runtime

package
v0.0.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 27, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var Builtins = map[string]Builtin{
	"all":            BuiltinAll,
	"any":            BuiltinAny,
	"as_list":        BuiltinAsList,
	"count":          BuiltinCount,
	"distinct":       BuiltinDistinct,
	"error":          BuiltInError,
	"filter":         BuiltinFilter,
	"first":          BuiltinFirst,
	"flatten":        BuiltinFlatten,
	"flatten_deep":   BuiltinFlattenDeep,
	"collect":        BuiltinCollect,
	"merge":          BuiltinMerge,
	"normalise_list": BuiltinNormaliseList,
	"reduce":         BuiltinReduce,
}

Builtins is the registry of global built-in functions.

View Source 
var ErrIllegalFactInjection = fmt.Errorf("fact injection not allowed in child context")
View Source 
var (
	ErrTypeRef = errors.New("typeref error")
)

Functions

func BuiltInError 

func BuiltInError(_ context.Context, _ *CallSite, args ...box.Value) (box.Value, error)

BuiltInError short-circuits execution with a formatted error.

func BuiltinAll added in v0.0.3 

func BuiltinAll(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

BuiltinAll reports whether every element satisfies the predicate callable.

func BuiltinAny added in v0.0.3 

func BuiltinAny(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

BuiltinAny reports whether any element satisfies the predicate callable.

func BuiltinAsList 

func BuiltinAsList(_ context.Context, _ *CallSite, args ...box.Value) (box.Value, error)

BuiltinAsList normalizes one-or-many inputs to a list.

func BuiltinCollect added in v0.0.3 

func BuiltinCollect(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

BuiltinCollect maps each list element through the callable.

func BuiltinCount 

func BuiltinCount(_ context.Context, _ *CallSite, args ...box.Value) (box.Value, error)

BuiltinCount returns the length of a list, string, or dict.

func BuiltinDistinct added in v0.0.3 

func BuiltinDistinct(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

BuiltinDistinct removes duplicates: either by scalar identity of elements, or by a key selector.

func BuiltinFilter added in v0.0.3 

func BuiltinFilter(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

BuiltinFilter returns items for which the predicate is true.

func BuiltinFirst added in v0.0.3 

func BuiltinFirst(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

BuiltinFirst returns the first item satisfying the predicate, or undefined.

func BuiltinFlatten 

func BuiltinFlatten(_ context.Context, _ *CallSite, args ...box.Value) (box.Value, error)

BuiltinFlatten flattens nested lists to a controlled depth.

func BuiltinFlattenDeep 

func BuiltinFlattenDeep(_ context.Context, _ *CallSite, args ...box.Value) (box.Value, error)

BuiltinFlattenDeep recursively flattens nested lists.

func BuiltinMerge 

func BuiltinMerge(_ context.Context, _ *CallSite, args ...box.Value) (box.Value, error)

BuiltinMerge merges two dict values into a new dict recursively.

func BuiltinNormaliseList 

func BuiltinNormaliseList(_ context.Context, _ *CallSite, args ...box.Value) (box.Value, error)

BuiltinNormaliseList normalizes messy list inputs with one level of nesting.

func BuiltinReduce added in v0.0.3 

func BuiltinReduce(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

BuiltinReduce folds the list with an initial accumulator using the reducer callable.

func ErrConstraintFailed 

func ErrConstraintFailed(pos tokens.Range, c *ast.TypeRefConstraint, err error) error

func ErrUnknownConstraint 

func ErrUnknownConstraint(c *ast.TypeRefConstraint) error

func ImportDecision 

func ImportDecision(ctx context.Context, exec *executorImpl, ec *ExecutionContext, p *index.Policy, t *ast.ImportClause) (box.Value, *trace.Node, error)

ImportDecision resolves an ImportClause with `with` facts for sandboxed execution, and returns (decision-envelope, node, error).

func IsConstraintFailed 

func IsConstraintFailed(err error) bool

func IsUnknownConstraint 

func IsUnknownConstraint(err error) bool

Types

type Builtin 

type Builtin func(ctx context.Context, site *CallSite, args ...box.Value) (box.Value, error)

Builtin is a built-in function taking evaluated boxed arguments.

type CallSite added in v0.0.3 

type CallSite struct {
	EC     *ExecutionContext
	Exec   *executorImpl
	Policy *index.Policy
}

CallSite is the evaluation frame passed to every builtin so higher-order builtins can invoke lambdas with the correct policy and executor.

type Callable added in v0.0.3 

type Callable interface {
	Arity() int
	Invoke(ctx context.Context, site *CallSite, args []box.Value) (box.Value, error)
}

Callable is a boxed runtime callable (lambda closure). v1 capture keeps a reference to the defining ExecutionContext so late-bound lexical lookups use the live parent chain, not a snapshot at creation time.

type Decision 

type Decision struct {
	State trinary.Value `json:"state"`
	Value box.Value     `json:"value"`
}

func DecisionOf 

func DecisionOf(val box.Value) *Decision

Behaviour: - nil → Unknown - *Decision → as-is - trinary.Value → Decision with the same state - anything else → trinary.From(val)

func (Decision) ToTrinary 

func (d Decision) ToTrinary() trinary.Value

type DecisionAttachments 

type DecisionAttachments map[string]box.Value

type ExecutionContext 

type ExecutionContext struct {
	// contains filtered or unexported fields
}

ExecutionContext holds ephemeral state for a single rule execution. It owns an arena and is disposed immediately after the run.

func NewExecutionContext 

func NewExecutionContext(policy *index.Policy, executor Executor) *ExecutionContext

func (*ExecutionContext) AttachedChildContext 

func (ec *ExecutionContext) AttachedChildContext() *ExecutionContext

AttachedChildContext creates a child context. All lookups will be performed in the child context first, then the parent context.

func (*ExecutionContext) BindModule 

func (ec *ExecutionContext) BindModule(alias string, m *ModuleBinding)

func (*ExecutionContext) CreatedAt 

func (ec *ExecutionContext) CreatedAt() time.Time

func (*ExecutionContext) Dispose 

func (ec *ExecutionContext) Dispose()

Dispose frees the arena immediately. Do NOT reuse an EC after Dispose.

func (*ExecutionContext) GetFact 

func (ec *ExecutionContext) GetFact(name string) (box.Value, bool)

func (*ExecutionContext) GetLet 

func (ec *ExecutionContext) GetLet(name string) (*ast.VarDeclaration, bool)

func (*ExecutionContext) GetLocal 

func (ec *ExecutionContext) GetLocal(name string) (box.Value, bool)

GetLocal gets a local value from the current context if present - otherwise the parent context is checked.

func (*ExecutionContext) GetRefStack 

func (ec *ExecutionContext) GetRefStack() []string

GetCallStack returns a copy of the current reference stack

func (*ExecutionContext) InjectFact 

func (ec *ExecutionContext) InjectFact(ctx context.Context, name string, v box.Value, isDefault bool, typeRef ast.TypeRef) error

Inject facts into the current context. It is illegal to inject facts into a child context.

func (*ExecutionContext) InjectLet 

func (ec *ExecutionContext) InjectLet(name string, v *ast.VarDeclaration) error

Inject local let declarations into the current context. Let declarations are always injected into the current context - NEVER in the parent.

func (*ExecutionContext) IsFactInjected 

func (ec *ExecutionContext) IsFactInjected(name string) bool

func (*ExecutionContext) IsLetInjected 

func (ec *ExecutionContext) IsLetInjected(name string) bool

func (*ExecutionContext) Module 

func (ec *ExecutionContext) Module(alias string) (binding *ModuleBinding, found bool)

func (*ExecutionContext) PopRefStack 

func (ec *ExecutionContext) PopRefStack()

PopRefStack removes the last item from the call stack

func (*ExecutionContext) PushRefStack 

func (ec *ExecutionContext) PushRefStack(uniqueID string) error

PushRefStack adds an item to the reference stack for cycle detection

func (*ExecutionContext) SetLocal 

func (ec *ExecutionContext) SetLocal(name string, value box.Value, force bool)

SetLocal sets a local value in the current context if and only if the current context supplied an identifier with that name.

type Executor 

type Executor interface {
	ExecPolicy(ctx context.Context, namespace, policy string, facts map[string]any) ([]*ExecutorOutput, error)
	ExecRule(ctx context.Context, namespace, policy, rule string, facts map[string]any) (*ExecutorOutput, error)
	Index() *index.Index
}

func NewExecutor 

func NewExecutor(idx *index.Index, opts ...NewExecutorOption) (Executor, error)

NewExecutor builds an Executor with built-in @sentra/* modules registered.

type ExecutorOutput 

type ExecutorOutput struct {
	PolicyName  string              `json:"policy"`
	Namespace   string              `json:"namespace"`
	RuleName    string              `json:"rule"`
	Decision    *Decision           `json:"decision"`
	Attachments DecisionAttachments `json:"attachments"`
	RuleNode    *trace.Node         `json:"trace"`
}

func (*ExecutorOutput) ToTrinary 

func (e *ExecutorOutput) ToTrinary() trinary.Value

type JSInstance 

type JSInstance struct {
	// contains filtered or unexported fields
}

JSInstance is a context-aware binding for an alias VM.

type ModuleBinding 

type ModuleBinding struct {
	CanonicalKey string
	Alias        string
	// contains filtered or unexported fields
}

func (ModuleBinding) Call 

func (m ModuleBinding) Call(ctx context.Context, ec *ExecutionContext, fn string, args ...any) (any, error)

type NewExecutorOption 

type NewExecutorOption func(*executorImpl)

func WithCallMemoizeCacheSize 

func WithCallMemoizeCacheSize(size int) NewExecutorOption

The number of Megabytes to allocate for the call memoize cache

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.