lawspec 0.12.0 → 0.13.0

package/API-MIGRATION.md

@@ -287,3 +287,10 @@ Each item names the owning unit, the contract `declaration`, the `stage`
 `runtime-checked`, a `reason`, and the `claim` as a typed expression. Schemas 3
 and 4 are otherwise unchanged; clients that ignore unknown fields need no
 changes. Generated definition code no longer re-checks proved postconditions.
+
+## Construction evidence (0.13)
+
+`evidence` items may have stage `construction`: a constructor field constraint,
+including a `wrapper` constraint, checked whenever a value is constructed or
+decoded. Its `declaration` is the constructor identity and its `status` is
+`runtime-checked`. The TypeScript API names these records `ObligationEvidence`.

package/LANGUAGE.md

@@ -1,4 +1,4 @@
-# LawSpec language and compiler boundary (0.12)
+# LawSpec language and compiler boundary (0.13)
 
 LawSpec describes portable laws, concrete examples, and adapter contracts. The
 compiler is written in Haskell. Rust is an output backend alongside Java, Python,
@@ -213,6 +213,54 @@ the `evidence` field. A proved definition is a natural reference model for a
 native adapter, as in `append xs ys = concatV xs ys` in the
 [indexed example](examples/specs/indexed_families.lawspec).
 
+## Domain modeling
+
+### Wrappers and constrained primitives
+
+A `wrapper` gives a primitive or container a domain meaning. It declares a
+distinct nominal type with one field, `value`, and an optional constraint:
+
+```lawspec
+wrapper UnitQuantity is Int32 where value >= 1 && value <= 1000 end
+wrapper OrderId is Text where prelude.length value > 0 end
+wrapper NonEmptyList (a :: Type) is List a where prelude.length value > 0 end
+```
+
+`UnitQuantity` is not interchangeable with `Int32` or with another wrapper over
+`Int32`. Its constructor, `UnitQuantity 5`, checks the constraint, so an invalid
+value cannot be constructed in an example, produced by a generator, or decoded
+from native code. `valueOfUnitQuantity` unwraps it. A wrapper elaborates to a
+single-constructor product with a refined field and a checked definition, and
+its native representation is that product on every target. The constraint is
+reported as a `construction` obligation in the evidence.
+
+### Workflows and state distinctions
+
+A workflow names a pipeline of adapter steps between distinct state types:
+
+```lawspec
+type UnvalidatedOrder is UnvalidatedOrder id :: Text quantity :: Int32 end
+type ValidatedOrder is ValidatedOrder id :: OrderId quantity :: UnitQuantity end
+type PricedOrder is PricedOrder id :: OrderId quantity :: UnitQuantity total :: Int64 end
+
+workflow placeOrder :: UnvalidatedOrder -> Either OrderError PricedOrder is
+  validateOrder :: UnvalidatedOrder -> Either OrderError ValidatedOrder
+  priceOrder :: ValidatedOrder -> Either OrderError PricedOrder
+end
+```
+
+Each step is an ordinary adapter declaration with one input. The compiler checks
+that every step accepts the state the previous step produces, that fallible steps
+(those returning `Either E T`) share one error type, and that the workflow's
+declared result matches: `Either E T` if any step can fail, otherwise `T`. It then
+adds the law `placeOrder composes its steps`: the native workflow must equal the
+railway composition of the native steps, where the first `Left` is the result. A
+step declared again with the same type is shared between workflows.
+
+Because each state is its own type, a `ValidatedOrder` can only hold checked
+values, and a step that needs one cannot be given raw input. See the
+[domain modeling example](examples/specs/domain_modeling.lawspec).
+
 ## Total definitions
 
 A unit can supply an implementation as a checked total definition:
@@ -442,13 +490,15 @@ Still open, for evaluation in later releases: index equalities between sibling
 fields (perfect trees whose subtrees share one index), non-linear indices, and
 GADTs that refine type arguments.
 
-### 0.13 Wlaschin-style domain modeling primitives
-
-- Semantic wrappers and constrained primitives.
-- Make illegal states unrepresentable.
-- Explicit domain workflows and state distinctions.
+### 0.13 Wlaschin-style domain modeling primitives (released)
 
-These build on 0.10 native bindings and 0.11 refinements.
+- Semantic wrappers and constrained primitives: `wrapper` declarations with
+  checked constructors.
+- Illegal states are unrepresentable: wrapper and field constraints are checked
+  on construction, generation and native decoding, and reported as evidence.
+- Explicit domain workflows and state distinctions: `workflow` declarations with
+  checked step types and a generated railway composition law.
+- See [domain modeling](#domain-modeling).
 
 ### 0.14 Cross-unit imports and packages
 

package/PRIMITIVES.md

@@ -1,4 +1,4 @@
-# LawSpec scalar reference (0.12.0)
+# LawSpec scalar reference (0.13.0)
 
 A scalar has a declared domain, checked literals, equality, property inputs, and
 boundary fixtures. General collections, objects, pointers, and type-only constructs

package/README.md

@@ -2,7 +2,7 @@
 
 **State the law once. Check it everywhere.**
 
-LawSpec 0.12 compiles reusable laws into native property tests, executable examples,
+LawSpec 0.13 compiles reusable laws into native property tests, executable examples,
 and implementation adapters. The compiler is Haskell, distributed as prebuilt
 WebAssembly with a Node CLI and an asynchronous, typed JavaScript API.
 
@@ -69,8 +69,18 @@ needs no runtime postcondition. Every contract obligation is reported as
 [proved indices](LANGUAGE.md#proved-indices-and-evidence) and the
 [release notes](RELEASE-0.12.md).
 
-Planned: 0.13 domain modeling primitives, 0.14 cross-unit packages, and 0.15
-evidence reporting. See the [roadmap](LANGUAGE.md#roadmap).
+## Domain modeling in 0.13
+
+LawSpec 0.13 adds `wrapper` declarations for constrained primitives, such as a
+`UnitQuantity` that cannot hold 0, and `workflow` declarations for typed
+pipelines between domain states, with a generated law that the workflow is the
+railway composition of its steps. See
+[domain modeling](LANGUAGE.md#domain-modeling), the
+[example](examples/specs/domain_modeling.lawspec) and the
+[release notes](RELEASE-0.13.md).
+
+Planned: 0.14 cross-unit packages and 0.15 evidence reporting. See the
+[roadmap](LANGUAGE.md#roadmap).
 
 ## Install and try it
 
@@ -81,7 +91,7 @@ support to use it; GitHub currently uses the Haskell fallback.
 Install [LawSpec from npm](https://www.npmjs.com/package/lawspec):
 
 ```sh
-npm install --save-dev lawspec@0.12.0
+npm install --save-dev lawspec@0.13.0
 npx lawspec --version
 ```
 
@@ -95,8 +105,8 @@ local dependencies so LawSpec can create its `package.json` and test script:
 ```sh
 mkdir lawspec-example
 cd lawspec-example
-npm exec --package=lawspec@0.12.0 -- lawspec init --target javascript
-npm install --save-dev lawspec@0.12.0
+npm exec --package=lawspec@0.13.0 -- lawspec init --target javascript
+npm install --save-dev lawspec@0.13.0
 npx lawspec check
 npx lawspec explain 'example.atoi_codec::itoa and then atoi yields a'
 npx lawspec doctor
@@ -306,7 +316,7 @@ reusable laws accept these curried functions, their partial applications, and
 scalar parameters. Quantified test inputs remain scalar.
 
 The prelude defines the following laws. Every row has an executable example in
-[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/algebra.lawspec), including both sides of every
+[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/algebra.lawspec), including both sides of every
 combined law. `f` and `g` are binary operations, `inverse` is unary, and `e` and
 `zero` are scalar parameters. All these laws require equality of the element type.
 
@@ -374,7 +384,7 @@ their entire consequence. Every conjunct is type-checked and emitted. As with
 existing assertions, the first failure stops that individual test. `and` is now
 a reserved word.
 
-[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/currying.lawspec) demonstrate a four-argument
+[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/currying.lawspec) demonstrate a four-argument
 function partially applied twice, a formatter with four heterogeneous arguments,
 and composition after partial application. Each example states its exact outputs.
 Run `node npm/bin/lawspec.mjs examples` after rebuilding to inspect all nine units
@@ -426,7 +436,7 @@ law `valid ports round trip` is
 end
 ```
 
-The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/parse_port.lawspec)
+The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/parse_port.lawspec)
 defines valid ports as 1–65535, and covers both endpoints, ordinary ports, zero,
 negative values, and 65536. All explicit `expect` assertions run regardless of
 the law's condition. A false condition skips only the consequence: invalid ports
@@ -444,7 +454,7 @@ The prelude includes `satisfies predicate` (the predicate holds for every input)
 and `left inverse when predicate parse render` (the guarded round trip above).
 These reusable laws preserve the condition and its lexical bindings when expanded.
 `equivalent` can also compare two predicates, since `Bool` supports equality.
-The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/boolean_flags.lawspec)
+The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/boolean_flags.lawspec)
 checks that flipping twice restores both `false` and `true`; all targets generate
 Boolean property inputs and explicit tests for both Boolean boundary values. Java caps Boolean-only JetCheck runs at the number of
 possible input combinations (up to 100), avoiding generator exhaustion.
@@ -523,7 +533,7 @@ This expands to `for all (x :: Int32) . render (x) = referenceRender (x)`.
 The example inherits the input name `x` from the prelude. Both functions are
 user-owned adapter functions; either may delegate to your existing code.
 
-[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/equivalent.lawspec) compares decimal
+[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/equivalent.lawspec) compares decimal
 renderers and two implementations that clamp negative integers to zero. For
 JavaScript, their adapters can be:
 
@@ -560,7 +570,7 @@ law `normalizers agree` is
 end
 ```
 
-The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/slug.lawspec)
+The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/slug.lawspec)
 compares two implementations of ASCII-space replacement. It includes empty,
 Unicode and escaped text. Each target uses its native string generator:
 JetCheck `Generator.stringsOf(Generator.asciiPrintableChars())`, Hypothesis `st.text()`, fast-check `fc.string()`,
@@ -587,7 +597,7 @@ law `canonicalization reaches a fixed point` is
 end
 ```
 
-The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/canonical_url.lawspec)
+The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/canonical_url.lawspec)
 uses removal of **all trailing slashes** as a small fixed-point demonstration,
 not a complete URL canonicalization algorithm. For JavaScript:
 
@@ -596,7 +606,7 @@ export const canonicalize = value => value.replace(/\/+$/, "");
 ```
 
 Removing just one trailing slash fails the supplied repeated-slash example.
-The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/mixed_inputs.lawspec)
+The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/mixed_inputs.lawspec)
 shows `Text` and `Int32` in the same quantified property and executable example.
 The JavaScript API represents example bindings as typed records whose values use
 `DataValue`: lossless tagged scalar payloads or structural constructors. Expected results are
@@ -679,7 +689,7 @@ by the JS shim.
 ## Build and verify
 
 For contributors working from a repository checkout, build a local archive with
-`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.12.0.tgz`.
+`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.13.0.tgz`.
 The package payload lives in `npm/`.
 
 ```sh

package/REFINEMENTS.md

@@ -1,4 +1,4 @@
-# Refinements and abstract integers (0.12.0)
+# Refinements and abstract integers (0.13.0)
 
 A refinement restricts a scalar domain with a pure Boolean expression. LawSpec
 checks concrete examples, generates satisfying input tuples, and checks adapter

package/RELEASE-0.13.md

@@ -0,0 +1,55 @@
+# LawSpec 0.13.0
+
+## Wrappers and constrained primitives
+
+```lawspec
+wrapper UnitQuantity is Int32 where value >= 1 && value <= 1000 end
+wrapper NonEmptyList (a :: Type) is List a where prelude.length value > 0 end
+```
+
+A wrapper declares a distinct nominal type with one field, `value`, and an
+optional constraint. Its constructor checks the constraint, so an invalid value
+cannot be constructed in an example (the compiler rejects `UnitQuantity 0`),
+produced by a generator, or decoded from native code. `valueOf<Name>` unwraps a
+value. Wrappers may take type parameters. They elaborate to a single-constructor
+product with a refined field, so all eight targets represent them natively with
+no new runtime machinery.
+
+## Workflows and state distinctions
+
+```lawspec
+workflow placeOrder :: UnvalidatedOrder -> Either OrderError PricedOrder is
+  validateOrder :: UnvalidatedOrder -> Either OrderError ValidatedOrder
+  priceOrder :: ValidatedOrder -> Either OrderError PricedOrder
+end
+```
+
+A workflow declares its steps as adapters and checks the pipeline: each step
+must accept the previous step's state, and fallible steps must share an error
+type. The workflow's result must match `Either E T` when any step can fail, or
+`T` otherwise. The compiler adds the law `placeOrder composes its steps`: the
+native workflow must equal the railway composition of the native steps.
+Diagnostics name the step and the mismatched types, with the workflow's source
+location.
+
+## Evidence
+
+Constructor field constraints, including wrapper constraints, appear in the
+evidence as `construction` obligations with status `runtime-checked`, next to
+the contract obligations introduced in 0.12. The TypeScript API declares these
+records as `ObligationEvidence`; the 0.12 typing was not published.
+
+## Examples and acceptance
+
+`examples/specs/domain_modeling.lawspec` combines wrappers, a parameterized
+`NonEmptyList`, order states and the workflow. `tools/domain-integration.mjs`
+runs it on all eight targets in both machine profiles. Correct adapters pass;
+mutants that break a wrapper invariant, the railway composition, or a non-empty
+list operation fail. The example runners now share
+`tools/example-acceptance.mjs`.
+
+## Compatibility
+
+`wrapper` and `workflow` begin new declarations. Specifications that do not use
+them compile as in 0.12. API schemas 3 and 4 are unchanged, apart from the
+additive `construction` stage in `evidence`.

package/bin/lawspec.mjs

@@ -173,13 +173,13 @@ async function main() {
   }
   if (!verb || ["help", "--help", "-h"].includes(verb)) {
     output(
-      "LawSpec 0.12.0\nUsage: lawspec init --target <language> [--project <directory>] [--minify]\n       lawspec check | doctor | explain <unit>::<law> | generate\n       lawspec examples [--example payments] [--target <language>] [--output <directory>]\nOptions: --config <path>, --target <language>, --machine-bits <32|64>, --json\nGeneration: --dry-run, --check, --minify\nTargets: " +
+      "LawSpec 0.13.0\nUsage: lawspec init --target <language> [--project <directory>] [--minify]\n       lawspec check | doctor | explain <unit>::<law> | generate\n       lawspec examples [--example payments] [--target <language>] [--output <directory>]\nOptions: --config <path>, --target <language>, --machine-bits <32|64>, --json\nGeneration: --dry-run, --check, --minify\nTargets: " +
         targets.join(", "),
     );
     return;
   }
   if (verb === "--version") {
-    output("0.12.0");
+    output("0.13.0");
     return;
   }
   if (positional.length > (verb === "explain" ? 1 : 0))

package/build.json

@@ -57,6 +57,7 @@
     "src/LawSpec/Data.hs",
     "src/LawSpec/DefinitionTotality.hs",
     "src/LawSpec/Domain.hs",
+    "src/LawSpec/DomainModel.hs",
     "src/LawSpec/Elaboration.hs",
     "src/LawSpec/Emit.hs",
     "src/LawSpec/Eval.hs",
@@ -128,8 +129,8 @@
     "wasm/lawspec-wasm.cabal"
   ],
   "digests": {
-    "lawspec.cabal": "dee4969ade96a065c1a527c557575d4041eedd3ae664eb01ec6b568130c5a1fd",
-    "package.yaml": "e92c582f87b1704f80d5e31af7fb6dbe4f56190b8660b55cdb8728ca77efec67",
+    "lawspec.cabal": "2aab726a6d4e9c64e218c0563d52fab738b0753f9597683b9d650dde1baa948c",
+    "package.yaml": "95807129285b33f8ac2bf7452aae1ee049f8f7711f0dc9f962fdf9586b58fcc8",
     "runtime/LawSpecCodecs.hs": "90cb1ed15d7ab664a17a054580c849408d77cfd2b2adcb4a3228b05132caeaca",
     "runtime/LawSpecDataStrategies.hs": "cbe9f1946228db1076c19cd3158e8798fe32766cfdbea3f66b63d22d3d217508",
     "runtime/LawSpecDataStrategies.java": "e3416efe8a0d7b1276cb4d1a8105fd01b1f5f3f02a803bf55d955d9e3ec39095",
@@ -153,8 +154,8 @@
     "runtime/lawspec_schema.mjs": "60eb4204461eaa2c207fc7c3394014e2a814e4383b7045c065b4dae7c7a202c2",
     "runtime/lawspec_schema.py": "b6967ef1a33fe6a1a180d5573ec37cd8bb2079c06e961ac2eeb05f23cffcdd07",
     "runtime/lawspec_strategies.rs": "cac9ca301d4614fff9acfe61e7cc5678fabc044edadfa89ec11599b6780dc5f3",
-    "runtime/rust/Cargo.lock": "614c41fad8f762414ea0e6b1de325e0e919f2f7c6a88d85eaa00ae238dc692d5",
-    "runtime/rust/Cargo.toml": "5789d98b6ed2022abf63a4a39aa155981b7819df8d41d86e354ffa7b015bb00b",
+    "runtime/rust/Cargo.lock": "deb6b268124278aa237f64c8e821caf2388ccda3df92c2e814a5863331ae8c92",
+    "runtime/rust/Cargo.toml": "ed36668f25943b9c8a3ea9eb5a805f2953540aabb763919029947d342cc23978",
     "src/LawSpec/Api.hs": "392f6e8c1a9ae81a95e219ac071e5b4bea03ee330d63b829036f8f54b2eda8a7",
     "src/LawSpec/Backend.hs": "03c3b0cd62467ca677c88d29d7b12b2ab505cc0076d93d1f48fbddb0e9bcf133",
     "src/LawSpec/Capabilities.hs": "e43d4fc3a4481fbb8aa3ff1c3f41f7e7fca5db01bfe256a30162a45d75a00c1c",
@@ -166,7 +167,7 @@
     "src/LawSpec/Core/DefinitionContracts.hs": "b7f60f038b231187ecf898e585ae1a8fb1fc113bb55bad6d1bb2660350fd969e",
     "src/LawSpec/Core/Definitions.hs": "52f024fca59661142f70f9aa7dd2cbdb4892e5d3b1ca8079c878c5a1ba667112",
     "src/LawSpec/Core/Eval.hs": "e1ad8af5b240dd99c3b1126408d2be5f9b42b86ca6189ecd3868680a5119d931",
-    "src/LawSpec/Core/Evidence.hs": "de5b2fe0df0d681a2d6430a8c535293d7e084fe287ab47522dc57d2be857c6bf",
+    "src/LawSpec/Core/Evidence.hs": "460af282299258c87ddba58b55ad09290d7d89e6e7d43a02f5470fbd5b7974a3",
     "src/LawSpec/Core/Expression.hs": "84985f4f685126253d3af7b6b605d80d28fc9aa115bd5e2946f989eeb1355224",
     "src/LawSpec/Core/Payload.hs": "df6a2b250c27c12bb6ac16b84847c52546081d066a3dca7575ed0d743cc13d50",
     "src/LawSpec/Core/PayloadPlan.hs": "f2a7d2dc58c6a0f79707bdc24773bd3aad3a3b8eea2735a8284b2a9f3a4af4a8",
@@ -184,6 +185,7 @@
     "src/LawSpec/Data.hs": "9dbeafa120276b114dad790ec69e617f7ad0c632e3c718962f2f7faf8ca327f4",
     "src/LawSpec/DefinitionTotality.hs": "7671b7efb0cac5d796b074d48b2c10940e5bd0b5df082b926aee694903285efa",
     "src/LawSpec/Domain.hs": "222d15f0012ae630802238a6d7e1ee78d1e718b599f5ebb5a1ddc4e8d29d68c3",
+    "src/LawSpec/DomainModel.hs": "3be67117c44e66a39d42d7ce094c2940c48ea1541017b64027afa6ea4b77092f",
     "src/LawSpec/Elaboration.hs": "86e3ef77a977cb1b55985e2939648135acd0c2c015afe76e34e09615d555f53e",
     "src/LawSpec/Emit.hs": "9f34f5765915a2a12a66a6dca647ddaef9289372956802c6d99cf0cfec447c7a",
     "src/LawSpec/Eval.hs": "b0872ba8a6974463b32776653c2939826a6be87318c15641401f913f6b139de2",
@@ -220,11 +222,11 @@
     "src/LawSpec/Model.hs": "1d7ceb7bd66e3d496eef89eaa86403e6896472317ca9a4be86e0c933a7cce403",
     "src/LawSpec/NativeBinding.hs": "33959b0fd432ad4150f3b685f6438e284b801c2a59d9ef3132486a1cc7c8925a",
     "src/LawSpec/NativeRequest.hs": "fb2dc88f42424ca520533700eab68c407a5de83807d1b0d8c976e6c4f3d65212",
-    "src/LawSpec/Parser.hs": "7b11b5cbdc89a2f706623929dbdc61df84e003fac2b48b3bbafee1e2cb87a025",
+    "src/LawSpec/Parser.hs": "94a5603f6831d1dad5634a766bbc02cc58d884d23b5d6606ed4a1537cfe4c813",
     "src/LawSpec/PortableGenerator.hs": "69d457e39f539c77fc7a4c08205e75352bbecd9dfdff031a283a39bf44b22d49",
     "src/LawSpec/PortableTestHelpers.hs": "8ba4d87183c8c11f6ef1ce21c170127335797154f29fb97ad3429f032a167fd3",
     "src/LawSpec/Prelude.hs": "b1e155c12f58e7c346551a0c65c5d5af76d045b3f1625977ca2a5d1c97cb8c46",
-    "src/LawSpec/Public.hs": "5b986149fd3b6169e4393b8b09e67ddf6923607fb3b6af619a1c9dbd20b0280d",
+    "src/LawSpec/Public.hs": "ca7f3edd3e5d623ecb1aecb2386fdcf4b1e334cf7bd7770b6a14f5690d8f5ed5",
     "src/LawSpec/PythonData.hs": "07e9bb54a1515f3f4744b7b9bb43633cbdbf07b3f9e35efef511753f97e216d5",
     "src/LawSpec/PythonDefinitions.hs": "30f3d2d71a378e194d62261e0fd1baade5a49ac8b5eaac97578ca015a48ce8e4",
     "src/LawSpec/PythonExpr.hs": "23d7d24b5fb4efff9cb63d38c02a93d95744ec79b4565daf1412088fc7c4ba59",
@@ -252,8 +254,8 @@
     "wasm/app/Exports.hs": "4ecbdac8faa2449e6fc61b93c82e6278fa14374154f29b4dacf0eef433f06a47",
     "wasm/cabal.project": "021e560afdc5eb4cb7169e7119ecb8f92c9ee170245af909c94b612941bff5cc",
     "wasm/cabal.project.freeze": "733dbed3d2ecccb26e874fd58f136296dad772184deb1658c196b5d54a0814dc",
-    "wasm/lawspec-wasm.cabal": "1d3eb3b1ab9845896d0207ecd5c2cde6ffdbf1837b79203a5eec49f62d434c34",
-    "npm/core.wasm": "7a8d98c77d07bd16dec5d8fcd2488f27eac64daaa82d4d9e1643fd93ae4130bc",
+    "wasm/lawspec-wasm.cabal": "ee8235aa57e891fe5b1f0d798694f5db5bc6e83b4d013fd1a96e9b2d28aae613",
+    "npm/core.wasm": "f67a99e2de93750f0d4930cc086688a74ee1d309c3818bfe3125490e01b08660",
     "npm/core_jsffi.js": "88d136efe92f7cff5758c8fec8d9b6bbc9707fe37741cebeeb415fe34ce3d72b",
     "npm/api.mjs": "e93251db289ff0609abaff78ad67f0a9af82508c1141c6a999604f67c56b6e7d",
     "npm/index.d.ts": "2674f8830bd20a2b9ef7dfa99e183598125b6bcc17e8d454e8f7cca1bbd2c9fe"

package/examples/specs/domain_modeling.lawspec

@@ -0,0 +1,59 @@
+unit example.ordering
+
+-- Constrained primitives. Each wrapper is a distinct type whose constructor
+-- checks the value, so an out-of-range quantity cannot be constructed,
+-- generated or decoded from native code. valueOf<Name> unwraps a value.
+wrapper UnitQuantity is Int32 where value >= 1 && value <= 1000 end
+wrapper OrderId is Text where prelude.length value > 0 end
+wrapper NonEmptyList (a :: Type) is List a where prelude.length value > 0 end
+
+-- Each workflow state is its own type. A ValidatedOrder can only hold checked
+-- values, so no later step needs to validate again.
+type UnvalidatedOrder is UnvalidatedOrder id :: Text quantity :: Int32 end
+type ValidatedOrder is ValidatedOrder id :: OrderId quantity :: UnitQuantity end
+type PricedOrder is PricedOrder id :: OrderId quantity :: UnitQuantity total :: Int64 end
+type OrderError is | InvalidOrderId | InvalidQuantity | PriceTooHigh end
+
+-- The compiler checks that each step accepts the previous step's state and that
+-- all failures share one error type. It adds a law that placeOrder is the
+-- railway composition of the steps: the first Left is the workflow's result.
+workflow placeOrder :: UnvalidatedOrder -> Either OrderError PricedOrder is
+  validateOrder :: UnvalidatedOrder -> Either OrderError ValidatedOrder
+  priceOrder :: ValidatedOrder -> Either OrderError PricedOrder
+end
+
+firstLine :: NonEmptyList Int32 -> Int32
+
+law `validation accepts exactly the valid orders` is
+  definition is
+    `for all` (input :: UnvalidatedOrder) .
+      (match validateOrder input with
+        | Left e -> false
+        | Right v -> true
+        end) = (match input with
+        | UnvalidatedOrder id quantity ->
+            prelude.length id > 0 && quantity >= 1 && quantity <= 1000
+        end)
+  end
+end
+
+law `quantities are always in range` is
+  definition is
+    `for all` (q :: UnitQuantity) .
+      valueOfUnitQuantity q >= 1 && valueOfUnitQuantity q <= 1000
+  end
+  example `largest quantity` is
+    q = UnitQuantity 1000
+    expect valueOfUnitQuantity q = 1000
+  end
+end
+
+law `a non-empty list has a first element` is
+  definition is
+    `for all` (xs :: NonEmptyList Int32) .
+      (match valueOfNonEmptyList xs with
+        | Nil -> false
+        | Cons head tail -> firstLine xs == head
+        end) = true
+  end
+end

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lawspec",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "State the law once. Check it everywhere.",
   "license": "MIT",
   "type": "module",
@@ -8,6 +8,6 @@
   "bin": { "lawspec": "bin/lawspec.mjs" },
   "exports": { ".": { "types": "./index.d.ts", "import": "./api.mjs" } },
   "types": "index.d.ts",
-  "files": ["*.mjs", "*.json", "index.d.ts", "bin", "core.wasm", "core_jsffi.js", "README.md", "NATIVE-BINDINGS.md", "PRIMITIVES.md", "REFINEMENTS.md", "RUST.md", "JAVA.md", "PYTHON.md", "GO.md", "HASKELL.md", "KOTLIN.md", "WEB.md", "LANGUAGE.md", "API-MIGRATION.md", "RELEASE-0.9.md", "RELEASE-0.10.md", "RELEASE-0.11.md", "RELEASE-0.12.md", "LICENSE", "starter.lawspec", "examples"],
+  "files": ["*.mjs", "*.json", "index.d.ts", "bin", "core.wasm", "core_jsffi.js", "README.md", "NATIVE-BINDINGS.md", "PRIMITIVES.md", "REFINEMENTS.md", "RUST.md", "JAVA.md", "PYTHON.md", "GO.md", "HASKELL.md", "KOTLIN.md", "WEB.md", "LANGUAGE.md", "API-MIGRATION.md", "RELEASE-0.9.md", "RELEASE-0.10.md", "RELEASE-0.11.md", "RELEASE-0.12.md", "RELEASE-0.13.md", "LICENSE", "starter.lawspec", "examples"],
   "scripts": { "test": "node --test test/*.test.mjs" }
 }