@aldus-runtime/gate-engine 0.1.0

package/dist/engine.js

@@ -0,0 +1,361 @@
+/**
+ * Gate evaluation, decision recording, and authorization (architecture contract §12, §13, §19.3).
+ *
+ * The central design choice: **invalidation is derived, never stored.**
+ *
+ * Contract §13.1 requires a content-changing edit to invalidate the Content Freeze "and
+ * downstream approvals". The obvious implementation writes invalidation records and walks the
+ * graph marking approvals dead. That implementation has a failure mode the contract cannot
+ * tolerate — if the cascade is ever interrupted, or a gate is added after the fact, some approval
+ * stays marked valid while the thing it approved has moved underneath it, and §13.2 forbids
+ * exactly that.
+ *
+ * So nothing is marked. A gate's state is computed on every evaluation from three inputs: its
+ * latest decision, the current digests of what it binds, and the state of the gates it depends
+ * on. A stale approval cannot survive because there is no stored "valid" flag for it to survive
+ * in. Adding a dependency edge invalidates downstream approvals immediately, with no migration.
+ */
+import { SCHEMA_VERSION, newEventId, newGateDecisionId, validate } from "@aldus-runtime/core";
+import { assertSubjectsCover, detectDrift, } from "./binding.js";
+import { GateEngineErrorCodes, gateEngineError } from "./errors.js";
+import { checkSpend, grantLimitsDigest, } from "./spend.js";
+/**
+ * What a gate currently is.
+ *
+ * `stale` is deliberately distinct from `pending`: a gate that was approved and then drifted is
+ * not the same operator situation as one nobody has looked at, and §13.1 wants the difference
+ * visible. `blocked_upstream` is likewise distinct from both — the gate itself may be perfectly
+ * approved while something it depends on is not.
+ */
+export const GATE_STATES = [
+    /** No decision has been recorded. */
+    "pending",
+    // NOTE: `blocked_upstream` below is used only when a gate is otherwise fine. A gate that is
+    // itself stale or rejected keeps that state and carries `blockedBy` alongside it, because the
+    // more specific label is the one an operator can act on.
+    /** Approved, and still bound to the current inputs. */
+    "satisfied",
+    /** Approved, but a bound value has changed since (§13.1, §13.2). */
+    "stale",
+    /** The operator rejected it. */
+    "rejected",
+    /** The operator asked for changes. */
+    "changes_requested",
+    /** The operator deliberately bypassed the check (§13, distinct from approval). */
+    "waived",
+    /** A blocking gate this one depends on is not satisfied (§13.1 cascade). */
+    "blocked_upstream",
+];
+/** True if two id lists hold the same ids in the same order. */
+function sameIds(a, b) {
+    return a.length === b.length && a.every((id, index) => id === b[index]);
+}
+/**
+ * Evaluates gates, records decisions, and authorizes operations and spend.
+ */
+export class GateEngine {
+    #registry;
+    #decisions;
+    #events;
+    #costs;
+    constructor(options) {
+        this.#registry = options.registry;
+        this.#decisions = options.decisions;
+        this.#events = options.events;
+        this.#costs = options.costs;
+    }
+    /** The gate definitions this engine evaluates. */
+    get registry() {
+        return this.#registry;
+    }
+    /**
+     * Record a human decision (contract §3.6).
+     *
+     * §3.6: "Human review MUST create a durable `GateDecision`. A chat message saying 'looks good'
+     * is not enough unless it is translated into a recorded decision tied to exact inputs." This is
+     * that translation, and it refuses anything that would produce a decision tied to less than the
+     * gate binds.
+     *
+     * @throws {AldusError} `ALDUS_GATE_NOT_FOUND` if the gate is not registered.
+     * @throws {AldusError} `ALDUS_GATE_SUBJECTS_INCOMPLETE` if the subjects do not cover the gate.
+     * @throws {AldusError} `ALDUS_GATE_ACTOR_NOT_PERMITTED` if the actor may not decide this gate.
+     */
+    async decide(input) {
+        const gate = this.#registry.require(input.gateId);
+        assertSubjectsCover(gate, input.subjects);
+        if (!gate.permittedActorKinds.includes(input.decidedBy.kind)) {
+            throw gateEngineError(GateEngineErrorCodes.GATE_ACTOR_NOT_PERMITTED, `Gate "${gate.gateId}" accepts decisions from [${gate.permittedActorKinds.join(", ")}], ` +
+                `but "${input.decidedBy.id}" is a ${input.decidedBy.kind}. Contract §12 forbids ` +
+                "presenting a machine pass as semantic correctness, and §13.3 keeps final performance " +
+                "approval human-owned.", {
+                category: "policy",
+                details: {
+                    gateId: gate.gateId,
+                    actorKind: input.decidedBy.kind,
+                    permitted: [...gate.permittedActorKinds],
+                },
+            });
+        }
+        const decision = {
+            schemaVersion: SCHEMA_VERSION,
+            decisionId: input.decisionId ?? newGateDecisionId(),
+            gateId: gate.gateId,
+            runId: input.runId,
+            decision: input.decision,
+            subjectHashes: [...input.subjects].map((subject) => subject.sha256).sort(),
+            decidedBy: input.decidedBy,
+            decidedAt: input.decidedAt,
+            ...(input.comment !== undefined ? { comment: input.comment } : {}),
+            expiresOnChange: input.expiresOnChange ?? gate.expiresOnChange,
+        };
+        // Validate before persisting. A malformed decision written to the approvals log is worse
+        // than a rejected call, because §13 treats what is written there as authoritative.
+        const validated = validate("GateDecision", decision);
+        if (!validated.ok) {
+            throw gateEngineError(GateEngineErrorCodes.GATE_DEFINITION_INVALID, `The decision built for gate "${gate.gateId}" is not a valid GateDecision.`, { category: "internal", details: { issues: validated.error.details } });
+        }
+        await this.#decisions.append(input.runId, decision);
+        await this.#emitDecisionEvent(input, decision);
+        return decision;
+    }
+    /** Emit the §6.4 event for a recorded decision. */
+    async #emitDecisionEvent(input, decision) {
+        const event = {
+            schemaVersion: SCHEMA_VERSION,
+            eventId: input.eventId ?? newEventId(),
+            occurredAt: decision.decidedAt,
+            episodeId: input.episodeId,
+            runId: decision.runId,
+            action: `gate.${decision.decision}`,
+            actor: decision.decidedBy,
+            inputRefs: [],
+            outputRefs: [],
+            details: {
+                gateId: decision.gateId,
+                decisionId: decision.decisionId,
+                subjectCount: decision.subjectHashes.length,
+                expiresOnChange: decision.expiresOnChange,
+            },
+        };
+        await this.#events.emit(event);
+    }
+    /**
+     * Evaluate every registered gate for a Run.
+     *
+     * `subjects` supplies the current digests of what each gate binds. A gate absent from it is
+     * evaluated as having no current inputs, which reads as `pending` — never as satisfied.
+     */
+    async evaluate(runId, subjects) {
+        const decisions = await this.#decisions.list(runId);
+        return this.evaluateWith(decisions, subjects);
+    }
+    /**
+     * Evaluate against a decision list already in hand.
+     *
+     * Separated from {@link GateEngine.evaluate} so the whole cascade is a pure function of its
+     * inputs — which is what makes it testable without a store and impossible to get into a
+     * partially-updated state.
+     */
+    evaluateWith(decisions, subjects) {
+        const own = new Map();
+        for (const gate of this.#registry.list()) {
+            own.set(gate.gateId, this.#evaluateOne(gate, decisions, subjects[gate.gateId] ?? []));
+        }
+        return this.#applyCascade(own);
+    }
+    /** A gate's state from its own decision and subjects, before the cascade. */
+    #evaluateOne(gate, decisions, subjects) {
+        const base = { gateId: gate.gateId, level: gate.level, enforcement: gate.enforcement };
+        const blocks = (state) => gate.enforcement === "blocking" && state !== "satisfied" && state !== "waived";
+        // Append order is authoritative, not `decidedAt`: the log is the durable fact, and two
+        // machines with disagreeing clocks must not be able to reorder which approval is current.
+        const latest = [...decisions].reverse().find((entry) => entry.gateId === gate.gateId);
+        if (latest === undefined) {
+            return {
+                ...base,
+                state: "pending",
+                blocking: blocks("pending"),
+                explanation: `Gate "${gate.gateId}" has no recorded decision.`,
+            };
+        }
+        if (latest.decision === "rejected" || latest.decision === "changes_requested") {
+            return {
+                ...base,
+                state: latest.decision,
+                decision: latest,
+                blocking: blocks(latest.decision),
+                explanation: latest.comment ?? `Gate "${gate.gateId}" was ${latest.decision.replace("_", " ")}.`,
+            };
+        }
+        const drift = detectDrift(latest, subjects);
+        // A waiver records that a check was bypassed (§13). It still binds: waiving a gate for one
+        // version of the content says nothing about the next, so drift voids it exactly as it voids
+        // an approval.
+        if (drift !== undefined && latest.expiresOnChange) {
+            return {
+                ...base,
+                state: "stale",
+                decision: latest,
+                drift,
+                blocking: blocks("stale"),
+                explanation: `Gate "${gate.gateId}" was ${latest.decision}, but ` +
+                    `${drift.changed.length > 0 ? `[${drift.changed.join(", ")}] changed` : "its bound inputs changed"}` +
+                    " since. Contract §13.1 voids an approval once what it approved has moved.",
+            };
+        }
+        const state = latest.decision === "waived" ? "waived" : "satisfied";
+        return { ...base, state, decision: latest, blocking: blocks(state) };
+    }
+    /**
+     * Propagate §13.1's cascade over the dependency graph.
+     *
+     * Only **blocking** gates propagate. §12 level 2 defines an advisory signal as one that
+     * "reports a possible issue without blocking", so an un-run advisory check must not halt the
+     * gates downstream of it — otherwise every advisory would be a hard gate wearing a different
+     * label, and §12's four levels would collapse into two.
+     */
+    #applyCascade(own) {
+        const result = new Map(own);
+        // Registry construction already refused a cycle, so a fixpoint loop terminates. Bounding it
+        // by the gate count keeps a future graph bug from hanging an operator's session regardless.
+        for (let pass = 0; pass < result.size + 1; pass += 1) {
+            let changed = false;
+            for (const gate of this.#registry.list()) {
+                const current = result.get(gate.gateId);
+                if (current === undefined)
+                    continue;
+                const blockedBy = gate.dependsOn.filter((dependency) => {
+                    const upstream = result.get(dependency);
+                    return upstream !== undefined && upstream.blocking;
+                });
+                if (blockedBy.length === 0)
+                    continue;
+                if (current.blockedBy !== undefined && sameIds(current.blockedBy, blockedBy))
+                    continue;
+                // A gate can be broken on its own account *and* blocked by something upstream. When it
+                // has a decision that is itself broken, that state wins: an operator told only "blocked
+                // upstream" would fix the upstream gate and be surprised this one still needs
+                // re-approving. `blockedBy` is set either way, so the cascade is never lost.
+                //
+                // A `pending` gate has no such decision to preserve, and there "blocked upstream" is the
+                // more useful label — it says the gate cannot even be started on yet, rather than merely
+                // that nobody has.
+                const ownStateIsInformative = current.state === "stale" ||
+                    current.state === "rejected" ||
+                    current.state === "changes_requested";
+                const state = ownStateIsInformative ? current.state : "blocked_upstream";
+                const upstreamNote = `[${blockedBy.join(", ")}] is not satisfied, so contract §13.1 invalidates this ` +
+                    "approval along with the gate it depends on.";
+                result.set(gate.gateId, {
+                    ...current,
+                    state,
+                    blockedBy,
+                    blocking: gate.enforcement === "blocking",
+                    explanation: ownStateIsInformative
+                        ? `${current.explanation ?? `Gate "${gate.gateId}" is ${current.state}.`} Additionally, ${upstreamNote}`
+                        : `Gate "${gate.gateId}" cannot be relied on because ${upstreamNote}`,
+                });
+                changed = true;
+            }
+            if (!changed)
+                break;
+        }
+        return result;
+    }
+    /**
+     * Whether an operation is authorized (contract §13.4).
+     *
+     * An approval authorizes exactly the operations its gate names in `grants` and nothing else.
+     * That is what keeps §13.4's "Uploading and making public SHOULD be separate operations"
+     * enforceable: they are two gates granting two operations, and approving one leaves the other
+     * refused.
+     *
+     * Returns a refusal rather than throwing, because a caller needs to display why an operation is
+     * unavailable.
+     */
+    async authorize(runId, operation, subjects) {
+        const statuses = await this.evaluate(runId, subjects);
+        const candidates = this.#registry.list().filter((gate) => gate.grants.includes(operation));
+        if (candidates.length === 0) {
+            return {
+                authorized: false,
+                statuses: [],
+                explanation: `No registered gate grants "${operation}". An operation nobody authorizes is refused ` +
+                    "rather than allowed, so that adding a gate is what enables an action, never omitting one.",
+            };
+        }
+        const relevant = candidates.flatMap((gate) => {
+            const status = statuses.get(gate.gateId);
+            return status === undefined ? [] : [status];
+        });
+        const granted = relevant.find((status) => status.state === "satisfied" && status.decision?.decision === "approved");
+        if (granted?.decision !== undefined) {
+            return { authorized: true, gateId: granted.gateId, decision: granted.decision };
+        }
+        return {
+            authorized: false,
+            statuses: relevant,
+            explanation: `"${operation}" is not authorized. ` +
+                relevant
+                    .map((status) => `${status.gateId}: ${status.state}${status.explanation === undefined ? "" : ` — ${status.explanation}`}`)
+                    .join("; "),
+        };
+    }
+    /**
+     * Whether a paid request may proceed (contract §13.2, §19.3).
+     *
+     * Three things must hold, and all three are checked here because any one of them alone is
+     * insufficient:
+     *
+     * 1. the gate is satisfied — §13.2 forbids paid synthesis before the operator approves;
+     * 2. the grant's limits are among what that decision bound — otherwise the ceiling could be
+     *    raised after approval without voiding it;
+     * 3. the spend fits the remaining budget — §19.3 stop-on-budget.
+     */
+    async authorizeSpend(runId, grant, request, subjects, costs) {
+        const statuses = await this.evaluate(runId, subjects);
+        const status = statuses.get(grant.gateId);
+        if (status === undefined) {
+            return {
+                authorized: false,
+                explanation: `Gate "${grant.gateId}" is not registered, so it cannot authorize spend.`,
+            };
+        }
+        if (status.state !== "satisfied" || status.decision?.decision !== "approved") {
+            return {
+                authorized: false,
+                statuses: [status],
+                explanation: `Paid work is refused: gate "${grant.gateId}" is ${status.state}. Contract §13.2 ` +
+                    "forbids paid synthesis until the operator has approved, and voids that approval once " +
+                    `any bound value changes.${status.explanation === undefined ? "" : ` ${status.explanation}`}`,
+            };
+        }
+        const decision = status.decision;
+        if (decision.decisionId !== grant.decisionId) {
+            return {
+                authorized: false,
+                statuses: [status],
+                explanation: `The grant cites decision "${grant.decisionId}", but the current decision on gate ` +
+                    `"${grant.gateId}" is "${decision.decisionId}". A grant from a superseded decision ` +
+                    "does not carry forward (§13.2).",
+            };
+        }
+        if (!decision.subjectHashes.includes(grantLimitsDigest(grant))) {
+            return {
+                authorized: false,
+                statuses: [status],
+                explanation: `The authorized maximum of ${grant.maxTotal.amount} ${grant.maxTotal.currency} is not ` +
+                    `among what decision "${decision.decisionId}" bound. Contract §13.2 requires the ` +
+                    "operator to approve a maximum authorized cost; a limit the approval never covered is " +
+                    "not an authorization.",
+            };
+        }
+        const recorded = costs ?? (this.#costs === undefined ? [] : await this.#costs.list(runId));
+        const check = checkSpend(grant, recorded, request);
+        if (!check.allowed) {
+            return { authorized: false, explanation: check.explanation, statuses: [status], check };
+        }
+        return { authorized: true, gateId: grant.gateId, decision, check };
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EACL,mBAAmB,EACnB,WAAW,GAGZ,MAAM,cAAc,CAAC;AAOtB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EACL,UAAU,EACV,iBAAiB,GAIlB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,qCAAqC;IACrC,SAAS;IACT,4FAA4F;IAC5F,8FAA8F;IAC9F,yDAAyD;IACzD,uDAAuD;IACvD,WAAW;IACX,oEAAoE;IACpE,OAAO;IACP,gCAAgC;IAChC,UAAU;IACV,sCAAsC;IACtC,mBAAmB;IACnB,kFAAkF;IAClF,QAAQ;IACR,4EAA4E;IAC5E,kBAAkB;CACV,CAAC;AAkCX,gEAAgE;AAChE,SAAS,OAAO,CAAC,CAAoB,EAAE,CAAoB;IACzD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AA6DD;;GAEG;AACH,MAAM,OAAO,UAAU;IACZ,SAAS,CAAe;IACxB,UAAU,CAAoB;IAC9B,OAAO,CAAgB;IACvB,MAAM,CAAyB;IAExC,YAAY,OAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,kDAAkD;IAClD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,eAAe,CACnB,oBAAoB,CAAC,wBAAwB,EAC7C,SAAS,IAAI,CAAC,MAAM,6BAA6B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACvF,QAAQ,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,KAAK,CAAC,SAAS,CAAC,IAAI,yBAAyB;gBACjF,uFAAuF;gBACvF,uBAAuB,EACzB;gBACE,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI;oBAC/B,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC;iBACzC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAiB;YAC7B,aAAa,EAAE,cAAc;YAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAC1E,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe;SAC/D,CAAC;QAEF,yFAAyF;QACzF,mFAAmF;QACnF,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,eAAe,CACnB,oBAAoB,CAAC,uBAAuB,EAC5C,gCAAgC,IAAI,CAAC,MAAM,gCAAgC,EAC3E,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,kBAAkB,CAAC,KAAkB,EAAE,QAAsB;QACjE,MAAM,KAAK,GAAe;YACxB,aAAa,EAAE,cAAc;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,UAAU,EAAE;YACtC,UAAU,EAAE,QAAQ,CAAC,SAAS;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,QAAQ,CAAC,QAAQ,EAAE;YACnC,KAAK,EAAE,QAAQ,CAAC,SAAS;YACzB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;gBAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;aAC1C;SACF,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,QAAwB;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CACV,SAAkC,EAClC,QAAwB;QAExB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,6EAA6E;IAC7E,YAAY,CACV,IAA4B,EAC5B,SAAkC,EAClC,QAAgC;QAEhC,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,CAAC,KAAgB,EAAW,EAAE,CAC3C,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAC;QAEjF,uFAAuF;QACvF,0FAA0F;QAC1F,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,GAAG,IAAI;gBACP,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;gBAC3B,WAAW,EAAE,SAAS,IAAI,CAAC,MAAM,6BAA6B;aAC/D,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC9E,OAAO;gBACL,GAAG,IAAI;gBACP,KAAK,EAAE,MAAM,CAAC,QAAQ;gBACtB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACjC,WAAW,EACT,MAAM,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG;aACtF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE5C,2FAA2F;QAC3F,4FAA4F;QAC5F,eAAe;QACf,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAClD,OAAO;gBACL,GAAG,IAAI;gBACP,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;gBACzB,WAAW,EACT,SAAS,IAAI,CAAC,MAAM,SAAS,MAAM,CAAC,QAAQ,QAAQ;oBACpD,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,0BAA0B,EAAE;oBACpG,2EAA2E;aAC9E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAc,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/E,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,GAA4B;QACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,4FAA4F;QAC5F,4FAA4F;QAC5F,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,OAAO,KAAK,SAAS;oBAAE,SAAS;gBAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;oBACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACxC,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBACrD,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACrC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;oBAAE,SAAS;gBAEvF,uFAAuF;gBACvF,wFAAwF;gBACxF,8EAA8E;gBAC9E,6EAA6E;gBAC7E,EAAE;gBACF,yFAAyF;gBACzF,yFAAyF;gBACzF,mBAAmB;gBACnB,MAAM,qBAAqB,GACzB,OAAO,CAAC,KAAK,KAAK,OAAO;oBACzB,OAAO,CAAC,KAAK,KAAK,UAAU;oBAC5B,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC;gBACxC,MAAM,KAAK,GAAc,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBACpF,MAAM,YAAY,GAChB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD;oBACjF,6CAA6C,CAAC;gBAEhD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;oBACtB,GAAG,OAAO;oBACV,KAAK;oBACL,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,UAAU;oBACzC,WAAW,EAAE,qBAAqB;wBAChC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,MAAM,QAAQ,OAAO,CAAC,KAAK,GAAG,kBAAkB,YAAY,EAAE;wBACxG,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,iCAAiC,YAAY,EAAE;iBACxE,CAAC,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,MAAM;QACtB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,SAAiB,EACjB,QAAwB;QAExB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,EAAE;gBACZ,WAAW,EACT,8BAA8B,SAAS,+CAA+C;oBACtF,2FAA2F;aAC9F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,UAAU,CACrF,CAAC;QACF,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClF,CAAC;QAED,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EACT,IAAI,SAAS,uBAAuB;gBACpC,QAAQ;qBACL,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CACT,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAC3G;qBACA,IAAI,CAAC,IAAI,CAAC;SAChB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,KAAiB,EACjB,OAAqB,EACrB,QAAwB,EACxB,KAA6B;QAE7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,SAAS,KAAK,CAAC,MAAM,oDAAoD;aACvF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC7E,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,WAAW,EACT,+BAA+B,KAAK,CAAC,MAAM,QAAQ,MAAM,CAAC,KAAK,mBAAmB;oBAClF,uFAAuF;oBACvF,2BAA2B,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE;aAChG,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7C,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,WAAW,EACT,6BAA6B,KAAK,CAAC,UAAU,sCAAsC;oBACnF,IAAI,KAAK,CAAC,MAAM,SAAS,QAAQ,CAAC,UAAU,wCAAwC;oBACpF,iCAAiC;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,WAAW,EACT,6BAA6B,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,UAAU;oBACvF,wBAAwB,QAAQ,CAAC,UAAU,uCAAuC;oBAClF,uFAAuF;oBACvF,uBAAuB;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;CACF"}

package/dist/errors.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Failures specific to gate evaluation and spend authorization.
+ *
+ * Aldus Core deliberately keeps no central error-code registry, so that a package can name a new
+ * failure without forking Core. These codes are this package's contribution; they carry the same
+ * `ALDUS_` prefix and `SCREAMING_SNAKE_CASE` shape so production trace (contract §20) stays
+ * uniform across packages.
+ */
+import { AldusError, type ErrorCategory } from "@aldus-runtime/core";
+/** Error codes raised by the gate engine. */
+export declare const GateEngineErrorCodes: {
+    /** A gate was referenced that is not registered. */
+    readonly GATE_NOT_FOUND: "ALDUS_GATE_NOT_FOUND";
+    /** A gate definition is internally inconsistent and was refused at registration. */
+    readonly GATE_DEFINITION_INVALID: "ALDUS_GATE_DEFINITION_INVALID";
+    /**
+     * Gate dependencies form a cycle.
+     *
+     * A configuration fault, not a data fault: contract §13.1's cascade is only meaningful over a
+     * directed acyclic graph, and a cycle would make "what does this invalidate" unanswerable.
+     */
+    readonly GATE_DEPENDENCY_CYCLE: "ALDUS_GATE_DEPENDENCY_CYCLE";
+    /**
+     * A decision was submitted by an actor the gate does not accept.
+     *
+     * Contract §13.3 keeps final performance approval human-owned, and §12 reserves the human
+     * oracle level for subjective and asymmetric-risk judgements. A machine actor satisfying such
+     * a gate would present a machine pass as semantic correctness, which §12 forbids outright.
+     */
+    readonly GATE_ACTOR_NOT_PERMITTED: "ALDUS_GATE_ACTOR_NOT_PERMITTED";
+    /** A decision was submitted that does not bind the subjects its gate requires. */
+    readonly GATE_SUBJECTS_INCOMPLETE: "ALDUS_GATE_SUBJECTS_INCOMPLETE";
+    /**
+     * An operation requiring authorization was attempted without a valid one.
+     *
+     * Contract §13.2: paid TTS MUST NOT run until the operator approves. This is the refusal that
+     * enforces it.
+     */
+    readonly AUTHORIZATION_MISSING: "ALDUS_AUTHORIZATION_MISSING";
+    /**
+     * An authorization exists but no longer binds the current inputs.
+     *
+     * Contract §13.2: "The authorization MUST be invalidated if any bound value changes."
+     */
+    readonly AUTHORIZATION_STALE: "ALDUS_AUTHORIZATION_STALE";
+    /** A spend request would exceed the authorized maximum (contract §19.3 stop-on-budget). */
+    readonly SPEND_LIMIT_EXCEEDED: "ALDUS_SPEND_LIMIT_EXCEEDED";
+    /** Two monetary values in different currencies were combined or compared. */
+    readonly CURRENCY_MISMATCH: "ALDUS_CURRENCY_MISMATCH";
+    /** A monetary amount was not a well-formed decimal string. */
+    readonly MONEY_MALFORMED: "ALDUS_MONEY_MALFORMED";
+};
+/** @see GateEngineErrorCodes */
+export type GateEngineErrorCode = (typeof GateEngineErrorCodes)[keyof typeof GateEngineErrorCodes];
+/** Construct an {@link AldusError} with a gate-engine code. */
+export declare function gateEngineError(code: GateEngineErrorCode, message: string, options: {
+    category: ErrorCategory;
+    retryable?: boolean;
+    details?: Record<string, unknown>;
+}): AldusError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB;IAC/B,oDAAoD;aACpD,cAAc,EAAE,sBAAsB;IACtC,oFAAoF;aACpF,uBAAuB,EAAE,+BAA+B;IACxD;;;;;OAKG;aACH,qBAAqB,EAAE,6BAA6B;IACpD;;;;;;OAMG;aACH,wBAAwB,EAAE,gCAAgC;IAC1D,kFAAkF;aAClF,wBAAwB,EAAE,gCAAgC;IAC1D;;;;;OAKG;aACH,qBAAqB,EAAE,6BAA6B;IACpD;;;;OAIG;aACH,mBAAmB,EAAE,2BAA2B;IAChD,2FAA2F;aAC3F,oBAAoB,EAAE,4BAA4B;IAClD,6EAA6E;aAC7E,iBAAiB,EAAE,yBAAyB;IAC5C,8DAA8D;aAC9D,eAAe,EAAE,uBAAuB;CAChC,CAAC;AAEX,gCAAgC;AAChC,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAEnG,+DAA+D;AAC/D,wBAAgB,eAAe,CAC7B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,UAAU,CAEZ"}

package/dist/errors.js

@@ -0,0 +1,57 @@
+/**
+ * Failures specific to gate evaluation and spend authorization.
+ *
+ * Aldus Core deliberately keeps no central error-code registry, so that a package can name a new
+ * failure without forking Core. These codes are this package's contribution; they carry the same
+ * `ALDUS_` prefix and `SCREAMING_SNAKE_CASE` shape so production trace (contract §20) stays
+ * uniform across packages.
+ */
+import { AldusError } from "@aldus-runtime/core";
+/** Error codes raised by the gate engine. */
+export const GateEngineErrorCodes = {
+    /** A gate was referenced that is not registered. */
+    GATE_NOT_FOUND: "ALDUS_GATE_NOT_FOUND",
+    /** A gate definition is internally inconsistent and was refused at registration. */
+    GATE_DEFINITION_INVALID: "ALDUS_GATE_DEFINITION_INVALID",
+    /**
+     * Gate dependencies form a cycle.
+     *
+     * A configuration fault, not a data fault: contract §13.1's cascade is only meaningful over a
+     * directed acyclic graph, and a cycle would make "what does this invalidate" unanswerable.
+     */
+    GATE_DEPENDENCY_CYCLE: "ALDUS_GATE_DEPENDENCY_CYCLE",
+    /**
+     * A decision was submitted by an actor the gate does not accept.
+     *
+     * Contract §13.3 keeps final performance approval human-owned, and §12 reserves the human
+     * oracle level for subjective and asymmetric-risk judgements. A machine actor satisfying such
+     * a gate would present a machine pass as semantic correctness, which §12 forbids outright.
+     */
+    GATE_ACTOR_NOT_PERMITTED: "ALDUS_GATE_ACTOR_NOT_PERMITTED",
+    /** A decision was submitted that does not bind the subjects its gate requires. */
+    GATE_SUBJECTS_INCOMPLETE: "ALDUS_GATE_SUBJECTS_INCOMPLETE",
+    /**
+     * An operation requiring authorization was attempted without a valid one.
+     *
+     * Contract §13.2: paid TTS MUST NOT run until the operator approves. This is the refusal that
+     * enforces it.
+     */
+    AUTHORIZATION_MISSING: "ALDUS_AUTHORIZATION_MISSING",
+    /**
+     * An authorization exists but no longer binds the current inputs.
+     *
+     * Contract §13.2: "The authorization MUST be invalidated if any bound value changes."
+     */
+    AUTHORIZATION_STALE: "ALDUS_AUTHORIZATION_STALE",
+    /** A spend request would exceed the authorized maximum (contract §19.3 stop-on-budget). */
+    SPEND_LIMIT_EXCEEDED: "ALDUS_SPEND_LIMIT_EXCEEDED",
+    /** Two monetary values in different currencies were combined or compared. */
+    CURRENCY_MISMATCH: "ALDUS_CURRENCY_MISMATCH",
+    /** A monetary amount was not a well-formed decimal string. */
+    MONEY_MALFORMED: "ALDUS_MONEY_MALFORMED",
+};
+/** Construct an {@link AldusError} with a gate-engine code. */
+export function gateEngineError(code, message, options) {
+    return new AldusError(code, message, options);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AAErE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,oDAAoD;IACpD,cAAc,EAAE,sBAAsB;IACtC,oFAAoF;IACpF,uBAAuB,EAAE,+BAA+B;IACxD;;;;;OAKG;IACH,qBAAqB,EAAE,6BAA6B;IACpD;;;;;;OAMG;IACH,wBAAwB,EAAE,gCAAgC;IAC1D,kFAAkF;IAClF,wBAAwB,EAAE,gCAAgC;IAC1D;;;;;OAKG;IACH,qBAAqB,EAAE,6BAA6B;IACpD;;;;OAIG;IACH,mBAAmB,EAAE,2BAA2B;IAChD,2FAA2F;IAC3F,oBAAoB,EAAE,4BAA4B;IAClD,6EAA6E;IAC7E,iBAAiB,EAAE,yBAAyB;IAC5C,8DAA8D;IAC9D,eAAe,EAAE,uBAAuB;CAChC,CAAC;AAKX,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAC7B,IAAyB,EACzB,OAAe,EACf,OAA4F;IAE5F,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `@aldus-runtime/gate-engine` — hash-bound human gates, cascading invalidation, and spend authorization.
+ *
+ * Implements architecture contract §22 **WP-05**, covering §12 (quality levels), §13 (human gates
+ * and freezes), and §19.3 (cost governance).
+ *
+ * What this package is for, in one sentence: making it impossible to spend money or publish
+ * anything on the strength of an approval that no longer describes what is about to happen.
+ *
+ * Three properties carry that weight:
+ *
+ * - **A decision binds to digests.** §3.6 requires human review to produce a durable record "tied
+ *   to exact inputs", and §13.2 voids an authorization if any bound value changes.
+ * - **Invalidation is derived, never stored.** A gate's state is recomputed from its decision,
+ *   its current inputs, and its dependencies. There is no "valid" flag for a stale approval to
+ *   survive in, so §13.1's cascade cannot be half-applied.
+ * - **A grant's ceiling is itself bound.** §13.2 requires the operator to approve a maximum
+ *   authorized cost, so the limits' digest sits among the decision's subject hashes and raising
+ *   the ceiling voids the approval that permitted the spend.
+ *
+ * What it deliberately does not do: run any check that feeds a gate. §12's evaluators, §12.1's
+ * calibration metrics (WP-10), the TTS ledger (WP-07), and the release adapters (WP-12) are
+ * elsewhere. This package models the decisions; it does not make them.
+ *
+ * Contract §13 names four gates — Content Freeze, Performance Freeze, Human Ear, Final Release —
+ * and none is hardcoded. They are the definitions an adopter is most likely to write (§4.2, §4.3).
+ *
+ * @packageDocumentation
+ */
+export { GATE_ENFORCEMENTS, GATE_LEVELS, GateRegistry, validateGateDefinition, type GateDefinition, type GateEnforcement, type GateLevel, type PromotionEvidence, type ResolvedGateDefinition, } from "./definition.js";
+export { assertSubjectsCover, detectDrift, digestBytes, digestSubjectValue, toSubjectHashes, type GateSubject, type SubjectDrift, } from "./binding.js";
+export { GATE_STATES, GateEngine, type AuthorizationGrant, type AuthorizationRefusal, type AuthorizationResult, type DecideInput, type GateEngineOptions, type GateState, type GateStatus, type SpendAuthorization, type SubjectsByGate, } from "./engine.js";
+export { SPEND_LIMIT_SUBJECT_KEY, checkSpend, computeLedger, consumesBudget, costRecordDraw, grantLimitsDigest, type SpendCheck, type SpendGrant, type SpendLedger, type SpendRefusalReason, type SpendRequest, } from "./spend.js";
+export { addMoney, assertMoney, compareMoney, formatMoney, isNegativeMoney, isPositiveMoney, subtractMoney, sumMoney, zeroMoney, } from "./money.js";
+export { MemoryCostReader, MemoryGateDecisionStore, MemoryGateEventSink, type CostReader, type GateDecisionStore, type GateEventSink, } from "./ports.js";
+export { GateEngineErrorCodes, gateEngineError, type GateEngineErrorCode } from "./errors.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,WAAW,EACX,eAAe,EACf,eAAe,EACf,aAAa,EACb,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,37 @@
+/**
+ * `@aldus-runtime/gate-engine` — hash-bound human gates, cascading invalidation, and spend authorization.
+ *
+ * Implements architecture contract §22 **WP-05**, covering §12 (quality levels), §13 (human gates
+ * and freezes), and §19.3 (cost governance).
+ *
+ * What this package is for, in one sentence: making it impossible to spend money or publish
+ * anything on the strength of an approval that no longer describes what is about to happen.
+ *
+ * Three properties carry that weight:
+ *
+ * - **A decision binds to digests.** §3.6 requires human review to produce a durable record "tied
+ *   to exact inputs", and §13.2 voids an authorization if any bound value changes.
+ * - **Invalidation is derived, never stored.** A gate's state is recomputed from its decision,
+ *   its current inputs, and its dependencies. There is no "valid" flag for a stale approval to
+ *   survive in, so §13.1's cascade cannot be half-applied.
+ * - **A grant's ceiling is itself bound.** §13.2 requires the operator to approve a maximum
+ *   authorized cost, so the limits' digest sits among the decision's subject hashes and raising
+ *   the ceiling voids the approval that permitted the spend.
+ *
+ * What it deliberately does not do: run any check that feeds a gate. §12's evaluators, §12.1's
+ * calibration metrics (WP-10), the TTS ledger (WP-07), and the release adapters (WP-12) are
+ * elsewhere. This package models the decisions; it does not make them.
+ *
+ * Contract §13 names four gates — Content Freeze, Performance Freeze, Human Ear, Final Release —
+ * and none is hardcoded. They are the definitions an adopter is most likely to write (§4.2, §4.3).
+ *
+ * @packageDocumentation
+ */
+export { GATE_ENFORCEMENTS, GATE_LEVELS, GateRegistry, validateGateDefinition, } from "./definition.js";
+export { assertSubjectsCover, detectDrift, digestBytes, digestSubjectValue, toSubjectHashes, } from "./binding.js";
+export { GATE_STATES, GateEngine, } from "./engine.js";
+export { SPEND_LIMIT_SUBJECT_KEY, checkSpend, computeLedger, consumesBudget, costRecordDraw, grantLimitsDigest, } from "./spend.js";
+export { addMoney, assertMoney, compareMoney, formatMoney, isNegativeMoney, isPositiveMoney, subtractMoney, sumMoney, zeroMoney, } from "./money.js";
+export { MemoryCostReader, MemoryGateDecisionStore, MemoryGateEventSink, } from "./ports.js";
+export { GateEngineErrorCodes, gateEngineError } from "./errors.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,sBAAsB,GAMvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,WAAW,EACX,UAAU,GAUX,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,iBAAiB,GAMlB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,WAAW,EACX,eAAe,EACf,eAAe,EACf,aAAa,EACb,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,GAIpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC"}

package/dist/money.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Exact decimal arithmetic on {@link Money}.
+ *
+ * Contract §19.3 requires per-request and per-run limits, actual cost recording, and
+ * stop-on-budget behaviour. All three are comparisons and sums over money, and Core deliberately
+ * models an amount as a decimal *string* because TTS costs are fractional-cent and IEEE-754
+ * accumulation silently corrupts the totals an operator authorises spend against.
+ *
+ * Honouring that decision means never converting an amount to `number`. Every operation here
+ * scales both operands to a common exponent and works in `bigint`, so a sum of ten thousand
+ * ten-thousandth-of-a-cent charges is exact rather than approximately exact.
+ */
+import type { Money } from "@aldus-runtime/core";
+/** A zero amount in the given currency. */
+export declare function zeroMoney(currency: string): Money;
+/**
+ * Sum two amounts exactly.
+ *
+ * @throws {AldusError} `ALDUS_CURRENCY_MISMATCH` if the currencies differ.
+ */
+export declare function addMoney(a: Money, b: Money): Money;
+/**
+ * Subtract `b` from `a` exactly. The result may be negative.
+ *
+ * @throws {AldusError} `ALDUS_CURRENCY_MISMATCH` if the currencies differ.
+ */
+export declare function subtractMoney(a: Money, b: Money): Money;
+/**
+ * Total a list of amounts exactly.
+ *
+ * @throws {AldusError} `ALDUS_CURRENCY_MISMATCH` if the amounts are not all one currency.
+ */
+export declare function sumMoney(amounts: readonly Money[], currency: string): Money;
+/**
+ * Compare two amounts: `-1` if `a < b`, `0` if equal, `1` if `a > b`.
+ *
+ * Numerically equal amounts written differently — `"1.5"` and `"1.50"` — compare equal, because
+ * trailing zeros are a presentation choice and treating them as a difference would make a budget
+ * check depend on how a provider happened to format its invoice.
+ *
+ * @throws {AldusError} `ALDUS_CURRENCY_MISMATCH` if the currencies differ.
+ */
+export declare function compareMoney(a: Money, b: Money): -1 | 0 | 1;
+/** True if the amount is greater than zero. */
+export declare function isPositiveMoney(money: Money): boolean;
+/** True if the amount is below zero. */
+export declare function isNegativeMoney(money: Money): boolean;
+/** Validate an amount, raising `ALDUS_MONEY_MALFORMED` if it is not an exact decimal. */
+export declare function assertMoney(money: Money, context?: Record<string, unknown>): Money;
+/** Render an amount for an operator-facing message. */
+export declare function formatMoney(money: Money): string;
+//# sourceMappingURL=money.d.ts.map