dsh-logicprobe 0.6.8 → 0.7.0

package/lib/engine.js

@@ -1,5 +1,40 @@
 import { createHash } from 'node:crypto';
 export const ENGINE_SCHEMA_VERSION = 1;
+export function isStateGuard(when) {
+    return 'state' in when;
+}
+/** Allowed keys per invariant kind — the schema is closed, so anything else is a typo or an unsupported feature. */
+const INVARIANT_KEYS = {
+    'never-states': new Set(['id', 'description', 'kind', 'states']),
+    'var-in-range': new Set(['id', 'description', 'kind', 'variable', 'min', 'max', 'when']),
+    'event-before-state': new Set(['id', 'description', 'kind', 'event', 'state']),
+    'leads-to': new Set(['id', 'description', 'kind', 'from', 'to']),
+    'sequence': new Set(['id', 'description', 'kind', 'events']),
+    'atomicity': new Set(['id', 'description', 'kind', 'events', 'commit', 'rollback']),
+    'budget': new Set(['id', 'description', 'kind', 'budget']),
+    'probability': new Set(['id', 'description', 'kind', 'target', 'op', 'p']),
+};
+const KNOWN_INVARIANT_KINDS = new Set(Object.keys(INVARIANT_KEYS));
+/**
+ * Declared keys per model part. The model schema is closed: a key that is not
+ * declared is a typo or an unsupported feature, and silently ignoring it can make
+ * the engine report a property that the model does not actually have (a mistyped
+ * guard variable reads as an always-false guard, which prunes real paths and can
+ * yield a false "no deadlock"). Rejecting is the only safe option for a verifier.
+ */
+const MODEL_KEYS = {
+    root: new Set(['schemaVersion', 'init', 'states', 'transitions', 'variables', 'invariants', 'concurrentPairs', 'boundaryChecks', 'resourcePairs', 'idempotentEvents', 'tickEvents', 'narrative']),
+    state: new Set(['id', 'terminal', 'onEntry', 'onExit', 'maxTicks']),
+    transition: new Set(['from', 'event', 'to', 'guard', 'updates', 'cost', 'weight']),
+    update: new Set(['variable', 'op', 'value']),
+    variable: new Set(['name', 'kind', 'init', 'min', 'max', 'monotonic']),
+    // LogicModelV1 boundary checks are (variable, values). The data-model engine has
+    // its own (entity, field) shape and its own validator — the two must not be mixed.
+    boundaryCheck: new Set(['variable', 'values']),
+    resourcePair: new Set(['resource', 'acquireEvent', 'releaseEvent', 'failEvent']),
+    narrative: new Set(['states', 'events', 'scenarios']),
+    scenario: new Set(['from', 'event', 'scenario']),
+};
 const DEFAULT_MAX_STATES = 10_000;
 const DEFAULT_MAX_PERMUTATION_EVENTS = 5;
 function stableStringify(value) {
@@ -22,6 +57,13 @@ export function validateModel(input) {
         return { ok: false, errors: ['model: must be an object'] };
     }
     const root = input;
+    const rejectUnknownKeys = (value, allowed, path) => {
+        const unexpected = Object.keys(value).filter((key) => !allowed.has(key));
+        if (unexpected.length > 0) {
+            bad(path + '.' + unexpected[0], 'unknown field (allowed: ' + [...allowed].join(', ') + ')');
+        }
+    };
+    rejectUnknownKeys(root, MODEL_KEYS.root, 'model');
     if (root.schemaVersion !== 1)
         bad('schemaVersion', 'must be 1');
     if (typeof root.init !== 'string' || root.init.length === 0)
@@ -37,6 +79,7 @@ export function validateModel(input) {
                 return;
             }
             const state = entry;
+            rejectUnknownKeys(state, MODEL_KEYS.state, 'states[' + index + ']');
             if (typeof state.id !== 'string' || state.id.length === 0)
                 bad('states[' + index + '].id', 'must be a non-empty string');
             else if (seen.has(state.id))
@@ -75,6 +118,7 @@ export function validateModel(input) {
                 return;
             }
             const transition = entry;
+            rejectUnknownKeys(transition, MODEL_KEYS.transition, path);
             if (typeof transition.from !== 'string' || transition.from.length === 0)
                 bad(path + '.from', 'must be a non-empty string');
             else if (!stateIds.has(transition.from))
@@ -98,6 +142,7 @@ export function validateModel(input) {
                             return;
                         }
                         const record = update;
+                        rejectUnknownKeys(record, MODEL_KEYS.update, updatePath);
                         if (typeof record.variable !== 'string' || record.variable.length === 0)
                             bad(updatePath + '.variable', 'must be a non-empty string');
                         if (record.op !== 'set' && record.op !== 'inc' && record.op !== 'dec')
@@ -135,6 +180,7 @@ export function validateModel(input) {
                     return;
                 }
                 const variable = entry;
+                rejectUnknownKeys(variable, MODEL_KEYS.variable, path);
                 if (typeof variable.name !== 'string' || variable.name.length === 0)
                     bad(path + '.name', 'must be a non-empty string');
                 else if (variableNames.has(variable.name))
@@ -168,6 +214,10 @@ export function validateModel(input) {
         else if (!variableNames.has(name))
             bad(path, 'references unknown variable ' + name);
     };
+    const invariantStateIds = new Set(Array.isArray(root.states) ? root.states.map((state) => state.id) : []);
+    // Reference sets for invariant targets: denormalising a kind's target into the
+    // report makes a mistyped id look authoritative, so every reference must resolve.
+    const invariantEventIds = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.event) : []);
     if (root.invariants !== undefined) {
         if (!Array.isArray(root.invariants))
             bad('invariants', 'must be an array');
@@ -183,6 +233,17 @@ export function validateModel(input) {
                     bad(path + '.id', 'must be a non-empty string');
                 if (typeof invariant.description !== 'string')
                     bad(path + '.description', 'must be a string');
+                // Reject keys the selected kind does not declare instead of silently ignoring
+                // them: an ignored field (e.g. a `when` scope on a kind that cannot honor it)
+                // still shows up in the echoed report and reads as if it took effect. Kinds an
+                // older reader may not know are skipped so they still fail on `.kind` alone.
+                if (KNOWN_INVARIANT_KINDS.has(invariant.kind)) {
+                    const allowed = INVARIANT_KEYS[invariant.kind];
+                    const unexpected = Object.keys(invariant).filter((key) => !allowed.has(key));
+                    if (unexpected.length > 0) {
+                        bad(path + '.' + unexpected[0], 'unknown field for kind ' + String(invariant.kind) + ' (allowed: ' + [...allowed].join(', ') + ')');
+                    }
+                }
                 if (invariant.kind === 'never-states') {
                     if (!Array.isArray(invariant.states) || invariant.states.length === 0)
                         bad(path + '.states', 'must be a non-empty array');
@@ -190,6 +251,8 @@ export function validateModel(input) {
                         invariant.states.forEach((state, stateIndex) => {
                             if (typeof state !== 'string' || state.length === 0)
                                 bad(path + '.states[' + stateIndex + ']', 'must be a non-empty string');
+                            else if (!invariantStateIds.has(state))
+                                bad(path + '.states[' + stateIndex + ']', 'references unknown state ' + state);
                         });
                 }
                 else if (invariant.kind === 'var-in-range') {
@@ -198,18 +261,57 @@ export function validateModel(input) {
                         bad(path + '.min', 'must be a number');
                     if (invariant.max !== undefined && typeof invariant.max !== 'number')
                         bad(path + '.max', 'must be a number');
+                    if (invariant.min === undefined && invariant.max === undefined)
+                        bad(path, 'requires min or max (a range with neither bound is vacuous)');
+                    if (invariant.when !== undefined) {
+                        const when = invariant.when;
+                        if (typeof when !== 'object' || when === null || Array.isArray(when)) {
+                            bad(path + '.when', 'must be an object');
+                        }
+                        else if ('state' in when) {
+                            const scope = when;
+                            for (const key of Object.keys(scope)) {
+                                if (key !== 'state')
+                                    bad(path + '.when.' + key, 'unknown field for a state scope (allowed: state)');
+                            }
+                            const state = scope.state;
+                            if (typeof state !== 'string' || state.length === 0)
+                                bad(path + '.when.state', 'must be a non-empty string');
+                            else if (!invariantStateIds.has(state))
+                                bad(path + '.when.state', 'references unknown state ' + state);
+                        }
+                        else {
+                            validateGuard(when, path + '.when', errors, bad);
+                            for (const variable of guardVariables(when)) {
+                                if (variable === invariant.variable) {
+                                    bad(path + '.when', 'must not reference the constrained variable ' + invariant.variable + ' (it can mask its own violation)');
+                                }
+                                else {
+                                    validateVariableRef(variable, path + '.when');
+                                }
+                            }
+                        }
+                    }
                 }
                 else if (invariant.kind === 'event-before-state') {
                     if (typeof invariant.event !== 'string' || invariant.event.length === 0)
                         bad(path + '.event', 'must be a non-empty string');
+                    else if (!invariantEventIds.has(invariant.event))
+                        bad(path + '.event', 'references unknown event ' + invariant.event);
                     if (typeof invariant.state !== 'string' || invariant.state.length === 0)
                         bad(path + '.state', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.state))
+                        bad(path + '.state', 'references unknown state ' + invariant.state);
                 }
                 else if (invariant.kind === 'leads-to') {
                     if (typeof invariant.from !== 'string' || invariant.from.length === 0)
                         bad(path + '.from', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.from))
+                        bad(path + '.from', 'references unknown state ' + invariant.from);
                     if (typeof invariant.to !== 'string' || invariant.to.length === 0)
                         bad(path + '.to', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.to))
+                        bad(path + '.to', 'references unknown state ' + invariant.to);
                 }
                 else if (invariant.kind === 'sequence') {
                     if (!Array.isArray(invariant.events) || invariant.events.length === 0)
@@ -240,6 +342,8 @@ export function validateModel(input) {
                 else if (invariant.kind === 'probability') {
                     if (typeof invariant.target !== 'string' || invariant.target.length === 0)
                         bad(path + '.target', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.target))
+                        bad(path + '.target', 'references unknown state ' + invariant.target);
                     if (invariant.op !== '>=' && invariant.op !== '<=' && invariant.op !== '>' && invariant.op !== '<')
                         bad(path + '.op', "must be one of '>=', '<=', '>', '<'");
                     if (typeof invariant.p !== 'number' || !Number.isFinite(invariant.p) || invariant.p < 0 || invariant.p > 1)
@@ -272,6 +376,7 @@ export function validateModel(input) {
                     return;
                 }
                 const check = entry;
+                rejectUnknownKeys(check, MODEL_KEYS.boundaryCheck, path);
                 validateVariableRef(check.variable, path + '.variable');
                 if (!Array.isArray(check.values) || check.values.some((value) => typeof value !== 'number'))
                     bad(path + '.values', 'must be an array of numbers');
@@ -306,6 +411,7 @@ export function validateModel(input) {
                     return;
                 }
                 const pair = entry;
+                rejectUnknownKeys(pair, MODEL_KEYS.resourcePair, path);
                 if (typeof pair.resource !== 'string' || pair.resource.length === 0)
                     bad(path + '.resource', 'must be a non-empty string');
                 if (typeof pair.acquireEvent !== 'string' || pair.acquireEvent.length === 0)
@@ -323,6 +429,7 @@ export function validateModel(input) {
         }
         else {
             const narrative = root.narrative;
+            rejectUnknownKeys(narrative, MODEL_KEYS.narrative, narrativePath);
             const stateIds = new Set(Array.isArray(root.states) ? root.states.map((state) => state.id) : []);
             const eventIds = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.event) : []);
             const fromEventGroups = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.from + '|' + transition.event) : []);
@@ -368,6 +475,7 @@ export function validateModel(input) {
                         return;
                     }
                     const scenario = entry;
+                    rejectUnknownKeys(scenario, MODEL_KEYS.scenario, scenarioPath);
                     if (typeof scenario.from !== 'string' || scenario.from.length === 0)
                         bad(scenarioPath + '.from', 'must be a non-empty string');
                     else if (!stateIds.has(scenario.from))
@@ -845,10 +953,18 @@ function S5_eventCompleteness(model) {
     }
     return checkResult('S5', 'Event Completeness', findings, findings.length === 0 ? 'All states handle all relevant events' : findings.length + ' unhandled (state, event) pairs');
 }
-function invariantHolds(invariant, runtime) {
+/** Whether a `var-in-range` `when` scope selects this runtime state. */
+function whenScopeHolds(when, runtime) {
+    return isStateGuard(when) ? when.state === runtime.state : evalGuard(when, runtime.vars);
+}
+function invariantHolds(invariant, runtime, isInitial = false) {
     if (invariant.kind === 'never-states')
         return !invariant.states.includes(runtime.state);
     if (invariant.kind === 'var-in-range') {
+        // The initial runtime state is checked unconditionally: a machine must never be
+        // able to escape the range simply by starting outside the scope.
+        if (!isInitial && invariant.when !== undefined && !whenScopeHolds(invariant.when, runtime))
+            return true;
         const value = runtime.vars[invariant.variable];
         if (typeof value !== 'number')
             return false;
@@ -865,7 +981,7 @@ function shortestViolationForInvariant(model, options, invariant) {
         return shortestEventBeforeStateViolation(model, options, invariant);
     }
     const init = initialState(model);
-    if (!invariantHolds(invariant, init)) {
+    if (!invariantHolds(invariant, init, true)) {
         return { invariant, path: [], reason: 'Initial state violates the invariant.' };
     }
     const visited = new Set([runtimeKey(init)]);
@@ -1375,6 +1491,15 @@ function mapInvariantForComparison(invariant, mapping) {
             state: mapStateId(mapping, invariant.state),
         };
     }
+    if (invariant.kind === 'var-in-range') {
+        const mapped = { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' };
+        // A state scope must follow the state rename, otherwise D2 reports a spurious
+        // regression when the scope later refers to a state id that no longer exists.
+        if (mapped.when !== undefined && isStateGuard(mapped.when)) {
+            mapped.when = { state: mapStateId(mapping, mapped.when.state) };
+        }
+        return mapped;
+    }
     return { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' };
 }
 function D2_invariantContinuity(before, after, options, mapping) {