worldvm 0.0.0-stage → 0.1.0

package/dist/_internal/reconciler/commands.js

@@ -0,0 +1,468 @@
+import { sha256 } from "./sha256.js";
+import { canonicalJson } from "./result-digest.js";
+import { amendmentAction } from "./amendments.js";
+import { resourceMachineScope } from "./resource-generation.js";
+import { signEvidence, signatureInputValid } from "./signatures.js";
+import { evidenceFilesAllowed, factFileAllowed } from "./files.js";
+import { occurrenceHome } from "./homes.js";
+import { instanceContext } from "./evaluation.js";
+import { canAttestEvidence } from "./evidence-authority.js";
+import { reuseKey, reuseDecisionName } from "./reuse.js";
+import { actionTargets, canPerformWork, workItems, workKey } from "./work.js";
+import { permitsConstraints } from "./policies.js";
+import { confirmFacts, refreshDrafts } from "./collection-state.js";
+import { collectionRule, factKey } from "./collection-rules.js";
+import { projectInteractionFields } from "./interaction-fields.js";
+import { priorCycleOperationName, sensitivePayload } from "../ir-checks/index.js";
+import { decide } from "./decide.js";
+import { log } from "./journal.js";
+export { log } from "./journal.js";
+import { admit, canTransition, evaluateFor, evaluateValues, machineState, programFor, Unknown, } from "./reconcile.js";
+import { basis } from "./memory.js";
+/** Shared field and rule checks for signed submissions. */
+export const validEvidence = (p, type, values, now) => {
+    const evidence = p.evidence.get(type);
+    if (!evidence)
+        return false;
+    const optional = (t, seen = new Set()) => {
+        if (Array.isArray(t)) {
+            const payload = sensitivePayload(t);
+            return payload
+                ? optional(payload, seen)
+                : t[0] === "Option" || (t[0] === "Brand" && optional(t[1], seen));
+        }
+        if (typeof t !== "string" || seen.has(t))
+            return false;
+        const alias = p.ir.types.find((a) => a.name === t);
+        if (!alias)
+            return false;
+        seen.add(t);
+        return optional(alias.type, seen);
+    };
+    const filled = (name) => values[name] !== undefined && (typeof values[name] !== "string" || values[name].trim() !== "");
+    if (evidence.fields.some((f) => !optional(f.type) && !filled(f.name)))
+        return false;
+    const env = Object.fromEntries(evidence.fields.map((f) => [
+        f.name,
+        filled(f.name) ? values[f.name] : new Unknown(`${f.name} is empty`),
+    ]));
+    return evidence.rules.every((r) => {
+        const when = r.when ? evaluateValues(p, env, now, r.when) : true;
+        if (when === false)
+            return true;
+        return (when === true &&
+            (r.requires.mode === "all" ? r.requires.fields.every(filled) : r.requires.fields.some(filled)));
+    });
+};
+/** Perform an eligible action. Ineligible or repeated work leaves the world unchanged. */
+export const perform = (recon, world, at, request) => performInMode(recon, world, at, request);
+const performInMode = (recon, world, at, request, amendment) => {
+    if (request.signature && (request.unsigned || request.actor?.kind !== "human"))
+        return world;
+    if (request.actor?.kind === "agent" && !request.unsigned)
+        return world;
+    const inst = recon.instances.get(request.instance);
+    const p = programFor(recon, request.instance);
+    const action = recon.results
+        .get(request.instance)
+        ?.actions.find((a) => a.action === request.action);
+    if (!inst || !p || !action || (action.state !== "eligible" && action.state !== "dispatched"))
+        return world;
+    if ((request.actor?.kind === "service" || request.actor?.kind === "connector") &&
+        (action.kind !== "connector" ||
+            request.actor.id !== action.assigneeId ||
+            request.actor.id !== request.by))
+        return world;
+    if (request.signature && action.kind !== "interaction")
+        return world;
+    const decisionActor = request.actor?.kind === "human" || request.actor?.kind === "agent" ? request.actor : undefined;
+    const actor = decisionActor ?? { id: request.by, kind: "human", groups: [] };
+    if (action.kind === "interaction" && !canPerformWork(action, actor, request.by))
+        return world;
+    if (action.authorityConstraints &&
+        ((request.actor?.id !== undefined && request.actor.id !== request.by) ||
+            !permitsConstraints(action.authorityConstraints, {
+                id: request.by,
+                groups: request.actor?.groups ?? [],
+            })))
+        return world;
+    const target = recon.results
+        .get(request.instance)
+        .requirements.find((r) => r.name === action.advances);
+    const names = actionTargets(action), multi = names.length > 1;
+    const identity = workKey(p.account.name, action.idempotencyKey);
+    if (multi) {
+        if (workItems(recon).find((w) => w.key === identity)?.state === "conflict")
+            return world;
+        if (action.kind === "interaction") {
+            if (!amendment &&
+                world.evidence.some((e) => e.workKey === identity && e.status === "attested"))
+                return world;
+        }
+    }
+    if (action.kind === "decision") {
+        const choice = request.decision ?? "accepted";
+        const reuse = p.components
+            .get(inst.component)
+            .requirements.find((r) => r.name === action.advances)?.reuse;
+        if (reuse)
+            return decide(recon, world, at, {
+                id: request.id ??
+                    `reuse:${inst.id}:${action.advances}:${choice}:${world.decisions?.length ?? 0}`,
+                instance: inst.id,
+                decision: reuseDecisionName(inst.component, action.advances, choice),
+                actor: decisionActor ?? { id: request.by, kind: "human", groups: [] },
+                ...(request.reason === undefined ? {} : { reason: request.reason }),
+                ...(request.revoke ? { revoke: request.revoke } : {}),
+            }).world;
+        const result = decide(recon, world, at, {
+            id: request.id ??
+                `prior:${inst.id}:${action.advances}:${choice}:${world.decisions?.length ?? 0}`,
+            instance: inst.id,
+            decision: priorCycleOperationName(p.ir.decisions ?? [], inst.component, action.advances, choice),
+            actor: decisionActor ?? { id: request.by, kind: "human", groups: [] },
+            ...(request.reason === undefined ? {} : { reason: request.reason }),
+            ...(request.revoke ? { revoke: request.revoke } : {}),
+        });
+        if (!result.accepted || result.world === world)
+            return result.world;
+        const title = `${request.revoke ? "Revoked" : choice === "accepted" ? "Accepted" : "Declined"} the prior cycle's ${target.label}`;
+        return {
+            ...result.world,
+            acceptances: result.record?.kind === "grant"
+                ? [
+                    ...result.world.acceptances,
+                    {
+                        instance: inst.id,
+                        requirement: action.advances,
+                        from: inst.prior ?? "",
+                        decision: choice,
+                        by: result.record.by,
+                        at,
+                    },
+                ]
+                : result.world.acceptances,
+            journal: result.world.journal.map((entry, i) => i === result.world.journal.length - 1 ? { ...entry, title } : entry),
+        };
+    }
+    if (action.kind === "connector") {
+        // Idempotent: a retried reconcile never dispatches the same work twice.
+        if (world.dispatches.some((d) => d.key === action.idempotencyKey))
+            return world;
+        let next = log({
+            ...world,
+            dispatches: [
+                ...world.dispatches,
+                {
+                    key: action.idempotencyKey,
+                    action: action.action,
+                    occurrence: target.occurrence,
+                    assignee: action.assignee,
+                    at,
+                },
+            ],
+        }, {
+            at,
+            actor: "worldvm:runtime",
+            title: `Dispatched ${action.via}`,
+            context: `idempotency key ${action.idempotencyKey}`,
+            changes: [],
+        });
+        if (request.connectorAcknowledgement === "deferred")
+            return next;
+        // Simulated acknowledgement: the connector opens the machines it owns at their initial state.
+        const connector = p.connectors.get(action.via.split("/")[0]);
+        for (const use of p.components.get(inst.component).machines) {
+            const protocol = p.machines.get(use.protocol);
+            if (protocol && connector?.owns.includes(protocol.name))
+                next = signal(recon, next, at, {
+                    instance: inst.id,
+                    machine: use.name,
+                    state: protocol.initial,
+                    by: `connector:${connector.name}`,
+                });
+        }
+        return next;
+    }
+    const interaction = p.interactions.get(action.interaction ?? "");
+    if (!interaction)
+        return world;
+    const supplied = request.values ?? {};
+    const inputBasis = basis(world, at);
+    const fields = projectInteractionFields(p, interaction, (expr) => evaluateFor(recon, inputBasis, at, inst.id, expr, target.occurrence));
+    const values = { ...supplied };
+    for (const fixed of interaction.fixes ?? []) {
+        if (supplied[fixed.field] !== undefined && supplied[fixed.field] !== fixed.value)
+            return world;
+        values[fixed.field] = fixed.value;
+    }
+    for (const field of fields) {
+        const proposed = supplied[field.field];
+        if (field.mode === "read-only" &&
+            proposed !== undefined &&
+            (field.value === null || String(proposed) !== String(field.value)))
+            return world;
+        if (field.value !== null &&
+            (proposed === undefined ||
+                field.mode === "read-only" ||
+                String(proposed) === String(field.value)))
+            values[field.field] = field.value;
+    }
+    const type = interaction.produces;
+    if (!request.unsigned &&
+        !canAttestEvidence(instanceContext(recon, inputBasis, inst), type, actor))
+        return world;
+    const audit = p.evidence.get(type)?.attest?.audit;
+    const method = p.evidence.get(type)?.attest?.method;
+    if (request.signature && !audit)
+        return world;
+    if (!request.unsigned &&
+        audit &&
+        (request.actor?.kind !== "human" ||
+            request.actor.id !== request.by ||
+            action.assigneeId == null ||
+            (action.assigneeKind === "group"
+                ? !request.actor.groups.includes(action.assigneeId)
+                : request.actor.id !== action.assigneeId) ||
+            !canPerformWork(action, request.actor, request.by) ||
+            !signatureInputValid(request.signature, method)))
+        return world;
+    const requirement = p.components
+        .get(inst.component)
+        .requirements.find((r) => r.name === action.advances);
+    const scope = !request.unsigned && requirement.reuse
+        ? reuseKey(instanceContext(recon, inputBasis, inst), requirement)
+        : null;
+    if (!request.unsigned &&
+        (!validEvidence(p, type, values, at) ||
+            !evidenceFilesAllowed(p, inputBasis, occurrenceHome(p, inst, recon.instances)?.id, type, values)))
+        return world;
+    if (!request.unsigned)
+        for (const binding of interaction.binds) {
+            if (binding.target?.k !== "attr" || values[binding.field] === undefined)
+                continue;
+            const entity = evaluateFor(recon, inputBasis, at, inst.id, binding.target.of);
+            if (typeof entity === "string" &&
+                !factFileAllowed(p, inputBasis, entity, binding.target.attr, values[binding.field]))
+                return world;
+        }
+    const record = {
+        ...(amendment ? { amendment } : {}),
+        id: `ev-${world.evidence.length + 1}`,
+        type,
+        ...(request.unsigned && interaction.binds.length ? { interaction: interaction.name } : {}),
+        occurrence: target.occurrence,
+        ...(scope ? { reuseScopes: [scope] } : {}),
+        ...(multi
+            ? {
+                occurrences: names.map((name) => recon.results.get(inst.id).requirements.find((r) => r.name === name).occurrence),
+                workKey: identity,
+            }
+            : {}),
+        status: request.unsigned ? "submitted" : "attested",
+        at,
+        by: request.by,
+        values: Object.fromEntries(Object.entries(values).map(([key, v]) => [key, String(v)])),
+    };
+    const signedRecord = audit && request.signature ? signEvidence(record, audit, request.signature) : record;
+    let next = log({
+        ...world,
+        evidence: [...world.evidence, signedRecord],
+    }, {
+        at,
+        actor: request.by,
+        title: `${amendment ? "Amended and re-attested" : request.unsigned ? "Submitted (unsigned)" : "Attested"} ${type}`,
+        context: target.occurrence,
+        changes: [
+            {
+                label: `${type}.status`,
+                before: "—",
+                after: request.unsigned ? "submitted" : "attested",
+            },
+            ...(amendment
+                ? [{ label: `${type}.correction`, before: amendment.previous, after: amendment.reason }]
+                : []),
+            ...Object.entries(values).map(([label, after]) => ({
+                label: `${type}.${label}`,
+                before: "—",
+                after: String(after),
+            })),
+        ],
+    });
+    if (request.unsigned)
+        return next;
+    // Accepted evidence writes through direct role fields; reference-path bindings are read-only.
+    const changes = [];
+    const changedFacts = new Set();
+    for (const proposal of interaction.binds) {
+        if (!proposal.target)
+            continue;
+        const value = values[proposal.field];
+        if (value === undefined || value === "" || proposal.target.k !== "attr")
+            continue;
+        const via = proposal.target.meta.via;
+        if (via && (p.bindings.get(via)?.attrs.length ?? 0) > 1)
+            continue;
+        const entity = evaluateFor(recon, basis(next, at), at, inst.id, proposal.target.of);
+        if (typeof entity !== "string")
+            continue;
+        const before = basis(next, at).fact(entity, proposal.target.attr)?.v;
+        if (before === value)
+            continue;
+        next = {
+            ...next,
+            facts: [...next.facts, { e: entity, a: proposal.target.attr, v: value, at, by: request.by }],
+        };
+        changedFacts.add(factKey(entity, proposal.target.attr));
+        changes.push({
+            label: `${proposal.target.attr} (${proposal.target.meta.via ?? proposal.target.meta.path})`,
+            before: before === undefined ? "—" : String(before),
+            after: String(value),
+        });
+    }
+    next = refreshDrafts(recon, next, at, changedFacts);
+    const confirmed = interaction.binds.flatMap((binding) => {
+        const expr = binding.from ?? binding.target;
+        if (expr?.k !== "attr" || !collectionRule(p, expr.attr))
+            return [];
+        const entity = evaluateFor(recon, basis(next, at), at, inst.id, expr.of), value = values[binding.field];
+        return typeof entity === "string" &&
+            value !== undefined &&
+            basis(next, at).fact(entity, expr.attr)?.v === value
+            ? [{ entity, attribute: expr.attr, value }]
+            : [];
+    });
+    next = confirmFacts(next, at, request.by, confirmed);
+    return changes.length
+        ? log(next, {
+            at,
+            actor: request.by,
+            title: "Proposed facts accepted",
+            context: `${interaction.name} :binds`,
+            changes,
+        })
+        : next;
+};
+/** An inbound signal moves a machine only along a declared transition. */
+export const signal = (recon, world, at, request) => {
+    const inst = recon.instances.get(request.instance);
+    const p = programFor(recon, request.instance);
+    if (!inst || !p)
+        return world;
+    const b = basis(world, at);
+    const scope = resourceMachineScope(p, b, inst, request.machine);
+    const before = machineState(b, inst.id, request.machine, scope);
+    if (!canTransition(p, b, inst, request.machine, request.state))
+        return log(world, {
+            at,
+            actor: request.by,
+            title: `Rejected signal: ${request.machine} cannot move from ${before ?? "nothing"} to ${request.state}`,
+            context: inst.id,
+            changes: [],
+        });
+    const protocol = p.machines.get(p.components.get(inst.component).machines.find((m) => m.name === request.machine).protocol);
+    const label = (state) => state === null ? "—" : (protocol.states.find((s) => s.name === state)?.label ?? state);
+    return log({
+        ...world,
+        signals: [
+            ...world.signals,
+            {
+                instance: inst.id,
+                machine: request.machine,
+                state: request.state,
+                at,
+                by: request.by,
+                ...(scope ?? {}),
+            },
+        ],
+    }, {
+        at,
+        actor: request.by,
+        title: `Signal ${protocol.signal}: ${label(request.state)}`,
+        context: inst.id,
+        changes: [
+            { label: `${request.machine}.state`, before: label(before), after: label(request.state) },
+        ],
+    });
+};
+/** A command is admitted only if no declared invariant forbids it now. */
+export const command = (recon, world, at, request) => {
+    const snapshot = basis(world, at);
+    const violations = [...admit(recon, snapshot, at, request)];
+    for (const fact of request.facts)
+        for (const p of recon.programs) {
+            if (fact.v !== null && !factFileAllowed(p, snapshot, fact.e, fact.a, fact.v))
+                violations.push({
+                    instance: fact.e,
+                    invariant: "E_FILE_REFERENCE",
+                    reason: "File fact requires clean, non-redacted metadata within every declared field policy.",
+                    at: p.account.at,
+                });
+        }
+    if (violations.length)
+        return {
+            violations,
+            world: log(world, {
+                at,
+                actor: request.by,
+                title: `Rejected: ${request.title}`,
+                context: violations.map((v) => `invariant ${v.reason}`).join("; "),
+                changes: [],
+            }),
+        };
+    const b = basis(world, at);
+    return {
+        violations,
+        world: log(refreshDrafts(recon, {
+            ...world,
+            facts: [...world.facts, ...request.facts.map((f) => ({ ...f, at, by: request.by }))],
+        }, at, new Set(request.facts.map((f) => factKey(f.e, f.a)))), {
+            at,
+            actor: request.by,
+            title: request.title,
+            context: "admitted: no invariant forbids it",
+            changes: request.facts.map((f) => ({
+                label: f.a,
+                before: String(b.fact(f.e, f.a)?.v ?? "—"),
+                after: f.v === null ? "—" : String(f.v),
+            })),
+        }),
+    };
+};
+/** Only this checked path can pass correction metadata into the shared writer. */
+export const amendEvidence = (recon, world, at, request) => {
+    const who = request.actor, input = request.amend;
+    if (!who ||
+        who.kind !== "human" ||
+        who.id !== request.by ||
+        request.unsigned ||
+        !input.previous.trim() ||
+        !input.reason.trim() ||
+        input.reason.length > 2000)
+        return world;
+    const prepared = amendmentAction(recon, world, at, request.instance, request.action, input.previous);
+    if (!prepared.action)
+        return world;
+    const action = prepared.action;
+    if (!action.assigneeId ||
+        (action.assigneeKind === "group"
+            ? !who.groups.includes(action.assigneeId)
+            : who.id !== action.assigneeId))
+        return world;
+    const inst = recon.instances.get(request.instance), p = programFor(recon, inst.id), home = occurrenceHome(p, inst, recon.instances);
+    if (!home ||
+        [request.action, "perform"].some((kind) => admit(recon, basis(world, at), at, { kind, subject: home.id }).length))
+        return world;
+    const current = recon.results.get(inst.id);
+    const amended = {
+        ...recon,
+        results: new Map(recon.results).set(inst.id, {
+            ...current,
+            actions: [...current.actions.filter((a) => a.action !== request.action), action],
+        }),
+    };
+    return performInMode(amended, world, at, request, {
+        ...input,
+        previousDigest: sha256(canonicalJson(prepared.record)),
+    });
+};

package/dist/_internal/reconciler/component-operations.d.ts

@@ -0,0 +1,48 @@
+import type * as IR from "../world-ir/types.generated.js";
+import type { Scalar } from "./basis.js";
+import type { TimePoint } from "./instants.js";
+import { type WorkActor } from "./commands.js";
+import { type World } from "./memory.js";
+import type { WorldReconciliation, ActionResult } from "./model.js";
+export type OperationTarget = {
+    readonly instance: string;
+} | {
+    readonly parent: string;
+    readonly slot: string;
+    readonly instance?: string;
+};
+export interface OperationRequest {
+    readonly id: string;
+    readonly account: string;
+    readonly target: OperationTarget;
+    readonly operation: string;
+    readonly actor: WorkActor;
+    readonly values?: Readonly<Record<string, Scalar>>;
+    readonly unsigned?: boolean;
+    readonly signature?: IR.SignatureInput;
+    readonly amend?: IR.AmendmentInput;
+    readonly reason?: Scalar | null;
+    readonly revoke?: string;
+}
+export interface OperationResult {
+    readonly accepted: boolean;
+    readonly codes: readonly string[];
+    readonly world: World;
+    readonly instance?: string;
+}
+export interface PublicOperation {
+    readonly name: string;
+    readonly kind: "action" | "decision";
+    readonly state: ActionResult["state"] | "complete" | "not-applicable" | "decision";
+    readonly workKey?: string;
+    readonly amendable?: boolean;
+    readonly at: IR.Span;
+}
+/** Structural projection only; command admission still checks the trusted actor and current work. */
+export declare const operationsFor: (recon: WorldReconciliation, account: string, target: OperationTarget) => {
+    readonly instance: string | null;
+    readonly operations: readonly PublicOperation[];
+    readonly codes: readonly string[];
+};
+/** The host supplies a current reconciliation/basis pair and verified identity; M16 serializes it. */
+export declare const invokeOperation: (recon: WorldReconciliation, world: World, now: TimePoint, request: OperationRequest) => OperationResult;