# V6020 dependency_acquires_authority

URL: /docs/errors/V6020
Markdown: /docs/errors/V6020.md

> A dependency acquires authority itself: it calls a std host() constructor (Fs.host(), Env.host(), …) or declares an @external binding (RFC 0003 §5.2, experimental).

An error from the `capability` phase. `sakura explain V6020` prints this explanation offline.

A dependency acquires authority itself: it calls a std `host()` constructor (`Fs.host()`,
`Env.host()`, …) or declares an `@external` binding (RFC 0003 §5.2, experimental). In any
package other than the one being built, authority comes only from the consumer: the dependency
performs the effects its public rows declare, through the handlers its caller installs. A
`host()` call reads the program's root grants, so without this rule a dependency could use
`Fs` without `Fs` in any public row. Rewrite the dependency to declare the effect in its row, or,
if you have reviewed it, write `trusted = true` on its line in the consumer's `[dependencies]`;
`sakura audit` and `build --manifest` then list each such site under the package's name. `test`
bodies of a dependency are not compiled by its consumers and are not checked.

Wrong:

```sakura
# util/src/lib.sak, a dependency
import std/env.{Env}
pub fn home() -> Option<String> { with Env.host() { Env.get("HOME") } }
```

Fixed:

```sakura
import std/env.{Env}
pub fn home() -> Option<String> ! {Env} { Env.get("HOME") }
```

## Wrong program [#wrong-program]

[`compiler/tests/ui/V6020_dependency_external/`](https://github.com/icantcodefyi/sakuralang/blob/main/compiler/tests/ui/V6020_dependency_external/), which the compiler's ui suite runs through `sakura check`:

`main.sak`:

```sakura
// RFC 0003 §5.2: an `@external` declaration in a dependency is `V6020` at the attribute unless the
// root trusts the dependency.
pub fn main() -> Unit ! {Console} { Console.print("hi") }
```

`sakura.toml`:

```toml
[package]
name = "billing"

[dependencies]
util = { path = "util" }
```

`sakura check --json` reports this record (pretty-printed; `$DIR` is the fixture's directory):

```json
{
  "schema_version": "1.0",
  "kind": "diagnostic",
  "id": "d:81422692b3f5d1c9",
  "code": "V6020",
  "severity": "error",
  "phase": "capability",
  "message": "dependency `util` declares an `@external` binding, which acquires authority: a dependency performs only the effects its rows declare, through its caller's handlers. Declare the effect in the function's row instead, or, after reviewing `util`, write `trusted = true` on its line in the root package's `[dependencies]`",
  "snapshot": "sha256:$SNAPSHOT",
  "symbol_id": "util::clock::now",
  "spans": [
    {
      "uri": "file://$DIR/V6020_dependency_external/util/src/clock.sak",
      "content_hash": "sha256:bb7ad686f0499dc68f493b5eb87e1fe2d9ef378de8d9b4065c4bef768b4e9e31",
      "start_byte": 64,
      "end_byte": 72,
      "role": "primary"
    }
  ],
  "related_ids": [],
  "expected": null,
  "actual": null,
  "obligation": null,
  "counterexample": null,
  "explanation_uri": "sakura://explain/V6020",
  "fixes": []
}
```

## Fixed program [#fixed-program]

No fixed program is checked in for this code yet; the explanation above describes the repair.