aontu 0.72.0 → 0.74.0

package/src/hints.ts

@@ -181,8 +181,8 @@ const hints: Record<string, string> = {
 
   merge_conflict: 'A version-control conflict marker was found in the source. The\nfile still holds an unresolved merge: resolve it and remove the\n`<<<<<<<`, `=======` and `>>>>>>>` lines before unifying.\n \nExamples:\n  <<<<<<< HEAD  -> nil  # A conflict marker, not a `<` operation;\n  =======       -> nil  # ... nor a chain of `=` characters;\n  >>>>>>> other -> nil  # ... nor a `>` operation.',
 
-  include_denied: 'An @"..." include was refused by the active trust profile\n(docs/trust.md). The document asked to read a source the evaluation\'s\ninclude capability does not allow: widen the capability if the read is\nintended, or remove the include if it is not.\n \nExamples:\n  a:@"./in-root.aon"  -> {..}  # Inside the confinement root: allowed;\n  a:@"../secret.aon"  -> nil   # ... but escaping the root is denied;\n  a:@"/etc/hostname"  -> nil   # ... and so is an absolute path outside it.',
-  include_extension: 'An @\"...\" include named a file the engine does not read. THE\nEXTENSION DECIDES which of two things a file is: `.aon` and\n`.aontu` are aontu source, with the whole language in them, and\n`.json`, `.jsonld`, `.jsonc`, `.json5`, `.jsonic`, `.jsc`, `.toml`,\n`.yaml`, `.yml` and `.ini` are configuration DATA, read by that\nformat\'s own parser. Anything else -- and a name with no extension\n-- is refused rather than guessed at: a guess produces a document\nthat looks right and is not.\n \nExamples:\n  a:@\"model.aon\"    -> {..}  # aontu source;\n  a:@\"server.toml\"  -> {..}  # ... config data, read as TOML;\n  a:@\"notes.txt\"    -> nil   # ... but text is not a document;\n  a:@\"data\"         -> nil   # ... and neither is an unnamed kind.',
+  include_denied: 'An @"..." include was refused by the active trust profile\n(docs/trust.md). The document asked to read a source the evaluation\'s\ninclude capability does not allow: widen the capability if the read is\nintended, or remove the include if it is not.\n \nExamples:\n  a:@"./in-root.aontu" -> {..}  # Inside the confinement root: allowed;\n  a:@"../secret.aontu" -> nil   # ... but escaping the root is denied;\n  a:@"/etc/hostname"   -> nil   # ... and so is an absolute path outside it.',
+  include_extension: 'An @\"...\" include named a file the engine does not read. THE\nEXTENSION DECIDES which of two things a file is: `.aontu` is aontu\nsource, with the whole language in it, and `.json`, `.jsonld`,\n`.jsonc`, `.json5`, `.jsonic`, `.jsc`, `.toml`, `.yaml`, `.yml` and\n`.ini` are configuration DATA, read by that format\'s own parser.\nAnything else -- and a name with no extension -- is refused rather\nthan guessed at: a guess produces a document that looks right and is\nnot.\n \nExamples:\n  a:@\"model.aontu\" -> {..}  # aontu source;\n  a:@\"server.toml\" -> {..}  # ... config data, read as TOML;\n  a:@\"notes.txt\"   -> nil   # ... but text is not a document;\n  a:@\"data\"        -> nil   # ... and neither is an unnamed kind.',
 
   func_arity: 'This function was called with the wrong number of arguments:\n{func} takes {want}, but was given {got}.\n \nExamples:\n  upper(\"a\")     -> \"A\"  # One argument, which is what upper takes;\n  upper(\"a\",\"b\") -> nil  # ... so two is a mistake in the source;\n  key()          -> \"\"   # key takes none, or one level count;\n  neq(1,2,3)     -> neq  # ... and neq takes one or more exclusions.',
   func_arg: 'This argument does not fit the function\'s signature:\n \n  {sig}\n  argument {argn} (`{arg}`) was `{got}`.\n \nThe signature is the declared call surface (one line per builtin,\ntest/spec/signature.tsv); an argument slot admits a concrete value\nof its declared kind, `number` admitting every numeric leaf and\n`string` admitting a path.\n \nExamples:\n  upper("a")     -> "A"    # A string fits upper(s: string|number);\n  upper(1)       -> 1      # ... and so does a number;\n  upper(true)    -> nil    # ... but a boolean fits neither word;\n  add([1],2)     -> nil    # ... and a list is no operand.',
@@ -291,9 +291,9 @@ const hints: Record<string, string> = {
 
 
   module_path: 'A module import is domain-shaped, but its path cannot be a\ndirectory on every platform the toolchain runs on -- so it is refused\nbefore anything is built from it. An element may not be empty, may not\nbegin or end with `.` (which is what forbids `..`), and may not be a\nreserved device name. These are Go\'s module-path rules, for Go\'s\nreason: a package path becomes a real directory.\n \nExamples:\n  @"corp.example/s"        -> {..} # An ordinary path is fine;\n  @"corp.example/../s"     -> nil  # ... `..` would escape the store;\n  @"corp.example/nul"      -> nil  # ... and Windows has no such file.',
-  module_missing: 'A module import names a package that is not in this project. A\nmodule is resolved from LOCAL stores only -- `aontu_meta/vendor/` beside the\nproject\'s pkg.aon, then the user cache -- because evaluation never\ntouches the network. Fetching is a separate step, and the message\nnames it.\n \nExamples:\n  @"corp.example/s"        -> nil  # Not fetched: run aontu sync;\n  @"./local.aon"           -> {..} # ... a local path is not a module;\n  @"corp.example/s#aon1-…" -> {..} # ... and a pin does not fetch it either.',
+  module_missing: 'A module import names a package that is not in this project. A\nmodule is resolved from LOCAL stores only -- `aontu_meta/vendor/` beside the\nproject\'s pkg.aontu, then the user cache -- because evaluation never\ntouches the network. Fetching is a separate step, and the message\nnames it.\n \nExamples:\n  @"corp.example/s"        -> nil  # Not fetched: run aontu sync;\n  @"./local.aontu"         -> {..} # ... a local path is not a module;\n  @"corp.example/s#aon1-…" -> {..} # ... and a pin does not fetch it either.',
   module_local: 'A bare reference names a file: its last segment carries an\nextension the include table knows, and a package path never does. A\nlocal file is written with a `./`, `../` or `/` prefix, so every\nreference says what it is (ADR-022); a package path is\n`<domain>/<path>` and nothing else.\n \nExamples:\n  @"config.json"           -> nil  # Meant as a file: write ./config.json;\n  @"./config.json"         -> {..} # ... a local file says so;\n  @"corp.example/schemas"  -> {..} # ... and a package path carries no extension.',
-  module_moved: 'The package this import names has MOVED: a later version of it\ndeclares a new path, and nothing follows a move. A name that quietly\nmeant something else would be the failure the naming convention exists\nto prevent, so the refusal names the destination and stops there;\nimport the destination instead.\n \nExamples:\n  @"corp.example/old"      -> nil  # moved: import the destination;\n  @"corp.example/new"      -> {..} # ... which resolves as any package does;\n  aontu sync                       # ... after pkg.aon names it.',
+  module_moved: 'The package this import names has MOVED: a later version of it\ndeclares a new path, and nothing follows a move. A name that quietly\nmeant something else would be the failure the naming convention exists\nto prevent, so the refusal names the destination and stops there;\nimport the destination instead.\n \nExamples:\n  @"corp.example/old"      -> nil  # moved: import the destination;\n  @"corp.example/new"      -> {..} # ... which resolves as any package does;\n  aontu sync                       # ... after pkg.aontu names it.',
   module_integrity: 'A module resolved locally does not have the MEANING it was pinned\nto. The pin is a canon-hash -- the hash of the module unified\nstandalone -- so it survives comments, formatting and refactoring and\nbreaks on any semantic change in the module\'s transitive closure.\nVerification is always local: the repository\'s manifest is a claim.\n \nExamples:\n  @"corp.example/s"        -> {..} # No pin, no check;\n  @"corp.example/s#aon1-x" -> nil  # ... a pin that disagrees refuses;\n  aontu hash <file>                # ... and this is what it should be.',
   module_depth: 'Module verification nested too deep. A pinned module is checked by\nEVALUATING it, and that evaluation resolves the module\'s own imports\n-- so a vendor tree that leads back to itself would recurse until the\nhost ran out of stack. The bound makes that a stated refusal rather\nthan a crash whose verdict depends on the machine.\n \nExamples:\n  @"corp.example/s"     -> {..}  # Ordinary nesting is far below it;\n  aontu pkg vendor              # ... rebuild a vendor tree that loops;\n  aontu hash <file>             # ... and check what it hashes to.',
 
@@ -625,8 +625,8 @@ const hints: Record<string, string> = {
     'The include still placed the file\'s values -- it is the NAME that\n' +
     'did not cross.\n' +
     ' \nExamples:\n' +
-    '  { %u8 } = @"types.aon"      -> bound, if types.aon exports %u8;\n' +
-    '  { %secret } = @"types.aon"  -> nil  # ... and refused if not.',
+    '  { %u8 } = @"types.aontu"      -> bound, if types.aontu exports %u8;\n' +
+    '  { %secret } = @"types.aontu"  -> nil  # ... and refused if not.',
 
   'patch_assignment':
     'This is not a <path>=<value> assignment. The path is what stands\n' +

package/src/lang.ts

@@ -214,7 +214,7 @@ const MERGE_KEY = RESERVED_KEY_PREFIX + 'merge'
 const ALIAS_MARK_KEY = RESERVED_KEY_PREFIX + 'alias'
 const OPTIONAL_MARK_KEY = RESERVED_KEY_PREFIX + 'optional'
 
-// `{ %a } = @"f.aon"` is the pair `<head>: <include>`, so the head is
+// `{ %a } = @"f.aontu"` is the pair `<head>: <include>`, so the head is
 // one token and the grammar needs nothing new.
 const IMPORT_HEAD_RE = new RegExp('^(' + ALIAS_SET + ')[ \\t]*=(?!=)')
 const EXPORT_RE = /^export[ \t]*\([ \t]*([^()\s][^()]*?)[ \t]*\)/
@@ -1752,7 +1752,6 @@ help isolate the syntax error.`,
 
 
 const INCLUDE_KINDS: { [kind: string]: string } = {
-  aon: 'source',
   aontu: 'source',
 
   json: 'json',
@@ -1975,7 +1974,7 @@ function makeModelResolver(options: any) {
   }
 
   // The gate every leg that RESOLVES A NAME passes through. The aontu:
-  // and module legs do not: both state `kind: 'aon'` because what they
+  // and module legs do not: both state `kind: 'aontu'` because what they
   // serve is Aontu source by construction, not by its spelling.
   const gateExtension = (path: string, full: string): void => {
     if (undefined === includeFormat(extKindOf(full), options.textExt)) {
@@ -2054,7 +2053,7 @@ function makeModelResolver(options: any) {
         modelNotFound(path)
       }
       record(ctx, path, 'aontu')
-      return { found: true, path, full: path, kind: 'aon', src: model, search: [] }
+      return { found: true, path, full: path, kind: 'aontu', src: model, search: [] }
     }
 
     let search: any = []
@@ -2096,7 +2095,7 @@ function makeModelResolver(options: any) {
       record(ctx, found.full, 'mod')
       return {
         found: true, path, full: found.full,
-        kind: 'aon', src: found.src, search: [],
+        kind: 'aontu', src: found.src, search: [],
       }
     }
 
@@ -2318,7 +2317,7 @@ class Lang {
     this.jsonic
       .use(asPlugin(MultiSource), {
         resolver: options?.resolver || modelResolver,
-        implictExt: ['aon', 'aontu'],
+        implictExt: ['aontu'],
         processor: includeProcessors(this.opts.textExt)
       })
       .use(AontuJsonic)

package/src/mod.ts

@@ -107,8 +107,8 @@ export function moduleDir(store: string, path: string): string {
 }
 
 
-export const PKG_FILE = 'pkg.aon'
-export const LOCK_FILE = 'pkg-lock.aon'
+export const PKG_FILE = 'pkg.aontu'
+export const LOCK_FILE = 'pkg-lock.aontu'
 export const META_DIR = 'aontu_meta'
 export const VENDOR_DIR = 'vendor'
 
@@ -363,4 +363,4 @@ function aliasTarget(
 }
 
 
-const DEFAULT_MAIN = 'main.aon'
+const DEFAULT_MAIN = 'main.aontu'

package/src/pkg-net.ts

@@ -237,8 +237,8 @@ export function objectPath(kind: string, pkg: string, version?: string): string
     case 'manifest': return p + '/@v/' + version + '.manifest'
     case 'signature': return p + '/@v/' + version + '.sig'
     case 'sigstore': return p + '/@v/' + version + '.sigstore.json'
-    case 'advisory': return '/advisory/' + pkgUrlPath(pkg) + '.aon'
-    default: return '/tombstone/' + pkgUrlPath(pkg) + '/@v/' + version + '.aon'
+    case 'advisory': return '/advisory/' + pkgUrlPath(pkg) + '.aontu'
+    default: return '/tombstone/' + pkgUrlPath(pkg) + '/@v/' + version + '.aontu'
   }
 }
 
@@ -560,25 +560,41 @@ async function fetchAdvisory(ctx: AcquireCtx, bases: string[], pkg: string):
 
 
 // The versions this client has seen for a package, from its own
-// records: a version absent from the list now is a rollback.
+// records: a version absent from the list now is a rollback. Both
+// suffixes are read -- a record is evidence rather than a document,
+// and dropping either would forget versions and weaken the check.
+const SEEN_EXT = ['.aontu', '.aon']
+
+function seenFile(dir: string, version: string): string | undefined {
+  return SEEN_EXT.map((ext) => pathJoin(dir, version + ext)).find(existsSync)
+}
+
 function seenVersions(ctx: AcquireCtx, pkg: string): string[] {
   const dir = cacheSeenDir(ctx.cache, pkg)
   if (!existsSync(dir)) {
     return []
   }
-  return readdirSync(dir).filter((f) => f.endsWith('.aon'))
-    .map((f) => f.slice(0, -'.aon'.length)).sort(cmpBytes)
+  const seen = new Set<string>()
+  for (const name of readdirSync(dir)) {
+    const ext = SEEN_EXT.find((e) => name.endsWith(e))
+    if (undefined !== ext) {
+      seen.add(name.slice(0, -ext.length))
+    }
+  }
+  return [...seen].sort(cmpBytes)
 }
 
 function recordSeen(ctx: AcquireCtx, pkg: string, version: string, subject: string): void {
   const dir = cacheSeenDir(ctx.cache, pkg)
-  const file = pathJoin(dir, version + '.aon')
-  if (existsSync(file)) {
+  const file = pathJoin(dir, version + '.aontu')
+  // A record under either spelling is the first sighting, so neither is
+  // overwritten -- a second write would date the version to today.
+  if (undefined !== seenFile(dir, version)) {
     return
   }
   mkdirSync(dir, { recursive: true })
   writeFileSync(file, canonLine(
-    { package: pkg, version, seen: timestamp(ctx.now()), subject }, ctx.options, 'seen.aon'))
+    { package: pkg, version, seen: timestamp(ctx.now()), subject }, ctx.options, 'seen.aontu'))
 }
 
 
@@ -867,8 +883,8 @@ export async function acquire(ctx: AcquireCtx, pkg: string, asked: string | unde
   const tmp = pathJoin(ctx.cache, 'tmp', randomBytes(8).toString('hex'))
   mkdirSync(pathJoin(tmp, META_DIR), { recursive: true })
   writeTree(tmp, entries)
-  writeFileSync(pathJoin(tmp, META_DIR, 'manifest.aon'), manifestBytes)
-  writeFileSync(pathJoin(tmp, META_DIR, 'proof.aon'), proofBytes)
+  writeFileSync(pathJoin(tmp, META_DIR, 'manifest.aontu'), manifestBytes)
+  writeFileSync(pathJoin(tmp, META_DIR, 'proof.aontu'), proofBytes)
   const self = packageSelf(tmp, ctx.options)
   const mod = manifest.modules[0]
   if (self.path !== pkg || self.version !== version || self.main !== mod.main) {
@@ -1435,8 +1451,8 @@ export function writeLayout(dir: string, w: LayoutWrite, options: PkgToolOptions
   }
   retracted.sort((a, b) => versionCompare(a.version, b.version))
   const advisory = pathJoin(dir, 'advisory', ...pkgUrlPath(pkg).split('/'))
-  mkdirSync(pathDirname(advisory + '.aon'), { recursive: true })
-  writeFileSync(advisory + '.aon',
+  mkdirSync(pathDirname(advisory + '.aontu'), { recursive: true })
+  writeFileSync(advisory + '.aontu',
     canonLine({ package: pkg, retracted }, options, 'advisory'))
 }
 
@@ -1627,7 +1643,7 @@ export async function pkgPublish(root: string, options: PkgToolOptions, http: Pk
   }
 
   const proof = signDigest(readFileSync(args.key as string, 'utf8'), report.digest)
-  const proofBytes = canonLine(proof, options, 'proof.aon')
+  const proofBytes = canonLine(proof, options, 'proof.aontu')
   const archive = archiveOf(root)
   try {
     if (null != args.to) {
@@ -1786,7 +1802,7 @@ function refusedOutdated(report: PkgOutdatedReport, e: unknown): PkgOutdatedRepo
 // THE LOCAL REGISTRY AND PROXY (`aontu pkg serve`): the directory
 // layout served verbatim; with upstreams, fetched on a miss and kept.
 const OBJECT_RE =
-  /^\/(pkg\/[A-Za-z0-9!._/-]+\/@v\/(list|(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)\.(zip|manifest|sig|sigstore\.json))|pkg\/[A-Za-z0-9!._/-]+\/@latest|advisory\/[A-Za-z0-9!._/-]+\.aon|tombstone\/(feed\.aon|[A-Za-z0-9!._/-]+\/@v\/(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)\.aon))$/
+  /^\/(pkg\/[A-Za-z0-9!._/-]+\/@v\/(list|(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)\.(zip|manifest|sig|sigstore\.json))|pkg\/[A-Za-z0-9!._/-]+\/@latest|advisory\/[A-Za-z0-9!._/-]+\.aontu|tombstone\/(feed\.aontu|[A-Za-z0-9!._/-]+\/@v\/(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)\.aontu))$/
 
 export function objectShape(p: string): boolean {
   return OBJECT_RE.test(p) && !p.split('/').some((e) => '' === e && p.indexOf('//') >= 0) &&
@@ -1927,8 +1943,8 @@ export function defaultHttp(): PkgHttp {
     },
     post: async (url: string, parts: PublishParts, token: string) => {
       const form = new FormData()
-      form.set('manifest', new Blob([Buffer.from(parts.manifest)], { type: 'text/plain' }), 'manifest.aon')
-      form.set('proof', new Blob([Buffer.from(parts.proof)], { type: 'text/plain' }), 'proof.aon')
+      form.set('manifest', new Blob([Buffer.from(parts.manifest)], { type: 'text/plain' }), 'manifest.aontu')
+      form.set('proof', new Blob([Buffer.from(parts.proof)], { type: 'text/plain' }), 'proof.aontu')
       form.set('archive', new Blob([Buffer.from(parts.archive)], { type: 'application/zip' }), 'archive.zip')
       try {
         const r = await fetch(url, {

package/src/pkg.ts

@@ -272,7 +272,7 @@ export function lockText(entries: LockEntry[], options: PkgToolOptions): string
 // The generated-file header. A lockfile is machine-written, and the
 // file says so where an editor will see it.
 export const LOCK_HEADER =
-  '# pkg-lock.aon (generated by `aontu sync`; do not edit)\n'
+  '# pkg-lock.aontu (generated by `aontu sync`; do not edit)\n'
 
 
 export function writeLock(root: string, entries: LockEntry[],
@@ -297,7 +297,7 @@ export type PackageSelf = {
 export function packageSelf(dir: string, options: PkgToolOptions): PackageSelf {
   const file = pathJoin(dir, PKG_FILE)
   const self: PackageSelf = {
-    path: '', version: '', main: 'main.aon', publish: 'private', retract: [],
+    path: '', version: '', main: 'main.aontu', publish: 'private', retract: [],
   }
   if (!existsSync(file)) {
     return self
@@ -307,7 +307,7 @@ export function packageSelf(dir: string, options: PkgToolOptions): PackageSelf {
   const str = (v: any): string => 'string' === typeof v ? v : ''
   self.path = str(pkg?.path)
   self.version = str(pkg?.version)
-  self.main = '' === str(pkg?.main) ? 'main.aon' : str(pkg?.main)
+  self.main = '' === str(pkg?.main) ? 'main.aontu' : str(pkg?.main)
   self.publish = 'public' === gen?.publish ? 'public' : 'private'
   if ('' !== str(gen?.moved)) {
     self.moved = str(gen.moved)
@@ -321,7 +321,7 @@ export function packageSelf(dir: string, options: PkgToolOptions): PackageSelf {
 
 // What a package may contain (REPOSITORY.0.md §9.4): an enumerated
 // allowlist, refused by default. The data half is ADR-012's table.
-export const ARCHIVE_SOURCE_EXT = ['aon', 'aontu']
+export const ARCHIVE_SOURCE_EXT = ['aontu']
 export const ARCHIVE_DATA_EXT = [
   'json', 'jsonld', 'jsonc', 'json5', 'jsonic', 'jsc', 'toml', 'yaml', 'yml',
   'ini',
@@ -412,7 +412,7 @@ export function archiveOf(dir: string): Archive {
 // repository: the served manifest, verbatim.
 export function storedManifest(dir: string):
   { digest: string, files: ArchiveFile[] } | undefined {
-  const file = pathJoin(dir, META_DIR, 'manifest.aon')
+  const file = pathJoin(dir, META_DIR, 'manifest.aontu')
   if (!existsSync(file)) {
     return undefined
   }
@@ -1014,5 +1014,5 @@ const MANIFEST_VERDICT: Record<string, PkgManifestReport['verdict']> = {
 export function manifestText(m: PkgManifest, options: PkgToolOptions,
   extra?: Record<string, any>): string {
   const src = JSON.stringify({ ...m, ...(extra ?? {}) })
-  return options.eval(src, 'manifest.aon').canon
+  return options.eval(src, 'manifest.aontu').canon
 }

package/src/view.ts

@@ -72,7 +72,7 @@ export type ViewLoss = {
 export type ViewDoc = {
   src: string
   // Where it came from, so a relative include inside it resolves and
-  // so its label (the file name without `.aon`) is known.
+  // so its label (the file name without `.aontu`) is known.
   path?: string
   // The label to draw, overriding the one derived from `path`.
   name?: string
@@ -2493,7 +2493,7 @@ export function view(
       .map((d: ViewDoc, i) => ({
         src: d.src, path: d.path,
         label: d.name ?? (undefined === d.path
-          ? `doc${i + 1}` : basename(d.path).replace(/\.aon$/, '')),
+          ? `doc${i + 1}` : basename(d.path).replace(/\.aontu$/, '')),
       }))
     return done(drawPoset(docs, options, as, max, loss, compare))
   }
@@ -2540,7 +2540,7 @@ function drawLoaded(
     if (undefined === gen) {
       // GENERATION CAN FAIL WHERE UNIFICATION DID NOT: the panel reads
       // generated values, so a document that is not concrete is an
-      // error here, exactly as `aontu file.aon` on it is.
+      // error here, exactly as `aontu file.aontu` on it is.
       const before = ctx.err.length
       value = root.gen(ctx)
       if (before < ctx.err.length) {
@@ -2743,7 +2743,7 @@ export function viewSet(
   const ctx = loaded.ctx
   // The declarations are part of the document, so reading them
   // generates it -- and a view document that does not generate has no
-  // figures, exactly as `aontu file.aon` on it has no output.
+  // figures, exactly as `aontu file.aontu` on it has no output.
   const before = ctx.err.length
   const value = root.gen(ctx)
   if (before < ctx.err.length) {