litedbmodel 1.2.9 → 2.0.0

package/dist/scp/guard.d.ts

@@ -0,0 +1,47 @@
+/**
+ * litedbmodel v2 SCP — param/fragment portability guard (WS1, #21).
+ *
+ * Fail-closed enforcement of the hard rule: every Expression IR node this backend emits
+ * (param slots, fragment `when` guards) uses ONLY bc's closed operator set
+ * (`PORTABLE_EXPR_OPERATORS`). A single-key object whose key is not a known operator is
+ * an un-lowerable construct — it must go through the Raw SQL escape hatch (spec §13), NOT
+ * a fake opcode. This wraps bc's `assertPortable` (no functions/Date/Promise residue)
+ * plus the operator-set check.
+ */
+import { type Component, type ComponentGraphIR } from 'behavior-contracts';
+import type { CompiledOperation, ExprNode } from './ir';
+/**
+ * Assert one Expression IR node is portable: no residue (functions/Date/…) and every
+ * operator-node key is in bc's closed set. Literals (number/string/bool/null) and arrays
+ * pass structurally.
+ *
+ * A single-key object is an OPERATOR node only when its key is a known operator
+ * (∈ {@link PORTABLE_EXPR_OPERATORS}); its value is then recursed as operator args. A
+ * single-key object whose key is NOT a known operator is a real portability violation and
+ * is rejected fail-closed (an un-lowerable pseudo-opcode → must use the Raw SQL escape
+ * hatch, spec §13). This mirrors bc's `assertPortableComponentGraph` operator-position
+ * semantics exactly — see {@link walkExpr} for the `obj` field-map special case.
+ */
+export declare function assertExprPortable(node: ExprNode, path?: string): void;
+/**
+ * Assert a whole compiled operation emits only portable Expression IR (static params +
+ * fragment tree). Throws {@link PortabilityError} on the first non-portable construct.
+ */
+export declare function assertOperationPortable(op: CompiledOperation): void;
+/**
+ * Assert every Expression IR node in ONE lowered component's port wiring is portable
+ * (WS2 AC). Walks every `componentRef`/`map` node's `ports` (and `map.over` / `map.when`)
+ * and every `cond` node's `if`/`then`/`else`, applying {@link assertExprPortable} — so any
+ * operator outside bc's closed set is rejected fail-closed at compile time. This is the
+ * litedbmodel-owned portability layer the authoring lower path auto-applies, over and
+ * above bc's own `assertPortableComponentGraph` self-check.
+ */
+export declare function assertComponentPortable(component: Component): void;
+/**
+ * Assert every component of a lowered Component-graph IR is portable (WS2 AC). The
+ * authoring lower path ({@link publishBehaviors} / {@link compileEager}) invokes this
+ * automatically so a non-portable opcode anywhere in the emitted IR is a fail-closed
+ * compile error. Throws {@link PortabilityError} on the first violation.
+ */
+export declare function assertComponentGraphPortable(ir: ComponentGraphIR): void;
+//# sourceMappingURL=guard.d.ts.map

package/dist/scp/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/scp/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAmF,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5J,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAA0B,MAAM,MAAM,CAAC;AAEhF;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,SAAM,GAAG,IAAI,CAGnE;AAwDD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,iBAAiB,GAAG,IAAI,CAGnE;AAID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAgBlE;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,CAEvE"}

package/dist/scp/guard.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * litedbmodel v2 SCP — param/fragment portability guard (WS1, #21).
+ *
+ * Fail-closed enforcement of the hard rule: every Expression IR node this backend emits
+ * (param slots, fragment `when` guards) uses ONLY bc's closed operator set
+ * (`PORTABLE_EXPR_OPERATORS`). A single-key object whose key is not a known operator is
+ * an un-lowerable construct — it must go through the Raw SQL escape hatch (spec §13), NOT
+ * a fake opcode. This wraps bc's `assertPortable` (no functions/Date/Promise residue)
+ * plus the operator-set check.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertExprPortable = assertExprPortable;
+exports.assertOperationPortable = assertOperationPortable;
+exports.assertComponentPortable = assertComponentPortable;
+exports.assertComponentGraphPortable = assertComponentGraphPortable;
+const behavior_contracts_1 = require("behavior-contracts");
+/**
+ * Assert one Expression IR node is portable: no residue (functions/Date/…) and every
+ * operator-node key is in bc's closed set. Literals (number/string/bool/null) and arrays
+ * pass structurally.
+ *
+ * A single-key object is an OPERATOR node only when its key is a known operator
+ * (∈ {@link PORTABLE_EXPR_OPERATORS}); its value is then recursed as operator args. A
+ * single-key object whose key is NOT a known operator is a real portability violation and
+ * is rejected fail-closed (an un-lowerable pseudo-opcode → must use the Raw SQL escape
+ * hatch, spec §13). This mirrors bc's `assertPortableComponentGraph` operator-position
+ * semantics exactly — see {@link walkExpr} for the `obj` field-map special case.
+ */
+function assertExprPortable(node, path = '$') {
+    (0, behavior_contracts_1.assertPortable)(node, path);
+    walkExpr(node, path);
+}
+function walkExpr(node, path) {
+    if (node === null || typeof node !== 'object')
+        return;
+    if (Array.isArray(node)) {
+        node.forEach((el, i) => walkExpr(el, `${path}[${i}]`));
+        return;
+    }
+    const keys = Object.keys(node);
+    if (keys.length === 1) {
+        // Single-key object = OPERATOR-position node. The key must be a known opcode
+        // (fail-closed on unknown opcodes — a real portability violation).
+        const op = keys[0];
+        if (!behavior_contracts_1.PORTABLE_EXPR_OPERATORS.has(op)) {
+            throw new behavior_contracts_1.PortabilityError(path, `Portability Guard: '${op}' is not a portable Expression IR operator (closed set: ${[...behavior_contracts_1.PORTABLE_EXPR_OPERATORS].join(', ')})`);
+        }
+        const arg = node[op];
+        // `obj` is the construction node: its arg is a FIELD MAP whose KEYS are data field
+        // names (NOT opcodes) and whose VALUES are ExprNodes. Recurse into the values ONLY —
+        // never apply the operator heuristic to the field map itself (aligns with bc's
+        // assertPortableExpr / evaluate() so a single-field {obj:{one:…}} is not misread as an
+        // unknown opcode). See behavior-contracts guard.ts `op === "obj"` branch.
+        if (op === 'obj') {
+            if (arg === null || typeof arg !== 'object' || Array.isArray(arg)) {
+                throw new behavior_contracts_1.PortabilityError(`${path}.obj`, `Portability Guard: {obj: ...} expects an object (at ${path}.obj)`);
+            }
+            for (const [k, v] of Object.entries(arg)) {
+                // Static fail-closed (defense-in-depth): own key "__proto__" is rejected here as it
+                // is by bc's guard/evaluator (prototype pollution / cross-language divergence).
+                if (k === behavior_contracts_1.FORBIDDEN_OBJECT_KEY) {
+                    throw new behavior_contracts_1.PortabilityError(`${path}.obj`, `Portability Guard: object key "${behavior_contracts_1.FORBIDDEN_OBJECT_KEY}" is forbidden (fail-closed) at ${path}.obj`);
+                }
+                walkExpr(v, `${path}.obj.${k}`);
+            }
+            return;
+        }
+        // Any other operator: recurse its arg (array of args or a nested expr node).
+        walkExpr(arg, `${path}.${op}`);
+        return;
+    }
+    // Multi-key objects are not operator nodes (operator nodes are single-key). Recurse each
+    // value structurally so nested operator nodes are still checked (assertPortable above has
+    // already rejected any function/Date/Promise residue across the whole subtree).
+    for (const k of keys)
+        walkExpr(node[k], `${path}.${k}`);
+}
+/** Assert a fragment (and its slots + `when`) emits only portable Expression IR. */
+function assertFragmentPortable(node, path) {
+    if ('connector' in node) {
+        node.fragments.forEach((f, i) => assertFragmentPortable(f, `${path}.fragments[${i}]`));
+        return;
+    }
+    if (node.when !== undefined)
+        assertExprPortable(node.when, `${path}.when`);
+    node.params.forEach((p, i) => assertExprPortable(p, `${path}.params[${i}]`));
+}
+/**
+ * Assert a whole compiled operation emits only portable Expression IR (static params +
+ * fragment tree). Throws {@link PortabilityError} on the first non-portable construct.
+ */
+function assertOperationPortable(op) {
+    op.params.forEach((p, i) => assertExprPortable(p, `$.params[${i}]`));
+    if (op.where !== null)
+        assertFragmentPortable(op.where, '$.where');
+}
+// ── Authoring→IR lower guard (WS2, #22 — auto-applied on the single compile path) ─────
+/**
+ * Assert every Expression IR node in ONE lowered component's port wiring is portable
+ * (WS2 AC). Walks every `componentRef`/`map` node's `ports` (and `map.over` / `map.when`)
+ * and every `cond` node's `if`/`then`/`else`, applying {@link assertExprPortable} — so any
+ * operator outside bc's closed set is rejected fail-closed at compile time. This is the
+ * litedbmodel-owned portability layer the authoring lower path auto-applies, over and
+ * above bc's own `assertPortableComponentGraph` self-check.
+ */
+function assertComponentPortable(component) {
+    const at = `component '${component.name}'`;
+    for (const n of component.body) {
+        if ('map' in n) {
+            assertExprPortable(n.map.over, `${at}/${n.id}.map.over`);
+            assertExprPortable(n.map.ports, `${at}/${n.id}.map.ports`);
+            if (n.map.when !== undefined)
+                assertExprPortable(n.map.when, `${at}/${n.id}.map.when`);
+        }
+        else if ('cond' in n) {
+            assertExprPortable(n.cond.if, `${at}/${n.id}.cond.if`);
+            assertExprPortable(n.cond.then, `${at}/${n.id}.cond.then`);
+            assertExprPortable(n.cond.else, `${at}/${n.id}.cond.else`);
+        }
+        else {
+            assertExprPortable(n.ports, `${at}/${n.id}.ports`);
+        }
+    }
+    assertExprPortable(component.output, `${at}.output`);
+}
+/**
+ * Assert every component of a lowered Component-graph IR is portable (WS2 AC). The
+ * authoring lower path ({@link publishBehaviors} / {@link compileEager}) invokes this
+ * automatically so a non-portable opcode anywhere in the emitted IR is a fail-closed
+ * compile error. Throws {@link PortabilityError} on the first violation.
+ */
+function assertComponentGraphPortable(ir) {
+    for (const c of ir.components)
+        assertComponentPortable(c);
+}
+//# sourceMappingURL=guard.js.map

package/dist/scp/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/scp/guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAiBH,gDAGC;AA4DD,0DAGC;AAYD,0DAgBC;AAQD,oEAEC;AAvHD,2DAA4J;AAG5J;;;;;;;;;;;GAWG;AACH,SAAgB,kBAAkB,CAAC,IAAc,EAAE,IAAI,GAAG,GAAG;IAC3D,IAAA,mCAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,IAAY;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,6EAA6E;QAC7E,mEAAmE;QACnE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,4CAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,qCAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,2DAA2D,CAAC,GAAG,4CAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnK,CAAC;QACD,MAAM,GAAG,GAAI,IAAgC,CAAC,EAAE,CAAC,CAAC;QAClD,mFAAmF;QACnF,qFAAqF;QACrF,+EAA+E;QAC/E,uFAAuF;QACvF,0EAA0E;QAC1E,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACjB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,qCAAgB,CAAC,GAAG,IAAI,MAAM,EAAE,uDAAuD,IAAI,OAAO,CAAC,CAAC;YAChH,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;gBACpE,oFAAoF;gBACpF,gFAAgF;gBAChF,IAAI,CAAC,KAAK,yCAAoB,EAAE,CAAC;oBAC/B,MAAM,IAAI,qCAAgB,CAAC,GAAG,IAAI,MAAM,EAAE,kCAAkC,yCAAoB,mCAAmC,IAAI,MAAM,CAAC,CAAC;gBACjJ,CAAC;gBACD,QAAQ,CAAC,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,OAAO;QACT,CAAC;QACD,6EAA6E;QAC7E,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,yFAAyF;IACzF,0FAA0F;IAC1F,gFAAgF;IAChF,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,QAAQ,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,oFAAoF;AACpF,SAAS,sBAAsB,CAAC,IAA6B,EAAE,IAAY;IACzE,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,EAAE,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,EAAqB;IAC3D,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI;QAAE,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAED,yFAAyF;AAEzF;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,SAAoB;IAC1D,MAAM,EAAE,GAAG,cAAc,SAAS,CAAC,IAAI,GAAG,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACzD,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACvD,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAC3D,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAAC,EAAoB;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU;QAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC"}