Fortis Agent mode

Human mode: The core runtime

The core library#

Both modes. Generated by conformance/tools/libref.py from the declarations of library/fortis; do not edit. Source of truth: LR 15 for the inventory, and each declaration's own contract.

Preview: the core runtime inventory (LR 15) arrives in v0.4.

Every public declaration of the seven core modules (LR 15): each exported declaration, every member of an exported interface (whose members share its visibility, LR 4.4) and every variant of an exported enum, with its signature as the library declares it and the contract its documentation comment states. The check counts these against the module sources independently of this page. A trusted operation is implemented by the toolchain, and its comment is its review record (LR 11.3). fortis.prelude is imported into every module; the other modules need an import (LR 4.3). What is not listed here does not exist in Language 1.0's core library; the gaps against the Language Reference are recorded as D-58.

fortis.prelude#

Imported into every module: the built-in types, the optional and outcome operations, the built-in interfaces (LR 4.3, LR 6.2, LR 6.10).

class Void#

class Never#

class Bool#

class Int#

DeclarationContract
trusted pure try func add(a: Int, b: Int) Intchecked 64-bit two's-complement addition; fails numeric.overflow outside [-2^63, 2^63-1]; O(1), no allocation
trusted pure try func sub(a: Int, b: Int) Intchecked subtraction; fails numeric.overflow; O(1), no allocation
trusted pure try func mul(a: Int, b: Int) Intchecked multiplication; fails numeric.overflow; O(1), no allocation
trusted pure try func div(a: Int, b: Int) Inttruncating division; fails numeric.divide_by_zero when b = 0 and numeric.overflow for -2^63 / -1; O(1)
trusted pure try func rem(a: Int, b: Int) Intremainder with the sign of a; fails numeric.divide_by_zero when b = 0; O(1)
trusted pure try func shiftLeft(a: Int, bits: Int) Inta * 2^bits; fails numeric.shift_range unless 0 <= bits < 64 and numeric.overflow when the result is out of range; O(1)
trusted pure func wrappingAdd(a: Int, b: Int) Intaddition modulo 2^64 into [-2^63, 2^63-1]; total; O(1)
trusted pure func wrappingSub(a: Int, b: Int) Intsubtraction modulo 2^64; total; O(1)
trusted pure func wrappingMul(a: Int, b: Int) Intmultiplication modulo 2^64; total; O(1)
trusted pure func saturatingAdd(a: Int, b: Int) Intaddition clamped to [-2^63, 2^63-1]; total; O(1)
trusted pure func saturatingSub(a: Int, b: Int) Intsubtraction clamped to [-2^63, 2^63-1]; total; O(1)
trusted pure func saturatingMul(a: Int, b: Int) Intmultiplication clamped to [-2^63, 2^63-1]; total; O(1)
trusted pure try func validate(value: Int) Intthe value when it lies in the refinement of the receiver type; fails refinement.out_of_range otherwise; O(1)

class Int8#

class Int16#

class Int32#

class Int64#

class UInt8#

class UInt16#

class UInt32#

class UInt64#

class UInt#

class Byte#

class Float#

DeclarationContract
trusted pure func sqrt(x: Float) FloatIEEE 754 binary64 correctly rounded square root; NaN for negative input; O(1)
trusted pure func totalOrder(x: Float) Int64the IEEE 754 totalOrder key of x as a signed 64-bit integer; O(1)
trusted pure func bitsEqual(a: Float, b: Float) Booltrue exactly when a and b have the same 64-bit pattern; O(1)
trusted pure func isNaN(x: Float) Booltrue exactly for NaN; O(1)

class Float32#

DeclarationContract
trusted pure func sqrt(x: Float32) Float32IEEE 754 binary32 correctly rounded square root; O(1)
trusted pure func isNaN(x: Float32) Booltrue exactly for NaN; O(1)

enum RoundingMode#

Variants: HalfEven, HalfAwayFromZero, TowardZero, AwayFromZero.

class Decimal#

DeclarationContract
trusted pure try func add(a: Decimal, b: Decimal) Decimalthe sum at the larger operand scale, rounded half to even when it needs more than 96 coefficient bits; fails numeric.overflow when the integer part does not fit (6.4); O(digits)
trusted pure try func sub(a: Decimal, b: Decimal) Decimalthe difference at the larger operand scale, rounded half to even when needed; fails numeric.overflow (6.4); O(digits)
trusted pure try func mul(a: Decimal, b: Decimal) Decimalthe product at the sum of the scales, rounded half to even above 28 fractional digits or 96 coefficient bits; fails numeric.overflow (6.4); O(digits^2)
trusted pure try func div(a: Decimal, b: Decimal) Decimalthe quotient at the largest scale that fits, rounded half to even; fails numeric.divide_by_zero and numeric.overflow (6.4); O(digits^2)
trusted pure try func rem(a: Decimal, b: Decimal) Decimalthe remainder with the sign of the dividend at the larger operand scale; fails numeric.divide_by_zero (6.4); O(digits^2)
trusted pure func round(value: Decimal, scale: Int<0..28>, mode: RoundingMode) Decimalvalue rounded to scale by mode; total; O(digits)
trusted pure try func fromFloat(x: Float, scale: Int<0..28>, mode: RoundingMode) Decimalthe binary value of x rounded to scale by mode; fails numeric.overflow for a non-finite x or an integer part that does not fit (6.4); O(digits)
trusted pure func scale(self) Int<0..28>the number of fractional digits; O(1)

class BigInt#

class String#

DeclarationContract
trusted pure func from(text: StringView) Stringan owned copy of the view; allocates; O(n) in bytes
pure func empty() String—
trusted pure func scalarCount(self) Intthe number of Unicode scalar values; O(n) in bytes
trusted pure func byteCount(self) Intthe UTF-8 length in bytes; O(1)

class StringView#

DeclarationContract
trusted pure func scalarCount(self) Intthe number of Unicode scalar values; O(n) in bytes
trusted pure func byteCount(self) Intthe UTF-8 length in bytes; O(1)
trusted pure try func slice(self, start: Int, end: Int) StringViewthe scalars [start, end) as a view of the same owner; fails text.slice_bounds unless 0 <= start <= end <= scalarCount; O(n) in bytes, no allocation
trusted pure try func scalarAt(self, index: Int) Scalarthe scalar at index; fails text.index past the end; O(n) in bytes

class Bytes#

DeclarationContract
trusted pure func byteCount(self) Intthe length in bytes; O(1)
trusted pure func get(self, index: Int) Byte?the byte at index, or null outside [0, byteCount); never allocates; O(1)

class BytesView#

DeclarationContract
trusted pure func byteCount(self) Intthe length in bytes; O(1)
trusted pure func count(self) Intthe length in bytes (same as byteCount); O(1)
trusted pure func get(self, index: Int) Byte?the byte at index, or null outside [0, byteCount); never allocates; O(1)

class Scalar#

DeclarationContract
trusted pure func of(text: StringView) Scalarthe single scalar of a one-scalar view; a constant expression for a literal; O(1)
trusted pure func digitValue(s: Scalar) Int<0..9>?the value 0-9 of an ASCII decimal digit, null otherwise; O(1)
trusted pure func hexValue(s: Scalar) Int<0..15>?the value 0-15 of an ASCII hexadecimal digit (either case), null otherwise; O(1)

class Duration#

DeclarationContract
trusted pure func days(n: Int<0..>) Durationn * 86400 * 10^9 nanoseconds; O(1) (n bounded by the 64-bit count)
trusted pure func hours(n: Int<0..>) Durationn * 3600 * 10^9 nanoseconds; O(1)
trusted pure func minutes(n: Int<0..>) Durationn * 60 * 10^9 nanoseconds; O(1)
trusted pure func seconds(n: Int<0..>) Durationn * 10^9 nanoseconds; O(1)
trusted pure func milliseconds(n: Int<0..>) Durationn * 10^6 nanoseconds; O(1)
trusted pure try func add(a: Duration, b: Duration) Durationsum of the signed 64-bit nanosecond counts; fails numeric.overflow; O(1)
trusted pure try func sub(a: Duration, b: Duration) Durationdifference of the nanosecond counts; fails numeric.overflow; O(1)
trusted pure try func multiply(d: Duration, factor: Int) Durationthe count times factor; fails numeric.overflow; O(1)
trusted pure func nanoseconds(self) Intthe signed 64-bit nanosecond count; O(1)

class Instant#

class Timestamp#

DeclarationContract
trusted pure func epoch() Timestamp1970-01-01T00:00:00Z as a signed 64-bit nanosecond count of 0; O(1)
trusted pure try func add(t: Timestamp, d: Duration) Timestampt + d in nanoseconds since the epoch; fails numeric.overflow; O(1)
trusted pure func after(a: Timestamp, b: Timestamp) Boola is strictly later than b; O(1)
trusted pure func before(a: Timestamp, b: Timestamp) Boola is strictly earlier than b; O(1)

class List[T]#

DeclarationContract
trusted pure func default() List[T]an empty list with no allocation until the first push; O(1)
trusted pure func of(...items: owned T) List[T]a list holding the arguments in order; allocates once; O(n)
trusted pure func count(self) Intthe number of elements; O(1)
trusted func push(editable self, item: owned T) Voidappends item; amortised O(1) (capacity doubles), worst case O(n) for the growth step
trusted func pop(editable self) T?removes and returns the last element, null when empty; O(1)
trusted pure func get(self, index: Int) (alias T from self)?a read loan of the element at index, null outside [0, count); O(1)
trusted pure try func at(self, index: Int) Tthe element at index; fails collection.index outside [0, count); O(1)
trusted try func set(editable self, index: Int, value: owned T) Voidreplaces the element at index, dropping the old value; fails collection.index; O(1)
pure func isEmpty(self) Bool—
pure func first(self) (alias T from self)?—
pure func reversed(self) List[T] where T implements Copyable—
pure func concat(self, other: ListView[T]) List[T] where T implements Copyable—
pure func countWhere(self, keep: pure fn(T) Bool) Int—
pure func map[U](self, f: pure fn(T) U) List[U]—
pure func filter(self, keep: pure fn(T) Bool) List[T] where T implements Copyable—
trusted pure func iterate(self) ListCursor[T] from selfa cursor over read loans of the elements in order; O(1) to create, O(1) per step
trusted func consumeEach(owned self, visit: fn mut(owned T) Void) Voidconsumes the list (10.7): no early exit, so no element is left unvisited; an empty list makes no calls intrinsic: calls visit once per element in order, transferring each element out; O(n) plus the callback per element

class ListCursor[T] implements Iterator[T]#

DeclarationContract
trusted pure func next(editable self) (alias T from self)?a read loan of the next element, null at the end; O(1)

class ListView[T]#

DeclarationContract
trusted pure func count(self) Intthe number of elements; O(1)
trusted pure func get(self, index: Int) (alias T from self)?a read loan of the element at index, null outside [0, count); O(1)
pure func isEmpty(self) Bool—
pure func reversed(self) List[T] where T implements Copyable—

class Array[T, N]#

DeclarationContract
trusted pure func filled(value: T) Array[T, N]N copies of value; O(N), inline storage
trusted pure func count(self) IntN; O(1)
trusted func set(editable self, index: Int, value: owned T) Voidreplaces the element at index; O(1)

class Map[K, V]#

DeclarationContract
trusted pure func default() Map[K, V]an empty map; O(1)
trusted pure func get(self, key: K) (alias V from self)?a read loan of the value for key, null when absent; expected O(1) under the release's fixed hash function
trusted func set(editable self, key: owned K, value: owned V) Voidinserts or replaces the value for key, dropping a replaced value; amortised expected O(1)
trusted pure func count(self) Intthe number of keys; O(1)

class OrderedMap[K, V]#

class Set[T]#

DeclarationContract
trusted pure func default() Set[T]an empty set; O(1)
trusted func add(editable self, item: owned T) Boolinserts item, true when it was absent; amortised expected O(1)
trusted pure func contains(self, item: T) Boolmembership; expected O(1)
trusted pure func count(self) Intthe number of items; O(1)

class FixedList[T, N]#

class FixedMap[K, V, N]#

class VariantMap[E, V]#

class Must#

DeclarationContract
trusted pure func create() Musta zero-sized linear witness; O(1), no allocation
trusted pure func discharge(m: owned Must) Voidconsumes the witness; O(1)

class Outcome[T]#

DeclarationContract
trusted pure func success(value: owned T) Outcome[T]an outcome holding value; O(1)
trusted pure func failure(f: owned Failure) Outcome[T]an outcome holding f; O(1)
trusted pure try func collect(list: owned List[Outcome[T]]) List[T]the successes in order when every element succeeds, otherwise the first failure in order, consuming every other element's obligation; O(n)

class Failure#

class Report#

class Failures#

DeclarationContract
trusted pure func aggregate(list: owned List[Failure]) Failureone failure with code failure.aggregate whose cause chain is the list in order; O(n)

class Future[T]#

class Task[T] implements Abandonable#

DeclarationContract
trusted func abandon(owned self) Voidcancels the task and waits for it to finish (12.4); its result is consumed by the scope

class Cancellation#

class TaskDefect#

enum TaskCompletion[T]#

Variants: Completed(value: T), Cancelled(reason: Cancellation), Defect(info: TaskDefect).

class Shared[T]#

DeclarationContract
trusted pure func create(value: owned T) Shared[T]a reference-counted owner holding value, strong count 1; allocates once; O(1)
trusted pure func retain(self) Shared[T]a new strong handle, strong count + 1; O(1)
trusted pure func downgrade(self) Weak[T]a weak handle to the same value; O(1)

class Weak[T]#

DeclarationContract
trusted func upgrade(self) Shared[T]?a strong handle when the value is alive, null after the last strong handle was dropped; O(1)
trusted pure func retain(self) Weak[T]a new weak handle; O(1)

class Mutex[T]#

DeclarationContract
trusted pure func create(value: owned T) Mutex[T]a mutex owning value; O(1)
trusted async try func lock(self) MutexGuard[T] from selfan exclusive guard over the value, released when the guard is dropped, suspending until the lock is free; fails concurrency.poisoned if a holder was terminated by a defect (unreachable on the interpreter, where a defect ends the program)
trusted try func lockBlocking(self) MutexGuard[T] from selfan exclusive guard over the value, released when the guard is dropped, blocking the thread until free (the block effect); fails concurrency.poisoned

class MutexGuard[T]#

DeclarationContract
trusted pure func get(self) T where T implements Copyablea copy of the protected value, read through the exclusive guard (12.7); allocates when the value owns heap storage
trusted func set(self, value: owned T) Voidreplaces the protected value with value and drops the old one; a write to storage shared between tasks (mutate, 11.1)
trusted func replace(self, value: owned T) Treplaces the protected value with value and returns the old one, which the caller now owns; a write to storage shared between tasks (mutate, 11.1)

class AtomicInt#

DeclarationContract
trusted pure func create(value: Int) AtomicIntan atomic integer holding value; O(1)
trusted pure func load(self) Intthe current value (seqcst); O(1)
trusted func store(self, value: Int) Voidreplaces the value (seqcst); O(1)
trusted func fetchAdd(self, delta: Int) Intadds delta with wrapping and returns the previous value (seqcst); O(1)

class AtomicBool#

DeclarationContract
trusted pure func create(value: Bool) AtomicBoolan atomic boolean holding value; O(1)
trusted pure func load(self) Boolthe current value (seqcst); O(1)
trusted func store(self, value: Bool) Voidreplaces the value (seqcst); O(1)

class Scope#

DeclarationContract
trusted func launch[T](self, work: owned Future[T]) Task[T]a task running work on the cooperative executor of this scope (12.5); O(1)
trusted func launchParallel[T](self, work: owned Future[T]) Task[T]a task running work on the parallel pool (12.5); the environment is Shareable; O(1)
trusted func launchBlocking[T](self, work: owned fn once() T) Task[T]a task running work on the bounded blocking pool (12.5); O(1)
trusted func detach[T](self, task: owned Task[T], supervisor: Supervisor) Voidremoves task from the scope and hands its join obligation to supervisor (12.5); O(1)

class ObservationSchema#

class Hasher#

enum Ordering derive Equatable#

Variants: Less, Equal, Greater.

class Encoder#

class Decoder#

interface Equatable#

DeclarationContract
pure func equals(self, other: Self) Bool—

interface Hashable requires Equatable#

DeclarationContract
pure func hash(self, into: editable Hasher) Void—

interface Comparable requires Equatable#

DeclarationContract
pure func compare(self, other: Self) Ordering—

interface Displayable#

DeclarationContract
pure func display(self, into: editable Builder) Void—

interface Iterable[T, I] where I implements Iterator[T]#

DeclarationContract
pure func iterate(self) I from self—

interface Iterator[T]#

DeclarationContract
pure func next(editable self) (alias T from self)?—

interface Consumable[T, I] where I implements Consumer[T]#

DeclarationContract
func consume(owned self) I—

interface Consumer[T]#

DeclarationContract
func next(editable self) T?—

interface Copyable#

interface Shareable#

interface Abandonable#

DeclarationContract
func abandon(owned self) Void—

interface Default#

DeclarationContract
pure func default() Self—

interface Encodable#

DeclarationContract
pure func encode(self, into: editable Encoder) Void—

interface Decodable#

DeclarationContract
try func decode(source: editable Decoder) Self—

interface Codec requires Encodable, Decodable#

interface Authority#

interface From[S]#

DeclarationContract
func from(source: S) Self—

class Builder#

DeclarationContract
trusted pure func create() Builderan empty builder; O(1)
trusted func append(editable self, text: StringView) Voidappends the view; amortised O(len)
trusted func appendLine(editable self, text: StringView) Voidappends the view and a line feed; amortised O(len)
trusted func appendScalar(editable self, s: Scalar) Voidappends one scalar; amortised O(1)
trusted pure func finish(self) Stringthe accumulated text as an owned String; O(total length)

Functions and aspects#

DeclarationContract
trusted pure func annotate(f: owned Failure, note: StringView) Failuref with note added to its annotation trail; the result carries the single obligation of f; O(1) amortised
trusted async func join[A, B](a: owned Future[A], b: owned Future[B]) (A, B)runs both futures to completion inside the parent and returns both results (12.5)
trusted func checkpoint() Voida cancellation point for parallel and blocking tasks (12.4); no effect in cooperative tasks
trusted func injectDefect(kind: StringView) Neverthe conformance corpus's fault-injection hook (LR 10.8); not part of the language
aspect observe(schema: ObservationSchema)—

fortis.text#

Text building, scalars and graphemes (LR 6.6).

class Builder#

DeclarationContract
trusted pure func create() Builderan empty builder; O(1)
trusted func append(editable self, text: StringView) Voidappends the view; amortised O(len)
trusted func appendLine(editable self, text: StringView) Voidappends the view and a line feed; amortised O(len)
trusted func appendScalar(editable self, s: Scalar) Voidappends one scalar; amortised O(1)
trusted pure func finish(self) Stringthe accumulated text as an owned String; O(total length)

class Scalar#

DeclarationContract
trusted pure func of(text: StringView) Scalarthe single scalar of a one-scalar view; a constant expression for a literal; O(1)
trusted pure func digitValue(s: Scalar) Int<0..9>?the value 0-9 of an ASCII decimal digit, null otherwise; O(1)
trusted pure func hexValue(s: Scalar) Int<0..15>?the value 0-15 of an ASCII hexadecimal digit (either case), null otherwise; O(1)

class Text#

DeclarationContract
trusted pure func words(text: StringView) List[String]the maximal runs of non-whitespace scalars (Unicode White_Space), in order, as owned strings; allocates; O(n)

Functions and aspects#

DeclarationContract
trusted pure func graphemes(text: StringView) Intthe number of extended grapheme clusters (UAX #29, the rules GB3-GB9c and GB11-GB13 over combining marks, ZWJ sequences and regional-indicator pairs; Hangul syllable rules GB6-GB8 are not yet implemented); O(n)

fortis.collections#

Collection algorithms (LR 6.7).

Functions and aspects#

DeclarationContract
pure func sorted(items: ListView[Int]) List[Int]Bottom-up merge sort: stable, O(n log n) comparisons and copies, O(n) extra space.

fortis.numeric#

Integer helpers (LR 6.4).

Functions and aspects#

DeclarationContract
pure func abs(value: Int) Int<0..>—
pure func min(a: Int, b: Int) Int—
pure func max(a: Int, b: Int) Int—

fortis.time#

Durations and timestamps (LR 15).

class Duration#

DeclarationContract
trusted pure func days(n: Int<0..>) Durationn * 86400 * 10^9 nanoseconds; O(1) (n bounded by the 64-bit count)
trusted pure func hours(n: Int<0..>) Durationn * 3600 * 10^9 nanoseconds; O(1)
trusted pure func minutes(n: Int<0..>) Durationn * 60 * 10^9 nanoseconds; O(1)
trusted pure func seconds(n: Int<0..>) Durationn * 10^9 nanoseconds; O(1)
trusted pure func milliseconds(n: Int<0..>) Durationn * 10^6 nanoseconds; O(1)
trusted pure try func add(a: Duration, b: Duration) Durationsum of the signed 64-bit nanosecond counts; fails numeric.overflow; O(1)
trusted pure try func sub(a: Duration, b: Duration) Durationdifference of the nanosecond counts; fails numeric.overflow; O(1)
trusted pure try func multiply(d: Duration, factor: Int) Durationthe count times factor; fails numeric.overflow; O(1)
trusted pure func nanoseconds(self) Intthe signed 64-bit nanosecond count; O(1)

class Instant#

class Timestamp#

DeclarationContract
trusted pure func epoch() Timestamp1970-01-01T00:00:00Z as a signed 64-bit nanosecond count of 0; O(1)
trusted pure try func add(t: Timestamp, d: Duration) Timestampt + d in nanoseconds since the epoch; fails numeric.overflow; O(1)
trusted pure func after(a: Timestamp, b: Timestamp) Boola is strictly later than b; O(1)
trusted pure func before(a: Timestamp, b: Timestamp) Boola is strictly earlier than b; O(1)

fortis.money#

An amount of a currency (LR 15).

enum Currency derive Equatable#

Variants: GBP, EUR, USD.

error CurrencyMismatch#

class Money#

DeclarationContract
pure func of(currency: Currency, amount: Decimal) Money—
pure func zero(currency: Currency) Money—
pure try func add(a: Money, b: Money) Money—
pure try func subtract(a: Money, b: Money) Money—
trusted pure try func multiply(money: Money, factor: Int) Moneythe amount times factor at the amount's scale (an Int has scale 0), rounded half to even when it needs more than 96 coefficient bits; fails numeric.overflow (6.4); O(digits^2)
trusted pure try func divide(money: Money, divisor: Int<1..>) Moneythe amount divided by divisor at the largest scale that fits, rounded half to even; fails numeric.overflow (6.4); O(digits^2)
pure func greaterThan(a: Money, b: Money) BoolOrdered within one currency; amounts in different currencies are incomparable, so greaterThan is false.

fortis.host#

The capabilities, Path, Secret and reveal (LR 11.6, LR 15).

class Path#

DeclarationContract
trusted pure try func parse(text: String) Patha path from its text; fails path.invalid for empty text or text containing NUL; O(n)

class Secret[T]#

class SecretAccess implements Authority#

class FileSystem implements Authority#

DeclarationContract
trusted try func readText(self, path: Path) Stringthe UTF-8 contents of path below this root; fails fs.outside_root when the path is absolute or escapes the root, fs.not_found, fs.not_a_file or fs.invalid_text. Development adapter: the root is a fresh empty temporary directory per run, or FORTIS_DEV_ROOT when set; blocks the calling thread (the block effect, 11.1)
trusted try func writeAll(self, path: Path, text: StringView) Voidreplaces the contents of path with text, creating the file; fails fs.outside_root or fs.not_found (missing parent directory); blocks the calling thread (the block effect, 11.1)
trusted try func readAll(self, path: Path) Bytesthe bytes of path; fails fs.outside_root, fs.not_found or fs.not_a_file; blocks the calling thread (the block effect, 11.1)
trusted try func open(self, path: Path) Filean open file for reading; fails fs.outside_root or fs.not_found; blocks the calling thread (the block effect, 11.1)
trusted try func create(self, path: Path) Filean open file for writing, created or truncated; fails fs.outside_root or fs.not_found; blocks the calling thread (the block effect, 11.1)
trusted func subtree(self, path: Path) FileSystema FileSystem confined below path; a path that escapes this root yields a confinement that refuses every operation with fs.outside_root (attenuation never widens)

class File#

DeclarationContract
trusted try func readAll(editable self) Bytesthe remaining bytes of a file opened for reading; fails fs.closed after close and fs.wrong_mode on a file opened for writing; blocks the calling thread (the block effect, 11.1)
trusted try func writeAll(editable self, data: BytesView) Voidappends data to a file opened for writing; fails fs.closed after close and fs.wrong_mode on a file opened for reading; blocks the calling thread (the block effect, 11.1)
trusted func close(editable self) Voidcloses the file; closing twice has no effect; dropping an open file closes it

class Network implements Authority#

DeclarationContract
trusted try func resolve(self, host: StringView) Stringthe address of host. Development adapter: offline; localhost resolves to 127.0.0.1 and every other host fails network.unreachable; blocks the calling thread (the block effect, 11.1)

class Clock implements Authority#

DeclarationContract
trusted async func sleep(self, duration: Duration) Voidsuspends the task for duration of the clock's time (a cancellation point, 12.4). Development adapter: virtual time on the controlled scheduler
trusted func now(self) Timestampthe current instant in UTC (nondet). Development adapter: the system clock; a frozen clock returns its instant
trusted func frozen(self, instant: Timestamp) Clocka clock whose now() is always instant (for tests and replay)
trusted try func elapsedSince(self, earlier: Timestamp) Durationnow() minus earlier; fails clock.future when earlier is after now()

class Random implements Authority#

DeclarationContract
trusted func below(self, bound: Int<1..>) Int<0..>a uniformly distributed integer in [0, bound) (nondet; rejection sampling, no modulo bias). Development adapter: SplitMix64 from seed 0, or FORTIS_DEV_SEED
trusted func seeded(self, seed: Int) Randoma generator with its own deterministic sequence from seed (replay)

class Environment implements Authority#

DeclarationContract
trusted func get(self, name: StringView) Secret[String]?the variable as a Secret, or null when unset or when name is empty or contains = (nondet). Development adapter: the process environment

class Process implements Authority#

DeclarationContract
trusted try func run(self, program: StringView, arguments: ListView[String]) Intruns program with arguments to completion and returns its exit status (the block effect). Development adapter: starts no process; simulates true (0) and false (1) and refuses every other program with process.denied

class Supervisor implements Authority#

class Console implements Authority#

DeclarationContract
trusted func print(self, text: StringView) Voidwrites text and a line feed to standard output

class RawSql implements Authority#

DeclarationContract
trusted try func execute(self, statement: StringView) Intruns one SQL statement and returns the affected row count. Development adapter: has no database; every statement fails sql.unavailable; blocks the calling thread (the block effect, 11.1)

class Capabilities#

class Host#

DeclarationContract
trusted func capabilities() Capabilitiesthe ten process-wide capabilities, created by one direct call in the entry main (11.6): every other use is rejected statically (E-EFF-010), and a second creation stops the run with the runtime-invariant defect (10.8) (E-EFF-010: LR 4.6)

Functions and aspects#

DeclarationContract
trusted func reveal[T](secret: Secret[T], cap: SecretAccess) Tthe secret value (a copy); requires the SecretAccess capability (15); O(size)