worldvm 0.0.0-stage → 0.1.0

package/dist/_internal/reconciler/evidence-authority.d.ts

@@ -0,0 +1,6 @@
+import type { Cx } from "./model.js";
+/** A declared signer is an additional restriction, never a replacement for assignment. */
+export declare const canAttestEvidence: (cx: Cx, type: string, actor: {
+    readonly id: string;
+    readonly groups: readonly string[];
+}) => boolean;

package/dist/_internal/reconciler/evidence-authority.js

@@ -0,0 +1,70 @@
+import { evaluateIn } from "./evaluation.js";
+/** A declared signer is an additional restriction, never a replacement for assignment. */
+export const canAttestEvidence = (cx, type, actor) => {
+    const evidence = cx.p.evidence.get(type);
+    if (!evidence || evidence.of !== cx.inst?.component)
+        return false;
+    const signer = evidence.attest?.signer;
+    if (signer === undefined || signer === "assignee")
+        return true;
+    const [root, ...path] = signer.split(".");
+    const component = cx.p.components.get(cx.inst.component);
+    let declared = component.inputs.find((f) => f.name === root)?.type;
+    let expr = { k: "var", name: root, at: evidence.at };
+    const unwrap = (type) => {
+        const seen = new Set();
+        while (type !== undefined) {
+            if (Array.isArray(type) && (type[0] === "Option" || type[0] === "Brand")) {
+                type = type[1];
+            }
+            else if (typeof type === "string") {
+                const alias = cx.p.ir.types.find((a) => a.name === type);
+                if (!alias)
+                    return type;
+                if (seen.has(type))
+                    return undefined;
+                seen.add(type);
+                type = alias.type;
+            }
+            else
+                return type;
+        }
+        return undefined;
+    };
+    for (const field of path) {
+        const ref = unwrap(declared);
+        if (!Array.isArray(ref) || ref[0] !== "Id" || typeof ref[1] !== "string")
+            return false;
+        const owner = ref[1];
+        const nested = cx.p.components.get(owner);
+        if (nested) {
+            declared = nested.inputs.find((f) => f.name === field)?.type;
+            expr = { k: "inst", of: expr, field, at: evidence.at };
+            continue;
+        }
+        const role = cx.p.ir.roles.find((r) => r.name === owner);
+        const entity = cx.p.ir.entities.find((e) => e.name === owner);
+        declared = (role ?? entity)?.fields.find((f) => f.name === field)?.type;
+        const attrs = role
+            ? cx.p.bindings.get(`${owner}.${field}`)?.attrs
+            : entity?.fields.some((f) => f.name === field)
+                ? [`${entity.ns}/${field}`]
+                : undefined;
+        if (!attrs?.length)
+            return false;
+        for (const attr of attrs)
+            expr = { k: "attr", of: expr, attr, meta: { path: signer }, at: evidence.at };
+    }
+    const resolved = unwrap(declared);
+    // Unknown, malformed and non-principal declarations cannot grant signing authority.
+    if (resolved !== "Group" &&
+        !(Array.isArray(resolved) &&
+            resolved[0] === "Id" &&
+            (cx.p.ir.roles.some((r) => r.name === resolved[1]) ||
+                cx.p.ir.entities.some((e) => e.name === resolved[1]))))
+        return false;
+    const value = evaluateIn(cx, expr);
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        (resolved === "Group" ? actor.groups.includes(value) : actor.id === value));
+};

package/dist/_internal/reconciler/evidence-history.d.ts

@@ -0,0 +1,5 @@
+import type { Basis, EvidenceRecord } from "./basis.js";
+export declare const evidenceOccurrences: (record: EvidenceRecord) => readonly string[];
+/** A damaged replacement cannot make the version it superseded standing again. */
+export declare const supersededEvidence: (records: readonly EvidenceRecord[]) => ReadonlySet<string>;
+export declare const evidenceSuperseded: (basis: Basis, record: EvidenceRecord) => boolean;

package/dist/_internal/reconciler/evidence-history.js

@@ -0,0 +1,22 @@
+import { timeOrder } from "./instants.js";
+export const evidenceOccurrences = (record) => [...new Set([record.occurrence, ...(record.occurrences ?? [])])].sort();
+/** A damaged replacement cannot make the version it superseded standing again. */
+export const supersededEvidence = (records) => {
+    const ids = new Map(records.map((record, index) => [record.id, { record, index }])), superseded = new Set();
+    records.forEach((record, index) => {
+        const link = record.amendment, previous = link && ids.get(link.previous);
+        if (record.status === "attested" &&
+            link &&
+            previous &&
+            previous.index < index &&
+            link.reason.trim() &&
+            link.reason.length <= 2000 &&
+            record.type === previous.record.type &&
+            timeOrder(previous.record.at, record.at) <= 0 &&
+            JSON.stringify(evidenceOccurrences(record)) ===
+                JSON.stringify(evidenceOccurrences(previous.record)))
+            superseded.add(link.previous);
+    });
+    return superseded;
+};
+export const evidenceSuperseded = (basis, record) => supersededEvidence(basis.evidence(record.occurrence)).has(record.id);

package/dist/_internal/reconciler/evidence-validity.d.ts

@@ -0,0 +1,17 @@
+import type * as IR from "../world-ir/types.generated.js";
+import type { EvidenceRecord } from "./basis.js";
+import { type LocalDate } from "./dates.js";
+import { type Cx, type RenewalResult, type Value } from "./model.js";
+interface Validity {
+    readonly value: Value;
+    readonly record: EvidenceRecord | null;
+    readonly expiresAt: LocalDate | null;
+    readonly unknown: string | null;
+}
+/** Attestation remains historical; validity additionally queries the signed expiry. */
+export declare const readValidity: (cx: Cx, type: string) => Validity;
+/** Validate a specifically referenced signed record without widening an occurrence's evidence. */
+export declare const recordValidity: (cx: Cx, type: string, record: EvidenceRecord) => Validity;
+/** One replacement challenge per deadline, including when the deadline has passed. */
+export declare const readRenewal: (cx: Cx, requirement: IR.Requirement, occurrence: string) => RenewalResult | null;
+export {};

package/dist/_internal/reconciler/evidence-validity.js

@@ -0,0 +1,135 @@
+import { localDateAt, timeOrder } from "./instants.js";
+import { isLocalDate, sensitivePayload } from "../ir-checks/index.js";
+import { addDays, addYears } from "./dates.js";
+import { attested, evaluateIn, isUnknown, vars } from "./evaluation.js";
+import { Unknown, } from "./model.js";
+const fieldValue = (p, type, value, seen = new Set()) => {
+    if (value === undefined || value.trim() === "")
+        return new Unknown("signed field is missing");
+    const payload = sensitivePayload(type);
+    if (payload)
+        return fieldValue(p, payload, value, seen);
+    if (Array.isArray(type) && ["Option", "Brand"].includes(String(type[0])))
+        return fieldValue(p, type[1], value, seen);
+    if (typeof type === "string") {
+        const alias = p.ir.types.find((a) => a.name === type);
+        if (alias) {
+            if (seen.has(type))
+                return new Unknown("cyclic field type");
+            return fieldValue(p, alias.type, value, new Set([...seen, type]));
+        }
+        if (type === "Bool")
+            return value === "true"
+                ? true
+                : value === "false"
+                    ? false
+                    : new Unknown("invalid signed Boolean");
+        if (type === "Int" || type === "Float") {
+            const n = Number(value);
+            return Number.isFinite(n) && (type !== "Int" || Number.isSafeInteger(n))
+                ? n
+                : new Unknown("invalid signed number");
+        }
+    }
+    return value;
+};
+/** Attestation remains historical; validity additionally queries the signed expiry. */
+export const readValidity = (cx, type) => {
+    const trace = cx.trace ?? { steps: [] }, probe = { ...cx, trace };
+    const signed = attested(probe, type), record = signed === true ? (trace.witness?.evidence ?? null) : null;
+    if (!record)
+        return { value: false, record: null, expiresAt: null, unknown: null };
+    return recordValidity({ ...cx, trace }, type, record);
+};
+/** Validate a specifically referenced signed record without widening an occurrence's evidence. */
+export const recordValidity = (cx, type, record) => {
+    const trace = cx.trace ?? { steps: [] };
+    trace.witness ??= {
+        evidence: record,
+        type,
+        via: "evidence",
+        detail: `${cx.p.evidence.get(type).label ?? type} attested by ${record.by} on ${record.at}`,
+    };
+    const probe = { ...cx, trace };
+    const definition = cx.p.evidence.get(type);
+    if (!definition.expires)
+        return { value: true, record, expiresAt: null, unknown: null };
+    const env = vars([
+        // The signing date; a declared field named signed-on overrides it below.
+        ["signed-on", localDateAt(record.at)],
+        ...definition.fields.map((field) => {
+            const raw = Object.hasOwn(record.values, field.name) ? record.values[field.name] : undefined;
+            const value = fieldValue(cx.p, field.type, raw);
+            return [
+                field.name,
+                isUnknown(value) ? new Unknown(`${field.name}: ${value.why}`) : value,
+            ];
+        }),
+    ]);
+    let expiry;
+    try {
+        expiry = evaluateIn({ ...probe, env }, definition.expires);
+    }
+    catch (error) {
+        if (!(error instanceof RangeError))
+            throw error;
+        expiry = new Unknown("expiry is outside the supported calendar");
+    }
+    if (!isLocalDate(expiry)) {
+        const why = `${definition.label ?? type} expiry is unknown: ${isUnknown(expiry) ? expiry.why : "invalid local date"}`;
+        trace.witness = { ...trace.witness, detail: why };
+        return { value: new Unknown(why), record, expiresAt: null, unknown: why };
+    }
+    cx.temporal?.add(expiry);
+    const value = timeOrder(cx.b.now, expiry) < 0;
+    trace.witness = {
+        ...trace.witness,
+        detail: `${trace.witness.detail}; ${value ? "valid until" : "expired on"} ${expiry} (exclusive)`,
+    };
+    return { value, record, expiresAt: expiry, unknown: null };
+};
+/** One replacement challenge per deadline, including when the deadline has passed. */
+export const readRenewal = (cx, requirement, occurrence) => {
+    if (!requirement.renewWithin ||
+        requirement.satisfiedBy.k !== "call" ||
+        requirement.satisfiedBy.fn !== "valid")
+        return null;
+    const ref = requirement.satisfiedBy.args[0];
+    if (ref?.k !== "ref" || ref.kind !== "evidence")
+        return null;
+    const validity = readValidity({ ...cx, occurrence, trace: { steps: [] } }, ref.name);
+    if (!validity.record)
+        return null;
+    const { n, unit } = requirement.renewWithin;
+    if (!validity.expiresAt || !Number.isSafeInteger(n) || n < 0)
+        return {
+            evidence: validity.record.id,
+            expiresAt: validity.expiresAt,
+            availableAt: null,
+            state: "unknown",
+            unknown: validity.unknown ?? "Invalid renewal window",
+        };
+    let availableAt;
+    try {
+        const shifted = unit === "years" ? addYears(validity.expiresAt, -n) : addDays(validity.expiresAt, -n);
+        // Subtracting a nonnegative duration can only overflow below the supported calendar.
+        availableAt = isLocalDate(shifted) ? shifted : "0000-01-01";
+    }
+    catch (error) {
+        if (!(error instanceof RangeError))
+            throw error;
+        availableAt = "0000-01-01";
+    }
+    cx.temporal?.add(availableAt);
+    return {
+        evidence: validity.record.id,
+        expiresAt: validity.expiresAt,
+        availableAt,
+        state: timeOrder(cx.b.now, validity.expiresAt) >= 0
+            ? "expired"
+            : timeOrder(cx.b.now, availableAt) >= 0
+                ? "ready"
+                : "waiting",
+        unknown: null,
+    };
+};

package/dist/_internal/reconciler/fact-validation.d.ts

@@ -0,0 +1,5 @@
+import type { Scalar } from "./basis.js";
+import { type World } from "./memory.js";
+import type { Program } from "./model.js";
+/** Only scalar facts whose declared types can be checked are admitted by the first host. */
+export declare const validFact: (program: Program, world: World, subject: string, attribute: string, value: Scalar | null, now: string) => boolean;

package/dist/_internal/reconciler/fact-validation.js

@@ -0,0 +1,49 @@
+import { sensitivePayload } from "../ir-checks/index.js";
+import { factFileAllowed, fileDigest } from "./files.js";
+import { basis } from "./memory.js";
+/** Only scalar facts whose declared types can be checked are admitted by the first host. */
+export const validFact = (program, world, subject, attribute, value, now) => {
+    const entity = [...program.entities.values()].find((e) => e.ns.split(".")[0] === program.account.package.name && attribute.startsWith(e.ns + "/")), field = entity?.fields.find((f) => f.attr === attribute), existing = basis(world, now).nsOf(subject);
+    if (!field || (existing && existing !== entity.ns))
+        return false;
+    if (value === null)
+        return true;
+    if (!factFileAllowed(program, basis(world, now), subject, attribute, value))
+        return false;
+    const valid = (type, seen = new Set()) => {
+        if (typeof type === "string") {
+            const alias = program.ir.types.find((a) => a.name === type);
+            if (alias && !seen.has(type))
+                return valid(alias.type, new Set([...seen, type]));
+            if (type.startsWith(":"))
+                return value === type.slice(1);
+            if (["String", "Keyword", "Group"].includes(type))
+                return typeof value === "string";
+            if (type === "File")
+                return fileDigest(value);
+            if (type === "Bool")
+                return typeof value === "boolean";
+            if (type === "Int")
+                return typeof value === "number" && Number.isSafeInteger(value);
+            if (type === "Date")
+                return (typeof value === "string" &&
+                    /^\d{4}-\d{2}-\d{2}$/.test(value) &&
+                    Number.isFinite(Date.parse(value)) &&
+                    new Date(value).toISOString().slice(0, 10) === value);
+            if (type === "Instant")
+                return (typeof value === "string" &&
+                    /^\d{4}-\d{2}-\d{2}T/.test(value) &&
+                    Number.isFinite(Date.parse(value)));
+            return false;
+        }
+        const payload = sensitivePayload(type);
+        if (payload)
+            return valid(payload, seen);
+        if (type[0] === "Option" || type[0] === "Brand")
+            return valid(type[1], seen);
+        if (type[0] === "Union")
+            return type.slice(1).some((t) => valid(t, seen));
+        return type[0] === "Id" && typeof value === "string" && value.length > 0;
+    };
+    return valid(field.type);
+};

package/dist/_internal/reconciler/files.d.ts

@@ -0,0 +1,9 @@
+import type * as IR from "../world-ir/types.generated.js";
+import type { Basis, Scalar } from "./basis.js";
+import type { Program, Cx } from "./model.js";
+export { fileDigest } from "../ir-checks/index.js";
+/** Pure metadata admission; neither a digest nor a signed snapshot grants byte access. */
+export declare const fileAllowed: (p: Program, b: Basis, home: string, field: IR.Field, value: Scalar) => boolean;
+export declare const evidenceFilesAllowed: (p: Program, b: Basis, home: string | undefined, type: string, values: Readonly<Record<string, Scalar>>) => boolean;
+export declare const signedFilesAllowed: (cx: Cx, type: string, values: Readonly<Record<string, string>>) => boolean;
+export declare const factFileAllowed: (p: Program, b: Basis, home: string, attribute: string, value: Scalar) => boolean;

package/dist/_internal/reconciler/files.js

@@ -0,0 +1,56 @@
+import { fileDigest, fileShape, sensitivePayload } from "../ir-checks/index.js";
+import { occurrenceHome } from "./homes.js";
+export { fileDigest } from "../ir-checks/index.js";
+/** Pure metadata admission; neither a digest nor a signed snapshot grants byte access. */
+export const fileAllowed = (p, b, home, field, value) => {
+    if (fileShape(field.type, p.ir.types) !== "file")
+        return true;
+    if (!field.file || !fileDigest(value))
+        return false;
+    const record = b.file?.(p.account.name, home, value);
+    return (!!record &&
+        record.scan === "clean" &&
+        record.redacted === false &&
+        Number.isSafeInteger(record.size) &&
+        record.size >= 0 &&
+        record.size <= field.file.maxBytes &&
+        field.file.accept.includes(record.mediaType));
+};
+const optionalFile = (p, type, seen = new Set()) => {
+    if (Array.isArray(type)) {
+        const payload = sensitivePayload(type);
+        return payload
+            ? optionalFile(p, payload, seen)
+            : type[0] === "Option" || (type[0] === "Brand" && optionalFile(p, type[1], seen));
+    }
+    if (typeof type !== "string" || seen.has(type))
+        return false;
+    const alias = p.ir.types.find((a) => a.name === type);
+    return !!alias && optionalFile(p, alias.type, new Set([...seen, type]));
+};
+export const evidenceFilesAllowed = (p, b, home, type, values) => (p.evidence.get(type)?.fields ?? []).every((field) => fileShape(field.type, p.ir.types) !== "file" ||
+    (values[field.name] === undefined || values[field.name] === ""
+        ? optionalFile(p, field.type)
+        : !!home && fileAllowed(p, b, home, field, values[field.name])));
+export const signedFilesAllowed = (cx, type, values) => {
+    if (!(cx.p.evidence.get(type)?.fields ?? []).some((f) => fileShape(f.type, cx.p.ir.types) === "file"))
+        return true;
+    const home = cx.inst && cx.k ? occurrenceHome(cx.p, cx.inst, cx.k.instances)?.id : undefined;
+    return evidenceFilesAllowed(cx.p, cx.b, home, type, values);
+};
+export const factFileAllowed = (p, b, home, attribute, value) => {
+    const field = p.entities
+        .get(attribute.slice(0, attribute.indexOf("/")))
+        ?.fields.find((f) => f.attr === attribute);
+    if (field && !fileAllowed(p, b, home, field, value))
+        return false;
+    for (const role of p.ir.roles)
+        for (const rf of role.fields) {
+            const binding = p.bindings.get(`${role.name}.${rf.name}`);
+            if (binding?.attrs.length === 1 &&
+                binding.attrs[0] === attribute &&
+                !fileAllowed(p, b, home, rf, value))
+                return false;
+        }
+    return true;
+};

package/dist/_internal/reconciler/graph.d.ts

@@ -0,0 +1,40 @@
+import { type EvaluationContext } from "./context.js";
+import { ReadSet } from "./dependencies.js";
+import type * as IR from "../world-ir/types.generated.js";
+import { type ChildSlot, type Cx, type Instance, type Program, type Truth, Unknown, type Value } from "./model.js";
+export declare const rankCache: WeakMap<Program, ReadonlyMap<string, number> | null>;
+export declare const componentRanks: (p: Program) => ReadonlyMap<string, number> | null;
+export declare const make: (ctx: EvaluationContext, p: Program, component: string, key: readonly Value[], inputs: ReadonlyMap<string, Value>, cycle: number, parameters?: ReadonlyMap<string, Value>) => Instance;
+export declare const truthOf: (cx: Cx, e: IR.Expr | undefined) => {
+    truth: Truth;
+    reason: string;
+};
+export declare const bindKey: (ctx: EvaluationContext, cx: Cx, slot: IR.Slot, child: IR.Component) => {
+    inputs: Map<string, Value>;
+    key: (string | number | boolean | Unknown | readonly Value[] | import("./model.js").InstRef | import("./model.js").MachineRef | import("./model.js").Duration | import("./model.js").Ref | import("./model.js").Closure)[];
+};
+export declare const unresolvedKey: (parent: Instance, slot: ChildSlot, key: readonly Value[]) => boolean;
+export declare const cyclesOf: (ctx: EvaluationContext, p: Program, component: IR.Component, attached: readonly string[], inputs: ReadonlyMap<string, Value>, reads: ReadSet, parameters?: ReadonlyMap<string, Value>) => (readonly string[])[];
+export declare const slotFor: (slot: IR.Slot, applies: {
+    truth: Truth;
+    reason: string;
+}) => ChildSlot;
+export declare const membersOf: (group: Group) => readonly string[];
+interface Group {
+    id: string;
+    p: Program;
+    component: IR.Component;
+    key: readonly Value[];
+    inputs: ReadonlyMap<string, Value>;
+    members: Set<string>;
+    links: Array<{
+        parent: Instance;
+        slot: ChildSlot;
+        members: readonly string[];
+        with?: IR.Slot["with"];
+    }>;
+    resolved: Instance[];
+    root: boolean;
+}
+export declare const buildInstanceGraph: (ctx: EvaluationContext) => void;
+export {};