worldvm 0.0.0-stage → 0.1.0

package/dist/_internal/forma/world/lowering/recurrences.js

@@ -0,0 +1,56 @@
+import { sourceSyntax } from "../source-syntax.js";
+import {} from "@forma-language/forma/reader";
+import { children, headOf, items, LowerError, mapPairs, option, spanOf, symName, } from "./syntax.js";
+const read = (form, at) => {
+    const value = option(form, "recur");
+    if (!value)
+        return undefined;
+    const pairs = mapPairs(value), keys = pairs.map(([k]) => symName(k));
+    const every = pairs.find(([k]) => symName(k) === ":every")?.[1];
+    const from = pairs.find(([k]) => symName(k) === ":from")?.[1];
+    if (value._tag !== "Map" || keys.length !== 2 || new Set(keys).size !== 2 || !every || !from)
+        throw new LowerError("E_RECUR_SHAPE", "Recurrence requires exactly :every and :from.", at(value), "Use :recur {:every (years N) :from date}, or (days N), with a positive fixed interval.");
+    const count = items(every)[1], n = count?._tag === "Num" ? Number(count.value) : NaN;
+    const unit = headOf(every);
+    if ((unit !== "days" && unit !== "years") ||
+        items(every).length !== 2 ||
+        !Number.isSafeInteger(n) ||
+        n <= 0)
+        throw new LowerError("E_RECUR_INTERVAL", "Recurrence intervals are fixed positive day or year counts.", at(every), "Use (days N) or (years N) with a positive safe-integer literal; dynamic or sub-day intervals are not supported.");
+    const cycle = option(form, "cycle");
+    if (cycle)
+        throw new LowerError("E_RECUR_CYCLE", "A requirement cannot combine :cycle and :recur.", at(cycle), "Choose :cycle for fact-keyed occurrences or :recur for anchored calendar periods.");
+    return { every: { n, unit }, from, at: at(value) };
+};
+/** Check closed syntax before nested Expr validation so malformed maps get actionable spans. */
+export const recurrenceDiagnostics = (files) => {
+    for (const file of files) {
+        if (!file.text.includes(":recur"))
+            continue;
+        try {
+            for (const form of sourceSyntax(file).forms)
+                if (headOf(form) === "component")
+                    for (const requirement of children(form, "requirement"))
+                        read(requirement, (expr) => spanOf(file.id, expr));
+        }
+        catch (error) {
+            // The normal descriptor pass owns malformed-reader diagnostics.
+            if (!(error instanceof LowerError))
+                return [];
+            return [
+                {
+                    code: error.code,
+                    severity: "error",
+                    message: error.message,
+                    at: error.at,
+                    ...(error.help ? { help: error.help } : {}),
+                },
+            ];
+        }
+    }
+    return [];
+};
+export const lowerRecurrence = (context, declaration, form, scope) => {
+    const value = read(form, (expr) => context.at(declaration, expr));
+    return value ? { ...value, from: context.lowerExpr(declaration, value.from, scope) } : undefined;
+};

package/dist/_internal/forma/world/lowering/renewal.d.ts

@@ -0,0 +1,5 @@
+import type { ElaboratedDeclaration } from "@forma-language/forma/descriptor";
+import type { SExpr } from "@forma-language/forma/reader";
+import type * as IR from "../../../world-ir/types.generated.js";
+import type { LoweringContext } from "./context.js";
+export declare const lowerRenewal: (context: LoweringContext, declaration: ElaboratedDeclaration, form: SExpr) => IR.RenewalWindow | undefined;

package/dist/_internal/forma/world/lowering/renewal.js

@@ -0,0 +1,21 @@
+import { headOf, items, LowerError, option, symName } from "./syntax.js";
+export const lowerRenewal = (context, declaration, form) => {
+    const value = option(form, "renew-within");
+    if (!value)
+        return undefined;
+    const count = items(value)[1], n = count?._tag === "Num" ? Number(count.value) : NaN, unit = headOf(value);
+    if ((unit !== "days" && unit !== "years") ||
+        items(value).length !== 2 ||
+        !Number.isSafeInteger(n) ||
+        n < 0)
+        throw new LowerError("E_RENEW_INTERVAL", "Renewal windows are fixed nonnegative day/year counts.", context.at(declaration, value), "Use (days N) or (years N) with a nonnegative safe-integer literal; dynamic/sub-day windows are not supported.");
+    const target = option(form, "satisfied-by"), name = symName(items(target)[1]);
+    const evidence = context.byForm("evidence").find((d) => d.summary.name === name);
+    if (headOf(target) !== "valid" ||
+        items(target).length !== 2 ||
+        !evidence ||
+        context.payload(evidence).of !== declaration.summary.name ||
+        !option(context.formOf(evidence), "expires"))
+        throw new LowerError("E_RENEW_TARGET", "Renewal requires one directly named expiring evidence type owned by this component.", context.at(declaration, target), "Use :satisfied-by (valid Evidence) with :expires on that evidence; compose additional conditions as separate requirements/outputs.");
+    return { n, unit, at: context.at(declaration, value) };
+};

package/dist/_internal/forma/world/lowering/resources.d.ts

@@ -0,0 +1,6 @@
+import type { ElaboratedDeclaration } from "@forma-language/forma/descriptor";
+import type { SExpr } from "@forma-language/forma/reader";
+import type * as IR from "../../../world-ir/types.generated.js";
+import type { LoweringContext } from "./context.js";
+import { type Scope } from "./syntax.js";
+export declare const lowerResources: (context: LoweringContext, d: ElaboratedDeclaration, form: SExpr, scope: Scope) => IR.Resource[];

package/dist/_internal/forma/world/lowering/resources.js

@@ -0,0 +1,19 @@
+import { children, items, LowerError, option, symName } from "./syntax.js";
+export const lowerResources = (context, d, form, scope) => children(form, "resource").map((resource) => {
+    const call = (field) => {
+        const raw = option(resource, field);
+        if (!raw)
+            throw new LowerError("E_RESOURCE_CALL", "A resource requires acquire and release calls.", context.at(d, resource), "Use declared (connector capability) pairs for both calls.");
+        const xs = items(raw), connector = symName(xs[0]), capability = symName(xs[1]);
+        if (raw._tag !== "List" || xs.length !== 2 || !connector || !capability)
+            throw new LowerError("E_RESOURCE_CALL", "A resource call must name a connector and capability.", context.at(d, raw), "Use a declared (connector capability) pair.");
+        return { connector, capability, at: context.at(d, raw) };
+    };
+    return {
+        name: symName(items(resource)[1]),
+        acquire: call("acquire"),
+        release: call("release"),
+        releaseWhen: context.lowerExpr(d, option(resource, "release-when"), scope),
+        at: context.at(d, resource),
+    };
+});

package/dist/_internal/forma/world/lowering/reuse.d.ts

@@ -0,0 +1,5 @@
+import type { ElaboratedDeclaration } from "@forma-language/forma/descriptor";
+import type { SExpr } from "@forma-language/forma/reader";
+import type * as IR from "../../../world-ir/types.generated.js";
+import type { LoweringContext } from "./context.js";
+export declare const lowerReuse: (cx: LoweringContext, d: ElaboratedDeclaration, form: SExpr) => IR.Reuse | undefined;

package/dist/_internal/forma/world/lowering/reuse.js

@@ -0,0 +1,75 @@
+import { principalActionKey, principalKinds } from "../../../ir-checks/index.js";
+import { headOf, items, LowerError, mapPairs, option, symName } from "./syntax.js";
+export const lowerReuse = (cx, d, form) => {
+    const value = option(form, "reuse");
+    if (!value)
+        return undefined;
+    const owner = d.summary.name, component = cx.components.get(owner);
+    const fail = (code, syntax, message, help) => {
+        throw new LowerError(code, message, cx.at(d, syntax), help);
+    };
+    const pairs = mapPairs(value), fields = new Map(pairs.map(([k, v]) => [symName(k), v]));
+    const scope = fields.get(":scope"), within = fields.get(":within"), confirm = fields.get(":confirm");
+    const scopeHelp = "Use a nonempty vector of distinct component key inputs including its direct entity home, for example [employee] in a component keyed by [employee employer]. Do not scan entities or read mutable facts for scope.";
+    if (value._tag !== "Map" ||
+        fields.size !== pairs.length ||
+        [...fields.keys()].some((k) => ![":scope", ":within", ":confirm"].includes(k ?? "")) ||
+        !scope ||
+        !within)
+        return fail("E_REUSE_SCOPE", value, "Reuse requires :scope and :within, with optional :confirm only.", scopeHelp);
+    const names = items(scope).map(symName), home = cx.homeOf(owner);
+    if (scope._tag !== "Vector" ||
+        !names.length ||
+        new Set(names).size !== names.length ||
+        names.some((n) => !n || !component.key.includes(n)) ||
+        home.path.length !== 1 ||
+        !names.includes(home.path[0]))
+        return fail("E_REUSE_SCOPE", scope, "Reuse scope must be stable, unique and contain its entity home.", scopeHelp);
+    const nValue = items(within)[1], n = nValue?._tag === "Num" ? Number(nValue.value) : NaN, unit = headOf(within);
+    if (!["days", "years", "hours", "minutes"].includes(unit ?? "") ||
+        items(within).length !== 2 ||
+        !Number.isSafeInteger(n) ||
+        n <= 0)
+        return fail("E_REUSE_INTERVAL", within, "Reuse needs a positive fixed safe-integer window.", "Use (days N), (years N), (hours N) or (minutes N) with a positive safe-integer literal.");
+    const proof = option(form, "satisfied-by"), evidenceName = symName(items(proof)[1]);
+    const evidence = cx.byForm("evidence").find((e) => e.summary.name === evidenceName);
+    if (!["attested", "valid"].includes(headOf(proof) ?? "") ||
+        items(proof).length !== 2 ||
+        !evidence ||
+        cx.payload(evidence).of !== owner ||
+        ["accepts", "cycle", "recur", "renew-within"].some((k) => option(form, k)))
+        return fail("E_REUSE_TARGET", value, "Reuse needs one direct owned proof in an ordinary requirement context.", "Use (attested Evidence) or (valid Evidence) owned by this component; keep prior-cycle, recurrence and renewal in separate requirements.");
+    const env = cx.componentScope(owner);
+    let confirmation = {};
+    if (confirm) {
+        const expr = cx.lowerExpr(d, confirm, env);
+        const path = (e) => e.k === "var"
+            ? component.key.includes(e.name)
+            : e.k === "read" || e.k === "attr"
+                ? path(e.of)
+                : false;
+        const target = expr.k === "call" && expr.fn === "members" && expr.args.length === 1 ? expr.args[0] : expr;
+        if (!path(target))
+            return fail("E_REUSE_CONFIRM", confirm, "Confirmation must name a principal through keyed entity references.", "Use a keyed person or a group field such as employer.reviewers; literal labels and status/computed principals are unsupported.");
+        const kinds = principalKinds({
+            types: cx.authoredTypes,
+            derives: [],
+            roles: cx.byForm("role").map((e) => ({ name: e.summary.name, ...cx.payload(e) })),
+            entities: cx
+                .byForm("entity")
+                .map((e) => ({ name: e.summary.name, ...cx.payload(e) })),
+            components: [{ ...component, name: owner, actions: [{ name: "$reuse", assignee: expr }] }],
+        });
+        const kind = kinds.assignees.get(principalActionKey(owner, "$reuse"));
+        if (!kind || kinds.diagnostics.length)
+            return fail("E_REUSE_CONFIRM", confirm, "Confirmation has no proven principal kind.", "Use a keyed person or a group field such as employer.reviewers.");
+        confirmation = { confirm: expr, confirmKind: kind };
+    }
+    const expressions = items(scope).map((e) => cx.lowerExpr(d, e, env));
+    return {
+        scope: [expressions[0], ...expressions.slice(1)],
+        within: { n, unit: unit, at: cx.at(d, within) },
+        ...confirmation,
+        at: cx.at(d, value),
+    };
+};

package/dist/_internal/forma/world/lowering/sources.d.ts

@@ -0,0 +1,10 @@
+import { type ElaboratedDeclaration } from "@forma-language/forma/descriptor";
+import { type SExpr } from "@forma-language/forma/reader";
+import type * as IR from "../../../world-ir/types.generated.js";
+import { type SyntaxContext } from "./context.js";
+export declare const sourceContext: (context: SyntaxContext) => {
+    references: IR.Source[];
+    citations: (d: ElaboratedDeclaration, form: SExpr) => {
+        cites?: readonly IR.Citation[];
+    };
+};

package/dist/_internal/forma/world/lowering/sources.js

@@ -0,0 +1,47 @@
+import {} from "@forma-language/forma/descriptor";
+import {} from "@forma-language/forma/reader";
+import {} from "./context.js";
+import { items, LowerError, option, symName } from "./syntax.js";
+export const sourceContext = (context) => {
+    const { byForm, payload, at, formOf } = context;
+    const references = byForm("source").map((d) => {
+        const p = payload(d);
+        const date = p["as-of"], parsed = new Date(`${date}T00:00:00Z`);
+        if (!/^\d{4}-\d{2}-\d{2}$/.test(date) ||
+            !Number.isFinite(parsed.getTime()) ||
+            parsed.toISOString().slice(0, 10) !== date)
+            throw new LowerError("E_SOURCE_DATE", "Source :as-of must be a real YYYY-MM-DD date.", at(d, option(formOf(d), "as-of")), "Use a real calendar date in YYYY-MM-DD form; record when the source was reviewed.");
+        return {
+            name: d.summary.name,
+            ...(p.doc ? { doc: p.doc } : {}),
+            kind: p["source-kind"],
+            ...(p.jurisdiction ? { jurisdiction: p.jurisdiction } : {}),
+            url: p.url,
+            asOf: date,
+            at: at(d, formOf(d)),
+        };
+    });
+    const sourceNames = new Set(references.map((s) => s.name));
+    const citations = (d, form) => {
+        const node = option(form, "cites");
+        if (!node)
+            return {};
+        const help = 'Use :cites [(named-source "specific clause")] with a declared source.';
+        if (node._tag !== "Vector")
+            throw new LowerError("E_CITATION", ":cites must be a vector of source/clause pairs.", at(d, node), help);
+        const cites = node.items.map((item) => {
+            const pair = items(item), name = symName(pair[0]), clause = pair[1];
+            if (item._tag !== "List" ||
+                pair.length !== 2 ||
+                !name ||
+                clause?._tag !== "Str" ||
+                !clause.value.trim())
+                throw new LowerError("E_CITATION", "A citation names a source and a nonempty clause string.", at(d, item), help);
+            if (!sourceNames.has(name))
+                throw new LowerError("E_UNKNOWN_SOURCE", `Unknown cited source ${name}.`, at(d, pair[0]), "Declare the source with (source name ...), then cite its specific clause.");
+            return { source: name, clause: clause.value, at: at(d, item) };
+        });
+        return cites.length ? { cites } : {};
+    };
+    return { references, citations };
+};

package/dist/_internal/forma/world/lowering/syntax.d.ts

@@ -0,0 +1,84 @@
+import { type SExpr } from "@forma-language/forma/reader";
+import type * as IR from "../../../world-ir/types.generated.js";
+export declare const KERNEL_FUNCTIONS: Set<string>;
+export declare class LowerError extends Error {
+    readonly code: string;
+    readonly at: IR.Span;
+    readonly help?: string | undefined;
+    constructor(code: string, message: string, at: IR.Span, help?: string | undefined);
+}
+export type Sym = Extract<SExpr, {
+    _tag: "Sym";
+}>;
+export type ListNode = Extract<SExpr, {
+    _tag: "List";
+}>;
+export declare const isSym: (e: SExpr | undefined) => e is Sym;
+export declare const symName: (e: SExpr | undefined) => string | undefined;
+export declare const items: (e: SExpr | undefined) => readonly SExpr[];
+export declare const headOf: (e: SExpr | undefined) => string | undefined;
+export declare const option: (e: SExpr | undefined, key: string) => SExpr | undefined;
+export declare const childNamed: (e: SExpr, head: string, name: string) => SExpr;
+export declare const children: (e: SExpr, head: string) => SExpr[];
+export declare const mapPairs: (e: SExpr | undefined) => readonly (readonly [SExpr, SExpr])[];
+export type SType = {
+    readonly t: "role";
+    readonly name: string;
+} | {
+    readonly t: "entity";
+    readonly name: string;
+} | {
+    readonly t: "inst";
+    readonly name: string;
+} | {
+    readonly t: "list";
+    readonly of: SType;
+} | {
+    readonly t: "status";
+} | {
+    readonly t: "machine";
+} | {
+    readonly t: "value";
+};
+export declare const VALUE: SType;
+export declare const spanOf: (src: string, e: SExpr) => IR.Span;
+export declare const typeRef: (e: SExpr) => IR.TypeRef;
+export type Fields = ReadonlyArray<{
+    name: string;
+    type: IR.TypeRef;
+}>;
+export interface ComponentPayload {
+    doc?: string;
+    key: string[];
+    inputs: Fields;
+    params: Fields;
+    requirements: ReadonlyArray<{
+        name: string;
+        label?: string;
+    }>;
+    actions: ReadonlyArray<{
+        name: string;
+        label?: string;
+        advances: string | readonly string[];
+    }>;
+    slots: ReadonlyArray<{
+        mode: "child" | "attach";
+        name: string;
+        component: string;
+    }>;
+    outputs: ReadonlyArray<{
+        name: string;
+        label?: string;
+    }>;
+    machines: ReadonlyArray<{
+        name: string;
+        protocol: string;
+    }>;
+    invariants: ReadonlyArray<{
+        name: string;
+    }>;
+    retention: ReadonlyArray<{
+        disposal: string;
+    }>;
+}
+export type Scope = ReadonlyMap<string, SType>;

package/dist/_internal/forma/world/lowering/syntax.js

@@ -0,0 +1,94 @@
+import {} from "@forma-language/forma/reader";
+export const KERNEL_FUNCTIONS = new Set([
+    "=",
+    "table",
+    "instant",
+    "hours-after",
+    "minutes-after",
+    "hours",
+    "minutes",
+    "not=",
+    "<",
+    "<=",
+    ">",
+    ">=",
+    "in?",
+    "all?",
+    "any?",
+    "negate",
+    "true?",
+    "false?",
+    "unknown?",
+    "known?",
+    "earliest",
+    "latest",
+    "days",
+    "years",
+    "months",
+    "years-after",
+    "months-after",
+    "days-after",
+    "days-before",
+    "business-days-after",
+    "before?",
+    "on-or-after?",
+    "asserted-at",
+    "spells",
+    "attested",
+    "resource-generation",
+    "entered-at",
+    "attested-for",
+    "notice-delivered?",
+    "notice-acknowledged?",
+    "valid",
+    "decided",
+    "added-on",
+    "status-is?",
+    "satisfied?",
+    "met?",
+    "carried-over?",
+    "started?",
+    "final?",
+    "in-state?",
+    "members",
+    "map",
+    "filter",
+    "count",
+]);
+export class LowerError extends Error {
+    code;
+    at;
+    help;
+    constructor(code, message, at, help) {
+        super(message);
+        this.code = code;
+        this.at = at;
+        this.help = help;
+    }
+}
+export const isSym = (e) => e?._tag === "Sym";
+export const symName = (e) => isSym(e) ? e.name : undefined;
+export const items = (e) => e && (e._tag === "List" || e._tag === "Vector") ? e.items : [];
+export const headOf = (e) => e?._tag === "List" ? symName(e.items[0]) : undefined;
+export const option = (e, key) => {
+    const list = items(e);
+    const index = list.findIndex((x) => symName(x) === `:${key}`);
+    return index >= 0 ? list[index + 1] : undefined;
+};
+export const childNamed = (e, head, name) => {
+    const found = items(e).find((x) => headOf(x) === head && symName(items(x)[1]) === name);
+    if (!found)
+        throw new Error(`Missing (${head} ${name}) in syntax`);
+    return found;
+};
+export const children = (e, head) => items(e).filter((x) => headOf(x) === head);
+export const mapPairs = (e) => (e?._tag === "Map" ? e.pairs : []);
+export const VALUE = { t: "value" };
+export const spanOf = (src, e) => ({
+    src,
+    from: e.loc.start,
+    to: e.loc.end,
+    line: e.loc.line,
+    col: e.loc.col,
+});
+export const typeRef = (e) => e._tag === "List" || e._tag === "Vector" ? e.items.map(typeRef) : isSym(e) ? e.name : String(e);

package/dist/_internal/forma/world/lowering/vaults.d.ts

@@ -0,0 +1,11 @@
+import type { ElaboratedDeclaration } from "@forma-language/forma/descriptor";
+import type * as IR from "../../../world-ir/types.generated.js";
+import type { SourceFile } from "../compile.js";
+import type { LoweringContext } from "./context.js";
+/** Invalid keys must be located before selecting the native expression scope. */
+export declare const vaultSourceDiagnostics: (files: readonly SourceFile[]) => IR.Diagnostic[];
+export declare const lowerRecordSeal: (cx: LoweringContext, d: ElaboratedDeclaration) => {
+    sealedBy?: IR.Seal;
+};
+export declare const lowerSealedFields: <F extends IR.Field>(cx: LoweringContext, d: ElaboratedDeclaration, fields: readonly F[]) => F[];
+export declare const lowerVaults: (cx: LoweringContext, model: Pick<IR.WorldIR, "types" | "roles" | "entities" | "components" | "derives">) => IR.Vault[];

package/dist/_internal/forma/world/lowering/vaults.js

@@ -0,0 +1,148 @@
+import { sourceSyntax } from "../source-syntax.js";
+import {} from "@forma-language/forma/reader";
+import { sensitiveClasses, vaultHelp, vaultAuthority } from "../../../ir-checks/index.js";
+import { headOf, items, mapPairs, option, symName, spanOf, LowerError } from "./syntax.js";
+/** Invalid keys must be located before selecting the native expression scope. */
+export const vaultSourceDiagnostics = (files) => {
+    if (!files.some((f) => f.text.includes("vault")))
+        return [];
+    const forms = files.flatMap((file) => {
+        const parsed = sourceSyntax(file);
+        return parsed.errors.length ? [] : parsed.forms.map((node) => ({ file, node }));
+    }), diagnostics = [], names = new Set();
+    for (const { file, node } of forms.filter(({ node }) => headOf(node) === "vault")) {
+        const parts = items(node), name = symName(parts[1]) ?? "", seen = new Set();
+        if (!name)
+            continue;
+        if (names.has(name))
+            diagnostics.push({
+                code: "E_VAULT_POLICY",
+                severity: "error",
+                message: "Vault names must be unique.",
+                at: spanOf(file.id, parts[1]),
+                help: vaultHelp,
+            });
+        names.add(name);
+        for (let i = parts[2]?._tag === "Str" ? 3 : 2; i < parts.length; i += 2) {
+            const key = symName(parts[i]) ?? "";
+            if (!parts[i + 1] ||
+                ![":key", ":holds", ":retain", ":cites", ":erasure", ":dispose"].includes(key) ||
+                seen.has(key))
+                diagnostics.push({
+                    code: "E_VAULT_POLICY",
+                    severity: "error",
+                    message: "Vault options must be supported, unique pairs.",
+                    at: spanOf(file.id, parts[i]),
+                    help: vaultHelp,
+                });
+            seen.add(key);
+        }
+        const key = option(node, "key"), keyParts = items(key), kind = headOf(key), target = symName(keyParts[1]);
+        const valid = keyParts.length === 2 &&
+            target &&
+            ["per-occurrence", "per-subject"].includes(kind ?? "") &&
+            forms.some(({ node }) => headOf(node) === (kind === "per-occurrence" ? "component" : "role") &&
+                symName(items(node)[1]) === target);
+        if (!valid)
+            diagnostics.push({
+                code: "E_VAULT_SCOPE",
+                severity: "error",
+                message: "Choose a declared component or role for the vault key.",
+                at: spanOf(file.id, kind === "per-occurrence" && target ? keyParts[1] : (key ?? node)),
+                help: vaultHelp,
+            });
+    }
+    return diagnostics;
+};
+export const lowerRecordSeal = (cx, d) => {
+    const node = option(cx.formOf(d), "sealed-by");
+    if (!node)
+        return {};
+    const vault = symName(node);
+    if (!vault || vault.startsWith(":"))
+        throw new LowerError("E_VAULT_SEAL", "A record seal names one vault.", cx.at(d, node), vaultHelp);
+    return { sealedBy: { vault, at: cx.at(d, node) } };
+};
+export const lowerSealedFields = (cx, d, fields) => {
+    const node = option(cx.formOf(d), "sealed-by");
+    if (!node)
+        return [...fields];
+    const fail = (at) => {
+        throw new LowerError("E_VAULT_SEAL", "Use a unique field-to-vault map over declared fields.", cx.at(d, at), vaultHelp);
+    };
+    if (node._tag !== "Map")
+        return fail(node);
+    const seals = new Map();
+    for (const [key, value] of mapPairs(node)) {
+        const field = symName(key)?.replace(/^:/, ""), vault = symName(value);
+        if (!field || !fields.some((f) => f.name === field) || seals.has(field))
+            return fail(key);
+        if (!vault || vault.startsWith(":"))
+            return fail(value);
+        seals.set(field, { vault, at: cx.at(d, value) });
+    }
+    return fields.map((f) => (seals.has(f.name) ? { ...f, sealedBy: seals.get(f.name) } : f));
+};
+export const lowerVaults = (cx, model) => cx.byForm("vault").map((d) => {
+    const form = cx.formOf(d), fail = (code, node, message) => {
+        throw new LowerError(code, message, cx.at(d, node ?? form), vaultHelp);
+    }, key = option(form, "key"), target = symName(items(key)[1]), kind = headOf(key) === "per-occurrence" ? "occurrence" : "subject", scope = kind === "occurrence"
+        ? cx.componentScope(target)
+        : new Map([
+            ["subject", { t: "role", name: target }],
+            ["today", { t: "value" }],
+            ["now", { t: "value" }],
+        ]), holds = option(form, "holds"), retain = option(form, "retain"), erasure = option(form, "erasure"), dispose = option(form, "dispose"), quorum = option(dispose, "approvals"), by = option(dispose, "by");
+    if (holds?._tag !== "Vector" || !holds.items.length)
+        return fail("E_VAULT_POLICY", holds, "Declare nonempty held classes.");
+    const classes = [];
+    for (const node of holds.items) {
+        const value = symName(node)?.slice(1);
+        if (!symName(node)?.startsWith(":") || !sensitiveClasses.some((c) => c === value))
+            return fail("E_VAULT_POLICY", node, "Use a supported literal class.");
+        classes.push(value);
+    }
+    if (new Set(classes).size !== classes.length)
+        return fail("E_VAULT_POLICY", holds, "Held classes must be unique.");
+    if (!retain)
+        return fail("E_VAULT_POLICY", form, "Declare a finite retention date.");
+    const cites = cx.citations(d, form).cites;
+    if (!cites?.length)
+        return fail("E_VAULT_UNCITED", form, "Vault retention needs cited authority.");
+    const erasureKind = symName(erasure)?.slice(1);
+    if (erasureKind !== "on-request" && erasureKind !== "held-until-retained")
+        return fail("E_VAULT_POLICY", erasure, "Choose a supported erasure policy.");
+    const disposalParts = items(dispose), disposalOptions = [symName(disposalParts[2]), symName(disposalParts[4])];
+    if (headOf(dispose) !== "decision" ||
+        !symName(disposalParts[1]) ||
+        symName(disposalParts[1]).startsWith(":") ||
+        !by ||
+        disposalParts.length !== 6 ||
+        new Set(disposalOptions).size !== 2 ||
+        disposalOptions.some((k) => k !== ":by" && k !== ":approvals"))
+        return fail("E_VAULT_POLICY", dispose, "Declare a named disposal decision with unique authority and approval options.");
+    if (quorum?._tag !== "Num" ||
+        !Number.isSafeInteger(Number(quorum.value)) ||
+        Number(quorum.value) < 1)
+        return fail("E_VAULT_POLICY", quorum ?? dispose, "Use a positive fixed approval count.");
+    const policyKey = { kind, target, at: cx.at(d, key) }, authority = cx.lowerExpr(d, by, scope), checked = vaultAuthority(model, policyKey, authority);
+    if (!checked.kind || checked.diagnostics.length)
+        return fail("E_VAULT_AUTHORITY", by, "Use one proven entity or group authority.");
+    return {
+        name: d.summary.name,
+        ...cx.docOf(cx.payload(d).doc),
+        key: policyKey,
+        holds: classes.sort(),
+        retain: cx.lowerExpr(d, retain, scope),
+        cites: cites,
+        erasure: { kind: erasureKind, at: cx.at(d, erasure) },
+        dispose: {
+            name: symName(items(dispose)[1]),
+            by: authority,
+            byKind: checked.kind === "entity" ? "individual" : "group",
+            approvals: Number(quorum.value),
+            at: cx.at(d, dispose),
+        },
+        at: cx.at(d, form),
+    };
+});

package/dist/_internal/forma/world/prelude.generated.d.ts

@@ -0,0 +1 @@
+export declare const worldPrelude: string;