capdag 1.306.150 → 1.361.331

package/capdag.js

@@ -1,12 +1,36 @@
 // Cap URN JavaScript Implementation
 // Follows the exact same rules as Rust, Go, and Objective-C implementations
-
-// Import TaggedUrn from the tagged-urn package
-const {
-  TaggedUrn,
-  valuesMatch: taggedUrnValuesMatch,
-  scoreTagValue
-} = require('tagged-urn');
+//
+// Dispatch, acceptance, equivalence and specificity are decided by code
+// generated from the proved model in ../formal (Lean) by lungo, in ./formal,
+// not written here. It runs as WebAssembly, instantiated once when this module
+// is first imported.
+
+import { TaggedUrn } from 'tagged-urn';
+import * as machineParser from './machine-parser.js';
+import { load } from './formal/index.js';
+
+const model = await load();
+
+// Node's modules, for what works with the file system and with processes:
+// cartridge discovery, installation records and directory hashes. They exist
+// only under Node; elsewhere this module loads without them, and asking for
+// them there is an error naming what needed them.
+const node = (typeof process !== 'undefined' && process.versions && process.versions.node)
+  ? {
+      fs: await import('node:fs'),
+      path: await import('node:path'),
+      crypto: await import('node:crypto'),
+      childProcess: await import('node:child_process'),
+    }
+  : null;
+
+function nodeModules(what) {
+  if (node === null) {
+    throw new Error(`capdag: ${what} needs Node's file system and processes, which this runtime does not have`);
+  }
+  return node;
+}
 
 /**
  * Error types for Cap URN operations
@@ -83,7 +107,7 @@ function processDirectionTag(taggedUrn, tagName) {
  */
 function canonicalizeDirectionSpec(spec, tagName) {
   if (spec === 'media:' || spec === '*') {
-    return spec;
+    return 'media:';
   }
 
   try {
@@ -106,7 +130,7 @@ function canonicalizeDirectionSpec(spec, tagName) {
  */
 function validatePreservedDirectionSpec(spec, tagName) {
   if (spec === 'media:' || spec === '*') {
-    return spec;
+    return 'media:';
   }
 
   try {
@@ -195,6 +219,27 @@ function validateNonStructuralTags(tags) {
   }
 }
 
+/**
+ * A tagged URN as capdag's model takes it. Each program generated for
+ * JavaScript runs in a WebAssembly instance of its own, so tagged-urn's model
+ * value of a URN cannot pass here: this program makes its own, from the same
+ * tags, with the same function of the same model.
+ */
+function modelUrn(urn) {
+  const made = model.make(urn.prefix, urn.modelTags());
+  if (made === null) {
+    throw new Error(`capdag: the model refused ${urn.toString()}, whose keys are sorted`);
+  }
+  return made;
+}
+
+const MODEL_EFFECTS = Object.freeze({
+  declared: Object.freeze({ kind: 'declared' }),
+  none: Object.freeze({ kind: 'none' }),
+  patch: Object.freeze({ kind: 'patch' }),
+  '?': Object.freeze({ kind: 'unspecified' }),
+});
+
 class CapUrn {
   // Per-axis weights for cap-URN specificity. Two orders of
   // magnitude separate each axis to keep them in distinct digit
@@ -224,6 +269,20 @@ class CapUrn {
     }
     validateNonStructuralTags(this.tags);
     this._validateAdmissible();
+    // The same cap on the proved model's side: its three URNs and its effect.
+    // Dispatch, acceptance, equivalence and specificity are asked of it. Made
+    // here, from the same fields, and the cap is frozen, so the two can never
+    // describe different caps; it is not enumerable, so it is not part of what
+    // a cap serializes or compares as.
+    const formal = {
+      input: modelUrn(MediaUrn.fromString(this.inSpec)._urn),
+      output: modelUrn(MediaUrn.fromString(this.outSpec)._urn),
+      other: modelUrn(new TaggedUrn('cap', this.tags)),
+      effect: MODEL_EFFECTS[this.effectValue],
+    };
+    Object.defineProperty(this, 'formal', { value: formal, enumerable: false });
+    Object.freeze(this.tags);
+    Object.freeze(this);
   }
 
   /**
@@ -604,51 +663,10 @@ class CapUrn {
     if (!request) {
       return true;
     }
-
-    // Input direction: pattern accepts instance. `media:` on the pattern side is
-    // the wildcard top and skips the check.
-    if (this.inSpec !== 'media:' && this.inSpec !== '*') {
-      const capIn = MediaUrn.fromString(this.inSpec);
-      const requestIn = MediaUrn.fromString(request.inSpec);
-      if (!capIn.accepts(requestIn)) {
-        return false;
-      }
-    }
-
-    // Output direction: candidate output must conform to requested output.
-    // `media:` on the pattern side is wildcard top and skips the check.
-    if (this.outSpec !== 'media:' && this.outSpec !== '*') {
-      const capOut = MediaUrn.fromString(this.outSpec);
-      const requestOut = MediaUrn.fromString(request.outSpec);
-      if (!capOut.conformsTo(requestOut)) {
-        return false;
-      }
-    }
-
-    if (this.effectValue !== CapEffect.ANY && this.effectValue !== request.effectValue) {
-      return false;
-    }
-
-    // Y-axis: every tag's per-key match runs through the six-form
-    // truth table (taggedUrnValuesMatch). Walk the union of all keys
-    // appearing on either side so missing-on-pattern and
-    // missing-on-instance cells both get evaluated.
-    const allKeys = new Set([
-      ...Object.keys(this.tags),
-      ...Object.keys(request.tags),
-    ]);
-    for (const key of allKeys) {
-      const patt = Object.prototype.hasOwnProperty.call(this.tags, key)
-        ? this.tags[key]
-        : undefined;
-      const inst = Object.prototype.hasOwnProperty.call(request.tags, key)
-        ? request.tags[key]
-        : undefined;
-      if (!taggedUrnValuesMatch(inst, patt)) {
-        return false;
-      }
-    }
-    return true;
+    // Decided by the proved model (CapDAG.Exec.accepts). The cap-tag axis runs
+    // opposite to isDispatchable's: this is the pattern relation, dispatch is
+    // the routing one.
+    return model.accepts(this.formal, request.formal);
   }
 
   /**
@@ -689,16 +707,8 @@ class CapUrn {
    * @returns {number} The specificity score
    */
   specificity() {
-    const inUrn = MediaUrn.fromString(this.inSpec);
-    const outUrn = MediaUrn.fromString(this.outSpec);
-
-    let yScore = 0;
-    for (const value of Object.values(this.tags)) {
-      yScore += scoreTagValue(value);
-    }
-    return CapUrn.WEIGHT_OUT * outUrn.specificity()
-         + CapUrn.WEIGHT_IN  * inUrn.specificity()
-         + yScore;
+    // Computed by the proved model (CapDAG.Exec.specificity).
+    return Number(model.specificity(this.formal));
   }
 
   /**
@@ -781,7 +791,7 @@ class CapUrn {
    * @returns {boolean}
    */
   isComparable(other) {
-    return this.accepts(other) || other.accepts(this);
+    return model.comparable(this.formal, other.formal);
   }
 
   /**
@@ -792,7 +802,7 @@ class CapUrn {
    * @returns {boolean}
    */
   isEquivalent(other) {
-    return this.accepts(other) && other.accepts(this);
+    return model.equivalent(this.formal, other.formal);
   }
 
   /**
@@ -857,45 +867,13 @@ class CapUrn {
    * @returns {boolean}
    */
   isDispatchable(request) {
-    return this._inputDispatchable(request)
-      && this._outputDispatchable(request)
-      && this._effectDispatchable(request)
-      && this._capTagsDispatchable(request);
-  }
-
-  _inputDispatchable(request) {
-    if (request.inSpec === 'media:') return true;
-    if (this.inSpec === 'media:') return true;
-    return MediaUrn.fromString(request.inSpec).conformsTo(MediaUrn.fromString(this.inSpec));
-  }
-
-  _outputDispatchable(request) {
-    if (request.outSpec === 'media:') return true;
-    if (this.outSpec === 'media:') return false;
-    return MediaUrn.fromString(this.outSpec).conformsTo(MediaUrn.fromString(request.outSpec));
-  }
-
-  _effectDispatchable(request) {
-    return request.effectValue === CapEffect.ANY || this.effectValue === request.effectValue;
-  }
-
-  _capTagsDispatchable(request) {
-    const allKeys = new Set([
-      ...Object.keys(this.tags),
-      ...Object.keys(request.tags),
-    ]);
-    for (const key of allKeys) {
-      const patt = Object.prototype.hasOwnProperty.call(request.tags, key)
-        ? request.tags[key]
-        : undefined;
-      const inst = Object.prototype.hasOwnProperty.call(this.tags, key)
-        ? this.tags[key]
-        : undefined;
-      if (!taggedUrnValuesMatch(inst, patt)) {
-        return false;
-      }
-    }
-    return true;
+    // Decided by the proved model (CapDAG.Exec.dispatch): every axis is a type.
+    // The request's input refines the candidate's, the candidate's output
+    // refines the request's, the effect matches unless the request says
+    // ?effect, and the candidate's cap-tags refine the request's. `media:` on
+    // a request's input is a type — "may send anything" — so only a candidate
+    // that accepts anything serves it, which is what makes dispatch compose.
+    return model.dispatch(this.formal, request.formal);
   }
 
   /**
@@ -6172,8 +6150,7 @@ class CartridgeJson {
    * @throws {CartridgeJsonError}
    */
   static readFromDir(versionDir, expectedSlug) {
-    const fs = require('fs');
-    const path = require('path');
+    const { fs, path } = nodeModules('reading cartridge.json');
     const jsonPath = path.join(versionDir, 'cartridge.json');
 
     if (!fs.existsSync(jsonPath)) {
@@ -6255,7 +6232,7 @@ class CartridgeJson {
    * @returns {string}
    */
   resolveEntryPoint(versionDir) {
-    const path = require('path');
+    const { path } = nodeModules('resolving an entry point');
     return path.join(versionDir, this.entry);
   }
 }
@@ -6272,9 +6249,7 @@ class CartridgeJson {
  * @returns {string} Lowercase hex SHA256.
  */
 function hashCartridgeDirectory(dir) {
-  const fs = require('fs');
-  const path = require('path');
-  const crypto = require('crypto');
+  const { fs, path, crypto } = nodeModules('hashing a cartridge directory');
 
   const files = [];
   const collect = (current) => {
@@ -6577,7 +6552,7 @@ function encodeHelloFrame() {
  * @throws {Error} when the handshake/probe fails.
  */
 function probeCartridgeCapGroups(entryPath) {
-  const { spawn } = require('child_process');
+  const { spawn } = nodeModules('probing a cartridge').childProcess;
   return new Promise((resolve, reject) => {
     let child;
     try {
@@ -6714,8 +6689,7 @@ function probeCartridgeCapGroups(entryPath) {
  * @returns {Promise<Array<DiscoveredCartridge>>}
  */
 async function discoverCartridges(cartridgesRoot, identity) {
-  const fs = require('fs');
-  const path = require('path');
+  const { fs, path } = nodeModules('discovering cartridges');
   const discovered = [];
 
   let rootStat;
@@ -6755,8 +6729,7 @@ async function discoverCartridges(cartridgesRoot, identity) {
  * Mirrors capdag::cartridge_discovery::scan_channel_root.
  */
 async function scanChannelRoot(scanRoot, expectedSlug, identity, discovered) {
-  const fs = require('fs');
-  const path = require('path');
+  const { fs, path } = nodeModules('discovering cartridges');
 
   let nameEntries;
   try {
@@ -7645,7 +7618,6 @@ class Machine {
 // ============================================================================
 
 // Load the Peggy-generated parser
-const machineParser = require('./machine-parser.js');
 
 /**
  * Assign a media URN to a node, or check consistency if already assigned.
@@ -8026,22 +7998,13 @@ class MediaRegistryEntry {
  * implementations (capdag, capdag-js, capdag-py, capdag-go, capdag-objc)
  * use this same algorithm so a URN's key is identical across languages.
  *
- * Runtime detection: `crypto.subtle` is available in browsers and
- * modern Node (≥ 16, exposed via `globalThis.crypto`); CommonJS Node
- * also has the synchronous `crypto` module. We prefer subtle for
- * portability and fall back to the Node module when subtle is absent.
+ * `crypto.subtle` is on `globalThis` in browsers and in every Node this
+ * package supports.
  */
 async function sha256Hex(s) {
   const utf8 = new TextEncoder().encode(s);
-  if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle) {
-    const buf = await globalThis.crypto.subtle.digest('SHA-256', utf8);
-    return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
-  }
-  // Node CommonJS fallback. require() may throw in strict ESM contexts;
-  // we let it propagate because every supported runtime has a crypto API.
-  // eslint-disable-next-line global-require
-  const nodeCrypto = require('crypto');
-  return nodeCrypto.createHash('sha256').update(utf8).digest('hex');
+  const buf = await globalThis.crypto.subtle.digest('SHA-256', utf8);
+  return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
 }
 
 /**
@@ -8445,12 +8408,7 @@ class Manifest {
   }
 }
 
-// Unified configurable planner vocabulary (mirrors Rust plan_space.rs and the
-// PlanMachines/DiscoverConvergentTargets proto surface).
-const planner = require('./planner.js');
-
-// Export for CommonJS
-module.exports = {
+export {
   // Registry trust vocabulary — one verdict per registry, shared by every
   // cartridge that claims provenance from it.
   RegistryVerdict,
@@ -8466,24 +8424,6 @@ module.exports = {
   registryVerdictRemedy,
   MANIFEST_SIG_FORMAT,
   RELEASE_KEY_CERT_FORMAT,
-  // Planner plan-space vocabulary
-  PlanStateError: planner.PlanStateError,
-  ConvergencePresence: planner.ConvergencePresence,
-  ConvergenceLocation: planner.ConvergenceLocation,
-  ConvergenceMechanism: planner.ConvergenceMechanism,
-  ConvergenceArity: planner.ConvergenceArity,
-  DivergencePresence: planner.DivergencePresence,
-  DivergenceLocation: planner.DivergenceLocation,
-  RankPolicy: planner.RankPolicy,
-  PlanMode: planner.PlanMode,
-  PlanRequest: planner.PlanRequest,
-  parsePlanApex: planner.parsePlanApex,
-  parsePlanProfile: planner.parsePlanProfile,
-  parsePlanCost: planner.parsePlanCost,
-  parsePlanCandidate: planner.parsePlanCandidate,
-  parsePlanCandidates: planner.parsePlanCandidates,
-  parseConvergentTarget: planner.parseConvergentTarget,
-  parseConvergentTargets: planner.parseConvergentTargets,
   ALIAS_TARGET_CAP,
   ALIAS_TARGET_MEDIA,
   tokenIsUrn,
@@ -8541,7 +8481,7 @@ module.exports = {
   MEDIA_OBJECT,
   // List types
   MEDIA_LIST,
-  MEDIA_TEXTABLE_LIST: MEDIA_STRING_LIST,
+  MEDIA_STRING_LIST as MEDIA_TEXTABLE_LIST,
   MEDIA_STRING_LIST,
   MEDIA_INTEGER_LIST,
   MEDIA_NUMBER_LIST,
@@ -8705,3 +8645,25 @@ module.exports = {
   MediaRegistryEntry,
   FabricRegistryClient,
 };
+
+// Unified configurable planner vocabulary (mirrors Rust plan_space.rs and the
+// PlanMachines/DiscoverConvergentTargets proto surface).
+export {
+  PlanStateError,
+  ConvergencePresence,
+  ConvergenceLocation,
+  ConvergenceMechanism,
+  ConvergenceArity,
+  DivergencePresence,
+  DivergenceLocation,
+  RankPolicy,
+  PlanMode,
+  PlanRequest,
+  parsePlanApex,
+  parsePlanProfile,
+  parsePlanCost,
+  parsePlanCandidate,
+  parsePlanCandidates,
+  parseConvergentTarget,
+  parseConvergentTargets,
+} from './planner.js';

package/formal/index.d.ts

@@ -0,0 +1,74 @@
+// Generated by lungo 1.78.3254 from Lean 4.34.1 for program capdagFormal. Do not edit.
+import * as L from "lungo-ts";
+
+/** Lean's CapDAG.Exec.WfCap. */
+export interface WfCap {
+  readonly input: Wf;
+  readonly output: Wf;
+  readonly other: Wf;
+  readonly effect: Effect;
+}
+export function wfCapType(): L.Type<WfCap>;
+
+/** Lean's CapDAG.Effect. */
+export type Effect =
+  | { readonly kind: "unspecified" }
+  | { readonly kind: "declared" }
+  | { readonly kind: "none" }
+  | { readonly kind: "patch" }
+;
+export function effectType(): L.Type<Effect>;
+
+/** Lean's TaggedUrn.Constraint. */
+export type Constraint =
+  | { readonly kind: "missing" }
+  | { readonly kind: "unconstrained" }
+  | { readonly kind: "optionalNot"; readonly value: string }
+  | { readonly kind: "present" }
+  | { readonly kind: "presentNot"; readonly value: string }
+  | { readonly kind: "exact"; readonly value: string }
+  | { readonly kind: "absent" }
+;
+export function constraintType(): L.Type<Constraint>;
+
+/** Lean's TaggedUrn.Exec.Wf, held by handle: only the program's functions make and read its values. */
+export class Wf extends L.Opaque {
+  private constructor();
+}
+export function wfType(): L.Type<Wf>;
+
+/** The layout fingerprint and descriptor of each type, by Lean name, for modules using them. */
+export const leanTypes: {
+  readonly [lean: string]: { readonly fingerprint: string; readonly type: (...args: L.Type<any>[]) => L.Type<any> };
+};
+
+/** The Lean program capdagFormal. */
+export class CapdagFormal {
+  private constructor();
+  /** Lean's CapDAG.Exec.accepts : CapDAG.Exec.WfCap → CapDAG.Exec.WfCap → Bool */
+  accepts(pattern: WfCap, request: WfCap): boolean;
+  /** Lean's CapDAG.Exec.comparable : CapDAG.Exec.WfCap → CapDAG.Exec.WfCap → Bool */
+  comparable(a: WfCap, b: WfCap): boolean;
+  /** Lean's CapDAG.Exec.dispatch : CapDAG.Exec.WfCap → CapDAG.Exec.WfCap → Bool */
+  dispatch(candidate: WfCap, request: WfCap): boolean;
+  /** Lean's CapDAG.Exec.effectOk : CapDAG.Effect → CapDAG.Effect → Bool */
+  effectOk(candidate: Effect, request: Effect): boolean;
+  /** Lean's CapDAG.Exec.equivalent : CapDAG.Exec.WfCap → CapDAG.Exec.WfCap → Bool */
+  equivalent(a: WfCap, b: WfCap): boolean;
+  /** Lean's CapDAG.Exec.rankingKey : CapDAG.Exec.WfCap → CapDAG.Exec.WfCap → Nat × Nat */
+  rankingKey(candidate: WfCap, request: WfCap): [bigint, bigint];
+  /** Lean's CapDAG.Exec.select : List CapDAG.Exec.WfCap → CapDAG.Exec.WfCap → Option CapDAG.Exec.WfCap */
+  select(candidates: Array<WfCap>, request: WfCap): L.Option<WfCap>;
+  /** Lean's CapDAG.Exec.specificity : CapDAG.Exec.WfCap → Nat */
+  specificity(c: WfCap): bigint;
+  /** Lean's TaggedUrn.Exec.make : String → List (String × TaggedUrn.Constraint) → Option TaggedUrn.Exec.Wf */
+  make(scheme: string, tags: Array<[string, Constraint]>): L.Option<Wf>;
+}
+
+export interface LoadOptions {
+  /** The program module (default: `program.wasm` next to this file). */
+  module?: WebAssembly.Module | BufferSource;
+  wasi?: L.Wasi;
+}
+
+export function load(options?: LoadOptions): Promise<CapdagFormal>;

package/formal/index.js

@@ -0,0 +1,185 @@
+// Generated by lungo 1.78.3254 from Lean 4.34.1 for program capdagFormal. Do not edit.
+import * as L from "lungo-ts";
+
+async function programModule() {
+  const url = new URL("./program.wasm", import.meta.url);
+  if (typeof process !== "undefined" && process.versions?.node) {
+    const { readFile } = await import("node:fs/promises");
+    return readFile(url);
+  }
+  const response = await fetch(url);
+  if (!response.ok) throw new Error(`cannot load ${url}: ${response.status}`);
+  return response.arrayBuffer();
+}
+
+/** Describes CapDAG.Exec.WfCap for polymorphic functions. */
+export function wfCapType() {
+  return new L.Type(
+    L.inductiveExpr(0),
+    (w, v) => {
+      if (typeof v !== "object" || v === null) throw new L.MalformedError("not a CapDAG.Exec.WfCap");
+      w.u32(0);
+      wfType().encode(w, v.input);
+      wfType().encode(w, v.output);
+      wfType().encode(w, v.other);
+      effectType().encode(w, v.effect);
+    },
+    (r) => {
+      const c = r.u32();
+      if (c !== 0) throw new L.MalformedError(`constructor index ${c} of CapDAG.Exec.WfCap`);
+      return ({ input: wfType().decode(r), output: wfType().decode(r), other: wfType().decode(r), effect: effectType().decode(r) });
+    },
+  );
+}
+
+/** Describes CapDAG.Effect for polymorphic functions. */
+export function effectType() {
+  return new L.Type(
+    L.inductiveExpr(1),
+    (w, v) => {
+      if (typeof v !== "object" || v === null) throw new L.MalformedError("not a CapDAG.Effect");
+      switch (v.kind) {
+        case "unspecified":
+          w.u32(0);
+          return;
+        case "declared":
+          w.u32(1);
+          return;
+        case "none":
+          w.u32(2);
+          return;
+        case "patch":
+          w.u32(3);
+          return;
+        default:
+          throw new L.MalformedError(`${String(v.kind)} is not a constructor of CapDAG.Effect`);
+      }
+    },
+    (r) => {
+      const c = r.u32();
+      switch (c) {
+        case 0: return ({ kind: "unspecified" });
+        case 1: return ({ kind: "declared" });
+        case 2: return ({ kind: "none" });
+        case 3: return ({ kind: "patch" });
+        default: throw new L.MalformedError(`constructor index ${c} of CapDAG.Effect`);
+      }
+    },
+  );
+}
+
+/** Describes TaggedUrn.Constraint for polymorphic functions. */
+export function constraintType() {
+  return new L.Type(
+    L.inductiveExpr(2),
+    (w, v) => {
+      if (typeof v !== "object" || v === null) throw new L.MalformedError("not a TaggedUrn.Constraint");
+      switch (v.kind) {
+        case "missing":
+          w.u32(0);
+          return;
+        case "unconstrained":
+          w.u32(1);
+          return;
+        case "optionalNot":
+          w.u32(2);
+          L.STRING.encode(w, v.value);
+          return;
+        case "present":
+          w.u32(3);
+          return;
+        case "presentNot":
+          w.u32(4);
+          L.STRING.encode(w, v.value);
+          return;
+        case "exact":
+          w.u32(5);
+          L.STRING.encode(w, v.value);
+          return;
+        case "absent":
+          w.u32(6);
+          return;
+        default:
+          throw new L.MalformedError(`${String(v.kind)} is not a constructor of TaggedUrn.Constraint`);
+      }
+    },
+    (r) => {
+      const c = r.u32();
+      switch (c) {
+        case 0: return ({ kind: "missing" });
+        case 1: return ({ kind: "unconstrained" });
+        case 2: return ({ kind: "optionalNot", value: L.STRING.decode(r) });
+        case 3: return ({ kind: "present" });
+        case 4: return ({ kind: "presentNot", value: L.STRING.decode(r) });
+        case 5: return ({ kind: "exact", value: L.STRING.decode(r) });
+        case 6: return ({ kind: "absent" });
+        default: throw new L.MalformedError(`constructor index ${c} of TaggedUrn.Constraint`);
+      }
+    },
+  );
+}
+
+/** Lean's TaggedUrn.Exec.Wf, held by handle: only the program's functions make and read its values. */
+export class Wf extends L.Opaque {}
+
+/** Describes TaggedUrn.Exec.Wf for polymorphic functions. */
+export function wfType() {
+  return new L.Type(
+    L.inductiveExpr(3),
+    (w, v) => {
+      if (!(v instanceof Wf)) throw new L.MalformedError("not a TaggedUrn.Exec.Wf");
+      L.OPAQUE.encode(w, v);
+    },
+    (r) => new Wf(r.program, r.u64()),
+  );
+}
+
+/** The layout fingerprint and descriptor of each type, by Lean name, for modules using them. */
+export const leanTypes = Object.freeze({
+  "CapDAG.Exec.WfCap": Object.freeze({ fingerprint: "2b8d6466d218f4ae6bc98d95bba55d98f21cac4a49446ae170993773cefdb830", type: wfCapType }),
+  "CapDAG.Effect": Object.freeze({ fingerprint: "38c7bd3c0527cda156713cd441c9b6b92bd5df8a39108fa101449a789abcb477", type: effectType }),
+  "TaggedUrn.Constraint": Object.freeze({ fingerprint: "481fc09e23c6415a7c3f05887577ec940a6ecc84b005e63476c1060b59edcac7", type: constraintType }),
+  "TaggedUrn.Exec.Wf": Object.freeze({ fingerprint: "20e9f81ad195b2f4a481e7a5dcae2b3d0de6efe7b3dc720db0e2aa3b52527785", type: wfType }),
+});
+
+/** The Lean program capdagFormal. */
+export class CapdagFormal {
+  #program;
+  constructor(program) {
+    this.#program = program;
+  }
+  accepts(pattern, request) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_daccepts", [], [[wfCapType(), pattern], [wfCapType(), request]], L.value(L.BOOL));
+  }
+  comparable(a, b) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_dcomparable", [], [[wfCapType(), a], [wfCapType(), b]], L.value(L.BOOL));
+  }
+  dispatch(candidate, request) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_ddispatch", [], [[wfCapType(), candidate], [wfCapType(), request]], L.value(L.BOOL));
+  }
+  effectOk(candidate, request) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_deffectOk", [], [[effectType(), candidate], [effectType(), request]], L.value(L.BOOL));
+  }
+  equivalent(a, b) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_dequivalent", [], [[wfCapType(), a], [wfCapType(), b]], L.value(L.BOOL));
+  }
+  rankingKey(candidate, request) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_drankingKey", [], [[wfCapType(), candidate], [wfCapType(), request]], L.value(L.pair(L.NAT, L.NAT)));
+  }
+  select(candidates, request) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_dselect", [], [[L.list(wfCapType()), candidates], [wfCapType(), request]], L.value(L.option(wfCapType())));
+  }
+  specificity(c) {
+    return this.#program.invoke("capdagFormal__call_l_CapDAG_dExec_dspecificity", [], [[wfCapType(), c]], L.value(L.NAT));
+  }
+  make(scheme, tags) {
+    return this.#program.invoke("capdagFormal__call_l_TaggedUrn_dExec_dmake", [], [[L.STRING, scheme], [L.list(L.pair(L.STRING, constraintType())), tags]], L.value(L.option(wfType())));
+  }
+}
+
+/** Instantiates the program; `options.host` implements its externs. */
+export async function load(options = {}) {
+  const program = await L.Program.load(options.module ?? (await programModule()), { wasi: options.wasi });
+  program.types("capdagFormal__types");
+  return new CapdagFormal(program);
+}