@affiant/core 0.1.0-alpha.0

package/dist/model/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/model/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,0FAA0F;AAC1F,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAMjC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,iGAQkB,CAAC;AAUjD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAEhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAEjE;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CAC5C;AAED;;;GAGG;AACH,MAAM,MAAM,OAAO,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAC;AAEvE,2CAA2C;AAC3C,eAAO,MAAM,aAAa,8FAMqB,CAAC;AAEhD,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,cAAc,GAAG,iBAAiB,CAAA;CAAE,CAAC,CAAC;AAMhG;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,kCAAkC;AAClC,UAAU,UAAU;IAClB,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED,0FAA0F;AAC1F,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAe9C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAU9D;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,UAAU,CAAC;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CAQf;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAE7E;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAEzE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,aAAa,CAE9E;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAExD;AAMD,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,eAAe,CAE3D;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,GAAG,eAAe,CAKtF;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,eAAe,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,aAAa,EAAE,CAEvE"}

package/dist/model/provenance.js

@@ -0,0 +1,223 @@
+/**
+ * Provenance: the seven-source ladder, the tag, the binding that makes a tag
+ * checkable, the chain that keeps every superseded tag, and the merge rule.
+ *
+ * **Rules served: PV-1** (the ladder, the chain, confidence-first /
+ * determinism-second merge, confidence clamped into `[0, 1]`), **PV-2** (a tag
+ * above `Conversation` carries a binding, and the binding kinds are a fixed set),
+ * **PV-3** (an implementation's own inference never mints `UserStated`), **PV-5**
+ * (no wire type raises a grade: an asserted grade above `Conversation` with no
+ * binding is carried on the record but is not honourable).
+ *
+ * The idea in one paragraph: a value on an Affidavit is worth exactly what its
+ * evidence is worth. A provenance tag says where the value came from
+ * ({@link ProvenanceSource}), how confident its producer was, and — for the grades
+ * that claim more than "a model read it in the conversation" — a {@link Binding}:
+ * a pointer at something an auditor can go and check years later. A tag with no
+ * binding is not a lie, it is a weaker claim, and the framework's job is to keep
+ * the difference visible rather than to average it away.
+ *
+ * Nothing here reads a clock. Every function that stamps a time takes the instant
+ * as a parameter, so a fixture can pin it (RT-1, and the same reason the clock is
+ * a port rather than a call to `Date.now()`).
+ *
+ * @packageDocumentation
+ */
+// ---------------------------------------------------------------------------
+// The ladder (PV-1)
+// ---------------------------------------------------------------------------
+/**
+ * The seven provenance sources, **most deterministic first**.
+ *
+ * This order is not a preference, it is the tie-breaker: when two tags carry equal
+ * confidence the one nearer the front of this list wins the merge (PV-1). Read it
+ * as a claim about who could re-derive the value — the person said it; a system of
+ * record holds it; a named rule computes it; it was literally present in the
+ * conversation; a model reasoned to it; a default filled it in; nobody knows.
+ *
+ * Spelled out here rather than re-exported from `@affiant/contract` so the gate's
+ * ordering is a fact of the gate. `test/provenance.test.ts` asserts the two lists
+ * are identical, which is what keeps them from drifting apart.
+ */
+export const PROVENANCE_LADDER = [
+    "UserStated",
+    "External",
+    "Computed",
+    "Conversation",
+    "Inferred",
+    "Default",
+    "Empty",
+];
+/** Rank by position in {@link PROVENANCE_LADDER}, computed once. */
+const RANK = Object.freeze(Object.fromEntries(PROVENANCE_LADDER.map((source, index) => [source, index])));
+/**
+ * How deterministic `source` is: `0` for `UserStated`, `6` for `Empty`.
+ *
+ * **Lower is more deterministic.** The number is an index into
+ * {@link PROVENANCE_LADDER}, so it is a comparison key and nothing else — never a
+ * score, never a weight, never something to multiply a confidence by.
+ */
+export function determinismRank(source) {
+    return RANK[source];
+}
+/**
+ * Whether a tag with this source must carry a {@link Binding} to be worth its grade
+ * (PV-2): the three sources **above** `Conversation` — `UserStated`, `External`,
+ * `Computed`.
+ *
+ * At or below `Conversation` the grade already says "this came from the turn, or
+ * from a model reading the turn", and the turn is itself the artifact. Above it,
+ * the tag claims an artifact outside the conversation, and a claim with no pointer
+ * at that artifact is not checkable — see {@link isBound} and PV-4, where the pair
+ * decides whether a person-free approval may rest on the tag.
+ */
+export function requiresBinding(source) {
+    return determinismRank(source) < determinismRank("Conversation");
+}
+/** Every {@link Binding} kind, as data. */
+export const BINDING_KINDS = [
+    "utterance-span",
+    "reviewer-act",
+    "form-input",
+    "external-ref",
+    "computation-ref",
+];
+/**
+ * Clamp a producer-reported confidence into `[0, 1]` (PV-1).
+ *
+ * `NaN` becomes `0`: a number that is not a number is not a claim, and the shipped
+ * .NET inference step floors at 0 without capping, which is the defect this closes.
+ */
+function clampConfidence(confidence) {
+    if (Number.isNaN(confidence))
+        return 0;
+    if (confidence < 0)
+        return 0;
+    if (confidence > 1)
+        return 1;
+    return confidence;
+}
+/**
+ * Mint a tag for any source, clamping the confidence into `[0, 1]` (PV-1).
+ *
+ * A tag whose source is `Empty` is forced to confidence `0`: "nobody knows where
+ * this came from" cannot also be a confident claim, and AF-2 counts every `Empty`
+ * field as `0` in the aggregate anyway — forcing it here means the two can never
+ * disagree.
+ *
+ * This is the general minting surface, used by deterministic interceptors, by the
+ * projection step and by a reviewer's amendment. **It is not the surface the
+ * inference step gets:** PV-3 forbids an implementation's own inference from
+ * minting `UserStated`, so the inference step is handed {@link mintInference},
+ * whose source parameter is typed {@link InferenceSource} and cannot name it.
+ */
+export function mintTag(options) {
+    const confidence = options.source === "Empty" ? 0 : clampConfidence(options.confidence);
+    return {
+        source: options.source,
+        confidence,
+        note: options.note ?? null,
+        at: options.at,
+        conversationTurn: options.conversationTurn ?? null,
+        binding: options.binding ?? null,
+    };
+}
+/**
+ * Mint a tag from the inference step. The source parameter is
+ * {@link InferenceSource}, so `UserStated` is a compile error here (PV-3).
+ *
+ * The runtime guard exists for callers with no type-checker — a JavaScript host, a
+ * value cast at the boundary — because PV-3 is a rule about what the record may
+ * say, not about what TypeScript can see.
+ *
+ * @throws RangeError if `source` is anything but `Conversation` or `Inferred`.
+ */
+export function mintInference(source, options) {
+    if (source !== "Conversation" && source !== "Inferred") {
+        throw new RangeError(`PV-3: inference may mint only "Conversation" or "Inferred", not ${JSON.stringify(source)}; ` +
+            `"UserStated" is an observation of a person's act, never the host vouching for its own value`);
+    }
+    return mintTag({ ...options, source });
+}
+/** {@link mintInference} with source `Conversation`: the value was literally in the turn. */
+export function mintConversation(options) {
+    return mintInference("Conversation", options);
+}
+/** {@link mintInference} with source `Inferred`: the model reasoned to the value. */
+export function mintInferred(options) {
+    return mintInference("Inferred", options);
+}
+/**
+ * The tag a field carries when nobody knows where its value came from: source
+ * `Empty`, confidence `0` (AF-1 — present and tagged, never omitted).
+ */
+export function emptyTag(at, note = null) {
+    return mintTag({ source: "Empty", confidence: 0, at, note });
+}
+/** Whether `tag` points at something an auditor can check (PV-2). */
+export function isBound(tag) {
+    return tag.binding !== null && tag.binding !== undefined;
+}
+/**
+ * Whether `tag`'s grade is one a person-free verdict may rest on: either the grade
+ * needs no binding, or it has one (PV-4, PV-5).
+ *
+ * The unhonourable case is exactly the one PV-5 names: a caller asserts
+ * `UserStated` on the wire and points at nothing. The tag is still recorded — the
+ * record says what the caller claimed — but a Standing Order that predicates on it
+ * falls back to asking a person.
+ */
+export function isHonourable(tag) {
+    return !requiresBinding(tag.source) || isBound(tag);
+}
+// ---------------------------------------------------------------------------
+// Chains and the merge rule (PV-1)
+// ---------------------------------------------------------------------------
+/** A fresh chain holding one tag and no history. */
+export function chainOf(tag) {
+    return { current: tag, prior: [] };
+}
+/**
+ * Whether `challenger` beats `incumbent`: higher confidence first, ties broken
+ * toward the more deterministic source (PV-1).
+ *
+ * An exact tie — same confidence, same source — leaves the incumbent in force. It
+ * was there first and the challenger brings nothing new; the challenger is still
+ * preserved in the chain, so the fact that two producers agreed is on the record.
+ */
+function beats(challenger, incumbent) {
+    if (challenger.confidence !== incumbent.confidence) {
+        return challenger.confidence > incumbent.confidence;
+    }
+    return determinismRank(challenger.source) < determinismRank(incumbent.source);
+}
+/**
+ * Merge `incoming` into `chain` (PV-1): the higher confidence wins, ties break
+ * toward the more deterministic source, **and the loser is preserved** at the head
+ * of `prior`.
+ *
+ * This is the step where a deterministic interceptor's `External` value displaces
+ * a model's guess, or fails to. Either way both tags survive, so a card can show a
+ * reviewer that the model said one thing and the system of record said another.
+ */
+export function merge(chain, incoming) {
+    if (beats(incoming, chain.current)) {
+        return { current: incoming, prior: [chain.current, ...chain.prior] };
+    }
+    return { current: chain.current, prior: [incoming, ...chain.prior] };
+}
+/**
+ * Put `tag` in force unconditionally, pushing the tag it displaces onto `prior`.
+ *
+ * Not a merge: a reviewer's amendment is not a confidence contest it might lose
+ * (AF-4, PV-2). When a person corrects a field, their act is the provenance of the
+ * new value even if the machine was more sure of the old one.
+ */
+export function supersede(chain, tag) {
+    return { current: tag, prior: [chain.current, ...chain.prior] };
+}
+/** Every tag in `chain`, in force first and then oldest-displaced last. */
+export function tagsOf(chain) {
+    return [chain.current, ...chain.prior];
+}
+//# sourceMappingURL=provenance.js.map

package/dist/model/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/model/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY;IACZ,UAAU;IACV,UAAU;IACV,cAAc;IACd,UAAU;IACV,SAAS;IACT,OAAO;CACuC,CAAC;AAEjD,oEAAoE;AACpE,MAAM,IAAI,GAA+C,MAAM,CAAC,MAAM,CACpE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAG3E,CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAwB;IACtD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,MAAwB;IACtD,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;AACnE,CAAC;AA2GD,2CAA2C;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,cAAc;IACd,iBAAiB;CAC4B,CAAC;AAgFhD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,OAAO,CAAC,OAAuB;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC1B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;KACjC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAuB,EACvB,OAA6B;IAE7B,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAClB,mEAAmE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;YAC3F,6FAA6F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,OAA6B;IAC5D,OAAO,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,OAA6B;IACxD,OAAO,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAU,EAAE,OAAsB,IAAI;IAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,OAAO,CAAC,GAAkB;IACxC,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,UAAU,OAAO,CAAC,GAAkB;IACxC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,UAAyB,EAAE,SAAwB;IAChE,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;IACtD,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAC,KAAsB,EAAE,QAAuB;IACnE,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAsB,EAAE,GAAkB;IAClE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,MAAM,CAAC,KAAsB;IAC3C,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/ports.d.ts

@@ -0,0 +1,269 @@
+/**
+ * The ports a host supplies. Types only — this module has no runtime behaviour
+ * beyond {@link defaultClock}.
+ *
+ * **Rules served: GT-1** (the pipeline runs in protocol order, and every step it
+ * cannot do itself is a port), **GT-5** (a Standing Order that declares a risk
+ * threshold is compared against a host-supplied scorer), **AZ-2** (decision
+ * authorization is the host's answer, and the gate fails closed on it), **CV-1**
+ * (a port the gate needs and does not have is a wire-up failure, not a runtime
+ * surprise), **GT-2** (every port method that needs to know who is asking is
+ * handed the {@link TurnContext}; none of them may go looking).
+ *
+ * The shape of this file is the framework's central claim: **the core ships no
+ * model client, no scoring formula, no executor and no store.** It decides *what
+ * must be sworn to and who must agree*, and it asks the host for everything else.
+ * That is what lets one gate sit in front of any model, any database and any
+ * approval surface — and it is why a host cannot accidentally end up with a gate
+ * that scores its own risk or executes its own writes.
+ *
+ * @packageDocumentation
+ */
+import type { Principal, TurnContext, Turn } from "./context.js";
+import type { DocketEntry } from "./docket/entry.js";
+import type { Affidavit, JsonValue } from "./model/affidavit.js";
+import type { InterceptorBinding } from "./model/provenance.js";
+export type { TelemetryPort, TelemetryEvent, TelemetryAttributes } from "./telemetry.js";
+/**
+ * The bindings a deterministic interceptor may mint, re-exported from the model.
+ *
+ * The type lives in `model/provenance.ts` with the other four binding kinds (PV-2);
+ * it is re-exported here because an interceptor is a port, and a host writing one
+ * should not have to know which module the binding came from.
+ */
+export type { InterceptorBinding };
+/**
+ * The write being proposed, named the way the host names it.
+ *
+ * `create` carries no `entityId` because none exists yet; `update` always carries
+ * one. That is the distinction the projection step turns into `previousValue:
+ * null` on every field of a create (AF-3), so it is spelled as a discriminated
+ * union rather than a nullable string a caller could get wrong.
+ */
+export type Operation = {
+    /** A new entity. */
+    readonly kind: "create";
+    /** The kind of domain entity being written, named by the host. */
+    readonly entityType: string;
+    /** Always `null` for a create — no identifier exists yet. */
+    readonly entityId: null;
+    /** The names of the fields being proposed. */
+    readonly fields: readonly string[];
+} | {
+    /** An existing entity. */
+    readonly kind: "update";
+    /** The kind of domain entity being written, named by the host. */
+    readonly entityType: string;
+    /** The identifier of the entity being written. Never `null` for an update. */
+    readonly entityId: string;
+    /** The names of the fields being proposed. */
+    readonly fields: readonly string[];
+};
+/**
+ * What a single field is, as far as the inference port needs to know: enough to ask
+ * a model for a value and to reject one that does not fit.
+ *
+ * `kind` is the wire's rendering hint, reused here so the description a model is
+ * given and the control a reviewer sees cannot drift apart.
+ */
+export interface FieldSchemaEntry {
+    /** The field's name on the target entity. The key everything else is keyed by. */
+    readonly name: string;
+    /** What sort of value this is. */
+    readonly kind: "text" | "number" | "date" | "enum";
+    /** What the field means, for the model and for the reviewer. `null` when the name says it. */
+    readonly description: string | null;
+    /** Whether the target entity requires the field. */
+    readonly required: boolean;
+    /** The closed set a value must come from when {@link FieldSchemaEntry.kind} is `"enum"`; `null` otherwise. */
+    readonly allowedValues: readonly string[] | null;
+    /**
+     * The regular expression a reviewer surface constrains the amendment input with,
+     * or `null` for no constraint.
+     *
+     * The wire Affidavit carries a `pattern` per field and `@affiant/evidence-card`
+     * sets it as the amendment input's `pattern` attribute, so without a way for a
+     * host to say what the pattern is the slot could never be filled by anything the
+     * gate produced. It is a presentation constraint, not sworn substance: the gate
+     * carries it onto the card and never validates a value against it.
+     */
+    readonly pattern: string | null;
+}
+/** The fields one inference call is asked to fill, and the entity they belong to. */
+export interface FieldSchema {
+    /** The kind of domain entity being written. */
+    readonly entityType: string;
+    /** The fields to extract, in the order the host declared them. */
+    readonly fields: readonly FieldSchemaEntry[];
+}
+/** Where in the utterance a value was found, as character offsets into {@link Turn.utterance}. */
+export interface UtteranceSpan {
+    /** Inclusive start offset. */
+    readonly start: number;
+    /** Exclusive end offset. */
+    readonly end: number;
+}
+/** One field an inference port filled in. */
+export interface StructuredField {
+    /** The extracted value. Any JSON value, including `null`. */
+    readonly value: JsonValue;
+    /**
+     * How confident the port is, `0.0` to `1.0`. The pipeline clamps whatever
+     * arrives into that range rather than trusting it (PV-1).
+     */
+    readonly confidence: number;
+    /**
+     * Whether the value is literally present in the utterance (`"literal"`, tagged
+     * `Conversation`) or was reasoned to (`"inferred"`, tagged `Inferred`). The
+     * distinction is provenance, not confidence: a reviewer reads them differently.
+     */
+    readonly presence: "literal" | "inferred";
+    /**
+     * Where in the utterance the value was found, when the port can say. `null` when
+     * it cannot — the pipeline then records the tag without an `utterance-span`
+     * binding rather than inventing offsets.
+     */
+    readonly utteranceSpan: UtteranceSpan | null;
+}
+/** What one inference call returns: the fields it could fill, keyed by name. */
+export interface StructuredResult {
+    /** The filled fields. A field the port could not fill is absent, not `null`. */
+    readonly fields: {
+        readonly [fieldName: string]: StructuredField;
+    };
+}
+/**
+ * One tool-free structured extraction over the unmodified turn.
+ *
+ * "Tool-free" is the point: the gate asks the model for *values*, never for an
+ * action, so nothing the model returns can execute. The host owns the model
+ * client, the prompt and the cost.
+ */
+export interface InferencePort {
+    /**
+     * Extract `schema`'s fields from `turn`, verbatim as the host received it.
+     *
+     * @param turn   The turn, unmodified — same object as `ctx.turn`.
+     * @param schema The fields to fill.
+     */
+    infer(turn: Turn, schema: FieldSchema): Promise<StructuredResult>;
+}
+/**
+ * What the target entity holds *now*, so the Affidavit can swear to what a write
+ * would replace rather than only to what it would set.
+ *
+ * The gate never reads the host's database itself; a card that shows "was £40,
+ * becomes £4,000" only exists because the host answered this.
+ */
+export interface ProjectionPort {
+    /**
+     * The current values of `op.fields` on the entity `op` names.
+     *
+     * @returns A map keyed by field name, or `null` when there is nothing to project
+     *          — a create, or an entity that no longer exists. A field the host
+     *          cannot supply is absent from the map, which is not the same as `null`
+     *          under its key (`null` means "the field is currently empty").
+     */
+    previousValues(op: Operation, ctx: TurnContext): Promise<Record<string, JsonValue> | null>;
+}
+/**
+ * Whether this principal may decide this entry. The host's answer, and the gate
+ * fails closed on it (AZ-2).
+ *
+ * The gate has already refused an unresolved principal and a cross-tenant entry
+ * before it asks; this port answers the host's own question — role, ownership,
+ * separation of duties. A port that throws is a refusal, never an approval.
+ */
+export interface AuthorizationPort {
+    /** Whether `principal` may decide `entry`. */
+    mayDecide(principal: Principal, entry: DocketEntry): Promise<boolean>;
+}
+/**
+ * How risky this write is, on the host's own scale.
+ *
+ * There is no default formula, deliberately: a number the framework invented would
+ * be compared against a threshold the operator chose, and the operator would have
+ * no way to know what they had agreed to. A policy that declares a threshold with
+ * no scorer wired is a wire-up failure (`wireup-invalid`, CV-1), not a policy that
+ * quietly never fires.
+ */
+export interface RiskScorer {
+    /** Score `affidavit`. The scale is the host's; the policy's threshold is on the same scale (GT-5). */
+    score(affidavit: Affidavit, ctx: TurnContext): Promise<number>;
+}
+/**
+ * Where "now" comes from.
+ *
+ * A port rather than a call to `Date.now()` inside the gate, for two reasons: a
+ * fixture has to be able to pin an expiry to the millisecond, and the core owns no
+ * timer of its own (DK-3) — expiry is state the host sweeps, not a callback the
+ * gate schedules.
+ */
+export interface Clock {
+    /** The current instant, as an ISO 8601 string in UTC. */
+    now(): string;
+}
+/**
+ * The clock used when a host supplies none: the Web-standard `Date`, formatted as
+ * an ISO 8601 instant in UTC.
+ *
+ * `Date` and `toISOString` are ECMAScript, present on Node, Bun and workerd alike
+ * (RT-1). No Node API, no timer, no interval — one reading, on demand.
+ */
+export declare const defaultClock: Clock;
+/**
+ * The binding that makes a deterministic value checkable: which external record or
+ * computation the value came from.
+ *
+ * PV-4 is why it is mandatory on an {@link InterceptedField} rather than optional:
+ * a Standing Order — an approval with no person present — is honoured only if every
+ * provenance input the policy declares carries a binding. An `External` value with
+ * no binding is a claim nobody can re-derive, so a policy that would auto-approve
+ * on it falls back to asking a person.
+ *
+ * {@link InterceptorBinding} is the two-kind restriction of the model's `Binding`
+ * union: `external-ref` (a system of record) and `computation-ref` (a named,
+ * re-runnable rule). The other three kinds all point at something a *person* did,
+ * and PV-3 forbids a machine from minting those.
+ */
+/** One field a {@link FieldInterceptor} resolved. */
+export interface InterceptedField {
+    /** The resolved value. */
+    readonly value: JsonValue;
+    /**
+     * Where it came from. Only these two: **PV-3** forbids an interceptor from
+     * minting `UserStated`, because a machine may not put words in a person's mouth.
+     */
+    readonly source: "External" | "Computed";
+    /** How to check the value. Never absent (PV-4). */
+    readonly binding: InterceptorBinding;
+    /**
+     * How confident the interceptor is, `0.0` to `1.0`. A deterministic resolver
+     * normally says `1`; the merge step clamps whatever arrives (PV-1).
+     */
+    readonly confidence: number;
+    /** A human-readable line for the reviewer, or `null`. */
+    readonly evidence: string | null;
+}
+/** The fields one interceptor resolved, keyed by field name. */
+export type InterceptedFields = {
+    readonly [fieldName: string]: InterceptedField;
+};
+/**
+ * A host-supplied resolver that fills fields deterministically, before any model is
+ * asked (GT-1 step 2).
+ *
+ * Interceptors run first because a value read from a system of record beats a value
+ * a model guessed, and running them first means the model is never asked for
+ * something the host already knows.
+ */
+export interface FieldInterceptor {
+    /** A name for the record and for telemetry. */
+    readonly name: string;
+    /**
+     * Resolve whichever of `op.fields` this interceptor can. Returning `{}` is normal
+     * — an interceptor that has nothing to say says nothing.
+     */
+    resolve(op: Operation, ctx: TurnContext): Promise<InterceptedFields> | InterceptedFields;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEzF;;;;;;GAMG;AACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAMnC;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACD;IACE,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,CAAC;AAEN;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IACnD,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACjD;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC9C;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,UAAU,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;CAC9C;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,CAAA;KAAE,CAAC;CACpE;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACnE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;CAC5F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,sGAAsG;IACtG,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,KAAK;IACpB,yDAAyD;IACzD,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,KAI1B,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AAEH,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;IACzC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;CAC1F"}

package/dist/ports.js

@@ -0,0 +1,34 @@
+/**
+ * The ports a host supplies. Types only — this module has no runtime behaviour
+ * beyond {@link defaultClock}.
+ *
+ * **Rules served: GT-1** (the pipeline runs in protocol order, and every step it
+ * cannot do itself is a port), **GT-5** (a Standing Order that declares a risk
+ * threshold is compared against a host-supplied scorer), **AZ-2** (decision
+ * authorization is the host's answer, and the gate fails closed on it), **CV-1**
+ * (a port the gate needs and does not have is a wire-up failure, not a runtime
+ * surprise), **GT-2** (every port method that needs to know who is asking is
+ * handed the {@link TurnContext}; none of them may go looking).
+ *
+ * The shape of this file is the framework's central claim: **the core ships no
+ * model client, no scoring formula, no executor and no store.** It decides *what
+ * must be sworn to and who must agree*, and it asks the host for everything else.
+ * That is what lets one gate sit in front of any model, any database and any
+ * approval surface — and it is why a host cannot accidentally end up with a gate
+ * that scores its own risk or executes its own writes.
+ *
+ * @packageDocumentation
+ */
+/**
+ * The clock used when a host supplies none: the Web-standard `Date`, formatted as
+ * an ISO 8601 instant in UTC.
+ *
+ * `Date` and `toISOString` are ECMAScript, present on Node, Bun and workerd alike
+ * (RT-1). No Node API, no timer, no interval — one reading, on demand.
+ */
+export const defaultClock = {
+    now() {
+        return new Date().toISOString();
+    },
+};
+//# sourceMappingURL=ports.js.map

package/dist/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgNH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAU;IACjC,GAAG;QACD,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;CACF,CAAC"}

package/dist/store-memory.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `@affiant/core/store-memory` — the reference Docket and Session stores, in
+ * memory.
+ *
+ * They are a separate entry point because a host in production imports the gate and
+ * a *durable* store, and should never be one careless import away from an approval
+ * record that lives only in an isolate that is about to be recycled. Keeping them
+ * out of the main entry point makes the choice visible in the import line.
+ *
+ * The in-memory store is nonetheless the **reference** implementation, not a toy: it
+ * is what the store-semantics fixtures are written against, and a production store
+ * earns the name by passing the same ones. What it enforces — idempotent filing, the
+ * guarded compare-and-set, the deadline applied on every read, opaque paging on every
+ * list, the bounded sweep, retention, purge, export, and a tenant partition a query
+ * cannot cross — is the DK area of the rulebook, in code.
+ *
+ * @packageDocumentation
+ */
+export { InMemoryDocketStore, InMemorySessionStore } from "./docket/memory.js";
+export type { InMemoryDocketStoreOptions } from "./docket/memory.js";
+//# sourceMappingURL=store-memory.d.ts.map

package/dist/store-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-memory.d.ts","sourceRoot":"","sources":["../src/store-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/store-memory.js

@@ -0,0 +1,20 @@
+/**
+ * `@affiant/core/store-memory` — the reference Docket and Session stores, in
+ * memory.
+ *
+ * They are a separate entry point because a host in production imports the gate and
+ * a *durable* store, and should never be one careless import away from an approval
+ * record that lives only in an isolate that is about to be recycled. Keeping them
+ * out of the main entry point makes the choice visible in the import line.
+ *
+ * The in-memory store is nonetheless the **reference** implementation, not a toy: it
+ * is what the store-semantics fixtures are written against, and a production store
+ * earns the name by passing the same ones. What it enforces — idempotent filing, the
+ * guarded compare-and-set, the deadline applied on every read, opaque paging on every
+ * list, the bounded sweep, retention, purge, export, and a tenant partition a query
+ * cannot cross — is the DK area of the rulebook, in code.
+ *
+ * @packageDocumentation
+ */
+export { InMemoryDocketStore, InMemorySessionStore } from "./docket/memory.js";
+//# sourceMappingURL=store-memory.js.map

package/dist/store-memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-memory.js","sourceRoot":"","sources":["../src/store-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}