project-tiny-context-harness 0.8.10 → 0.8.12

package/dist/lib/design-resource-symbolic-source-ir-proof.d.ts

@@ -0,0 +1,14 @@
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofMethodV2 } from "./design-resource-symbolic-fact-types.js";
+import { type DerivedCurrentSourceNoninterferenceEvidenceV2 } from "./design-resource-symbolic-source-ir-evidence.js";
+import type { DesignResourceSymbolicSourceIrCertificateScopeV1 } from "./design-resource-symbolic-source-ir-types.js";
+export declare function deriveCurrentSourceScopeEvidence({ manifest, certificate, method, resource, source, sourceResourceRef, scope, certificateScopeSha256, }: {
+    manifest: DesignResourceObservableRuleManifestV2;
+    certificate: DesignResourceSymbolicNoninterferenceCertificateV2;
+    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
+    resource: DesignResource;
+    source: string;
+    sourceResourceRef: string;
+    scope: DesignResourceSymbolicSourceIrCertificateScopeV1;
+    certificateScopeSha256: string;
+}): DerivedCurrentSourceNoninterferenceEvidenceV2;

package/dist/lib/design-resource-symbolic-source-ir-proof.js

@@ -0,0 +1,98 @@
+import { compareText } from "./design-resource-symbolic-validation-support.js";
+import { derivedSourceResult, emptyDerivedSourceResult, failedSourceEvidence, sameStringSet, sourceCaseWitness, sourceNoninterferenceWitness, } from "./design-resource-symbolic-source-ir-evidence.js";
+import { evaluateCompleteSymbolicSourceDomain } from "./design-resource-symbolic-source-ir-evaluation.js";
+import { createSymbolicDenotationCompilationSession } from "./symbolic-denotation-engine.js";
+export function deriveCurrentSourceScopeEvidence({ manifest, certificate, method, resource, source, sourceResourceRef, scope, certificateScopeSha256, }) {
+    const ruleIndex = new Map(manifest.fact_rules.map((rule) => [rule.key, rule]));
+    const rules = certificate.fact_rule_refs.map((ruleRef) => {
+        const rule = ruleIndex.get(ruleRef);
+        if (!rule)
+            throw new Error(`certificate_rule_unknown:${ruleRef}`);
+        return rule;
+    });
+    const compilation = createSymbolicDenotationCompilationSession(manifest.axis_domains, [
+        ...rules.map((rule) => rule.region),
+        ...scope.regions.map((row) => row.predicate),
+    ]);
+    const rulesByRegion = new Map();
+    for (const rule of rules) {
+        const compiled = compilation.compile(rule.region);
+        const current = rulesByRegion.get(compiled.canonical_sha256) ?? {
+            factRuleRefs: [],
+            compiled,
+        };
+        current.factRuleRefs.push(rule.key);
+        rulesByRegion.set(compiled.canonical_sha256, current);
+    }
+    const declaredRegionRefs = scope.regions.map((row) => row.rule_region_sha256);
+    if (new Set(declaredRegionRefs).size !== declaredRegionRefs.length)
+        throw new Error("symbolic_source_ir_region_duplicate");
+    if (!sameStringSet(declaredRegionRefs, [...rulesByRegion.keys()]))
+        return failedSourceEvidence(emptyDerivedSourceResult(method, sourceResourceRef), sourceNoninterferenceWitness({
+            certificateScopeSha256,
+            resource,
+            locator: "/certificate_scopes/*/regions",
+            detail: `source_rule_region_set_mismatch:${declaredRegionRefs.join(",")}:${[
+                ...rulesByRegion.keys(),
+            ].join(",")}`,
+            kind: "source_rule_denotation_mismatch",
+        }));
+    const cases = scope.regions.map((region, index) => {
+        const expected = rulesByRegion.get(region.rule_region_sha256);
+        return {
+            index,
+            region,
+            compiledSource: compilation.compile(region.predicate),
+            compiledRule: expected.compiled,
+            factRuleRefs: [...expected.factRuleRefs].sort(compareText),
+        };
+    });
+    const derived = derivedSourceResult(method, sourceResourceRef, cases, manifest);
+    if (method !== "finite_complete_domain_exhaustive_equivalence") {
+        for (const proofCase of cases) {
+            const omittedAxisRef = proofCase.compiledSource.referenced_axis_refs.find((axisRef) => certificate.omitted_axis_refs.includes(axisRef));
+            if (omittedAxisRef)
+                return failedSourceEvidence(derived, sourceCaseWitness({
+                    certificateScopeSha256,
+                    resource,
+                    source,
+                    proofCase,
+                    axisRef: omittedAxisRef,
+                    kind: "omitted_axis_dependency",
+                    detail: "current Source expression branches on an omitted axis",
+                }));
+            if (proofCase.compiledSource.canonical_sha256 !==
+                proofCase.compiledRule.canonical_sha256)
+                return failedSourceEvidence(derived, sourceCaseWitness({
+                    certificateScopeSha256,
+                    resource,
+                    source,
+                    proofCase,
+                    kind: "source_rule_denotation_mismatch",
+                    detail: "current Source predicate differs from the current Rule region",
+                }));
+        }
+        return { derived_result: derived, failure_witness: null };
+    }
+    const exhaustive = evaluateCompleteSymbolicSourceDomain(manifest.axis_domains, certificate.omitted_axis_refs, cases.map((proofCase) => ({
+        fact_rule_refs: proofCase.factRuleRefs,
+        source: proofCase.compiledSource,
+        rule: proofCase.compiledRule,
+    })));
+    derived.complete_domain_cardinality = exhaustive.cardinality;
+    derived.exhaustive_evaluation_sha256 = exhaustive.evaluation_sha256;
+    if (exhaustive.counterexample) {
+        const proofCase = cases.find((item) => item.factRuleRefs.includes(exhaustive.counterexample.fact_rule_ref));
+        return failedSourceEvidence(derived, sourceCaseWitness({
+            certificateScopeSha256,
+            resource,
+            source,
+            proofCase,
+            kind: exhaustive.counterexample.kind,
+            axisRef: exhaustive.counterexample.axis_ref,
+            assignment: exhaustive.counterexample.assignment,
+            detail: exhaustive.counterexample.detail,
+        }));
+    }
+    return { derived_result: derived, failure_witness: null };
+}

package/dist/lib/design-resource-symbolic-source-ir-shape.d.ts

@@ -0,0 +1,2 @@
+import { type DesignResourceSymbolicSourceIrV1 } from "./design-resource-symbolic-source-ir-types.js";
+export declare function parseDesignResourceSymbolicSourceIr(value: unknown, label: string): DesignResourceSymbolicSourceIrV1;

package/dist/lib/design-resource-symbolic-source-ir-shape.js

@@ -0,0 +1,38 @@
+import { sha256, stableKey, } from "./design-resource-handoff-shape-primitives.js";
+import { parseSymbolicPredicate } from "./design-resource-symbolic-predicate-shape.js";
+import { DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION, } from "./design-resource-symbolic-source-ir-types.js";
+import { array, literal, object } from "./long-task-shape-primitives.js";
+export function parseDesignResourceSymbolicSourceIr(value, label) {
+    const root = object(value, label, [
+        "schema_version",
+        "target_ref",
+        "certificate_scopes",
+    ]);
+    return {
+        schema_version: literal(root.schema_version, [DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION], `${label}.schema_version`),
+        target_ref: stableKey(root.target_ref, `${label}.target_ref`),
+        certificate_scopes: array(root.certificate_scopes, `${label}.certificate_scopes`).map((scope, scopeIndex) => {
+            const scopeLabel = `${label}.certificate_scopes[${scopeIndex}]`;
+            const row = object(scope, scopeLabel, [
+                "certificate_scope_sha256",
+                "rule_scope_sha256",
+                "regions",
+            ]);
+            return {
+                certificate_scope_sha256: sha256(row.certificate_scope_sha256, `${scopeLabel}.certificate_scope_sha256`),
+                rule_scope_sha256: sha256(row.rule_scope_sha256, `${scopeLabel}.rule_scope_sha256`),
+                regions: array(row.regions, `${scopeLabel}.regions`).map((region, regionIndex) => {
+                    const regionLabel = `${scopeLabel}.regions[${regionIndex}]`;
+                    const entry = object(region, regionLabel, [
+                        "rule_region_sha256",
+                        "predicate",
+                    ]);
+                    return {
+                        rule_region_sha256: sha256(entry.rule_region_sha256, `${regionLabel}.rule_region_sha256`),
+                        predicate: parseSymbolicPredicate(entry.predicate, `${regionLabel}.predicate`),
+                    };
+                }),
+            };
+        }),
+    };
+}

package/dist/lib/design-resource-symbolic-source-ir-types.d.ts

@@ -0,0 +1,17 @@
+import type { SymbolicDenotationPredicate } from "./symbolic-denotation-types.js";
+export declare const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION: "design-resource-symbolic-source-ir-v1";
+export declare const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE: "application/vnd.ty-context.symbolic-source-ir+json";
+export interface DesignResourceSymbolicSourceIrRegionV1 {
+    rule_region_sha256: string;
+    predicate: SymbolicDenotationPredicate;
+}
+export interface DesignResourceSymbolicSourceIrCertificateScopeV1 {
+    certificate_scope_sha256: string;
+    rule_scope_sha256: string;
+    regions: DesignResourceSymbolicSourceIrRegionV1[];
+}
+export interface DesignResourceSymbolicSourceIrV1 {
+    schema_version: typeof DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION;
+    target_ref: string;
+    certificate_scopes: DesignResourceSymbolicSourceIrCertificateScopeV1[];
+}

package/dist/lib/design-resource-symbolic-source-ir-types.js

@@ -0,0 +1,2 @@
+export const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_SCHEMA_VERSION = "design-resource-symbolic-source-ir-v1";
+export const DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE = "application/vnd.ty-context.symbolic-source-ir+json";

package/dist/lib/design-resource-symbolic-static-dependency-validation.d.ts

@@ -0,0 +1,2 @@
+import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceProofV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function validateStaticDependencyClosure(proof: DesignResourceSymbolicNoninterferenceProofV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, projections: DesignResourceHandoffPreflightV2["rule_projections"], manifest: DesignResourceObservableRuleManifestV2): void;

package/dist/lib/design-resource-symbolic-static-dependency-validation.js

@@ -0,0 +1,83 @@
+import { assertSameSet, invalid, requireKnownRefs, unique, } from "./design-resource-symbolic-validation-support.js";
+const MAX_STATIC_DEPENDENCY_NODES = 8_192;
+const MAX_STATIC_DEPENDENCY_EDGES = 65_536;
+const MAX_STATIC_DEPENDENCY_DEPTH = 512;
+export function validateStaticDependencyClosure(proof, certificate, projections, manifest) {
+    if (proof.equivalence_cases.length ||
+        proof.complete_domain_cardinality !== null)
+        invalid("v2_static_dependency_proof_shape_invalid", certificate.key);
+    if (!proof.static_dependency_nodes.length || !proof.static_rule_roots.length)
+        invalid("v2_static_dependency_graph_required", certificate.key);
+    if (proof.static_dependency_nodes.length > MAX_STATIC_DEPENDENCY_NODES)
+        invalid("v2_static_dependency_node_limit_exceeded", certificate.key);
+    if (proof.static_dependency_nodes.reduce((total, node) => total + node.dependency_refs.length, 0) > MAX_STATIC_DEPENDENCY_EDGES)
+        invalid("v2_static_dependency_edge_limit_exceeded", certificate.key);
+    const nodes = new Map(proof.static_dependency_nodes.map((node) => [node.key, node]));
+    unique(proof.static_dependency_nodes.map((node) => node.key), `v2_static_dependency_node_duplicate:${certificate.key}`);
+    validateNodes(proof, manifest, nodes, certificate.key);
+    const rootedRuleRefs = proof.static_rule_roots.flatMap((root) => root.fact_rule_refs ?? certificate.fact_rule_refs);
+    unique(rootedRuleRefs, `v2_static_dependency_rule_duplicate:${certificate.key}`);
+    assertSameSet(rootedRuleRefs, certificate.fact_rule_refs, "v2_static_dependency_rule_set_mismatch", certificate.key);
+    const projectionsByRule = new Map(projections.map((projection) => [projection.rule.key, projection]));
+    const reachedNodes = new Set();
+    const reachedResources = new Set();
+    const closureMemo = new Map();
+    for (const root of proof.static_rule_roots) {
+        const rootRuleRefs = root.fact_rule_refs ?? certificate.fact_rule_refs;
+        if (!rootRuleRefs.length)
+            invalid("v2_static_dependency_root_rules_required", certificate.key);
+        const closure = collectClosure(root.node_ref, nodes, new Set(), reachedNodes, certificate.key, closureMemo);
+        if (closure.maximumDepth > MAX_STATIC_DEPENDENCY_DEPTH)
+            invalid("v2_static_dependency_depth_limit_exceeded", certificate.key);
+        closure.inputResourceRefs.forEach((ref) => reachedResources.add(ref));
+        for (const ruleRef of rootRuleRefs) {
+            const projection = projectionsByRule.get(ruleRef);
+            if (!projection)
+                invalid("v2_static_dependency_rule_unknown", `${certificate.key}:${ruleRef}`);
+            assertSameSet([...closure.axisRefs], projection.compiled_region.referenced_axis_refs, "v2_static_dependency_closure_mismatch", `${certificate.key}:${ruleRef}`);
+            if (certificate.omitted_axis_refs.some((axisRef) => closure.axisRefs.has(axisRef)))
+                invalid("v2_static_dependency_omitted_axis_conflict", `${certificate.key}:${ruleRef}`);
+        }
+    }
+    assertSameSet([...reachedNodes], [...nodes.keys()], "v2_static_dependency_unreachable_node", certificate.key);
+    assertSameSet([...reachedResources], proof.input_resource_refs, "v2_static_dependency_input_graph_mismatch", certificate.key);
+}
+function validateNodes(proof, manifest, nodes, label) {
+    const axes = new Set(manifest.axis_domains.map((axis) => axis.key));
+    for (const node of nodes.values()) {
+        unique(node.axis_refs, `v2_static_dependency_axis_duplicate:${node.key}`);
+        unique(node.dependency_refs, `v2_static_dependency_ref_duplicate:${node.key}`);
+        unique(node.input_resource_refs, `v2_static_dependency_input_duplicate:${node.key}`);
+        requireKnownRefs(node.axis_refs, axes, "v2_static_dependency_axis_unknown");
+        requireKnownRefs(node.dependency_refs, nodes, "v2_static_dependency_node_unknown");
+        requireKnownRefs(node.input_resource_refs, new Set(manifest.inspector.input_resources.map((resource) => resource.resource_ref)), "v2_static_dependency_input_unknown");
+    }
+    requireKnownRefs(proof.static_rule_roots.map((root) => root.node_ref), nodes, "v2_static_dependency_root_unknown");
+    if (!proof.input_resource_refs.length)
+        invalid("v2_noninterference_inputs_required", label);
+}
+function collectClosure(nodeRef, nodes, visiting, reached, label, memo) {
+    if (visiting.has(nodeRef))
+        invalid("v2_static_dependency_cycle", `${label}:${nodeRef}`);
+    const cached = memo.get(nodeRef);
+    if (cached)
+        return cached;
+    const node = nodes.get(nodeRef);
+    if (!node)
+        invalid("v2_static_dependency_node_unknown", `${label}:${nodeRef}`);
+    visiting.add(nodeRef);
+    reached.add(nodeRef);
+    const axisRefs = new Set(node.axis_refs);
+    const inputResourceRefs = new Set(node.input_resource_refs);
+    let maximumDepth = 1;
+    for (const dependencyRef of node.dependency_refs) {
+        const dependency = collectClosure(dependencyRef, nodes, visiting, reached, label, memo);
+        dependency.axisRefs.forEach((ref) => axisRefs.add(ref));
+        dependency.inputResourceRefs.forEach((ref) => inputResourceRefs.add(ref));
+        maximumDepth = Math.max(maximumDepth, dependency.maximumDepth + 1);
+    }
+    visiting.delete(nodeRef);
+    const result = { axisRefs, inputResourceRefs, maximumDepth };
+    memo.set(nodeRef, result);
+    return result;
+}

package/dist/lib/design-resource-symbolic-structural-closure-validation.d.ts

@@ -0,0 +1,6 @@
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
+import type { SymbolicManifestIndexes } from "./design-resource-symbolic-indexes.js";
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicHandoffTargetV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function validateSymbolicSubjectPopulationClosure(manifest: DesignResourceObservableRuleManifestV2, target: DesignResourceSymbolicHandoffTargetV2, indexes: SymbolicManifestIndexes, resources: Map<string, DesignResource>, contents: Map<string, Buffer>, compilation: DesignResourceSymbolicCompilationSession): void;
+export declare function validateSymbolicCensusClosure(manifest: DesignResourceObservableRuleManifestV2, indexes: SymbolicManifestIndexes): void;

package/dist/lib/design-resource-symbolic-structural-closure-validation.js

@@ -0,0 +1,79 @@
+import { validateDesignResourceLocatedDigest } from "./design-resource-fact-locator-validation.js";
+import { validateSymbolicQuantifier, validateSymbolicRegionWithinReachable, } from "./design-resource-symbolic-region-validation.js";
+import { assertNoUnprovedOmittedAxes } from "./design-resource-symbolic-safety-validation.js";
+import { assertSameSet, invalid, requireKnownRefs, unique, } from "./design-resource-symbolic-validation-support.js";
+export function validateSymbolicSubjectPopulationClosure(manifest, target, indexes, resources, contents, compilation) {
+    validateSubjects(manifest, target.key, indexes);
+    validatePopulations(manifest, target, indexes, resources, contents, compilation);
+}
+export function validateSymbolicCensusClosure(manifest, indexes) {
+    validateCensusClosure(manifest, indexes);
+}
+function validateSubjects(manifest, targetKey, indexes) {
+    const stableKeys = [];
+    for (const subject of manifest.subjects) {
+        if (!subject.stable_keys.length)
+            invalid("v2_subject_stable_keys_required", subject.key);
+        unique(subject.stable_keys, `v2_subject_stable_key_duplicate:${subject.key}`);
+        stableKeys.push(...subject.stable_keys);
+        assertSameSet(subject.target_refs, [targetKey], "v2_subject_target_mismatch", subject.key);
+        requireKnownRefs(subject.census_refs, indexes.census, "v2_subject_census_unknown");
+        if (subject.population_ref &&
+            !indexes.populations.has(subject.population_ref))
+            invalid("v2_subject_population_unknown", subject.key);
+        for (const ref of [
+            subject.parent_ref,
+            subject.instance_of_ref,
+            subject.override_of_ref,
+            subject.family_ref,
+            subject.portal_host_ref,
+        ])
+            if (ref !== null && !indexes.subjects.has(ref))
+                invalid("v2_subject_hierarchy_ref_unknown", `${subject.key}:${ref}`);
+        unique(subject.relation_endpoints.map((item) => item.role), `v2_relation_endpoint_role_duplicate:${subject.key}`);
+        for (const endpoint of subject.relation_endpoints)
+            if (!indexes.subjects.has(endpoint.subject_ref))
+                invalid("v2_relation_endpoint_subject_unknown", `${subject.key}:${endpoint.subject_ref}`);
+        if (subject.kind === "relation" && subject.relation_endpoints.length < 2)
+            invalid("v2_relation_endpoints_incomplete", subject.key);
+        if (subject.presence === "always" && subject.presence_rule_ref !== null)
+            invalid("v2_subject_always_presence_rule_forbidden", subject.key);
+    }
+    unique(stableKeys, "v2_subject_stable_key_ambiguous");
+}
+function validatePopulations(manifest, target, indexes, resources, contents, compilation) {
+    const targetResources = new Set(target.resource_refs);
+    for (const population of manifest.populations) {
+        requireKnownRefs(population.member_subject_refs, indexes.subjects, "v2_population_subject_unknown");
+        assertSameSet(population.member_subject_refs, manifest.subjects
+            .filter((subject) => subject.population_ref === population.key)
+            .map((subject) => subject.key), "v2_population_member_set_mismatch", population.key);
+        if ((population.kind === "static" && population.enumeration !== "complete") ||
+            (population.kind === "dynamic" &&
+                population.enumeration !== "symbolic_partition"))
+            invalid("v2_population_enumeration_mismatch", population.key);
+        validateDesignResourceLocatedDigest(population.universe, resources, contents, `v2.population.${population.key}.universe`);
+        if (!targetResources.has(population.universe.locator.resource_ref))
+            invalid("v2_population_resource_outside_target", population.key);
+        validateSymbolicQuantifier(population.quantifier, population.key);
+        unique(population.exclusions.map((item) => item.key), `v2_population_exclusion_key_duplicate:${population.key}`);
+        for (const exclusion of population.exclusions) {
+            if (!exclusion.basis_refs.length)
+                invalid("v2_population_exclusion_basis_required", exclusion.key);
+            const compiled = compilation.compile(exclusion.region);
+            assertNoUnprovedOmittedAxes(compiled, exclusion.key);
+            validateSymbolicRegionWithinReachable(exclusion.region, manifest.reachable_region, exclusion.key, compilation);
+        }
+    }
+}
+function validateCensusClosure(manifest, indexes) {
+    const rules = new Map(manifest.fact_rules.map((item) => [item.key, item]));
+    for (const row of manifest.inspector.census) {
+        requireKnownRefs(row.fact_refs, rules, "v2_census_rule_unknown");
+        requireKnownRefs(row.source_item_refs, indexes.sourceItems, "v2_census_source_item_unknown");
+        if (!row.source_item_refs.length || !row.basis_refs.length)
+            invalid("v2_census_basis_source_required", row.key);
+        unique(row.fact_refs, `v2_census_rule_ref_duplicate:${row.key}`);
+        assertSameSet(row.fact_refs, (indexes.rulesByCensus.get(row.key) ?? []).map((rule) => rule.key), "v2_census_rule_set_mismatch", row.key);
+    }
+}

package/dist/lib/design-resource-symbolic-validation-support.d.ts

@@ -0,0 +1,29 @@
+import type { DesignResourceObservableRuleManifestV2, DesignResourceSymbolicDependencyEdgeV2, DesignResourceSymbolicFactRuleV2, DesignResourceSymbolicNoninterferenceCertificateV2 } from "./design-resource-symbolic-fact-types.js";
+export declare function designResourceSymbolicRuleKey(rule: Omit<DesignResourceSymbolicFactRuleV2, "key" | "semantic_obligation_refs">, regionSha256: string): string;
+export declare function designResourceSymbolicObligationKey(obligation: Omit<DesignResourceObservableRuleManifestV2["semantic_proof_obligations"][number], "key">): string;
+export declare function designResourceSymbolicDependencyEdge(axisRef: string, factRuleRef: string): DesignResourceSymbolicDependencyEdgeV2;
+export declare function designResourceSymbolicCertificateKey(certificate: Omit<DesignResourceSymbolicNoninterferenceCertificateV2, "key">): string;
+export declare function designResourceSymbolicNoninterferenceProofDigest(proof: DesignResourceSymbolicNoninterferenceCertificateV2["source_noninterference_proof"]): string | null;
+export declare function designResourceSymbolicCombinedRuleDigest(ruleProjections: Array<{
+    rule: {
+        key: string;
+    };
+    compiled_region: {
+        canonical_sha256: string;
+    };
+}>): string;
+export declare function omitRuleIdentityFields(rule: DesignResourceSymbolicFactRuleV2): Omit<DesignResourceSymbolicFactRuleV2, "key" | "semantic_obligation_refs">;
+export declare function omitKey<T extends {
+    key: string;
+}>(value: T): Omit<T, "key">;
+export declare function requireExactRefs<T>(refs: string[], values: Map<string, T>, code: string): void;
+export declare function requireKnownRefs(refs: string[], values: ReadonlyMap<string, unknown> | ReadonlySet<string>, code: string): void;
+export declare function unique(values: string[], code: string): void;
+export declare function assertSameSet(actual: string[], expected: string[], code: string, detail: string): void;
+export declare function assertCanonicalSet<T extends {
+    key: string;
+}>(actual: T[], expected: T[], code: string): void;
+export declare function stableJson(value: unknown): string;
+export declare function sha256(value: string): string;
+export declare function compareText(left: string, right: string): number;
+export declare function invalid(code: string, detail: string): never;

package/dist/lib/design-resource-symbolic-validation-support.js

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+import { invalidDesignResourceHandoff } from "./design-resource-handoff-validation-primitives.js";
+const ALL_EFFECTS = [
+    "disposition",
+    "expected_semantics",
+    "proof_denotation",
+];
+export function designResourceSymbolicRuleKey(rule, regionSha256) {
+    return `rule.${sha256(stableJson({
+        subject_or_relation_ref: rule.subject_or_relation_ref,
+        target_ref: rule.target_ref,
+        property_ref: rule.property_ref,
+        population_ref: rule.population_ref,
+        quantifier: rule.quantifier,
+        region_sha256: regionSha256,
+        expected: rule.expected,
+        value_kind: rule.value_kind,
+        provenance_ref: rule.provenance_ref,
+        observation_scope: rule.observation_scope,
+        observation_sensitivity: rule.observation_sensitivity,
+        lineage: rule.lineage,
+        evidence_refs: [...rule.evidence_refs].sort(compareText),
+        census_refs: [...rule.census_refs].sort(compareText),
+        source_item_refs: [...rule.source_item_refs].sort(compareText),
+    }))}`;
+}
+export function designResourceSymbolicObligationKey(obligation) {
+    return `obligation.${sha256(stableJson(obligation))}`;
+}
+export function designResourceSymbolicDependencyEdge(axisRef, factRuleRef) {
+    const body = {
+        axis_ref: axisRef,
+        fact_rule_ref: factRuleRef,
+        effects: [...ALL_EFFECTS],
+    };
+    return { key: `edge.${sha256(stableJson(body))}`, ...body };
+}
+export function designResourceSymbolicCertificateKey(certificate) {
+    return `certificate.${sha256(stableJson({
+        ...certificate,
+        fact_rule_refs: [...certificate.fact_rule_refs].sort(compareText),
+        omitted_axis_refs: [...certificate.omitted_axis_refs].sort(compareText),
+        dependency_edge_refs: [...certificate.dependency_edge_refs].sort(compareText),
+    }))}`;
+}
+export function designResourceSymbolicNoninterferenceProofDigest(proof) {
+    return proof ? sha256(stableJson(proof)) : null;
+}
+export function designResourceSymbolicCombinedRuleDigest(ruleProjections) {
+    return sha256(stableJson(ruleProjections
+        .map((projection) => ({
+        rule_ref: projection.rule.key,
+        region_sha256: projection.compiled_region.canonical_sha256,
+    }))
+        .sort((left, right) => compareText(left.rule_ref, right.rule_ref))));
+}
+export function omitRuleIdentityFields(rule) {
+    const { key: _key, semantic_obligation_refs: _refs, ...value } = rule;
+    return value;
+}
+export function omitKey(value) {
+    const { key: _key, ...rest } = value;
+    return rest;
+}
+export function requireExactRefs(refs, values, code) {
+    unique(refs, `${code}_duplicate`);
+    requireKnownRefs(refs, values, `${code}_unknown`);
+}
+export function requireKnownRefs(refs, values, code) {
+    for (const ref of refs)
+        if (!values.has(ref))
+            invalid(code, ref);
+}
+export function unique(values, code) {
+    if (new Set(values).size !== values.length)
+        invalid(code, "");
+}
+export function assertSameSet(actual, expected, code, detail) {
+    const left = [...new Set(actual)].sort(compareText);
+    const right = [...new Set(expected)].sort(compareText);
+    if (left.length !== right.length ||
+        left.some((item, index) => item !== right[index]))
+        invalid(code, `${detail}:${left.join(",")}:${right.join(",")}`);
+}
+export function assertCanonicalSet(actual, expected, code) {
+    const left = new Map(actual.map((item) => [item.key, stableJson(item)]));
+    const right = new Map(expected.map((item) => [item.key, stableJson(item)]));
+    assertSameSet([...left.keys()], [...right.keys()], code, "keys");
+    for (const [key, value] of right)
+        if (left.get(key) !== value)
+            invalid(code, key);
+}
+export function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map((item) => stableJson(item)).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => compareText(left, right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)
+            .join(",")}}`;
+    return JSON.stringify(value);
+}
+export function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+export function invalid(code, detail) {
+    invalidDesignResourceHandoff(code, detail);
+}

package/dist/lib/design-resource-v1-capacity-header.d.ts

@@ -0,0 +1,8 @@
+declare const V1_SCHEMA = "design-resource-observable-fact-manifest-v1";
+export declare const DESIGN_RESOURCE_V1_REGENERATION_GUIDANCE = "regenerate_as=design-resource-handoff-v2:fact_model=symbolic_rules_v2";
+export interface DesignResourceV1CapacityHeader {
+    schema_version: typeof V1_SCHEMA;
+    collection_counts: ReadonlyMap<string, number>;
+}
+export declare function parseDesignResourceV1CapacityHeader(prefix: string): DesignResourceV1CapacityHeader;
+export {};