gdp-wired 0.13.0 → 0.13.2

package/dist/core/chart.d.ts

@@ -1,4 +1,4 @@
-import { type Cond, type Kind, type Rule, type Term, type TermLike, type Verdict, type Choice } from './dsl.js';
+import { type Kind, type Rule, type TermLike, type Verdict, Choice, Cond, Term } from './dsl.js';
 import { type Law } from './machine.js';
 import type { StepLaw } from '../kernel/kernel.js';
 export type StateNode = {
@@ -19,10 +19,10 @@ type After<X> = X & {
 };
 export type Transition<P, I, X> = {
     from: string | string[];
-    to: string;
+    to?: string;
     when?: (env: Env<P, I, X>) => Cond;
     set?: (env: Env<P, I, X>) => Partial<{
-        [k in keyof X]: TermLike | Cond | X[k];
+        [k in keyof X]: X[k] extends Choice<infer K> ? K | X[k] : TermLike | Cond | X[k];
     }>;
 };
 export declare class Chart<P extends Obj = {}, I extends Obj = {}, X extends Obj = {}> {
@@ -32,8 +32,11 @@ export declare class Chart<P extends Obj = {}, I extends Obj = {}, X extends Obj
         params: Obj;
         inputs: Obj;
         context: Obj;
+        outputs: Obj;
         regions: [string, StateNode][];
         on: [string, Transition<P, I, X>][];
+        field?: string;
+        events?: string[];
     });
     private with;
     params<K extends Record<string, Kind<unknown>>>(kinds: K): Chart<P & {
@@ -50,8 +53,18 @@ export declare class Chart<P extends Obj = {}, I extends Obj = {}, X extends Obj
             kind: Kind<infer V>;
         } ? V : Term;
     }>;
+    outputs<T extends Record<string, number | {
+        kind: Kind<unknown>;
+        init: unknown;
+    }>>(init: T): Chart<P, I, X & {
+        [k in keyof T]: T[k] extends {
+            kind: Kind<infer V>;
+        } ? V : Term;
+    }>;
+    events(...names: string[]): Chart<P, I, X>;
     states(tree: Record<string, StateNode>, opts?: {
         initial?: string;
+        field?: string;
     }): Chart<P, I, X>;
     regions(regions: Record<string, StateNode>): Chart<P, I, X>;
     on(event: string, t: Transition<P, I, X>): Chart<P, I, X>;

package/dist/core/chart.js

@@ -16,7 +16,7 @@
 // most specific source (an inner state over its parent) is taken, then the first declared; the regions react to the
 // same event at once. A transition into a compound state enters its initial child, or the child it was last in when the
 // compound keeps its history; `set` writes the extended state (a variable two regions both set takes the first region's).
-import { all, any, oneOf, proveRule, proveSteps, rule, when } from "./dsl.js";
+import { Choice, Cond, Term, all, any, no, oneOf, proveRule, proveSteps, rule, when, yes } from "./dsl.js";
 import { interpret, numbersOf } from "./machine.js";
 import { allowed } from "./watch.js";
 export class Chart {
@@ -30,8 +30,15 @@ export class Chart {
     inputs(kinds) { return this.with({ inputs: { ...this.s.inputs, ...kinds } }); }
     // The extended state: a natural from a number, or any kind from `kind.from(init)`.
     context(init) { return this.with({ context: { ...this.s.context, ...init } }); }
-    // One region's states (a chart of one region names its states plainly: 'active.paid').
-    states(tree, opts = {}) { return this.with({ regions: [['state', { states: tree, initial: opts.initial }]] }); }
+    // What each step decides, read after it (a command, a verdict): every output starts each step at its default, and a
+    // transition taken may set it, so a step where none fires reads the default, never the last step's value. A default
+    // is a number, a choice (`oneOf(...).from('denied')`) or a yes/no (`bool.from(false)`).
+    outputs(init) { return this.with({ outputs: { ...this.s.outputs, ...init } }); }
+    // The events, in the order they are encoded (by default, the order they are first used in `on`).
+    events(...names) { return this.with({ events: names }); }
+    // One region's states (a chart of one region names its states plainly: 'active.paid'); `field` names the state
+    // variable the rule keeps them in (`state` by default).
+    states(tree, opts = {}) { return this.with({ regions: [['state', { states: tree, initial: opts.initial }]], field: opts.field }); }
     // Parallel regions, each with its own states, reacting to the same events: paths start with the region ('payment.paid').
     regions(regions) { return this.with({ regions: Object.entries(regions) }); }
     on(event, t) { return this.with({ on: [...this.s.on, [event, t]] }); }
@@ -64,7 +71,7 @@ export class Chart {
                 }
             };
             walk('', root);
-            return { name, field: single ? 'state' : name, leaves, finals, compounds };
+            return { name, field: single ? s.field ?? 'state' : name, leaves, finals, compounds };
         });
         // A path as the region and the state within it.
         const locate = (path) => {
@@ -81,14 +88,20 @@ export class Chart {
                 throw new Error(`${s.name}: no state ${path} in ${r.name}`);
             return out;
         };
-        const events = [...new Set(s.on.map(([e]) => e))];
+        const used = [...new Set(s.on.map(([e]) => e))], events = s.events ?? used;
+        for (const e of used)
+            if (!events.includes(e))
+                throw new Error(`${s.name}: the event ${e} isn't one of the events declared (${events.join(', ')})`);
+        if (new Set(events).size !== events.length)
+            throw new Error(`${s.name}: an event is declared twice`);
         if (!events.length)
             throw new Error(`${s.name}: a chart needs transitions`);
         const placed = s.on.map(([event, t], order) => {
-            const froms = (Array.isArray(t.from) ? t.from : [t.from]).map(locate), [to] = locate(t.to);
+            const froms = (Array.isArray(t.from) ? t.from : [t.from]).map(locate), [to] = t.to === undefined ? froms[0] : locate(t.to);
             if (froms.some(([r]) => r !== to))
-                throw new Error(`${s.name}: a transition on ${event} goes from one region to another (${t.to})`);
-            under(to, locate(t.to)[1]);
+                throw new Error(`${s.name}: a transition on ${event} goes from one region to another (${t.to ?? [t.from].flat().join(", ")})`);
+            if (t.to !== undefined)
+                under(to, locate(t.to)[1]);
             const sources = [...new Set(froms.flatMap(([r, p]) => under(r, p)))];
             return { ...t, event, region: to.name, sources, depth: Math.min(...froms.map(([, p]) => (p === '' ? 0 : p.split('.').length))), order };
         });
@@ -103,9 +116,8 @@ export class Chart {
                 if (history && c)
                     state[lastOf(r, c)] = kind.from(enter(c));
         }
-        for (const [k, v] of Object.entries(s.context))
+        for (const [k, v] of Object.entries({ ...s.context, ...s.outputs }))
             state[k] = v;
-        const inState = (env) => (path) => { const [r, p] = locate(path); return any(...under(r, p).map(l => env[r.field].is(l))); };
         const guardEnv = (env) => this.wrap(env);
         // Entering a path: a leaf, or a compound's last child (with history) or its initial one.
         const entered = (env, r, path) => {
@@ -117,23 +129,41 @@ export class Chart {
             return entered(env, r, path ? `${path}.${c.initial}` : c.initial);
         };
         let built = rule(s.name).params(s.params).inputs({ event: oneOf(...events), ...s.inputs }).state(state);
-        built = built.flags((env) => Object.fromEntries(placed.map((t, i) => [`on${i}`, all(env.event.is(t.event), inState(env)(single ? '' : t.region), any(...t.sources.map(l => env[regions.find(r => r.name === t.region).field].is(l))), ...(t.when ? [t.when(guardEnv(env))] : []))])));
-        // A transition is taken when it is enabled and no transition before it in its region is.
-        built = built.flags((env) => Object.fromEntries(placed.map((t, i) => [`take${i}`, all(env[`on${i}`], ...placed.slice(0, i).flatMap((u, j) => (u.region === t.region && u.sources.some(l => t.sources.includes(l)) ? [env[`on${j}`].not()] : [])))])));
+        // A set of a region's states as ranges of their indices (n <= 2, 3 <= n <= 4): a few comparisons, where one test per
+        // state would be a disjunction the prover splits on; the whole region is no condition at all.
+        const among = (env, r, leaves) => {
+            const n = env[r.field].index, ix = leaves.map(l => r.leaves.indexOf(l)).sort((a, b) => a - b), top = r.leaves.length - 1, ranges = [];
+            for (const i of ix) {
+                const last = ranges.at(-1);
+                if (last && i === last[1] + 1)
+                    last[1] = i;
+                else
+                    ranges.push([i, i]);
+            }
+            return any(...ranges.map(([a, b]) => (a === 0 && b === top ? yes : a === b ? n.eq(a) : a === 0 ? n.atMost(b) : b === top ? n.atLeast(a) : n.atLeast(a).and(n.atMost(b)))));
+        };
+        const regionOf = (t) => regions.find(r => r.name === t.region);
+        built = built.flags((env) => Object.fromEntries(placed.map((t, i) => [`on${i}`, all(env.event.is(t.event), among(env, regionOf(t), t.sources), ...(t.when ? [t.when(guardEnv(env))] : []))])));
+        // A transition is taken when it is enabled and no transition before it in its region, on its event, from a state it
+        // shares, is (transitions on other events are never enabled together).
+        built = built.flags((env) => Object.fromEntries(placed.map((t, i) => [`take${i}`, all(env[`on${i}`], ...placed.slice(0, i).flatMap((u, j) => (u.region === t.region && u.event === t.event && u.sources.some(l => t.sources.includes(l)) ? [env[`on${j}`].not()] : [])))])));
         built = built.step((env) => {
             const out = {};
             for (const r of regions) {
-                // The transitions taken in a region exclude one another: a chain of `when`s, the first in order outermost.
-                out[r.field] = placed.map((t, i) => [t, i]).filter(([t]) => t.region === r.name).reverse()
-                    .reduce((acc, [t, i]) => when(env[`take${i}`], entered(env, r, locate(t.to)[1]), acc), env[r.field]);
+                // The transitions taken in a region exclude one another, so those entering one state share a `when` (any of
+                // them taken), and an internal one needs none (the state stays).
+                out[r.field] = grouped(placed.map((t, i) => [t, i]).filter(([t]) => t.region === r.name && t.to !== undefined)
+                    .map(([t, i]) => ({ i, region: r.name, value: entered(env, r, locate(t.to)[1]) })), env, env[r.field]);
                 for (const [c, { history }] of r.compounds)
                     if (history && c)
                         out[lastOf(r, c)] = when(any(...under(r, c).map(l => out[r.field].is(l))), out[r.field], env[lastOf(r, c)]);
             }
-            for (const k of Object.keys(s.context)) {
-                const sets = placed.map((t, i) => [t, i]).filter(([t]) => t.set).map(([t, i]) => [i, t.set(guardEnv(env))[k]]).filter(([, v]) => v !== undefined);
-                if (sets.length)
-                    out[k] = sets.reverse().reduce((acc, [i, v]) => when(env[`take${i}`], v, acc), env[k]);
+            // Context keeps its value where no transition taken sets it; an output falls back to its default.
+            for (const k of [...Object.keys(s.context), ...Object.keys(s.outputs)]) {
+                const sets = placed.map((t, i) => [t, i]).filter(([t]) => t.set).map(([t, i]) => ({ i, region: t.region, value: t.set(guardEnv(env))[k] })).filter(x => x.value !== undefined);
+                const base = k in s.outputs ? defaultOf(env[k], s.outputs[k], k) : env[k];
+                if (sets.length || k in s.outputs)
+                    out[k] = grouped(sets.map(x => ({ ...x, value: typeof x.value === 'string' ? env[k].of(x.value) : x.value })), env, base);
             }
             return out;
         });
@@ -198,7 +228,9 @@ export class Chart {
                 reachedAt.set(label(reg, l), k);
         } };
         note(queue[0], start);
-        while (queue.length && seen.size < (opts.maxStates ?? 20_000)) {
+        // Breadth first, so each state's run is a shortest one; done once every state has one.
+        const states = regions.reduce((n, reg) => n + reg.leaves.length, 0);
+        while (queue.length && seen.size < (opts.maxStates ?? 20_000) && reachedAt.size < states) {
             const k = queue.shift(), st = seen.get(k).st;
             for (const req of requests) {
                 if (!allowed(m, run, params, st, req))
@@ -213,29 +245,72 @@ export class Chart {
         }
         const runTo = (k) => { const out = []; for (let at = seen.get(k); at.by; at = seen.get(at.from))
             out.unshift({ ...numbersOf(at.by), event: events[at.by.event] }); return out; };
-        const reached = {};
+        // States no run reached: proven unreachable together (one may lean on another), else each on its own.
+        const reached = {}, missed = [];
         for (const reg of regions)
             for (const l of reg.leaves) {
                 const name = label(reg, l), at = reachedAt.get(name);
-                if (at) {
+                if (at)
                     reached[name] = { run: runTo(at) };
-                    continue;
-                }
-                const never = r.law(`${name} is never reached`, (env) => env[reg.field].is(l).not());
-                const v = proveRule(r, [...this.chartLaws(), never]);
-                reached[name] = v.proven && v.checked ? 'unreachable' : 'unknown';
+                else
+                    missed.push({ name, law: r.law(`${name} is never reached`, (env) => env[reg.field].is(l).not()) });
             }
-        const stuck = regions.flatMap(reg => reg.leaves.filter(l => !reg.finals.has(l) && !placed.some(t => t.region === reg.name && t.sources.includes(l))).map(l => label(reg, l)));
-        const ambiguous = [];
+        const proven = (v) => v.proven && v.checked;
+        const allMissed = missed.length > 0 && proven(proveRule(r, [...this.chartLaws(), ...missed.map(x => x.law)]));
+        for (const x of missed)
+            reached[x.name] = allMissed || proven(proveRule(r, [...this.chartLaws(), x.law])) ? 'unreachable' : 'unknown';
+        // A way out is a transition to a state: an internal one stays where it is.
+        const stuck = regions.flatMap(reg => reg.leaves.filter(l => !reg.finals.has(l) && !placed.some(t => t.to !== undefined && t.region === reg.name && t.sources.includes(l))).map(l => label(reg, l)));
+        // Pairs as specific as each other, on one event, from a state they share: proven never both enabled, all at once,
+        // and only where that fails each on its own (to name the pair and the request).
+        const pairs = [];
         placed.forEach((t, i) => placed.forEach((u, j) => {
             if (j <= i || t.region !== u.region || t.event !== u.event || t.depth !== u.depth || !t.sources.some(l => u.sources.includes(l)))
                 return;
-            const apart = r.stepLaw(`transitions ${t.order} and ${u.order} on ${t.event} are never both enabled`, (env) => all(env[`on${i}`], env[`on${j}`]).not());
-            const v = proveSteps(r, this.chartLaws(), [apart]);
-            if (!(v.proven && v.checked))
-                ambiguous.push({ event: t.event, transitions: [t.order, u.order], verdict: v });
+            pairs.push({ t, u, law: r.stepLaw(`transitions ${t.order} and ${u.order} on ${t.event} are never both enabled`, (env) => all(env[`on${i}`], env[`on${j}`]).not()) });
         }));
+        const ambiguous = [];
+        if (pairs.length && !proven(proveSteps(r, this.chartLaws(), pairs.map(x => x.law))))
+            for (const { t, u, law } of pairs) {
+                const v = proveSteps(r, this.chartLaws(), [law]);
+                if (!proven(v))
+                    ambiguous.push({ event: t.event, transitions: [t.order, u.order], verdict: v });
+            }
         return { ok: !stuck.length && !ambiguous.length && Object.values(reached).every(x => x !== 'unknown'), reached, stuck, ambiguous };
     }
 }
-export const chart = (name) => new Chart({ name, params: {}, inputs: {}, context: {}, regions: [], on: [] });
+// The value a step writes: of the transitions taken, the first in order that writes one. Transitions of one region exclude
+// one another, so consecutive ones of a region writing the same value share one `when` (any of them taken); the order
+// between regions is kept.
+function grouped(writes, env, base) {
+    const keyOf = (v) => JSON.stringify(v instanceof Choice ? v.index.e : v instanceof Cond ? v.c : v instanceof Term ? v.e : v);
+    const groups = [];
+    for (const w of writes) {
+        const key = keyOf(w.value);
+        let g;
+        for (let j = groups.length - 1; j >= 0 && groups[j].region === w.region; j--)
+            if (groups[j].key === key) {
+                g = groups[j];
+                break;
+            }
+        if (g)
+            g.takes.push(env[`take${w.i}`]);
+        else
+            groups.push({ region: w.region, key, value: w.value, takes: [env[`take${w.i}`]] });
+    }
+    return groups.reduceRight((acc, g) => when(any(...g.takes), g.value, acc), base);
+}
+export const chart = (name) => new Chart({ name, params: {}, inputs: {}, context: {}, outputs: {}, regions: [], on: [] });
+// An output's default as a value of its kind: a number, a choice's named value, or a yes/no.
+function defaultOf(current, init, name) {
+    if (typeof init === 'number')
+        return init;
+    const { kind, init: v } = init;
+    if (current instanceof Choice)
+        return current.of(v);
+    if (typeof v === 'boolean')
+        return v ? yes : no;
+    if (typeof v === 'number')
+        return v;
+    throw new Error(`the output ${name}'s default is a number, a choice or a yes/no, not ${String(v)} of ${kind.constructor.name}`);
+}

package/dist/core/dsl.d.ts

@@ -131,7 +131,10 @@ export declare class Choice<K extends string> {
     constructor(n: Term, values: readonly K[]);
     is(k: K): Cond;
     of(k: K): Choice<K>;
-    private index;
+    get index(): Term;
+    eq(o: K | Choice<K> | number): Cond;
+    ne(o: K | Choice<K> | number): Cond;
+    private indexOf;
     match(cases: {
         [k in K]: () => Cond;
     }): Cond;

package/dist/core/dsl.js

@@ -353,10 +353,15 @@ export class Choice {
         this.n = n;
         this.values = values;
     }
-    is(k) { return this.n.eq(this.index(k)); }
+    is(k) { return this.n.eq(this.indexOf(k)); }
     // The value named k, of this choice's kind (to write: when(c, status.of('closed'), status)).
-    of(k) { return new Choice(lit(this.index(k)), this.values); }
-    index(k) {
+    of(k) { return new Choice(lit(this.indexOf(k)), this.values); }
+    // Its index among the values, in the order declared (oneOf('new', 'paid'): new is 0), as a term.
+    get index() { return this.n; }
+    // The same value as a name, another choice of the kind, or an index: status.eq('paid'), a.phase.eq(b.phase), phase.eq(3).
+    eq(o) { return typeof o === 'string' ? this.is(o) : typeof o === 'number' ? this.n.eq(o) : this.n.eq(o.n); }
+    ne(o) { return this.eq(o).not(); }
+    indexOf(k) {
         const i = this.values.indexOf(k);
         if (i < 0)
             throw new Error(`${k} is not one of ${this.values.join(', ')}`);
@@ -2426,13 +2431,31 @@ function refuteByRuns(r, laws, stepLaws = []) {
                 st = next;
             }
         }
+        // A step law holds from every state the laws allow, reached or not: from random such states (each scalar and cell
+        // small, kept when every law and kind law holds there), a step that breaks it is a counterexample too, without a run.
+        const steps1 = stepLaws.filter(sl => (sl.steps ?? 1) === 1), given = withKinds(r, laws);
+        for (let trial = 0; steps1.length && trial < refuteBudget.trials * 4 && performance.now() < until; trial++) {
+            const params = r.randomParams(rand, bound);
+            if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
+                continue;
+            const st = { scalars: Object.fromEntries(Object.keys(m.state).map(n => [n, rand(8)])), maps: Object.fromEntries(Object.keys(m.maps ?? {}).map(n => [n, new Map(Array.from({ length: rand(3) }, () => [rand(bound + 1), rand(bound + 1)]))])) };
+            if (m.history || !given.every(l => watch(m, run, l, params, bound).start(st)))
+                continue;
+            const input = r.randomInput(rand, bound, params);
+            if (!allowed(m, run, params, st, input))
+                continue;
+            const next = run.step(params, st, input);
+            for (const sl of steps1)
+                if (!watch(m, run, sl, params, bound).step(st, input, next))
+                    return { goal: `${sl.name} @step law`, witness: { ...params, ...st.scalars, ...numbersOf(input) } };
+        }
     }
     catch {
         return undefined;
     }
     return undefined;
 }
-const refutedVerdict = (out) => ({ proven: false, checked: false, goal: out.goal, stuck: 'sat', witness: out.witness, run: out.run });
+const refutedVerdict = (out) => ({ proven: false, checked: false, goal: out.goal, stuck: 'sat', witness: out.witness, ...(out.run ? { run: out.run } : {}) });
 export function proveRule(r, laws) {
     const refuted = refuteByRuns(r, laws);
     if (refuted)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdp-wired",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "An automatic prover for stateful rules (budgets, caps, windows, workflows, policies): laws proven with no proof to write, checked again in Lean, counterexamples found on the GPU, the rule shipped as code",
   "keywords": [
     "verification",