gdp-wired 0.6.0 → 0.8.0

package/README.md

@@ -1,4 +1,7 @@
-<img src="https://raw.githubusercontent.com/monotykamary/gdp-wired/main/static/banner-ink.svg" alt="gdp-wired" width="100%" />
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/monotykamary/gdp-wired/main/static/banner-dark.svg">
+  <img src="https://raw.githubusercontent.com/monotykamary/gdp-wired/main/static/banner-light.svg" alt="gdp-wired: an automatic prover for stateful rules" width="100%">
+</picture>
 
 # gdp-wired
 
@@ -27,8 +30,10 @@ proveRule(budget, [bounded]) // {proven: true, checked: true}
 Names are typed: `({s, bb}) => …` or a law that reads the request `c` is a TypeScript error, not a runtime surprise.
 Forget the cap (`s.plus(c)`) and the kernel refuses the proof; a search from the start turns it into a real run:
 `{params: {b: 1, m: 0}, trace: [{c: 2}]}`. `bun examples/budget.ts` runs all of it, including the generated JavaScript,
-and `examples/domains/` holds 92 rules from nine domains (finance, access control, public services, operations,
-protocols, commerce, supply chains, games, education), each checked three ways.
+and `examples/domains/` holds 187 rules from 21 domains (finance, access control, public services, operations,
+protocols, commerce, supply chains, games, education, healthcare, energy, networking, AI agents, cloud, ad tech,
+governance, insurance, bookings, safety and IoT, mobility, media), each checked three ways: the kernel proves every law
+and refutes every broken variant, random runs of both runtimes agree, and Lean checks the trees.
 
 ## Where it fits
 
@@ -56,6 +61,12 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 - **Refinement**: an implementation behaves like a simpler spec, step for step (`examples/composition.ts`).
 - **Functions**: division, remainder, and your own functions, known by their facts; a function defined in Lean brings
   facts proven there (`examples/functions.ts`).
+- **Lemmas you state**: a function defined by a recurrence (`recur`), of one argument or several, reading other
+  functions, and lemmas about it proven by induction, at one point or between two, which every rule that reads it may
+  then use: a backoff delay is at most 64 at every attempt and never shrinks (`examples/lemmas.ts`).
+- **Records and variants**: inputs, state, results, map cells and list items made of named fields, or one of several
+  cases each with fields of its own (a payment by card or in cash, a seat free, held or sold), every case covered
+  (`examples/datatypes.ts`).
 - **Pure functions and two-run laws**: laws about what a function returns, and laws comparing two calls, like "the
   secret never changes the answer". `examples/jev-fabric/` ports a Bend project's policy core and proves all 59 laws its
   Bend proofs state.
@@ -66,7 +77,7 @@ synthesizer finds one and the kernel proves it.
 **What it leaves to Lean or Bend.** Two things, and neither is a gap the next feature closes: proofs the prover would
 have to invent (induction over a recursive structure whose proof needs a lemma nobody stated, and arithmetic with
 products of unknowns beyond multiplying two known facts; integer arithmetic with induction or with products is
-undecidable), and shipping an arbitrary algorithm as its proved source (gdp-wired ships the rule as JavaScript; Bend
+undecidable; a lemma you state about a recurrence is proven, but a recursive datatype as a value is Lean's), and shipping an arbitrary algorithm as its proved source (gdp-wired ships the rule as JavaScript; Bend
 compiles the proved source itself). The full list of what is and isn't in scope is in
 [`docs/comparison.md`](docs/comparison.md#gdp-wireds-scope-in-detail).
 
@@ -101,13 +112,46 @@ The untrusted parts are held to the trusted ones by the test suite:
   tests, and the few that survive are equivalent (`kernel/MUTANTS.md`).
 - **Fuzz**: the kernel never accepts a refutation of something that has a model.
 
+## With gdp-ts
+
+[gdp-ts](https://github.com/rauchg/gdp-ts) makes every call site present a proof that a check ran on exactly these
+values, and trusts the module that performs the check. `gdp-wired/gdp` proves that check: the trusted module hands its
+private prover to a `guard` (a function's condition) or a `gate` (a rule's flag), which proves the laws when the module
+loads, refuses to load if one fails, and mints a proof only where the proven condition holds. gdp-ts then holds every
+call site to it: the policy is proven, every caller is held to it, and Lean checks the proof again.
+
+```ts
+// proofs/can-set-protection.ts (trusted: the only module that can mint this proof)
+import {defineProof, type Named, type Proof} from '@gdp-ts/core'
+import {fun, no, oneOf} from 'gdp-wired'
+import {guard} from 'gdp-wired/gdp'
+
+const canSet = fun('can set password protection')
+  .inputs({role: oneOf('owner', 'member', 'viewer', 'none'), plan: oneOf('free', 'pro', 'enterprise')})
+  .returns(({role, plan}) => ({allow: role.is('owner').or(role.is('member')).and(plan.is('free').not())}))
+const laws = [canSet.law('the free plan never has protection', ({plan}, out) => [plan.is('free'), out.allow], () => no)]
+
+const CanSetProtection = defineProof('CanSetProtection') // not exported
+export interface CanSetProtection<U, P> extends Proof<'CanSetProtection', [U, P]> {}
+const mint = guard(CanSetProtection, canSet, 'allow', {laws}) // proven here, or the module doesn't load
+
+export async function canSetProtection<U, P>(user: Named<U, UserId>, project: Named<P, ProjectId>): Promise<CanSetProtection<U, P> | null> {
+  return mint({role: await db.role(user.value, project.value), plan: await db.plan(project.value)}, user, project)
+}
+```
+
+A `gate` does the same for a rule with state: each request takes the rule's step, and a proof is minted when the step
+takes the flag (a one-time token redeemed, a sign-in while the account is unlocked, an email within the hourly cap).
+Requests outside what was proven (a failed `assume`, a history read out of order) mint nothing and leave the state as it
+was. `examples/gdp.ts` runs gdp-ts's own example this way; `@gdp-ts/core` is an optional peer dependency.
+
 ## Writing laws
 
 The builders (`core/dsl.ts`) hand out typed values for every name you declare; everything compiles to the plain machine
 the kernel checks, so nothing in them is trusted.
 
 ```ts
-import {bool, count, forall, maybe, nat, oneOf, proveSteps, relation, rule, yes} from 'gdp-wired'
+import {bool, count, forall, fun, maybe, min, nat, no, oneOf, proveSteps, record, recur, relation, rule, variant, when, yes} from 'gdp-wired'
 
 // Maps and flags: a grant is decided once per step; each map is written once; a map law holds at every key.
 const caps = rule('caps')
@@ -142,12 +186,36 @@ const window = rule('window limit')
 const trial = rule('trial').inputs({plan: oneOf('free', 'pro'), spent: maybe(nat), allowance: maybe(nat)})
 const failsClosed = trial.decide('a missing fact means no trial', ({spent}) => spent.isNone,
   ({plan, spent, allowance}) => plan.match({free: () => spent.match({none: () => yes, some: s => allowance.match({none: () => yes, some: a => s.atLeast(a)})}), pro: () => yes}))
+
+// Records and variants: a payment is by card or in cash, each with fields of its own, read only in `match`.
+const Pay = variant({card: {amount: nat, verified: bool}, cash: {amount: nat}})
+const approve = fun('approve').inputs({pay: Pay, who: record({limit: nat, blocked: bool})})
+  .returns(({pay, who}) => ({ok: who.blocked.not().and(pay.match({card: c => c.verified.and(c.amount.atMost(who.limit)), cash: c => c.amount.atMost(200)}))}))
+const unverified = approve.law('an unverified card is never approved', ({pay}, out) => [pay.match({card: c => c.verified.not(), cash: () => no}), out.ok], () => no)
+
+// A lemma you state, proven by induction: the backoff delay is defined by its recurrence, and its lemmas are facts
+// every rule that reads it may use (its two equations alone don't bound it at an unknown attempt).
+const delay = recur('delay', {zero: 1, next: (_, d) => min(d.times(2), 64)}, {'at least 1': (_, d) => d.atLeast(1), 'at most 64': (_, d) => d.atMost(64)})
+const retry = rule('retry').inputs({failed: bool, now: nat}).state({tries: 0, next: 0, last: 0}).fns({delay})
+  .assume(({now, last}) => now.atLeast(last))
+  .step(({failed, now, tries, next, delay}) => ({tries: when(failed, tries.plus(1), 0), next: when(failed.and(now.atLeast(next)), now.plus(delay(tries)), next), last: now}))
+const soon = retry.law('the next try is at most 64 after the last request', ({next, last}) => next.atMost(last.plus(64)))
 ```
 
 
-- **Kinds**: `nat`, `upTo(k)`, `bool`, `oneOf(...)`, `maybe(kind)`, `int`, `decimal(places)`, `str({like, maxLength})`;
-  their assumptions (a bit is 0 or 1, a choice is in range) go to the kernel by themselves, and
-  `encodeInput`/`encodeParams` turn runtime values into the numbers the machine reads.
+- **Kinds**: `nat`, `upTo(k)`, `bool`, `oneOf(...)`, `maybe(kind)`, `int`, `decimal(places)`, `str({like, maxLength})`,
+  `record({...})`, `variant({...})`; their assumptions (a bit is 0 or 1, a choice is in range) go to the kernel by
+  themselves, and `encodeInput`/`encodeParams` turn runtime values into the numbers the machine reads.
+- **Records and variants**: `record({limit: nat, blocked: bool})` hands out an object of its fields' values;
+  `variant({card: {...}, cash: {...}})` a value with `is(case)` and `match({card: c => ..., cash: c => ...})`, the only
+  place a case's fields are read. `Pay.make({tag: 'card', amount, verified})` builds a case to write or to pass to
+  `when`, and `same(a, b)` compares two values of one kind part by part. At runtime a record is an object of its fields
+  and a variant `{tag: 'card', ...fields}`; a field or case the kind doesn't declare is refused. Both are their fields'
+  variables underneath (`pay.card.amount`, and the case's index as `pay`), so the kernel, both runtimes and the Lean
+  twin see nothing new. Maps and lists of them: `.maps({Acct: record({...}).from({...})})` (`Acct.at(k)`,
+  `Acct.set(k, value)`, `Acct.each(k => value)`) and `.items({Queue: Job})` (`push`, `pop`, `set`, `insertAt`,
+  `removeAt`, `apply`, `has`, `within`, `increasing(by)`), one map per variable of the kind; `rule.decode` reads them back
+  as objects and arrays. Not as values: recursive types (a tree).
 - **State of any kind**: `.state({open: bool.from(true), status: oneOf('new', 'done').from('new'), owner: str().from(''), note: maybe(nat).from(null)})`;
   a step writes each kind's own values, `when(c, a, b)` chooses between any two values of a kind, and `rule.decode(state)`
   reads them back as runtime values.
@@ -168,6 +236,16 @@ const failsClosed = trial.decide('a missing fact means no trial', ({spent}) => s
   take arguments, `perMinute(t)`; the kernel knows each only by its facts (`.facts(...)`, and a library function's
   own), and the Lean export takes them as the hypothesis they are, proving them where the function has a Lean
   definition. A function defined and proven in Lean is how a rule reaches past what the kernel decides: `examples/functions.ts`.
+- **Recurrences and their lemmas** (`recur(name, {args, fns, zero, next}, lemmas, between)`): f(0, a..) = zero and
+  f(x + 1, a..) = next(x, f(x, a..), a..), the further arguments `args` (up to three) fixed along the recursion, each term
+  the kernel's own or a read of a function in `fns` (`modBy(7)`, another recurrence). Each lemma is a law about every x
+  and f(x), proven when the function is made, all of them together by induction (the recurrence run as a machine, each
+  lemma a law of it, so one lemma may lean on another, and on the facts of the functions it reads); each law `between`
+  is about every x <= y and f(x), f(y) ("never shrinks"), proven by induction on y from x, with the lemmas. One that
+  isn't proven throws `Unproven` with the induction step it breaks at. The two equations, the lemmas and the laws
+  between are the function's facts. The runtimes compute f by the recurrence (x steps); the Lean export defines
+  `Recur.<name>` by it (a function of several arguments through an injective pairing, proven so in Lean) and proves
+  every fact there by induction (`examples/lemmas.ts`).
 - **Liveness** (`rule.leadsTo(name, {from, to, rank, helpful})`, `proveLeadsTo`): whenever `from` holds, `to` holds later in
   every run that takes each helpful request infinitely often; proven by a rank no step raises while waiting and each
   helpful request lowers in its region. `rank` may return several terms (compared in order) and `helpful` may be a list
@@ -230,7 +308,7 @@ Lean, compiled natively, wins where the state stays small. Details in [`docs/com
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (92 rules across nine domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |
@@ -266,10 +344,24 @@ modal run modal/run.py --jobs modal/suite.json --out runs/modal/suite && sh moda
 
 Each directory's README has its own runs and results.
 
+## The skill
+
+`npx skills add monotykamary/gdp-wired` installs a skill that guides coding agents (and people) through writing a rule
+the way the code does it, stating its laws, reading a refused proof and handing a claim to Lean:
+
+- [**Workflow**](skills/gdp-wired/SKILL.md#workflow): the checklist for adding or changing a rule whose invariants matter.
+- [**Writing rules**](skills/gdp-wired/references/writing-rules.md): kinds, maps, step and k-step laws, histories,
+  liveness, decisions, two-run laws, loops.
+- [**Reading verdicts**](skills/gdp-wired/references/reading-verdicts.md): a bug or a missing invariant, and what to
+  change.
+- [**Shipping**](skills/gdp-wired/references/shipping.md): running the proven rule, and holding existing code to it.
+- [**The Lean handoff**](skills/gdp-wired/references/lean-handoff.md): exporting the proofs, and functions proven in Lean.
+- [**Where it fits**](skills/gdp-wired/references/where-it-fits.md): gdp-wired, Lean or Bend.
+
 ## Credits
 
 [gdp-ts](https://github.com/rauchg/gdp-ts) by Guillermo Rauch (Ghosts of Departed Proofs for TypeScript) is where the
-audit path starts; [Handwired](https://github.com/chenglou/handwired) by Cheng Lou is the circuit and GPU runtime this
+audit path starts, and what `gdp-wired/gdp` mints proofs for; [Handwired](https://github.com/chenglou/handwired) by Cheng Lou is the circuit and GPU runtime this
 builds on, through a fork; [Bend](https://github.com/bendlang/bend) is the language the laws were first written in,
 and the yardstick for the benchmarks.
 

package/dist/core/dsl.d.ts

@@ -1,4 +1,4 @@
-import { type C, type E, type Law, type Machine, type Request, type State } from './machine.js';
+import { type C, type E, type Law, type Recurrence, type Machine, type Request, type State } from './machine.js';
 import { type Goal, type Liveness, type Loop, type StepLaw, type Tree } from '../kernel/kernel.js';
 export type TermLike = Term | number;
 export declare const termOf: (t: TermLike) => E;
@@ -43,11 +43,17 @@ export declare function when<K extends string>(c: Cond, then: Choice<K>, otherwi
 export declare function when(c: Cond, then: Str, otherwise: Str): Str;
 export declare function when<V>(c: Cond, then: Maybe<V>, otherwise: Maybe<V>): Maybe<V>;
 export declare function when(c: Cond, then: Cond, otherwise: Cond): Cond;
+export declare function when<C extends Cases>(c: Cond, then: Variant<C>, otherwise: Variant<C>): Variant<C>;
+export declare function when<T extends Record<string, unknown>>(c: Cond, then: T, otherwise: T): T;
 export declare const choose: (c: Cond, then: Cond, otherwise: Cond) => Cond;
+export declare function same(a: unknown, b: unknown): Cond;
 export declare const count: (c: Cond) => Term;
 export declare const sum: (first: TermLike, ...rest: TermLike[]) => Term;
 type Rand = (k: number) => number;
-type Raw = number | boolean | string | null | undefined;
+export type Raw = number | boolean | string | null | undefined | RawObject | readonly Raw[];
+export type RawObject = {
+    readonly [field: string]: Raw;
+};
 export type At = string | ((name: string) => string);
 export type Init<V> = {
     readonly kind: Kind<V>;
@@ -57,7 +63,8 @@ export declare abstract class Kind<V> {
     readonly _value: V;
     abstract vars(name: string): string[];
     abstract assume(name: string): Cond[];
-    abstract value(name: string, at?: At): V;
+    abstract build(name: string, get: (part: string) => Term): V;
+    value(name: string, at?: At): V;
     abstract encode(name: string, raw: Raw): Record<string, number>;
     abstract random(name: string, rand: Rand, bound: number): Record<string, number>;
     abstract store(name: string, value: unknown): Record<string, TermLike>;
@@ -145,6 +152,61 @@ export declare class Maybe<V> {
     }): Term;
 }
 export declare const maybe: <V>(of: Kind<V>) => Kind<Maybe<V>>;
+type Fields = Record<string, Kind<unknown>>;
+export declare const record: <const K extends Fields>(fields: K) => Kind<ValuesOf<K>>;
+type Cases = Record<string, Fields>;
+type CaseValues<C extends Cases> = {
+    [k in keyof C]: ValuesOf<C[k]>;
+};
+type MatchCases<C extends Cases, T> = {
+    [k in keyof C]: (fields: ValuesOf<C[k]>) => T;
+};
+export declare class Variant<C extends Cases = Cases> {
+    readonly tag: Term;
+    readonly cases: CaseValues<C>;
+    readonly kind: VariantKind<C>;
+    constructor(tag: Term, cases: CaseValues<C>, kind: VariantKind<C>);
+    is(k: keyof C & string): Cond;
+    match(cases: MatchCases<C, Cond>): Cond;
+    match(cases: MatchCases<C, TermLike>): Term;
+    match<T>(cases: MatchCases<C, T>): T;
+}
+export type VariantWrite<C extends Cases> = {
+    [k in keyof C]: {
+        [f in 'tag' | keyof C[k]]: f extends 'tag' ? k : C[k][f] extends Kind<infer V> ? Writes<V> : never;
+    };
+}[keyof C];
+export declare class VariantKind<C extends Cases> extends Kind<Variant<C>> {
+    readonly cases: C;
+    readonly names: (keyof C & string)[];
+    readonly tagKey = "tag";
+    constructor(cases: C);
+    index(k: string): number;
+    private payload;
+    private filled;
+    private at;
+    vars(name: string): string[];
+    assume(name: string): Cond[];
+    build(name: string, get: (part: string) => Term): Variant<C>;
+    make(write: VariantWrite<C>): Variant<C>;
+    store(name: string, value: unknown): Record<string, TermLike>;
+    decode(name: string, vars: Record<string, number>): {
+        tag: keyof C & string;
+    };
+    empty(): {
+        tag: keyof C & string;
+    };
+    encode(name: string, raw: Raw): {
+        [x: string]: number;
+    };
+    random(name: string, rand: Rand, bound: number): {
+        [x: string]: number;
+    };
+    sample(rand: Rand, bound: number): {
+        tag: keyof C & string;
+    };
+}
+export declare const variant: <const C extends Cases>(cases: C) => VariantKind<C>;
 export declare const intern: ((text: string) => number) & {
     load(entries: [string, number][]): void;
 };
@@ -225,6 +287,42 @@ export declare class ListRef {
     within(): Forall;
     increasing(): Forall;
 }
+export type PartsWrite = {
+    readonly parts: Record<string, MapWrite>;
+};
+export declare class CellsRef<V> {
+    readonly name: string;
+    readonly kind: Kind<V>;
+    private readonly map;
+    constructor(name: string, kind: Kind<V>, map: (part: string) => MapRef);
+    at(key: TermLike): V;
+    set(key: TermLike, value: Writes<V>): PartsWrite;
+    each(f: (key: Term) => Writes<V>): PartsWrite;
+}
+export type ItemsOp = {
+    readonly when: Cond;
+    readonly parts: Record<string, ListOp>;
+    readonly len: TermLike;
+};
+export declare class ItemsRef<V> {
+    readonly name: string;
+    readonly kind: Kind<V>;
+    readonly len: Term;
+    private readonly list;
+    constructor(name: string, kind: Kind<V>, len: Term, list: (part: string) => ListRef);
+    private get names();
+    at(i: TermLike): V;
+    has(x: V): Cond;
+    private op;
+    push(x: Writes<V>, when?: Cond): ItemsOp;
+    pop(when?: Cond): ItemsOp;
+    set(i: TermLike, x: Writes<V>, when?: Cond): ItemsOp;
+    insertAt(i: TermLike, x: Writes<V>, when?: Cond): ItemsOp;
+    removeAt(i: TermLike, when?: Cond): ItemsOp;
+    apply(...ops: ItemsOp[]): Record<string, TermLike | PartsWrite>;
+    within(): Forall;
+    increasing(by: (x: V) => Term): Forall;
+}
 export type Forall = {
     readonly forall: (key: Term, ...more: Term[]) => Cond;
 };
@@ -239,7 +337,9 @@ export type FnDef = {
     arity: number;
     js: string | ((...args: number[]) => number);
     lean?: string;
-    facts?: (f: (...args: TermLike[]) => Term) => Record<string, Cond | Forall>;
+    facts?: (f: (...args: TermLike[]) => Term, uses?: Record<string, (...args: TermLike[]) => Term>) => Record<string, Cond | Forall>;
+    recur?: Recurrence;
+    uses?: Record<string, FnDef>;
 };
 export declare const fn: (arity: number, js: FnDef["js"], opts?: {
     lean?: string;
@@ -247,16 +347,35 @@ export declare const fn: (arity: number, js: FnDef["js"], opts?: {
 }) => FnDef;
 export declare const divBy: (c: number) => FnDef;
 export declare const modBy: (c: number) => FnDef;
+type FnTerm = (...args: TermLike[]) => Term;
+type RecurEnv<A extends string, U> = {
+    [a in A]: Term;
+} & {
+    [u in keyof U]: FnTerm;
+};
+export type RecurDef<A extends string, U extends Record<string, FnDef>> = {
+    args?: readonly A[];
+    fns?: U;
+    zero: TermLike | ((env: {
+        [a in A]: Term;
+    }) => TermLike);
+    next: (x: Term, prev: Term, env: RecurEnv<A, U>) => TermLike;
+};
+export declare const recur: <const A extends string = never, U extends Record<string, FnDef> = {}>(name: string, def: RecurDef<A, U>, lemmas?: Record<string, (x: Term, fx: Term, env: RecurEnv<A, U>) => Cond>, between?: Record<string, (x: Term, fx: Term, y: Term, fy: Term, env: RecurEnv<A, U>) => Cond>) => FnDef & {
+    verdict: Verdict;
+};
 type Kinds = Record<string, Kind<unknown>>;
 type ValuesOf<K extends Kinds> = {
     [n in keyof K]: K[n] extends Kind<infer V> ? V : never;
 };
 type Obj = object;
-type Writes<V> = V extends Decimal ? DecimalLike | string : V extends Int ? IntLike : V extends Cond ? Cond | boolean : V extends Choice<infer K> ? Choice<K> | K : V extends Maybe<infer W> ? Maybe<W> | Writes<W> | null : V extends Str ? Str | string : TermLike;
+type Writes<V> = V extends Decimal ? DecimalLike | string : V extends Int ? IntLike : V extends Cond ? Cond | boolean : V extends Choice<infer K> ? Choice<K> | K : V extends Maybe<infer W> ? Maybe<W> | Writes<W> | null : V extends Str ? Str | string : V extends Variant<infer C> ? Variant<C> | VariantWrite<C> : V extends Term ? TermLike : V extends Record<string, unknown> ? {
+    [k in keyof V]: Writes<V[k]>;
+} : TermLike;
 type Update<S extends Obj, M extends Obj> = Partial<{
     [k in keyof S]: Writes<S[k]>;
 } & {
-    [k in keyof M]: MapWrite;
+    [k in keyof M]: M[k] extends CellsRef<unknown> | ItemsRef<unknown> ? PartsWrite : MapWrite;
 }>;
 type Spec = {
     name: string;
@@ -265,6 +384,8 @@ type Spec = {
     state: [string, number | ((p: never) => TermLike)][];
     maps: [string, number][];
     lists?: string[];
+    cells?: [string, Kind<unknown>][];
+    items?: [string, Kind<unknown>][];
     kinded?: [string, Kind<unknown>][];
     carried?: string[];
     fns?: [string, FnDef][];
@@ -293,8 +414,8 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     state<T extends Record<string, number | ((p: P) => TermLike) | Init<unknown>>>(init: T): Rule<P, I, S & {
         [k in keyof T]: T[k] extends Init<infer V> ? V : Term;
     }, M, F, R, Su, Q>;
-    maps<T extends Record<string, number>>(init: T): Rule<P, I, S, M & {
-        [k in keyof T]: MapRef;
+    maps<T extends Record<string, number | Init<unknown>>>(init: T): Rule<P, I, S, M & {
+        [k in keyof T]: T[k] extends Init<infer V> ? CellsRef<V> : MapRef;
     }, F, R, Su, Q>;
     ints<T extends Record<string, number | ((p: P) => IntLike)>>(init: T): Rule<P, I, S & {
         [k in keyof T]: Int;
@@ -307,6 +428,11 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     }, M & {
         [k in N]: ListRef;
     }, F, R, Su, Q>;
+    items<T extends Record<string, Kind<unknown>>>(kinds: T): Rule<P, I, S & {
+        [k in keyof T & string as `${k}_len`]: Term;
+    }, M & {
+        [k in keyof T]: ItemsRef<T[k] extends Kind<infer V> ? V : never>;
+    }, F, R, Su, Q>;
     fns<T extends Record<string, FnDef>>(defs: T): Rule<P & {
         [k in keyof T]: (...args: TermLike[]) => Term;
     }, I, S, M, F, R, Su, Q>;
@@ -348,6 +474,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     private kindAssumptions;
     private afterEnv;
     private env;
+    private composites;
     private names;
     private whatIs;
     private distinct;
@@ -363,7 +490,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     };
     private verdict;
     private crossStep;
-    compare<St extends Record<string, number>>(reference: {
+    compare<St extends Record<string, Raw>>(reference: {
         init: (params: {
             [k in keyof P]: Raw;
         }) => St;
@@ -425,13 +552,28 @@ export type Decision = {
     then: C;
     goal: Goal;
 };
+type ResultOf<V> = 0 extends 1 & V ? Term : [V] extends [Cond] ? Cond : [V] extends [Decimal] ? Decimal : [V] extends [Int] ? Int : [V] extends [Choice<infer K>] ? Choice<K> : [V] extends [Str] ? Str : [V] extends [Variant<infer C>] ? Variant<C> : [V] extends [Term | number] ? Term : [V] extends [Record<string, unknown>] ? {
+    [f in keyof V]: ResultOf<V[f]>;
+} : Term;
 type Result<T> = {
-    [k in keyof T]: T[k] extends Cond ? Cond : T[k] extends Decimal ? Decimal : T[k] extends Int ? Int : T[k] extends Choice<infer K> ? Choice<K> : T[k] extends Str ? Str : Term;
+    [k in keyof T]: ResultOf<T[k]>;
 };
+type ValueOf<V> = 0 extends 1 & V ? number : [V] extends [Cond] ? boolean : [V] extends [Choice<infer K>] ? K : [V] extends [Str] ? string : [V] extends [Variant<infer C>] ? CaseRaw<C> : [V] extends [Term | number | Int | Decimal] ? number : [V] extends [Record<string, unknown>] ? {
+    [f in keyof V]: ValueOf<V[f]>;
+} : number;
+type CaseRaw<C extends Cases> = {
+    [k in keyof C]: {
+        tag: k;
+    } & {
+        [f in keyof C[k]]: C[k][f] extends Kind<infer V> ? ValueOf<V> : never;
+    };
+}[keyof C];
 type Value<T> = {
-    [k in keyof T]: T[k] extends Cond ? boolean : T[k] extends Choice<infer K> ? K : T[k] extends Str ? string : number;
+    [k in keyof T]: ValueOf<T[k]>;
+};
+type Field = Term | Cond | Int | Decimal | Choice<string> | Str | Variant<any> | {
+    [f: string]: Field | number;
 };
-type Field = Term | Cond | Int | Decimal | Choice<string> | Str;
 export declare class Fun<P extends Obj = {}, I extends Obj = {}, O extends Obj = {}> {
     private readonly r;
     private readonly out?;
@@ -469,6 +611,7 @@ export declare class Fun<P extends Obj = {}, I extends Obj = {}, O extends Obj =
     }): Value<O>;
 }
 export declare const fun: (name: string) => Fun;
+export declare const funOf: (d: Decision) => Fun<Obj, Obj, Obj> | undefined;
 export type Agreement = {
     checked: number;
     failure?: string;
@@ -523,6 +666,10 @@ export type Verdict = {
     why?: string;
     trees?: Record<string, Tree>;
 };
+export declare class Unproven extends Error {
+    readonly verdict: Verdict;
+    constructor(what: string, verdict: Verdict);
+}
 export declare function proveRule(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[]): Verdict;
 export declare function proveSteps(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], stepLaws: StepLaw[]): Verdict;
 export type { StepLaw };