gdp-wired 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tom X Nguyen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,230 @@
-# Temporary Holding Version
+<img src="https://raw.githubusercontent.com/monotykamary/gdp-wired/main/static/banner-ink.svg" alt="gdp-wired" width="100%" />
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# gdp-wired
+
+Laws about stateful rules (budgets, caps, rate limits, access policies), proven in TypeScript by a small trusted
+kernel, with an untrusted prover that writes the proofs, an optional Lean twin that checks the kernel itself, and GPU
+searches that find counterexamples or the invariants a proof needs.
+
+You write the rule once with typed builders and state what must always hold. The library proves it by induction (or
+shows a real run that breaks it), and the same rule runs as an interpreter or ships as generated JavaScript.
+
+```sh
+npm install gdp-wired   # or bun add gdp-wired; plain JavaScript with types, Node 20+, Bun or a browser
+```
+
+```ts
+import {min, nat, proveRule, rule, when} from 'gdp-wired'
+
+// A request of cost c is admitted while spend s is under budget b; each request is capped at m.
+const budget = rule('budget')
+  .params({b: nat, m: nat})
+  .inputs({c: nat})
+  .state({s: 0})
+  .step(({b, m, c, s}) => ({s: when(s.lt(b), s.plus(min(c, m)), s)}))
+const bounded = budget.law('spend stays within b + m', ({s, b, m}) => s.atMost(b.plus(m)))
+
+proveRule(budget, [bounded]) // {proven: true, checked: true}
+```
+
+Names are typed: `({s, bb}) => …` or a law that reads the request `c` is a TypeScript error, not a runtime surprise.
+Forget the cap (`s.plus(c)`) and the kernel refuses the proof; a search from the start turns it into a real run:
+`{params: {b: 1, m: 0}, trace: [{c: 2}]}`. `bun examples/budget.ts` runs all of it, including the generated JavaScript,
+and `examples/domains/` holds 92 rules from nine domains (finance, access control, public services, operations,
+protocols, commerce, supply chains, games, education), each checked three ways.
+
+## Scope: where it replaces Bend, and where it doesn't
+
+gdp-wired is meant to replace Bend where it matters in practice, not to be a language: laws about **stateful rules whose
+state is counters, totals, maps of counters and logs summed over time**, proven automatically, with the rule shipped as
+code. If the checker side finds new frontiers the scope may grow; until then:
+
+| It expresses and proves | It does not (today) |
+| --- | --- |
+| Step machines over naturals: scalars, maps from naturals to naturals (one write per map per step), named step conditions, preconditions on params, assumptions per request | Lists, sets or strings as values: membership, subsets, equality of lists of names |
+| Invariants of the state and params, laws about every key of a map; step laws relating one step's before and after (`s'`, `M'[k]`: "only increases", "stays retired") | Laws about runs of two or more steps ("a refund never follows a release" needs a state flag), or orderings beyond progress |
+| Laws about one key of a map at a time, or about scalars | Totals across a map's keys ("the sum of every client's holdings equals in-use") |
+| Histories: sums and queries over a log of requests, relations between them proven one record at a time, pruning | Unbounded recursion over data, quantifiers over sequences other than a machine's own history |
+| Decisions over facts: flags, one-of choices, optional facts, bounded naturals (`match` covers every case) | Datatypes beyond those encodings; division, modulo, reals |
+| Loops that halt by a rank or a tuple of ranks; folds over binary trees; progress laws ("some request makes this happen") | Arbitrary algorithms: there is no general recursion to prove things about |
+| Arithmetic: `+`, truncated `−`, `×` by a constant, `min`, `max`, `if`, products of two terms (proven by the kernel, less well by the prover) | Generated code for decisions alone (`compileJs` emits machines; a predicate emitter is planned) |
+
+Keep Bend where the specification is about **lists or sets of names** (resource scopes, capability subsets, normalization
+that must refine its input), where a proof needs **induction over data structures**, or where the shipped code must be
+the compiled proved source of an arbitrary algorithm. Use gdp-wired where the rule is a budget, a cap, a window, a
+workflow or a policy decision: it proves those without proof files, finds counterexample runs when they're false, and
+checks its own kernel in Lean.
+
+For a sense of the split: in one real codebase with 98 Bend laws and about 1,600 lines of hand proofs, the policy
+decisions, the compare-and-swap storage plans and the state/provider plans fit gdp-wired as it is (with names interned
+to numbers), and gdp-wired can prove more about storage than its Bend proofs state (no revision reuse across keys); the
+lifecycle machine's before/after laws are step laws (as in `release lifecycle` in `examples/`); the resource and authority checks, built on lists of names as
+sets, stay in Bend. `compare/` puts three rules side by side in gdp-wired, Bend and plain Lean, with line counts and
+check times.
+
+## What's trusted
+
+| Part | Trusted? | What it does |
+| --- | --- | --- |
+| `kernel/kernel.ts`, `core/check.ts` | **Yes** | Turns a machine and its laws into goals (the induction rules: step machines with maps and flags, step laws, loops with ranks, progress, folds over trees, histories) and checks a proof tree for each: splits on linear atoms, a Fourier–Motzkin derivation at each leaf. Refuses names a machine doesn't declare |
+| `kernel/prove.ts` | No | Grows the trees. If it's wrong, the kernel rejects the tree |
+| `lean-kernel/` | Optional | The kernel's twin in Lean 4.34.0, each rule proven sound (`Kern.sound`, `machine_sound`, `mmachine_sound`, `fmmachine_sound`, `loop_sound`, `fold_sound`, `progress_sound`, `steplaw_sound`, `hmachine_sound`), axioms `propext`, `Classical.choice`, `Quot.sound` only. The exporter sends the kernel's real trees; tampered ones compute to false |
+| `search/`, `synth/`, `hw/` | No | GPU work: counterexample search over every short history, and invariant/rank synthesis. Every hit is replayed by the interpreter or proven by the kernel before it counts |
+| `core/dsl.ts`, the runtimes | No | The builders compile to the kernel's plain values; the interpreter and generated JavaScript are held to the reference evaluator by the conformance test |
+
+How the untrusted parts are held to the trusted ones, automatically:
+
+- **Types**: the whole repo type-checks strictly (`noImplicitReturns`, `noFallthroughCasesInSwitch`,
+  `noUncheckedIndexedAccess`), and a type-aware lint denies warnings; every switch over term and condition operations is
+  exhaustive and ends in `unreachable()`, so a new operation fails to compile wherever it's missing.
+- **Conformance** (`core/conformance.test.ts`): random terms over every operation through every consumer (interpreter,
+  generated JS, the kernel on fixed values, the GPU search's u32 twin, the old symbolic prover) against the reference
+  evaluator, and the same cases through Lean's own `evalE` (`lean-kernel/conformance.ts`).
+- **Examples** (`examples/`): every law proven by the kernel and re-checked by Lean, every rule run at random through
+  both runtimes, and every broken variant broken by a real run (a refused proof alone could be the prover's weakness).
+- **Tampering and mutation** (`kernel/tamper.test.ts`, `kernel/refusals.test.ts`, `kernel/mutants.ts`): real proofs
+  broken structurally or offered for weakened goals that have a model must be rejected, every refusal the kernel makes is
+  exercised, and every one-operator mutation of `kernel.ts` and `check.ts` is run against the tests to find what they
+  don't notice: 222 of 241 mutants are caught, and the 19 left are equivalent (`kernel/MUTANTS.md`).
+- **Fuzz**: the kernel never accepts a refutation of something with a model (`kernel/kernel.test.ts`), and laws proven
+  over histories hold on every run (`kernel/history.test.ts`).
+
+## Writing laws
+
+The builders (`core/dsl.ts`) hand out typed values for every name you declare; everything compiles to the plain machine
+the kernel checks, so nothing in them is trusted.
+
+```ts
+import {bool, count, forall, maybe, nat, oneOf, proveSteps, relation, rule, yes} from 'gdp-wired'
+
+// Maps and flags: a grant is decided once per step; each map is written once; a map law holds at every key.
+const caps = rule('caps')
+  .params({d: nat})
+  .inputs({acct: nat, day: nat, ok: bool})
+  .maps({Acct: 0, Day: 0})
+  .flags(({ok, acct, day, d, Acct, Day}) => ({granted: ok.and(Acct.at(acct).lt(1), Day.at(day).lt(d))}))
+  .step(({acct, day, granted, Acct, Day}) => ({Acct: Acct.bump(acct, granted), Day: Day.bump(day, granted)}))
+const dayCap = caps.law('day cap', ({Day, d}) => forall(k => Day.at(k).atMost(d)))
+
+// Step laws: about one step, for every request the rule allows; `after` reads the state and maps after it.
+const onlyUp = caps.stepLaw('no count goes down', ({Day}, after) => forall(k => Day.at(k).atMost(after.Day.at(k))))
+const once = caps.stepLaw('a grant adds one to its day', ({day, Day}, after) => after.Day.at(day).eq(Day.at(day).plus(1)), ({granted}) => granted)
+proveSteps(caps, [dayCap], [onlyUp, once]) // {proven: true, checked: true}
+
+// Histories: a log of requests, a sum over it (state), a query over it at the request's time (an input the runtime
+// computes), and a relation between them proven one record at a time.
+const window = rule('window limit')
+  .params({w: nat, c: nat, now: nat})
+  .inputs({forced: bool, t: nat})
+  .log('forced', 't')
+  .sums({ours: (r, {now, w}) => count(r.forced.not().and(r.t.atMost(now), now.lt(r.t.plus(w))))})
+  .queries({seen: (r, {t, w}) => count(t.lt(r.t.plus(w)))})
+  .flags(({forced, seen, c}) => ({admitted: forced.not().and(seen.plus(1).atMost(c))}))
+  .keep(({forced, admitted}) => forced.or(admitted))
+  .relations(({t, now, ours, seen}) => [relation(ours.atMost(seen), t.atMost(now))])
+  .prune('t', ({w}) => w) // requests in time order: records older than the window are dropped
+
+// Decisions over facts: optional facts and choices, every case covered.
+const trial = rule('trial').inputs({plan: oneOf('free', 'pro'), spent: maybe(nat), allowance: maybe(nat)})
+const failsClosed = trial.decide('a missing fact means no trial', ({spent}) => spent.isNone,
+  ({plan, spent, allowance}) => plan.match({free: () => spent.match({none: () => yes, some: s => allowance.match({none: () => yes, some: a => s.atLeast(a)})}), pro: () => yes}))
+```
+
+- **Kinds**: `nat`, `upTo(k)`, `bool`, `oneOf(...)`, `maybe(kind)`; their assumptions (a bit is 0 or 1, a choice is in
+  range) go to the kernel by themselves, and `encodeInput`/`encodeParams` turn runtime values into the numbers the
+  machine reads.
+- **Arithmetic** over the naturals: `plus`, `minus` (truncated), `times(k)`, `mul` (a product of two terms), `min`,
+  `max`, `when(cond, a, b)`, `count(cond)`; conditions `lt`, `atMost`, `eq`, `and`, `or`, `not`, `implies`.
+- **Loops** (`loop(...)`): state, `while`, `body`, a `rank` (or a tuple of ranks) that must drop each turn.
+- **Running it**: `rule.interpreter()` is persistent (searches branch from any state); `rule.compiled()` is what an app
+  ships: maps and the log updated in place, so a step costs the same however long the history. Both refuse params and
+  inputs that aren't naturals below 2^53 and any value past 2^53 − 1, where the proofs over the naturals stop describing
+  the run. The GPU searches refuse a space whose values could pass 2^32 − 1.
+
+## Numbers
+
+On Modal CPUs (2 vCPU), generated JavaScript, the answers checked against the interpreter:
+
+| Machine | 1k | 10k | 100k | 1M |
+| --- | --- | --- | --- | --- |
+| Per-key caps (`perf/grant-scale.ts`), requests | 0.3 ms | 2.5 ms | 29 ms | 267 ms |
+| Window limit, pruned (`perf/window-scale.ts`), events | 0.8 ms | 3.1 ms | 16 ms | 136 ms |
+
+Pruned, the window limit holds about 35 records whatever the event count; unpruned, each request scans every record kept
+(76 ms at 10k events). The interpreter copies its maps each step (it's the reference, and searches branch from it):
+1.6 s for 10k requests of the caps rule.
+
+A brute-force enumeration of 2^31 worlds (`enum/`, `perf/bend-enum/`), the same predicate as Bend programs and as a
+Handwired word program: on an M2, Bend takes 985 ms sequential, 221 ms parallel and 153 ms on Metal (whole process,
+about 130 ms of it device setup); ours takes 33 ms warm on WebGPU, with about 115 ms of device setup first. On an NVIDIA
+L4 ours takes 5 ms warm; Bend's CUDA build compiled, but its GPU runs hung in our tests (its CPU builds ran: 109 ms
+parallel).
+
+## Compared with Bend and Lean
+
+`compare/` writes three rules (a budget, per-key caps, a sliding-window limit) in gdp-wired, in Bend 2 and in plain Lean
+4, each checked by its own tool on Modal, each also handed the same bug to reject. From `compare/README.md`:
+
+| | Rule lines | Law lines | Proof lines | Check (median, whole command) |
+| --- | --- | --- | --- | --- |
+| gdp-wired | 5–7 | 1–4 | 1–2 (`proveRule`) | 25–44 ms |
+| Bend 2 | 39–98 (25–50 of them proof evidence in the rule) | 5–26 | 74–117 | 137–161 ms (`--verdict` 167–178 ms) |
+| Lean 4 (by hand) | 4–15 | 1–4 | 8–30 | 488–571 ms |
+
+Most of each time is the tool's startup (17, 134 and 453 ms). gdp-wired's kernel trees for the same rules re-check in
+its Lean twin in 1.35 s. What each proves, what each ships at runtime, and where each is the better tool are in
+`compare/README.md`.
+
+## Layout
+
+| Path | What |
+| --- | --- |
+| `core/` | Machines, the interpreter and JS compiler, the linear solver and its checker, Houdini invariants, models, the first Lean export |
+| `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
+| `lean/`, `lean-kernel/` | Lean: the derivation checker `Cert.lean`, and the kernel's twin with its exported trees |
+| `search/`, `hw/`, `modal-gpu/` | Counterexample search on the GPU: a hand-written WGSL kernel, and the same through the Handwired fork's word stages |
+| `synth/` | Invariants and ranks found on the GPU, proven by the kernel |
+| `next/` | Guards synthesized from laws, relational laws (migrations, tenant isolation), a ReBAC audit |
+| `sat/` | Bit-vector laws: bit-blasted, solved, LRAT-checked in TypeScript, optionally by Lean |
+| `enum/`, `perf/` | The enumeration, and the benchmarks |
+| `examples/` | The builders at work: `domains/` (92 rules across nine domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts` |
+| `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
+| `spec.ts`, `gdp.ts`, `circuit.ts`, `laws.ts` | The audit path: gdp-ts predicates written once, as trusted provers per request and as a Handwired circuit that decides every (user, project) pair at once |
+| `modal/` | Everything above as Modal jobs: `suite.json` is the regression suite |
+| `vendor/handwired` | [monotykamary/handwired](https://github.com/monotykamary/handwired), branch `u32-words`: Cheng Lou's Handwired with exact u32 word circuits and word stages in loop programs |
+| `vendor/gdp-ts` | [rauchg/gdp-ts](https://github.com/rauchg/gdp-ts) |
+
+## Running
+
+The npm package is the library: the builders (`gdp-wired`), the runtimes (`gdp-wired/machine`), the kernel
+(`gdp-wired/kernel`), the prover (`gdp-wired/prove`), the derivation checker and solver (`gdp-wired/check`,
+`gdp-wired/solver`). Everything else here (examples, comparisons, the Lean twin, the GPU searches) runs from a clone and
+needs [Bun](https://bun.sh); Lean 4.34.0 for `lean/` and `lean-kernel/`; a WebGPU runtime (Chrome, or Dawn's node
+bindings) for the GPU parts. Releases: bump `version` in `package.json` and push to main;
+`.github/workflows/publish.yml` publishes it with npm provenance.
+
+```sh
+git clone --recursive https://github.com/monotykamary/gdp-wired && cd gdp-wired
+bun examples/budget.ts
+bun test core/compile.test.ts core/runtime.test.ts kernel/history.test.ts
+cd kernel && bun run-kernel.ts && bun test kernel.test.ts
+```
+
+The whole suite (107 jobs, about 15 minutes of wall time) runs on [Modal](https://modal.com):
+
+```sh
+modal run modal/run.py --jobs modal/suite.json --out runs/modal/suite && sh modal/reap.sh
+```
+
+Each directory's README has its own runs and results.
+
+## Credits
+
+[gdp-ts](https://github.com/rauchg/gdp-ts) by Guillermo Rauch (Ghosts of Departed Proofs for TypeScript) is where the
+audit path starts; [Handwired](https://github.com/chenglou/handwired) by Cheng Lou is the circuit and GPU runtime this
+builds on, through a fork; [Bend](https://github.com/bendlang/bend) is the language the laws were first written in,
+and the yardstick for the benchmarks.
+
+## License
+
+MIT

package/dist/core/check.d.ts

@@ -0,0 +1,3 @@
+import type { Constraint, Step } from './solver.js';
+export declare function checkRefutation(constraints: Constraint[], steps: Step[]): boolean;
+export declare function checkWitness(constraints: Constraint[], witness: Record<string, number>): boolean;

package/dist/core/check.js

@@ -0,0 +1,31 @@
+const vars = (lin) => Object.keys(lin).filter(key => key !== '1');
+export function checkRefutation(constraints, steps) {
+    const rows = [];
+    for (const [i, s] of steps.entries()) {
+        if (s.kind === 'input') {
+            if (!(s.index >= 0 && s.index < constraints.length))
+                return false;
+            rows.push(constraints[s.index].lin);
+        }
+        else if (s.kind === 'combine') {
+            if (!(s.a < i && s.b < i && Number.isInteger(s.ma) && Number.isInteger(s.mb) && s.ma > 0 && s.mb > 0))
+                return false;
+            const out = {};
+            for (const [lin, m] of [[rows[s.a], s.ma], [rows[s.b], s.mb]])
+                for (const [key, c] of Object.entries(lin))
+                    out[key] = (out[key] ?? 0) + m * c;
+            rows.push(out);
+        }
+        else {
+            const row = rows[s.of];
+            if (!(row !== undefined && s.of < i && Number.isInteger(s.g) && s.g > 0 && vars(row).every(key => row[key] % s.g === 0)))
+                return false;
+            rows.push({ ...Object.fromEntries(vars(row).map(key => [key, row[key] / s.g])), 1: Math.ceil((row['1'] ?? 0) / s.g) });
+        }
+    }
+    const last = rows.at(-1);
+    return last !== undefined && vars(last).every(key => last[key] === 0) && (last['1'] ?? 0) > 0;
+}
+export function checkWitness(constraints, witness) {
+    return constraints.every(c => Object.entries(c.lin).reduce((sum, [key, a]) => sum + a * (key === '1' ? 1 : (witness[key] ?? NaN)), 0) <= 0);
+}

package/dist/core/dsl.d.ts

@@ -0,0 +1,267 @@
+import { type C, type E, type Law, type Machine, type State } from './machine.js';
+import { type Goal, type Loop, type StepLaw, type Tree } from '../kernel/kernel.js';
+export type TermLike = Term | number;
+export declare const termOf: (t: TermLike) => E;
+export declare class Term {
+    readonly e: E;
+    constructor(e: E);
+    plus(b: TermLike): Term;
+    minus(b: TermLike): Term;
+    times(k: number): Term;
+    mul(b: TermLike): Term;
+    lt(b: TermLike): Cond;
+    atMost(b: TermLike): Cond;
+    gt(b: TermLike): Cond;
+    atLeast(b: TermLike): Cond;
+    eq(b: TermLike): Cond;
+    ne(b: TermLike): Cond;
+}
+export declare class Cond {
+    readonly c: C;
+    constructor(c: C);
+    and(...xs: Cond[]): Cond;
+    or(...xs: Cond[]): Cond;
+    not(): Cond;
+    implies(b: Cond): Cond;
+    iff(b: Cond): Cond;
+}
+export declare const lit: (v: number) => Term;
+export declare const yes: Cond;
+export declare const no: Cond;
+export declare const all: (...cs: Cond[]) => Cond;
+export declare const any: (...cs: Cond[]) => Cond;
+export declare const not: (c: Cond) => Cond;
+export declare const min: (a: TermLike, b: TermLike) => Term;
+export declare const max: (a: TermLike, b: TermLike) => Term;
+export declare const when: (c: Cond, then: TermLike, otherwise: TermLike) => Term;
+export declare const choose: (c: Cond, then: Cond, otherwise: Cond) => Cond;
+export declare const count: (c: Cond) => Term;
+export declare const sum: (first: TermLike, ...rest: TermLike[]) => Term;
+type Rand = (k: number) => number;
+type Raw = number | boolean | string | null | undefined;
+export declare abstract class Kind<V> {
+    readonly _value: V;
+    abstract vars(name: string): string[];
+    abstract assume(name: string): Cond[];
+    abstract value(name: string, prefix?: string): V;
+    abstract encode(name: string, raw: Raw): Record<string, number>;
+    abstract random(name: string, rand: Rand, bound: number): Record<string, number>;
+}
+export declare const nat: Kind<Term>;
+export declare const upTo: (maxValue: number) => Kind<Term>;
+export declare class Bool extends Cond {
+    readonly n: Term;
+    constructor(n: Term);
+}
+export declare const bool: Kind<Bool>;
+export declare class Choice<K extends string> {
+    readonly n: Term;
+    readonly values: readonly K[];
+    constructor(n: Term, values: readonly K[]);
+    is(k: K): Cond;
+    match(cases: {
+        [k in K]: () => Cond;
+    }): Cond;
+    match(cases: {
+        [k in K]: () => TermLike;
+    }): Term;
+}
+export declare const oneOf: <const K extends string>(...values: K[]) => Kind<Choice<K>>;
+export declare class Maybe<V> {
+    private readonly present;
+    private readonly inner;
+    constructor(present: Term, inner: V);
+    get isSome(): Cond;
+    get isNone(): Cond;
+    match(cases: {
+        none: () => Cond;
+        some: (value: V) => Cond;
+    }): Cond;
+    match(cases: {
+        none: () => TermLike;
+        some: (value: V) => TermLike;
+    }): Term;
+}
+export declare const maybe: <V>(of: Kind<V>) => Kind<Maybe<V>>;
+export type MapWrite = {
+    readonly map: string;
+    readonly key: E;
+    readonly value: E;
+};
+export declare class MapRef {
+    readonly name: string;
+    readonly init: number;
+    constructor(name: string, init: number);
+    at(key: TermLike): Term;
+    set(key: TermLike, value: TermLike): MapWrite;
+    bump(key: TermLike, c?: Cond, by?: TermLike): MapWrite;
+}
+export type Forall = {
+    readonly forall: (key: Term) => Cond;
+};
+export declare const forall: (f: (key: Term) => Cond) => Forall;
+export type Relation = {
+    readonly when: Cond;
+    readonly holds: Cond;
+};
+export declare const relation: (holds: Cond, whenever?: Cond) => Relation;
+type Kinds = Record<string, Kind<unknown>>;
+type ValuesOf<K extends Kinds> = {
+    [n in keyof K]: K[n] extends Kind<infer V> ? V : never;
+};
+type Obj = object;
+type Update<S extends Obj, M extends Obj> = Partial<{
+    [k in keyof S]: TermLike;
+} & {
+    [k in keyof M]: MapWrite;
+}>;
+type Spec = {
+    name: string;
+    params: [string, Kind<unknown>][];
+    inputs: [string, Kind<unknown>][];
+    state: [string, number | ((p: never) => TermLike)][];
+    maps: [string, number][];
+    flags: ((env: never) => Record<string, Cond>)[];
+    step?: (env: never) => Record<string, TermLike | MapWrite | undefined>;
+    pre: ((p: never) => Cond)[];
+    assume: ((env: never) => Cond)[];
+    record?: string[];
+    sums: [string, (r: never, p: never) => TermLike][];
+    queries: [string, (r: never, v: never) => TermLike][];
+    keep?: (env: never) => Cond;
+    relations?: (env: never) => Relation[];
+    prune?: {
+        order: string;
+        after: (p: never) => TermLike;
+    };
+};
+export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj = {}, M extends Obj = {}, F extends Obj = {}, R extends Obj = {}, Su extends Obj = {}, Q extends Obj = {}> {
+    private readonly spec;
+    constructor(spec: Spec);
+    private with;
+    get name(): string;
+    params<K extends Kinds>(kinds: K): Rule<P & ValuesOf<K>, I, S, M, F, R, Su, Q>;
+    inputs<K extends Kinds>(kinds: K): Rule<P, I & ValuesOf<K>, S, M, F, R, Su, Q>;
+    state<T extends Record<string, number | ((p: P) => TermLike)>>(init: T): Rule<P, I, S & {
+        [k in keyof T]: Term;
+    }, M, F, R, Su, Q>;
+    maps<T extends Record<string, number>>(init: T): Rule<P, I, S, M & {
+        [k in keyof T]: MapRef;
+    }, F, R, Su, Q>;
+    flags<T extends Record<string, Cond>>(f: (env: P & I & S & M & F & Su & Q) => T): Rule<P, I, S, M, F & {
+        [k in keyof T]: Cond;
+    }, R, Su, Q>;
+    step(f: (env: P & I & S & M & F & Su & Q) => Update<S, M>): Rule<P, I, S, M, F, R, Su, Q>;
+    pre(f: (p: P) => Cond): Rule<P, I, S, M, F, R, Su, Q>;
+    assume(f: (env: P & I & S & M & F & Su & Q) => Cond): Rule<P, I, S, M, F, R, Su, Q>;
+    log<const N extends keyof I & string>(...record: N[]): Rule<P, I, S, M, F, Pick<I, N>, Su, Q>;
+    sums<T extends Record<string, (r: R, p: P) => TermLike>>(sums: T): Rule<P, I, S, M, F, R, Su & {
+        [k in keyof T]: Term;
+    }, Q>;
+    queries<T extends Record<string, (r: R, v: P & I) => TermLike>>(queries: T): Rule<P, I, S, M, F, R, Su, Q & {
+        [k in keyof T]: Term;
+    }>;
+    keep(f: (env: P & I & S & M & F & Su & Q) => Cond): Rule<P, I, S, M, F, R, Su, Q>;
+    relations(f: (env: P & I & Su & Q) => Relation[]): Rule<P, I, S, M, F, R, Su, Q>;
+    prune(order: keyof R & string, after: (p: P) => TermLike): Rule<P, I, S, M, F, R, Su, Q>;
+    law(name: string, f: (env: P & S & M & Su) => Cond | Forall): Law;
+    stepLaw(name: string, then: (before: P & I & S & M & F & Su & Q, after: S & M & Su) => Cond | Forall, when?: (before: P & I & S & M & F & Su & Q) => Cond): StepLaw;
+    decide(name: string, given: (env: P & I) => Cond | Cond[], then: (env: P & I) => Cond): Decision;
+    private kindAssumptions;
+    private env;
+    get machine(): Machine;
+    encodeParams(values: {
+        [k in keyof P]: Raw;
+    }): Record<string, number>;
+    encodeInput(values: {
+        [k in keyof I]: Raw;
+    }): Record<string, number>;
+    randomParams(rand: Rand, bound: number): Record<string, number>;
+    randomInput(rand: Rand, bound: number): Record<string, number>;
+    get orderedBy(): string | undefined;
+    interpreter(): {
+        init: (params: {
+            [x: string]: number;
+        }) => State;
+        queries: (params: {
+            [x: string]: number;
+        }, st: State, input: {
+            [x: string]: number;
+        }) => {
+            [x: string]: number;
+        };
+        step: (params: {
+            [x: string]: number;
+        }, st: State, input: {
+            [x: string]: number;
+        }) => State;
+    };
+    compiled(): {
+        init: (params: object) => State & {
+            head?: number;
+        };
+        fork: (st: State) => State;
+        step: (params: object, st: State, input: object) => State & {
+            head?: number;
+        };
+    };
+}
+export declare const rule: (name: string) => Rule;
+type AnyOf<R, K extends 'decide' | 'step' | 'law'> = R extends Rule<infer P, infer I, infer S, infer M, infer F, any, infer Su, infer Q> ? K extends 'decide' ? P & I : K extends 'law' ? P & S & M & Su : P & I & S & M & F & Su & Q : never;
+export type DecisionEnv<R> = AnyOf<R, 'decide'>;
+export type StepEnv<R> = AnyOf<R, 'step'>;
+export type LawEnv<R> = AnyOf<R, 'law'>;
+export type Decision = {
+    name: string;
+    rule: Rule<Obj>;
+    given: C[];
+    then: C;
+    goal: Goal;
+};
+export declare class LoopRule<P extends Obj = {}, I extends Obj = {}, S extends Obj = {}> {
+    private readonly spec;
+    constructor(spec: {
+        name: string;
+        params: [string, Kind<unknown>][];
+        inputs: [string, Kind<unknown>][];
+        state: [string, number | ((p: never) => TermLike)][];
+        while?: (env: never) => Cond;
+        body?: (env: never) => Record<string, TermLike | undefined>;
+        pre: ((p: never) => Cond)[];
+        assume: ((env: never) => Cond)[];
+        rank?: (env: never) => TermLike | TermLike[];
+    });
+    private with;
+    params<K extends Kinds>(kinds: K): LoopRule<P & ValuesOf<K>, I, S>;
+    inputs<K extends Kinds>(kinds: K): LoopRule<P, I & ValuesOf<K>, S>;
+    state<T extends Record<string, number | ((p: P) => TermLike)>>(init: T): LoopRule<P, I, S & {
+        [k in keyof T]: Term;
+    }>;
+    while(f: (env: P & S) => Cond): LoopRule<P, I, S>;
+    body(f: (env: P & I & S) => Partial<{
+        [k in keyof S]: TermLike;
+    }>): LoopRule<P, I, S>;
+    pre(f: (p: P) => Cond): LoopRule<P, I, S>;
+    assume(f: (env: P & I & S) => Cond): LoopRule<P, I, S>;
+    rank(f: (env: P & S) => TermLike | TermLike[]): LoopRule<P, I, S>;
+    law(name: string, f: (env: P & S) => Cond): Law;
+    private env;
+    get loop(): Loop;
+    get rankTerms(): E[];
+    randomParams(rand: Rand, bound: number): Record<string, number>;
+    randomInput(rand: Rand, bound: number): Record<string, number>;
+}
+export declare const loop: (name: string) => LoopRule;
+export type Verdict = {
+    proven: boolean;
+    checked: boolean;
+    stuck?: string;
+    goal?: string;
+    witness?: Record<string, number>;
+    trees?: Record<string, Tree>;
+};
+export declare function proveRule(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[]): Verdict;
+export declare function proveSteps(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], stepLaws: StepLaw[]): Verdict;
+export type { StepLaw };
+export declare const proveDecision: (d: Decision) => Verdict;
+export declare const proveLoop: (l: LoopRule<Obj, Obj, Obj>, laws: Law[]) => Verdict;