@affiant/core 0.1.0-alpha.0

package/dist/gate/gate.d.ts

@@ -0,0 +1,212 @@
+/**
+ * `createGate` — the object a host builds once, and the wire-up checks it refuses at.
+ *
+ * **Rules served: CV-1** (a misconfiguration the framework can detect fails at
+ * wire-up with a stated error; no option turns the gate off), **GT-2** (every entry
+ * point takes the turn context as a parameter), **GT-5** (a policy that can declare a
+ * risk threshold needs a host-supplied scorer, and its absence is caught here rather
+ * than on the unlucky request that first reaches the threshold branch), **GT-4**
+ * (`defaultTtlMs` is required and so is every policy's own default: `expiresAt` is
+ * not nullable, so every filed entry carries a deadline and there is no wiring in
+ * which one is missing), **CV-4** (`declareUncovered`), **DK-3** (`expireDue` is
+ * host-scheduled — this package owns no timer).
+ *
+ * ## What is deliberately not on this object
+ *
+ * There is no `execute`, and no executor port in {@link GateOptions} for one to be
+ * built from. AZ-7 says no package in an implementation writes to a host's store, so
+ * the gate has nothing to call: the only path to `execution: "executed"` is
+ * {@link Gate.markExecuted}, the host's own executor reporting what it did.
+ *
+ * ## Two ways in
+ *
+ * {@link Gate.wrap} is Sequence A: a chat turn, a tool the model calls, the pipeline
+ * from the top. {@link Gate.file} is Sequence C: a capture that arrived over a trusted
+ * relay's MCP surface with its provenance already settled, entering at the projection
+ * step. They are the same pipeline; the second skips the two steps that have nothing
+ * to do.
+ *
+ * @packageDocumentation
+ */
+import type { TurnContext } from "../context.js";
+import type { DocketEntry } from "../docket/entry.js";
+import type { DocketStore, Page, PageResult, Scope, SessionStore } from "../docket/store.js";
+import type { JsonValue } from "../model/affidavit.js";
+import type { Clock, FieldInterceptor, FieldSchema, InferencePort, Operation, ProjectionPort, RiskScorer, TelemetryPort } from "../ports.js";
+import type { AuthorizationPort } from "../ports.js";
+import type { CoverageRegistry, ToolDefinition, UncoveredCategory } from "./coverage.js";
+import type { Decision, ExecutionReport } from "./decide.js";
+import type { FiledEntry, PreparedField } from "./pipeline.js";
+import type { ApprovalPolicy } from "./policy.js";
+import type { GatedTool } from "./wrap.js";
+/**
+ * Everything a host supplies. The four ports and the deadline are required; the rest
+ * have defaults that are the safe reading of "the host said nothing".
+ *
+ * `policies` defaults to none, which files everything `ReviewerConfirmation` — a
+ * person confirms every write. `interceptors` defaults to none. `telemetry` defaults
+ * to a port that drops events. `clock` defaults to the system clock, which is the one
+ * dependency a fixture always replaces.
+ */
+export interface GateOptions {
+    /** The Docket (DK-1). */
+    readonly store: DocketStore;
+    /**
+     * The rehydration surface, if the host has one (DK-5). Not used by the pipeline;
+     * {@link Gate.rehydrate} refuses when it is absent.
+     */
+    readonly sessions?: SessionStore;
+    /** The host's structured inference (GT-1 step 3). */
+    readonly inference: InferencePort;
+    /** The host's previous-value lookup (AF-3). */
+    readonly projection: ProjectionPort;
+    /** Who may decide an entry (AZ-2). Consulted on every decision, execution report and resubmission. */
+    readonly authorization: AuthorizationPort;
+    /** The approval chain, in order (AZ-4). */
+    readonly policies?: readonly ApprovalPolicy[];
+    /** The host's risk function (GT-5). Required if any policy declares a threshold. */
+    readonly riskScorer?: RiskScorer;
+    /** Deterministic resolvers (PV-2). */
+    readonly interceptors?: readonly FieldInterceptor[];
+    /** Where every instant on the record comes from. */
+    readonly clock?: Clock;
+    /** Where the TL-1 events go. */
+    readonly telemetry?: TelemetryPort;
+    /**
+     * The deadline applied when neither the verdict nor the policy names one (GT-4).
+     * **Required**: `expiresAt` is not nullable, so every filed entry carries a
+     * deadline and there is no wiring in which one is missing.
+     */
+    readonly defaultTtlMs: number;
+}
+/**
+ * A capture the host has already assembled — Sequence C's way in.
+ *
+ * Supply `fields` when the provenance is settled (a relay's capture, a form
+ * submission, a replay): the pipeline skips the interceptors and the inference and
+ * starts at projection. Supply `schema` instead to run the whole pipeline against the
+ * turn without a {@link ToolDefinition}. Supplying neither is a wire-up error — there
+ * would be nothing to swear to and no way to find out.
+ */
+export interface WriteProposal {
+    /** The write being proposed. */
+    readonly operation: Operation;
+    /** The tool or capture source's name — the key a coverage declaration matches (CV-4). */
+    readonly toolName: string;
+    /** Host-tagged fields. Present ⇒ interceptors and inference are skipped. */
+    readonly fields?: readonly PreparedField[];
+    /** The field schema, for a proposal that should run inference. */
+    readonly schema?: FieldSchema;
+    /**
+     * The arguments this capture came from, part of the entry id's derivation.
+     *
+     * A {@link JsonValue}, because that is what tool arguments are: the id derivation
+     * canonicalises them, and a value with no canonical form is a caller bug the type
+     * says so about rather than a `TypeError` at the first filing.
+     */
+    readonly args?: JsonValue;
+    /** The host's own verb for the operation, carried onto the card. */
+    readonly operationLabel?: string;
+}
+/** The gate a host builds once and calls from every seam (CV-2). */
+export interface Gate {
+    /**
+     * Put the gate in front of `tool` for the turn `ctx` describes (GT-2, GT-6, CV-4).
+     *
+     * @throws AffiantError `"coverage-refused"` or `"wireup-invalid"` at wire-up.
+     */
+    wrap<TArgs, TResult>(tool: ToolDefinition<TArgs, TResult>, ctx: TurnContext): GatedTool<TArgs, TResult>;
+    /**
+     * File a host-assembled proposal — Sequence C's entry point.
+     *
+     * @throws AffiantError `"substance-refused"` when the capture swears to nothing
+     *         (GT-3), or `"wireup-invalid"` when the proposal carries neither prepared
+     *         fields nor a schema.
+     */
+    file(proposal: WriteProposal, ctx: TurnContext): Promise<FiledEntry>;
+    /**
+     * Record that the gate cannot intercept `tool`, so every later proposal from it is
+     * filed `blocked` rather than refused at wire-up (CV-4). It never allows the tool.
+     */
+    declareUncovered(tool: Pick<ToolDefinition, "name">, category: UncoveredCategory): void;
+    /**
+     * Approve, amend or reject an entry, as `ctx.principal` (DK-1, AZ-1, AZ-2, AZ-3).
+     *
+     * @throws AffiantError `"decision-unauthorized"`, `"entry-not-found"`,
+     *         `"decision-expired"`, `"decision-not-pending"` or `"decision-lost-race"`.
+     */
+    decide(entryId: string, decision: Decision, ctx: TurnContext): Promise<DocketEntry>;
+    /**
+     * Record what the host's executor did with an approved write (DK-1, AZ-5, AZ-7).
+     *
+     * The only public path to `execution: "executed"`. The gate never calls an executor
+     * to get there — a host reads its approved-and-unexecuted rows, writes, and reports.
+     *
+     * @throws AffiantError `"decision-unauthorized"`, `"entry-not-found"`, or
+     *         `"decision-not-pending"` when the row is not approved.
+     */
+    markExecuted(entryId: string, outcome: ExecutionReport, detail: string | null, ctx: TurnContext): Promise<DocketEntry>;
+    /**
+     * File an expired entry again as a new entry whose lineage names it (DK-1).
+     *
+     * @throws AffiantError `"decision-unauthorized"`, `"entry-not-found"`, or
+     *         `"decision-not-pending"` when the entry does not read `expired`.
+     */
+    resubmit(entryId: string, ctx: TurnContext): Promise<FiledEntry>;
+    /**
+     * The entry as it reads now, within `ctx`'s tenant, or `null` (DK-1, expiry as
+     * state).
+     *
+     * **Tenant scope, not conversation scope, and that widening is deliberate.** A
+     * reviewer surface is not the conversation that proposed the write: a person opens
+     * a queue, or follows a link, and reads an entry filed in some other conversation
+     * of the same tenant. AZ-2's boundary is the tenant, and GT-2's "two conversations
+     * never observe each other" is about the turn's *own* state — its fields, its
+     * pending inference, its proposals — not about a Docket a tenant's reviewers
+     * share. Narrowing this to `{ tenantId, conversationId }` would break every
+     * reviewer surface; `gate-scope.test.ts` pins the widening so it cannot be
+     * "tightened" with a green suite.
+     */
+    get(entryId: string, ctx: TurnContext): Promise<DocketEntry | null>;
+    /**
+     * One page of what a reconnecting client needs: everything that reads `pending`,
+     * then everything `approved` and `unexecuted`, each in filing order (DK-5).
+     *
+     * @throws AffiantError `"wireup-invalid"` when the host supplied no
+     *         {@link GateOptions.sessions}. It is the one wiring check that cannot
+     *         happen at `createGate`: a host with no reconnecting client needs no
+     *         session store, and refusing to build a gate without one would be the
+     *         framework insisting on a surface the host does not have.
+     */
+    rehydrate(scope: Scope, page: Page): Promise<PageResult<DocketEntry>>;
+    /**
+     * Expire the pending entries in `scope` that are past their deadline, at most
+     * `limit` of them (DK-3). The host schedules this; the core owns no timer.
+     */
+    expireDue(now: string, scope: Scope, limit: number): Promise<{
+        readonly expired: readonly string[];
+        readonly more: boolean;
+    }>;
+    /** The uncovered declarations this gate holds (CV-4). */
+    readonly coverage: CoverageRegistry;
+}
+/**
+ * Build the gate, refusing a wiring it can tell is wrong (CV-1).
+ *
+ * Every refusal names the missing piece, because a wire-up error a host has to bisect
+ * is a wire-up error a host works around. The checks:
+ *
+ * - the four ports — `store`, `inference`, `projection`, `authorization` — are present;
+ * - `defaultTtlMs` is a positive, finite integer of milliseconds (GT-4);
+ * - every policy carrying its own {@link ApprovalPolicy.defaultTtlMs} states it the
+ *   same way (GT-4), so a policy that would file an entry nobody can decide is
+ *   refused here rather than on the request that first falls through to it;
+ * - every policy that says {@link ApprovalPolicy.declaresThreshold} has a
+ *   `riskScorer` to compare against (GT-5). This is checked from the **static**
+ *   declaration, before any evaluation, because a check that only fires when a policy
+ *   happens to return a threshold is exactly the "silent non-fire" GT-5 forbids.
+ *
+ * @throws AffiantError `"wireup-invalid"`, naming what is missing.
+ */
+export declare function createGate(options: GateOptions): Gate;
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EACV,KAAK,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,SAAS,EACT,cAAc,EACd,UAAU,EACV,aAAa,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,KAAK,EAAc,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAgB,aAAa,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAO3C;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,yBAAyB;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC1C,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC9C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,sCAAsC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpD,oDAAoD;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,gCAAgC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,oEAAoE;AACpE,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,OAAO,EACjB,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,EACpC,GAAG,EAAE,WAAW,GACf,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7B;;;;;;OAMG;IACH,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrE;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACxF;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpF;;;;;;;;OAQG;IACH,YAAY,CACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;;;;;OASG;IACH,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE;;;OAGG;IACH,SAAS,CACP,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5E,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAkJrD"}

package/dist/gate/gate.js

@@ -0,0 +1,175 @@
+/**
+ * `createGate` — the object a host builds once, and the wire-up checks it refuses at.
+ *
+ * **Rules served: CV-1** (a misconfiguration the framework can detect fails at
+ * wire-up with a stated error; no option turns the gate off), **GT-2** (every entry
+ * point takes the turn context as a parameter), **GT-5** (a policy that can declare a
+ * risk threshold needs a host-supplied scorer, and its absence is caught here rather
+ * than on the unlucky request that first reaches the threshold branch), **GT-4**
+ * (`defaultTtlMs` is required and so is every policy's own default: `expiresAt` is
+ * not nullable, so every filed entry carries a deadline and there is no wiring in
+ * which one is missing), **CV-4** (`declareUncovered`), **DK-3** (`expireDue` is
+ * host-scheduled — this package owns no timer).
+ *
+ * ## What is deliberately not on this object
+ *
+ * There is no `execute`, and no executor port in {@link GateOptions} for one to be
+ * built from. AZ-7 says no package in an implementation writes to a host's store, so
+ * the gate has nothing to call: the only path to `execution: "executed"` is
+ * {@link Gate.markExecuted}, the host's own executor reporting what it did.
+ *
+ * ## Two ways in
+ *
+ * {@link Gate.wrap} is Sequence A: a chat turn, a tool the model calls, the pipeline
+ * from the top. {@link Gate.file} is Sequence C: a capture that arrived over a trusted
+ * relay's MCP surface with its provenance already settled, entering at the projection
+ * step. They are the same pipeline; the second skips the two steps that have nothing
+ * to do.
+ *
+ * @packageDocumentation
+ */
+import { AffiantError } from "../errors.js";
+import { defaultClock } from "../ports.js";
+import { noopTelemetry } from "../telemetry.js";
+import { createCoverageRegistry, declareUncovered } from "./coverage.js";
+import { decide, markExecuted, resubmit } from "./decide.js";
+import { runPipeline } from "./pipeline.js";
+import { isUsableTtlMs, unusableTtlMessage } from "./policy.js";
+import { wrapTool } from "./wrap.js";
+// ---------------------------------------------------------------------------
+// Wire-up
+// ---------------------------------------------------------------------------
+/**
+ * Build the gate, refusing a wiring it can tell is wrong (CV-1).
+ *
+ * Every refusal names the missing piece, because a wire-up error a host has to bisect
+ * is a wire-up error a host works around. The checks:
+ *
+ * - the four ports — `store`, `inference`, `projection`, `authorization` — are present;
+ * - `defaultTtlMs` is a positive, finite integer of milliseconds (GT-4);
+ * - every policy carrying its own {@link ApprovalPolicy.defaultTtlMs} states it the
+ *   same way (GT-4), so a policy that would file an entry nobody can decide is
+ *   refused here rather than on the request that first falls through to it;
+ * - every policy that says {@link ApprovalPolicy.declaresThreshold} has a
+ *   `riskScorer` to compare against (GT-5). This is checked from the **static**
+ *   declaration, before any evaluation, because a check that only fires when a policy
+ *   happens to return a threshold is exactly the "silent non-fire" GT-5 forbids.
+ *
+ * @throws AffiantError `"wireup-invalid"`, naming what is missing.
+ */
+export function createGate(options) {
+    requirePort(options.store, "store", "the Docket every entry is filed in (DK-1)");
+    requirePort(options.inference, "inference", "the host's structured inference (GT-1 step 3)");
+    requirePort(options.projection, "projection", "the host's previous-value lookup (AF-3)");
+    requirePort(options.authorization, "authorization", "who may decide an entry (AZ-2)");
+    const defaultTtlMs = options.defaultTtlMs;
+    if (!Number.isInteger(defaultTtlMs) || defaultTtlMs <= 0) {
+        throw new AffiantError("wireup-invalid", `CV-1: GateOptions.defaultTtlMs must be a positive whole number of milliseconds; ` +
+            `received ${JSON.stringify(defaultTtlMs)}. Every filed entry carries a deadline (GT-4), ` +
+            `so there is no wiring in which this is absent.`, { option: "defaultTtlMs" });
+    }
+    const policies = options.policies ?? [];
+    for (const policy of policies) {
+        // The same rule as `GateOptions.defaultTtlMs`, applied to the other place the
+        // same value comes from. A verdict's own `ttlMs` cannot be seen from here — it
+        // exists only once a policy has spoken — so `evaluatePolicies` holds that one to
+        // this definition at the moment it reads it.
+        if (policy.defaultTtlMs !== undefined && !isUsableTtlMs(policy.defaultTtlMs)) {
+            throw new AffiantError("wireup-invalid", unusableTtlMessage(policy.id, "defaultTtlMs", policy.defaultTtlMs), { option: "defaultTtlMs", policyId: policy.id, ttlMs: String(policy.defaultTtlMs) });
+        }
+    }
+    if (options.riskScorer === undefined) {
+        const needsScorer = policies.filter((policy) => policy.declaresThreshold === true);
+        if (needsScorer.length > 0) {
+            throw new AffiantError("wireup-invalid", `CV-1: policy ${needsScorer.map((policy) => JSON.stringify(policy.id)).join(", ")} ` +
+                `declares a risk threshold and no GateOptions.riskScorer was supplied. This package ` +
+                `ships no scoring formula and no floor (GT-5): the host owns the risk function, and ` +
+                `a declared threshold with nothing to compare against is a configuration error, never ` +
+                `a silent non-fire.`, { option: "riskScorer", policyIds: needsScorer.map((policy) => policy.id) });
+        }
+    }
+    const coverage = createCoverageRegistry();
+    const clock = options.clock ?? defaultClock;
+    const telemetry = options.telemetry ?? noopTelemetry;
+    const store = options.store;
+    const deps = {
+        store,
+        inference: options.inference,
+        projection: options.projection,
+        policies,
+        interceptors: options.interceptors ?? [],
+        riskScorer: options.riskScorer,
+        clock,
+        telemetry,
+        defaultTtlMs,
+        coverage,
+    };
+    const sessions = options.sessions ?? null;
+    const decideDeps = { ...deps, authorization: options.authorization, sessions };
+    return {
+        coverage,
+        wrap(tool, ctx) {
+            return wrapTool(tool, ctx, deps);
+        },
+        async file(proposal, ctx) {
+            const fields = proposal.fields ?? null;
+            const schema = proposal.schema ?? null;
+            if (fields === null && schema === null) {
+                throw new AffiantError("wireup-invalid", `CV-1: a proposal for ${JSON.stringify(proposal.toolName)} carries neither prepared ` +
+                    `fields nor a field schema. Supply \`fields\` when the capture's provenance is ` +
+                    `already settled (Sequence C), or \`schema\` to run the inference step against the ` +
+                    `turn. With neither there is nothing to swear to.`, { toolName: proposal.toolName });
+            }
+            return runPipeline({
+                operation: proposal.operation,
+                toolName: proposal.toolName,
+                schema,
+                args: proposal.args ?? null,
+                preparedFields: fields,
+                operationLabel: proposal.operationLabel ?? null,
+                supersedes: null,
+                priorAmendments: null,
+            }, ctx, deps);
+        },
+        declareUncovered(tool, category) {
+            declareUncovered(coverage, tool, category);
+        },
+        async decide(entryId, decision, ctx) {
+            return decide(entryId, decision, ctx, decideDeps);
+        },
+        async markExecuted(entryId, outcome, detail, ctx) {
+            return markExecuted(entryId, outcome, detail, ctx, decideDeps);
+        },
+        async resubmit(entryId, ctx) {
+            return resubmit(entryId, ctx, decideDeps);
+        },
+        async rehydrate(scope, page) {
+            if (sessions === null) {
+                throw new AffiantError("wireup-invalid", `DK-5: GateOptions.sessions is required to rehydrate — it is the surface that ` +
+                    `returns pending entries and then approved, unexecuted ones, in that order. ` +
+                    `Supply a SessionStore, or do not call this.`, { option: "sessions" });
+            }
+            return sessions.rehydrate(scope, page);
+        },
+        async get(entryId, ctx) {
+            // Tenant scope, not conversation scope: a reviewer surface reads an entry filed
+            // in another conversation of the same tenant, and AZ-2's boundary is the tenant.
+            return store.get(entryId, { tenantId: ctx.tenantId });
+        },
+        async expireDue(now, scope, limit) {
+            const result = await store.expireDue(now, scope, limit);
+            for (const entryId of result.expired) {
+                telemetry.emit({ key: "docket.expired", at: now, attributes: { "entry.id": entryId } });
+            }
+            return result;
+        },
+    };
+}
+/** Refuse a missing port by name, so a host is told what to supply rather than what broke. */
+function requirePort(value, option, what) {
+    if (value === null || value === undefined) {
+        throw new AffiantError("wireup-invalid", `CV-1: GateOptions.${option} is required — ${what}. A misconfiguration the gate can ` +
+            `detect fails here, at wire-up, and there is no option that turns the gate off.`, { option });
+    }
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAY5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGhD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAyKrC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,2CAA2C,CAAC,CAAC;IACjF,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,+CAA+C,CAAC,CAAC;IAC7F,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,yCAAyC,CAAC,CAAC;IACzF,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;IAEtF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,kFAAkF;YAChF,YAAY,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,iDAAiD;YACzF,gDAAgD,EAClD,EAAE,MAAM,EAAE,cAAc,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,8EAA8E;QAC9E,+EAA+E;QAC/E,iFAAiF;QACjF,6CAA6C;QAC7C,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,EAClE,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;QACnF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,gBAAgB,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClF,qFAAqF;gBACrF,qFAAqF;gBACrF,uFAAuF;gBACvF,oBAAoB,EACtB,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAiB;QACzB,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ;QACR,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;QACL,SAAS;QACT,YAAY;QACZ,QAAQ;KACT,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC1C,MAAM,UAAU,GAAe,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;IAE3F,OAAO;QACL,QAAQ;QAER,IAAI,CAAC,IAAI,EAAE,GAAG;YACZ,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG;YACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;YACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;YACvC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,wBAAwB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B;oBACnF,gFAAgF;oBAChF,oFAAoF;oBACpF,kDAAkD,EACpD,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAChB;gBACE,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM;gBACN,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,cAAc,EAAE,MAAM;gBACtB,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;gBAC/C,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,IAAI;aACtB,EACD,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,IAAI,EAAE,QAAQ;YAC7B,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG;YACjC,OAAO,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG;YAC9C,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG;YACzB,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI;YACzB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,+EAA+E;oBAC7E,6EAA6E;oBAC7E,6CAA6C,EAC/C,EAAE,MAAM,EAAE,UAAU,EAAE,CACvB,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG;YACpB,gFAAgF;YAChF,iFAAiF;YACjF,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK;YAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACxD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,WAAW,CAAC,KAAc,EAAE,MAAc,EAAE,IAAY;IAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,qBAAqB,MAAM,kBAAkB,IAAI,oCAAoC;YACnF,gFAAgF,EAClF,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;AACH,CAAC"}