@affiant/core 0.1.0-alpha.0

package/dist/gate/decide.js

@@ -0,0 +1,559 @@
+/**
+ * Decisions: who may make one, what it attests to, what it does to the row, and how
+ * a refused one is resubmitted.
+ *
+ * **Rules served: AZ-1** (every decided row carries an attestation record naming who
+ * agreed, when, and to which entry), **AZ-2** (tenant-scoped, fail-closed decision
+ * authorization, checked by the framework before any transition), **AZ-3** (what
+ * identity may attest what — a machine caller may never attest `member`), **AZ-4** (a
+ * blocked entry refuses every decision), **AZ-5** (the Docket is the sole record of
+ * approval authority: the only way to `executed` is a report against an approved,
+ * attested row), **AZ-6** (nothing here is conditional on a port, a model or a
+ * transport being available, so there is no degraded path that skips a check),
+ * **AZ-7** (the gate never performs the write — there is no executor port and no
+ * method that calls one), **DK-1** (the guarded compare-and-set, expiry as state with
+ * the late decision's amendments preserved, the execution outcome, resubmission
+ * lineage), **DK-2** (`null` clears, absent leaves untouched), **DK-5** (rehydration
+ * order), **AF-4** (an accepted amendment recomputes the three numbers), **PV-2** (an
+ * amended field's tag carries a `reviewer-act` binding naming the decision).
+ *
+ * ## The order the checks run in, and why it is this order
+ *
+ * 1. **No resolved principal → refused, before the store is touched.** AZ-2's
+ *    "fail closed, never *identity unknown, allow*" is not only about the answer; it
+ *    is about not doing any work on an entry for a caller who has not been
+ *    identified. A read that happened before the refusal is a read an attacker can
+ *    time.
+ * 2. **The entry is fetched inside the caller's tenant, and the row that comes back
+ *    is checked against it.** A row in another tenant is reported as
+ *    `entry-not-found`, exactly as an id that never existed — never "not authorized
+ *    for that tenant", which would be an oracle for guessing ids. The scope goes to
+ *    the store *and* the row's own `tenantId` is compared here, because AZ-2 makes
+ *    this the framework's check: a host store with a scope bug would otherwise fail
+ *    open with nothing above it noticing.
+ * 3. **The host's authorization port.** Its answer is the host's own — role,
+ *    ownership, separation of duties. A port that throws is a refusal.
+ * 4. **What the entry reads *now*.** Expiry is state (DK-1): a row past its deadline
+ *    reads `expired` whether or not the host's sweep has run, and a decision on it is
+ *    refused with the amendments it carried preserved for a resubmission — provided
+ *    the caller could have attested at all, because those values come back as a
+ *    person's act on the resubmission (PV-3).
+ * 5. **The attestation.** Built from the principal, and *only* from the principal:
+ *    there is no parameter through which a caller can name whose signature this is.
+ * 6. **The transition**, a guarded compare-and-set that is applied once or not at
+ *    all.
+ *
+ * ## Why there is no `execute`
+ *
+ * AZ-7 says no package in an implementation writes to a host's store, and the gate
+ * has no executor port to call. The path to `execution: "executed"` is
+ * {@link markExecuted} — the host's own executor telling the Docket what happened.
+ * That is also why a `service` principal is admitted there and refused as a decider
+ * here: reporting an outcome is a statement of fact about work the host did, and a
+ * decision is an act of authority a machine may not perform on a person's behalf
+ * (AZ-3).
+ *
+ * @packageDocumentation
+ */
+import { readStatus } from "../docket/entry.js";
+import { AffiantError } from "../errors.js";
+import { applyAmendments, resolveAmendments } from "../model/amendments.js";
+import { mintTag, supersede } from "../model/provenance.js";
+import { runPipeline } from "./pipeline.js";
+// ---------------------------------------------------------------------------
+// decide
+// ---------------------------------------------------------------------------
+/**
+ * Approve, amend or reject the entry `entryId` names, as `ctx.principal` (DK-1,
+ * AZ-1, AZ-2, AZ-3).
+ *
+ * @returns The row as it stands after the transition.
+ * @throws AffiantError `"decision-unauthorized"` when the context carries no
+ *         resolved principal, when the host's authorization port says no, or when a
+ *         machine caller with nothing to relay tries to attest (AZ-2, AZ-3);
+ *         `"entry-not-found"` when no entry with that id is visible in the caller's
+ *         tenant; `"decision-expired"` when the entry has passed its deadline — the
+ *         decision's amendments are preserved on the row first (DK-1);
+ *         `"decision-not-pending"` when it has already been decided or is blocked
+ *         (AZ-4); `"decision-lost-race"` when a competing decision won the guarded
+ *         compare-and-set.
+ * @throws RangeError when an amendment map holds `undefined` under a key, or names a
+ *         field the Affidavit does not propose. Neither is a refusal the gate hands
+ *         back to a caller: they are caller programming errors, and an `AffiantError`
+ *         code would invite a host to catch and continue.
+ */
+export async function decide(entryId, decision, ctx, deps) {
+    const now = deps.clock.now();
+    const scope = { tenantId: ctx.tenantId };
+    // (i) AZ-2, fail closed — before any store call at all.
+    const principal = requirePrincipal(ctx, entryId, "decide", deps, now);
+    // (ii) The tenant is the boundary, and a miss is a miss (AZ-2).
+    const entry = await requireEntry(entryId, ctx, "decide", deps, now);
+    // (iii) The host's own answer.
+    await requireAuthorized(principal, entry, ctx, "decide", deps, now);
+    // (iv) What the entry reads now (DK-1).
+    const amendments = decision.kind === "approve" ? (decision.amendments ?? null) : null;
+    const reads = readStatus(entry, now);
+    if (reads === "expired") {
+        throw await refuseExpired(entryId, scope, entry, amendments, principal, now, deps);
+    }
+    if (reads !== "pending") {
+        throw new AffiantError("decision-not-pending", `DK-1: Docket entry ${JSON.stringify(entryId)} reads ${reads}; a decision is accepted ` +
+            `only while an entry is pending, and a recorded decision is never overwritten.`, { entryId, status: reads });
+    }
+    if (entry.blocked !== null) {
+        // AZ-4: an entry the implementation will not decide refuses every decision on it
+        // and is never degraded to a requirement this version does know how to run.
+        throw new AffiantError("decision-not-pending", `AZ-4: Docket entry ${JSON.stringify(entryId)} is blocked ` +
+            `(${entry.blocked.code}); every decision on it is refused, and it is never ` +
+            `degraded to a weaker requirement.`, {
+            entryId,
+            blocked: entry.blocked.code,
+            // Narrowed on the code, not sniffed for a property: each arm carries only
+            // the context its own code makes meaningful (AZ-4, CV-4).
+            ...(entry.blocked.code === "requirement-not-implemented"
+                ? { level: entry.blocked.level }
+                : { category: entry.blocked.category, toolName: entry.blocked.toolName }),
+        });
+    }
+    // (v) Who is being held to this (AZ-1, AZ-3).
+    const attestor = attestorOf(principal);
+    if (attestor === null) {
+        throw refuseUnauthorized(entryId, ctx, "decide", "machine-attestation", `AZ-3: a machine caller cannot attest a decision. A service principal decides only on ` +
+            `behalf of a person it names, over a relay it names — both \`assertedMember\` and ` +
+            `\`relay\` — and the result attests member-via-relay. There is no path by which a ` +
+            `service attests member.`, deps, now);
+    }
+    const attestation = { by: attestor, at: now, entryId };
+    // (vi) The amendment, if there is one (DK-2, AF-4, PV-2).
+    const amended = decision.kind === "approve" && amendments !== null
+        ? applyAmendments(entry.affidavit, amendments, {
+            entryId,
+            decisionAt: now,
+            by: subjectOf(attestor),
+        })
+        : null;
+    // (vii) The guarded compare-and-set (DK-1).
+    const patch = {
+        status: decision.kind === "approve" ? "approved" : "rejected",
+        execution: decision.kind === "approve" ? "unexecuted" : null,
+        decision: { kind: decision.kind, reason: decision.reason ?? null, at: now },
+        amendments,
+        attestation,
+        decidedAt: now,
+        // Beside the proposal, never over it: the row keeps what the agent swore to and
+        // gains what the reviewer accepted (DK-4, AF-4).
+        ...(amended === null ? {} : { amendedAffidavit: amended }),
+    };
+    const result = await deps.store.transition(entryId, scope, "pending", patch);
+    if (result === "not-found") {
+        // The row was purged between the read and the write. Same answer as an id that
+        // never existed: the caller learns nothing they did not already know.
+        throw notFound(entryId, ctx);
+    }
+    if (result === "already-decided") {
+        throw new AffiantError("decision-lost-race", `DK-1: another decision on Docket entry ${JSON.stringify(entryId)} was applied first. ` +
+            `A transition out of pending happens once or not at all — this one is refused, not ` +
+            `queued and not applied on top.`, { entryId });
+    }
+    if (result === "expired") {
+        // The store's guard saw a state this function's own read did not. The only way
+        // that happens is a deadline crossed in between, so re-read to say so precisely
+        // rather than reporting a race that did not occur.
+        const current = await deps.store.get(entryId, scope);
+        if (current === null)
+            throw notFound(entryId, ctx);
+        if (readStatus(current, deps.clock.now()) === "expired") {
+            throw await refuseExpired(entryId, scope, current, amendments, principal, now, deps);
+        }
+        throw new AffiantError("decision-not-pending", `DK-1: Docket entry ${JSON.stringify(entryId)} is no longer pending.`, { entryId, status: readStatus(current, deps.clock.now()) });
+    }
+    deps.telemetry.emit({
+        key: "docket.transition",
+        at: now,
+        attributes: {
+            "entry.id": entryId,
+            "gen_ai.conversation.id": ctx.conversationId,
+            from: "pending",
+            to: result.status,
+            execution: result.execution,
+            "decision.kind": decision.kind,
+            "attestation.kind": attestor.kind,
+            amended: amended !== null,
+        },
+    });
+    return result;
+}
+// ---------------------------------------------------------------------------
+// markExecuted
+// ---------------------------------------------------------------------------
+/**
+ * Record what the host's executor did with an approved write (DK-1, AZ-5, AZ-7).
+ *
+ * `status` stays `approved` — the approval happened and is not undone by a failed
+ * write; only `execution` and `executionDetail` move. This is the **only** public
+ * path to `execution: "executed"`, and the gate never calls an executor to reach it:
+ * a host reads its approved-and-unexecuted rows (DK-5), does the write itself, and
+ * says what happened.
+ *
+ * A `service` principal is admitted here and refused as a decider (AZ-3). The
+ * asymmetry is the point: reporting an outcome is a statement of fact about work the
+ * host performed, which a machine is the right party to make, while a decision is an
+ * act of authority that a machine may never make in a person's name. The tenant check
+ * and the host's authorization port still apply, so "which service may report on this
+ * entry" is still the host's answer and not an open door.
+ *
+ * **Reported once.** The execution transition is a guarded compare-and-set out of
+ * `"unexecuted"`, like every other transition on a row (DK-1): a second report is
+ * refused and the first stands. Overwriting would let an approved-and-committed row
+ * later read `failed` — an edit in place of a recorded fact (DK-4), and the loss of
+ * exactly the distinction DK-1 requires the row to keep. So a host that retries a
+ * write reports **once**, when it knows the outcome; the retries are the host's
+ * business (AZ-5), the outcome is the Docket's.
+ *
+ * @throws AffiantError `"decision-unauthorized"`, `"entry-not-found"`,
+ *         `"decision-not-pending"` when the row is not `approved`, or
+ *         `"execution-already-recorded"` when it already carries an outcome.
+ */
+export async function markExecuted(entryId, outcome, detail, ctx, deps) {
+    const now = deps.clock.now();
+    const scope = { tenantId: ctx.tenantId };
+    const principal = requirePrincipal(ctx, entryId, "mark-executed", deps, now);
+    const entry = await requireEntry(entryId, ctx, "mark-executed", deps, now);
+    await requireAuthorized(principal, entry, ctx, "mark-executed", deps, now);
+    const result = await deps.store.recordExecution(entryId, scope, outcome, detail, "unexecuted");
+    if (result === "not-found")
+        throw notFound(entryId, ctx);
+    if (result === "execution-already-recorded") {
+        const recorded = await deps.store.get(entryId, scope);
+        throw new AffiantError("execution-already-recorded", `DK-4, DK-1: Docket entry ${JSON.stringify(entryId)} already carries an execution ` +
+            `outcome, so this report is refused rather than written over it. A recorded fact is ` +
+            `never edited in place, and an approved-and-committed write has to stay ` +
+            `distinguishable from an approved-but-failed one. A host that retries a write reports ` +
+            `once, when it knows the outcome.`, { entryId, recorded: recorded?.execution ?? null, outcome });
+    }
+    if (result === "not-approved") {
+        throw new AffiantError("decision-not-pending", `DK-1, AZ-5: Docket entry ${JSON.stringify(entryId)} is not approved, so there is no ` +
+            `authorised write for an executor to have performed. An execution outcome is only ` +
+            `ever recorded against an approved, attested row.`, { entryId, status: readStatus(entry, now), outcome });
+    }
+    deps.telemetry.emit({
+        key: "docket.transition",
+        at: now,
+        attributes: {
+            "entry.id": entryId,
+            "gen_ai.conversation.id": ctx.conversationId,
+            from: "approved",
+            to: result.status,
+            execution: result.execution,
+            "decision.kind": null,
+            "attestation.kind": result.attestation?.by.kind ?? null,
+            amended: result.amendments !== null,
+        },
+    });
+    return result;
+}
+// ---------------------------------------------------------------------------
+// resubmit
+// ---------------------------------------------------------------------------
+/**
+ * File the expired entry `entryId` names again, as a **new** entry whose lineage
+ * points back at it (DK-1).
+ *
+ * A resubmission is never a reopening. The superseded entry keeps its terminal state
+ * and gains a successor link, so the history reads forward (DK-4) and nothing that
+ * was once decided is quietly edited. The new proposal carries the same operation and
+ * the same sworn fields, with the amendments the refused late decision left on the
+ * row prefilled as values — each prefilled field tagged `UserStated` with a
+ * `reviewer-act` binding naming the superseded entry (PV-2), so a reader of the new
+ * card can see which values came from a person's earlier correction rather than from
+ * the machine.
+ *
+ * The whole pipeline runs again: the policy chain gets another say, the deadline is
+ * stamped afresh from that verdict (GT-4), and the substance gate applies (GT-3). A
+ * resubmission is a new proposal, not a replay of an old approval.
+ *
+ * @throws AffiantError `"decision-unauthorized"`, `"entry-not-found"`, or
+ *         `"decision-not-pending"` when the entry does not read `expired`.
+ * @throws RangeError when the preserved amendment map names a field the Affidavit
+ *         does not propose.
+ */
+export async function resubmit(entryId, ctx, deps) {
+    const now = deps.clock.now();
+    const scope = { tenantId: ctx.tenantId };
+    const principal = requirePrincipal(ctx, entryId, "resubmit", deps, now);
+    const entry = await requireEntry(entryId, ctx, "resubmit", deps, now);
+    await requireAuthorized(principal, entry, ctx, "resubmit", deps, now);
+    const reads = readStatus(entry, now);
+    if (reads !== "expired") {
+        throw new AffiantError("decision-not-pending", `DK-1: Docket entry ${JSON.stringify(entryId)} reads ${reads}; only an expired entry is ` +
+            `resubmitted. A pending one is still waiting for its decision, and a decided one has ` +
+            `had it.`, { entryId, status: reads });
+    }
+    const filed = await runPipeline(resubmissionProposal(entry), ctx, deps);
+    // The successor link goes on afterwards and on the *other* row: an appended later
+    // fact on a terminal entry (DK-4), never an edit of the decision it recorded.
+    await deps.store.recordSupersession(entryId, scope, filed.entry.entryId);
+    return filed;
+}
+/** The proposal a resubmission of `entry` files: same operation, amendments prefilled. */
+function resubmissionProposal(entry) {
+    const sworn = entry.affidavit;
+    const fieldNames = sworn.fields.map((field) => field.name);
+    if (sworn.operationType === "update" && sworn.entityId === null) {
+        throw new RangeError("AF-3: an update Affidavit names the entity it updates; this row names none, so there " +
+            "is no write for a resubmission to propose");
+    }
+    const operation = sworn.operationType === "update" && sworn.entityId !== null
+        ? {
+            kind: "update",
+            entityType: sworn.entityType,
+            entityId: sworn.entityId,
+            fields: fieldNames,
+        }
+        : { kind: "create", entityType: sworn.entityType, entityId: null, fields: fieldNames };
+    // What a *refused late decision* left behind, with the act that left it (DK-1).
+    // An approval's accepted amendments are a different fact and cannot be here: only
+    // an expired row is resubmitted, and an expired row was never approved.
+    const preserved = entry.preservedAmendments;
+    const prior = preserved?.amendments ?? null;
+    // `resolveAmendments` is DK-2's discipline: `null` is a clear, an absent key says
+    // nothing, and `undefined` under a key is refused rather than guessed at.
+    const prefills = new Map((prior === null ? [] : resolveAmendments(prior)).map((entry_) => [entry_.name, entry_]));
+    for (const name of prefills.keys()) {
+        if (!fieldNames.includes(name)) {
+            throw new RangeError(`the amendments preserved on Docket entry ${JSON.stringify(entry.entryId)} name field ` +
+                `${JSON.stringify(name)}, which its Affidavit does not propose; there is nothing to ` +
+                `prefill`);
+        }
+    }
+    // PV-2: the binding names the entry the correction was made on **and the instant
+    // the correction was made**, which the row carries because `preserveAmendments`
+    // recorded the refused decision's own act. Dating it to the row's deadline instead
+    // would place a person's correction at the moment the gate refused it, and dating
+    // it to this call would place it whenever somebody happened to press resubmit.
+    //
+    // `preserved` is non-null whenever `prefills` is non-empty — they come from the
+    // same fact — so there is no case where a prefilled value has no act behind it.
+    const binding = preserved === null
+        ? null
+        : { kind: "reviewer-act", ref: { entryId: entry.entryId, decisionAt: preserved.at } };
+    const preparedFields = sworn.fields.map((field) => {
+        const prefill = prefills.get(field.name);
+        if (prefill === undefined || preserved === null || binding === null) {
+            return {
+                name: field.name,
+                kind: field.kind,
+                value: field.value,
+                provenance: field.provenance,
+                isMandatory: field.isMandatory,
+            };
+        }
+        return {
+            name: field.name,
+            kind: field.kind,
+            value: prefill.amendment.kind === "clear" ? null : prefill.amendment.value,
+            provenance: supersede(field.provenance, mintTag({
+                source: "UserStated",
+                confidence: 1,
+                // The act's instant, not this call's: a value a person typed at 09:05 is
+                // theirs from 09:05, whoever resubmits it and whenever (PV-2).
+                at: preserved.at,
+                note: `Prefilled from the amendment ${preserved.by} carried on Docket entry ` +
+                    `${entry.entryId}`,
+                conversationTurn: sworn.conversationTurn,
+                binding,
+            })),
+            isMandatory: field.isMandatory,
+        };
+    });
+    return {
+        operation,
+        // The tool that proposed the write, off the row (CV-4): a resubmission of an
+        // uncovered tool's proposal is filed blocked again rather than resubmitting clean.
+        toolName: entry.toolName,
+        schema: null,
+        args: null,
+        preparedFields,
+        operationLabel: null,
+        supersedes: entry.entryId,
+        priorAmendments: prior,
+    };
+}
+// ---------------------------------------------------------------------------
+// Identity and attestation (AZ-1, AZ-2, AZ-3)
+// ---------------------------------------------------------------------------
+/**
+ * The principal on `ctx`, or a refusal.
+ *
+ * Called before every store access on every entry point here. `null` means the host
+ * has not resolved an identity, which is not the same as anonymous and is never
+ * treated as permission (AZ-2).
+ */
+function requirePrincipal(ctx, entryId, path, deps, now) {
+    if (ctx.principal !== null)
+        return ctx.principal;
+    throw refuseUnauthorized(entryId, ctx, path, "identity-unresolved", `AZ-2: identity unresolved — the turn context carries no principal, so there is nobody ` +
+        `to hold to a decision on Docket entry ${JSON.stringify(entryId)}. The gate fails closed ` +
+        `here, before it reads the Docket: "identity unknown" is never "allow".`, deps, now);
+}
+/**
+ * The entry inside the caller's tenant, or `entry-not-found` — never an oracle (AZ-2).
+ *
+ * The scoped read is asked for **and** the answer is checked. AZ-2 says the tenant
+ * boundary is "checked by the framework … a rule the framework enforces is the only
+ * version of this check that every host gets" — and a check that consists solely of
+ * passing a `tenantId` to `store.get` is a check the *store* performs. A host store
+ * with a scope bug then fails open and the gate does not notice. So the row's own
+ * `tenantId` is compared here, after the read, whatever the store returned: two
+ * independent enforcements of one rule, which is what "fail closed" is worth.
+ */
+async function requireEntry(entryId, ctx, path, deps, now) {
+    const entry = await deps.store.get(entryId, { tenantId: ctx.tenantId });
+    if (entry !== null && entry.tenantId === ctx.tenantId)
+        return entry;
+    // The host is told an attempt was made; the caller is told only that there is no
+    // such entry, which is also the answer a caller in another tenant gets. The two
+    // reasons are separated for the host alone: `tenant-mismatch` means the store
+    // answered a scoped read with another tenant's row, which is a bug in that store
+    // and the one thing this second check exists to surface.
+    deps.telemetry.emit({
+        key: "decision.unauthorized",
+        at: now,
+        attributes: {
+            "entry.id": entryId,
+            "gen_ai.conversation.id": ctx.conversationId,
+            reason: entry === null ? "entry-not-found" : "tenant-mismatch",
+            "principal.kind": ctx.principal?.kind ?? "unresolved",
+            path,
+        },
+    });
+    throw notFound(entryId, ctx);
+}
+/** The host's own answer to "may this principal act on this entry" (AZ-2). */
+async function requireAuthorized(principal, entry, ctx, path, deps, now) {
+    let admitted;
+    try {
+        admitted = await deps.authorization.mayDecide(principal, entry);
+    }
+    catch {
+        // A port that throws is a refusal, never an approval: an authorization callback
+        // that fell over has not said yes.
+        admitted = false;
+    }
+    if (admitted)
+        return;
+    throw refuseUnauthorized(entry.entryId, ctx, path, "not-authorized", `AZ-2: the host's authorization port did not admit this principal for Docket entry ` +
+        `${JSON.stringify(entry.entryId)}.`, deps, now);
+}
+export function attestorOf(principal) {
+    if (principal.kind === "member") {
+        return { kind: "member", id: principal.id };
+    }
+    const relay = principal.relay;
+    const memberId = principal.assertedMember;
+    if (relay === undefined || memberId === undefined)
+        return null;
+    return {
+        kind: "member-via-relay",
+        memberId,
+        relay: {
+            principal: principal.id,
+            channelIdentity: relay.channelIdentity,
+            messageId: relay.messageId,
+        },
+    };
+}
+/** Who an attestation is about: the person, however they reached the gate. */
+function subjectOf(attestor) {
+    switch (attestor.kind) {
+        case "member":
+            return attestor.id;
+        case "member-via-relay":
+            return attestor.memberId;
+        default:
+            return attestor.policyId;
+    }
+}
+// ---------------------------------------------------------------------------
+// Refusals
+// ---------------------------------------------------------------------------
+/** Emit the AZ-2 event and build the refusal. Thrown by the caller, so control flow reads. */
+function refuseUnauthorized(entryId, ctx, path, reason, message, deps, now) {
+    deps.telemetry.emit({
+        key: "decision.unauthorized",
+        at: now,
+        attributes: {
+            "entry.id": entryId,
+            "gen_ai.conversation.id": ctx.conversationId,
+            reason,
+            // The kind, never the id: an event stream is not an audit record, and the
+            // record of who decided is the attestation on the row (AZ-1).
+            "principal.kind": ctx.principal?.kind ?? "unresolved",
+            path,
+        },
+    });
+    return new AffiantError("decision-unauthorized", message, { entryId, reason });
+}
+/**
+ * Preserve the amendments a late decision carried and refuse it (DK-1).
+ *
+ * The preservation is a separate store write on purpose: the compare-and-set that
+ * refused the decision must not also write to the row, or "applied once or not at
+ * all" stops being true. What is written is the map and nothing else — not a status,
+ * not a decision record, not an attestation. Nobody decided anything here.
+ *
+ * Two conditions on writing it at all, both about not letting a refused call put
+ * something on the record that a later resubmission would treat as a person's act:
+ *
+ * - the map's field names are checked against the Affidavit first, exactly as
+ *   `applyAmendments` checks them on the path that was not late, so a caller learns
+ *   about a bad field name here rather than in whoever resubmits the entry;
+ * - the caller must be able to attest at all (AZ-3). A resubmission prefills these
+ *   values with a `UserStated` tag, and PV-3 forbids a machine from putting words in
+ *   a person's mouth — so a machine caller with nothing to relay leaves nothing
+ *   behind, even though its refusal is the expiry, not its identity.
+ */
+async function refuseExpired(entryId, scope, entry, amendments, principal, now, deps) {
+    let preserved = false;
+    if (amendments !== null && Object.keys(amendments).length > 0) {
+        requireAmendableFields(entry.affidavit, amendments);
+        const attestor = attestorOf(principal);
+        if (attestor !== null) {
+            // The refused decision's **own** instant and principal (DK-1, PV-2): a
+            // resubmission binds each prefilled field's tag to this act, and dating it to
+            // the row's deadline would place the correction at a moment nobody typed.
+            const result = await deps.store.preserveAmendments(entryId, scope, amendments, {
+                at: now,
+                by: subjectOf(attestor),
+            });
+            preserved = typeof result !== "string";
+        }
+    }
+    return new AffiantError("decision-expired", `DK-1: Docket entry ${JSON.stringify(entryId)} passed its deadline at ${entry.expiresAt} ` +
+        `and reads expired, whether or not a sweep has run. The decision is refused` +
+        (preserved
+            ? `; the amendments it carried are preserved on the row for a resubmission.`
+            : `.`), { entryId, expiresAt: entry.expiresAt, amendmentsPreserved: preserved });
+}
+/**
+ * Refuse an amendment map that names a field the Affidavit does not propose (DK-2).
+ *
+ * A `RangeError` and not an `AffiantError`, and the same message `applyAmendments`
+ * raises: the {@link ErrorCode} registry names refusals the gate makes about a
+ * proposal's substance or a decider's identity, and a field name that is not there is
+ * a caller passing an index out of range.
+ */
+function requireAmendableFields(affidavit, map) {
+    for (const resolved of resolveAmendments(map)) {
+        if (!affidavit.fields.some((field) => field.name === resolved.name)) {
+            throw new RangeError(`amendment names field ${JSON.stringify(resolved.name)}, which this Affidavit does ` +
+                `not propose`);
+        }
+    }
+}
+/** The one answer a caller outside the tenant ever gets, and the answer a bad id gets. */
+function notFound(entryId, ctx) {
+    return new AffiantError("entry-not-found", `no Docket entry ${JSON.stringify(entryId)} is visible in this tenant.`, { entryId, tenantId: ctx.tenantId });
+}
+//# sourceMappingURL=decide.js.map

package/dist/gate/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../../src/gate/decide.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE5E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAI5D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAqD5C,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAe,EACf,QAAkB,EAClB,GAAgB,EAChB,IAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAEhD,wDAAwD;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEtE,gEAAgE;IAChE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEpE,+BAA+B;IAC/B,MAAM,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEpE,wCAAwC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,KAAK,2BAA2B;YACrF,+EAA+E,EACjF,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3B,iFAAiF;QACjF,4EAA4E;QAC5E,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc;YACzD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,sDAAsD;YAC5E,mCAAmC,EACrC;YACE,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YAC3B,0EAA0E;YAC1E,0DAA0D;YAC1D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,6BAA6B;gBACtD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE;gBAChC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC5E,CACF,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,kBAAkB,CACtB,OAAO,EACP,GAAG,EACH,QAAQ,EACR,qBAAqB,EACrB,uFAAuF;YACrF,mFAAmF;YACnF,mFAAmF;YACnF,yBAAyB,EAC3B,IAAI,EACJ,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAEpE,0DAA0D;IAC1D,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAChD,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE;YAC3C,OAAO;YACP,UAAU,EAAE,GAAG;YACf,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC;SACxB,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAEX,4CAA4C;IAC5C,MAAM,KAAK,GAAoB;QAC7B,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;QAC7D,SAAS,EAAE,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QAC5D,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE;QAC3E,UAAU;QACV,WAAW;QACX,SAAS,EAAE,GAAG;QACd,gFAAgF;QAChF,iDAAiD;QACjD,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;KAC3D,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,+EAA+E;QAC/E,sEAAsE;QACtE,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,0CAA0C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,sBAAsB;YACrF,oFAAoF;YACpF,gCAAgC,EAClC,EAAE,OAAO,EAAE,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,+EAA+E;QAC/E,gFAAgF;QAChF,mDAAmD;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB,EACrE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAClB,GAAG,EAAE,mBAAmB;QACxB,EAAE,EAAE,GAAG;QACP,UAAU,EAAE;YACV,UAAU,EAAE,OAAO;YACnB,wBAAwB,EAAE,GAAG,CAAC,cAAc;YAC5C,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,MAAM,CAAC,MAAM;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,eAAe,EAAE,QAAQ,CAAC,IAAI;YAC9B,kBAAkB,EAAE,QAAQ,CAAC,IAAI;YACjC,OAAO,EAAE,OAAO,KAAK,IAAI;SAC1B;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,OAAwB,EACxB,MAAqB,EACrB,GAAgB,EAChB,IAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAEhD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/F,IAAI,MAAM,KAAK,WAAW;QAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,4BAA4B,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,gCAAgC;YACjF,qFAAqF;YACrF,yEAAyE;YACzE,uFAAuF;YACvF,kCAAkC,EACpC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mCAAmC;YACpF,mFAAmF;YACnF,kDAAkD,EACpD,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAClB,GAAG,EAAE,mBAAmB;QACxB,EAAE,EAAE,GAAG;QACP,UAAU,EAAE;YACV,UAAU,EAAE,OAAO;YACnB,wBAAwB,EAAE,GAAG,CAAC,cAAc;YAC5C,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,MAAM,CAAC,MAAM;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,eAAe,EAAE,IAAI;YACrB,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI;YACvD,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,IAAI;SACpC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,GAAgB,EAChB,IAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAEhD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,KAAK,6BAA6B;YACvF,sFAAsF;YACtF,SAAS,EACX,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAExE,kFAAkF;IAClF,8EAA8E;IAC9E,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,SAAS,oBAAoB,CAAC,KAAkB;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE3D,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,UAAU,CAClB,uFAAuF;YACrF,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GACb,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QACzD,CAAC,CAAC;YACE,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,UAAU;SACnB;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE3F,gFAAgF;IAChF,kFAAkF;IAClF,wEAAwE;IACxE,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,CAAC;IAC5C,MAAM,KAAK,GAAG,SAAS,EAAE,UAAU,IAAI,IAAI,CAAC;IAC5C,kFAAkF;IAClF,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CACxF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAClB,4CAA4C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc;gBACrF,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8DAA8D;gBACrF,SAAS,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,kFAAkF;IAClF,+EAA+E;IAC/E,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,OAAO,GACX,SAAS,KAAK,IAAI;QAChB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC;IAE1F,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAiB,EAAE;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK;YAC1E,UAAU,EAAE,SAAS,CACnB,KAAK,CAAC,UAAU,EAChB,OAAO,CAAC;gBACN,MAAM,EAAE,YAAY;gBACpB,UAAU,EAAE,CAAC;gBACb,yEAAyE;gBACzE,+DAA+D;gBAC/D,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,IAAI,EACF,gCAAgC,SAAS,CAAC,EAAE,2BAA2B;oBACvE,GAAG,KAAK,CAAC,OAAO,EAAE;gBACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,OAAO;aACR,CAAC,CACH;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,6EAA6E;QAC7E,mFAAmF;QACnF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,cAAc;QACd,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,KAAK,CAAC,OAAO;QACzB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,GAAgB,EAChB,OAAe,EACf,IAAkB,EAClB,IAAgB,EAChB,GAAW;IAEX,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,SAAS,CAAC;IACjD,MAAM,kBAAkB,CACtB,OAAO,EACP,GAAG,EACH,IAAI,EACJ,qBAAqB,EACrB,wFAAwF;QACtF,yCAAyC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,0BAA0B;QAC1F,wEAAwE,EAC1E,IAAI,EACJ,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,GAAgB,EAChB,IAAkB,EAClB,IAAgB,EAChB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpE,iFAAiF;IACjF,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiF;IACjF,yDAAyD;IACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAClB,GAAG,EAAE,uBAAuB;QAC5B,EAAE,EAAE,GAAG;QACP,UAAU,EAAE;YACV,UAAU,EAAE,OAAO;YACnB,wBAAwB,EAAE,GAAG,CAAC,cAAc;YAC5C,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB;YAC9D,gBAAgB,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,YAAY;YACrD,IAAI;SACL;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,iBAAiB,CAC9B,SAAoB,EACpB,KAAkB,EAClB,GAAgB,EAChB,IAAkB,EAClB,IAAgB,EAChB,GAAW;IAEX,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,mCAAmC;QACnC,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ;QAAE,OAAO;IACrB,MAAM,kBAAkB,CACtB,KAAK,CAAC,OAAO,EACb,GAAG,EACH,IAAI,EACJ,gBAAgB,EAChB,oFAAoF;QAClF,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EACrC,IAAI,EACJ,GAAG,CACJ,CAAC;AACJ,CAAC;AA8BD,MAAM,UAAU,UAAU,CAAC,SAAoB;IAC7C,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,QAAQ;QACR,KAAK,EAAE;YACL,SAAS,EAAE,SAAS,CAAC,EAAE;YACvB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,KAAK,kBAAkB;YACrB,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC3B;YACE,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,8FAA8F;AAC9F,SAAS,kBAAkB,CACzB,OAAe,EACf,GAAgB,EAChB,IAAkB,EAClB,MAAc,EACd,OAAe,EACf,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAClB,GAAG,EAAE,uBAAuB;QAC5B,EAAE,EAAE,GAAG;QACP,UAAU,EAAE;YACV,UAAU,EAAE,OAAO;YACnB,wBAAwB,EAAE,GAAG,CAAC,cAAc;YAC5C,MAAM;YACN,0EAA0E;YAC1E,8DAA8D;YAC9D,gBAAgB,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,YAAY;YACrD,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,KAAY,EACZ,KAAkB,EAClB,UAA+B,EAC/B,SAAoB,EACpB,GAAW,EACX,IAAgB;IAEhB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,uEAAuE;YACvE,8EAA8E;YAC9E,0EAA0E;YAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;gBAC7E,EAAE,EAAE,GAAG;gBACP,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC;aACxB,CAAC,CAAC;YACH,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,YAAY,CACrB,kBAAkB,EAClB,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,2BAA2B,KAAK,CAAC,SAAS,GAAG;QACxF,4EAA4E;QAC5E,CAAC,SAAS;YACR,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,GAAG,CAAC,EACV,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,CACxE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,SAAoB,EAAE,GAAiB;IACrE,KAAK,MAAM,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,UAAU,CAClB,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B;gBAClF,aAAa,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAgB;IACjD,OAAO,IAAI,YAAY,CACrB,iBAAiB,EACjB,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6BAA6B,EACvE,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CACpC,CAAC;AACJ,CAAC"}