@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/api-lane/review.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Answering an API claim's review (Go Prod §10, `POST /v1/api/claims/:claimId/review`): the lane
+ * half of the route S3 serves. The chain lane's twin is routes/v1/reviews.ts, and the checks are
+ * the same, in the same fail-closed order — required attestation, pending, coverage, not yet
+ * folded, then the signature — with ONE difference in who the reviewer is. A MEMBER's issuer is
+ * a `did:key` they registered on THIS source as their reviewer key (`api_members.reviewerDid`),
+ * and that member must hold `claims/review` over the claim's protocol right now (§3.4 — see
+ * `mayReview`); the key is the document, so the signature check needs no network
+ * (lib/review/attestation.ts). Its `reviewerGrant` is two links — its stored access from a
+ * controller, then its own grant to that key (`parseMemberReviewGrant`). A ROOT — a current controller of the source's organisation,
+ * invoking as itself (owner 2026-10-10) — has no member row: its issuer is its own `did:ixo`, the
+ * `kid` a key on that DID's document, and it carries a `reviewerGrant` to itself
+ * (`parseSelfReviewGrant`) that the fold forwards; the engine records it as `rootKind:
+ * company-controller` and re-checks the controller live. The engine re-verifies both, and
+ * refuses a company decision's fold without a grant, so every answer carries one.
+ *
+ * A paid claim's review closes at its `answerBy` (record.ts `answerByOf`: the reservation's expiry
+ * less a margin): past it an answer is refused `REVIEW_EXPIRED` before anything is verified or
+ * written, since a fold would produce a receipt nothing can be settled against any more — except
+ * the SAME signed answer again when it first landed in time (a client retrying a 503). This is
+ * the one door to an API-lane fold (the chain route 404s an API claim: it is no watched
+ * collection), so the check lives here and nowhere else.
+ *
+ * Every check passes or NOTHING is written. Then the answers land (a re-answer before the fold
+ * replaces them and clears a `foldError` — the "try again" path), the timeline says so, and
+ * `ReviewComplete` is spawned — or an errored instance restarted — to fold them.
+ *
+ * Refusals come back as values with an App. A code (`API_ERROR_STATUS` gives the status), never
+ * thrown: the route owns the envelope. Only transient trouble (D1, the Workflows API) throws.
+ */
+import type { Config } from "../../config.js";
+import { type ApiErrorCode, type ReviewRequest, type ReviewRow } from "../../contracts/index.js";
+import { type Database } from "../../db/client.js";
+import type { OracleEnv } from "../../env.js";
+import type { BlocksyncDeps } from "../ixo/blocksync/types.js";
+export type AnswerReviewResult = {
+    ok: true;
+    review: ReviewRow;
+} | {
+    ok: false;
+    code: ApiErrorCode;
+    message: string;
+    details?: unknown;
+};
+export declare function answerApiReview(env: OracleEnv, input: {
+    sourceId: string;
+    claimId: string;
+    request: ReviewRequest;
+    /** The invoker's did:ixo when it is a ROOT of the source (the console's live controller check:
+     *  `MemberCaller.controller`); absent for a member, a key or an AI app. */
+    controllerDid?: string;
+}): Promise<AnswerReviewResult>;
+/**
+ * The fold's re-check of an API answer's reviewer (workflows/review-complete.ts), the API twin of
+ * the chain lane's fold-time gate. The answer was verified whole at the door; only what can change
+ * since is read again, with no signature or DID work: a ROOT (a `did:ixo` reviewer — a member's is
+ * always its `did:key`) is still a controller of the source's organisation; a MEMBER still holds
+ * its reviewer key, still reviews this protocol now (`mayReview`: revoked, expired, removed or
+ * re-granted narrower), its row still names the role grant the answer's first link is (a re-grant
+ * replaced it), and that link's issuer is still a controller (one roots read for both paths). Neither
+ * may be the oracle's owner (`assertNotOracle`: an owner set or changed since the answer). Revocation is the
+ * oracle's alone — the engine keeps none — so this is where a revoke between answer and fold is
+ * seen. Answers the stored grant the fold forwards; throws `REVIEWER_GRANT_INVALID` /
+ * `REVIEWER_NOT_AUTHORIZED` (`details.reason`), Blocksync trouble a 503.
+ */
+export declare function recheckApiReviewer(deps: {
+    db: Database;
+    chain: BlocksyncDeps & {
+        config: Config;
+    };
+}, review: {
+    scopeId: string;
+    reviewerDid: string;
+    reviewerGrant: string | null;
+}): Promise<string>;
+//# sourceMappingURL=review.d.ts.map

package/dist/lib/api-lane/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,KAAK,YAAY,EAAU,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,KAAK,QAAQ,EAAS,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAK3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAiB5D,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAS1E,wBAAsB,eAAe,CACnC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,CAAC;IACvB;+EAC2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAmP7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,aAAa,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACjE,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7E,OAAO,CAAC,MAAM,CAAC,CA6DjB"}

package/dist/lib/api-lane/review.js

@@ -0,0 +1,355 @@
+/**
+ * Answering an API claim's review (Go Prod §10, `POST /v1/api/claims/:claimId/review`): the lane
+ * half of the route S3 serves. The chain lane's twin is routes/v1/reviews.ts, and the checks are
+ * the same, in the same fail-closed order — required attestation, pending, coverage, not yet
+ * folded, then the signature — with ONE difference in who the reviewer is. A MEMBER's issuer is
+ * a `did:key` they registered on THIS source as their reviewer key (`api_members.reviewerDid`),
+ * and that member must hold `claims/review` over the claim's protocol right now (§3.4 — see
+ * `mayReview`); the key is the document, so the signature check needs no network
+ * (lib/review/attestation.ts). Its `reviewerGrant` is two links — its stored access from a
+ * controller, then its own grant to that key (`parseMemberReviewGrant`). A ROOT — a current controller of the source's organisation,
+ * invoking as itself (owner 2026-10-10) — has no member row: its issuer is its own `did:ixo`, the
+ * `kid` a key on that DID's document, and it carries a `reviewerGrant` to itself
+ * (`parseSelfReviewGrant`) that the fold forwards; the engine records it as `rootKind:
+ * company-controller` and re-checks the controller live. The engine re-verifies both, and
+ * refuses a company decision's fold without a grant, so every answer carries one.
+ *
+ * A paid claim's review closes at its `answerBy` (record.ts `answerByOf`: the reservation's expiry
+ * less a margin): past it an answer is refused `REVIEW_EXPIRED` before anything is verified or
+ * written, since a fold would produce a receipt nothing can be settled against any more — except
+ * the SAME signed answer again when it first landed in time (a client retrying a 503). This is
+ * the one door to an API-lane fold (the chain route 404s an API claim: it is no watched
+ * collection), so the check lives here and nowhere else.
+ *
+ * Every check passes or NOTHING is written. Then the answers land (a re-answer before the fold
+ * replaces them and clears a `foldError` — the "try again" path), the timeline says so, and
+ * `ReviewComplete` is spawned — or an errored instance restarted — to fold them.
+ *
+ * Refusals come back as values with an App. A code (`API_ERROR_STATUS` gives the status), never
+ * thrown: the route owns the envelope. Only transient trouble (D1, the Workflows API) throws.
+ */
+import { and, eq, isNotNull, isNull } from "drizzle-orm";
+import { covers } from "../../contracts/index.js";
+import { getDb } from "../../db/client.js";
+import { apiCharges, apiMembers, apiSources, claimReviews } from "../../db/schema.js";
+import { fmtTime } from "../email/template.js";
+import { AppError } from "../errors.js";
+import { reviewInstanceIdFor } from "../ids.js";
+import { depsFromEnv } from "../ixo/index.js";
+import { decode, Invalid, proofsOf, Refused, summarize } from "../ixo/grant-chain.js";
+import { getDIDWeb } from "../ixo/identity.js";
+import { verifyReviewAttestation } from "../review/attestation.js";
+import { assertNotOracle, invalid, notAuthorized, parseMemberReviewGrant, parseSelfReviewGrant, } from "../review/reviewer-grant.js";
+import { sourceRoots } from "./company.js";
+import { parseApiScopeId } from "./ids.js";
+import { liveGrant, reachesProtocol } from "./members.js";
+import { answerByOf } from "./record.js";
+import { recordEvents } from "./timeline.js";
+const refuse = (code, message, details) => ({
+    ok: false,
+    code,
+    message,
+    ...(details === undefined ? {} : { details }),
+});
+export async function answerApiReview(env, input) {
+    const { sourceId, claimId, request, controllerDid } = input;
+    const { answers, attestation, reviewerGrant } = request;
+    if (!attestation) {
+        return refuse("ATTESTATION_REQUIRED", "Review answers must be signed by the reviewer. Answer from the Decision Console, which signs them for you.");
+    }
+    // Who signed? Read unverified only to pick the path — the verification below is what proves it.
+    const issuer = issuerOf(attestation);
+    // A root answers in its own name with its grant to itself; a member with the two-link grant to
+    // its reviewer key. No grant, no review — the engine refuses a company decision's fold without
+    // one — so a missing one is the request's shape, refused before any read (as the chain route).
+    const root = !!controllerDid && issuer === controllerDid;
+    if (!reviewerGrant) {
+        return refuse("REVIEWER_GRANT_INVALID", root
+            ? "An organisation controller's review must carry reviewerGrant: a claims/review grant from your account to itself on this source, signed with the key that signed the answers. Answer from the Decision Console, which signs it for you."
+            : "A review must carry reviewerGrant: your access to this source from the organisation, then your claims/review grant to your reviewer key (at most 30 days each). Answer from the Decision Console, which signs it for you.", { reason: "absent" });
+    }
+    const { config, logger, trace } = depsFromEnv(env);
+    const db = getDb(env);
+    const decision = await db.query.decisions.findFirst({
+        where: (t, { eq: eqOp }) => eqOp(t.claimId, claimId),
+    });
+    const scope = decision && parseApiScopeId(decision.collectionId);
+    // Another source's claim does not exist (§14: 404, never 403).
+    if (!decision || !scope || scope.sourceId !== sourceId) {
+        return refuse("NOT_FOUND", `Claim ${claimId} was not found for this source.`);
+    }
+    // Erased answers (the organisation's erase — nothing else deletes them) can no longer be folded:
+    // the engine needs the body back, so an answer now would be accepted and then fail forever.
+    const claim = await db.query.apiClaims.findFirst({
+        columns: { bodyErasedAt: true },
+        where: (t, { eq: eqOp }) => eqOp(t.claimId, claimId),
+    });
+    if (claim?.bodyErasedAt) {
+        return refuse("NOT_PENDING_REVIEW", "This claim's answers were erased, so it can no longer be reviewed.");
+    }
+    const pendingTasks = decision.decision?.pendingTasks ?? [];
+    if (decision.status !== "pending_review" || pendingTasks.length === 0) {
+        return refuse("NOT_PENDING_REVIEW", "This claim isn't waiting for review answers; it may already be decided. Reload it to see its current status.");
+    }
+    // A `pending_review` row always has a digest (written together): one without is OUR broken row,
+    // never the reviewer's mismatch.
+    if (!decision.resultDigest) {
+        throw AppError.internal(`Decision ${claimId} is pending review with no resultDigest`);
+    }
+    // Past the paid claim's deadline its reservation is (nearly) gone: answering now could never be
+    // paid. The one pass: the identical signed answer that already landed before it (a retried 503).
+    const [charge, existing] = await Promise.all([
+        db.query.apiCharges.findFirst({
+            columns: { createdAt: true, reservationExpiresAt: true },
+            where: eq(apiCharges.claimId, claimId),
+        }),
+        db.query.claimReviews.findFirst({ where: (t, { eq: eqOp }) => eqOp(t.claimId, claimId) }),
+    ]);
+    const answerBy = charge && answerByOf(charge);
+    const retry = !!answerBy && existing?.attestationJws === attestation && existing.answeredAt < answerBy;
+    if (answerBy && Date.now() >= answerBy.getTime() && !retry) {
+        return refuse("REVIEW_EXPIRED", `This review closed on ${fmtTime(answerBy)}: its payment reservation expired, so answering now can't be paid. Nothing was changed.`, { answerBy: answerBy.toISOString() });
+    }
+    if (request.answeredAgainst && request.answeredAgainst !== decision.resultDigest) {
+        return refuse("NOT_PENDING_REVIEW", "This claim's decision changed while you were reviewing it. Reload the claim and review it again.");
+    }
+    const extra = Object.keys(answers).filter((id) => !pendingTasks.includes(id));
+    const missing = pendingTasks.filter((id) => !Object.hasOwn(answers, id));
+    if (extra.length > 0 || missing.length > 0) {
+        return refuse("VALIDATION", "Answer every open review task, and only those — details lists the missing and the extra ones.", {
+            missing,
+            extra,
+        });
+    }
+    if (existing?.foldedAt)
+        return refuse("NOT_PENDING_REVIEW", "This claim has already been reviewed.");
+    if (issuer === undefined) {
+        return refuse("ATTESTATION_INVALID", "The review answers' signature could not be read. Answer again from the Decision Console.");
+    }
+    // A member's key must be one a member registered on this source — and whose member may review
+    // this claim — refused before any crypto. A root's standing is the console's live controller
+    // check; its key is proved on its DID document by the verification below.
+    let member = null;
+    if (!root) {
+        const reviewer = issuer.startsWith("did:key:") &&
+            (await db.query.apiMembers.findFirst({
+                where: and(eq(apiMembers.sourceId, sourceId), eq(apiMembers.reviewerDid, issuer), isNotNull(apiMembers.acceptedAt)),
+            }));
+        const chain = { config, trace };
+        if (!reviewer || !(await mayReview({ db, chain }, reviewer, scope.protocolDid))) {
+            return refuse("ATTESTATION_KEY_UNKNOWN", "These answers are not signed with the reviewer key of a member allowed to review this claim. Register your reviewer key in the console (your member settings), or ask the source's owner for a role that can review.");
+        }
+        // `mayReview` passed (so `did` is set). A controller with a member row but no stored grant has
+        // no first link to send: it answers as root, in its own did:ixo.
+        const source = await db.query.apiSources.findFirst({
+            columns: { companyEntityDid: true },
+            where: eq(apiSources.sourceId, sourceId),
+        });
+        member = {
+            did: reviewer.did,
+            delegationCid: reviewer.delegationCid ?? "",
+            roots: source ? await sourceRoots(chain, source) : [],
+        };
+    }
+    if (!config.SERVICE_ED25519_MNEMONIC) {
+        throw AppError.internal("SERVICE_ED25519_MNEMONIC not configured");
+    }
+    // The oracle the reviewer answered — the same did:web the chain lane's attestation names.
+    const { serviceDid } = await getDIDWeb(config.SERVICE_ED25519_MNEMONIC, config.ORACLE_HOSTNAME);
+    const verified = await verifyReviewAttestation({ config }, attestation, {
+        issuer,
+        oracleDid: serviceDid,
+        claimId,
+        answeredAgainst: decision.resultDigest,
+        answers,
+    });
+    if (!verified.ok) {
+        return refuse(verified.code, verified.code === "ATTESTATION_UNRESOLVABLE"
+            ? "The reviewer's identity couldn't be checked right now. Nothing was recorded — retry in a moment."
+            : "The review answers' signature was rejected (details.failures says why). Answer again from the Decision Console.", {
+            failures: verified.failures,
+        });
+    }
+    // The grant: a root's to itself, signed by the very key the answers were (now proved on its
+    // IID); a member's two links, its stored access then its grant to the key that signed.
+    let grant;
+    try {
+        grant = (member
+            ? await parseMemberReviewGrant(config, reviewerGrant, {
+                sourceId,
+                memberDid: member.did,
+                reviewerKey: issuer,
+                delegationCid: member.delegationCid,
+                roots: member.roots,
+            })
+            : await parseSelfReviewGrant(config, reviewerGrant, {
+                sourceId,
+                controllerDid: issuer,
+                keyDid: verified.kid,
+            })).delegation;
+    }
+    catch (err) {
+        if (err instanceof AppError &&
+            (err.code === "REVIEWER_GRANT_INVALID" || err.code === "REVIEWER_NOT_AUTHORIZED")) {
+            return refuse(err.code, err.message, err.details);
+        }
+        throw err;
+    }
+    // The same signed answer again (a client retrying a 503) keeps its first moment, so its timeline
+    // row is the same row.
+    const answeredAt = existing?.attestationJws === attestation ? existing.answeredAt : new Date();
+    const fields = {
+        answers,
+        reviewerDid: issuer,
+        attestationJws: attestation,
+        // Forwarded verbatim by the fold (workflows/review-complete.ts).
+        reviewerGrant: grant,
+        answeredAt,
+        foldedAt: null,
+        foldError: null,
+    };
+    // Never over a fold that landed since the read above: the folded row is final.
+    const [row] = await db
+        .insert(claimReviews)
+        .values({ claimId, ...fields })
+        .onConflictDoUpdate({
+        target: claimReviews.claimId,
+        set: fields,
+        setWhere: isNull(claimReviews.foldedAt),
+    })
+        .returning();
+    if (!row)
+        return refuse("NOT_PENDING_REVIEW", "This claim has already been reviewed.");
+    await recordEvents(db, [
+        {
+            key: `${claimId}:review_answered:${verified.cid}`,
+            at: answeredAt,
+            sourceId,
+            claimId,
+            type: "review_answered",
+            data: { reviewerDid: issuer, tasks: pendingTasks, attestationCid: verified.cid },
+        },
+    ]);
+    await spawnReviewComplete(env, claimId);
+    logger.info("api.review.received", {
+        claimId,
+        sourceId,
+        reviewerDid: issuer,
+        attestationCid: verified.cid,
+        resend: !!existing,
+    });
+    return {
+        ok: true,
+        review: {
+            claimId,
+            answers: row.answers,
+            reviewerDid: row.reviewerDid,
+            answeredAt: row.answeredAt.toISOString(),
+            foldedAt: null,
+            foldError: null,
+        },
+    };
+}
+/**
+ * The fold's re-check of an API answer's reviewer (workflows/review-complete.ts), the API twin of
+ * the chain lane's fold-time gate. The answer was verified whole at the door; only what can change
+ * since is read again, with no signature or DID work: a ROOT (a `did:ixo` reviewer — a member's is
+ * always its `did:key`) is still a controller of the source's organisation; a MEMBER still holds
+ * its reviewer key, still reviews this protocol now (`mayReview`: revoked, expired, removed or
+ * re-granted narrower), its row still names the role grant the answer's first link is (a re-grant
+ * replaced it), and that link's issuer is still a controller (one roots read for both paths). Neither
+ * may be the oracle's owner (`assertNotOracle`: an owner set or changed since the answer). Revocation is the
+ * oracle's alone — the engine keeps none — so this is where a revoke between answer and fold is
+ * seen. Answers the stored grant the fold forwards; throws `REVIEWER_GRANT_INVALID` /
+ * `REVIEWER_NOT_AUTHORIZED` (`details.reason`), Blocksync trouble a 503.
+ */
+export async function recheckApiReviewer(deps, review) {
+    const { db, chain } = deps;
+    const scope = parseApiScopeId(review.scopeId);
+    if (!scope)
+        throw AppError.internal(`Not an API scope id: ${review.scopeId}`);
+    const grant = review.reviewerGrant;
+    if (!grant)
+        throw invalid("absent", "the answer carries no reviewer grant — answer again");
+    const source = await db.query.apiSources.findFirst({
+        columns: { companyEntityDid: true },
+        where: eq(apiSources.sourceId, scope.sourceId),
+    });
+    const roots = source ? await sourceRoots(chain, source) : [];
+    if (review.reviewerDid.startsWith("did:ixo:")) {
+        await assertNotOracle(chain.config, [review.reviewerDid]);
+        if (!roots.includes(review.reviewerDid)) {
+            throw notAuthorized("root-not-controller", `${review.reviewerDid} is no longer a controller of this source's organisation`);
+        }
+        return grant;
+    }
+    const member = await db.query.apiMembers.findFirst({
+        where: and(eq(apiMembers.sourceId, scope.sourceId), eq(apiMembers.reviewerDid, review.reviewerDid), isNotNull(apiMembers.acceptedAt)),
+    });
+    if (!member) {
+        throw notAuthorized("revoked", "your reviewer key changed (or you were removed) since you answered — answer again");
+    }
+    if (!(await mayReview({ db, chain }, member, scope.protocolDid))) {
+        throw notAuthorized("revoked", "the reviewer no longer holds claims/review on this source for this claim's protocol");
+    }
+    let access;
+    try {
+        const [root] = await proofsOf(await decode(grant), { max: 1, message: "two links" });
+        access = root ? await summarize(root) : undefined;
+    }
+    catch (err) {
+        if (!(err instanceof Invalid || err instanceof Refused))
+            throw err;
+    }
+    if (!access || access.cid !== member.delegationCid) {
+        throw notAuthorized("revoked", "the reviewer's access to this source changed since they answered — they answer again");
+    }
+    await assertNotOracle(chain.config, [access.issuer, member.did ?? "", review.reviewerDid]);
+    if (!roots.includes(access.issuer)) {
+        throw notAuthorized("root-not-controller", `${access.issuer}, who granted the reviewer's access, is no longer a controller of this source's organisation`);
+    }
+    return grant;
+}
+/** Does this member hold `claims/review` over `protocolDid` NOW (§3.4)? See `liveGrant`. */
+async function mayReview(deps, member, protocolDid) {
+    if (!member.did)
+        return false;
+    const grant = await liveGrant(deps, member.sourceId, member.did);
+    return (grant !== null &&
+        covers(grant.capabilities, "claims/review") &&
+        reachesProtocol(grant, protocolDid));
+}
+/**
+ * The payload's `issuer` (a member's `did:key`, a root's `did:ixo`, or anything — the checks
+ * decide); undefined when the attestation is not a JWS with a readable string issuer at all.
+ */
+function issuerOf(jws) {
+    try {
+        const payload = jws.split(".")[1] ?? "";
+        const json = atob(payload.replaceAll("-", "+").replaceAll("_", "/"));
+        const issuer = JSON.parse(json).issuer;
+        return typeof issuer === "string" ? issuer : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Spawn (or revive) the fold, as the chain route does: the id is deterministic, so a duplicate
+ * throws "exists" — a running or complete instance is already folding, an errored one restarts.
+ */
+async function spawnReviewComplete(env, claimId) {
+    const id = await reviewInstanceIdFor(claimId);
+    try {
+        await env.REVIEW_WORKFLOW.create({ id, params: { claimId } });
+    }
+    catch (err) {
+        const instance = await env.REVIEW_WORKFLOW.get(id).catch(() => null);
+        if (!instance)
+            throw AppError.unavailable("Review workflow unavailable", err);
+        const { status } = await instance.status();
+        if (status === "errored" || status === "terminated")
+            await instance.restart();
+    }
+}
+//# sourceMappingURL=review.js.map

package/dist/lib/api-lane/review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../../src/lib/api-lane/review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAqB,MAAM,EAAsC,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAiB,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAkB,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEnG,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EACL,eAAe,EACf,OAAO,EACP,aAAa,EACb,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM1C,MAAM,MAAM,GAAG,CAAC,IAAkB,EAAE,OAAe,EAAE,OAAiB,EAAsB,EAAE,CAAC,CAAC;IAC9F,EAAE,EAAE,KAAK;IACT,IAAI;IACJ,OAAO;IACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAc,EACd,KAOC;IAED,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAC5D,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,MAAM,CACX,sBAAsB,EACtB,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,gGAAgG;IAChG,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrC,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,MAAM,KAAK,aAAa,CAAC;IACzD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI;YACF,CAAC,CAAC,wOAAwO;YAC1O,CAAC,CAAC,2NAA2N,EAC/N,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;KACrD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACjE,+DAA+D;IAC/D,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,WAAW,EAAE,SAAS,OAAO,iCAAiC,CAAC,CAAC;IAChF,CAAC;IACD,iGAAiG;IACjG,4FAA4F;IAC5F,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;QAC/C,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;QACxB,OAAO,MAAM,CACX,oBAAoB,EACpB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,MAAM,CACX,oBAAoB,EACpB,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IACD,gGAAgG;IAChG,iCAAiC;IACjC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,OAAO,yCAAyC,CAAC,CAAC;IACxF,CAAC;IACD,gGAAgG;IAChG,iGAAiG;IACjG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YAC5B,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE;YACxD,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;SACvC,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GACT,CAAC,CAAC,QAAQ,IAAI,QAAQ,EAAE,cAAc,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC;IAC3F,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3D,OAAO,MAAM,CACX,gBAAgB,EAChB,yBAAyB,OAAO,CAAC,QAAQ,CAAC,yFAAyF,EACnI,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjF,OAAO,MAAM,CACX,oBAAoB,EACpB,kGAAkG,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,MAAM,CACX,YAAY,EACZ,+FAA+F,EAC/F;YACE,OAAO;YACP,KAAK;SACN,CACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,QAAQ;QACpB,OAAO,MAAM,CAAC,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;IAE/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CACX,qBAAqB,EACrB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,6FAA6F;IAC7F,0EAA0E;IAC1E,IAAI,MAAM,GAAmE,IAAI,CAAC;IAClF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,QAAQ,GACZ,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YAC7B,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;gBACnC,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACjC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CACjC;aACF,CAAC,CAAC,CAAC;QACN,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,MAAM,CACX,yBAAyB,EACzB,sNAAsN,CACvN,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;YACnC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,GAAG;YACP,GAAG,EAAE,QAAQ,CAAC,GAAa;YAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;YAC3C,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IACrE,CAAC;IACD,0FAA0F;IAC1F,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE;QACtE,MAAM;QACN,SAAS,EAAE,UAAU;QACrB,OAAO;QACP,eAAe,EAAE,QAAQ,CAAC,YAAY;QACtC,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,CACX,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,KAAK,0BAA0B;YAC1C,CAAC,CAAC,kGAAkG;YACpG,CAAC,CAAC,iHAAiH,EACrH;YACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CACF,CAAC;IACJ,CAAC;IACD,4FAA4F;IAC5F,uFAAuF;IACvF,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,CACN,MAAM;YACJ,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE;gBAClD,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,WAAW,EAAE,MAAM;gBACnB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC;YACJ,CAAC,CAAC,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE;gBAChD,QAAQ;gBACR,aAAa,EAAE,MAAM;gBACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;aACrB,CAAC,CACP,CAAC,UAAU,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,QAAQ;YACvB,CAAC,GAAG,CAAC,IAAI,KAAK,wBAAwB,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,CAAC,EACjF,CAAC;YACD,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iGAAiG;IACjG,uBAAuB;IACvB,MAAM,UAAU,GAAG,QAAQ,EAAE,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG;QACb,OAAO;QACP,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,WAAW;QAC3B,iEAAiE;QACjE,aAAa,EAAE,KAAK;QACpB,UAAU;QACV,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,+EAA+E;IAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;SAC9B,kBAAkB,CAAC;QAClB,MAAM,EAAE,YAAY,CAAC,OAAO;QAC5B,GAAG,EAAE,MAAM;QACX,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC;KACxC,CAAC;SACD,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;IACvF,MAAM,YAAY,CAAC,EAAE,EAAE;QACrB;YACE,GAAG,EAAE,GAAG,OAAO,oBAAoB,QAAQ,CAAC,GAAG,EAAE;YACjD,EAAE,EAAE,UAAU;YACd,QAAQ;YACR,OAAO;YACP,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE;SACjF;KACF,CAAC,CAAC;IACH,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;QACjC,OAAO;QACP,QAAQ;QACR,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,QAAQ,CAAC,GAAG;QAC5B,MAAM,EAAE,CAAC,CAAC,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,OAAO;YACP,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;YACxC,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAiE,EACjE,MAA8E;IAE9E,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,qDAAqD,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;QACnC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,aAAa,CACjB,qBAAqB,EACrB,GAAG,MAAM,CAAC,WAAW,0DAA0D,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACvC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAC9C,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CACjC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,aAAa,CACjB,SAAS,EACT,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,aAAa,CACjB,SAAS,EACT,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,MAAmD,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,GAAG,YAAY,OAAO,CAAC;YAAE,MAAM,GAAG,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,aAAa,CACjB,SAAS,EACT,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,aAAa,CACjB,qBAAqB,EACrB,GAAG,MAAM,CAAC,MAAM,8FAA8F,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,SAAS,CACtB,IAA4C,EAC5C,MAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CACL,KAAK,KAAK,IAAI;QACd,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC;QAC3C,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,MAAM,CAAC;QACjE,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAc,EAAE,OAAe;IAChE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/lib/api-lane/reviewers.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Telling the people (Go Prod §10.1, §10.4; copy in the member-emails spec §5–§7): when an API
+ * claim goes `pending_review`, every member who can answer it hears about it — by email, and in
+ * the source's review room on Matrix — and the ones nobody answers are reminded at 3 and 14 days.
+ *
+ * Who: an accepted member whose grant is live right now (`liveMembers` — `liveGrant` for a whole
+ * source in one query: unrevoked, unexpired, the source's owner the root) and carries
+ * `claims/review`. Email also needs the grant to reach the claim's protocol (`nb.protocols`), an
+ * address on the row (a member invited by DID has none: Matrix only) and `notifyReviews` on. Every
+ * email — §5, §6 and the reminders — also goes to the source's `contactEmail` (`recipientsOf`): an
+ * org admin has no member row, and would otherwise never hear of a claim until it was 3 days old —
+ * unless a member with that same address is already sent every claim the contact would be. The
+ * room takes every review-capable member: one room per source cannot be narrowed per protocol, so
+ * its notices reach a protocol-narrowed member too — accepted, since a notice carries no answers.
+ *
+ * The 15-minute window (§10.1): `api_members.reviewEmailAt` is when the member was last emailed
+ * about this source (the contact's, with no member row, is its `rvw:<sourceId>` marker's
+ * `updatedAt`). A claim arriving with the window closed claims it (one conditional UPDATE — the
+ * mutex, so two racing notify steps never both send) and goes out at once — as §5, or as §6 with
+ * whatever was still held for the member folded in; one arriving while it is open is HELD — its
+ * `rv:` row written `pending` — and the minute tick sends everything held for the member as ONE
+ * email once the window has run out (§6; a lone held claim reads better as §5). Every send opens
+ * the next window, so it is never more than one email per 15 minutes.
+ *
+ * Membership of the room follows the grants: each person is invited from their own `rvi:` row
+ * (keyed by MXID, so a member removed and re-added is the same row, never kicked by their old one),
+ * and one whose grant is gone (revoked, expired, removed) is kicked on the next notify for that
+ * source AND on the hourly pass — whichever comes first.
+ *
+ * Idempotent and fail-soft like every side-effect lane (lib/matrix/deliver.ts): each email and
+ * notice is a `matrix_deliveries` row keyed by what it is about (schema header). An email's row is
+ * CLAIMED before the send (`claimRows`: inserted `sending`, or a `failed` one taken over), so two
+ * racing callers never both send, and a row once `sent` is never moved off it. A crash between
+ * the send and its mark leaves the row `sending` — never re-sent: at most once, like every notice.
+ * A `failed` email is NOT re-driven by anything but the path that wrote it running again (a
+ * notify-step replay; a reminder claim stays due until one of its sends lands) — at most
+ * `MAX_ATTEMPTS`. Nothing here throws for an email or Matrix failure, and no `EMAIL` binding,
+ * sender, `CONSOLE_URL` (every link) or Matrix token ⇒ skipped with one log line. The timeline
+ * gets `review_notified` with COUNTS only — never an address.
+ *
+ * D1 allows 1000 queries per invocation, so every cron pass is bounded: a flush serves at most
+ * `FLUSH_MEMBERS` members (oldest held first), the room pass `ROOMS_PER_PASS` rooms (least
+ * recently synced first), and a source's reviewer set is one query.
+ */
+import type { Config } from "../../config.js";
+import type { Database } from "../../db/client.js";
+import { type ReviewEmailClaim } from "../email/template.js";
+import type { Logger } from "../logger.js";
+import type { Metrics } from "../metrics.js";
+import type { TraceContext } from "../tracing.js";
+export interface ReviewerDeps {
+    db: Database;
+    config: Config;
+    logger: Logger;
+    metrics: Metrics;
+    trace: TraceContext;
+    cache: KVNamespace;
+    /** `env.EMAIL`; absent ⇒ no emails (one log line). */
+    email?: SendEmail;
+}
+/** §10.1: at most one review email per member per source per window. */
+export declare const REVIEW_EMAIL_WINDOW_MS: number;
+/** Members emailed per minute tick: each is a few queries, and the tick shares D1's budget. */
+export declare const FLUSH_MEMBERS = 50;
+/** Review rooms re-synced per hourly pass (one query for its people, one for its invites). */
+export declare const ROOMS_PER_PASS = 20;
+/** A claim still waiting for an answer, as the emails show it plus what the recipients need. */
+export interface AwaitingClaim extends ReviewEmailClaim {
+    sourceId: string;
+    protocolDid: string;
+}
+/**
+ * Tell the claim's reviewers it is waiting (the notify step, after `review_required` is on the
+ * timeline). Never throws: a failure here is one log line, never the claim's.
+ */
+export declare function notifyReviewers(deps: ReviewerDeps, claimId: string, now?: Date): Promise<void>;
+/**
+ * Send what was held for every recipient whose window has run out: §6 over the claims still waiting
+ * (§5 for a lone one). A claim answered meanwhile, or a member who lost access, opted out, has no
+ * address any more or was removed (a contact whose address was cleared), is dropped (`skipped`).
+ * Only closed-window recipients are read (the joins), oldest held first, at most `FLUSH_MEMBERS` a
+ * tick — a backlog drains over ticks and nobody starves behind recipients whose window is still
+ * open. The count of emails sent.
+ */
+export declare function flushReviewBatches(deps: ReviewerDeps, now?: Date): Promise<number>;
+/**
+ * §10.4: every API claim still waiting 3 (and 14) days after it was decided `review` gets its
+ * reminder — batched per recipient and source like §6: one email listing all their due claims.
+ * The recipients are §5's (`recipientsOf`: the members and the source's contact). Each claim is marked done
+ * (`notice_review_reminder:<claimId>:<days>`) once its pass ran, so the pass never reads it again —
+ * except one whose every send this pass failed: it stays due and the next hour retries it (the
+ * `rv3:`/`rv14:` rows' attempts bound that, and keep a re-run from re-sending the ones that landed).
+ * A paid claim's reminder states its `answerBy` (template.ts); one already past it is not sent.
+ */
+export declare function remindReviewers(deps: ReviewerDeps, now?: Date): Promise<number>;
+/**
+ * The hourly pass over the review rooms: kick whoever lost access since (and retry a failed
+ * invite). `ROOMS_PER_PASS` rooms a pass, least recently synced first — the room marker's
+ * `updatedAt` is the rotation's cursor, touched after each sync.
+ */
+export declare function syncReviewRooms(deps: ReviewerDeps, now?: Date): Promise<void>;
+/**
+ * The paid claims whose review closed unanswered (§10: `review_expired`) and are not yet announced
+ * — no `notice_review_expired:` marker — oldest deadline first, bounded like every pass. The SQL
+ * is `answerByOf`'s twin (the extended expiry, else the charge's `createdAt` + 24 h, less the
+ * margin), re-checked with the function itself so the two can never disagree about a claim.
+ */
+export declare function expiredReviews(db: Database, now: Date): Promise<AwaitingClaim[]>;
+//# sourceMappingURL=reviewers.d.ts.map

package/dist/lib/api-lane/reviewers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewers.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/reviewers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAgBhD,OAAO,EAGL,KAAK,gBAAgB,EAKtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAcxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;IACnB,sDAAsD;IACtD,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAKlD,+FAA+F;AAC/F,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,8FAA8F;AAC9F,eAAO,MAAM,cAAc,KAAK,CAAC;AA0BjC,gGAAgG;AAChG,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAaD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CA0Cf;AA+ID;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,YAAY,EAClB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA0FjB;AAID;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6EjG;AAuLD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/F;AAiDD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAatF"}