[yazaddaruvala]

An extremely verbose effects system can resolve these dependency permissions at compile time.

However, balancing ergonomics is a the big challenge.

I personally would prefer less ergonomics for more security, but that’s likely not a broadly shared opinion.

[tancop]

i dont know if it needs to be extremely verbose:

  fn prints_output(value: &str) @ mut std::io::Output {
    println!("side effects! value: {}", value);
  }
  
  effect CurrentTime {
    pub date_time: DateTime<Utc>
  }
  
  fn takes_context() @ CurrentTime dt -> String {
    dt.date_time.format("%H:%M").to_string()
  }
  
  // combine effects for shorter declarations
  // `?mut` is only mutable if the function declares it as `mut`
  effect TimeAndOutput = CurrentTime + ?mut std::io::Output;
  
  fn implicit_pass() @ mut TimeAndOutput {
    prints_output(takes_context());
  }
  
  fn creates_new_context() @ mut std::io::Output {
    // you only need to create the context thats not passed automatically
    implicit_pass(@CurrentTime { date_time: DateTime<Utc>::now() });
  }

effects can also have private fields and methods realized as a function pointer. that means `Output::print` can do different things in a simple cli app and a server framework with advanced logging. the calling function never knows the details.

syntax not final obviously and idk if it should be called "effect" or "context" so im using both. every function has to declare them but theres no big ergonomics hit when you have union effects and ide autocomplete. might not be easy to implement this in practice but the concept is simple, its basically some extra objects that get automatically passed through kinda like react context.

a function that takes no context and no &mut parameters is pure, if it takes only "shared" context its view (no side effects but depends on shared state). this can be used to let the compiler optimize better or guarantee security, like proc macros have to be pure or build.rs can only log to a provided output. of course you need to forbid unsafe code in the untrusted module to make it safe.