kibi-cli 2.32.0 → 2.36.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (164) hide show
  1. package/dist/cli.d.ts.map +1 -1
  2. package/dist/cli.js +5 -1
  3. package/dist/commands/check-generated.d.ts +5 -1
  4. package/dist/commands/check-generated.d.ts.map +1 -1
  5. package/dist/commands/check-generated.js +24 -35
  6. package/dist/commands/init-helpers.d.ts.map +1 -1
  7. package/dist/commands/init-helpers.js +8 -5
  8. package/dist/commands/migrate.d.ts.map +1 -1
  9. package/dist/commands/migrate.js +23 -5
  10. package/dist/commands/sync/manifest.d.ts +10 -1
  11. package/dist/commands/sync/manifest.d.ts.map +1 -1
  12. package/dist/commands/sync/manifest.js +87 -14
  13. package/dist/commands/sync.d.ts.map +1 -1
  14. package/dist/commands/sync.js +19 -0
  15. package/dist/extractors/markdown.d.ts +1 -1
  16. package/dist/extractors/markdown.d.ts.map +1 -1
  17. package/dist/extractors/symbol-coordinates.js +2 -2
  18. package/dist/extractors/symbols-coordinator.d.ts +2 -4
  19. package/dist/extractors/symbols-coordinator.d.ts.map +1 -1
  20. package/dist/extractors/symbols-coordinator.js +1 -2
  21. package/dist/operations/migration/proof-contract-claims.d.ts +23 -10
  22. package/dist/operations/migration/proof-contract-claims.d.ts.map +1 -1
  23. package/dist/operations/migration/proof-contract-claims.js +35 -2
  24. package/dist/operations/migration/schema6.d.ts.map +1 -1
  25. package/dist/operations/migration/schema6.js +2 -4
  26. package/dist/operations/migration/symbol-coordinates-refresh.d.ts +3 -2
  27. package/dist/operations/migration/symbol-coordinates-refresh.d.ts.map +1 -1
  28. package/dist/operations/migration/symbol-coordinates-refresh.js +4 -3
  29. package/dist/operations/migration/untrack-symbol-coordinates.d.ts +23 -0
  30. package/dist/operations/migration/untrack-symbol-coordinates.d.ts.map +1 -0
  31. package/dist/operations/migration/untrack-symbol-coordinates.js +67 -0
  32. package/dist/operations/modeling/requirement-modeler.d.ts.map +1 -1
  33. package/dist/operations/modeling/requirement-modeler.js +48 -1
  34. package/dist/operations/modeling/requirement-types.d.ts +2 -1
  35. package/dist/operations/modeling/requirement-types.d.ts.map +1 -1
  36. package/dist/operations/modeling/requirement-utils.d.ts +1 -1
  37. package/dist/operations/modeling/requirement-utils.d.ts.map +1 -1
  38. package/dist/operations/modeling/requirement-utils.js +8 -1
  39. package/dist/operations/mutation/source-authoring.d.ts.map +1 -1
  40. package/dist/operations/mutation/source-authoring.js +39 -20
  41. package/dist/operations/proof/claim-bindings.d.ts +18 -0
  42. package/dist/operations/proof/claim-bindings.d.ts.map +1 -1
  43. package/dist/operations/proof/claim-bindings.js +157 -4
  44. package/dist/operations/proof/code-certificates.d.ts +34 -14
  45. package/dist/operations/proof/code-certificates.d.ts.map +1 -1
  46. package/dist/operations/proof/code-certificates.js +266 -157
  47. package/dist/operations/proof/code-models.d.ts +96 -0
  48. package/dist/operations/proof/code-models.d.ts.map +1 -0
  49. package/dist/operations/proof/code-models.js +601 -0
  50. package/dist/operations/proof/code-runner.d.ts +40 -0
  51. package/dist/operations/proof/code-runner.d.ts.map +1 -0
  52. package/dist/operations/proof/code-runner.js +164 -0
  53. package/dist/operations/proof/code-scope.d.ts +3 -0
  54. package/dist/operations/proof/code-scope.d.ts.map +1 -1
  55. package/dist/operations/proof/code-scope.js +26 -2
  56. package/dist/operations/proof/ingest-proof.d.ts.map +1 -1
  57. package/dist/operations/proof/ingest-proof.js +2 -1
  58. package/dist/operations/proof/regular-language.d.ts +89 -0
  59. package/dist/operations/proof/regular-language.d.ts.map +1 -0
  60. package/dist/operations/proof/regular-language.js +943 -0
  61. package/dist/operations/proof/source-code-readers.d.ts +12 -0
  62. package/dist/operations/proof/source-code-readers.d.ts.map +1 -0
  63. package/dist/operations/proof/source-code-readers.js +699 -0
  64. package/dist/operations/semantic-advisor/analyze-prose.d.ts.map +1 -1
  65. package/dist/operations/semantic-advisor/analyze-prose.js +2 -1
  66. package/dist/operations/semantic-advisor/strict-count-rules.d.ts.map +1 -1
  67. package/dist/operations/semantic-advisor/strict-count-rules.js +8 -2
  68. package/dist/operations/semantic-advisor/strict-rules.d.ts +8 -0
  69. package/dist/operations/semantic-advisor/strict-rules.d.ts.map +1 -1
  70. package/dist/operations/semantic-advisor/strict-rules.js +231 -1
  71. package/dist/operations/semantic-advisor/types.d.ts +1 -1
  72. package/dist/operations/semantic-advisor/types.d.ts.map +1 -1
  73. package/dist/prolog.d.ts.map +1 -1
  74. package/dist/prolog.js +13 -3
  75. package/dist/public/operations/catalog.d.ts +156 -13
  76. package/dist/public/operations/catalog.d.ts.map +1 -1
  77. package/dist/public/operations/evidence-floor.js +1 -1
  78. package/dist/public/operations/proof-contract-claims.js +1 -1
  79. package/dist/public/operations/specs/composite.d.ts +16 -3
  80. package/dist/public/operations/specs/composite.d.ts.map +1 -1
  81. package/dist/public/operations/specs/modeling.d.ts +16 -3
  82. package/dist/public/operations/specs/modeling.d.ts.map +1 -1
  83. package/dist/public/operations/specs/modeling.js +22 -3
  84. package/dist/public/operations/specs/mutation-schemas.d.ts +140 -10
  85. package/dist/public/operations/specs/mutation-schemas.d.ts.map +1 -1
  86. package/dist/public/operations/specs/mutation-schemas.js +14 -3
  87. package/dist/public/operations/specs/upsert.d.ts +140 -10
  88. package/dist/public/operations/specs/upsert.d.ts.map +1 -1
  89. package/dist/public/proof-certificates.d.ts +75 -1
  90. package/dist/public/proof-certificates.d.ts.map +1 -1
  91. package/dist/public/proof-certificates.js +212 -0
  92. package/dist/public/proof-protocol.d.ts +143 -10
  93. package/dist/public/proof-protocol.d.ts.map +1 -1
  94. package/dist/public/proof-protocol.js +301 -16
  95. package/dist/public/proof-receipt.d.ts +4 -3
  96. package/dist/public/proof-receipt.d.ts.map +1 -1
  97. package/dist/public/proof-receipt.js +6 -1
  98. package/dist/public/proof-sources.d.ts +102 -0
  99. package/dist/public/proof-sources.d.ts.map +1 -0
  100. package/dist/public/proof-sources.js +1292 -0
  101. package/dist/public/schemas/entity.d.ts.map +1 -1
  102. package/dist/public/schemas/entity.js +21 -1
  103. package/dist/public/skills/kibi-commit-review/SKILL.md +8 -8
  104. package/dist/public/skills/kibi-commit-review/resources/staged-gate.md +6 -6
  105. package/dist/public/skills/kibi-decisions/SKILL.md +5 -2
  106. package/dist/public/skills/kibi-decisions/resources/decision-records.md +4 -1
  107. package/dist/public/skills/kibi-freshness/SKILL.md +2 -2
  108. package/dist/public/skills/kibi-traceability/SKILL.md +3 -2
  109. package/dist/public/skills/kibi-usage/SKILL.md +5 -3
  110. package/dist/public/skills/kibi-usage/resources/proof.md +105 -9
  111. package/dist/report/html-report.css +45 -10
  112. package/dist/report/html-report.d.ts.map +1 -1
  113. package/dist/report/html-report.js +74 -17
  114. package/dist/report/report-view.d.ts +1 -1
  115. package/dist/report/report-view.d.ts.map +1 -1
  116. package/dist/report/report-view.js +1 -0
  117. package/dist/schemas/entity.schema.json +199 -8
  118. package/dist/traceability/evidence-model.d.ts +13 -12
  119. package/dist/traceability/evidence-model.d.ts.map +1 -1
  120. package/dist/traceability/evidence-model.js +1 -1
  121. package/dist/traceability/staged-diagnostics.d.ts.map +1 -1
  122. package/dist/traceability/staged-diagnostics.js +24 -20
  123. package/dist/traceability/staged-impact-contract.d.ts +4 -4
  124. package/dist/traceability/staged-impact-contract.js +9 -9
  125. package/dist/traceability/staged-symbols-manifest.d.ts +11 -3
  126. package/dist/traceability/staged-symbols-manifest.d.ts.map +1 -1
  127. package/dist/traceability/staged-symbols-manifest.js +47 -140
  128. package/dist/types/entities.d.ts +1 -1
  129. package/dist/types/entities.d.ts.map +1 -1
  130. package/dist/utils/rule-registry.generated.d.ts +1 -1
  131. package/dist/utils/rule-registry.generated.js +1 -1
  132. package/dist/utils/schema-version.d.ts +1 -1
  133. package/dist/utils/schema-version.d.ts.map +1 -1
  134. package/dist/utils/schema-version.js +3 -1
  135. package/dist/utils/strict-modeling.d.ts +3 -2
  136. package/dist/utils/strict-modeling.d.ts.map +1 -1
  137. package/dist/utils/strict-modeling.js +37 -4
  138. package/dist/workspace-cwd.d.ts +15 -0
  139. package/dist/workspace-cwd.d.ts.map +1 -0
  140. package/dist/workspace-cwd.js +86 -0
  141. package/package.json +2 -2
  142. package/schema/validation.pl +3 -1
  143. package/src/public/operations/evidence-floor.ts +1 -1
  144. package/src/public/operations/proof-contract-claims.ts +1 -1
  145. package/src/public/operations/specs/modeling.ts +24 -5
  146. package/src/public/operations/specs/mutation-schemas.ts +14 -3
  147. package/src/public/proof-certificates.ts +296 -1
  148. package/src/public/proof-protocol-types.d.ts +54 -2
  149. package/src/public/proof-protocol.ts +396 -20
  150. package/src/public/proof-receipt.ts +8 -2
  151. package/src/public/proof-sources.ts +1656 -0
  152. package/src/public/schemas/entity.ts +32 -2
  153. package/src/public/skills/kibi-commit-review/SKILL.md +8 -8
  154. package/src/public/skills/kibi-commit-review/resources/staged-gate.md +6 -6
  155. package/src/public/skills/kibi-decisions/SKILL.md +5 -2
  156. package/src/public/skills/kibi-decisions/resources/decision-records.md +4 -1
  157. package/src/public/skills/kibi-freshness/SKILL.md +2 -2
  158. package/src/public/skills/kibi-traceability/SKILL.md +3 -2
  159. package/src/public/skills/kibi-usage/SKILL.md +5 -3
  160. package/src/public/skills/kibi-usage/resources/proof.md +105 -9
  161. package/src/schemas/entity.schema.json +199 -8
  162. package/dist/traceability/reviewed-coordinate-refresh.d.ts +0 -10
  163. package/dist/traceability/reviewed-coordinate-refresh.d.ts.map +0 -1
  164. package/dist/traceability/reviewed-coordinate-refresh.js +0 -49
@@ -26,7 +26,9 @@
26
26
  import { createHash } from "node:crypto";
27
27
  import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
28
28
  import path from "node:path";
29
+ import { evaluateSourceCode } from "../operations/proof/source-code-readers.js";
29
30
  import { CODE_CERTIFICATE_VERSION } from "./proof-protocol.js";
31
+ import { describeSource, readSource, } from "./proof-sources.js";
30
32
  /** Where `kibi prove` asks a run to leave its certificates. */
31
33
  // implements REQ-kibi-code-proof-kinds
32
34
  export const PROOF_CERTIFICATES_ENV = "KIBI_PROOF_CERTIFICATES";
@@ -191,6 +193,216 @@ export function smtCertificate(input) {
191
193
  result: input.result,
192
194
  };
193
195
  }
196
+ const certificateText = (value) => typeof value === "string" ? value : String(value);
197
+ /**
198
+ * Call every predicate on every combination of its argument domains and
199
+ * record what the code decides. Import the domains and functions from their
200
+ * source (never restate them): Kibi evaluates the same exports at ingest and
201
+ * rejects a certificate whose tables differ, then model checks each claim's
202
+ * rule, predicate or set fact against the tables.
203
+ */
204
+ // implements REQ-kibi-non-numeric-proof-kinds
205
+ export async function ruleCertificate(input) {
206
+ const values = {};
207
+ const domains = {};
208
+ for (const [type, domain] of Object.entries(input.domains)) {
209
+ values[type] = [...domain.members];
210
+ domains[type] = {
211
+ ...(domain.symbolId !== undefined ? { symbol_id: domain.symbolId } : {}),
212
+ members: values[type].map(certificateText),
213
+ };
214
+ }
215
+ const predicates = {};
216
+ for (const [name, predicate] of Object.entries(input.predicates)) {
217
+ const lists = predicate.argTypes.map((type) => {
218
+ const list = values[type];
219
+ if (list === undefined)
220
+ throw new Error(`no domain for argument type ${type} of ${name}`);
221
+ return list;
222
+ });
223
+ const rows = [];
224
+ const count = lists.reduce((product, list) => product * list.length, 1);
225
+ for (let index = 0; index < count; index++) {
226
+ let rest = index;
227
+ const tuple = [];
228
+ for (let position = lists.length - 1; position >= 0; position--) {
229
+ const list = lists[position];
230
+ tuple[position] = list[rest % list.length];
231
+ rest = Math.floor(rest / list.length);
232
+ }
233
+ const args = tuple.map(certificateText);
234
+ try {
235
+ const value = await predicate.decide(...tuple);
236
+ rows.push(typeof value === "boolean"
237
+ ? { args, value }
238
+ : { args, error: `returned ${typeof value}, not a boolean` });
239
+ }
240
+ catch (error) {
241
+ rows.push({
242
+ args,
243
+ error: error instanceof Error ? error.message : String(error),
244
+ });
245
+ }
246
+ }
247
+ predicates[name] = {
248
+ symbol_id: predicate.symbolId,
249
+ arg_types: [...predicate.argTypes],
250
+ rows,
251
+ };
252
+ }
253
+ return {
254
+ version: CODE_CERTIFICATE_VERSION,
255
+ kind: "rule",
256
+ test_id: input.testId,
257
+ domains,
258
+ predicates,
259
+ };
260
+ }
261
+ /** The calls of a rule certificate that threw or returned a non-boolean. */
262
+ // implements REQ-kibi-non-numeric-proof-kinds
263
+ export function failedCalls(certificate) {
264
+ const predicates = (certificate.predicates ?? {});
265
+ return Object.entries(predicates).flatMap(([name, table]) => (table.rows ?? [])
266
+ .filter((row) => row.error !== undefined)
267
+ .map((row) => `${name}(${row.args.join(", ")}): ${row.error}`));
268
+ }
269
+ function nextStates(next) {
270
+ if (next === null || next === undefined || next === false)
271
+ return [];
272
+ if (Array.isArray(next))
273
+ return next;
274
+ if (next instanceof Set)
275
+ return [...next];
276
+ if (next instanceof Map)
277
+ return [...next.values()];
278
+ if (typeof next === "object")
279
+ return Object.values(next);
280
+ return [next];
281
+ }
282
+ /**
283
+ * Record a state machine as the code defines it: a transition table (an
284
+ * object or Map from each state to its next state, states, or event map; or
285
+ * a list of [from, to] pairs) or a next-state function called on every state
286
+ * and event (a throw, null or undefined means no transition). Kibi reads the
287
+ * same exports at ingest and checks each claim's transitions, reachability,
288
+ * initial and terminal states against the machine.
289
+ */
290
+ // implements REQ-kibi-non-numeric-proof-kinds
291
+ export async function stateMachineCertificate(input) {
292
+ const states = new Set();
293
+ const edges = new Map();
294
+ const edge = (from, to) => {
295
+ const pair = [certificateText(from), certificateText(to)];
296
+ states.add(pair[0]);
297
+ states.add(pair[1]);
298
+ edges.set(pair.join("\u0000"), pair);
299
+ };
300
+ const table = input.transitions;
301
+ if (typeof table === "function") {
302
+ const events = [...(input.events ?? [])];
303
+ for (const state of input.states ?? []) {
304
+ states.add(certificateText(state));
305
+ for (const event of events) {
306
+ let next;
307
+ try {
308
+ next = await table(state, event);
309
+ }
310
+ catch {
311
+ continue;
312
+ }
313
+ for (const target of nextStates(next))
314
+ edge(state, target);
315
+ }
316
+ }
317
+ }
318
+ else if (Array.isArray(table)) {
319
+ for (const entry of table) {
320
+ if (Array.isArray(entry) && entry.length === 2)
321
+ edge(entry[0], entry[1]);
322
+ else if (entry !== null && typeof entry === "object")
323
+ edge(entry.from, entry.to);
324
+ }
325
+ }
326
+ else {
327
+ const entries = table instanceof Map
328
+ ? [...table.entries()]
329
+ : Object.entries(table);
330
+ for (const [from, next] of entries) {
331
+ states.add(certificateText(from));
332
+ for (const target of nextStates(next))
333
+ edge(from, target);
334
+ }
335
+ }
336
+ const initial = input.initial === undefined
337
+ ? undefined
338
+ : (typeof input.initial === "object" && input.initial !== null
339
+ ? [...input.initial]
340
+ : [input.initial])
341
+ .map(certificateText)
342
+ .sort();
343
+ return {
344
+ version: CODE_CERTIFICATE_VERSION,
345
+ kind: "state_machine",
346
+ test_id: input.testId,
347
+ machine: {
348
+ symbol_id: input.symbolId,
349
+ states: [...states].sort(),
350
+ transitions: [...edges.values()].sort((a, b) => a.join("\u0000") < b.join("\u0000") ? -1 : 1),
351
+ ...(initial !== undefined ? { initial } : {}),
352
+ },
353
+ };
354
+ }
355
+ /**
356
+ * Record the pattern (a RegExp) or string constant a string claim is about.
357
+ * Kibi reads the same export at ingest and decides the claim exactly: a
358
+ * pattern's language against the fact's, or the string against the fact.
359
+ */
360
+ // implements REQ-kibi-non-numeric-proof-kinds
361
+ export function regexCertificate(input) {
362
+ return {
363
+ version: CODE_CERTIFICATE_VERSION,
364
+ kind: "regex",
365
+ test_id: input.testId,
366
+ pattern: typeof input.value === "string"
367
+ ? { symbol_id: input.symbolId, type: "string", value: input.value }
368
+ : {
369
+ symbol_id: input.symbolId,
370
+ type: "regexp",
371
+ source: input.value.source,
372
+ flags: input.value.flags,
373
+ flavor: "js",
374
+ },
375
+ };
376
+ }
377
+ /**
378
+ * The certificate of a source proof. Kibi reads the contract's source
379
+ * itself at ingest and stores its own read, so the run only names the test
380
+ * and, optionally, the source (which must be the contract's). A run may also
381
+ * leave nothing: a passed source proof needs no certificate from the test.
382
+ */
383
+ // implements REQ-kibi-source-proof-kinds
384
+ export function sourceCertificate(input) {
385
+ return {
386
+ version: CODE_CERTIFICATE_VERSION,
387
+ kind: "source",
388
+ test_id: input.testId,
389
+ ...(input.source !== undefined ? { source: input.source } : {}),
390
+ };
391
+ }
392
+ /**
393
+ * Read a project source the way Kibi does at ingest: the members (and the
394
+ * tables, objects or routes) of a JSON or YAML file, a glob, an OpenAPI
395
+ * document, the references the code makes, a data schema, a route table or
396
+ * a validator. A rule proof whose contract reads a domain from a source
397
+ * uses this to range its predicates over the same members.
398
+ */
399
+ // implements REQ-kibi-source-proof-kinds
400
+ export async function readProjectSource(source, workspaceRoot = process.cwd()) {
401
+ const read = await readSource(workspaceRoot, source, evaluateSourceCode);
402
+ if (!read.ok)
403
+ throw new Error(`Kibi could not read ${describeSource(source)}: ${read.reason}`);
404
+ return read.model;
405
+ }
194
406
  /**
195
407
  * Leave the certificate where `kibi prove` reads it. Returns the file written,
196
408
  * or null outside a `kibi prove` run.
@@ -29,11 +29,14 @@ export declare const SUCCESS_POLICIES: readonly ["all_required_first_attempt", "
29
29
  /**
30
30
  * What a proof contract's checker establishes. Runner kinds (e2e, example,
31
31
  * property) sample cases and support tested evidence; certificate kinds
32
- * (exhaustive, typecheck, arithmetic, smt) cover every case and support
33
- * proved evidence once Kibi re-checks the certificate the run left.
32
+ * (exhaustive, typecheck, arithmetic, smt, rule, state_machine, regex,
33
+ * source) cover every case and support proved evidence once Kibi re-checks
34
+ * the certificate the run left. A source certificate is Kibi's own read of a
35
+ * project source (a JSON or YAML file, a glob, an OpenAPI document, the
36
+ * references the code makes, a data schema, a route table, a validator).
34
37
  */
35
- export declare const PROOF_KINDS: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt"];
36
- export declare const CERTIFICATE_PROOF_KINDS: readonly ["exhaustive", "typecheck", "arithmetic", "smt"];
38
+ export declare const PROOF_KINDS: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt", "rule", "state_machine", "regex", "source"];
39
+ export declare const CERTIFICATE_PROOF_KINDS: readonly ["exhaustive", "typecheck", "arithmetic", "smt", "rule", "state_machine", "regex", "source"];
37
40
  export type ProofKind = (typeof PROOF_KINDS)[number];
38
41
  export declare function isCertificateProofKind(kind: unknown): boolean;
39
42
  export type { AttemptsStatus, ProducerProvenance, ProofAttempt, ProofAttempts, ProofBinding, ProofBindingKind, ProofContract, ProofEnvironment, ProofObligation, ProofResult, ProofResultOutcome, ProofRun, ProofRunArtifact, ProofRunOutcome, RunFailurePhase, SuccessPolicy, } from "./proof-protocol-types.js";
@@ -346,12 +349,24 @@ export declare const PROOF_CONTRACT_SCHEMA: {
346
349
  };
347
350
  readonly kind: {
348
351
  readonly type: "string";
349
- readonly enum: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt"];
350
- readonly description: "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic and smt must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved.";
352
+ readonly enum: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt", "rule", "state_machine", "regex", "source"];
353
+ readonly description: "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic, smt, rule, state_machine and regex must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved. source reads the contract's source itself: the run may leave {version, kind: source, test_id, source} or nothing, and Kibi stores its own read as the certificate.";
354
+ };
355
+ readonly source: {
356
+ readonly description: "source: the project source a source proof reads. A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.";
357
+ readonly type: "object";
358
+ readonly required: readonly ["reader"];
359
+ readonly properties: {
360
+ readonly reader: {
361
+ readonly type: "string";
362
+ readonly enum: readonly ["json", "yaml", "glob", "openapi", "references", "schema", "routes", "validator"];
363
+ };
364
+ };
365
+ readonly additionalProperties: true;
351
366
  };
352
367
  readonly domain_source: {
353
368
  readonly type: "object";
354
- readonly description: "exhaustive and typecheck: the symbol that defines the finite domain. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.";
369
+ readonly description: "exhaustive and typecheck: the symbol that defines the finite domain (typecheck: also the type whose fields a required_fields fact names). state_machine: the transition table or next-state function. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.";
355
370
  readonly required: readonly ["symbol_id"];
356
371
  readonly properties: {
357
372
  readonly symbol_id: {
@@ -380,7 +395,7 @@ export declare const PROOF_CONTRACT_SCHEMA: {
380
395
  };
381
396
  readonly proves: {
382
397
  readonly type: "array";
383
- readonly description: "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt); a claim with no such derivation is only attested and never counts as proved.";
398
+ readonly description: "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt, a rule, predicate or set fact for rule and state_machine, a string fact for regex); a claim with no such derivation is only attested and never counts as proved.";
384
399
  readonly minItems: 1;
385
400
  readonly items: {
386
401
  readonly type: "string";
@@ -390,9 +405,45 @@ export declare const PROOF_CONTRACT_SCHEMA: {
390
405
  };
391
406
  readonly value_source: {
392
407
  readonly type: "array";
393
- readonly description: "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base.";
408
+ readonly description: "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base. With measure count the value is the size of a list, set, map or object export, so a count claim reads the collection itself. An entry {source, measure: count} counts the members Kibi reads from a project source (routes, tables, environment variables).";
394
409
  readonly minItems: 1;
395
410
  readonly items: {
411
+ readonly type: "object";
412
+ readonly properties: {
413
+ readonly symbol_id: {
414
+ readonly type: "string";
415
+ readonly minLength: 1;
416
+ };
417
+ readonly export: {
418
+ readonly type: "string";
419
+ readonly minLength: 1;
420
+ };
421
+ readonly source: {
422
+ readonly type: "object";
423
+ readonly description: "A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.";
424
+ readonly required: readonly ["reader"];
425
+ readonly properties: {
426
+ readonly reader: {
427
+ readonly type: "string";
428
+ readonly enum: readonly ["json", "yaml", "glob", "openapi", "references", "schema", "routes", "validator"];
429
+ };
430
+ };
431
+ readonly additionalProperties: true;
432
+ };
433
+ readonly measure: {
434
+ readonly type: "string";
435
+ readonly enum: readonly ["value", "count"];
436
+ readonly description: "value (default for an export): the export is a number. count (the only measure of a source): the number of members of a list, set, map or object export, or of a source.";
437
+ };
438
+ };
439
+ readonly additionalProperties: false;
440
+ };
441
+ };
442
+ readonly predicate_source: {
443
+ readonly type: "object";
444
+ readonly description: "rule: the code function behind each predicate a claim's rule, predicate or set fact names, keyed by predicate name. Each export takes the predicate's arguments in order and returns a boolean; Kibi calls it on every combination of its argument domains.";
445
+ readonly minProperties: 1;
446
+ readonly additionalProperties: {
396
447
  readonly type: "object";
397
448
  readonly required: readonly ["symbol_id"];
398
449
  readonly properties: {
@@ -403,11 +454,93 @@ export declare const PROOF_CONTRACT_SCHEMA: {
403
454
  readonly export: {
404
455
  readonly type: "string";
405
456
  readonly minLength: 1;
457
+ readonly description: "The exported function's name in the symbol's source file. Without it Kibi reads the export named by the symbol's title.";
458
+ };
459
+ readonly harness_for: {
460
+ readonly type: "array";
461
+ readonly minItems: 1;
462
+ readonly items: {
463
+ readonly type: "string";
464
+ readonly minLength: 1;
465
+ };
466
+ readonly description: "The predicate is a test harness that decides the predicate by driving these code symbols (for example by calling the handler with each role). The symbols must be covered_by the test; a claim the harness proves is bound with scope harness.";
406
467
  };
407
468
  };
408
469
  readonly additionalProperties: false;
409
470
  };
410
471
  };
472
+ readonly domains: {
473
+ readonly type: "object";
474
+ readonly description: "rule: the finite domain of each argument type, keyed by type name (an array, Set, Map or object export, or a Python list, set, dict or Enum), or {source} for the members Kibi reads from a project source (every route, every table, every environment variable). state_machine with a next-state function: the `state` and `event` domains it is called on.";
475
+ readonly minProperties: 1;
476
+ readonly additionalProperties: {
477
+ readonly anyOf: readonly [{
478
+ readonly type: "object";
479
+ readonly required: readonly ["symbol_id"];
480
+ readonly properties: {
481
+ readonly symbol_id: {
482
+ readonly type: "string";
483
+ readonly minLength: 1;
484
+ };
485
+ readonly export: {
486
+ readonly type: "string";
487
+ readonly minLength: 1;
488
+ };
489
+ };
490
+ readonly additionalProperties: false;
491
+ }, {
492
+ readonly type: "object";
493
+ readonly required: readonly ["source"];
494
+ readonly properties: {
495
+ readonly source: {
496
+ readonly type: "object";
497
+ readonly description: "A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.";
498
+ readonly required: readonly ["reader"];
499
+ readonly properties: {
500
+ readonly reader: {
501
+ readonly type: "string";
502
+ readonly enum: readonly ["json", "yaml", "glob", "openapi", "references", "schema", "routes", "validator"];
503
+ };
504
+ };
505
+ readonly additionalProperties: true;
506
+ };
507
+ };
508
+ readonly additionalProperties: false;
509
+ }];
510
+ };
511
+ };
512
+ readonly initial_source: {
513
+ readonly description: "state_machine: the export holding the initial state (or states), needed for initial_states and reachable_states facts.";
514
+ readonly type: "object";
515
+ readonly required: readonly ["symbol_id"];
516
+ readonly properties: {
517
+ readonly symbol_id: {
518
+ readonly type: "string";
519
+ readonly minLength: 1;
520
+ };
521
+ readonly export: {
522
+ readonly type: "string";
523
+ readonly minLength: 1;
524
+ };
525
+ };
526
+ readonly additionalProperties: false;
527
+ };
528
+ readonly pattern_source: {
529
+ readonly description: "regex: the export holding the code's pattern (a RegExp, or a Python re.Pattern) or string constant that a string fact is about.";
530
+ readonly type: "object";
531
+ readonly required: readonly ["symbol_id"];
532
+ readonly properties: {
533
+ readonly symbol_id: {
534
+ readonly type: "string";
535
+ readonly minLength: 1;
536
+ };
537
+ readonly export: {
538
+ readonly type: "string";
539
+ readonly minLength: 1;
540
+ };
541
+ };
542
+ readonly additionalProperties: false;
543
+ };
411
544
  readonly constraint_source: {
412
545
  readonly type: "object";
413
546
  readonly description: "arithmetic and smt: the typed numeric property_value facts the certificate's assumptions come from. Kibi checks the assumptions (or the query's assertions) are exactly these facts' constraints, so the proof is about the knowledge base, not numbers the test chose.";
@@ -472,6 +605,6 @@ export declare function proofContractErrors(value: unknown): string[];
472
605
  * The optional contract fields beyond the v1 core, copied only when present
473
606
  * so existing contracts keep their hash.
474
607
  */
475
- export declare function optionalProofContractFields(contract: Record<string, unknown>): Pick<ProofContract, "kind" | "domain_source" | "witness" | "constraint_source" | "value_source" | "proves">;
608
+ export declare function optionalProofContractFields(contract: Record<string, unknown>): Pick<ProofContract, "kind" | "domain_source" | "witness" | "constraint_source" | "value_source" | "proves" | "predicate_source" | "domains" | "initial_source" | "pattern_source" | "source">;
476
609
  export declare function proofBindingsErrors(value: unknown): string[];
477
610
  //# sourceMappingURL=proof-protocol.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"proof-protocol.d.ts","sourceRoot":"","sources":["../../src/public/proof-protocol.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAG,wBAAiC,CAAC;AACxE;;;GAGG;AAEH,eAAO,MAAM,qBAAqB,EAAG,uBAAgC,CAAC;AACtE,yEAAyE;AAEzE,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAC;AAEzE,eAAO,MAAM,sBAAsB,6DAGzB,CAAC;AACX,4EAA4E;AAE5E,eAAO,MAAM,wBAAwB,EAAG,0BAAmC,CAAC;AAE5E,eAAO,MAAM,yBAAyB,EAAG,2BAAoC,CAAC;AAE9E,eAAO,MAAM,kBAAkB,iGAQrB,CAAC;AAEX,eAAO,MAAM,qBAAqB,iFAOxB,CAAC;AAEX,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAE7E,eAAO,MAAM,eAAe,sCAAuC,CAAC;AAEpE,eAAO,MAAM,kBAAkB,6EAMrB,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,sEAGnB,CAAC;AAEX;;;;;GAKG;AAEH,eAAO,MAAM,WAAW,yFAQd,CAAC;AAGX,eAAO,MAAM,uBAAuB,2DAK1B,CAAC;AAGX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAGrD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAIV,aAAa,EAGd,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0DtB,CAAC;AAEX,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwE5B,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4FxB,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoBxB,CAAC;AA0GX,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCzE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAoH/D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAyD5D;AAwGD;;;GAGG;AAEH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CACL,aAAa,EACX,MAAM,GACN,eAAe,GACf,SAAS,GACT,mBAAmB,GACnB,cAAc,GACd,QAAQ,CACX,CA2CA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA8C5D"}
1
+ {"version":3,"file":"proof-protocol.d.ts","sourceRoot":"","sources":["../../src/public/proof-protocol.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAG,wBAAiC,CAAC;AACxE;;;GAGG;AAEH,eAAO,MAAM,qBAAqB,EAAG,uBAAgC,CAAC;AACtE,yEAAyE;AAEzE,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAC;AAEzE,eAAO,MAAM,sBAAsB,6DAGzB,CAAC;AACX,4EAA4E;AAE5E,eAAO,MAAM,wBAAwB,EAAG,0BAAmC,CAAC;AAE5E,eAAO,MAAM,yBAAyB,EAAG,2BAAoC,CAAC;AAE9E,eAAO,MAAM,kBAAkB,iGAQrB,CAAC;AAEX,eAAO,MAAM,qBAAqB,iFAOxB,CAAC;AAEX,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAE7E,eAAO,MAAM,eAAe,sCAAuC,CAAC;AAEpE,eAAO,MAAM,kBAAkB,6EAMrB,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,sEAGnB,CAAC;AAEX;;;;;;;;GAQG;AAEH,eAAO,MAAM,WAAW,qIAYd,CAAC;AAGX,eAAO,MAAM,uBAAuB,uGAS1B,CAAC;AAGX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAGrD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAIV,aAAa,EAGd,MAAM,2BAA2B,CAAC;AAQnC,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0DtB,CAAC;AAEX,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwE5B,CAAC;AAqDX,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgIxB,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoBxB,CAAC;AA0GX,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCzE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAoH/D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAyD5D;AA0RD;;;GAGG;AAEH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CACL,aAAa,EACX,MAAM,GACN,eAAe,GACf,SAAS,GACT,mBAAmB,GACnB,cAAc,GACd,QAAQ,GACR,kBAAkB,GAClB,SAAS,GACT,gBAAgB,GAChB,gBAAgB,GAChB,QAAQ,CACX,CAgEA;AAsED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA8C5D"}