nervur 0.9.0 → 0.11.0

package/admin.mjs

@@ -13,8 +13,8 @@ const ADMIN = `({
       opened: Boolean                  @rights(is: [SELF, MEMBER, STRANGER])
     }
     type Mutation {
-      invite(address: String!, nextPkHash: String, rights: String): Boolean @rights(is: [SELF])
-      drop(address: String!): Boolean                       @rights(is: [SELF])
+      invite(address: String!, nextPkHash: String, rights: String): Boolean @rights(is: [SELF, MEMBER])
+      drop(address: String!): Boolean                       @rights(is: [SELF, MEMBER])
       extend(program: String): Boolean                      @rights(is: [SELF])
       create(program: String!, refs: [RefInput!], data: String, config: String): String
         @rights(is: [SELF, MEMBER])

package/being.mjs

@@ -143,7 +143,10 @@ const rotates = ({ mine }, from, nextPkHash) => {
     .list('refs/')
     .map((key) => ({ key, referred: mine.read(key) }))
     .find(({ referred }) => referred?.nextPkHash === claim);
-  if (held === undefined) {
+  if (
+    held === undefined ||
+    (held.key !== `refs/${from}` && mine.read(`refs/${from}`) !== undefined)
+  ) {
     return undefined;
   }
   mine.write(`refs/${from}`, { nextPkHash, rights: held.referred.rights });
@@ -261,7 +264,7 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
           });
           return answer({ referred: from, rights: pending.rights });
         }
-        if (op?.ask === undefined || program === undefined) {
+        if (op?.ask === undefined || program === undefined || !program.visible(rights)) {
           return undefined;
         }
         const asked = await program.ask({
@@ -336,10 +339,13 @@ const Registry = ({
     if (voice === undefined) {
       return undefined;
     }
+    const declared = (Program(memory.read(at, 'program')?.value)?.modules ?? []).map(
+      (one) => one.module,
+    );
     const door = Being({
       address: at,
       deliver,
-      modules: modulesFor(voice),
+      modules: modulesFor(voice, declared),
       vouched,
       voice,
       watch,
@@ -355,7 +361,7 @@ const Registry = ({
       if (program !== undefined && written === undefined) {
         return undefined;
       }
-      const missing = (written?.modules ?? []).filter((one) => modules[one.module] === undefined);
+      const missing = (written?.modules ?? []).filter((one) => !modules.has(one.module));
       if (missing.length > 0) {
         return undefined;
       }
@@ -403,7 +409,7 @@ const Registry = ({
       if (written === undefined) {
         return undefined;
       }
-      if (written.modules.some((one) => modules[one.module] === undefined)) {
+      if (written.modules.some((one) => !modules.has(one.module))) {
         return undefined;
       }
       if (orphans(address, written).length > 0) {

package/blueprint.mjs

@@ -167,12 +167,12 @@ const merged = (base, added) =>
     ]),
   );
 
+// Bare names, not Type.field pairs: X's "if create answers, it created"
+// makes Query.create and Mutation.create one reserved word.
 const doorsIn = (sdl) =>
   parse(sdl)
-    .definitions.filter(
-      (one) => one.kind === Kind.OBJECT_TYPE_DEFINITION || one.kind === Kind.OBJECT_TYPE_EXTENSION,
-    )
-    .flatMap((one) => (one.fields ?? []).map((field) => `${one.name.value}.${field.name.value}`));
+    .definitions.filter((one) => doorHolder(one) && ['Mutation', 'Query'].includes(one.name.value))
+    .flatMap((one) => (one.fields ?? []).map((field) => field.name.value));
 
 const composed = (baseSource, addedSource) => {
   try {
@@ -319,23 +319,36 @@ const Blueprint = (source) => {
       rights,
       schema,
       // The directive definition stays: pointer.mjs runs buildSchema on this output.
-      sdlFor: (held) =>
-        print({
+      sdlFor: (held) => {
+        const kept = document.definitions
+          .map((one) =>
+            doorHolder(one)
+              ? {
+                  ...one,
+                  fields: (one.fields ?? []).filter((field) => {
+                    const allowed = rightsOf(field);
+                    return allowed === undefined || allowed.includes(held);
+                  }),
+                }
+              : one,
+          )
+          .filter((one) => !doorHolder(one) || one.fields.length > 0);
+        const defined = new Set(
+          kept
+            .filter((one) => one.kind === Kind.OBJECT_TYPE_DEFINITION)
+            .map((one) => one.name.value),
+        );
+        // A filtered view where only a part's extension survives must still
+        // stand alone as a schema, or the right it serves opens nothing.
+        return print({
           ...document,
-          definitions: document.definitions
-            .map((one) =>
-              doorHolder(one)
-                ? {
-                    ...one,
-                    fields: (one.fields ?? []).filter((field) => {
-                      const allowed = rightsOf(field);
-                      return allowed === undefined || allowed.includes(held);
-                    }),
-                  }
-                : one,
-            )
-            .filter((one) => !doorHolder(one) || one.fields.length > 0),
-        }),
+          definitions: kept.map((one) =>
+            one.kind === Kind.OBJECT_TYPE_EXTENSION && !defined.has(one.name.value)
+              ? { ...one, kind: Kind.OBJECT_TYPE_DEFINITION }
+              : one,
+          ),
+        });
+      },
       trespass: [],
     });
   } catch {

package/client.mjs

@@ -64,4 +64,4 @@ const Client = ({ voice, deliver, resolve = (one) => one }) => {
   });
 };
 
-export { Client };
+export { Client, speaking };

package/ground.mjs

@@ -93,7 +93,8 @@ const Ground = (modules = {}) => {
 
   const extension = modules.blueprints?.ground();
   const program = extension === undefined ? ADMIN : composed(ADMIN, extension);
-  if (program === undefined || Blueprint(program)?.digest === undefined) {
+  const blueprint = program === undefined ? undefined : Blueprint(program);
+  if (blueprint?.digest === undefined) {
     return undefined;
   }
   const installed = cells.peek('ground/admin');
@@ -141,18 +142,24 @@ const Ground = (modules = {}) => {
         typeof one?.scope === 'function' ? one.scope(address) : one,
       ]),
     );
-  const modulesFor = (voice) =>
+  const declaredOnly = (obj, declared) =>
+    Object.fromEntries(Object.entries(obj).filter(([name]) => declared.includes(name)));
+  const modulesFor = (voice, declared = []) =>
     Object.freeze(
       introduced(
         {
-          ...extra,
-          ...boundFor(voice),
+          ...declaredOnly(extra, declared),
+          ...declaredOnly(boundFor(voice), declared),
           memory,
         },
         Tools.address(voice.pk),
       ),
     );
-  const adminModules = modulesFor(adminVoice);
+  const offeredNames = new Set([...Object.keys(extra), ...bound.map(([name]) => name), 'memory']);
+  const adminDeclared = () =>
+    (Program(memory.read(address, 'program')?.value)?.modules ?? blueprint.modules).map(
+      (one) => one.module,
+    );
 
   const adminMine = Compartment({
     memory,
@@ -185,8 +192,11 @@ const Ground = (modules = {}) => {
 
   const attest = async (name) => {
     const one = extra[name];
-    if (one?.at === undefined) {
-      return adminModules[name] !== undefined;
+    if (one === undefined) {
+      return false;
+    }
+    if (one.at === undefined) {
+      return null;
     }
     const seen = await deliver(Tools.envelope(adminVoice, one.at, { describe: {} }, stamp()));
     return seen?.body?.sdl === undefined
@@ -199,7 +209,7 @@ const Ground = (modules = {}) => {
     adminMine,
     address,
     deliver: (envelope) => deliver(envelope),
-    modules: adminModules,
+    modules: offeredNames,
     modulesFor,
     announce,
     forget,
@@ -211,7 +221,7 @@ const Ground = (modules = {}) => {
     Being({
       address,
       deliver: (envelope) => deliver(envelope),
-      modules: adminModules,
+      modules: modulesFor(adminVoice, adminDeclared()),
       registry,
       vouched,
       voice: adminVoice,

package/index.mjs

@@ -1,8 +1,8 @@
 export { ADMIN } from './admin.mjs';
 export { Blueprint, CLASSES, CORE_ONLY, OPEN, STRUCTURAL, coreClass, reads } from './blueprint.mjs';
-export { Client } from './client.mjs';
+export { Client, speaking } from './client.mjs';
 export { Contract, Contracts } from './contract.mjs';
-export { GROUND, Ground } from './ground.mjs';
+export { FLOOR, GROUND, Ground } from './ground.mjs';
 export { Cells, Clock, Dns, Entropy, Keychain, Memory, Paths, Wire } from './modules.mjs';
 export { Mcp, Pointer } from './pointer.mjs';
 export { Program } from './program.mjs';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nervur",
-  "version": "0.9.0",
-  "description": "A distributed system of sovereign beings \u2014 one door, one question: by whose authority.",
+  "version": "0.11.0",
+  "description": "A distributed system of sovereign beings — one door, one question: by whose authority.",
   "license": "Apache-2.0",
   "author": "Razvan Gherghina",
   "homepage": "https://nervur.org",

package/program.mjs

@@ -4,6 +4,8 @@ import {
   getIntrospectionQuery,
   graphql,
   isObjectType,
+  parse,
+  validate,
 } from 'graphql';
 import { Blueprint } from './blueprint.mjs';
 
@@ -41,8 +43,39 @@ const Program = (source) => {
     }
     return curtained.get(held);
   };
+  // graphql's validator demands a Query root even to judge a mutation, so an
+  // all-mutation filtered world validates against a copy wearing an empty one
+  // — never printed, never executed against.
+  const askable = new Map();
+  const askableBy = (held) => {
+    if (!askable.has(held)) {
+      const seen = seenBy(held);
+      try {
+        askable.set(
+          held,
+          seen === undefined || seen.getQueryType() != null
+            ? seen
+            : buildSchema(`${blueprint.sdlFor(held)}\ntype Query { _stands: Boolean }`),
+        );
+      } catch {
+        askable.set(held, undefined);
+      }
+    }
+    return askable.get(held);
+  };
   return Object.freeze({
     ask: async ({ source: asked, variables, context }) => {
+      const seen = askableBy(context.rights);
+      if (seen === undefined) {
+        return undefined;
+      }
+      try {
+        if (validate(seen, parse(asked)).length > 0) {
+          return undefined;
+        }
+      } catch {
+        return undefined;
+      }
       const answered = await graphql({
         contextValue: context,
         schema,