kibi-cli 2.31.1 → 2.35.1

package/dist/operations/mutation/strict-fact.js

@@ -5,6 +5,7 @@ const PROPERTY_VALUE_FIELDS = [
     "value_int",
     "value_number",
     "value_bool",
+    "value_set",
 ];
 // implements REQ-kibi-operation-interface-parity
 export function valueFieldHint(value) {
@@ -19,7 +20,10 @@ export function valueFieldHint(value) {
     if (typeof value === "string") {
         return `Use value_type: "string" plus value_string: ${JSON.stringify(value)}.`;
     }
-    return "Use value_type plus exactly one of value_string, value_int, value_number, or value_bool.";
+    if (Array.isArray(value)) {
+        return `Use value_type: "set" plus value_set: ${JSON.stringify(value)}.`;
+    }
+    return "Use value_type plus exactly one of value_string, value_int, value_number, value_bool, or value_set.";
 }
 // implements REQ-kibi-operation-interface-parity
 export function factKindShapeHints(entity) {
@@ -38,7 +42,7 @@ export function factKindShapeHints(entity) {
             hints.push(`fact_kind 'property_value' requires ${missing.join(", ")}.`);
         }
         if (present.length !== 1) {
-            hints.push("fact_kind 'property_value' requires exactly one typed value field: value_string, value_int, value_number, or value_bool.");
+            hints.push("fact_kind 'property_value' requires exactly one typed value field: value_string, value_int, value_number, value_bool, or value_set.");
         }
         if (hints.length > 0) {
             hints.push("Next action: use kb_model_requirement for prose claims, or provide subject_key, property_key, operator, value_type, and one value_* field in kb_upsert.properties.");

package/dist/operations/mutation/symbol-granularity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symbol-granularity.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/symbol-granularity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAajF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA0BpD;;;;GAIG;AAEH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AA+B3E,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAC3E,OAAO,CAAC,IAAI,CAAC,CAmDf"}
+{"version":3,"file":"symbol-granularity.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/symbol-granularity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAajF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA0BpD;;;;GAIG;AAEH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AA+B3E,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAC3E,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/operations/mutation/symbol-granularity.js

@@ -1,7 +1,7 @@
 import { collectGranularityCandidates } from "kibi-plugin-builtin";
 import { InputError } from "../../cli-errors.js";
-import { resolveWorkspaceSourceAbsolute } from "../../utils/repo-relative-path.js";
 import { ALLOWED_GRANULARITY_REASONS_PROSE, coarseLinkBehavioralNames, getBehavioralSymbolNames, getNonBehavioralSymbolNames, inferSymbolRole, isAllowedGranularityReason, isTraceabilityRelationshipType, } from "../../public/symbol-granularity.js";
+import { resolveWorkspaceSourceAbsolute } from "../../utils/repo-relative-path.js";
 function candidate(name, kind) {
     return { name, kind, role: inferSymbolRole(kind) };
 }
@@ -86,8 +86,10 @@ export async function validateSymbolGranularity(payload, relationships, context,
     // A declaration named like the symbol is coarse only through its own
     // behavioral members (a class and its public methods), the same test the
     // staged gate and `kibi check` apply; any other title is judged against
-    // every behavioral declaration in the file.
-    const behavioral = exact && (exact.kind !== "variable" || entity.symbol_role === "config")
+    // every behavioral declaration in the file. An exported constant is its
+    // own declaration with exact coordinates (a certificate proof's domain is
+    // one), so it is granular whatever its role.
+    const behavioral = exact
         ? coarseLinkBehavioralNames(entity.title, available)
         : getBehavioralSymbolNames(available);
     if (behavioral.length === 0)

package/dist/operations/mutation/upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upsert.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/upsert.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAexE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AA6B3E,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAI9B,MAAM,wBAAwB,CAAC;AAsEhC,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,IAAI,CAkBN;AA8CD;;;;;;;GAOG;AAEH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAmCxD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAgCvC;AAmCD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GAAG;IACrB,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACtD,GACA,sBAAsB,CASxB;AAGD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;CAC3C,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CA+H3B;AAgDD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C;;;;;;OAMG;IAEH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAClE,GAAG,IAAI,CAAC,CAmBR;AAyBD,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CA4gBzC"}
+{"version":3,"file":"upsert.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/upsert.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAexE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AA8B3E,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAI9B,MAAM,wBAAwB,CAAC;AAsEhC,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,IAAI,CAkBN;AA8CD;;;;;;;GAOG;AAEH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAmCxD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAgCvC;AAmCD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GAAG;IACrB,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACtD,GACA,sBAAsB,CASxB;AAGD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;CAC3C,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CAqI3B;AAgDD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C;;;;;;OAMG;IAEH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAClE,GAAG,IAAI,CAAC,CAmBR;AAyBD,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CA4gBzC"}

package/dist/operations/mutation/upsert.js

@@ -16,6 +16,7 @@ import { assertLogicalGroundingClaimKeys, assertSemanticInventoryBoundary, } fro
 import { entityContextWarnings } from "./context-warning.js";
 import { buildUpsertCommitGoal, formatUpsertError } from "./contradictions.js";
 import { assertFirmDecisionUnchanged } from "./firm-decision-guard.js";
+import { withStoredOmittedProperties } from "./omitted-properties.js";
 import { resolveUpsertOrigin } from "./origin.js";
 import { planRecoveryNotes, settlePendingPlanApplyJournals, withPlanRecoveryNotes, } from "./plan-apply-journal.js";
 import { assertPredicateArgumentVocabulary } from "./predicate-vocabulary-guard.js";
@@ -279,7 +280,12 @@ export async function validateUpsertForCommit(payload, context, options = {}) {
     // than later by the staged gate.
     if (checked.entity.sourceFile === undefined)
         await validateSymbolGranularity(checked.entity, checked.relationships, context, async () => staged?.entities.get(payload.id) ?? (await lookup.entity()));
-    let input = await withStoredRequirementSemantics(payload, prolog, staged, lookup);
+    const withSemantics = await withStoredRequirementSemantics(payload, prolog, staged, lookup);
+    // An uncompiled file is judged as the writer will patch it (below), so only
+    // a compiled entity lends its omitted properties to the stored write.
+    let input = uncompiledSource === null
+        ? await withStoredOmittedProperties(withSemantics, lookup, staged)
+        : withSemantics;
     let validated = input === payload ? checked : validateUpsertInput(input, context.clock());
     if (uncompiledSource !== null)
         lookup = {

package/dist/operations/mutation/validation.d.ts

@@ -1,5 +1,7 @@
 import { isAllowedGranularityReason } from "../../public/symbol-granularity.js";
 import type { UpsertInput, ValidatedUpsert } from "./types.js";
+/** Whether the upsert entity schema defines `key` as an entity property. */
+export declare function isUpsertEntityProperty(key: string): boolean;
 export declare function validateUpsertInput(input: UpsertInput, now: Date): ValidatedUpsert;
 export { isAllowedGranularityReason };
 //# sourceMappingURL=validation.d.ts.map

package/dist/operations/mutation/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/validation.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,0BAA0B,EAC3B,MAAM,oCAAoC,CAAC;AAU5C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAqN/D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,IAAI,GACR,eAAe,CA6DjB;AAED,OAAO,EAAE,0BAA0B,EAAE,CAAC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/validation.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,0BAA0B,EAC3B,MAAM,oCAAoC,CAAC;AAU5C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA2D/D,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAK3D;AA4JD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,IAAI,GACR,eAAe,CA6DjB;AAED,OAAO,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/operations/mutation/validation.js

@@ -59,6 +59,10 @@ const DOCUMENT_TEXT_PROPERTIES = new Set([
     "summary",
     "details",
 ]);
+/** Whether the upsert entity schema defines `key` as an entity property. */
+export function isUpsertEntityProperty(key) {
+    return Object.hasOwn(upsertEntitySchema.properties, key);
+}
 /** Every top-level entity key the upsert entity schema does not define. */
 function unknownEntityProperties(entity) {
     const known = upsertEntitySchema.properties;

package/dist/operations/proof/claim-bindings.d.ts

@@ -0,0 +1,41 @@
+import type { OperationContext } from "../../public/operations/runtime-types.js";
+import type { ProofContract } from "../../public/proof-protocol.js";
+import type { ClaimBinding } from "../../public/proof-receipt.js";
+import { type CertificateVerdict } from "./code-certificates.js";
+/**
+ * The type-level witness Kibi writes for a typecheck claim binding: it
+ * compiles only when the domain type has exactly the fact's members.
+ */
+export declare function setEqualityWitness(importPath: string, members: readonly string[], membersType: string): string;
+/**
+ * The type-level witness Kibi writes for a required_fields claim binding: it
+ * compiles only when every field is a required key of the type whose value
+ * can be neither undefined nor null. Each field has its own two lines (`key<i>`
+ * that the field exists, `required<i>` that it is required and non-null), so
+ * a failed compile says which fields break the claim.
+ */
+export declare function requiredFieldsWitness(importPath: string, typeExpression: string, fields: readonly string[]): string;
+/** Which fields a failed required-fields witness rejected, and how. */
+export declare function requiredFieldsFailures(witness: string, fields: readonly string[], errorLines: readonly number[]): string[];
+/**
+ * The evidence level a receipt records. A certificate that re-checks but
+ * derives none of the claims it names from the code proves nothing about
+ * the code, so the receipt supports tested, the level coverage reports. An
+ * intent-scope derivation rests on the knowledge base's own facts alone
+ * (the test read no value from the code), so it does not count either.
+ */
+export declare function receiptEvidenceLevel(level: "proved" | "tested", bindings: readonly ClaimBinding[] | undefined): "proved" | "tested";
+/**
+ * How a certificate binds to each claim its contract names in proves. Kibi
+ * derives what the certificate must establish from each claim's grounding
+ * fact (claim_obligations.pl) and checks the certificate against it; a claim
+ * whose fact has no derivation is only attested by the author. Returns
+ * undefined for a contract that names no claims.
+ */
+export declare function judgeClaimBindings(context: OperationContext, input: Readonly<{
+    testId: string;
+    contract: ProofContract;
+    verdict: CertificateVerdict;
+    coveredBySymbols: readonly string[];
+}>): Promise<ClaimBinding[] | undefined>;
+//# sourceMappingURL=claim-bindings.d.ts.map

package/dist/operations/proof/claim-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-bindings.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/claim-bindings.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,KAAK,kBAAkB,EAIxB,MAAM,wBAAwB,CAAC;AAgDhC;;;GAGG;AAEH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAgED;;;;;;GAMG;AAEH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,MAAM,CAgBR;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,EAAE,CAaV;AA0JD;;;;;;GAMG;AAEH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,GAAG,QAAQ,EAC1B,QAAQ,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,GAC5C,QAAQ,GAAG,QAAQ,CAQrB;AAED;;;;;;GAMG;AAEH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,QAAQ,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC,GACD,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,CA+FrC"}

package/dist/operations/proof/claim-bindings.js

@@ -0,0 +1,364 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+import { randomBytes } from "node:crypto";
+import { rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { runOperationJsonQuery, toPrologAtom, } from "../../public/operations/prolog-json.js";
+import { compileWitness, loadSymbol, smtAssertion, } from "./code-certificates.js";
+import { stringConstraintProblem } from "./code-models.js";
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function text(value) {
+    return typeof value === "string" ? value : "";
+}
+function sorted(values) {
+    return [...new Set(values)].sort();
+}
+function setDifference(code, fact) {
+    const factSet = new Set(fact);
+    const codeSet = new Set(code);
+    const missing = fact.filter((member) => !codeSet.has(member));
+    const extra = code.filter((member) => !factSet.has(member));
+    return [
+        missing.length > 0 ? `missing ${missing.slice(0, 5).join(", ")}` : "",
+        extra.length > 0 ? `not in the set ${extra.slice(0, 5).join(", ")}` : "",
+    ]
+        .filter(Boolean)
+        .join("; ");
+}
+/**
+ * The type-level witness Kibi writes for a typecheck claim binding: it
+ * compiles only when the domain type has exactly the fact's members.
+ */
+// implements REQ-kibi-claim-bound-proofs
+export function setEqualityWitness(importPath, members, membersType) {
+    const union = members.map((member) => JSON.stringify(member)).join(" | ");
+    return [
+        `import type * as domain from ${JSON.stringify(importPath)};`,
+        "type Equals<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;",
+        `type Members = ${membersType};`,
+        `const exact: Equals<Members, ${union}> = true;`,
+        "void exact;",
+        "export {};",
+        "",
+    ].join("\n");
+}
+/**
+ * How a domain export may spell its members as a type: a type alias or
+ * enum, a const array, the values of a string enum, or a const object's keys.
+ */
+function membersTypeCandidates(exportName) {
+    const name = `domain.${exportName}`;
+    return [
+        name,
+        `(typeof ${name})[number]`,
+        `\`\${${name}}\``,
+        `keyof typeof ${name}`,
+    ];
+}
+async function typecheckSetProblem(context, contract, obligation) {
+    const domainId = contract.domain_source?.symbol_id ?? "";
+    const domain = await loadSymbol(context, domainId);
+    if (!domain || domain.sourceFile === "")
+        return `the domain_source symbol ${domainId} has no source file`;
+    const exportName = contract.domain_source?.export ?? domain.title;
+    const directory = path.dirname(domain.sourceFile);
+    const base = path.basename(domain.sourceFile).replace(/\.[cm]?[jt]sx?$/, "");
+    const witnessPath = path.join(directory, `.kibi-claim-witness-${randomBytes(6).toString("hex")}.ts`);
+    const absolute = path.resolve(context.workspaceRoot, witnessPath);
+    let lastReason = "";
+    try {
+        for (const membersType of membersTypeCandidates(exportName)) {
+            writeFileSync(absolute, setEqualityWitness(`./${base}.js`, obligation.members, membersType), "utf8");
+            const compiled = compileWitness(context.workspaceRoot, witnessPath);
+            if (compiled.ok)
+                return null;
+            lastReason = compiled.reason;
+        }
+    }
+    finally {
+        rmSync(absolute, { force: true });
+    }
+    return `${exportName} as a type is not exactly the fact's set {${obligation.members.join(", ")}}${lastReason ? ` (${lastReason.replace(/ the witness \S+/, " the set-equality witness")})` : ""}`;
+}
+function smtNegation(obligation) {
+    const assertion = smtAssertion(obligation.variable, obligation.value_type, {
+        operator: obligation.operator,
+        value: obligation.value,
+    });
+    // (assert X) -> (assert (not X))
+    return `(assert (not ${assertion.slice("(assert ".length, -1)}))`;
+}
+function constraintText(obligation) {
+    return `${obligation.variable} ${obligation.operator} ${obligation.value}`;
+}
+/**
+ * The type-level witness Kibi writes for a required_fields claim binding: it
+ * compiles only when every field is a required key of the type whose value
+ * can be neither undefined nor null. Each field has its own two lines (`key<i>`
+ * that the field exists, `required<i>` that it is required and non-null), so
+ * a failed compile says which fields break the claim.
+ */
+// implements REQ-kibi-non-numeric-proof-kinds
+export function requiredFieldsWitness(importPath, typeExpression, fields) {
+    return [
+        `import type * as domain from ${JSON.stringify(importPath)};`,
+        `type Shape = ${typeExpression};`,
+        "type HasKey<K extends PropertyKey> = K extends keyof Shape ? true : false;",
+        "type IsRequired<K extends PropertyKey> = K extends keyof Shape",
+        "  ? {} extends Pick<Shape, K> ? false : undefined extends Shape[K] ? false : null extends Shape[K] ? false : true",
+        "  : false;",
+        ...fields.flatMap((field, index) => [
+            `const key${index}: HasKey<${JSON.stringify(field)}> = true;`,
+            `const required${index}: IsRequired<${JSON.stringify(field)}> = true;`,
+        ]),
+        `void [${fields.map((_, index) => `key${index}, required${index}`).join(", ")}];`,
+        "export {};",
+        "",
+    ].join("\n");
+}
+/** Which fields a failed required-fields witness rejected, and how. */
+export function requiredFieldsFailures(witness, fields, errorLines) {
+    const lines = witness.split("\n");
+    const failing = new Set(errorLines);
+    const lineOf = (prefix) => lines.findIndex((line) => line.startsWith(prefix));
+    const failures = [];
+    fields.forEach((field, index) => {
+        if (failing.has(lineOf(`const key${index}:`)))
+            failures.push(`${field} is not a field`);
+        else if (failing.has(lineOf(`const required${index}:`)))
+            failures.push(`${field} is optional or nullable`);
+    });
+    return failures;
+}
+async function requiredFieldsProblem(context, contract, fields) {
+    const domainId = contract.domain_source?.symbol_id ?? "";
+    const domain = await loadSymbol(context, domainId);
+    if (!domain || domain.sourceFile === "")
+        return `the domain_source symbol ${domainId} has no source file`;
+    const exportName = contract.domain_source?.export ?? domain.title;
+    const directory = path.dirname(domain.sourceFile);
+    const base = path.basename(domain.sourceFile).replace(/\.[cm]?[jt]sx?$/, "");
+    const witnessPath = path.join(directory, `.kibi-claim-witness-${randomBytes(6).toString("hex")}.ts`);
+    const absolute = path.resolve(context.workspaceRoot, witnessPath);
+    let lastReason = "";
+    let failures = [];
+    try {
+        for (const typeExpression of [
+            `domain.${exportName}`,
+            `InstanceType<typeof domain.${exportName}>`,
+        ]) {
+            const witness = requiredFieldsWitness(`./${base}.js`, typeExpression, fields);
+            writeFileSync(absolute, witness, "utf8");
+            const compiled = compileWitness(context.workspaceRoot, witnessPath);
+            if (compiled.ok)
+                return null;
+            lastReason = compiled.reason;
+            // The first type expression that names a real type decides which
+            // fields fail; the InstanceType form is only for classes.
+            const errorLines = compiled.errorLines ?? [];
+            const shapeLine = witness.split("\n").findIndex((line) => line.startsWith("type Shape"));
+            if (failures.length === 0 && !errorLines.includes(shapeLine))
+                failures = requiredFieldsFailures(witness, fields, errorLines);
+        }
+    }
+    finally {
+        rmSync(absolute, { force: true });
+    }
+    if (failures.length > 0)
+        return `${exportName} does not have every field of {${fields.join(", ")}} as a required, non-nullable field: ${failures.join("; ")}`;
+    return `${exportName} does not have every field of {${fields.join(", ")}} as a required, non-nullable field${lastReason ? ` (${lastReason.replace(/ the witness \S+/, " the required-fields witness")})` : ""}`;
+}
+/** The symbols a non-numeric certificate read, which must be in code scope. */
+function modelSymbols(contract) {
+    return [
+        contract.domain_source?.symbol_id,
+        contract.initial_source?.symbol_id,
+        contract.pattern_source?.symbol_id,
+        ...Object.values(contract.domains ?? {}).map((row) => "symbol_id" in row ? row.symbol_id : undefined),
+        ...Object.values(contract.predicate_source ?? {}).flatMap((row) => [
+            row.symbol_id,
+            ...(row.harness_for ?? []),
+        ]),
+    ].filter((id) => typeof id === "string" && id !== "");
+}
+async function nonNumericProblem(context, contract, certificate, obligation, factId, coveredBy) {
+    const outside = modelSymbols(contract).find((id) => !coveredBy.has(id));
+    if (outside !== undefined)
+        return `the symbol ${outside} the certificate read is not in the receipt's code scope: link it covered_by the test so a change to it stales the proof`;
+    const obligationKind = text(obligation.kind);
+    if (obligationKind === "required_fields" && contract.kind === "typecheck")
+        return requiredFieldsProblem(context, contract, Array.isArray(obligation.members) ? obligation.members.map(String) : []);
+    if (obligationKind === "string_constraint")
+        return stringConstraintProblem(certificate, obligation, factId);
+    if (context.prolog === undefined)
+        return "no Prolog runtime is attached to model check the claim";
+    const checked = await runOperationJsonQuery(context.prolog, "claim_obligations.pl", `claim_obligations:claim_model_check_json(${toPrologAtom(contract.kind ?? "")}, ${toPrologAtom(JSON.stringify(obligation))}, ${toPrologAtom(JSON.stringify(certificate))}, JsonString)`, "Claim model check");
+    return checked.ok === true ? null : (checked.reason ?? "the model check failed");
+}
+const NON_NUMERIC_OBLIGATIONS = new Set([
+    "required_fields",
+    "string_constraint",
+    "rule_holds",
+    "predicate_holds",
+    "every_member",
+    "machine_set",
+    "machine_relation",
+    "set_relation",
+    "nullable_fields",
+    "route_middleware",
+]);
+async function derivedProblem(context, contract, certificate, row, coveredBy) {
+    const obligation = record(row.obligation) ?? {};
+    const kind = contract.kind;
+    const factId = row.fact_id ?? "the grounding fact";
+    if (NON_NUMERIC_OBLIGATIONS.has(text(obligation.kind)))
+        return nonNumericProblem(context, contract, certificate, obligation, factId, coveredBy);
+    if (kind === "exhaustive" || kind === "typecheck") {
+        const set = obligation;
+        const domainId = contract.domain_source?.symbol_id ?? "";
+        if (!coveredBy.has(domainId))
+            return `the domain_source symbol ${domainId} is not in the receipt's code scope: link it covered_by the test so a change to the domain stales the proof`;
+        if (kind === "exhaustive") {
+            const members = record(certificate.domain)?.members;
+            const code = sorted(Array.isArray(members) ? members.map((member) => String(member)) : []);
+            const fact = sorted(set.members ?? []);
+            if (code.join("\u0000") !== fact.join("\u0000"))
+                return `the domain members Kibi read are not ${factId}'s set (${setDifference(code, fact)})`;
+            return null;
+        }
+        return typecheckSetProblem(context, contract, set);
+    }
+    const numeric = obligation;
+    if (kind === "arithmetic") {
+        const claim = record(certificate.claim) ?? {};
+        if (text(certificate.variable) !== numeric.variable ||
+            text(certificate.value_type) !== numeric.value_type ||
+            text(claim.operator) !== numeric.operator ||
+            Number(claim.value) !== numeric.value)
+            return `the certificate's claim is not ${factId}'s constraint (${constraintText(numeric)})`;
+        return null;
+    }
+    const query = text(certificate.query).replace(/\s+/g, " ");
+    const negation = smtNegation(numeric);
+    if (!query.includes(negation))
+        return `the query does not assert the negation of ${factId}'s constraint ${negation}`;
+    return null;
+}
+/**
+ * The evidence level a receipt records. A certificate that re-checks but
+ * derives none of the claims it names from the code proves nothing about
+ * the code, so the receipt supports tested, the level coverage reports. An
+ * intent-scope derivation rests on the knowledge base's own facts alone
+ * (the test read no value from the code), so it does not count either.
+ */
+// implements REQ-kibi-claim-bound-proofs
+export function receiptEvidenceLevel(level, bindings) {
+    if (level !== "proved" || bindings === undefined || bindings.length === 0)
+        return level;
+    return bindings.some((binding) => binding.binding === "derived" && binding.scope !== "intent")
+        ? "proved"
+        : "tested";
+}
+/**
+ * How a certificate binds to each claim its contract names in proves. Kibi
+ * derives what the certificate must establish from each claim's grounding
+ * fact (claim_obligations.pl) and checks the certificate against it; a claim
+ * whose fact has no derivation is only attested by the author. Returns
+ * undefined for a contract that names no claims.
+ */
+// implements REQ-kibi-claim-bound-proofs, REQ-kibi-non-numeric-proof-kinds
+export async function judgeClaimBindings(context, input) {
+    const keys = input.contract.proves ?? [];
+    if (keys.length === 0 || input.contract.kind === undefined)
+        return undefined;
+    if (context.prolog === undefined)
+        return keys.map((key) => ({
+            claim_key: key,
+            binding: "rejected",
+            reason: "no Prolog runtime is attached to resolve the claim",
+        }));
+    const rows = await runOperationJsonQuery(context.prolog, "claim_obligations.pl", `claim_obligations:test_claim_obligations_json(${toPrologAtom(input.testId)}, ${toPrologAtom(JSON.stringify(keys))}, ${toPrologAtom(input.contract.kind)}, JsonString)`, "Claim obligations");
+    const coveredBy = new Set(input.coveredBySymbols);
+    const valueSourced = (input.contract.value_source ?? []).length > 0 &&
+        (input.contract.value_source ?? []).every((source) => "source" in source || coveredBy.has(source.symbol_id));
+    // A rule decided by a test harness that drives the code is about the code
+    // through that harness, so its claims are bound with scope harness.
+    const harnessed = input.contract.kind === "rule" &&
+        Object.values(input.contract.predicate_source ?? {}).some((row) => (row.harness_for ?? []).length > 0);
+    const certificate = record(input.verdict.certificate) ?? {};
+    const bindings = [];
+    for (const row of rows) {
+        const base = {
+            claim_key: row.claim_key,
+            ...(row.requirement_id ? { requirement_id: row.requirement_id } : {}),
+            ...(row.fact_id ? { fact_id: row.fact_id } : {}),
+        };
+        if (row.result === "unresolved" || row.result === "incompatible") {
+            bindings.push({
+                ...base,
+                binding: "rejected",
+                reason: row.reason ?? "the claim cannot be proved by this certificate",
+            });
+            continue;
+        }
+        if (row.result === "attested") {
+            bindings.push({ ...base, binding: "attested", scope: "code" });
+            continue;
+        }
+        const obligation = record(row.obligation) ?? {};
+        if (input.verdict.evidence_level !== "proved") {
+            const recheck = `the certificate did not re-check${input.verdict.certificate_rejection ? `: ${input.verdict.certificate_rejection}` : ""}`;
+            // A typecheck claim is decided from the code alone, so when the
+            // author's witness fails, lead with what the code breaks (the field
+            // that is nullable, the member that is missing) rather than only
+            // "the type checker did not accept the witness".
+            const codeProblem = input.contract.kind === "typecheck" &&
+                input.verdict.certificate !== undefined
+                ? await derivedProblem(context, input.contract, certificate, row, coveredBy)
+                : null;
+            bindings.push({
+                ...base,
+                binding: "rejected",
+                obligation,
+                reason: codeProblem === null ? recheck : `${codeProblem} (${recheck})`,
+            });
+            continue;
+        }
+        const problem = await derivedProblem(context, input.contract, certificate, row, coveredBy);
+        const numeric = text(obligation.kind) === "numeric_constraint";
+        bindings.push(problem === null
+            ? {
+                ...base,
+                binding: "derived",
+                scope: numeric && !valueSourced
+                    ? "intent"
+                    : harnessed
+                        ? "harness"
+                        : input.contract.kind === "source"
+                            ? "source"
+                            : "code",
+                obligation,
+            }
+            : { ...base, binding: "rejected", obligation, reason: problem });
+    }
+    return bindings;
+}