@glubean/sdk 0.1.39 → 0.2.1

package/dist/contract-core.js

@@ -0,0 +1,749 @@
+/**
+ * Protocol-agnostic contract core.
+ *
+ * Provides:
+ *   - Adapter registry (`_adapters`)
+ *   - `contract.register(protocol, adapter)` — plugin extension point
+ *   - `contract[protocol](id, spec)` dispatcher — validates 1:1 case keys,
+ *     invokes adapter.execute per case, registers tests + ContractRegistryMeta
+ *   - `contract.flow(id)` — protocol-agnostic FlowBuilder
+ *   - `runFlow(flow, ctx)` — core flow execution helper (Rule 1/2 teardown)
+ *   - `normalizeFlow(runtime)` — Runtime → ExtractedFlowProjection
+ *   - Permissive Proxy tracer for `compute` nodes (best-effort reads/writes)
+ *
+ * HTTP is NOT handled here — it registers itself in `./contract-http/`.
+ * This file has zero HTTP-specific code.
+ *
+ * See:
+ *   - `internal/40-discovery/proposals/contract-generics-complete.md` v5
+ *   - `internal/40-discovery/proposals/contract-flow.md` v9
+ */
+import { registerTest } from "./internal.js";
+// =============================================================================
+// Adapter registry
+// =============================================================================
+const _adapters = new Map();
+/** Internal accessor for plugins / downstream (scanner, runner). */
+export function getAdapter(protocol) {
+    return _adapters.get(protocol);
+}
+// =============================================================================
+// contract.register + dispatcher
+// =============================================================================
+const RESERVED_PROTOCOL_NAMES = new Set([
+    "register",
+    "flow",
+    "getAdapter",
+]);
+/**
+ * Register an adapter. Called by built-in HTTP adapter on SDK load, and by
+ * external protocol packages (`@glubean/grpc`, `@glubean/graphql` etc.) on
+ * their import — single-package model, each protocol package owns both
+ * transport + contract adapter.
+ */
+function register(protocol, adapter) {
+    if (RESERVED_PROTOCOL_NAMES.has(protocol)) {
+        throw new Error(`Cannot register reserved protocol name "${protocol}"`);
+    }
+    _adapters.set(protocol, adapter);
+    // Attach contract[protocol] dispatcher dynamically.
+    contract[protocol] = (id, spec) => {
+        return dispatchContract(protocol, adapter, id, spec);
+    };
+}
+/**
+ * Generic contract dispatcher — shared across all protocols.
+ * Called by `contract[protocol](id, spec)` above.
+ */
+function dispatchContract(protocol, adapter, id, spec) {
+    const rawProjection = adapter.project(spec);
+    // Registered protocol name is source of truth — adapters may report a
+    // canonical name that drifts from the registration name.
+    const projection = {
+        ...rawProjection,
+        protocol,
+    };
+    // 1:1 key invariant between spec.cases and projection.cases
+    validateCaseKeys(protocol, spec.cases ?? {}, projection.cases);
+    const cases = spec.cases ?? {};
+    const contractTagsRaw = spec.tags;
+    const contractTags = Array.isArray(contractTagsRaw)
+        ? contractTagsRaw
+        : contractTagsRaw
+            ? [contractTagsRaw]
+            : [];
+    const projCaseMap = new Map(projection.cases.map((c) => [c.key, c]));
+    const tests = Object.entries(cases).map(([caseKey, caseSpec]) => {
+        const testId = `${id}.${caseKey}`;
+        const testName = `${id} — ${caseKey}`;
+        const projCase = projCaseMap.get(caseKey);
+        const caseTags = caseSpec.tags ?? [];
+        const allTags = [...contractTags, ...caseTags];
+        // Projection lifecycle/severity are authoritative
+        const requires = projCase.requires ?? caseSpec.requires ?? "headless";
+        const defaultRun = projCase.defaultRun ?? caseSpec.defaultRun ??
+            (requires !== "headless" ? "opt-in" : "always");
+        const runtimeTags = [];
+        if (requires !== "headless")
+            runtimeTags.push(`requires:${requires}`);
+        if (defaultRun === "opt-in")
+            runtimeTags.push("default-run:opt-in");
+        const finalTags = [...allTags, ...runtimeTags];
+        const skipDeprecated = projCase.lifecycle === "deprecated"
+            ? `deprecated: ${projCase.deprecatedReason ?? caseSpec.deprecated ?? "deprecated"}`
+            : caseSpec.deprecated
+                ? `deprecated: ${caseSpec.deprecated}`
+                : undefined;
+        const skipDeferred = projCase.lifecycle === "deferred"
+            ? (projCase.deferredReason ?? caseSpec.deferred ?? "deferred")
+            : caseSpec.deferred;
+        const testDef = {
+            meta: {
+                id: testId,
+                name: testName,
+                description: projCase.description,
+                tags: finalTags.length > 0 ? finalTags : undefined,
+                deferred: skipDeferred,
+                deprecated: skipDeprecated
+                    ? (projCase.deprecatedReason ?? caseSpec.deprecated ?? "deprecated")
+                    : undefined,
+                requires,
+                defaultRun,
+            },
+            type: "simple",
+            fn: async (ctx) => {
+                if (skipDeprecated)
+                    ctx.skip(skipDeprecated);
+                if (skipDeferred)
+                    ctx.skip(skipDeferred);
+                await adapter.execute(ctx, caseSpec, spec);
+            },
+        };
+        // Build ContractRegistryMeta
+        const payloadSummary = adapter.describePayload
+            ? (() => {
+                // describePayload expects SafeSchemas — we don't have safe form yet,
+                // so pass projCase.schemas as a best-effort (adapters using this in
+                // runtime meta should be tolerant of live objects).
+                try {
+                    return adapter.describePayload((projCase.schemas ?? undefined));
+                }
+                catch {
+                    return undefined;
+                }
+            })()
+            : undefined;
+        const registryMeta = {
+            target: projection.target,
+            protocol: projection.protocol,
+            caseKey,
+            lifecycle: projCase.lifecycle,
+            severity: projCase.severity,
+            instanceName: projection.instanceName,
+            payloadSummary,
+            meta: projCase.meta,
+        };
+        registerTest({
+            id: testId,
+            name: testName,
+            type: "simple",
+            tags: finalTags.length > 0 ? finalTags : undefined,
+            description: projCase.description,
+            groupId: id,
+            requires,
+            defaultRun,
+            contract: registryMeta,
+        });
+        return testDef;
+    });
+    // Core injects id into both _projection and _spec carrier
+    const enrichedProjection = { ...projection, id };
+    const arr = [...tests];
+    const contractObj = Object.assign(arr, {
+        _projection: enrichedProjection,
+        _spec: spec,
+        case(key) {
+            // Delegate fail-fast validation to adapter (e.g. HTTP rejects
+            // function-valued body/params/query/headers).
+            adapter.validateCaseForFlow?.(spec, key, id);
+            return makeContractCaseRef(protocol, id, projection.target, key, contractObj, spec);
+        },
+    });
+    return contractObj;
+}
+function validateCaseKeys(protocol, specCases, projectionCases) {
+    // Duplicate check
+    const keys = projectionCases.map((c) => c.key);
+    const keySet = new Set(keys);
+    if (keySet.size !== keys.length) {
+        const dupes = keys.filter((k, i) => keys.indexOf(k) !== i);
+        throw new Error(`contract.register("${protocol}"): project() returned duplicate case key(s): ${[...new Set(dupes)].join(", ")}. ` +
+            `Each projected case key must be unique.`);
+    }
+    const specKeys = new Set(Object.keys(specCases));
+    for (const key of keySet) {
+        if (!specKeys.has(key)) {
+            throw new Error(`contract.register("${protocol}"): project() returned case "${key}" not present in spec.cases. ` +
+                `Projected cases must 1:1 match spec.cases keys.`);
+        }
+    }
+    for (const key of specKeys) {
+        if (!keySet.has(key)) {
+            throw new Error(`contract.register("${protocol}"): spec.cases has "${key}" but project() did not return it. ` +
+                `Projected cases must 1:1 match spec.cases keys.`);
+        }
+    }
+}
+/**
+ * Construct a ContractCaseRef. Adapters may extend this via module
+ * augmentation if they want stricter typing for their specific I/O shapes.
+ *
+ * This function performs the `function-valued field fail-fast` check
+ * required by contract-flow §5.1.1 — but since the check is
+ * protocol-specific (what counts as an "input slot" varies), adapters
+ * should enforce it in their own `.case()` wrapper if needed. For
+ * built-in HTTP adapter, see `./contract-http/adapter.ts`.
+ */
+function makeContractCaseRef(protocol, contractId, target, caseKey, contract, _spec) {
+    return {
+        __glubean_type: "contract-case-ref",
+        contractId,
+        caseKey,
+        protocol,
+        target,
+        contract,
+    };
+}
+export const contract = {
+    register,
+    flow,
+};
+// =============================================================================
+// Flow: FlowBuilder + runFlow + normalizeFlow + tracePureFn
+// =============================================================================
+/**
+ * Protocol-agnostic flow builder. See contract-flow.md v9 §4.1.
+ */
+export function flow(idOrMeta) {
+    const meta = typeof idOrMeta === "string"
+        ? { id: idOrMeta }
+        : idOrMeta;
+    const steps = [];
+    let setupFn;
+    let teardownFn;
+    let built = false;
+    let extraMeta = {};
+    const builder = {
+        __glubean_type: "flow-builder",
+        meta(m) {
+            extraMeta = { ...extraMeta, ...m };
+            return builder;
+        },
+        setup(fn) {
+            setupFn = fn;
+            return builder;
+        },
+        teardown(fn) {
+            teardownFn = fn;
+            return builder;
+        },
+        step(ref, bindings) {
+            const adapter = _adapters.get(ref.protocol);
+            if (!adapter) {
+                throw new Error(`contract.flow(${JSON.stringify(meta.id)}).step: unknown protocol "${ref.protocol}". ` +
+                    `Did you forget to import a contract plugin package (e.g. "@glubean/grpc")?`);
+            }
+            if (!adapter.executeCaseInFlow) {
+                throw new Error(`contract.flow(${JSON.stringify(meta.id)}).step: adapter for "${ref.protocol}" ` +
+                    `does not implement executeCaseInFlow — this protocol cannot appear in a flow.`);
+            }
+            const step = {
+                kind: "contract-call",
+                name: bindings?.name,
+                ref,
+                caseKey: ref.caseKey,
+                contract: ref.contract,
+                bindings: bindings
+                    ? { in: bindings.in, out: bindings.out }
+                    : undefined,
+            };
+            steps.push(step);
+            return builder;
+        },
+        compute(fn) {
+            const step = {
+                kind: "compute",
+                fn: fn,
+            };
+            steps.push(step);
+            return builder;
+        },
+        build() {
+            return finalize();
+        },
+    };
+    // Auto-finalize via microtask (mirrors TestBuilder pattern)
+    queueMicrotask(() => {
+        if (!built)
+            finalize();
+    });
+    function finalize() {
+        if (built)
+            return builtResult;
+        built = true;
+        const runtime = {
+            protocol: "flow",
+            description: extraMeta.description,
+            tags: extraMeta.tags,
+            extensions: extraMeta.extensions,
+            setup: setupFn,
+            teardown: teardownFn,
+            steps,
+        };
+        // Build the single Test that runFlow orchestrates.
+        const flowTest = {
+            meta: {
+                id: meta.id,
+                name: extraMeta.name ?? meta.id,
+                tags: extraMeta.tags,
+                description: extraMeta.description,
+                // `FlowMeta.skip: string` (the reason) → `TestMeta.deferred: string`
+                // mirrors the ContractCase.deferred convention so downstream
+                // reporters render the skip reason consistently.
+                ...(extraMeta.skip !== undefined ? { deferred: extraMeta.skip } : {}),
+                ...(extraMeta.only !== undefined ? { only: extraMeta.only } : {}),
+            },
+            type: "simple",
+            fn: async (ctx) => {
+                // Belt-and-suspenders: runtime ctx.skip in case the runner didn't
+                // filter on meta.deferred (e.g. the user ran with an explicit
+                // target that bypasses skip filters).
+                if (extraMeta.skip)
+                    ctx.skip(extraMeta.skip);
+                await runFlow(resultHandle, ctx);
+            },
+        };
+        const arr = [flowTest];
+        const runtimeWithId = { ...runtime, id: meta.id };
+        // Pre-compute extracted projection so downstream consumers (scanner,
+        // CLI, MCP, Cloud) get full field mappings + compute reads/writes
+        // without having to import the SDK to call normalizeFlow themselves.
+        const extracted = normalizeFlow(runtimeWithId);
+        const resultHandle = Object.assign(arr, {
+            _flow: runtimeWithId,
+            _extracted: extracted,
+        });
+        // Register flow in the registry
+        const flowRegistryMeta = {
+            id: extracted.id,
+            description: extracted.description,
+            tags: extracted.tags,
+            steps: extracted.steps.map(stepProjectionToRegistry),
+            setupDynamic: extracted.setupDynamic,
+        };
+        registerTest({
+            id: meta.id,
+            name: extraMeta.name ?? meta.id,
+            type: "simple",
+            tags: extraMeta.tags,
+            description: extraMeta.description,
+            flow: flowRegistryMeta,
+        });
+        builtResult = resultHandle;
+        return resultHandle;
+    }
+    let builtResult;
+    return builder;
+}
+function stepProjectionToRegistry(step) {
+    if (step.kind === "compute") {
+        return {
+            kind: "compute",
+            name: step.name,
+            reads: step.reads,
+            writes: step.writes,
+        };
+    }
+    return {
+        kind: "contract-call",
+        name: step.name,
+        contractId: step.contractId,
+        caseKey: step.caseKey,
+        protocol: step.protocol,
+        target: step.target,
+        inputs: step.inputs,
+        outputs: step.outputs,
+    };
+}
+/**
+ * Core flow execution helper. Implements the Rule 1 / Rule 2 teardown
+ * semantics from contract-flow.md §7.
+ */
+export async function runFlow(flowContract, ctx) {
+    const runtime = flowContract._flow;
+    // If flow.setup throws → flow.teardown does NOT run (Rule 2).
+    let state = runtime.setup
+        ? await runtime.setup(ctx)
+        : undefined;
+    try {
+        for (const step of runtime.steps) {
+            if (step.kind === "compute") {
+                // Compute: synchronous pure function. Enforce both syntactic and
+                // value-level async rejection.
+                if (step.fn.constructor?.name === "AsyncFunction") {
+                    throw new Error(`flow "${runtime.id}" compute step "${step.name ?? "<unnamed>"}": ` +
+                        `async functions are not allowed — compute must be synchronous and I/O-free`);
+                }
+                const result = step.fn(state);
+                if (result && typeof result.then === "function") {
+                    throw new Error(`flow "${runtime.id}" compute step "${step.name ?? "<unnamed>"}": ` +
+                        `returned a thenable (Promise or Promise-like) — compute must not return async values. ` +
+                        `If you need async initialization, use flow.setup() instead.`);
+                }
+                state = result;
+                continue;
+            }
+            // contract-call branch
+            const adapter = _adapters.get(step.ref.protocol);
+            if (!adapter) {
+                throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
+                    `no registered adapter for protocol "${step.ref.protocol}". ` +
+                    `Did you forget to import a contract plugin package?`);
+            }
+            if (!adapter.executeCaseInFlow) {
+                throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
+                    `adapter for "${step.ref.protocol}" does not implement executeCaseInFlow`);
+            }
+            const resolvedInputs = step.bindings?.in?.(state);
+            const response = await adapter.executeCaseInFlow({
+                ctx,
+                contract: step.contract,
+                caseKey: step.caseKey,
+                resolvedInputs,
+            });
+            if (step.bindings?.out) {
+                state = step.bindings.out(state, response);
+            }
+        }
+    }
+    finally {
+        if (runtime.teardown) {
+            // flow.teardown runs in Rule 2 outer-finally. Its errors are logged
+            // but must not mask the primary exception.
+            try {
+                await runtime.teardown(ctx, state);
+            }
+            catch (teardownErr) {
+                ctx.log?.(`flow.teardown failed: ${String(teardownErr)}`);
+            }
+        }
+    }
+}
+// =============================================================================
+// normalizeFlow + permissive Proxy tracer
+// =============================================================================
+/**
+ * Normalize a RuntimeFlowProjection to JSON-safe ExtractedFlowProjection.
+ * Runs Proxy dry-run of lens functions to extract FieldMappings.
+ *
+ * Lens purity is enforced here: if a `step.bindings.in` or `.out` lens
+ * violates purity (method call, `new`, etc.), `LensPurityError` is thrown
+ * with step context so the author sees which step needs fixing.
+ */
+export function normalizeFlow(runtime) {
+    return {
+        id: runtime.id,
+        protocol: "flow",
+        description: runtime.description,
+        tags: runtime.tags,
+        extensions: runtime.extensions,
+        setupDynamic: runtime.setup ? true : undefined,
+        steps: runtime.steps.map((s, idx) => {
+            const stepLabel = s.name ??
+                (s.kind === "contract-call" ? `${s.contract._projection.id}#${s.caseKey}` : `step-${idx + 1}`);
+            if (s.kind === "compute") {
+                try {
+                    const { reads, writes } = traceComputeFn(s.fn);
+                    return { kind: "compute", name: s.name, reads, writes };
+                }
+                catch (err) {
+                    // Wrap compute-tracer failures with the same step-context format
+                    // used for lens errors, so authoring mistakes are equally easy
+                    // to localize regardless of which tracer caught them.
+                    throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (compute): ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            let inputs;
+            if (s.bindings?.in) {
+                try {
+                    inputs = extractMappings(s.bindings.in);
+                }
+                catch (err) {
+                    if (err instanceof LensPurityError) {
+                        throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (in lens): ${err.message}`);
+                    }
+                    throw err;
+                }
+            }
+            let outputs;
+            if (s.bindings?.out) {
+                try {
+                    outputs = extractMappingsOut(s.bindings.out);
+                }
+                catch (err) {
+                    if (err instanceof LensPurityError) {
+                        throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (out lens): ${err.message}`);
+                    }
+                    throw err;
+                }
+            }
+            return {
+                kind: "contract-call",
+                name: s.name,
+                contractId: s.contract._projection.id,
+                caseKey: s.caseKey,
+                protocol: s.ref.protocol,
+                target: s.ref.target,
+                inputs,
+                outputs,
+            };
+        }),
+    };
+}
+/**
+ * Run a pure lens `fn: (state) => output` with a tracing Proxy, extracting
+ * FieldMappings from state paths to output paths.
+ *
+ * Pure-lens enforcement: method calls, `new`, and coercion on the state
+ * proxy raise `LensPurityError`. Errors are **not** swallowed — the caller
+ * (typically `normalizeFlow`) wraps them with step context and re-throws,
+ * so authors see the failure at flow build time rather than silently
+ * losing projection data.
+ */
+export function extractMappings(fn) {
+    const proxy = makeLensProxy("state");
+    const result = fn(proxy);
+    return collectMappings(result, []);
+}
+/**
+ * Extract FieldMappings from `out: (state, response) => newState`.
+ * Same purity contract as `extractMappings`.
+ */
+export function extractMappingsOut(fn) {
+    const stateProxy = makeLensProxy("state");
+    const resProxy = makeLensProxy("response");
+    const result = fn(stateProxy, resProxy);
+    // outputs target is always state.X
+    return collectMappings(result, ["state"]);
+}
+/**
+ * Recursively descend into an object produced by a traced lens, collecting
+ * paths. Lens outputs are plain objects whose leaf values are TracedValue
+ * markers (recording their source path).
+ */
+function collectMappings(out, targetPath) {
+    const mappings = [];
+    walk(out, targetPath);
+    return mappings;
+    function walk(val, path) {
+        if (isTracedValue(val)) {
+            mappings.push({
+                target: path.join("."),
+                source: { kind: "path", path: val[TRACE_MARKER] },
+            });
+            return;
+        }
+        if (val === undefined || val === null)
+            return;
+        if (typeof val === "object" && !Array.isArray(val)) {
+            for (const [k, v] of Object.entries(val)) {
+                walk(v, [...path, k]);
+            }
+            return;
+        }
+        if (Array.isArray(val)) {
+            val.forEach((v, i) => walk(v, [...path, String(i)]));
+            return;
+        }
+        // Primitive literal
+        mappings.push({
+            target: path.join("."),
+            source: { kind: "literal", value: val },
+        });
+    }
+}
+// --- Traced values (returned by lens proxy on property access) ---------------
+//
+// The trace marker is a Symbol (not a string key) so it is invisible to
+// `Object.keys` / spread / JSON.stringify. Without this, `{ ...s }` in a lens
+// would copy the tracer sentinel into the result and trip the traced-value
+// check against the entire spread object.
+const TRACE_MARKER = Symbol.for("@glubean/lens-trace");
+function isTracedValue(v) {
+    // Lens proxy uses a callable function target (for apply-trap purity
+    // enforcement), so the proxy itself reports `typeof === "function"` in
+    // V8. Accept either object or function.
+    return ((typeof v === "object" || typeof v === "function") &&
+        v !== null &&
+        v[TRACE_MARKER] !== undefined);
+}
+/**
+ * Raised by the strict lens Proxy when a user lens fn attempts an operation
+ * that breaks the "pure field access + repack" contract. Caught and re-
+ * thrown with step context by `normalizeFlow`.
+ */
+export class LensPurityError extends Error {
+    path;
+    operation;
+    constructor(path, operation) {
+        super(`Flow step in/out lens must be a pure select/repack function ` +
+            `(no method calls, branches, or arithmetic). ` +
+            `Illegal operation: "${operation}" on path "${path}". ` +
+            `If you need computation, move it to a .compute(s => ...) step between ` +
+            `this .step() and the next one.`);
+        this.name = "LensPurityError";
+        this.path = path;
+        this.operation = operation;
+    }
+}
+/**
+ * Strict lens proxy — records top-level property access path as a TracedValue
+ * on read. Used for `.step()` in/out lenses where we want precise field
+ * mappings. Trace marker is a Symbol so it doesn't leak through spread.
+ *
+ * Enforces the lens purity invariant (contract-flow v9 §3.1 + §3.3):
+ * method calls / coercion / method dispatch on state or response throw
+ * `LensPurityError`. Authors who need computation must move it to a
+ * `.compute(s => ...)` step.
+ */
+function makeLensProxy(rootPath) {
+    function childProxy(path) {
+        // Use a callable **arrow** function target so `apply` trap fires on
+        // method calls. Arrow functions don't own `prototype`, so ownKeys can
+        // return [] without violating Proxy invariants (regular functions own
+        // a non-configurable `prototype` that would have to be surfaced).
+        const target = (() => { });
+        return new Proxy(target, {
+            get(_target, prop) {
+                if (prop === TRACE_MARKER)
+                    return path;
+                if (typeof prop === "symbol")
+                    return undefined;
+                return childProxy(`${path}.${String(prop)}`);
+            },
+            apply(_target, _thisArg, _args) {
+                // Method call — forbidden. Extract the leaf segment as the offending op.
+                const dot = path.lastIndexOf(".");
+                const op = dot >= 0 ? path.slice(dot + 1) : path;
+                const owner = dot >= 0 ? path.slice(0, dot) : path;
+                throw new LensPurityError(owner, `${op}()`);
+            },
+            construct(_target, _args) {
+                throw new LensPurityError(path, "new");
+            },
+            // ownKeys returns nothing so spread copies no fields.
+            ownKeys() {
+                return [];
+            },
+            getOwnPropertyDescriptor() {
+                return undefined;
+            },
+        });
+    }
+    return childProxy(rootPath);
+}
+// --- Permissive compute proxy (different role, different trap rules) --------
+/**
+ * Trace a `compute` fn to extract top-level reads + writes.
+ *
+ * Compute allows arbitrary sync TS (template literals, method calls, .map()),
+ * so the Proxy must be permissive: respond to primitive coercion, swallow
+ * method calls, etc. We only record top-level property access paths.
+ *
+ * See contract-flow.md §4.1.1 for design + known limitations.
+ */
+export function traceComputeFn(fn) {
+    const reads = new Set();
+    const proxy = makeComputeProxy("state", reads);
+    // compute fn is permitted to do arbitrary synchronous TS — the proxy is
+    // tolerant of method calls / coercion / iteration via its permissive
+    // trap rules, so any exception here is genuine (e.g. fn threw explicitly).
+    // Don't silently swallow: let the error propagate so callers surface it.
+    const result = fn(proxy);
+    const writes = result && typeof result === "object" && !Array.isArray(result)
+        ? Object.keys(result).filter((k) => typeof k === "string")
+        : [];
+    return { reads: [...reads].sort(), writes };
+}
+function makeComputeProxy(rootPath, reads) {
+    // Arrow-function target: callable (for `apply` trap on method calls) but
+    // does NOT own `prototype`, so `ownKeys` returning [] is valid and spread
+    // (`{ ...s }`) works without triggering a Proxy invariant violation.
+    return new Proxy((() => { }), {
+        get(_target, prop) {
+            if (prop === Symbol.toPrimitive)
+                return () => "";
+            if (prop === "toString")
+                return () => "";
+            if (prop === "valueOf")
+                return () => 0;
+            if (prop === Symbol.iterator)
+                return function* () { };
+            if (prop === "length")
+                return 0;
+            if (prop === Symbol.isConcatSpreadable)
+                return false;
+            if (typeof prop !== "string")
+                return undefined;
+            reads.add(`${rootPath}.${prop}`);
+            return makePermissiveChildProxy();
+        },
+        apply() {
+            return makePermissiveChildProxy();
+        },
+        has() {
+            return true;
+        },
+        ownKeys() {
+            return [];
+        },
+        getOwnPropertyDescriptor() {
+            return { configurable: true, enumerable: true, value: undefined };
+        },
+    });
+}
+/**
+ * Totally-permissive child proxy — swallows every access / invocation,
+ * returns itself. Used for depth-2+ of compute tracing where we don't track.
+ */
+function makePermissiveChildProxy() {
+    const self = new Proxy((() => { }), {
+        get(_target, prop) {
+            if (prop === Symbol.toPrimitive)
+                return () => "";
+            if (prop === "toString")
+                return () => "";
+            if (prop === "valueOf")
+                return () => 0;
+            if (prop === Symbol.iterator)
+                return function* () { };
+            if (prop === "length")
+                return 0;
+            return self;
+        },
+        apply() {
+            return self;
+        },
+        has() {
+            return true;
+        },
+        ownKeys() {
+            return [];
+        },
+        getOwnPropertyDescriptor() {
+            return { configurable: true, enumerable: true, value: undefined };
+        },
+    });
+    return self;
+}
+//# sourceMappingURL=contract-core.js.map