE_DENIED is internal (SPEC section 9, Existence is not revealed): never a reportable result.
+        const reportable = reported.result !== "SCOPE_DENIED" && (INVOCATION.includes(reported.result) || domainResults(ont, c.action).includes(reported.result));
+        if (!reportable)
             return cannot("runtime_unmapped", reported.result);
         if (d.layer === "indeterminate")
             return cannot("indeterminate", d.reason);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githonllc/avouch",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",