@titan-design/hitl 0.2.1 → 0.3.1

package/README.md

@@ -97,6 +97,43 @@ can send on as-is.
 The row carries a `reason` column beyond the minimum, so a cancelled gate can
 tell its waiter why.
 
+## Who resolved it
+
+`resolve` and `resolveGate` take an optional third argument, a `GateResolver`:
+`{ class, id, channel, confirmEvent? }`. `class` is an actor class from
+`@titan-design/authority`. The store records it as `resolvedBy`.
+
+```ts
+resolveGate(store, "deploy-approval", { approved: true }, {
+  class: "owner-terminal",
+  id: "owner",
+  channel: "cli",
+});
+```
+
+Every store refuses a resolver whose class is not in authority's `RESOLVER_CLASSES`, so an
+agent or automation never answers a gate. It throws `GateResolverRefused` and the gate stays
+pending. The store reads each declared resolver field once into a frozen copy, and checks and stores
+only that copy. A store's `authorize` option runs after the class check and can refuse more,
+never fewer. It must return `{ allowed }` synchronously, or the store throws
+`GateAuthorizeInvalid`. With `authorize` installed, a resolve that names no resolver is refused.
+Refusals name the gate id and the actor class, never the resolver's other fields.
+
+hitl records a claim about the resolver; it cannot prove one. Any process that can write
+the database can claim any class.
+
+On SQLite the resolver lives in a `resolved_by` column that `gateResolverMigration(n)` adds,
+along with a trigger that refuses any resolve naming no resolver. Add it to your own
+migration list after `gateMigration`. It is idempotent and does not backfill: gates resolved
+before it read back with `resolvedBy` undefined. Until the migration runs, a store resolves
+without a resolver as before and throws `GateStoreSchemaOutdated` when given one, rather
+than dropping it. `migrate: true` does not run it yet.
+
+After the migration, a writer built on hitl 0.2.x fails when it resolves: SQLite aborts the
+statement with a raw error whose message is `hitl: resolvedBy required`. The same trigger
+refuses a direct insert of a resolved row with no resolver. Cancels from an old writer still
+work. The fix is to upgrade that writer so it passes a resolver.
+
 ## Settling
 
 A gate is `pending`, then exactly one of `resolved`, `cancelled`, or `expired`.

package/dist/{base-store-BeRbMZEp.d.ts → base-store-BvwOJL6M.d.ts}

@@ -1,3 +1,5 @@
+import { ActorClass } from '@titan-design/authority';
+
 /** A gate is a row, never a promise: pending work survives the process that opened it. */
 type GateStatus = "pending" | "resolved" | "cancelled" | "expired";
 /** A JSON Schema document, stored so any process can validate a payload without the original zod schema. */
@@ -14,7 +16,28 @@ interface GateRecord {
     createdAt: string;
     resolvedAt: string | undefined;
     expiresAt: string | undefined;
+    /** Who resolved the gate, as claimed by the caller; unset for gates resolved before stores recorded it. */
+    resolvedBy: GateResolver | undefined;
+}
+/** A claim about who answered a gate. hitl records it and checks its class; it cannot prove it. */
+interface GateResolver {
+    class: ActorClass;
+    id: string;
+    channel: string;
+    /** The channel's own id for the confirming event, such as a chat reaction. */
+    confirmEvent?: string;
 }
+type GateAuthorization = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+/**
+ * Runs after the default resolver-class check, so it can refuse a resolver but
+ * never admit one the default refused. Must return synchronously.
+ */
+type GateAuthorize = (gate: Readonly<GateRecord>, resolver: Readonly<GateResolver>) => GateAuthorization;
 interface GateInput {
     /** Defaults to a random UUID. Supply one to make the gate addressable by a name you already own. */
     id?: string;
@@ -29,7 +52,7 @@ interface GateInput {
 interface GateStore {
     create(input: GateInput): GateRecord;
     get(id: string): GateRecord | undefined;
-    resolve(id: string, payload: unknown): GateRecord;
+    resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;
     cancel(id: string, reason: string): GateRecord;
     listPending(): GateRecord[];
 }
@@ -61,6 +84,20 @@ declare class GatePayloadInvalid extends GateError {
 declare class GateAborted extends GateError {
     constructor(gateId: string, reason: string);
 }
+declare class GateResolverRefused extends GateError {
+    readonly actorClass: string | undefined;
+    readonly reason: string;
+    constructor(gateId: string, actorClass: string | undefined, reason: string);
+}
+/** The store cannot record a resolver because its table predates the resolver migration. */
+declare class GateStoreSchemaOutdated extends GateError {
+    readonly table: string;
+    readonly migration: string;
+    constructor(gateId: string, table: string, migration: string);
+}
+declare class GateAuthorizeInvalid extends GateError {
+    constructor(gateId: string);
+}
 
 /**
  * Every settle rule lives here so the memory and SQLite stores cannot drift
@@ -68,20 +105,23 @@ declare class GateAborted extends GateError {
  */
 declare abstract class BaseGateStore implements GateStore {
     protected readonly clock: () => number;
-    protected constructor(clock: () => number);
+    private readonly authorize?;
+    protected constructor(clock: () => number, authorize?: GateAuthorize | undefined);
     protected abstract insert(record: GateRecord): void;
     protected abstract read(id: string): GateRecord | undefined;
     protected abstract update(record: GateRecord): void;
     protected abstract readByStatus(status: GateRecord["status"]): GateRecord[];
     create(input: GateInput): GateRecord;
     get(id: string): GateRecord | undefined;
-    resolve(id: string, payload: unknown): GateRecord;
+    resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;
     cancel(id: string, reason: string): GateRecord;
     listPending(): GateRecord[];
     private requirePending;
+    /** The default check runs first and `authorize` second, so `authorize` can only narrow who may resolve. */
+    private requireAuthorized;
     /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */
     private lapseIfExpired;
     protected nowIso(): string;
 }
 
-export { BaseGateStore as B, type GateRecord as G, type JsonSchema as J, type GateStore as a, GateAborted as b, GateAlreadyExists as c, GateAlreadySettled as d, GateCancelled as e, GateError as f, GateExpired as g, type GateInput as h, GateNotFound as i, GatePayloadInvalid as j, type GateStatus as k };
+export { BaseGateStore as B, type GateRecord as G, type JsonSchema as J, type GateStore as a, type GateResolver as b, type GateAuthorize as c, GateAborted as d, GateAlreadyExists as e, GateAlreadySettled as f, type GateAuthorization as g, GateAuthorizeInvalid as h, GateCancelled as i, GateError as j, GateExpired as k, type GateInput as l, GateNotFound as m, GatePayloadInvalid as n, GateResolverRefused as o, type GateStatus as p, GateStoreSchemaOutdated as q };

package/dist/{chunk-5P4RFTKR.js → chunk-4GAZKT6Z.js}

@@ -48,6 +48,29 @@ var GateAborted = class extends GateError {
     super(`stopped waiting on gate ${gateId}: ${reason}`, gateId);
   }
 };
+var GateResolverRefused = class extends GateError {
+  constructor(gateId, actorClass, reason) {
+    super(`gate ${gateId} refused a resolution by ${actorClass ?? "an unnamed resolver"}: ${reason}`, gateId);
+    this.actorClass = actorClass;
+    this.reason = reason;
+  }
+  actorClass;
+  reason;
+};
+var GateStoreSchemaOutdated = class extends GateError {
+  constructor(gateId, table, migration) {
+    super(`gate ${gateId} cannot record its resolver: table ${table} needs ${migration}`, gateId);
+    this.table = table;
+    this.migration = migration;
+  }
+  table;
+  migration;
+};
+var GateAuthorizeInvalid = class extends GateError {
+  constructor(gateId) {
+    super(`authorize for gate ${gateId} must return a decision { allowed: boolean } synchronously`, gateId);
+  }
+};
 
 // src/json-schema.ts
 function checkAgainstJsonSchema(schema, value, path = "$") {
@@ -120,12 +143,51 @@ function describe(value) {
   return Array.isArray(value) ? "array" : typeof value;
 }
 
+// src/resolver-policy.ts
+import { ACTOR_CLASSES, RESOLVER_CLASSES } from "@titan-design/authority";
+function defaultResolverRefusal(resolver) {
+  if (RESOLVER_CLASSES.includes(resolver.class)) return void 0;
+  return `actor class ${resolver.class} may not resolve a gate`;
+}
+function snapshotResolver(gateId, raw) {
+  if (typeof raw !== "object" || raw === null) throw new GateResolverRefused(gateId, void 0, "the resolver is not an object");
+  const { class: actorClass, id, channel, confirmEvent } = raw;
+  if (!isActorClass(actorClass)) {
+    throw new GateResolverRefused(gateId, void 0, "the resolver's class is not a known actor class");
+  }
+  if (typeof id !== "string" || typeof channel !== "string") {
+    throw new GateResolverRefused(gateId, actorClass, "the resolver's id and channel must be strings");
+  }
+  if (confirmEvent === void 0) return Object.freeze({ class: actorClass, id, channel });
+  if (typeof confirmEvent !== "string") {
+    throw new GateResolverRefused(gateId, actorClass, "the resolver's confirmEvent must be a string");
+  }
+  return Object.freeze({ class: actorClass, id, channel, confirmEvent });
+}
+function readDecision(gateId, decision) {
+  if (typeof decision !== "object" || decision === null) throw new GateAuthorizeInvalid(gateId);
+  const { then, allowed, reason } = decision;
+  if (typeof then === "function") {
+    then.call(decision, void 0, () => {
+    });
+    throw new GateAuthorizeInvalid(gateId);
+  }
+  if (typeof allowed !== "boolean") throw new GateAuthorizeInvalid(gateId);
+  if (allowed) return { allowed: true };
+  return { allowed: false, reason: typeof reason === "string" ? reason : "authorize refused the resolver" };
+}
+function isActorClass(value) {
+  return typeof value === "string" && ACTOR_CLASSES.includes(value);
+}
+
 // src/base-store.ts
 var BaseGateStore = class {
-  constructor(clock) {
+  constructor(clock, authorize) {
     this.clock = clock;
+    this.authorize = authorize;
   }
   clock;
+  authorize;
   create(input) {
     const id = input.id ?? globalThis.crypto.randomUUID();
     if (this.read(id)) throw new GateAlreadyExists(id);
@@ -138,7 +200,8 @@ var BaseGateStore = class {
       reason: void 0,
       createdAt: this.nowIso(),
       resolvedAt: void 0,
-      expiresAt: toIso(input.expiresAt)
+      expiresAt: toIso(input.expiresAt),
+      resolvedBy: void 0
     };
     this.insert(record);
     return record;
@@ -147,13 +210,15 @@ var BaseGateStore = class {
     const record = this.read(id);
     return record ? this.lapseIfExpired(record) : void 0;
   }
-  resolve(id, payload) {
+  resolve(id, payload, resolvedBy) {
+    const resolver = resolvedBy === void 0 ? void 0 : snapshotResolver(id, resolvedBy);
     const record = this.requirePending(id);
+    this.requireAuthorized(record, resolver);
     if (record.schema) {
       const issues = checkAgainstJsonSchema(record.schema, payload);
       if (issues.length > 0) throw new GatePayloadInvalid(id, issues);
     }
-    const resolved = { ...record, status: "resolved", payload, resolvedAt: this.nowIso() };
+    const resolved = { ...record, status: "resolved", payload, resolvedAt: this.nowIso(), resolvedBy: resolver };
     this.update(resolved);
     return resolved;
   }
@@ -173,6 +238,15 @@ var BaseGateStore = class {
     if (record.status !== "pending") throw new GateAlreadySettled(id, record.status);
     return record;
   }
+  /** The default check runs first and `authorize` second, so `authorize` can only narrow who may resolve. */
+  requireAuthorized(record, resolver) {
+    const refusal = resolver ? defaultResolverRefusal(resolver) : void 0;
+    if (resolver && refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);
+    if (!this.authorize) return;
+    if (!resolver) throw new GateResolverRefused(record.id, void 0, "a resolver is required when authorize is installed");
+    const decision = readDecision(record.id, this.authorize(Object.freeze({ ...record }), resolver));
+    if (!decision.allowed) throw new GateResolverRefused(record.id, resolver.class, decision.reason);
+  }
   /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */
   lapseIfExpired(record) {
     if (record.status !== "pending" || !record.expiresAt) return record;
@@ -199,7 +273,12 @@ export {
   GateExpired,
   GatePayloadInvalid,
   GateAborted,
+  GateResolverRefused,
+  GateStoreSchemaOutdated,
+  GateAuthorizeInvalid,
   checkAgainstJsonSchema,
+  defaultResolverRefusal,
+  snapshotResolver,
   BaseGateStore
 };
-//# sourceMappingURL=chunk-5P4RFTKR.js.map
+//# sourceMappingURL=chunk-4GAZKT6Z.js.map

package/dist/chunk-4GAZKT6Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/json-schema.ts","../src/resolver-policy.ts","../src/base-store.ts"],"sourcesContent":["import type { ActorClass } from \"@titan-design/authority\";\n\n/** A gate is a row, never a promise: pending work survives the process that opened it. */\nexport type GateStatus = \"pending\" | \"resolved\" | \"cancelled\" | \"expired\";\n\n/** A JSON Schema document, stored so any process can validate a payload without the original zod schema. */\nexport type JsonSchema = Record<string, unknown>;\n\nexport interface GateRecord {\n  id: string;\n  prompt: string;\n  schema: JsonSchema | undefined;\n  status: GateStatus;\n  payload: unknown;\n  /** Why the gate was cancelled; unset for every other status. */\n  reason: string | undefined;\n  /** ISO-8601 with milliseconds, the shape store-sqlite writes and any surface can send as-is. */\n  createdAt: string;\n  resolvedAt: string | undefined;\n  expiresAt: string | undefined;\n  /** Who resolved the gate, as claimed by the caller; unset for gates resolved before stores recorded it. */\n  resolvedBy: GateResolver | undefined;\n}\n\n/** A claim about who answered a gate. hitl records it and checks its class; it cannot prove it. */\nexport interface GateResolver {\n  class: ActorClass;\n  id: string;\n  channel: string;\n  /** The channel's own id for the confirming event, such as a chat reaction. */\n  confirmEvent?: string;\n}\n\nexport type GateAuthorization = { allowed: true } | { allowed: false; reason: string };\n\n/**\n * Runs after the default resolver-class check, so it can refuse a resolver but\n * never admit one the default refused. Must return synchronously.\n */\nexport type GateAuthorize = (gate: Readonly<GateRecord>, resolver: Readonly<GateResolver>) => GateAuthorization;\n\nexport interface GateInput {\n  /** Defaults to a random UUID. Supply one to make the gate addressable by a name you already own. */\n  id?: string;\n  prompt: string;\n  schema?: JsonSchema;\n  expiresAt?: Date | string;\n}\n\n/**\n * Synchronous on purpose: both implementations are local (a Map, and\n * better-sqlite3), and `wait` is the only thing that needs to be async.\n */\nexport interface GateStore {\n  create(input: GateInput): GateRecord;\n  get(id: string): GateRecord | undefined;\n  resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;\n  cancel(id: string, reason: string): GateRecord;\n  listPending(): GateRecord[];\n}\n\nexport class GateError extends Error {\n  constructor(\n    message: string,\n    readonly gateId: string,\n  ) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\nexport class GateNotFound extends GateError {\n  constructor(gateId: string) {\n    super(`no gate with id ${gateId}`, gateId);\n  }\n}\n\nexport class GateAlreadyExists extends GateError {\n  constructor(gateId: string) {\n    super(`a gate with id ${gateId} already exists`, gateId);\n  }\n}\n\nexport class GateAlreadySettled extends GateError {\n  constructor(\n    gateId: string,\n    readonly status: GateStatus,\n  ) {\n    super(`gate ${gateId} is already ${status}`, gateId);\n  }\n}\n\nexport class GateCancelled extends GateError {\n  constructor(\n    gateId: string,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} was cancelled: ${reason}`, gateId);\n  }\n}\n\nexport class GateExpired extends GateError {\n  constructor(gateId: string) {\n    super(`gate ${gateId} expired before anyone resolved it`, gateId);\n  }\n}\n\nexport class GatePayloadInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly issues: string[],\n  ) {\n    super(`payload for gate ${gateId} does not match its schema: ${issues.join(\"; \")}`, gateId);\n  }\n}\n\nexport class GateAborted extends GateError {\n  constructor(gateId: string, reason: string) {\n    super(`stopped waiting on gate ${gateId}: ${reason}`, gateId);\n  }\n}\n\nexport class GateResolverRefused extends GateError {\n  constructor(\n    gateId: string,\n    readonly actorClass: string | undefined,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} refused a resolution by ${actorClass ?? \"an unnamed resolver\"}: ${reason}`, gateId);\n  }\n}\n\n/** The store cannot record a resolver because its table predates the resolver migration. */\nexport class GateStoreSchemaOutdated extends GateError {\n  constructor(\n    gateId: string,\n    readonly table: string,\n    readonly migration: string,\n  ) {\n    super(`gate ${gateId} cannot record its resolver: table ${table} needs ${migration}`, gateId);\n  }\n}\n\nexport class GateAuthorizeInvalid extends GateError {\n  constructor(gateId: string) {\n    super(`authorize for gate ${gateId} must return a decision { allowed: boolean } synchronously`, gateId);\n  }\n}\n","import type { JsonSchema } from \"./types.js\";\n\n/**\n * A deliberately small structural check over the JSON Schema subset `z.toJSONSchema`\n * emits. It exists so the process that resolves a gate can reject a bad payload\n * without holding the original zod schema, which by definition lives in another\n * process. The waiter still re-validates with the real zod schema, so this is the\n * boundary check, not the type guarantee.\n */\nexport function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path = \"$\"): string[] {\n  const issues: string[] = [];\n  collect(schema, value, path, issues);\n  return issues;\n}\n\nfunction collect(schema: JsonSchema, value: unknown, path: string, issues: string[]): void {\n  if (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf)) {\n    checkUnion((schema.anyOf ?? schema.oneOf) as JsonSchema[], value, path, issues);\n    return;\n  }\n  if (\"const\" in schema && !Object.is(schema.const, value)) {\n    issues.push(`${path}: expected ${JSON.stringify(schema.const)}`);\n    return;\n  }\n  if (Array.isArray(schema.enum) && !schema.enum.some((option) => Object.is(option, value))) {\n    issues.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);\n    return;\n  }\n  if (typeof schema.type !== \"string\") return;\n  if (!matchesType(schema.type, value)) {\n    issues.push(`${path}: expected ${schema.type}, received ${describe(value)}`);\n    return;\n  }\n  if (schema.type === \"object\") checkObject(schema, value as Record<string, unknown>, path, issues);\n  if (schema.type === \"array\") checkArray(schema, value as unknown[], path, issues);\n}\n\nfunction checkUnion(branches: JsonSchema[], value: unknown, path: string, issues: string[]): void {\n  const matched = branches.some((branch) => checkAgainstJsonSchema(branch, value, path).length === 0);\n  if (!matched) issues.push(`${path}: matched none of the ${branches.length} allowed shapes`);\n}\n\nfunction checkObject(schema: JsonSchema, value: Record<string, unknown>, path: string, issues: string[]): void {\n  const properties = (schema.properties ?? {}) as Record<string, JsonSchema>;\n  for (const key of (schema.required ?? []) as string[]) {\n    if (!(key in value)) issues.push(`${path}.${key}: required`);\n  }\n  if (schema.additionalProperties === false) {\n    for (const key of Object.keys(value)) {\n      if (!(key in properties)) issues.push(`${path}.${key}: unexpected property`);\n    }\n  }\n  for (const [key, sub] of Object.entries(properties)) {\n    if (key in value) collect(sub, value[key], `${path}.${key}`, issues);\n  }\n}\n\nfunction checkArray(schema: JsonSchema, value: unknown[], path: string, issues: string[]): void {\n  const items = schema.items as JsonSchema | undefined;\n  if (!items) return;\n  value.forEach((entry, index) => collect(items, entry, `${path}[${index}]`, issues));\n}\n\nfunction matchesType(type: string, value: unknown): boolean {\n  switch (type) {\n    case \"object\":\n      return typeof value === \"object\" && value !== null && !Array.isArray(value);\n    case \"array\":\n      return Array.isArray(value);\n    case \"integer\":\n      return Number.isInteger(value);\n    case \"number\":\n      return typeof value === \"number\" && Number.isFinite(value);\n    case \"null\":\n      return value === null;\n    default:\n      return typeof value === type;\n  }\n}\n\nfunction describe(value: unknown): string {\n  if (value === null) return \"null\";\n  return Array.isArray(value) ? \"array\" : typeof value;\n}\n","import { ACTOR_CLASSES, RESOLVER_CLASSES, type ActorClass } from \"@titan-design/authority\";\nimport { GateAuthorizeInvalid, GateResolverRefused, type GateAuthorization, type GateResolver } from \"./types.js\";\n\n/**\n * The default refusal: only an owner class may resolve a gate, so an agent or\n * automation never answers its own gate. Every store applies it before `authorize`.\n */\nexport function defaultResolverRefusal(resolver: GateResolver): string | undefined {\n  if ((RESOLVER_CLASSES as readonly string[]).includes(resolver.class)) return undefined;\n  return `actor class ${resolver.class} may not resolve a gate`;\n}\n\n/**\n * Reads each declared field exactly once into a frozen plain object, so the\n * checks and the stored row see the same resolver and nothing undeclared is kept.\n */\nexport function snapshotResolver(gateId: string, raw: unknown): Readonly<GateResolver> {\n  if (typeof raw !== \"object\" || raw === null) throw new GateResolverRefused(gateId, undefined, \"the resolver is not an object\");\n  const { class: actorClass, id, channel, confirmEvent } = raw as Record<string, unknown>;\n  if (!isActorClass(actorClass)) {\n    throw new GateResolverRefused(gateId, undefined, \"the resolver's class is not a known actor class\");\n  }\n  if (typeof id !== \"string\" || typeof channel !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's id and channel must be strings\");\n  }\n  if (confirmEvent === undefined) return Object.freeze({ class: actorClass, id, channel });\n  if (typeof confirmEvent !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's confirmEvent must be a string\");\n  }\n  return Object.freeze({ class: actorClass, id, channel, confirmEvent });\n}\n\n/** Accepts only a synchronous `{ allowed: boolean }`; a promise is refused because the row cannot wait on it. */\nexport function readDecision(gateId: string, decision: unknown): GateAuthorization {\n  if (typeof decision !== \"object\" || decision === null) throw new GateAuthorizeInvalid(gateId);\n  const { then, allowed, reason } = decision as Record<string, unknown>;\n  if (typeof then === \"function\") {\n    (then as (onFulfilled: undefined, onRejected: () => void) => unknown).call(decision, undefined, () => {});\n    throw new GateAuthorizeInvalid(gateId);\n  }\n  if (typeof allowed !== \"boolean\") throw new GateAuthorizeInvalid(gateId);\n  if (allowed) return { allowed: true };\n  return { allowed: false, reason: typeof reason === \"string\" ? reason : \"authorize refused the resolver\" };\n}\n\nfunction isActorClass(value: unknown): value is ActorClass {\n  return typeof value === \"string\" && (ACTOR_CLASSES as readonly string[]).includes(value);\n}\n","import { checkAgainstJsonSchema } from \"./json-schema.js\";\nimport { defaultResolverRefusal, readDecision, snapshotResolver } from \"./resolver-policy.js\";\nimport {\n  GateAlreadyExists,\n  GateAlreadySettled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  GateResolverRefused,\n  type GateAuthorize,\n  type GateInput,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\n/**\n * Every settle rule lives here so the memory and SQLite stores cannot drift\n * apart. Subclasses only move rows.\n */\nexport abstract class BaseGateStore implements GateStore {\n  protected constructor(\n    protected readonly clock: () => number,\n    private readonly authorize?: GateAuthorize,\n  ) {}\n\n  protected abstract insert(record: GateRecord): void;\n  protected abstract read(id: string): GateRecord | undefined;\n  protected abstract update(record: GateRecord): void;\n  protected abstract readByStatus(status: GateRecord[\"status\"]): GateRecord[];\n\n  create(input: GateInput): GateRecord {\n    const id = input.id ?? globalThis.crypto.randomUUID();\n    if (this.read(id)) throw new GateAlreadyExists(id);\n    const record: GateRecord = {\n      id,\n      prompt: input.prompt,\n      schema: input.schema,\n      status: \"pending\",\n      payload: undefined,\n      reason: undefined,\n      createdAt: this.nowIso(),\n      resolvedAt: undefined,\n      expiresAt: toIso(input.expiresAt),\n      resolvedBy: undefined,\n    };\n    this.insert(record);\n    return record;\n  }\n\n  get(id: string): GateRecord | undefined {\n    const record = this.read(id);\n    return record ? this.lapseIfExpired(record) : undefined;\n  }\n\n  resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord {\n    const resolver = resolvedBy === undefined ? undefined : snapshotResolver(id, resolvedBy);\n    const record = this.requirePending(id);\n    this.requireAuthorized(record, resolver);\n    if (record.schema) {\n      const issues = checkAgainstJsonSchema(record.schema, payload);\n      if (issues.length > 0) throw new GatePayloadInvalid(id, issues);\n    }\n    const resolved: GateRecord = { ...record, status: \"resolved\", payload, resolvedAt: this.nowIso(), resolvedBy: resolver };\n    this.update(resolved);\n    return resolved;\n  }\n\n  cancel(id: string, reason: string): GateRecord {\n    const record = this.requirePending(id);\n    const cancelled: GateRecord = { ...record, status: \"cancelled\", reason, resolvedAt: this.nowIso() };\n    this.update(cancelled);\n    return cancelled;\n  }\n\n  listPending(): GateRecord[] {\n    return this.readByStatus(\"pending\")\n      .map((record) => this.lapseIfExpired(record))\n      .filter((record) => record.status === \"pending\")\n      .sort((a, b) => a.createdAt.localeCompare(b.createdAt));\n  }\n\n  private requirePending(id: string): GateRecord {\n    const record = this.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"expired\") throw new GateExpired(id);\n    if (record.status !== \"pending\") throw new GateAlreadySettled(id, record.status);\n    return record;\n  }\n\n  /** The default check runs first and `authorize` second, so `authorize` can only narrow who may resolve. */\n  private requireAuthorized(record: GateRecord, resolver: Readonly<GateResolver> | undefined): void {\n    const refusal = resolver ? defaultResolverRefusal(resolver) : undefined;\n    if (resolver && refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);\n    if (!this.authorize) return;\n    if (!resolver) throw new GateResolverRefused(record.id, undefined, \"a resolver is required when authorize is installed\");\n    const decision = readDecision(record.id, this.authorize(Object.freeze({ ...record }), resolver));\n    if (!decision.allowed) throw new GateResolverRefused(record.id, resolver.class, decision.reason);\n  }\n\n  /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */\n  private lapseIfExpired(record: GateRecord): GateRecord {\n    if (record.status !== \"pending\" || !record.expiresAt) return record;\n    if (Date.parse(record.expiresAt) > this.clock()) return record;\n    const expired: GateRecord = { ...record, status: \"expired\", resolvedAt: this.nowIso() };\n    this.update(expired);\n    return expired;\n  }\n\n  protected nowIso(): string {\n    return new Date(this.clock()).toISOString();\n  }\n}\n\nfunction toIso(value: Date | string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  return typeof value === \"string\" ? value : value.toISOString();\n}\n"],"mappings":";AA6DO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO,WAAW;AAAA,EACzB;AAAA,EAJW;AAKb;AAEO,IAAM,eAAN,cAA2B,UAAU;AAAA,EAC1C,YAAY,QAAgB;AAC1B,UAAM,mBAAmB,MAAM,IAAI,MAAM;AAAA,EAC3C;AACF;AAEO,IAAM,oBAAN,cAAgC,UAAU;AAAA,EAC/C,YAAY,QAAgB;AAC1B,UAAM,kBAAkB,MAAM,mBAAmB,MAAM;AAAA,EACzD;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,eAAe,MAAM,IAAI,MAAM;AAF1C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,gBAAN,cAA4B,UAAU;AAAA,EAC3C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,mBAAmB,MAAM,IAAI,MAAM;AAF9C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB;AAC1B,UAAM,QAAQ,MAAM,sCAAsC,MAAM;AAAA,EAClE;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,oBAAoB,MAAM,+BAA+B,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM;AAFjF;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB,QAAgB;AAC1C,UAAM,2BAA2B,MAAM,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,IAAM,sBAAN,cAAkC,UAAU;AAAA,EACjD,YACE,QACS,YACA,QACT;AACA,UAAM,QAAQ,MAAM,4BAA4B,cAAc,qBAAqB,KAAK,MAAM,IAAI,MAAM;AAH/F;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAIb;AAGO,IAAM,0BAAN,cAAsC,UAAU;AAAA,EACrD,YACE,QACS,OACA,WACT;AACA,UAAM,QAAQ,MAAM,sCAAsC,KAAK,UAAU,SAAS,IAAI,MAAM;AAHnF;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAIb;AAEO,IAAM,uBAAN,cAAmC,UAAU;AAAA,EAClD,YAAY,QAAgB;AAC1B,UAAM,sBAAsB,MAAM,8DAA8D,MAAM;AAAA,EACxG;AACF;;;AC1IO,SAAS,uBAAuB,QAAoB,OAAgB,OAAO,KAAe;AAC/F,QAAM,SAAmB,CAAC;AAC1B,UAAQ,QAAQ,OAAO,MAAM,MAAM;AACnC,SAAO;AACT;AAEA,SAAS,QAAQ,QAAoB,OAAgB,MAAc,QAAwB;AACzF,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC9D,eAAY,OAAO,SAAS,OAAO,OAAwB,OAAO,MAAM,MAAM;AAC9E;AAAA,EACF;AACA,MAAI,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG;AACxD,WAAO,KAAK,GAAG,IAAI,cAAc,KAAK,UAAU,OAAO,KAAK,CAAC,EAAE;AAC/D;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,OAAO,GAAG,QAAQ,KAAK,CAAC,GAAG;AACzF,WAAO,KAAK,GAAG,IAAI,qBAAqB,KAAK,UAAU,OAAO,IAAI,CAAC,EAAE;AACrE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,SAAS,SAAU;AACrC,MAAI,CAAC,YAAY,OAAO,MAAM,KAAK,GAAG;AACpC,WAAO,KAAK,GAAG,IAAI,cAAc,OAAO,IAAI,cAAc,SAAS,KAAK,CAAC,EAAE;AAC3E;AAAA,EACF;AACA,MAAI,OAAO,SAAS,SAAU,aAAY,QAAQ,OAAkC,MAAM,MAAM;AAChG,MAAI,OAAO,SAAS,QAAS,YAAW,QAAQ,OAAoB,MAAM,MAAM;AAClF;AAEA,SAAS,WAAW,UAAwB,OAAgB,MAAc,QAAwB;AAChG,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,uBAAuB,QAAQ,OAAO,IAAI,EAAE,WAAW,CAAC;AAClG,MAAI,CAAC,QAAS,QAAO,KAAK,GAAG,IAAI,yBAAyB,SAAS,MAAM,iBAAiB;AAC5F;AAEA,SAAS,YAAY,QAAoB,OAAgC,MAAc,QAAwB;AAC7G,QAAM,aAAc,OAAO,cAAc,CAAC;AAC1C,aAAW,OAAQ,OAAO,YAAY,CAAC,GAAgB;AACrD,QAAI,EAAE,OAAO,OAAQ,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,YAAY;AAAA,EAC7D;AACA,MAAI,OAAO,yBAAyB,OAAO;AACzC,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,EAAE,OAAO,YAAa,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,uBAAuB;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACnD,QAAI,OAAO,MAAO,SAAQ,KAAK,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM;AAAA,EACrE;AACF;AAEA,SAAS,WAAW,QAAoB,OAAkB,MAAc,QAAwB;AAC9F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO;AACZ,QAAM,QAAQ,CAAC,OAAO,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AACpF;AAEA,SAAS,YAAY,MAAc,OAAyB;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA,IAC5E,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B,KAAK;AACH,aAAO,OAAO,UAAU,KAAK;AAAA,IAC/B,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU;AAAA,IACnB;AACE,aAAO,OAAO,UAAU;AAAA,EAC5B;AACF;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACjD;;;ACnFA,SAAS,eAAe,wBAAyC;AAO1D,SAAS,uBAAuB,UAA4C;AACjF,MAAK,iBAAuC,SAAS,SAAS,KAAK,EAAG,QAAO;AAC7E,SAAO,eAAe,SAAS,KAAK;AACtC;AAMO,SAAS,iBAAiB,QAAgB,KAAsC;AACrF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,oBAAoB,QAAQ,QAAW,+BAA+B;AAC7H,QAAM,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,IAAI;AACzD,MAAI,CAAC,aAAa,UAAU,GAAG;AAC7B,UAAM,IAAI,oBAAoB,QAAQ,QAAW,iDAAiD;AAAA,EACpG;AACA,MAAI,OAAO,OAAO,YAAY,OAAO,YAAY,UAAU;AACzD,UAAM,IAAI,oBAAoB,QAAQ,YAAY,+CAA+C;AAAA,EACnG;AACA,MAAI,iBAAiB,OAAW,QAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,QAAQ,CAAC;AACvF,MAAI,OAAO,iBAAiB,UAAU;AACpC,UAAM,IAAI,oBAAoB,QAAQ,YAAY,8CAA8C;AAAA,EAClG;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,CAAC;AACvE;AAGO,SAAS,aAAa,QAAgB,UAAsC;AACjF,MAAI,OAAO,aAAa,YAAY,aAAa,KAAM,OAAM,IAAI,qBAAqB,MAAM;AAC5F,QAAM,EAAE,MAAM,SAAS,OAAO,IAAI;AAClC,MAAI,OAAO,SAAS,YAAY;AAC9B,IAAC,KAAqE,KAAK,UAAU,QAAW,MAAM;AAAA,IAAC,CAAC;AACxG,UAAM,IAAI,qBAAqB,MAAM;AAAA,EACvC;AACA,MAAI,OAAO,YAAY,UAAW,OAAM,IAAI,qBAAqB,MAAM;AACvE,MAAI,QAAS,QAAO,EAAE,SAAS,KAAK;AACpC,SAAO,EAAE,SAAS,OAAO,QAAQ,OAAO,WAAW,WAAW,SAAS,iCAAiC;AAC1G;AAEA,SAAS,aAAa,OAAqC;AACzD,SAAO,OAAO,UAAU,YAAa,cAAoC,SAAS,KAAK;AACzF;;;AC3BO,IAAe,gBAAf,MAAkD;AAAA,EAC7C,YACW,OACF,WACjB;AAFmB;AACF;AAAA,EAChB;AAAA,EAFkB;AAAA,EACF;AAAA,EAQnB,OAAO,OAA8B;AACnC,UAAM,KAAK,MAAM,MAAM,WAAW,OAAO,WAAW;AACpD,QAAI,KAAK,KAAK,EAAE,EAAG,OAAM,IAAI,kBAAkB,EAAE;AACjD,UAAM,SAAqB;AAAA,MACzB;AAAA,MACA,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW,KAAK,OAAO;AAAA,MACvB,YAAY;AAAA,MACZ,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,YAAY;AAAA,IACd;AACA,SAAK,OAAO,MAAM;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAoC;AACtC,UAAM,SAAS,KAAK,KAAK,EAAE;AAC3B,WAAO,SAAS,KAAK,eAAe,MAAM,IAAI;AAAA,EAChD;AAAA,EAEA,QAAQ,IAAY,SAAkB,YAAuC;AAC3E,UAAM,WAAW,eAAe,SAAY,SAAY,iBAAiB,IAAI,UAAU;AACvF,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,SAAK,kBAAkB,QAAQ,QAAQ;AACvC,QAAI,OAAO,QAAQ;AACjB,YAAM,SAAS,uBAAuB,OAAO,QAAQ,OAAO;AAC5D,UAAI,OAAO,SAAS,EAAG,OAAM,IAAI,mBAAmB,IAAI,MAAM;AAAA,IAChE;AACA,UAAM,WAAuB,EAAE,GAAG,QAAQ,QAAQ,YAAY,SAAS,YAAY,KAAK,OAAO,GAAG,YAAY,SAAS;AACvH,SAAK,OAAO,QAAQ;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAY,QAA4B;AAC7C,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,UAAM,YAAwB,EAAE,GAAG,QAAQ,QAAQ,aAAa,QAAQ,YAAY,KAAK,OAAO,EAAE;AAClG,SAAK,OAAO,SAAS;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,cAA4B;AAC1B,WAAO,KAAK,aAAa,SAAS,EAC/B,IAAI,CAAC,WAAW,KAAK,eAAe,MAAM,CAAC,EAC3C,OAAO,CAAC,WAAW,OAAO,WAAW,SAAS,EAC9C,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC;AAAA,EAC1D;AAAA,EAEQ,eAAe,IAAwB;AAC7C,UAAM,SAAS,KAAK,IAAI,EAAE;AAC1B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,mBAAmB,IAAI,OAAO,MAAM;AAC/E,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,kBAAkB,QAAoB,UAAoD;AAChG,UAAM,UAAU,WAAW,uBAAuB,QAAQ,IAAI;AAC9D,QAAI,YAAY,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,OAAO;AACzF,QAAI,CAAC,KAAK,UAAW;AACrB,QAAI,CAAC,SAAU,OAAM,IAAI,oBAAoB,OAAO,IAAI,QAAW,oDAAoD;AACvH,UAAM,WAAW,aAAa,OAAO,IAAI,KAAK,UAAU,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAC;AAC/F,QAAI,CAAC,SAAS,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,SAAS,MAAM;AAAA,EACjG;AAAA;AAAA,EAGQ,eAAe,QAAgC;AACrD,QAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAW,QAAO;AAC7D,QAAI,KAAK,MAAM,OAAO,SAAS,IAAI,KAAK,MAAM,EAAG,QAAO;AACxD,UAAM,UAAsB,EAAE,GAAG,QAAQ,QAAQ,WAAW,YAAY,KAAK,OAAO,EAAE;AACtF,SAAK,OAAO,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEU,SAAiB;AACzB,WAAO,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,YAAY;AAAA,EAC5C;AACF;AAEA,SAAS,MAAM,OAAsD;AACnE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM,YAAY;AAC/D;","names":[]}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import { ZodType } from 'zod';
-import { G as GateRecord, a as GateStore, B as BaseGateStore, J as JsonSchema } from './base-store-BeRbMZEp.js';
-export { b as GateAborted, c as GateAlreadyExists, d as GateAlreadySettled, e as GateCancelled, f as GateError, g as GateExpired, h as GateInput, i as GateNotFound, j as GatePayloadInvalid, k as GateStatus } from './base-store-BeRbMZEp.js';
+import { G as GateRecord, a as GateStore, b as GateResolver, B as BaseGateStore, c as GateAuthorize, J as JsonSchema } from './base-store-BvwOJL6M.js';
+export { d as GateAborted, e as GateAlreadyExists, f as GateAlreadySettled, g as GateAuthorization, h as GateAuthorizeInvalid, i as GateCancelled, j as GateError, k as GateExpired, l as GateInput, m as GateNotFound, n as GatePayloadInvalid, o as GateResolverRefused, p as GateStatus, q as GateStoreSchemaOutdated } from './base-store-BvwOJL6M.js';
+import '@titan-design/authority';
 
 declare const DEFAULT_POLL_MS = 250;
 interface OpenGateOptions<T> {
@@ -33,12 +34,14 @@ declare function openGate<T = unknown>(store: GateStore, options: OpenGateOption
  */
 declare function waitForGate<T = unknown>(store: GateStore, id: string, options?: WaitOptions<T>): Promise<T>;
 /** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */
-declare function resolveGate(store: GateStore, id: string, payload: unknown): GateRecord;
+declare function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;
 declare function cancelGate(store: GateStore, id: string, reason: string): GateRecord;
 
 interface MemoryGateStoreOptions {
     /** Epoch-millis clock, injectable so expiry is testable without waiting. */
     now?: () => number;
+    /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */
+    authorize?: GateAuthorize;
 }
 /**
  * In-process gates. Right for tests and for a single-process product that only
@@ -54,6 +57,17 @@ declare class MemoryGateStore extends BaseGateStore {
     protected readByStatus(status: GateRecord["status"]): GateRecord[];
 }
 
+/**
+ * The default refusal: only an owner class may resolve a gate, so an agent or
+ * automation never answers its own gate. Every store applies it before `authorize`.
+ */
+declare function defaultResolverRefusal(resolver: GateResolver): string | undefined;
+/**
+ * Reads each declared field exactly once into a frozen plain object, so the
+ * checks and the stored row see the same resolver and nothing undeclared is kept.
+ */
+declare function snapshotResolver(gateId: string, raw: unknown): Readonly<GateResolver>;
+
 /**
  * A deliberately small structural check over the JSON Schema subset `z.toJSONSchema`
  * emits. It exists so the process that resolves a gate can reject a bad payload
@@ -63,4 +77,4 @@ declare class MemoryGateStore extends BaseGateStore {
  */
 declare function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path?: string): string[];
 
-export { BaseGateStore, DEFAULT_POLL_MS, type GateHandle, GateRecord, GateStore, JsonSchema, MemoryGateStore, type MemoryGateStoreOptions, type OpenGateOptions, type WaitOptions, cancelGate, checkAgainstJsonSchema, openGate, resolveGate, waitForGate };
+export { BaseGateStore, DEFAULT_POLL_MS, GateAuthorize, type GateHandle, GateRecord, GateResolver, GateStore, JsonSchema, MemoryGateStore, type MemoryGateStoreOptions, type OpenGateOptions, type WaitOptions, cancelGate, checkAgainstJsonSchema, defaultResolverRefusal, openGate, resolveGate, snapshotResolver, waitForGate };

package/dist/index.js

@@ -3,13 +3,18 @@ import {
   GateAborted,
   GateAlreadyExists,
   GateAlreadySettled,
+  GateAuthorizeInvalid,
   GateCancelled,
   GateError,
   GateExpired,
   GateNotFound,
   GatePayloadInvalid,
-  checkAgainstJsonSchema
-} from "./chunk-5P4RFTKR.js";
+  GateResolverRefused,
+  GateStoreSchemaOutdated,
+  checkAgainstJsonSchema,
+  defaultResolverRefusal,
+  snapshotResolver
+} from "./chunk-4GAZKT6Z.js";
 
 // src/gate.ts
 import { toJSONSchema } from "zod";
@@ -42,8 +47,8 @@ async function waitForGate(store, id, options = {}) {
     await sleep(pollMs, options.signal);
   }
 }
-function resolveGate(store, id, payload) {
-  return store.resolve(id, payload);
+function resolveGate(store, id, payload, resolvedBy) {
+  return store.resolve(id, payload, resolvedBy);
 }
 function cancelGate(store, id, reason) {
   return store.cancel(id, reason);
@@ -76,38 +81,46 @@ function sleep(ms, signal) {
 var MemoryGateStore = class extends BaseGateStore {
   rows = /* @__PURE__ */ new Map();
   constructor(options = {}) {
-    super(options.now ?? Date.now);
+    super(options.now ?? Date.now, options.authorize);
   }
   insert(record) {
-    this.rows.set(record.id, { ...record });
+    this.rows.set(record.id, copy(record));
   }
   read(id) {
     const row = this.rows.get(id);
-    return row ? { ...row } : void 0;
+    return row ? copy(row) : void 0;
   }
   update(record) {
-    this.rows.set(record.id, { ...record });
+    this.rows.set(record.id, copy(record));
   }
   readByStatus(status) {
-    return [...this.rows.values()].filter((row) => row.status === status).map((row) => ({ ...row }));
+    return [...this.rows.values()].filter((row) => row.status === status).map(copy);
   }
 };
+function copy(record) {
+  return { ...record, resolvedBy: record.resolvedBy && { ...record.resolvedBy } };
+}
 export {
   BaseGateStore,
   DEFAULT_POLL_MS,
   GateAborted,
   GateAlreadyExists,
   GateAlreadySettled,
+  GateAuthorizeInvalid,
   GateCancelled,
   GateError,
   GateExpired,
   GateNotFound,
   GatePayloadInvalid,
+  GateResolverRefused,
+  GateStoreSchemaOutdated,
   MemoryGateStore,
   cancelGate,
   checkAgainstJsonSchema,
+  defaultResolverRefusal,
   openGate,
   resolveGate,
+  snapshotResolver,
   waitForGate
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gate.ts","../src/memory-store.ts"],"sourcesContent":["import { toJSONSchema, type ZodType } from \"zod\";\nimport {\n  GateAborted,\n  GateCancelled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  type GateRecord,\n  type GateStore,\n} from \"./types.js\";\n\nexport const DEFAULT_POLL_MS = 250;\n\nexport interface OpenGateOptions<T> {\n  id?: string;\n  prompt: string;\n  /** Stored as JSON Schema so the resolving process can validate without it, and reused here to type the answer. */\n  schema?: ZodType<T>;\n  expiresAt?: Date | string;\n}\n\nexport interface WaitOptions<T> {\n  pollMs?: number;\n  signal?: AbortSignal;\n  /** Needed only when re-attaching to a gate this process did not open. */\n  schema?: ZodType<T>;\n}\n\nexport interface GateHandle<T> {\n  id: string;\n  record: GateRecord;\n  wait(options?: Omit<WaitOptions<T>, \"schema\">): Promise<T>;\n}\n\n/**\n * Open a gate and hand back something to await. The row exists before this\n * returns, so a crash here leaves a resolvable gate rather than a lost one.\n */\nexport function openGate<T = unknown>(store: GateStore, options: OpenGateOptions<T>): GateHandle<T> {\n  const input: Parameters<GateStore[\"create\"]>[0] = { prompt: options.prompt };\n  if (options.id !== undefined) input.id = options.id;\n  if (options.expiresAt !== undefined) input.expiresAt = options.expiresAt;\n  if (options.schema) input.schema = toJSONSchema(options.schema) as Record<string, unknown>;\n\n  const record = store.create(input);\n  return {\n    id: record.id,\n    record,\n    wait: (waitOptions = {}) => {\n      const merged: WaitOptions<T> = { ...waitOptions };\n      if (options.schema) merged.schema = options.schema;\n      return waitForGate<T>(store, record.id, merged);\n    },\n  };\n}\n\n/**\n * Await a gate by id from any process, including one that restarted after the\n * gate was opened. Polls rather than subscribes because the resolver may be a\n * different process writing the same SQLite file.\n */\nexport async function waitForGate<T = unknown>(\n  store: GateStore,\n  id: string,\n  options: WaitOptions<T> = {},\n): Promise<T> {\n  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;\n  for (;;) {\n    throwIfAborted(id, options.signal);\n    const record = store.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"resolved\") return validate(record, options.schema);\n    if (record.status === \"cancelled\") throw new GateCancelled(id, record.reason ?? \"no reason given\");\n    if (record.status === \"expired\") throw new GateExpired(id);\n    await sleep(pollMs, options.signal);\n  }\n}\n\n/** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */\nexport function resolveGate(store: GateStore, id: string, payload: unknown): GateRecord {\n  return store.resolve(id, payload);\n}\n\nexport function cancelGate(store: GateStore, id: string, reason: string): GateRecord {\n  return store.cancel(id, reason);\n}\n\nfunction validate<T>(record: GateRecord, schema: ZodType<T> | undefined): T {\n  if (!schema) return record.payload as T;\n  const parsed = schema.safeParse(record.payload);\n  if (parsed.success) return parsed.data;\n  throw new GatePayloadInvalid(\n    record.id,\n    parsed.error.issues.map((issue) => `${issue.path.join(\".\") || \"$\"}: ${issue.message}`),\n  );\n}\n\nfunction throwIfAborted(id: string, signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new GateAborted(id, String(signal.reason ?? \"aborted\"));\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve) => {\n    const timer = setTimeout(finish, ms);\n    signal?.addEventListener(\"abort\", finish, { once: true });\n    function finish(): void {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", finish);\n      resolve();\n    }\n  });\n}\n","import { BaseGateStore } from \"./base-store.js\";\nimport type { GateRecord } from \"./types.js\";\n\nexport interface MemoryGateStoreOptions {\n  /** Epoch-millis clock, injectable so expiry is testable without waiting. */\n  now?: () => number;\n}\n\n/**\n * In-process gates. Right for tests and for a single-process product that only\n * needs the pause, not the durability; anything that must survive a restart\n * wants `SqliteGateStore`.\n */\nexport class MemoryGateStore extends BaseGateStore {\n  private readonly rows = new Map<string, GateRecord>();\n\n  constructor(options: MemoryGateStoreOptions = {}) {\n    super(options.now ?? Date.now);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.rows.set(record.id, { ...record });\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.rows.get(id);\n    return row ? { ...row } : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    this.rows.set(record.id, { ...record });\n  }\n\n  protected readByStatus(status: GateRecord[\"status\"]): GateRecord[] {\n    return [...this.rows.values()].filter((row) => row.status === status).map((row) => ({ ...row }));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,oBAAkC;AAWpC,IAAM,kBAAkB;AA2BxB,SAAS,SAAsB,OAAkB,SAA4C;AAClG,QAAM,QAA4C,EAAE,QAAQ,QAAQ,OAAO;AAC3E,MAAI,QAAQ,OAAO,OAAW,OAAM,KAAK,QAAQ;AACjD,MAAI,QAAQ,cAAc,OAAW,OAAM,YAAY,QAAQ;AAC/D,MAAI,QAAQ,OAAQ,OAAM,SAAS,aAAa,QAAQ,MAAM;AAE9D,QAAM,SAAS,MAAM,OAAO,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX;AAAA,IACA,MAAM,CAAC,cAAc,CAAC,MAAM;AAC1B,YAAM,SAAyB,EAAE,GAAG,YAAY;AAChD,UAAI,QAAQ,OAAQ,QAAO,SAAS,QAAQ;AAC5C,aAAO,YAAe,OAAO,OAAO,IAAI,MAAM;AAAA,IAChD;AAAA,EACF;AACF;AAOA,eAAsB,YACpB,OACA,IACA,UAA0B,CAAC,GACf;AACZ,QAAM,SAAS,QAAQ,UAAU;AACjC,aAAS;AACP,mBAAe,IAAI,QAAQ,MAAM;AACjC,UAAM,SAAS,MAAM,IAAI,EAAE;AAC3B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,WAAY,QAAO,SAAS,QAAQ,QAAQ,MAAM;AACxE,QAAI,OAAO,WAAW,YAAa,OAAM,IAAI,cAAc,IAAI,OAAO,UAAU,iBAAiB;AACjG,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,UAAM,MAAM,QAAQ,QAAQ,MAAM;AAAA,EACpC;AACF;AAGO,SAAS,YAAY,OAAkB,IAAY,SAA8B;AACtF,SAAO,MAAM,QAAQ,IAAI,OAAO;AAClC;AAEO,SAAS,WAAW,OAAkB,IAAY,QAA4B;AACnF,SAAO,MAAM,OAAO,IAAI,MAAM;AAChC;AAEA,SAAS,SAAY,QAAoB,QAAmC;AAC1E,MAAI,CAAC,OAAQ,QAAO,OAAO;AAC3B,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO;AAC9C,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IACP,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,MAAM,OAAO,EAAE;AAAA,EACvF;AACF;AAEA,SAAS,eAAe,IAAY,QAAuC;AACzE,MAAI,QAAQ,QAAS,OAAM,IAAI,YAAY,IAAI,OAAO,OAAO,UAAU,SAAS,CAAC;AACnF;AAEA,SAAS,MAAM,IAAY,QAAgD;AACzE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,WAAW,QAAQ,EAAE;AACnC,YAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,aAAS,SAAe;AACtB,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,MAAM;AAC3C,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;AClGO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAChC,OAAO,oBAAI,IAAwB;AAAA,EAEpD,YAAY,UAAkC,CAAC,GAAG;AAChD,UAAM,QAAQ,OAAO,KAAK,GAAG;AAAA,EAC/B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,EAAE,GAAG,OAAO,CAAC;AAAA,EACxC;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,KAAK,IAAI,EAAE;AAC5B,WAAO,MAAM,EAAE,GAAG,IAAI,IAAI;AAAA,EAC5B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,EAAE,GAAG,OAAO,CAAC;AAAA,EACxC;AAAA,EAEU,aAAa,QAA4C;AACjE,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,EAAE;AAAA,EACjG;AACF;","names":[]}
+{"version":3,"sources":["../src/gate.ts","../src/memory-store.ts"],"sourcesContent":["import { toJSONSchema, type ZodType } from \"zod\";\nimport {\n  GateAborted,\n  GateCancelled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\nexport const DEFAULT_POLL_MS = 250;\n\nexport interface OpenGateOptions<T> {\n  id?: string;\n  prompt: string;\n  /** Stored as JSON Schema so the resolving process can validate without it, and reused here to type the answer. */\n  schema?: ZodType<T>;\n  expiresAt?: Date | string;\n}\n\nexport interface WaitOptions<T> {\n  pollMs?: number;\n  signal?: AbortSignal;\n  /** Needed only when re-attaching to a gate this process did not open. */\n  schema?: ZodType<T>;\n}\n\nexport interface GateHandle<T> {\n  id: string;\n  record: GateRecord;\n  wait(options?: Omit<WaitOptions<T>, \"schema\">): Promise<T>;\n}\n\n/**\n * Open a gate and hand back something to await. The row exists before this\n * returns, so a crash here leaves a resolvable gate rather than a lost one.\n */\nexport function openGate<T = unknown>(store: GateStore, options: OpenGateOptions<T>): GateHandle<T> {\n  const input: Parameters<GateStore[\"create\"]>[0] = { prompt: options.prompt };\n  if (options.id !== undefined) input.id = options.id;\n  if (options.expiresAt !== undefined) input.expiresAt = options.expiresAt;\n  if (options.schema) input.schema = toJSONSchema(options.schema) as Record<string, unknown>;\n\n  const record = store.create(input);\n  return {\n    id: record.id,\n    record,\n    wait: (waitOptions = {}) => {\n      const merged: WaitOptions<T> = { ...waitOptions };\n      if (options.schema) merged.schema = options.schema;\n      return waitForGate<T>(store, record.id, merged);\n    },\n  };\n}\n\n/**\n * Await a gate by id from any process, including one that restarted after the\n * gate was opened. Polls rather than subscribes because the resolver may be a\n * different process writing the same SQLite file.\n */\nexport async function waitForGate<T = unknown>(\n  store: GateStore,\n  id: string,\n  options: WaitOptions<T> = {},\n): Promise<T> {\n  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;\n  for (;;) {\n    throwIfAborted(id, options.signal);\n    const record = store.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"resolved\") return validate(record, options.schema);\n    if (record.status === \"cancelled\") throw new GateCancelled(id, record.reason ?? \"no reason given\");\n    if (record.status === \"expired\") throw new GateExpired(id);\n    await sleep(pollMs, options.signal);\n  }\n}\n\n/** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */\nexport function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord {\n  return store.resolve(id, payload, resolvedBy);\n}\n\nexport function cancelGate(store: GateStore, id: string, reason: string): GateRecord {\n  return store.cancel(id, reason);\n}\n\nfunction validate<T>(record: GateRecord, schema: ZodType<T> | undefined): T {\n  if (!schema) return record.payload as T;\n  const parsed = schema.safeParse(record.payload);\n  if (parsed.success) return parsed.data;\n  throw new GatePayloadInvalid(\n    record.id,\n    parsed.error.issues.map((issue) => `${issue.path.join(\".\") || \"$\"}: ${issue.message}`),\n  );\n}\n\nfunction throwIfAborted(id: string, signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new GateAborted(id, String(signal.reason ?? \"aborted\"));\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve) => {\n    const timer = setTimeout(finish, ms);\n    signal?.addEventListener(\"abort\", finish, { once: true });\n    function finish(): void {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", finish);\n      resolve();\n    }\n  });\n}\n","import { BaseGateStore } from \"./base-store.js\";\nimport type { GateAuthorize, GateRecord } from \"./types.js\";\n\nexport interface MemoryGateStoreOptions {\n  /** Epoch-millis clock, injectable so expiry is testable without waiting. */\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n}\n\n/**\n * In-process gates. Right for tests and for a single-process product that only\n * needs the pause, not the durability; anything that must survive a restart\n * wants `SqliteGateStore`.\n */\nexport class MemoryGateStore extends BaseGateStore {\n  private readonly rows = new Map<string, GateRecord>();\n\n  constructor(options: MemoryGateStoreOptions = {}) {\n    super(options.now ?? Date.now, options.authorize);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.rows.get(id);\n    return row ? copy(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected readByStatus(status: GateRecord[\"status\"]): GateRecord[] {\n    return [...this.rows.values()].filter((row) => row.status === status).map(copy);\n  }\n}\n\n/** `resolvedBy` is nested, so a shallow spread would let a caller rewrite the stored resolver. */\nfunction copy(record: GateRecord): GateRecord {\n  return { ...record, resolvedBy: record.resolvedBy && { ...record.resolvedBy } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAkC;AAYpC,IAAM,kBAAkB;AA2BxB,SAAS,SAAsB,OAAkB,SAA4C;AAClG,QAAM,QAA4C,EAAE,QAAQ,QAAQ,OAAO;AAC3E,MAAI,QAAQ,OAAO,OAAW,OAAM,KAAK,QAAQ;AACjD,MAAI,QAAQ,cAAc,OAAW,OAAM,YAAY,QAAQ;AAC/D,MAAI,QAAQ,OAAQ,OAAM,SAAS,aAAa,QAAQ,MAAM;AAE9D,QAAM,SAAS,MAAM,OAAO,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX;AAAA,IACA,MAAM,CAAC,cAAc,CAAC,MAAM;AAC1B,YAAM,SAAyB,EAAE,GAAG,YAAY;AAChD,UAAI,QAAQ,OAAQ,QAAO,SAAS,QAAQ;AAC5C,aAAO,YAAe,OAAO,OAAO,IAAI,MAAM;AAAA,IAChD;AAAA,EACF;AACF;AAOA,eAAsB,YACpB,OACA,IACA,UAA0B,CAAC,GACf;AACZ,QAAM,SAAS,QAAQ,UAAU;AACjC,aAAS;AACP,mBAAe,IAAI,QAAQ,MAAM;AACjC,UAAM,SAAS,MAAM,IAAI,EAAE;AAC3B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,WAAY,QAAO,SAAS,QAAQ,QAAQ,MAAM;AACxE,QAAI,OAAO,WAAW,YAAa,OAAM,IAAI,cAAc,IAAI,OAAO,UAAU,iBAAiB;AACjG,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,UAAM,MAAM,QAAQ,QAAQ,MAAM;AAAA,EACpC;AACF;AAGO,SAAS,YAAY,OAAkB,IAAY,SAAkB,YAAuC;AACjH,SAAO,MAAM,QAAQ,IAAI,SAAS,UAAU;AAC9C;AAEO,SAAS,WAAW,OAAkB,IAAY,QAA4B;AACnF,SAAO,MAAM,OAAO,IAAI,MAAM;AAChC;AAEA,SAAS,SAAY,QAAoB,QAAmC;AAC1E,MAAI,CAAC,OAAQ,QAAO,OAAO;AAC3B,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO;AAC9C,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IACP,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,MAAM,OAAO,EAAE;AAAA,EACvF;AACF;AAEA,SAAS,eAAe,IAAY,QAAuC;AACzE,MAAI,QAAQ,QAAS,OAAM,IAAI,YAAY,IAAI,OAAO,OAAO,UAAU,SAAS,CAAC;AACnF;AAEA,SAAS,MAAM,IAAY,QAAgD;AACzE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,WAAW,QAAQ,EAAE;AACnC,YAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,aAAS,SAAe;AACtB,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,MAAM;AAC3C,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;ACjGO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAChC,OAAO,oBAAI,IAAwB;AAAA,EAEpD,YAAY,UAAkC,CAAC,GAAG;AAChD,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS;AAAA,EAClD;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,KAAK,IAAI,EAAE;AAC5B,WAAO,MAAM,KAAK,GAAG,IAAI;AAAA,EAC3B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,aAAa,QAA4C;AACjE,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,EAAE,IAAI,IAAI;AAAA,EAChF;AACF;AAGA,SAAS,KAAK,QAAgC;AAC5C,SAAO,EAAE,GAAG,QAAQ,YAAY,OAAO,cAAc,EAAE,GAAG,OAAO,WAAW,EAAE;AAChF;","names":[]}

package/dist/sqlite.d.ts

@@ -1,15 +1,28 @@
 import { Db, Migration } from '@titan-design/store-sqlite';
-import { B as BaseGateStore, G as GateRecord, k as GateStatus } from './base-store-BeRbMZEp.js';
+import { B as BaseGateStore, c as GateAuthorize, G as GateRecord, p as GateStatus } from './base-store-BvwOJL6M.js';
+import '@titan-design/authority';
 
 declare const DEFAULT_GATE_TABLE = "hitl_gate";
 declare function gateTableDdl(name?: string): string;
 /** Drop into the product's own `runMigrations` list so hitl shares one database with its domain tables. */
 declare function gateMigration(version: number, name?: string): Migration;
+/**
+ * The triggers that refuse a resolved row naming no resolver, on update and on
+ * insert, so a writer that predates `resolved_by` fails loudly instead of resolving anonymously.
+ */
+declare function resolverRequiredTriggerDdl(name?: string): string;
+/**
+ * Adds `resolved_by` and the resolver trigger. Idempotent and backfill-free:
+ * gates resolved before it keep an unknown resolver rather than a guessed one.
+ */
+declare function gateResolverMigration(version: number, name?: string): Migration;
 interface SqliteGateStoreOptions {
     table?: string;
     /** Run `gateMigration` on construction. Off when the product owns its migration list. */
     migrate?: boolean;
     now?: () => number;
+    /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */
+    authorize?: GateAuthorize;
 }
 /**
  * Durable gates. Two instances on the same file are two processes as far as the
@@ -19,11 +32,16 @@ interface SqliteGateStoreOptions {
 declare class SqliteGateStore extends BaseGateStore {
     private readonly db;
     private readonly table;
+    private resolverColumnSeen;
     constructor(db: Db, options?: SqliteGateStoreOptions);
     protected insert(record: GateRecord): void;
     protected read(id: string): GateRecord | undefined;
     protected update(record: GateRecord): void;
+    /** Refuses rather than dropping the resolver when the table has no column to hold it. */
+    private updateWithResolver;
+    /** Only a positive probe is cached, so a migration run after construction is still noticed. */
+    private resolverColumnPresent;
     protected readByStatus(status: GateStatus): GateRecord[];
 }
 
-export { DEFAULT_GATE_TABLE, SqliteGateStore, type SqliteGateStoreOptions, gateMigration, gateTableDdl };
+export { DEFAULT_GATE_TABLE, SqliteGateStore, type SqliteGateStoreOptions, gateMigration, gateResolverMigration, gateTableDdl, resolverRequiredTriggerDdl };

package/dist/sqlite.js

@@ -1,6 +1,7 @@
 import {
-  BaseGateStore
-} from "./chunk-5P4RFTKR.js";
+  BaseGateStore,
+  GateStoreSchemaOutdated
+} from "./chunk-4GAZKT6Z.js";
 
 // src/sqlite-store.ts
 import { quoteIdent, runMigrations } from "@titan-design/store-sqlite";
@@ -26,15 +27,43 @@ function gateTableDdl(name = DEFAULT_GATE_TABLE) {
 function gateMigration(version, name = DEFAULT_GATE_TABLE) {
   return { version, name: `hitl:${name}`, up: (db) => db.exec(gateTableDdl(name)) };
 }
+function resolverRequiredTriggerDdl(name = DEFAULT_GATE_TABLE) {
+  return ["UPDATE", "INSERT"].map((event) => resolverTrigger(name, event)).join("\n");
+}
+function resolverTrigger(name, event) {
+  const suffix = event === "UPDATE" ? "resolver_required" : "resolver_required_insert";
+  return `
+    CREATE TRIGGER IF NOT EXISTS ${quoteIdent(`${name}_${suffix}`)}
+      BEFORE ${event} ON ${quoteIdent(name)}
+      FOR EACH ROW WHEN NEW.status = 'resolved' AND NEW.resolved_by IS NULL
+    BEGIN
+      SELECT RAISE(ABORT, 'hitl: resolvedBy required');
+    END;
+  `;
+}
+function gateResolverMigration(version, name = DEFAULT_GATE_TABLE) {
+  return {
+    version,
+    name: `hitl:resolver:${name}`,
+    up: (db) => {
+      if (!hasResolverColumn(db, name)) db.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN resolved_by TEXT`);
+      db.exec(resolverRequiredTriggerDdl(name));
+    }
+  };
+}
+function hasResolverColumn(db, table) {
+  return db.prepare("SELECT 1 FROM pragma_table_info(?) WHERE name = 'resolved_by'").get(table) !== void 0;
+}
 var SqliteGateStore = class extends BaseGateStore {
   constructor(db, options = {}) {
-    super(options.now ?? Date.now);
+    super(options.now ?? Date.now, options.authorize);
     this.db = db;
     this.table = options.table ?? DEFAULT_GATE_TABLE;
     if (options.migrate ?? true) runMigrations(db, [gateMigration(1, this.table)]);
   }
   db;
   table;
+  resolverColumnSeen = false;
   insert(record) {
     this.db.prepare(
       `INSERT INTO ${quoteIdent(this.table)}
@@ -47,12 +76,39 @@ var SqliteGateStore = class extends BaseGateStore {
     return row ? toRecord(row) : void 0;
   }
   update(record) {
+    if (record.resolvedBy) {
+      this.updateWithResolver(record, record.resolvedBy);
+      return;
+    }
     this.db.prepare(
       `UPDATE ${quoteIdent(this.table)}
             SET status = ?, payload = ?, reason = ?, resolved_at = ?
           WHERE id = ?`
     ).run(record.status, toJson(record.payload), record.reason ?? null, record.resolvedAt ?? null, record.id);
   }
+  /** Refuses rather than dropping the resolver when the table has no column to hold it. */
+  updateWithResolver(record, resolvedBy) {
+    if (!this.resolverColumnPresent()) {
+      throw new GateStoreSchemaOutdated(record.id, this.table, "gateResolverMigration");
+    }
+    this.db.prepare(
+      `UPDATE ${quoteIdent(this.table)}
+            SET status = ?, payload = ?, reason = ?, resolved_at = ?, resolved_by = ?
+          WHERE id = ?`
+    ).run(
+      record.status,
+      toJson(record.payload),
+      record.reason ?? null,
+      record.resolvedAt ?? null,
+      JSON.stringify(resolvedBy),
+      record.id
+    );
+  }
+  /** Only a positive probe is cached, so a migration run after construction is still noticed. */
+  resolverColumnPresent() {
+    if (!this.resolverColumnSeen) this.resolverColumnSeen = hasResolverColumn(this.db, this.table);
+    return this.resolverColumnSeen;
+  }
   readByStatus(status) {
     const rows = this.db.prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE status = ? ORDER BY created_at`).all(status);
     return rows.map(toRecord);
@@ -84,13 +140,16 @@ function toRecord(row) {
     reason: row.reason ?? void 0,
     createdAt: row.created_at,
     resolvedAt: row.resolved_at ?? void 0,
-    expiresAt: row.expires_at ?? void 0
+    expiresAt: row.expires_at ?? void 0,
+    resolvedBy: row.resolved_by ? JSON.parse(row.resolved_by) : void 0
   };
 }
 export {
   DEFAULT_GATE_TABLE,
   SqliteGateStore,
   gateMigration,
-  gateTableDdl
+  gateResolverMigration,
+  gateTableDdl,
+  resolverRequiredTriggerDdl
 };
 //# sourceMappingURL=sqlite.js.map

package/dist/sqlite.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/sqlite-store.ts"],"sourcesContent":["import { quoteIdent, runMigrations, type Db, type Migration } from \"@titan-design/store-sqlite\";\nimport { BaseGateStore } from \"./base-store.js\";\nimport type { GateRecord, GateStatus, JsonSchema } from \"./types.js\";\n\nexport const DEFAULT_GATE_TABLE = \"hitl_gate\";\n\nexport function gateTableDdl(name: string = DEFAULT_GATE_TABLE): string {\n  const t = quoteIdent(name);\n  return `\n    CREATE TABLE IF NOT EXISTS ${t} (\n      id          TEXT PRIMARY KEY,\n      prompt      TEXT NOT NULL,\n      schema      TEXT,\n      status      TEXT NOT NULL DEFAULT 'pending',\n      payload     TEXT,\n      reason      TEXT,\n      created_at  TEXT NOT NULL,\n      resolved_at TEXT,\n      expires_at  TEXT\n    );\n    CREATE INDEX IF NOT EXISTS ${quoteIdent(`${name}_pending`)}\n      ON ${t} (created_at) WHERE status = 'pending';\n  `;\n}\n\n/** Drop into the product's own `runMigrations` list so hitl shares one database with its domain tables. */\nexport function gateMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return { version, name: `hitl:${name}`, up: (db) => db.exec(gateTableDdl(name)) };\n}\n\nexport interface SqliteGateStoreOptions {\n  table?: string;\n  /** Run `gateMigration` on construction. Off when the product owns its migration list. */\n  migrate?: boolean;\n  now?: () => number;\n}\n\ninterface RawGateRow {\n  id: string;\n  prompt: string;\n  schema: string | null;\n  status: GateStatus;\n  payload: string | null;\n  reason: string | null;\n  created_at: string;\n  resolved_at: string | null;\n  expires_at: string | null;\n}\n\n/**\n * Durable gates. Two instances on the same file are two processes as far as the\n * gate is concerned, which is the entire point: whoever resolves the row does\n * not have to be whoever opened it.\n */\nexport class SqliteGateStore extends BaseGateStore {\n  private readonly table: string;\n\n  constructor(\n    private readonly db: Db,\n    options: SqliteGateStoreOptions = {},\n  ) {\n    super(options.now ?? Date.now);\n    this.table = options.table ?? DEFAULT_GATE_TABLE;\n    if (options.migrate ?? true) runMigrations(db, [gateMigration(1, this.table)]);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.db\n      .prepare(\n        `INSERT INTO ${quoteIdent(this.table)}\n           (id, prompt, schema, status, payload, reason, created_at, resolved_at, expires_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n      )\n      .run(...columns(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.db.prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE id = ?`).get(id) as\n      | RawGateRow\n      | undefined;\n    return row ? toRecord(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    this.db\n      .prepare(\n        `UPDATE ${quoteIdent(this.table)}\n            SET status = ?, payload = ?, reason = ?, resolved_at = ?\n          WHERE id = ?`,\n      )\n      .run(record.status, toJson(record.payload), record.reason ?? null, record.resolvedAt ?? null, record.id);\n  }\n\n  protected readByStatus(status: GateStatus): GateRecord[] {\n    const rows = this.db\n      .prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE status = ? ORDER BY created_at`)\n      .all(status) as RawGateRow[];\n    return rows.map(toRecord);\n  }\n}\n\nfunction columns(record: GateRecord): unknown[] {\n  return [\n    record.id,\n    record.prompt,\n    record.schema ? JSON.stringify(record.schema) : null,\n    record.status,\n    toJson(record.payload),\n    record.reason ?? null,\n    record.createdAt,\n    record.resolvedAt ?? null,\n    record.expiresAt ?? null,\n  ];\n}\n\n/** `undefined` and a stored JSON `null` are different states, so only the former becomes a SQL NULL. */\nfunction toJson(payload: unknown): string | null {\n  return payload === undefined ? null : JSON.stringify(payload);\n}\n\nfunction toRecord(row: RawGateRow): GateRecord {\n  return {\n    id: row.id,\n    prompt: row.prompt,\n    schema: row.schema ? (JSON.parse(row.schema) as JsonSchema) : undefined,\n    status: row.status,\n    payload: row.payload === null ? undefined : JSON.parse(row.payload),\n    reason: row.reason ?? undefined,\n    createdAt: row.created_at,\n    resolvedAt: row.resolved_at ?? undefined,\n    expiresAt: row.expires_at ?? undefined,\n  };\n}\n"],"mappings":";;;;;AAAA,SAAS,YAAY,qBAA8C;AAI5D,IAAM,qBAAqB;AAE3B,SAAS,aAAa,OAAe,oBAA4B;AACtE,QAAM,IAAI,WAAW,IAAI;AACzB,SAAO;AAAA,iCACwB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAWD,WAAW,GAAG,IAAI,UAAU,CAAC;AAAA,WACnD,CAAC;AAAA;AAEZ;AAGO,SAAS,cAAc,SAAiB,OAAe,oBAA+B;AAC3F,SAAO,EAAE,SAAS,MAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,aAAa,IAAI,CAAC,EAAE;AAClF;AA0BO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAGjD,YACmB,IACjB,UAAkC,CAAC,GACnC;AACA,UAAM,QAAQ,OAAO,KAAK,GAAG;AAHZ;AAIjB,SAAK,QAAQ,QAAQ,SAAS;AAC9B,QAAI,QAAQ,WAAW,KAAM,eAAc,IAAI,CAAC,cAAc,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EAC/E;AAAA,EANmB;AAAA,EAHF;AAAA,EAWP,OAAO,QAA0B;AACzC,SAAK,GACF;AAAA,MACC,eAAe,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGvC,EACC,IAAI,GAAG,QAAQ,MAAM,CAAC;AAAA,EAC3B;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,GAAG,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE;AAG1F,WAAO,MAAM,SAAS,GAAG,IAAI;AAAA,EAC/B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,GACF;AAAA,MACC,UAAU,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGlC,EACC,IAAI,OAAO,QAAQ,OAAO,OAAO,OAAO,GAAG,OAAO,UAAU,MAAM,OAAO,cAAc,MAAM,OAAO,EAAE;AAAA,EAC3G;AAAA,EAEU,aAAa,QAAkC;AACvD,UAAM,OAAO,KAAK,GACf,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,uCAAuC,EACtF,IAAI,MAAM;AACb,WAAO,KAAK,IAAI,QAAQ;AAAA,EAC1B;AACF;AAEA,SAAS,QAAQ,QAA+B;AAC9C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO,SAAS,KAAK,UAAU,OAAO,MAAM,IAAI;AAAA,IAChD,OAAO;AAAA,IACP,OAAO,OAAO,OAAO;AAAA,IACrB,OAAO,UAAU;AAAA,IACjB,OAAO;AAAA,IACP,OAAO,cAAc;AAAA,IACrB,OAAO,aAAa;AAAA,EACtB;AACF;AAGA,SAAS,OAAO,SAAiC;AAC/C,SAAO,YAAY,SAAY,OAAO,KAAK,UAAU,OAAO;AAC9D;AAEA,SAAS,SAAS,KAA6B;AAC7C,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,SAAU,KAAK,MAAM,IAAI,MAAM,IAAmB;AAAA,IAC9D,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI,YAAY,OAAO,SAAY,KAAK,MAAM,IAAI,OAAO;AAAA,IAClE,QAAQ,IAAI,UAAU;AAAA,IACtB,WAAW,IAAI;AAAA,IACf,YAAY,IAAI,eAAe;AAAA,IAC/B,WAAW,IAAI,cAAc;AAAA,EAC/B;AACF;","names":[]}
+{"version":3,"sources":["../src/sqlite-store.ts"],"sourcesContent":["import { quoteIdent, runMigrations, type Db, type Migration } from \"@titan-design/store-sqlite\";\nimport { BaseGateStore } from \"./base-store.js\";\nimport {\n  GateStoreSchemaOutdated,\n  type GateAuthorize,\n  type GateRecord,\n  type GateResolver,\n  type GateStatus,\n  type JsonSchema,\n} from \"./types.js\";\n\nexport const DEFAULT_GATE_TABLE = \"hitl_gate\";\n\nexport function gateTableDdl(name: string = DEFAULT_GATE_TABLE): string {\n  const t = quoteIdent(name);\n  return `\n    CREATE TABLE IF NOT EXISTS ${t} (\n      id          TEXT PRIMARY KEY,\n      prompt      TEXT NOT NULL,\n      schema      TEXT,\n      status      TEXT NOT NULL DEFAULT 'pending',\n      payload     TEXT,\n      reason      TEXT,\n      created_at  TEXT NOT NULL,\n      resolved_at TEXT,\n      expires_at  TEXT\n    );\n    CREATE INDEX IF NOT EXISTS ${quoteIdent(`${name}_pending`)}\n      ON ${t} (created_at) WHERE status = 'pending';\n  `;\n}\n\n/** Drop into the product's own `runMigrations` list so hitl shares one database with its domain tables. */\nexport function gateMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return { version, name: `hitl:${name}`, up: (db) => db.exec(gateTableDdl(name)) };\n}\n\n/**\n * The triggers that refuse a resolved row naming no resolver, on update and on\n * insert, so a writer that predates `resolved_by` fails loudly instead of resolving anonymously.\n */\nexport function resolverRequiredTriggerDdl(name: string = DEFAULT_GATE_TABLE): string {\n  return ([\"UPDATE\", \"INSERT\"] as const).map((event) => resolverTrigger(name, event)).join(\"\\n\");\n}\n\nfunction resolverTrigger(name: string, event: \"UPDATE\" | \"INSERT\"): string {\n  const suffix = event === \"UPDATE\" ? \"resolver_required\" : \"resolver_required_insert\";\n  return `\n    CREATE TRIGGER IF NOT EXISTS ${quoteIdent(`${name}_${suffix}`)}\n      BEFORE ${event} ON ${quoteIdent(name)}\n      FOR EACH ROW WHEN NEW.status = 'resolved' AND NEW.resolved_by IS NULL\n    BEGIN\n      SELECT RAISE(ABORT, 'hitl: resolvedBy required');\n    END;\n  `;\n}\n\n/**\n * Adds `resolved_by` and the resolver trigger. Idempotent and backfill-free:\n * gates resolved before it keep an unknown resolver rather than a guessed one.\n */\nexport function gateResolverMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return {\n    version,\n    name: `hitl:resolver:${name}`,\n    up: (db) => {\n      if (!hasResolverColumn(db, name)) db.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN resolved_by TEXT`);\n      db.exec(resolverRequiredTriggerDdl(name));\n    },\n  };\n}\n\nfunction hasResolverColumn(db: Db, table: string): boolean {\n  return db.prepare(\"SELECT 1 FROM pragma_table_info(?) WHERE name = 'resolved_by'\").get(table) !== undefined;\n}\n\nexport interface SqliteGateStoreOptions {\n  table?: string;\n  /** Run `gateMigration` on construction. Off when the product owns its migration list. */\n  migrate?: boolean;\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n}\n\ninterface RawGateRow {\n  id: string;\n  prompt: string;\n  schema: string | null;\n  status: GateStatus;\n  payload: string | null;\n  reason: string | null;\n  created_at: string;\n  resolved_at: string | null;\n  expires_at: string | null;\n  /** Absent entirely on a table that has not run `gateResolverMigration`. */\n  resolved_by?: string | null;\n}\n\n/**\n * Durable gates. Two instances on the same file are two processes as far as the\n * gate is concerned, which is the entire point: whoever resolves the row does\n * not have to be whoever opened it.\n */\nexport class SqliteGateStore extends BaseGateStore {\n  private readonly table: string;\n  private resolverColumnSeen = false;\n\n  constructor(\n    private readonly db: Db,\n    options: SqliteGateStoreOptions = {},\n  ) {\n    super(options.now ?? Date.now, options.authorize);\n    this.table = options.table ?? DEFAULT_GATE_TABLE;\n    if (options.migrate ?? true) runMigrations(db, [gateMigration(1, this.table)]);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.db\n      .prepare(\n        `INSERT INTO ${quoteIdent(this.table)}\n           (id, prompt, schema, status, payload, reason, created_at, resolved_at, expires_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n      )\n      .run(...columns(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.db.prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE id = ?`).get(id) as\n      | RawGateRow\n      | undefined;\n    return row ? toRecord(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    if (record.resolvedBy) {\n      this.updateWithResolver(record, record.resolvedBy);\n      return;\n    }\n    this.db\n      .prepare(\n        `UPDATE ${quoteIdent(this.table)}\n            SET status = ?, payload = ?, reason = ?, resolved_at = ?\n          WHERE id = ?`,\n      )\n      .run(record.status, toJson(record.payload), record.reason ?? null, record.resolvedAt ?? null, record.id);\n  }\n\n  /** Refuses rather than dropping the resolver when the table has no column to hold it. */\n  private updateWithResolver(record: GateRecord, resolvedBy: GateResolver): void {\n    if (!this.resolverColumnPresent()) {\n      throw new GateStoreSchemaOutdated(record.id, this.table, \"gateResolverMigration\");\n    }\n    this.db\n      .prepare(\n        `UPDATE ${quoteIdent(this.table)}\n            SET status = ?, payload = ?, reason = ?, resolved_at = ?, resolved_by = ?\n          WHERE id = ?`,\n      )\n      .run(\n        record.status,\n        toJson(record.payload),\n        record.reason ?? null,\n        record.resolvedAt ?? null,\n        JSON.stringify(resolvedBy),\n        record.id,\n      );\n  }\n\n  /** Only a positive probe is cached, so a migration run after construction is still noticed. */\n  private resolverColumnPresent(): boolean {\n    if (!this.resolverColumnSeen) this.resolverColumnSeen = hasResolverColumn(this.db, this.table);\n    return this.resolverColumnSeen;\n  }\n\n  protected readByStatus(status: GateStatus): GateRecord[] {\n    const rows = this.db\n      .prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE status = ? ORDER BY created_at`)\n      .all(status) as RawGateRow[];\n    return rows.map(toRecord);\n  }\n}\n\nfunction columns(record: GateRecord): unknown[] {\n  return [\n    record.id,\n    record.prompt,\n    record.schema ? JSON.stringify(record.schema) : null,\n    record.status,\n    toJson(record.payload),\n    record.reason ?? null,\n    record.createdAt,\n    record.resolvedAt ?? null,\n    record.expiresAt ?? null,\n  ];\n}\n\n/** `undefined` and a stored JSON `null` are different states, so only the former becomes a SQL NULL. */\nfunction toJson(payload: unknown): string | null {\n  return payload === undefined ? null : JSON.stringify(payload);\n}\n\nfunction toRecord(row: RawGateRow): GateRecord {\n  return {\n    id: row.id,\n    prompt: row.prompt,\n    schema: row.schema ? (JSON.parse(row.schema) as JsonSchema) : undefined,\n    status: row.status,\n    payload: row.payload === null ? undefined : JSON.parse(row.payload),\n    reason: row.reason ?? undefined,\n    createdAt: row.created_at,\n    resolvedAt: row.resolved_at ?? undefined,\n    expiresAt: row.expires_at ?? undefined,\n    resolvedBy: row.resolved_by ? (JSON.parse(row.resolved_by) as GateResolver) : undefined,\n  };\n}\n"],"mappings":";;;;;;AAAA,SAAS,YAAY,qBAA8C;AAW5D,IAAM,qBAAqB;AAE3B,SAAS,aAAa,OAAe,oBAA4B;AACtE,QAAM,IAAI,WAAW,IAAI;AACzB,SAAO;AAAA,iCACwB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAWD,WAAW,GAAG,IAAI,UAAU,CAAC;AAAA,WACnD,CAAC;AAAA;AAEZ;AAGO,SAAS,cAAc,SAAiB,OAAe,oBAA+B;AAC3F,SAAO,EAAE,SAAS,MAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,aAAa,IAAI,CAAC,EAAE;AAClF;AAMO,SAAS,2BAA2B,OAAe,oBAA4B;AACpF,SAAQ,CAAC,UAAU,QAAQ,EAAY,IAAI,CAAC,UAAU,gBAAgB,MAAM,KAAK,CAAC,EAAE,KAAK,IAAI;AAC/F;AAEA,SAAS,gBAAgB,MAAc,OAAoC;AACzE,QAAM,SAAS,UAAU,WAAW,sBAAsB;AAC1D,SAAO;AAAA,mCAC0B,WAAW,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;AAAA,eACnD,KAAK,OAAO,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAM3C;AAMO,SAAS,sBAAsB,SAAiB,OAAe,oBAA+B;AACnG,SAAO;AAAA,IACL;AAAA,IACA,MAAM,iBAAiB,IAAI;AAAA,IAC3B,IAAI,CAAC,OAAO;AACV,UAAI,CAAC,kBAAkB,IAAI,IAAI,EAAG,IAAG,KAAK,eAAe,WAAW,IAAI,CAAC,8BAA8B;AACvG,SAAG,KAAK,2BAA2B,IAAI,CAAC;AAAA,IAC1C;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,IAAQ,OAAwB;AACzD,SAAO,GAAG,QAAQ,+DAA+D,EAAE,IAAI,KAAK,MAAM;AACpG;AA8BO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAIjD,YACmB,IACjB,UAAkC,CAAC,GACnC;AACA,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS;AAH/B;AAIjB,SAAK,QAAQ,QAAQ,SAAS;AAC9B,QAAI,QAAQ,WAAW,KAAM,eAAc,IAAI,CAAC,cAAc,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EAC/E;AAAA,EANmB;AAAA,EAJF;AAAA,EACT,qBAAqB;AAAA,EAWnB,OAAO,QAA0B;AACzC,SAAK,GACF;AAAA,MACC,eAAe,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGvC,EACC,IAAI,GAAG,QAAQ,MAAM,CAAC;AAAA,EAC3B;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,GAAG,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE;AAG1F,WAAO,MAAM,SAAS,GAAG,IAAI;AAAA,EAC/B;AAAA,EAEU,OAAO,QAA0B;AACzC,QAAI,OAAO,YAAY;AACrB,WAAK,mBAAmB,QAAQ,OAAO,UAAU;AACjD;AAAA,IACF;AACA,SAAK,GACF;AAAA,MACC,UAAU,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGlC,EACC,IAAI,OAAO,QAAQ,OAAO,OAAO,OAAO,GAAG,OAAO,UAAU,MAAM,OAAO,cAAc,MAAM,OAAO,EAAE;AAAA,EAC3G;AAAA;AAAA,EAGQ,mBAAmB,QAAoB,YAAgC;AAC7E,QAAI,CAAC,KAAK,sBAAsB,GAAG;AACjC,YAAM,IAAI,wBAAwB,OAAO,IAAI,KAAK,OAAO,uBAAuB;AAAA,IAClF;AACA,SAAK,GACF;AAAA,MACC,UAAU,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGlC,EACC;AAAA,MACC,OAAO;AAAA,MACP,OAAO,OAAO,OAAO;AAAA,MACrB,OAAO,UAAU;AAAA,MACjB,OAAO,cAAc;AAAA,MACrB,KAAK,UAAU,UAAU;AAAA,MACzB,OAAO;AAAA,IACT;AAAA,EACJ;AAAA;AAAA,EAGQ,wBAAiC;AACvC,QAAI,CAAC,KAAK,mBAAoB,MAAK,qBAAqB,kBAAkB,KAAK,IAAI,KAAK,KAAK;AAC7F,WAAO,KAAK;AAAA,EACd;AAAA,EAEU,aAAa,QAAkC;AACvD,UAAM,OAAO,KAAK,GACf,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,uCAAuC,EACtF,IAAI,MAAM;AACb,WAAO,KAAK,IAAI,QAAQ;AAAA,EAC1B;AACF;AAEA,SAAS,QAAQ,QAA+B;AAC9C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO,SAAS,KAAK,UAAU,OAAO,MAAM,IAAI;AAAA,IAChD,OAAO;AAAA,IACP,OAAO,OAAO,OAAO;AAAA,IACrB,OAAO,UAAU;AAAA,IACjB,OAAO;AAAA,IACP,OAAO,cAAc;AAAA,IACrB,OAAO,aAAa;AAAA,EACtB;AACF;AAGA,SAAS,OAAO,SAAiC;AAC/C,SAAO,YAAY,SAAY,OAAO,KAAK,UAAU,OAAO;AAC9D;AAEA,SAAS,SAAS,KAA6B;AAC7C,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,SAAU,KAAK,MAAM,IAAI,MAAM,IAAmB;AAAA,IAC9D,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI,YAAY,OAAO,SAAY,KAAK,MAAM,IAAI,OAAO;AAAA,IAClE,QAAQ,IAAI,UAAU;AAAA,IACtB,WAAW,IAAI;AAAA,IACf,YAAY,IAAI,eAAe;AAAA,IAC/B,WAAW,IAAI,cAAc;AAAA,IAC7B,YAAY,IAAI,cAAe,KAAK,MAAM,IAAI,WAAW,IAAqB;AAAA,EAChF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@titan-design/hitl",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Human-in-the-loop gate()/resolve() primitive",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,6 +35,7 @@
     "access": "public"
   },
   "dependencies": {
+    "@titan-design/authority": "^0.2.0",
     "@titan-design/store-sqlite": "0.3.1"
   },
   "peerDependencies": {

package/dist/chunk-5P4RFTKR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts","../src/json-schema.ts","../src/base-store.ts"],"sourcesContent":["/** A gate is a row, never a promise: pending work survives the process that opened it. */\nexport type GateStatus = \"pending\" | \"resolved\" | \"cancelled\" | \"expired\";\n\n/** A JSON Schema document, stored so any process can validate a payload without the original zod schema. */\nexport type JsonSchema = Record<string, unknown>;\n\nexport interface GateRecord {\n  id: string;\n  prompt: string;\n  schema: JsonSchema | undefined;\n  status: GateStatus;\n  payload: unknown;\n  /** Why the gate was cancelled; unset for every other status. */\n  reason: string | undefined;\n  /** ISO-8601 with milliseconds, the shape store-sqlite writes and any surface can send as-is. */\n  createdAt: string;\n  resolvedAt: string | undefined;\n  expiresAt: string | undefined;\n}\n\nexport interface GateInput {\n  /** Defaults to a random UUID. Supply one to make the gate addressable by a name you already own. */\n  id?: string;\n  prompt: string;\n  schema?: JsonSchema;\n  expiresAt?: Date | string;\n}\n\n/**\n * Synchronous on purpose: both implementations are local (a Map, and\n * better-sqlite3), and `wait` is the only thing that needs to be async.\n */\nexport interface GateStore {\n  create(input: GateInput): GateRecord;\n  get(id: string): GateRecord | undefined;\n  resolve(id: string, payload: unknown): GateRecord;\n  cancel(id: string, reason: string): GateRecord;\n  listPending(): GateRecord[];\n}\n\nexport class GateError extends Error {\n  constructor(\n    message: string,\n    readonly gateId: string,\n  ) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\nexport class GateNotFound extends GateError {\n  constructor(gateId: string) {\n    super(`no gate with id ${gateId}`, gateId);\n  }\n}\n\nexport class GateAlreadyExists extends GateError {\n  constructor(gateId: string) {\n    super(`a gate with id ${gateId} already exists`, gateId);\n  }\n}\n\nexport class GateAlreadySettled extends GateError {\n  constructor(\n    gateId: string,\n    readonly status: GateStatus,\n  ) {\n    super(`gate ${gateId} is already ${status}`, gateId);\n  }\n}\n\nexport class GateCancelled extends GateError {\n  constructor(\n    gateId: string,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} was cancelled: ${reason}`, gateId);\n  }\n}\n\nexport class GateExpired extends GateError {\n  constructor(gateId: string) {\n    super(`gate ${gateId} expired before anyone resolved it`, gateId);\n  }\n}\n\nexport class GatePayloadInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly issues: string[],\n  ) {\n    super(`payload for gate ${gateId} does not match its schema: ${issues.join(\"; \")}`, gateId);\n  }\n}\n\nexport class GateAborted extends GateError {\n  constructor(gateId: string, reason: string) {\n    super(`stopped waiting on gate ${gateId}: ${reason}`, gateId);\n  }\n}\n","import type { JsonSchema } from \"./types.js\";\n\n/**\n * A deliberately small structural check over the JSON Schema subset `z.toJSONSchema`\n * emits. It exists so the process that resolves a gate can reject a bad payload\n * without holding the original zod schema, which by definition lives in another\n * process. The waiter still re-validates with the real zod schema, so this is the\n * boundary check, not the type guarantee.\n */\nexport function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path = \"$\"): string[] {\n  const issues: string[] = [];\n  collect(schema, value, path, issues);\n  return issues;\n}\n\nfunction collect(schema: JsonSchema, value: unknown, path: string, issues: string[]): void {\n  if (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf)) {\n    checkUnion((schema.anyOf ?? schema.oneOf) as JsonSchema[], value, path, issues);\n    return;\n  }\n  if (\"const\" in schema && !Object.is(schema.const, value)) {\n    issues.push(`${path}: expected ${JSON.stringify(schema.const)}`);\n    return;\n  }\n  if (Array.isArray(schema.enum) && !schema.enum.some((option) => Object.is(option, value))) {\n    issues.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);\n    return;\n  }\n  if (typeof schema.type !== \"string\") return;\n  if (!matchesType(schema.type, value)) {\n    issues.push(`${path}: expected ${schema.type}, received ${describe(value)}`);\n    return;\n  }\n  if (schema.type === \"object\") checkObject(schema, value as Record<string, unknown>, path, issues);\n  if (schema.type === \"array\") checkArray(schema, value as unknown[], path, issues);\n}\n\nfunction checkUnion(branches: JsonSchema[], value: unknown, path: string, issues: string[]): void {\n  const matched = branches.some((branch) => checkAgainstJsonSchema(branch, value, path).length === 0);\n  if (!matched) issues.push(`${path}: matched none of the ${branches.length} allowed shapes`);\n}\n\nfunction checkObject(schema: JsonSchema, value: Record<string, unknown>, path: string, issues: string[]): void {\n  const properties = (schema.properties ?? {}) as Record<string, JsonSchema>;\n  for (const key of (schema.required ?? []) as string[]) {\n    if (!(key in value)) issues.push(`${path}.${key}: required`);\n  }\n  if (schema.additionalProperties === false) {\n    for (const key of Object.keys(value)) {\n      if (!(key in properties)) issues.push(`${path}.${key}: unexpected property`);\n    }\n  }\n  for (const [key, sub] of Object.entries(properties)) {\n    if (key in value) collect(sub, value[key], `${path}.${key}`, issues);\n  }\n}\n\nfunction checkArray(schema: JsonSchema, value: unknown[], path: string, issues: string[]): void {\n  const items = schema.items as JsonSchema | undefined;\n  if (!items) return;\n  value.forEach((entry, index) => collect(items, entry, `${path}[${index}]`, issues));\n}\n\nfunction matchesType(type: string, value: unknown): boolean {\n  switch (type) {\n    case \"object\":\n      return typeof value === \"object\" && value !== null && !Array.isArray(value);\n    case \"array\":\n      return Array.isArray(value);\n    case \"integer\":\n      return Number.isInteger(value);\n    case \"number\":\n      return typeof value === \"number\" && Number.isFinite(value);\n    case \"null\":\n      return value === null;\n    default:\n      return typeof value === type;\n  }\n}\n\nfunction describe(value: unknown): string {\n  if (value === null) return \"null\";\n  return Array.isArray(value) ? \"array\" : typeof value;\n}\n","import { checkAgainstJsonSchema } from \"./json-schema.js\";\nimport {\n  GateAlreadyExists,\n  GateAlreadySettled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  type GateInput,\n  type GateRecord,\n  type GateStore,\n} from \"./types.js\";\n\n/**\n * Every settle rule lives here so the memory and SQLite stores cannot drift\n * apart. Subclasses only move rows.\n */\nexport abstract class BaseGateStore implements GateStore {\n  protected constructor(protected readonly clock: () => number) {}\n\n  protected abstract insert(record: GateRecord): void;\n  protected abstract read(id: string): GateRecord | undefined;\n  protected abstract update(record: GateRecord): void;\n  protected abstract readByStatus(status: GateRecord[\"status\"]): GateRecord[];\n\n  create(input: GateInput): GateRecord {\n    const id = input.id ?? globalThis.crypto.randomUUID();\n    if (this.read(id)) throw new GateAlreadyExists(id);\n    const record: GateRecord = {\n      id,\n      prompt: input.prompt,\n      schema: input.schema,\n      status: \"pending\",\n      payload: undefined,\n      reason: undefined,\n      createdAt: this.nowIso(),\n      resolvedAt: undefined,\n      expiresAt: toIso(input.expiresAt),\n    };\n    this.insert(record);\n    return record;\n  }\n\n  get(id: string): GateRecord | undefined {\n    const record = this.read(id);\n    return record ? this.lapseIfExpired(record) : undefined;\n  }\n\n  resolve(id: string, payload: unknown): GateRecord {\n    const record = this.requirePending(id);\n    if (record.schema) {\n      const issues = checkAgainstJsonSchema(record.schema, payload);\n      if (issues.length > 0) throw new GatePayloadInvalid(id, issues);\n    }\n    const resolved: GateRecord = { ...record, status: \"resolved\", payload, resolvedAt: this.nowIso() };\n    this.update(resolved);\n    return resolved;\n  }\n\n  cancel(id: string, reason: string): GateRecord {\n    const record = this.requirePending(id);\n    const cancelled: GateRecord = { ...record, status: \"cancelled\", reason, resolvedAt: this.nowIso() };\n    this.update(cancelled);\n    return cancelled;\n  }\n\n  listPending(): GateRecord[] {\n    return this.readByStatus(\"pending\")\n      .map((record) => this.lapseIfExpired(record))\n      .filter((record) => record.status === \"pending\")\n      .sort((a, b) => a.createdAt.localeCompare(b.createdAt));\n  }\n\n  private requirePending(id: string): GateRecord {\n    const record = this.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"expired\") throw new GateExpired(id);\n    if (record.status !== \"pending\") throw new GateAlreadySettled(id, record.status);\n    return record;\n  }\n\n  /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */\n  private lapseIfExpired(record: GateRecord): GateRecord {\n    if (record.status !== \"pending\" || !record.expiresAt) return record;\n    if (Date.parse(record.expiresAt) > this.clock()) return record;\n    const expired: GateRecord = { ...record, status: \"expired\", resolvedAt: this.nowIso() };\n    this.update(expired);\n    return expired;\n  }\n\n  protected nowIso(): string {\n    return new Date(this.clock()).toISOString();\n  }\n}\n\nfunction toIso(value: Date | string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  return typeof value === \"string\" ? value : value.toISOString();\n}\n"],"mappings":";AAwCO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO,WAAW;AAAA,EACzB;AAAA,EAJW;AAKb;AAEO,IAAM,eAAN,cAA2B,UAAU;AAAA,EAC1C,YAAY,QAAgB;AAC1B,UAAM,mBAAmB,MAAM,IAAI,MAAM;AAAA,EAC3C;AACF;AAEO,IAAM,oBAAN,cAAgC,UAAU;AAAA,EAC/C,YAAY,QAAgB;AAC1B,UAAM,kBAAkB,MAAM,mBAAmB,MAAM;AAAA,EACzD;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,eAAe,MAAM,IAAI,MAAM;AAF1C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,gBAAN,cAA4B,UAAU;AAAA,EAC3C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,mBAAmB,MAAM,IAAI,MAAM;AAF9C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB;AAC1B,UAAM,QAAQ,MAAM,sCAAsC,MAAM;AAAA,EAClE;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,oBAAoB,MAAM,+BAA+B,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM;AAFjF;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB,QAAgB;AAC1C,UAAM,2BAA2B,MAAM,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9D;AACF;;;AC1FO,SAAS,uBAAuB,QAAoB,OAAgB,OAAO,KAAe;AAC/F,QAAM,SAAmB,CAAC;AAC1B,UAAQ,QAAQ,OAAO,MAAM,MAAM;AACnC,SAAO;AACT;AAEA,SAAS,QAAQ,QAAoB,OAAgB,MAAc,QAAwB;AACzF,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC9D,eAAY,OAAO,SAAS,OAAO,OAAwB,OAAO,MAAM,MAAM;AAC9E;AAAA,EACF;AACA,MAAI,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG;AACxD,WAAO,KAAK,GAAG,IAAI,cAAc,KAAK,UAAU,OAAO,KAAK,CAAC,EAAE;AAC/D;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,OAAO,GAAG,QAAQ,KAAK,CAAC,GAAG;AACzF,WAAO,KAAK,GAAG,IAAI,qBAAqB,KAAK,UAAU,OAAO,IAAI,CAAC,EAAE;AACrE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,SAAS,SAAU;AACrC,MAAI,CAAC,YAAY,OAAO,MAAM,KAAK,GAAG;AACpC,WAAO,KAAK,GAAG,IAAI,cAAc,OAAO,IAAI,cAAc,SAAS,KAAK,CAAC,EAAE;AAC3E;AAAA,EACF;AACA,MAAI,OAAO,SAAS,SAAU,aAAY,QAAQ,OAAkC,MAAM,MAAM;AAChG,MAAI,OAAO,SAAS,QAAS,YAAW,QAAQ,OAAoB,MAAM,MAAM;AAClF;AAEA,SAAS,WAAW,UAAwB,OAAgB,MAAc,QAAwB;AAChG,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,uBAAuB,QAAQ,OAAO,IAAI,EAAE,WAAW,CAAC;AAClG,MAAI,CAAC,QAAS,QAAO,KAAK,GAAG,IAAI,yBAAyB,SAAS,MAAM,iBAAiB;AAC5F;AAEA,SAAS,YAAY,QAAoB,OAAgC,MAAc,QAAwB;AAC7G,QAAM,aAAc,OAAO,cAAc,CAAC;AAC1C,aAAW,OAAQ,OAAO,YAAY,CAAC,GAAgB;AACrD,QAAI,EAAE,OAAO,OAAQ,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,YAAY;AAAA,EAC7D;AACA,MAAI,OAAO,yBAAyB,OAAO;AACzC,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,EAAE,OAAO,YAAa,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,uBAAuB;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACnD,QAAI,OAAO,MAAO,SAAQ,KAAK,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM;AAAA,EACrE;AACF;AAEA,SAAS,WAAW,QAAoB,OAAkB,MAAc,QAAwB;AAC9F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO;AACZ,QAAM,QAAQ,CAAC,OAAO,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AACpF;AAEA,SAAS,YAAY,MAAc,OAAyB;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA,IAC5E,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B,KAAK;AACH,aAAO,OAAO,UAAU,KAAK;AAAA,IAC/B,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU;AAAA,IACnB;AACE,aAAO,OAAO,UAAU;AAAA,EAC5B;AACF;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACjD;;;ACnEO,IAAe,gBAAf,MAAkD;AAAA,EAC7C,YAA+B,OAAqB;AAArB;AAAA,EAAsB;AAAA,EAAtB;AAAA,EAOzC,OAAO,OAA8B;AACnC,UAAM,KAAK,MAAM,MAAM,WAAW,OAAO,WAAW;AACpD,QAAI,KAAK,KAAK,EAAE,EAAG,OAAM,IAAI,kBAAkB,EAAE;AACjD,UAAM,SAAqB;AAAA,MACzB;AAAA,MACA,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW,KAAK,OAAO;AAAA,MACvB,YAAY;AAAA,MACZ,WAAW,MAAM,MAAM,SAAS;AAAA,IAClC;AACA,SAAK,OAAO,MAAM;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAoC;AACtC,UAAM,SAAS,KAAK,KAAK,EAAE;AAC3B,WAAO,SAAS,KAAK,eAAe,MAAM,IAAI;AAAA,EAChD;AAAA,EAEA,QAAQ,IAAY,SAA8B;AAChD,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,QAAI,OAAO,QAAQ;AACjB,YAAM,SAAS,uBAAuB,OAAO,QAAQ,OAAO;AAC5D,UAAI,OAAO,SAAS,EAAG,OAAM,IAAI,mBAAmB,IAAI,MAAM;AAAA,IAChE;AACA,UAAM,WAAuB,EAAE,GAAG,QAAQ,QAAQ,YAAY,SAAS,YAAY,KAAK,OAAO,EAAE;AACjG,SAAK,OAAO,QAAQ;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAY,QAA4B;AAC7C,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,UAAM,YAAwB,EAAE,GAAG,QAAQ,QAAQ,aAAa,QAAQ,YAAY,KAAK,OAAO,EAAE;AAClG,SAAK,OAAO,SAAS;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,cAA4B;AAC1B,WAAO,KAAK,aAAa,SAAS,EAC/B,IAAI,CAAC,WAAW,KAAK,eAAe,MAAM,CAAC,EAC3C,OAAO,CAAC,WAAW,OAAO,WAAW,SAAS,EAC9C,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC;AAAA,EAC1D;AAAA,EAEQ,eAAe,IAAwB;AAC7C,UAAM,SAAS,KAAK,IAAI,EAAE;AAC1B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,mBAAmB,IAAI,OAAO,MAAM;AAC/E,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,eAAe,QAAgC;AACrD,QAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAW,QAAO;AAC7D,QAAI,KAAK,MAAM,OAAO,SAAS,IAAI,KAAK,MAAM,EAAG,QAAO;AACxD,UAAM,UAAsB,EAAE,GAAG,QAAQ,QAAQ,WAAW,YAAY,KAAK,OAAO,EAAE;AACtF,SAAK,OAAO,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEU,SAAiB;AACzB,WAAO,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,YAAY;AAAA,EAC5C;AACF;AAEA,SAAS,MAAM,OAAsD;AACnE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM,YAAY;AAC/D;","names":[]}