worldvm 0.0.0-stage → 0.1.0

package/dist/_internal/ir-checks/index.d.ts

@@ -0,0 +1,59 @@
+export { sensitiveClasses, sensitivityOfType, sensitivePayload, factSensitivity, sensitivityDiagnostics, sensitiveTypeHelp, sensitiveSealHelp, type SensitiveClass, type Sensitivity, } from "./sensitivity.js";
+export { resourceProofDiagnostics, resourceProofRequirement } from "./resource-proofs.js";
+export { childParameterDiagnostics } from "./child-parameters.js";
+export { componentOperationNames, operationDeclarationProblem } from "./component-operations.js";
+export { componentContractDiagnostics } from "./contract-validation.js";
+export { componentContractSurface, componentContractDigest } from "./contracts.js";
+export { sha256, canonicalJson, contentDigest } from "./content-digest.js";
+export { clockBindingDiagnostics } from "./clock-bindings.js";
+export { isInstant, normalizeInstant, timePointKey, instantLiteralDiagnostics, } from "./instants.js";
+export { evidenceScopeDiagnostics, type EvidenceScopeDiagnostic } from "./evidence.js";
+export { isLocalDate } from "./dates.js";
+/** Structural IR checks shared by the publisher and pure runtime. This package has no services. */
+export interface Span {
+    readonly src: string;
+    readonly from: number;
+    readonly to: number;
+    readonly line: number;
+    readonly col: number;
+}
+export interface ClockDiagnostic {
+    readonly code: "E_UNBOUNDED_TIME" | "E_INSTANT_LITERAL" | "E_CLOCK_BINDING";
+    readonly severity: "error";
+    readonly message: string;
+    readonly help: string;
+    readonly at?: Span;
+}
+interface ClockIR {
+    readonly evidence?: readonly {
+        readonly expires?: unknown;
+    }[];
+    readonly vaults?: readonly {
+        readonly retain: unknown;
+    }[];
+    readonly components: readonly unknown[];
+    readonly derives: readonly {
+        readonly name: string;
+        readonly body: unknown;
+    }[];
+    readonly accounts: readonly unknown[];
+}
+/** A clock is a predicate input, never rolling date data. Finite cutoffs are then enumerable
+ * from expressions, without probing each day or enumerating an entity namespace. */
+export declare const finiteTimeDiagnostics: (ir: ClockIR) => readonly ClockDiagnostic[];
+export { priorCycleDecisionName, priorCycleOperationName, priorCycleDecisions, } from "./prior-cycle.js";
+export { principalKinds, principalActionKey, principalEscalationKey, type PrincipalIR, type PrincipalKind, type PrincipalDiagnostic, } from "./principals.js";
+export { collectionType, type CollectionType } from "./collect-types.js";
+export { policyNumberValid, policyBoundValid, policyValueWithin, policyParameterType, } from "./policy-bounds.js";
+export { advanceTargets, stableWorkIdentity } from "./advances.js";
+export { reuseDecisionName, reuseDecisions, reuseProblem } from "./reuse.js";
+export { fileDigest, fileShape, fileMediaType, filePolicyValid, filePolicyHelp, fileFieldDiagnostics, } from "./files.js";
+export { documentDiagnostics, documentHelp } from "./documents.js";
+export { noticeDiagnostics, noticeHelp } from "./notices.js";
+export { auditPolicyValid, signatureDiagnostics, signatureHelp } from "./signatures.js";
+export { amendmentDiagnostics, amendmentHelp } from "./amendments.js";
+export { resourceDiagnostics, resourceHelp } from "./resources.js";
+export { vaultAuthority, vaultDiagnostics, vaultHelp } from "./vaults.js";
+export { agentReadDiagnostics, agentReadInfo, agentReadHelp, type AgentReadPermission, type AgentReadInfo, } from "./agent-reads.js";
+export { dataReadInfo, type DataReadSelector } from "./read-classification.js";
+export { semanticJson } from "./canonical-json.js";

package/dist/_internal/ir-checks/index.js

@@ -0,0 +1,166 @@
+export { sensitiveClasses, sensitivityOfType, sensitivePayload, factSensitivity, sensitivityDiagnostics, sensitiveTypeHelp, sensitiveSealHelp, } from "./sensitivity.js";
+export { resourceProofDiagnostics, resourceProofRequirement } from "./resource-proofs.js";
+export { childParameterDiagnostics } from "./child-parameters.js";
+export { componentOperationNames, operationDeclarationProblem } from "./component-operations.js";
+export { componentContractDiagnostics } from "./contract-validation.js";
+export { componentContractSurface, componentContractDigest } from "./contracts.js";
+export { sha256, canonicalJson, contentDigest } from "./content-digest.js";
+export { clockBindingDiagnostics } from "./clock-bindings.js";
+export { isInstant, normalizeInstant, timePointKey, instantLiteralDiagnostics, } from "./instants.js";
+export { evidenceScopeDiagnostics } from "./evidence.js";
+export { isLocalDate } from "./dates.js";
+const record = (x) => x && typeof x === "object" && !Array.isArray(x) ? x : {};
+const array = (x) => (Array.isArray(x) ? x : []);
+const expressions = (value, parent) => {
+    if (Array.isArray(value))
+        return value.flatMap((v) => expressions(v, parent));
+    const node = record(value);
+    const isExpr = typeof node.k === "string";
+    return [
+        ...(isExpr ? [{ node, parent }] : []),
+        ...Object.entries(node)
+            .filter(([key]) => key !== "at")
+            .flatMap(([, v]) => expressions(v, isExpr ? node : parent)),
+    ];
+};
+const scheduled = (component) => {
+    const c = record(component);
+    return [
+        c.cycle,
+        record(c.retention).until,
+        ...array(c.milestones).map((milestone) => record(milestone).when),
+        ...array(c.holds).map((hold) => record(hold).while),
+        ...array(c.resources).map((resource) => record(resource).releaseWhen),
+        ...array(c.requirements).flatMap((r) => {
+            const q = record(r), accepts = record(q.accepts);
+            return [
+                q.appliesWhen,
+                q.satisfiedBy,
+                q.due,
+                q.remind,
+                ...array(q.escalate).map((step) => record(step).who),
+                q.cycle,
+                record(q.recur).from,
+                accepts.within,
+                accepts.confirm,
+            ];
+        }),
+        ...array(c.slots).flatMap((s) => [
+            record(s).appliesWhen,
+            ...array(record(s).bind).map((b) => record(b).expr),
+        ]),
+        ...array(c.actions).flatMap((a) => [
+            record(a).assignee,
+            ...array(record(a).idempotency),
+            ...array(record(a).needs).map((n) => record(n).expr),
+        ]),
+    ].filter((v) => v !== undefined);
+};
+/** A clock is a predicate input, never rolling date data. Finite cutoffs are then enumerable
+ * from expressions, without probing each day or enumerating an entity namespace. */
+export const finiteTimeDiagnostics = (ir) => {
+    const definitions = new Map(ir.derives.map((d) => [d.name, expressions(d.body)]));
+    const diagnostics = [];
+    const reported = new Set();
+    const report = (node, message, help) => {
+        if (reported.has(node))
+            return;
+        reported.add(node);
+        const at = node.at;
+        diagnostics.push({
+            code: "E_UNBOUNDED_TIME",
+            severity: "error",
+            message,
+            help,
+            ...(at ? { at } : {}),
+        });
+    };
+    const clock = (node) => node.k === "var" && ["today", "now"].includes(String(node.name));
+    const calls = (nodes) => nodes
+        .map(({ node }) => node)
+        .filter((n) => n.k === "call" && n.derive === true && typeof n.fn === "string");
+    const check = (root, isStatic = false) => {
+        const own = expressions(root);
+        const reachable = new Set(calls(own).map((n) => String(n.fn)));
+        for (const name of reachable)
+            for (const call of calls(definitions.get(name) ?? []))
+                reachable.add(String(call.fn));
+        const nodes = [...own, ...[...reachable].flatMap((n) => definitions.get(n) ?? [])];
+        const clocks = nodes.filter(({ node }) => clock(node));
+        if (clocks.length === 0)
+            return;
+        if (isStatic) {
+            report(record(root), "Account params are static and cannot read today or now.", "Use constant account params; put date predicates on requirements or actions instead.");
+            return;
+        }
+        for (const { node, parent } of clocks)
+            if (!(parent?.k === "call" &&
+                parent.derive !== true &&
+                array(parent.args).length === 2 &&
+                ["before?", "on-or-after?", "=", "not="].includes(String(parent.fn)) &&
+                array(parent.args).slice(0, 2).includes(node) &&
+                new Set(array(parent.args)
+                    .map(record)
+                    .filter(clock)
+                    .map((arg) => arg.name)).size <= 1))
+                report(node, "Scheduled clock reads must be finite date predicates.", "Use today or now directly in the builtin before?, on-or-after?, = or not= predicates; shift a fact-based cutoff date instead of the clock.");
+        const active = new Set(), done = new Set();
+        const cycle = (name) => {
+            if (done.has(name))
+                return;
+            active.add(name);
+            for (const call of calls(definitions.get(name) ?? [])) {
+                const target = String(call.fn);
+                if (active.has(target))
+                    return call;
+                const found = cycle(target);
+                if (found)
+                    return found;
+            }
+            active.delete(name);
+            done.add(name);
+        };
+        for (const name of reachable) {
+            const found = cycle(name);
+            if (found) {
+                report(found, "Clock-dependent scheduled expressions cannot call recursive derives.", "Keep scheduled clock logic non-recursive; use fixed cutoff facts and bounded date predicates.");
+                break;
+            }
+        }
+    };
+    for (const component of ir.components)
+        for (const expr of scheduled(component))
+            check(expr);
+    for (const evidence of ir.evidence ?? [])
+        if (evidence.expires)
+            check(evidence.expires);
+    for (const vault of ir.vaults ?? [])
+        check(vault.retain);
+    for (const account of ir.accounts) {
+        for (const param of array(record(account).params))
+            check(record(param).value, true);
+        for (const policy of array(record(account).policies)) {
+            check(record(policy).when);
+            check(record(policy).require);
+            for (const assignment of array(record(policy).assign))
+                check(record(assignment).assignee);
+        }
+    }
+    return diagnostics;
+};
+export { priorCycleDecisionName, priorCycleOperationName, priorCycleDecisions, } from "./prior-cycle.js";
+export { principalKinds, principalActionKey, principalEscalationKey, } from "./principals.js";
+export { collectionType } from "./collect-types.js";
+export { policyNumberValid, policyBoundValid, policyValueWithin, policyParameterType, } from "./policy-bounds.js";
+export { advanceTargets, stableWorkIdentity } from "./advances.js";
+export { reuseDecisionName, reuseDecisions, reuseProblem } from "./reuse.js";
+export { fileDigest, fileShape, fileMediaType, filePolicyValid, filePolicyHelp, fileFieldDiagnostics, } from "./files.js";
+export { documentDiagnostics, documentHelp } from "./documents.js";
+export { noticeDiagnostics, noticeHelp } from "./notices.js";
+export { auditPolicyValid, signatureDiagnostics, signatureHelp } from "./signatures.js";
+export { amendmentDiagnostics, amendmentHelp } from "./amendments.js";
+export { resourceDiagnostics, resourceHelp } from "./resources.js";
+export { vaultAuthority, vaultDiagnostics, vaultHelp } from "./vaults.js";
+export { agentReadDiagnostics, agentReadInfo, agentReadHelp, } from "./agent-reads.js";
+export { dataReadInfo } from "./read-classification.js";
+export { semanticJson } from "./canonical-json.js";

package/dist/_internal/ir-checks/instants.d.ts

@@ -0,0 +1,7 @@
+/** Require an explicit known offset; never guess a host zone or silently drop precision. */
+export declare const normalizeInstant: (value: unknown) => string | null;
+/** Stored instants have one representation, suitable for deterministic ordering/digests. */
+export declare const isInstant: (value: unknown) => value is string;
+/** A comparison key shared by publication-time scenario ordering and runtime snapshots. */
+export declare const timePointKey: (value: string) => string;
+export declare const instantLiteralDiagnostics: (ir: unknown) => import("./index.js").ClockDiagnostic[];

package/dist/_internal/ir-checks/instants.js

@@ -0,0 +1,61 @@
+import { isLocalDate } from "./dates.js";
+const canonical = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+/** Require an explicit known offset; never guess a host zone or silently drop precision. */
+export const normalizeInstant = (value) => {
+    if (typeof value !== "string")
+        return null;
+    const match = /^(\d{4}-\d{2}-\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+    if (!match ||
+        !isLocalDate(match[1]) ||
+        Number(match[2]) > 23 ||
+        Number(match[3]) > 59 ||
+        Number(match[4]) > 59)
+        return null;
+    const zone = match[6];
+    if (zone === "-00:00" ||
+        (zone !== "Z" && (Number(zone.slice(1, 3)) > 23 || Number(zone.slice(4)) > 59)))
+        return null;
+    const ms = Date.parse(value);
+    if (!Number.isFinite(ms))
+        return null;
+    const normalized = new Date(ms).toISOString();
+    return canonical.test(normalized) ? normalized : null;
+};
+/** Stored instants have one representation, suitable for deterministic ordering/digests. */
+export const isInstant = (value) => typeof value === "string" && canonical.test(value) && normalizeInstant(value) === value;
+/** A comparison key shared by publication-time scenario ordering and runtime snapshots. */
+export const timePointKey = (value) => {
+    if (isLocalDate(value))
+        return `${value}T00:00:00.000Z`;
+    if (isInstant(value))
+        return value;
+    throw new RangeError("Expected a local date or canonical UTC millisecond instant");
+};
+export const instantLiteralDiagnostics = (ir) => {
+    const diagnostics = [];
+    const scan = (value) => {
+        if (Array.isArray(value)) {
+            value.forEach(scan);
+            return;
+        }
+        if (!value || typeof value !== "object")
+            return;
+        const node = value;
+        if (node.k === "call" && node.fn === "instant" && node.derive !== true) {
+            const arg = node.args?.[0];
+            if (arg?.k === "lit" && normalizeInstant(arg.v) === null)
+                diagnostics.push({
+                    code: "E_INSTANT_LITERAL",
+                    severity: "error",
+                    message: "Invalid explicitly zoned millisecond instant.",
+                    help: "Use a real RFC3339 timestamp with Z or a known numeric offset and at most three fractional digits.",
+                    ...(arg.at ? { at: arg.at } : {}),
+                });
+        }
+        for (const [key, child] of Object.entries(node))
+            if (key !== "at")
+                scan(child);
+    };
+    scan(ir);
+    return diagnostics;
+};

package/dist/_internal/ir-checks/notices.d.ts

@@ -0,0 +1,4 @@
+import type * as IR from "../world-ir/types.generated.js";
+export declare const noticeHelp = "Use :of Component :document OwnDocument :to person, where person is one entity reference reached from the component's key inputs. Component paths may follow only key inputs; groups, scalar values, calls and attached subjects cannot choose a recipient.";
+/** Conservative reference paths keep identity within the owning occurrence's key closure. */
+export declare const noticeDiagnostics: (ir: Pick<IR.WorldIR, "notices" | "documents" | "components" | "types" | "roles" | "entities">) => IR.Diagnostic[];

package/dist/_internal/ir-checks/notices.js

@@ -0,0 +1,58 @@
+export const noticeHelp = "Use :of Component :document OwnDocument :to person, where person is one entity reference reached from the component's key inputs. Component paths may follow only key inputs; groups, scalar values, calls and attached subjects cannot choose a recipient.";
+/** Conservative reference paths keep identity within the owning occurrence's key closure. */
+export const noticeDiagnostics = (ir) => {
+    const errors = [], names = new Set();
+    const target = (type, seen = new Set()) => {
+        if (Array.isArray(type)) {
+            if (type[0] === "Option" || type[0] === "Brand")
+                return target(type[1], seen);
+            return type[0] === "Id" && typeof type[1] === "string" ? type[1] : undefined;
+        }
+        if (typeof type !== "string" || seen.has(type))
+            return undefined;
+        const alias = ir.types.find((a) => a.name === type);
+        return alias && target(alias.type, new Set([...seen, type]));
+    };
+    for (const n of ir.notices ?? []) {
+        const error = (code, message, at = n.at) => errors.push({ code, severity: "error", message, at, help: noticeHelp }), owner = ir.components.find((c) => c.name === n.of);
+        if (names.has(n.name))
+            error("E_NOTICE_DOCUMENT", "Notice names must be unique.");
+        names.add(n.name);
+        if (!owner || !ir.documents?.some((d) => d.name === n.document && d.of === n.of))
+            error("E_NOTICE_DOCUMENT", "A notice must select a document owned by its component.");
+        const reference = (e) => {
+            if (!owner)
+                return undefined;
+            if (e.k === "var") {
+                if (e.name === "self")
+                    return owner.name;
+                return owner.key.includes(e.name)
+                    ? target(owner.inputs.find((f) => f.name === e.name)?.type)
+                    : undefined;
+            }
+            if (e.k === "inst") {
+                const c = ir.components.find((c) => c.name === reference(e.of));
+                return c?.key.includes(e.field)
+                    ? target(c.inputs.find((f) => f.name === e.field)?.type)
+                    : undefined;
+            }
+            if (e.k === "read") {
+                const role = ir.roles.find((r) => r.name === reference(e.of) && r.name === e.role);
+                return target(role?.fields.find((f) => f.name === e.field)?.type);
+            }
+            if (e.k === "attr") {
+                const entity = ir.entities.find((x) => e.attr.startsWith(x.ns + "/")), base = reference(e.of);
+                if (!base ||
+                    !entity ||
+                    (base !== entity.name && !entity.implements.some((b) => b.role === base)))
+                    return undefined;
+                return target(entity.fields.find((f) => f.name === e.attr.slice(entity.ns.length + 1))?.type);
+            }
+            return undefined;
+        };
+        const recipient = reference(n.to);
+        if (!recipient || ![...ir.roles, ...ir.entities].some((x) => x.name === recipient))
+            error("E_NOTICE_RECIPIENT", "A notice needs one entity reference in its component's key-closed scope.", n.to.at);
+    }
+    return errors;
+};

package/dist/_internal/ir-checks/policy-bounds.d.ts

@@ -0,0 +1,5 @@
+import type { ParamBound, PolicyNumber, TypeAlias } from "../world-ir/types.generated.js";
+export declare const policyNumberValid: (value: PolicyNumber) => boolean;
+export declare const policyBoundValid: (bound: ParamBound) => boolean;
+export declare const policyValueWithin: (bound: ParamBound, value: PolicyNumber) => boolean;
+export declare const policyParameterType: (type: unknown, aliases: readonly TypeAlias[], seen?: Set<string>) => "integer" | "duration" | null;

package/dist/_internal/ir-checks/policy-bounds.js

@@ -0,0 +1,28 @@
+export const policyNumberValid = (value) => Number.isSafeInteger(value.n) &&
+    value.n >= 0 &&
+    ["integer", "days", "years", "hours", "minutes"].includes(value.unit);
+export const policyBoundValid = (bound) => [bound.min, bound.default, bound.max].every(policyNumberValid) &&
+    bound.min.unit === bound.default.unit &&
+    bound.max.unit === bound.default.unit &&
+    bound.min.n <= bound.default.n &&
+    bound.default.n <= bound.max.n &&
+    (bound.tighten === "lower"
+        ? bound.default.n === bound.max.n
+        : bound.tighten === "higher" && bound.default.n === bound.min.n);
+export const policyValueWithin = (bound, value) => policyBoundValid(bound) &&
+    policyNumberValid(value) &&
+    value.unit === bound.default.unit &&
+    value.n >= bound.min.n &&
+    value.n <= bound.max.n;
+export const policyParameterType = (type, aliases, seen = new Set()) => {
+    if (Array.isArray(type) && type[0] === "Brand")
+        return policyParameterType(type[1], aliases, seen);
+    if (type === "Int")
+        return "integer";
+    if (type === "Duration")
+        return "duration";
+    if (typeof type !== "string" || seen.has(type))
+        return null;
+    const alias = aliases.find((a) => a.name === type);
+    return alias ? policyParameterType(alias.type, aliases, new Set([...seen, type])) : null;
+};

package/dist/_internal/ir-checks/principals.d.ts

@@ -0,0 +1,26 @@
+import type { Span } from "./index.js";
+/** A structural view, shared across compiler/runtime Effect versions without services or codecs. */
+export interface PrincipalIR {
+    readonly types: readonly unknown[];
+    readonly roles: readonly unknown[];
+    readonly entities: readonly unknown[];
+    readonly components: readonly unknown[];
+    readonly derives: readonly unknown[];
+    readonly decisions?: readonly unknown[];
+}
+export type PrincipalKind = "entity" | "group";
+export interface PrincipalDiagnostic {
+    readonly code: "E_PRINCIPAL_KIND";
+    readonly severity: "error";
+    readonly message: string;
+    readonly help: string;
+    readonly at?: Span;
+}
+export declare const principalActionKey: (component: string, action: string) => string;
+export declare const principalEscalationKey: (component: string, requirement: string, index: number) => string;
+export declare const principalKinds: (ir: PrincipalIR, validateClaims?: boolean) => {
+    diagnostics: PrincipalDiagnostic[];
+    authorities: Map<string, PrincipalKind>;
+    assignees: Map<string, PrincipalKind>;
+    escalations: Map<string, PrincipalKind>;
+};

package/dist/_internal/ir-checks/principals.js

@@ -0,0 +1,162 @@
+const node = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+const array = (value) => (Array.isArray(value) ? value : []);
+const help = "Use one principal kind (entity references or groups) in every branch/union; split mixed policies into separate actions, decisions or escalation steps.";
+class KindError extends Error {
+}
+export const principalActionKey = (component, action) => JSON.stringify([component, action]);
+export const principalEscalationKey = (component, requirement, index) => JSON.stringify([component, requirement, index]);
+export const principalKinds = (ir, validateClaims = false) => {
+    const named = (values) => new Map(values.map((value) => {
+        const item = node(value);
+        return [String(item.name), item];
+    }));
+    const aliases = named(ir.types), roles = named(ir.roles), entities = named(ir.entities), components = named(ir.components), derives = named(ir.derives);
+    const field = (owner, name) => array(owner?.fields)
+        .map(node)
+        .find((f) => f.name === name)?.type;
+    const input = (owner, name) => [...array(owner?.inputs), ...array(owner?.params)].map(node).find((f) => f.name === name)?.type;
+    const unwrap = (type, seen = new Set()) => {
+        if (typeof type === "string" && aliases.has(type)) {
+            if (seen.has(type))
+                throw new KindError("Recursive principal aliases have no provable kind.");
+            return unwrap(aliases.get(type).type, new Set([...seen, type]));
+        }
+        if (Array.isArray(type) && (type[0] === "Option" || type[0] === "Brand"))
+            return unwrap(type[1], seen);
+        return type;
+    };
+    const combine = (kinds) => {
+        const distinct = new Set(kinds.filter((kind) => kind !== null));
+        if (distinct.size > 1)
+            throw new KindError("A principal expression mixes entity references and groups.");
+        return distinct.values().next().value ?? null;
+    };
+    const typeKind = (type, seen = new Set()) => {
+        if (type === null || type === "Unit")
+            return null;
+        if (typeof type === "string" && aliases.has(type)) {
+            if (seen.has(type))
+                throw new KindError("Recursive principal aliases have no provable kind.");
+            return typeKind(aliases.get(type).type, new Set([...seen, type]));
+        }
+        if (Array.isArray(type)) {
+            if (type[0] === "Option" || type[0] === "Brand")
+                return typeKind(type[1], seen);
+            if (type[0] === "Union")
+                return combine(type.slice(1).map((t) => typeKind(t, seen)));
+            if (type[0] === "Id" && (roles.has(String(type[1])) || entities.has(String(type[1]))))
+                return "entity";
+        }
+        if (typeof type === "string" &&
+            (type.startsWith(":") || ["Group", "String", "Keyword", "Date", "Status"].includes(type)))
+            return "group";
+        throw new KindError("The principal has no statically provable entity/group kind.");
+    };
+    const expressionType = (owner, e) => {
+        if (e.k === "lit")
+            return e.v === null ? null : typeof e.v === "string" ? "String" : undefined;
+        if (e.k === "kw")
+            return "Keyword";
+        if (e.k === "var") {
+            if (e.name === "self")
+                return ["Id", owner.name];
+            if (e.name === "today")
+                return "Date";
+            const found = input(owner, e.name);
+            if (found !== undefined)
+                return found;
+            if ([...array(owner.requirements), ...array(owner.outputs)].some((q) => node(q).name === e.name))
+                return "Status";
+        }
+        if (e.k === "read")
+            return field(roles.get(String(e.role)), e.field);
+        if (e.k === "attr") {
+            const attr = String(e.attr), slash = attr.indexOf("/");
+            return field([...entities.values()].find((entity) => entity.ns === attr.slice(0, slash)), attr.slice(slash + 1));
+        }
+        if (e.k === "inst") {
+            const reference = unwrap(expressionType(owner, node(e.of)));
+            if (Array.isArray(reference) && reference[0] === "Id") {
+                const component = components.get(String(reference[1]));
+                const found = input(component, e.field);
+                if (found !== undefined)
+                    return found;
+                if ([...array(component?.requirements), ...array(component?.outputs)].some((q) => node(q).name === e.field))
+                    return "Status";
+            }
+        }
+        if (e.k === "call") {
+            const derive = derives.get(String(e.fn));
+            if (derive)
+                return derive.returns;
+            if (e.fn === "members")
+                return "Group";
+            if ([
+                "earliest",
+                "latest",
+                "years-after",
+                "months-after",
+                "days-after",
+                "days-before",
+                "business-days-after",
+                "asserted-at",
+                "added-on",
+            ].includes(String(e.fn)))
+                return "Date";
+        }
+        return undefined;
+    };
+    const expressionKind = (owner, expression) => {
+        const e = node(expression);
+        if (e.k === "if")
+            return combine([expressionKind(owner, e.then), expressionKind(owner, e.else)]);
+        return typeKind(expressionType(owner, e));
+    };
+    const diagnostics = [];
+    const authorities = new Map(), assignees = new Map(), escalations = new Map();
+    const check = (owner, expression, claim, receive, entityOnly = false) => {
+        try {
+            const kind = expressionKind(owner, expression);
+            if (entityOnly && kind !== "entity")
+                throw new KindError("An excluded principal must be an entity reference.");
+            const actual = kind ?? "group";
+            if (validateClaims && claim !== undefined && claim !== actual)
+                throw new KindError("Principal-kind metadata disagrees with the declared expression type.");
+            receive(actual);
+        }
+        catch (error) {
+            if (!(error instanceof KindError))
+                throw error;
+            const at = node(expression).at;
+            diagnostics.push({
+                code: "E_PRINCIPAL_KIND",
+                severity: "error",
+                message: error.message,
+                help,
+                ...(at ? { at } : {}),
+            });
+        }
+    };
+    for (const owner of components.values())
+        for (const value of array(owner.actions)) {
+            const action = node(value);
+            if (action.assignee !== undefined)
+                check(owner, action.assignee, action.assigneeKind, (kind) => assignees.set(principalActionKey(String(owner.name), String(action.name)), kind));
+        }
+    for (const owner of components.values())
+        for (const value of array(owner.requirements)) {
+            const requirement = node(value);
+            array(requirement.escalate).forEach((value, index) => {
+                const step = node(value);
+                check(owner, step.who, step.whoKind, (kind) => escalations.set(principalEscalationKey(String(owner.name), String(requirement.name), index), kind));
+            });
+        }
+    for (const value of ir.decisions ?? []) {
+        const decision = node(value), owner = components.get(String(decision.of)) ?? {};
+        const claim = decision.byKind === "individual" ? "entity" : decision.byKind;
+        check(owner, decision.by, claim, (kind) => authorities.set(String(decision.name), kind));
+        for (const exclusion of array(decision.distinctFrom))
+            check(owner, exclusion, undefined, () => { }, true);
+    }
+    return { diagnostics, authorities, assignees, escalations };
+};

package/dist/_internal/ir-checks/prior-cycle.d.ts

@@ -0,0 +1,41 @@
+interface Span {
+    readonly src: string;
+    readonly from: number;
+    readonly to: number;
+    readonly line: number;
+    readonly col: number;
+}
+interface Citation {
+    readonly source: string;
+    readonly clause: string;
+    readonly at: Span;
+}
+export declare const priorCycleDecisionName: (component: string, requirement: string, choice: "accepted" | "declined") => string;
+/** Publish-time sugar and legacy-IR normalization share these owned operation contracts. */
+export declare const priorCycleDecisions: <E>(input: {
+    readonly component: string;
+    readonly requirement: string;
+    readonly by: E;
+    readonly byKind?: "individual" | "group";
+    readonly at: Span;
+    readonly cites?: readonly Citation[];
+}) => {
+    cites?: readonly Citation[];
+    effect: "accept" | "reject";
+    reason: readonly ["Option", "String"];
+    at: Span;
+    byKind?: "individual" | "group";
+    name: string;
+    doc: string;
+    of: string;
+    applies: string;
+    by: E;
+}[];
+/** An explicit accept policy owns the legacy confirmation syntax too. */
+export declare const priorCycleOperationName: (definitions: readonly {
+    readonly name: string;
+    readonly of: string;
+    readonly applies: string;
+    readonly effect: string;
+}[], component: string, requirement: string, choice: "accepted" | "declined") => string;
+export {};

package/dist/_internal/ir-checks/prior-cycle.js

@@ -0,0 +1,21 @@
+export const priorCycleDecisionName = (component, requirement, choice) => `$prior:${JSON.stringify([component, requirement, choice])}`;
+/** Publish-time sugar and legacy-IR normalization share these owned operation contracts. */
+export const priorCycleDecisions = (input) => ["accepted", "declined"].map((choice) => ({
+    name: priorCycleDecisionName(input.component, input.requirement, choice),
+    doc: `${choice === "accepted" ? "Accept" : "Decline"} prior-cycle evidence for ${input.component}/${input.requirement}.`,
+    of: input.component,
+    applies: input.requirement,
+    by: input.by,
+    ...(input.byKind ? { byKind: input.byKind } : {}),
+    effect: choice === "accepted" ? "accept" : "reject",
+    reason: ["Option", "String"],
+    at: input.at,
+    ...(input.cites ? { cites: input.cites } : {}),
+}));
+/** An explicit accept policy owns the legacy confirmation syntax too. */
+export const priorCycleOperationName = (definitions, component, requirement, choice) => choice === "accepted"
+    ? (definitions.find((d) => d.of === component &&
+        d.applies === requirement &&
+        d.effect === "accept" &&
+        d.name !== priorCycleDecisionName(component, requirement, "accepted"))?.name ?? priorCycleDecisionName(component, requirement, choice))
+    : priorCycleDecisionName(component, requirement, choice);