@titan-design/hitl 0.3.1 → 0.4.0

package/README.md

@@ -51,7 +51,11 @@ Somewhere else entirely, in a CLI, an MCP tool, or a dashboard route:
 ```ts
 import { resolveGate, cancelGate } from "@titan-design/hitl";
 
-resolveGate(store, "deploy-approval", { approved: true });
+resolveGate(store, "deploy-approval", { approved: true }, {
+  class: "owner-terminal",
+  id: "owner",
+  channel: "cli",
+});
 ```
 
 After a restart, re-attach by id instead of re-opening:
@@ -89,7 +93,7 @@ both pass the same behaviour suite.
 
 `SqliteGateStore` installs a `hitl_gate` table through store-sqlite's
 `runMigrations` on construction. Pass `migrate: false` and put `gateMigration(n)`
-in the product's own migration list when hitl shares a database with domain
+and `gateResolverMigration(m)` in the product's own migration list when hitl shares a database with domain
 tables. `table` renames the table so one database can host several gate spaces.
 Timestamps are ISO-8601 strings, the shape store-sqlite writes and any surface
 can send on as-is.
@@ -99,7 +103,7 @@ tell its waiter why.
 
 ## Who resolved it
 
-`resolve` and `resolveGate` take an optional third argument, a `GateResolver`:
+`resolve` and `resolveGate` require a third argument, a `GateResolver`:
 `{ class, id, channel, confirmEvent? }`. `class` is an actor class from
 `@titan-design/authority`. The store records it as `resolvedBy`.
 
@@ -116,23 +120,88 @@ agent or automation never answers a gate. It throws `GateResolverRefused` and th
 pending. The store reads each declared resolver field once into a frozen copy, and checks and stores
 only that copy. A store's `authorize` option runs after the class check and can refuse more,
 never fewer. It must return `{ allowed }` synchronously, or the store throws
-`GateAuthorizeInvalid`. With `authorize` installed, a resolve that names no resolver is refused.
+`GateAuthorizeInvalid`.
 Refusals name the gate id and the actor class, never the resolver's other fields.
 
 hitl records a claim about the resolver; it cannot prove one. Any process that can write
 the database can claim any class.
 
 On SQLite the resolver lives in a `resolved_by` column that `gateResolverMigration(n)` adds,
-along with a trigger that refuses any resolve naming no resolver. Add it to your own
-migration list after `gateMigration`. It is idempotent and does not backfill: gates resolved
-before it read back with `resolvedBy` undefined. Until the migration runs, a store resolves
-without a resolver as before and throws `GateStoreSchemaOutdated` when given one, rather
-than dropping it. `migrate: true` does not run it yet.
+along with a trigger that refuses any resolve naming no resolver. `migrate: true` runs it as
+version 2; with `migrate: false`, add it to your own migration list after `gateMigration`. It
+is idempotent and does not backfill: gates resolved before it read back with `resolvedBy`
+undefined. `SqliteGateStore` checks for the column when it is constructed and throws
+`GateStoreSchemaOutdated` naming `gateResolverMigration` when it is missing, or naming
+`gateMigration` when the table does not exist. That error carries an empty `gateId`,
+because no gate is involved yet.
 
 After the migration, a writer built on hitl 0.2.x fails when it resolves: SQLite aborts the
 statement with a raw error whose message is `hitl: resolvedBy required`. The same trigger
 refuses a direct insert of a resolved row with no resolver. Cancels from an old writer still
-work. The fix is to upgrade that writer so it passes a resolver.
+work. The fix is to upgrade that writer so it passes a resolver. A caller on this release
+never reaches the trigger: every store refuses a resolve with no resolver first.
+
+## Upgrading to 0.4
+
+0.4 makes the resolver required. It is a breaking release; a `^0.3` range does not pick it up.
+
+1. Pass a `GateResolver` to every `store.resolve`, `resolveGate` and workflow
+   `runtime.signal` call. The compiler finds each one. Name the class honestly: a human at
+   a terminal is `owner-terminal`, a human on a phone is `owner-remote`. An agent or an
+   automation cannot resolve a gate, by design.
+2. Add `gateResolverMigration(n)` to your migration list, after `gateMigration`, with the
+   next free version in your own list. `migrate: true` stores run it for you as version 2.
+3. Expect `GateStoreSchemaOutdated` naming `gateResolverMigration` from the
+   `SqliteGateStore` constructor if step 2 is missing. The store no longer opens over such a
+   table.
+4. Upgrade every process that writes the gate table at once. A writer still on 0.2 fails
+   each resolve with SQLite's `hitl: resolvedBy required` once the migration has run.
+
+A caller that bypasses the type and resolves with no resolver gets `GateResolverRefused`
+with the reason `a resolver is required` from every store, memory or SQLite, and the gate
+stays pending.
+
+## Rule-bound gates
+
+A gate can carry the authority rule that opened it. Pass `rule` to `create`:
+`{ table, version, ruleId, resolvers }`, where `resolvers` lists the resolver classes the
+rule admits, as `evaluate` from `@titan-design/authority` returns them.
+
+```ts
+store.create({
+  id: "release-approval",
+  prompt: "Publish the release?",
+  rule: { table: "F5", version: "1.0.0", ruleId: "REL-CO", resolvers: ["owner-terminal"] },
+});
+```
+
+The store reads the rule once into a frozen copy, so the caller cannot widen it after
+`create`. A rule that is not a non-empty list of resolver classes throws `GateRuleInvalid`
+and creates nothing. A rule-bound gate refuses a resolver whose class the rule does not
+name, and refuses a resolve that names no resolver. Both throw `GateResolverRefused` and
+leave the gate pending. The check runs after the default class check and before
+`authorize`, so it only narrows. A gate without a rule behaves as before.
+
+On SQLite the rule lives in a `rule` column that `gateRuleMigration(n)` adds, along with a
+trigger that aborts any update resolving a rule-bound row by a class outside its rule, or
+changing the rule, with `hitl: resolver outside the gate rule`. That stops a writer built on
+hitl 0.3.x, which knows nothing of rules, from widening who may answer. The migration is
+idempotent and does not backfill. `migrate: true` runs it as version 3. A store whose table
+lacks the column throws `GateStoreSchemaOutdated` naming `gateRuleMigration` when handed a
+rule, rather than dropping it.
+
+The trigger needs `resolved_by` to know who answered. On a table that has run
+`gateRuleMigration` but not `gateResolverMigration`, the trigger aborts every raw resolve of
+a rule-bound row, and no store opens over the table. Run both migrations in either order;
+the second one installs the class-aware trigger.
+
+The insert guard fires before SQLite's conflict handling. A raw insert with no rule onto a
+pending rule-bound id therefore aborts with `hitl: a pending rule-bound gate cannot be
+replaced`, whether it is a plain duplicate, `ON CONFLICT DO UPDATE`, `ON CONFLICT DO NOTHING`
+or `INSERT OR IGNORE`; a duplicate plain insert reports that message, not `UNIQUE`. The guard
+covers only pending rows. A raw `REPLACE` of a cancelled or resolved rule-bound row succeeds
+and can leave a pending rule-less row. That is outside the store API: `create` is a plain
+insert and throws on an existing id, and no store method replaces a row.
 
 ## Settling
 

package/dist/{base-store-BvwOJL6M.d.ts → base-store-BrVibYRJ.d.ts}

@@ -1,4 +1,4 @@
-import { ActorClass } from '@titan-design/authority';
+import { ResolverClass, ActorClass } from '@titan-design/authority';
 
 /** A gate is a row, never a promise: pending work survives the process that opened it. */
 type GateStatus = "pending" | "resolved" | "cancelled" | "expired";
@@ -18,6 +18,15 @@ interface GateRecord {
     expiresAt: string | undefined;
     /** Who resolved the gate, as claimed by the caller; unset for gates resolved before stores recorded it. */
     resolvedBy: GateResolver | undefined;
+    /** The authority rule that opened the gate; unset for a gate no rule governs. */
+    rule: GateRule | undefined;
+}
+/** Binds a gate to the authority rule that opened it, so only that rule's resolver classes may answer. */
+interface GateRule {
+    table: string;
+    version: string;
+    ruleId: string;
+    resolvers: ResolverClass[];
 }
 /** A claim about who answered a gate. hitl records it and checks its class; it cannot prove it. */
 interface GateResolver {
@@ -44,6 +53,7 @@ interface GateInput {
     prompt: string;
     schema?: JsonSchema;
     expiresAt?: Date | string;
+    rule?: GateRule;
 }
 /**
  * Synchronous on purpose: both implementations are local (a Map, and
@@ -52,7 +62,7 @@ interface GateInput {
 interface GateStore {
     create(input: GateInput): GateRecord;
     get(id: string): GateRecord | undefined;
-    resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;
+    resolve(id: string, payload: unknown, resolvedBy: GateResolver): GateRecord;
     cancel(id: string, reason: string): GateRecord;
     listPending(): GateRecord[];
 }
@@ -89,12 +99,19 @@ declare class GateResolverRefused extends GateError {
     readonly reason: string;
     constructor(gateId: string, actorClass: string | undefined, reason: string);
 }
-/** The store cannot record a resolver because its table predates the resolver migration. */
+/**
+ * The store cannot record a resolver or a rule because its table predates the migration that adds the column.
+ * `gateId` is empty when the store refuses at construction, before any gate is named.
+ */
 declare class GateStoreSchemaOutdated extends GateError {
     readonly table: string;
     readonly migration: string;
     constructor(gateId: string, table: string, migration: string);
 }
+declare class GateRuleInvalid extends GateError {
+    readonly reason: string;
+    constructor(gateId: string, reason: string);
+}
 declare class GateAuthorizeInvalid extends GateError {
     constructor(gateId: string);
 }
@@ -113,15 +130,15 @@ declare abstract class BaseGateStore implements GateStore {
     protected abstract readByStatus(status: GateRecord["status"]): GateRecord[];
     create(input: GateInput): GateRecord;
     get(id: string): GateRecord | undefined;
-    resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;
+    resolve(id: string, payload: unknown, resolvedBy: GateResolver): GateRecord;
     cancel(id: string, reason: string): GateRecord;
     listPending(): GateRecord[];
     private requirePending;
-    /** The default check runs first and `authorize` second, so `authorize` can only narrow who may resolve. */
+    /** The default check runs first, the gate's rule second and `authorize` last, so each can only narrow who may resolve. */
     private requireAuthorized;
     /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */
     private lapseIfExpired;
     protected nowIso(): string;
 }
 
-export { BaseGateStore as B, type GateRecord as G, type JsonSchema as J, type GateStore as a, type GateResolver as b, type GateAuthorize as c, GateAborted as d, GateAlreadyExists as e, GateAlreadySettled as f, type GateAuthorization as g, GateAuthorizeInvalid as h, GateCancelled as i, GateError as j, GateExpired as k, type GateInput as l, GateNotFound as m, GatePayloadInvalid as n, GateResolverRefused as o, type GateStatus as p, GateStoreSchemaOutdated as q };
+export { BaseGateStore as B, type GateRecord as G, type JsonSchema as J, type GateStore as a, type GateResolver as b, type GateAuthorize as c, GateAborted as d, GateAlreadyExists as e, GateAlreadySettled as f, type GateAuthorization as g, GateAuthorizeInvalid as h, GateCancelled as i, GateError as j, GateExpired as k, type GateInput as l, GateNotFound as m, GatePayloadInvalid as n, GateResolverRefused as o, type GateRule as p, GateRuleInvalid as q, type GateStatus as r, GateStoreSchemaOutdated as s };

package/dist/{chunk-4GAZKT6Z.js → chunk-PMEJTMSE.js}

@@ -59,13 +59,21 @@ var GateResolverRefused = class extends GateError {
 };
 var GateStoreSchemaOutdated = class extends GateError {
   constructor(gateId, table, migration) {
-    super(`gate ${gateId} cannot record its resolver: table ${table} needs ${migration}`, gateId);
+    const message = gateId === "" ? `cannot open a gate store on table ${table}: it needs ${migration}` : `gate ${gateId} cannot be recorded: table ${table} needs ${migration}`;
+    super(message, gateId);
     this.table = table;
     this.migration = migration;
   }
   table;
   migration;
 };
+var GateRuleInvalid = class extends GateError {
+  constructor(gateId, reason) {
+    super(`gate ${gateId} has an invalid rule: ${reason}`, gateId);
+    this.reason = reason;
+  }
+  reason;
+};
 var GateAuthorizeInvalid = class extends GateError {
   constructor(gateId) {
     super(`authorize for gate ${gateId} must return a decision { allowed: boolean } synchronously`, gateId);
@@ -149,6 +157,23 @@ function defaultResolverRefusal(resolver) {
   if (RESOLVER_CLASSES.includes(resolver.class)) return void 0;
   return `actor class ${resolver.class} may not resolve a gate`;
 }
+function ruleResolverRefusal(record, resolver) {
+  if (!record.rule) return void 0;
+  if (record.rule.resolvers.includes(resolver.class)) return void 0;
+  return `rule ${record.rule.ruleId} does not let ${resolver.class} resolve this gate`;
+}
+function snapshotRule(gateId, raw) {
+  if (typeof raw !== "object" || raw === null) throw new GateRuleInvalid(gateId, "the rule is not an object");
+  const { table, version, ruleId, resolvers } = raw;
+  if (typeof table !== "string" || typeof version !== "string" || typeof ruleId !== "string") {
+    throw new GateRuleInvalid(gateId, "the rule's table, version and ruleId must be strings");
+  }
+  const classes = Array.isArray(resolvers) ? [...resolvers] : [];
+  if (classes.length === 0 || !classes.every(isResolverClass)) {
+    throw new GateRuleInvalid(gateId, "the rule's resolvers must be a non-empty list of resolver classes");
+  }
+  return Object.freeze({ table, version, ruleId, resolvers: Object.freeze(classes) });
+}
 function snapshotResolver(gateId, raw) {
   if (typeof raw !== "object" || raw === null) throw new GateResolverRefused(gateId, void 0, "the resolver is not an object");
   const { class: actorClass, id, channel, confirmEvent } = raw;
@@ -176,6 +201,9 @@ function readDecision(gateId, decision) {
   if (allowed) return { allowed: true };
   return { allowed: false, reason: typeof reason === "string" ? reason : "authorize refused the resolver" };
 }
+function isResolverClass(value) {
+  return typeof value === "string" && RESOLVER_CLASSES.includes(value);
+}
 function isActorClass(value) {
   return typeof value === "string" && ACTOR_CLASSES.includes(value);
 }
@@ -190,6 +218,7 @@ var BaseGateStore = class {
   authorize;
   create(input) {
     const id = input.id ?? globalThis.crypto.randomUUID();
+    const rule = input.rule === void 0 ? void 0 : snapshotRule(id, input.rule);
     if (this.read(id)) throw new GateAlreadyExists(id);
     const record = {
       id,
@@ -201,7 +230,8 @@ var BaseGateStore = class {
       createdAt: this.nowIso(),
       resolvedAt: void 0,
       expiresAt: toIso(input.expiresAt),
-      resolvedBy: void 0
+      resolvedBy: void 0,
+      rule
     };
     this.insert(record);
     return record;
@@ -211,7 +241,8 @@ var BaseGateStore = class {
     return record ? this.lapseIfExpired(record) : void 0;
   }
   resolve(id, payload, resolvedBy) {
-    const resolver = resolvedBy === void 0 ? void 0 : snapshotResolver(id, resolvedBy);
+    if (!resolvedBy) throw new GateResolverRefused(id, void 0, "a resolver is required");
+    const resolver = snapshotResolver(id, resolvedBy);
     const record = this.requirePending(id);
     this.requireAuthorized(record, resolver);
     if (record.schema) {
@@ -238,12 +269,13 @@ var BaseGateStore = class {
     if (record.status !== "pending") throw new GateAlreadySettled(id, record.status);
     return record;
   }
-  /** The default check runs first and `authorize` second, so `authorize` can only narrow who may resolve. */
+  /** The default check runs first, the gate's rule second and `authorize` last, so each can only narrow who may resolve. */
   requireAuthorized(record, resolver) {
-    const refusal = resolver ? defaultResolverRefusal(resolver) : void 0;
-    if (resolver && refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);
+    const refusal = defaultResolverRefusal(resolver);
+    if (refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);
+    const ruleRefusal = ruleResolverRefusal(record, resolver);
+    if (ruleRefusal) throw new GateResolverRefused(record.id, resolver.class, ruleRefusal);
     if (!this.authorize) return;
-    if (!resolver) throw new GateResolverRefused(record.id, void 0, "a resolver is required when authorize is installed");
     const decision = readDecision(record.id, this.authorize(Object.freeze({ ...record }), resolver));
     if (!decision.allowed) throw new GateResolverRefused(record.id, resolver.class, decision.reason);
   }
@@ -275,10 +307,12 @@ export {
   GateAborted,
   GateResolverRefused,
   GateStoreSchemaOutdated,
+  GateRuleInvalid,
   GateAuthorizeInvalid,
   checkAgainstJsonSchema,
   defaultResolverRefusal,
+  ruleResolverRefusal,
   snapshotResolver,
   BaseGateStore
 };
-//# sourceMappingURL=chunk-4GAZKT6Z.js.map
+//# sourceMappingURL=chunk-PMEJTMSE.js.map

package/dist/chunk-PMEJTMSE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/json-schema.ts","../src/resolver-policy.ts","../src/base-store.ts"],"sourcesContent":["import type { ActorClass, ResolverClass } from \"@titan-design/authority\";\n\n/** A gate is a row, never a promise: pending work survives the process that opened it. */\nexport type GateStatus = \"pending\" | \"resolved\" | \"cancelled\" | \"expired\";\n\n/** A JSON Schema document, stored so any process can validate a payload without the original zod schema. */\nexport type JsonSchema = Record<string, unknown>;\n\nexport interface GateRecord {\n  id: string;\n  prompt: string;\n  schema: JsonSchema | undefined;\n  status: GateStatus;\n  payload: unknown;\n  /** Why the gate was cancelled; unset for every other status. */\n  reason: string | undefined;\n  /** ISO-8601 with milliseconds, the shape store-sqlite writes and any surface can send as-is. */\n  createdAt: string;\n  resolvedAt: string | undefined;\n  expiresAt: string | undefined;\n  /** Who resolved the gate, as claimed by the caller; unset for gates resolved before stores recorded it. */\n  resolvedBy: GateResolver | undefined;\n  /** The authority rule that opened the gate; unset for a gate no rule governs. */\n  rule: GateRule | undefined;\n}\n\n/** Binds a gate to the authority rule that opened it, so only that rule's resolver classes may answer. */\nexport interface GateRule {\n  table: string;\n  version: string;\n  ruleId: string;\n  resolvers: ResolverClass[];\n}\n\n/** A claim about who answered a gate. hitl records it and checks its class; it cannot prove it. */\nexport interface GateResolver {\n  class: ActorClass;\n  id: string;\n  channel: string;\n  /** The channel's own id for the confirming event, such as a chat reaction. */\n  confirmEvent?: string;\n}\n\nexport type GateAuthorization = { allowed: true } | { allowed: false; reason: string };\n\n/**\n * Runs after the default resolver-class check, so it can refuse a resolver but\n * never admit one the default refused. Must return synchronously.\n */\nexport type GateAuthorize = (gate: Readonly<GateRecord>, resolver: Readonly<GateResolver>) => GateAuthorization;\n\nexport interface GateInput {\n  /** Defaults to a random UUID. Supply one to make the gate addressable by a name you already own. */\n  id?: string;\n  prompt: string;\n  schema?: JsonSchema;\n  expiresAt?: Date | string;\n  rule?: GateRule;\n}\n\n/**\n * Synchronous on purpose: both implementations are local (a Map, and\n * better-sqlite3), and `wait` is the only thing that needs to be async.\n */\nexport interface GateStore {\n  create(input: GateInput): GateRecord;\n  get(id: string): GateRecord | undefined;\n  resolve(id: string, payload: unknown, resolvedBy: GateResolver): GateRecord;\n  cancel(id: string, reason: string): GateRecord;\n  listPending(): GateRecord[];\n}\n\nexport class GateError extends Error {\n  constructor(\n    message: string,\n    readonly gateId: string,\n  ) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\nexport class GateNotFound extends GateError {\n  constructor(gateId: string) {\n    super(`no gate with id ${gateId}`, gateId);\n  }\n}\n\nexport class GateAlreadyExists extends GateError {\n  constructor(gateId: string) {\n    super(`a gate with id ${gateId} already exists`, gateId);\n  }\n}\n\nexport class GateAlreadySettled extends GateError {\n  constructor(\n    gateId: string,\n    readonly status: GateStatus,\n  ) {\n    super(`gate ${gateId} is already ${status}`, gateId);\n  }\n}\n\nexport class GateCancelled extends GateError {\n  constructor(\n    gateId: string,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} was cancelled: ${reason}`, gateId);\n  }\n}\n\nexport class GateExpired extends GateError {\n  constructor(gateId: string) {\n    super(`gate ${gateId} expired before anyone resolved it`, gateId);\n  }\n}\n\nexport class GatePayloadInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly issues: string[],\n  ) {\n    super(`payload for gate ${gateId} does not match its schema: ${issues.join(\"; \")}`, gateId);\n  }\n}\n\nexport class GateAborted extends GateError {\n  constructor(gateId: string, reason: string) {\n    super(`stopped waiting on gate ${gateId}: ${reason}`, gateId);\n  }\n}\n\nexport class GateResolverRefused extends GateError {\n  constructor(\n    gateId: string,\n    readonly actorClass: string | undefined,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} refused a resolution by ${actorClass ?? \"an unnamed resolver\"}: ${reason}`, gateId);\n  }\n}\n\n/**\n * The store cannot record a resolver or a rule because its table predates the migration that adds the column.\n * `gateId` is empty when the store refuses at construction, before any gate is named.\n */\nexport class GateStoreSchemaOutdated extends GateError {\n  constructor(\n    gateId: string,\n    readonly table: string,\n    readonly migration: string,\n  ) {\n    const message =\n      gateId === \"\"\n        ? `cannot open a gate store on table ${table}: it needs ${migration}`\n        : `gate ${gateId} cannot be recorded: table ${table} needs ${migration}`;\n    super(message, gateId);\n  }\n}\n\nexport class GateRuleInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} has an invalid rule: ${reason}`, gateId);\n  }\n}\n\nexport class GateAuthorizeInvalid extends GateError {\n  constructor(gateId: string) {\n    super(`authorize for gate ${gateId} must return a decision { allowed: boolean } synchronously`, gateId);\n  }\n}\n","import type { JsonSchema } from \"./types.js\";\n\n/**\n * A deliberately small structural check over the JSON Schema subset `z.toJSONSchema`\n * emits. It exists so the process that resolves a gate can reject a bad payload\n * without holding the original zod schema, which by definition lives in another\n * process. The waiter still re-validates with the real zod schema, so this is the\n * boundary check, not the type guarantee.\n */\nexport function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path = \"$\"): string[] {\n  const issues: string[] = [];\n  collect(schema, value, path, issues);\n  return issues;\n}\n\nfunction collect(schema: JsonSchema, value: unknown, path: string, issues: string[]): void {\n  if (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf)) {\n    checkUnion((schema.anyOf ?? schema.oneOf) as JsonSchema[], value, path, issues);\n    return;\n  }\n  if (\"const\" in schema && !Object.is(schema.const, value)) {\n    issues.push(`${path}: expected ${JSON.stringify(schema.const)}`);\n    return;\n  }\n  if (Array.isArray(schema.enum) && !schema.enum.some((option) => Object.is(option, value))) {\n    issues.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);\n    return;\n  }\n  if (typeof schema.type !== \"string\") return;\n  if (!matchesType(schema.type, value)) {\n    issues.push(`${path}: expected ${schema.type}, received ${describe(value)}`);\n    return;\n  }\n  if (schema.type === \"object\") checkObject(schema, value as Record<string, unknown>, path, issues);\n  if (schema.type === \"array\") checkArray(schema, value as unknown[], path, issues);\n}\n\nfunction checkUnion(branches: JsonSchema[], value: unknown, path: string, issues: string[]): void {\n  const matched = branches.some((branch) => checkAgainstJsonSchema(branch, value, path).length === 0);\n  if (!matched) issues.push(`${path}: matched none of the ${branches.length} allowed shapes`);\n}\n\nfunction checkObject(schema: JsonSchema, value: Record<string, unknown>, path: string, issues: string[]): void {\n  const properties = (schema.properties ?? {}) as Record<string, JsonSchema>;\n  for (const key of (schema.required ?? []) as string[]) {\n    if (!(key in value)) issues.push(`${path}.${key}: required`);\n  }\n  if (schema.additionalProperties === false) {\n    for (const key of Object.keys(value)) {\n      if (!(key in properties)) issues.push(`${path}.${key}: unexpected property`);\n    }\n  }\n  for (const [key, sub] of Object.entries(properties)) {\n    if (key in value) collect(sub, value[key], `${path}.${key}`, issues);\n  }\n}\n\nfunction checkArray(schema: JsonSchema, value: unknown[], path: string, issues: string[]): void {\n  const items = schema.items as JsonSchema | undefined;\n  if (!items) return;\n  value.forEach((entry, index) => collect(items, entry, `${path}[${index}]`, issues));\n}\n\nfunction matchesType(type: string, value: unknown): boolean {\n  switch (type) {\n    case \"object\":\n      return typeof value === \"object\" && value !== null && !Array.isArray(value);\n    case \"array\":\n      return Array.isArray(value);\n    case \"integer\":\n      return Number.isInteger(value);\n    case \"number\":\n      return typeof value === \"number\" && Number.isFinite(value);\n    case \"null\":\n      return value === null;\n    default:\n      return typeof value === type;\n  }\n}\n\nfunction describe(value: unknown): string {\n  if (value === null) return \"null\";\n  return Array.isArray(value) ? \"array\" : typeof value;\n}\n","import { ACTOR_CLASSES, RESOLVER_CLASSES, type ActorClass, type ResolverClass } from \"@titan-design/authority\";\nimport {\n  GateAuthorizeInvalid,\n  GateResolverRefused,\n  GateRuleInvalid,\n  type GateAuthorization,\n  type GateRecord,\n  type GateResolver,\n  type GateRule,\n} from \"./types.js\";\n\n/**\n * The default refusal: only an owner class may resolve a gate, so an agent or\n * automation never answers its own gate. Every store applies it before `authorize`.\n */\nexport function defaultResolverRefusal(resolver: GateResolver): string | undefined {\n  if ((RESOLVER_CLASSES as readonly string[]).includes(resolver.class)) return undefined;\n  return `actor class ${resolver.class} may not resolve a gate`;\n}\n\n/** A rule-bound gate admits only its rule's resolver classes. Runs after the default refusal, so it only narrows. */\nexport function ruleResolverRefusal(record: GateRecord, resolver: GateResolver): string | undefined {\n  if (!record.rule) return undefined;\n  if ((record.rule.resolvers as readonly string[]).includes(resolver.class)) return undefined;\n  return `rule ${record.rule.ruleId} does not let ${resolver.class} resolve this gate`;\n}\n\n/** Reads each declared rule field once into a frozen copy, so a caller cannot widen the rule after `create`. */\nexport function snapshotRule(gateId: string, raw: unknown): Readonly<GateRule> {\n  if (typeof raw !== \"object\" || raw === null) throw new GateRuleInvalid(gateId, \"the rule is not an object\");\n  const { table, version, ruleId, resolvers } = raw as Record<string, unknown>;\n  if (typeof table !== \"string\" || typeof version !== \"string\" || typeof ruleId !== \"string\") {\n    throw new GateRuleInvalid(gateId, \"the rule's table, version and ruleId must be strings\");\n  }\n  const classes = Array.isArray(resolvers) ? [...(resolvers as unknown[])] : [];\n  if (classes.length === 0 || !classes.every(isResolverClass)) {\n    throw new GateRuleInvalid(gateId, \"the rule's resolvers must be a non-empty list of resolver classes\");\n  }\n  return Object.freeze({ table, version, ruleId, resolvers: Object.freeze(classes) as ResolverClass[] });\n}\n\n/**\n * Reads each declared field exactly once into a frozen plain object, so the\n * checks and the stored row see the same resolver and nothing undeclared is kept.\n */\nexport function snapshotResolver(gateId: string, raw: unknown): Readonly<GateResolver> {\n  if (typeof raw !== \"object\" || raw === null) throw new GateResolverRefused(gateId, undefined, \"the resolver is not an object\");\n  const { class: actorClass, id, channel, confirmEvent } = raw as Record<string, unknown>;\n  if (!isActorClass(actorClass)) {\n    throw new GateResolverRefused(gateId, undefined, \"the resolver's class is not a known actor class\");\n  }\n  if (typeof id !== \"string\" || typeof channel !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's id and channel must be strings\");\n  }\n  if (confirmEvent === undefined) return Object.freeze({ class: actorClass, id, channel });\n  if (typeof confirmEvent !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's confirmEvent must be a string\");\n  }\n  return Object.freeze({ class: actorClass, id, channel, confirmEvent });\n}\n\n/** Accepts only a synchronous `{ allowed: boolean }`; a promise is refused because the row cannot wait on it. */\nexport function readDecision(gateId: string, decision: unknown): GateAuthorization {\n  if (typeof decision !== \"object\" || decision === null) throw new GateAuthorizeInvalid(gateId);\n  const { then, allowed, reason } = decision as Record<string, unknown>;\n  if (typeof then === \"function\") {\n    (then as (onFulfilled: undefined, onRejected: () => void) => unknown).call(decision, undefined, () => {});\n    throw new GateAuthorizeInvalid(gateId);\n  }\n  if (typeof allowed !== \"boolean\") throw new GateAuthorizeInvalid(gateId);\n  if (allowed) return { allowed: true };\n  return { allowed: false, reason: typeof reason === \"string\" ? reason : \"authorize refused the resolver\" };\n}\n\nfunction isResolverClass(value: unknown): value is ResolverClass {\n  return typeof value === \"string\" && (RESOLVER_CLASSES as readonly string[]).includes(value);\n}\n\nfunction isActorClass(value: unknown): value is ActorClass {\n  return typeof value === \"string\" && (ACTOR_CLASSES as readonly string[]).includes(value);\n}\n","import { checkAgainstJsonSchema } from \"./json-schema.js\";\nimport { defaultResolverRefusal, readDecision, ruleResolverRefusal, snapshotResolver, snapshotRule } from \"./resolver-policy.js\";\nimport {\n  GateAlreadyExists,\n  GateAlreadySettled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  GateResolverRefused,\n  type GateAuthorize,\n  type GateInput,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\n/**\n * Every settle rule lives here so the memory and SQLite stores cannot drift\n * apart. Subclasses only move rows.\n */\nexport abstract class BaseGateStore implements GateStore {\n  protected constructor(\n    protected readonly clock: () => number,\n    private readonly authorize?: GateAuthorize,\n  ) {}\n\n  protected abstract insert(record: GateRecord): void;\n  protected abstract read(id: string): GateRecord | undefined;\n  protected abstract update(record: GateRecord): void;\n  protected abstract readByStatus(status: GateRecord[\"status\"]): GateRecord[];\n\n  create(input: GateInput): GateRecord {\n    const id = input.id ?? globalThis.crypto.randomUUID();\n    const rule = input.rule === undefined ? undefined : snapshotRule(id, input.rule);\n    if (this.read(id)) throw new GateAlreadyExists(id);\n    const record: GateRecord = {\n      id,\n      prompt: input.prompt,\n      schema: input.schema,\n      status: \"pending\",\n      payload: undefined,\n      reason: undefined,\n      createdAt: this.nowIso(),\n      resolvedAt: undefined,\n      expiresAt: toIso(input.expiresAt),\n      resolvedBy: undefined,\n      rule,\n    };\n    this.insert(record);\n    return record;\n  }\n\n  get(id: string): GateRecord | undefined {\n    const record = this.read(id);\n    return record ? this.lapseIfExpired(record) : undefined;\n  }\n\n  resolve(id: string, payload: unknown, resolvedBy: GateResolver): GateRecord {\n    if (!resolvedBy) throw new GateResolverRefused(id, undefined, \"a resolver is required\");\n    const resolver = snapshotResolver(id, resolvedBy);\n    const record = this.requirePending(id);\n    this.requireAuthorized(record, resolver);\n    if (record.schema) {\n      const issues = checkAgainstJsonSchema(record.schema, payload);\n      if (issues.length > 0) throw new GatePayloadInvalid(id, issues);\n    }\n    const resolved: GateRecord = { ...record, status: \"resolved\", payload, resolvedAt: this.nowIso(), resolvedBy: resolver };\n    this.update(resolved);\n    return resolved;\n  }\n\n  cancel(id: string, reason: string): GateRecord {\n    const record = this.requirePending(id);\n    const cancelled: GateRecord = { ...record, status: \"cancelled\", reason, resolvedAt: this.nowIso() };\n    this.update(cancelled);\n    return cancelled;\n  }\n\n  listPending(): GateRecord[] {\n    return this.readByStatus(\"pending\")\n      .map((record) => this.lapseIfExpired(record))\n      .filter((record) => record.status === \"pending\")\n      .sort((a, b) => a.createdAt.localeCompare(b.createdAt));\n  }\n\n  private requirePending(id: string): GateRecord {\n    const record = this.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"expired\") throw new GateExpired(id);\n    if (record.status !== \"pending\") throw new GateAlreadySettled(id, record.status);\n    return record;\n  }\n\n  /** The default check runs first, the gate's rule second and `authorize` last, so each can only narrow who may resolve. */\n  private requireAuthorized(record: GateRecord, resolver: Readonly<GateResolver>): void {\n    const refusal = defaultResolverRefusal(resolver);\n    if (refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);\n    const ruleRefusal = ruleResolverRefusal(record, resolver);\n    if (ruleRefusal) throw new GateResolverRefused(record.id, resolver.class, ruleRefusal);\n    if (!this.authorize) return;\n    const decision = readDecision(record.id, this.authorize(Object.freeze({ ...record }), resolver));\n    if (!decision.allowed) throw new GateResolverRefused(record.id, resolver.class, decision.reason);\n  }\n\n  /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */\n  private lapseIfExpired(record: GateRecord): GateRecord {\n    if (record.status !== \"pending\" || !record.expiresAt) return record;\n    if (Date.parse(record.expiresAt) > this.clock()) return record;\n    const expired: GateRecord = { ...record, status: \"expired\", resolvedAt: this.nowIso() };\n    this.update(expired);\n    return expired;\n  }\n\n  protected nowIso(): string {\n    return new Date(this.clock()).toISOString();\n  }\n}\n\nfunction toIso(value: Date | string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  return typeof value === \"string\" ? value : value.toISOString();\n}\n"],"mappings":";AAwEO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO,WAAW;AAAA,EACzB;AAAA,EAJW;AAKb;AAEO,IAAM,eAAN,cAA2B,UAAU;AAAA,EAC1C,YAAY,QAAgB;AAC1B,UAAM,mBAAmB,MAAM,IAAI,MAAM;AAAA,EAC3C;AACF;AAEO,IAAM,oBAAN,cAAgC,UAAU;AAAA,EAC/C,YAAY,QAAgB;AAC1B,UAAM,kBAAkB,MAAM,mBAAmB,MAAM;AAAA,EACzD;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,eAAe,MAAM,IAAI,MAAM;AAF1C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,gBAAN,cAA4B,UAAU;AAAA,EAC3C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,mBAAmB,MAAM,IAAI,MAAM;AAF9C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB;AAC1B,UAAM,QAAQ,MAAM,sCAAsC,MAAM;AAAA,EAClE;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,oBAAoB,MAAM,+BAA+B,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM;AAFjF;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB,QAAgB;AAC1C,UAAM,2BAA2B,MAAM,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,IAAM,sBAAN,cAAkC,UAAU;AAAA,EACjD,YACE,QACS,YACA,QACT;AACA,UAAM,QAAQ,MAAM,4BAA4B,cAAc,qBAAqB,KAAK,MAAM,IAAI,MAAM;AAH/F;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAIb;AAMO,IAAM,0BAAN,cAAsC,UAAU;AAAA,EACrD,YACE,QACS,OACA,WACT;AACA,UAAM,UACJ,WAAW,KACP,qCAAqC,KAAK,cAAc,SAAS,KACjE,QAAQ,MAAM,8BAA8B,KAAK,UAAU,SAAS;AAC1E,UAAM,SAAS,MAAM;AAPZ;AACA;AAAA,EAOX;AAAA,EARW;AAAA,EACA;AAQb;AAEO,IAAM,kBAAN,cAA8B,UAAU;AAAA,EAC7C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,yBAAyB,MAAM,IAAI,MAAM;AAFpD;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,uBAAN,cAAmC,UAAU;AAAA,EAClD,YAAY,QAAgB;AAC1B,UAAM,sBAAsB,MAAM,8DAA8D,MAAM;AAAA,EACxG;AACF;;;ACrKO,SAAS,uBAAuB,QAAoB,OAAgB,OAAO,KAAe;AAC/F,QAAM,SAAmB,CAAC;AAC1B,UAAQ,QAAQ,OAAO,MAAM,MAAM;AACnC,SAAO;AACT;AAEA,SAAS,QAAQ,QAAoB,OAAgB,MAAc,QAAwB;AACzF,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC9D,eAAY,OAAO,SAAS,OAAO,OAAwB,OAAO,MAAM,MAAM;AAC9E;AAAA,EACF;AACA,MAAI,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG;AACxD,WAAO,KAAK,GAAG,IAAI,cAAc,KAAK,UAAU,OAAO,KAAK,CAAC,EAAE;AAC/D;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,OAAO,GAAG,QAAQ,KAAK,CAAC,GAAG;AACzF,WAAO,KAAK,GAAG,IAAI,qBAAqB,KAAK,UAAU,OAAO,IAAI,CAAC,EAAE;AACrE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,SAAS,SAAU;AACrC,MAAI,CAAC,YAAY,OAAO,MAAM,KAAK,GAAG;AACpC,WAAO,KAAK,GAAG,IAAI,cAAc,OAAO,IAAI,cAAc,SAAS,KAAK,CAAC,EAAE;AAC3E;AAAA,EACF;AACA,MAAI,OAAO,SAAS,SAAU,aAAY,QAAQ,OAAkC,MAAM,MAAM;AAChG,MAAI,OAAO,SAAS,QAAS,YAAW,QAAQ,OAAoB,MAAM,MAAM;AAClF;AAEA,SAAS,WAAW,UAAwB,OAAgB,MAAc,QAAwB;AAChG,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,uBAAuB,QAAQ,OAAO,IAAI,EAAE,WAAW,CAAC;AAClG,MAAI,CAAC,QAAS,QAAO,KAAK,GAAG,IAAI,yBAAyB,SAAS,MAAM,iBAAiB;AAC5F;AAEA,SAAS,YAAY,QAAoB,OAAgC,MAAc,QAAwB;AAC7G,QAAM,aAAc,OAAO,cAAc,CAAC;AAC1C,aAAW,OAAQ,OAAO,YAAY,CAAC,GAAgB;AACrD,QAAI,EAAE,OAAO,OAAQ,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,YAAY;AAAA,EAC7D;AACA,MAAI,OAAO,yBAAyB,OAAO;AACzC,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,EAAE,OAAO,YAAa,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,uBAAuB;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACnD,QAAI,OAAO,MAAO,SAAQ,KAAK,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM;AAAA,EACrE;AACF;AAEA,SAAS,WAAW,QAAoB,OAAkB,MAAc,QAAwB;AAC9F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO;AACZ,QAAM,QAAQ,CAAC,OAAO,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AACpF;AAEA,SAAS,YAAY,MAAc,OAAyB;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA,IAC5E,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B,KAAK;AACH,aAAO,OAAO,UAAU,KAAK;AAAA,IAC/B,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU;AAAA,IACnB;AACE,aAAO,OAAO,UAAU;AAAA,EAC5B;AACF;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACjD;;;ACnFA,SAAS,eAAe,wBAA6D;AAe9E,SAAS,uBAAuB,UAA4C;AACjF,MAAK,iBAAuC,SAAS,SAAS,KAAK,EAAG,QAAO;AAC7E,SAAO,eAAe,SAAS,KAAK;AACtC;AAGO,SAAS,oBAAoB,QAAoB,UAA4C;AAClG,MAAI,CAAC,OAAO,KAAM,QAAO;AACzB,MAAK,OAAO,KAAK,UAAgC,SAAS,SAAS,KAAK,EAAG,QAAO;AAClF,SAAO,QAAQ,OAAO,KAAK,MAAM,iBAAiB,SAAS,KAAK;AAClE;AAGO,SAAS,aAAa,QAAgB,KAAkC;AAC7E,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,gBAAgB,QAAQ,2BAA2B;AAC1G,QAAM,EAAE,OAAO,SAAS,QAAQ,UAAU,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAC1F,UAAM,IAAI,gBAAgB,QAAQ,sDAAsD;AAAA,EAC1F;AACA,QAAM,UAAU,MAAM,QAAQ,SAAS,IAAI,CAAC,GAAI,SAAuB,IAAI,CAAC;AAC5E,MAAI,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,eAAe,GAAG;AAC3D,UAAM,IAAI,gBAAgB,QAAQ,mEAAmE;AAAA,EACvG;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,SAAS,QAAQ,WAAW,OAAO,OAAO,OAAO,EAAqB,CAAC;AACvG;AAMO,SAAS,iBAAiB,QAAgB,KAAsC;AACrF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,oBAAoB,QAAQ,QAAW,+BAA+B;AAC7H,QAAM,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,IAAI;AACzD,MAAI,CAAC,aAAa,UAAU,GAAG;AAC7B,UAAM,IAAI,oBAAoB,QAAQ,QAAW,iDAAiD;AAAA,EACpG;AACA,MAAI,OAAO,OAAO,YAAY,OAAO,YAAY,UAAU;AACzD,UAAM,IAAI,oBAAoB,QAAQ,YAAY,+CAA+C;AAAA,EACnG;AACA,MAAI,iBAAiB,OAAW,QAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,QAAQ,CAAC;AACvF,MAAI,OAAO,iBAAiB,UAAU;AACpC,UAAM,IAAI,oBAAoB,QAAQ,YAAY,8CAA8C;AAAA,EAClG;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,CAAC;AACvE;AAGO,SAAS,aAAa,QAAgB,UAAsC;AACjF,MAAI,OAAO,aAAa,YAAY,aAAa,KAAM,OAAM,IAAI,qBAAqB,MAAM;AAC5F,QAAM,EAAE,MAAM,SAAS,OAAO,IAAI;AAClC,MAAI,OAAO,SAAS,YAAY;AAC9B,IAAC,KAAqE,KAAK,UAAU,QAAW,MAAM;AAAA,IAAC,CAAC;AACxG,UAAM,IAAI,qBAAqB,MAAM;AAAA,EACvC;AACA,MAAI,OAAO,YAAY,UAAW,OAAM,IAAI,qBAAqB,MAAM;AACvE,MAAI,QAAS,QAAO,EAAE,SAAS,KAAK;AACpC,SAAO,EAAE,SAAS,OAAO,QAAQ,OAAO,WAAW,WAAW,SAAS,iCAAiC;AAC1G;AAEA,SAAS,gBAAgB,OAAwC;AAC/D,SAAO,OAAO,UAAU,YAAa,iBAAuC,SAAS,KAAK;AAC5F;AAEA,SAAS,aAAa,OAAqC;AACzD,SAAO,OAAO,UAAU,YAAa,cAAoC,SAAS,KAAK;AACzF;;;AC5DO,IAAe,gBAAf,MAAkD;AAAA,EAC7C,YACW,OACF,WACjB;AAFmB;AACF;AAAA,EAChB;AAAA,EAFkB;AAAA,EACF;AAAA,EAQnB,OAAO,OAA8B;AACnC,UAAM,KAAK,MAAM,MAAM,WAAW,OAAO,WAAW;AACpD,UAAM,OAAO,MAAM,SAAS,SAAY,SAAY,aAAa,IAAI,MAAM,IAAI;AAC/E,QAAI,KAAK,KAAK,EAAE,EAAG,OAAM,IAAI,kBAAkB,EAAE;AACjD,UAAM,SAAqB;AAAA,MACzB;AAAA,MACA,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW,KAAK,OAAO;AAAA,MACvB,YAAY;AAAA,MACZ,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,YAAY;AAAA,MACZ;AAAA,IACF;AACA,SAAK,OAAO,MAAM;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAoC;AACtC,UAAM,SAAS,KAAK,KAAK,EAAE;AAC3B,WAAO,SAAS,KAAK,eAAe,MAAM,IAAI;AAAA,EAChD;AAAA,EAEA,QAAQ,IAAY,SAAkB,YAAsC;AAC1E,QAAI,CAAC,WAAY,OAAM,IAAI,oBAAoB,IAAI,QAAW,wBAAwB;AACtF,UAAM,WAAW,iBAAiB,IAAI,UAAU;AAChD,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,SAAK,kBAAkB,QAAQ,QAAQ;AACvC,QAAI,OAAO,QAAQ;AACjB,YAAM,SAAS,uBAAuB,OAAO,QAAQ,OAAO;AAC5D,UAAI,OAAO,SAAS,EAAG,OAAM,IAAI,mBAAmB,IAAI,MAAM;AAAA,IAChE;AACA,UAAM,WAAuB,EAAE,GAAG,QAAQ,QAAQ,YAAY,SAAS,YAAY,KAAK,OAAO,GAAG,YAAY,SAAS;AACvH,SAAK,OAAO,QAAQ;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAY,QAA4B;AAC7C,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,UAAM,YAAwB,EAAE,GAAG,QAAQ,QAAQ,aAAa,QAAQ,YAAY,KAAK,OAAO,EAAE;AAClG,SAAK,OAAO,SAAS;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,cAA4B;AAC1B,WAAO,KAAK,aAAa,SAAS,EAC/B,IAAI,CAAC,WAAW,KAAK,eAAe,MAAM,CAAC,EAC3C,OAAO,CAAC,WAAW,OAAO,WAAW,SAAS,EAC9C,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC;AAAA,EAC1D;AAAA,EAEQ,eAAe,IAAwB;AAC7C,UAAM,SAAS,KAAK,IAAI,EAAE;AAC1B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,mBAAmB,IAAI,OAAO,MAAM;AAC/E,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,kBAAkB,QAAoB,UAAwC;AACpF,UAAM,UAAU,uBAAuB,QAAQ;AAC/C,QAAI,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,OAAO;AAC7E,UAAM,cAAc,oBAAoB,QAAQ,QAAQ;AACxD,QAAI,YAAa,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,WAAW;AACrF,QAAI,CAAC,KAAK,UAAW;AACrB,UAAM,WAAW,aAAa,OAAO,IAAI,KAAK,UAAU,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAC;AAC/F,QAAI,CAAC,SAAS,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,SAAS,MAAM;AAAA,EACjG;AAAA;AAAA,EAGQ,eAAe,QAAgC;AACrD,QAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAW,QAAO;AAC7D,QAAI,KAAK,MAAM,OAAO,SAAS,IAAI,KAAK,MAAM,EAAG,QAAO;AACxD,UAAM,UAAsB,EAAE,GAAG,QAAQ,QAAQ,WAAW,YAAY,KAAK,OAAO,EAAE;AACtF,SAAK,OAAO,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEU,SAAiB;AACzB,WAAO,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,YAAY;AAAA,EAC5C;AACF;AAEA,SAAS,MAAM,OAAsD;AACnE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM,YAAY;AAC/D;","names":[]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ZodType } from 'zod';
-import { G as GateRecord, a as GateStore, b as GateResolver, B as BaseGateStore, c as GateAuthorize, J as JsonSchema } from './base-store-BvwOJL6M.js';
-export { d as GateAborted, e as GateAlreadyExists, f as GateAlreadySettled, g as GateAuthorization, h as GateAuthorizeInvalid, i as GateCancelled, j as GateError, k as GateExpired, l as GateInput, m as GateNotFound, n as GatePayloadInvalid, o as GateResolverRefused, p as GateStatus, q as GateStoreSchemaOutdated } from './base-store-BvwOJL6M.js';
+import { G as GateRecord, a as GateStore, b as GateResolver, B as BaseGateStore, c as GateAuthorize, J as JsonSchema } from './base-store-BrVibYRJ.js';
+export { d as GateAborted, e as GateAlreadyExists, f as GateAlreadySettled, g as GateAuthorization, h as GateAuthorizeInvalid, i as GateCancelled, j as GateError, k as GateExpired, l as GateInput, m as GateNotFound, n as GatePayloadInvalid, o as GateResolverRefused, p as GateRule, q as GateRuleInvalid, r as GateStatus, s as GateStoreSchemaOutdated } from './base-store-BrVibYRJ.js';
 import '@titan-design/authority';
 
 declare const DEFAULT_POLL_MS = 250;
@@ -34,7 +34,7 @@ declare function openGate<T = unknown>(store: GateStore, options: OpenGateOption
  */
 declare function waitForGate<T = unknown>(store: GateStore, id: string, options?: WaitOptions<T>): Promise<T>;
 /** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */
-declare function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;
+declare function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy: GateResolver): GateRecord;
 declare function cancelGate(store: GateStore, id: string, reason: string): GateRecord;
 
 interface MemoryGateStoreOptions {
@@ -62,6 +62,8 @@ declare class MemoryGateStore extends BaseGateStore {
  * automation never answers its own gate. Every store applies it before `authorize`.
  */
 declare function defaultResolverRefusal(resolver: GateResolver): string | undefined;
+/** A rule-bound gate admits only its rule's resolver classes. Runs after the default refusal, so it only narrows. */
+declare function ruleResolverRefusal(record: GateRecord, resolver: GateResolver): string | undefined;
 /**
  * Reads each declared field exactly once into a frozen plain object, so the
  * checks and the stored row see the same resolver and nothing undeclared is kept.
@@ -77,4 +79,4 @@ declare function snapshotResolver(gateId: string, raw: unknown): Readonly<GateRe
  */
 declare function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path?: string): string[];
 
-export { BaseGateStore, DEFAULT_POLL_MS, GateAuthorize, type GateHandle, GateRecord, GateResolver, GateStore, JsonSchema, MemoryGateStore, type MemoryGateStoreOptions, type OpenGateOptions, type WaitOptions, cancelGate, checkAgainstJsonSchema, defaultResolverRefusal, openGate, resolveGate, snapshotResolver, waitForGate };
+export { BaseGateStore, DEFAULT_POLL_MS, GateAuthorize, type GateHandle, GateRecord, GateResolver, GateStore, JsonSchema, MemoryGateStore, type MemoryGateStoreOptions, type OpenGateOptions, type WaitOptions, cancelGate, checkAgainstJsonSchema, defaultResolverRefusal, openGate, resolveGate, ruleResolverRefusal, snapshotResolver, waitForGate };

package/dist/index.js

@@ -10,11 +10,13 @@ import {
   GateNotFound,
   GatePayloadInvalid,
   GateResolverRefused,
+  GateRuleInvalid,
   GateStoreSchemaOutdated,
   checkAgainstJsonSchema,
   defaultResolverRefusal,
+  ruleResolverRefusal,
   snapshotResolver
-} from "./chunk-4GAZKT6Z.js";
+} from "./chunk-PMEJTMSE.js";
 
 // src/gate.ts
 import { toJSONSchema } from "zod";
@@ -98,7 +100,11 @@ var MemoryGateStore = class extends BaseGateStore {
   }
 };
 function copy(record) {
-  return { ...record, resolvedBy: record.resolvedBy && { ...record.resolvedBy } };
+  return {
+    ...record,
+    resolvedBy: record.resolvedBy && { ...record.resolvedBy },
+    rule: record.rule && { ...record.rule, resolvers: [...record.rule.resolvers] }
+  };
 }
 export {
   BaseGateStore,
@@ -113,6 +119,7 @@ export {
   GateNotFound,
   GatePayloadInvalid,
   GateResolverRefused,
+  GateRuleInvalid,
   GateStoreSchemaOutdated,
   MemoryGateStore,
   cancelGate,
@@ -120,6 +127,7 @@ export {
   defaultResolverRefusal,
   openGate,
   resolveGate,
+  ruleResolverRefusal,
   snapshotResolver,
   waitForGate
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gate.ts","../src/memory-store.ts"],"sourcesContent":["import { toJSONSchema, type ZodType } from \"zod\";\nimport {\n  GateAborted,\n  GateCancelled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\nexport const DEFAULT_POLL_MS = 250;\n\nexport interface OpenGateOptions<T> {\n  id?: string;\n  prompt: string;\n  /** Stored as JSON Schema so the resolving process can validate without it, and reused here to type the answer. */\n  schema?: ZodType<T>;\n  expiresAt?: Date | string;\n}\n\nexport interface WaitOptions<T> {\n  pollMs?: number;\n  signal?: AbortSignal;\n  /** Needed only when re-attaching to a gate this process did not open. */\n  schema?: ZodType<T>;\n}\n\nexport interface GateHandle<T> {\n  id: string;\n  record: GateRecord;\n  wait(options?: Omit<WaitOptions<T>, \"schema\">): Promise<T>;\n}\n\n/**\n * Open a gate and hand back something to await. The row exists before this\n * returns, so a crash here leaves a resolvable gate rather than a lost one.\n */\nexport function openGate<T = unknown>(store: GateStore, options: OpenGateOptions<T>): GateHandle<T> {\n  const input: Parameters<GateStore[\"create\"]>[0] = { prompt: options.prompt };\n  if (options.id !== undefined) input.id = options.id;\n  if (options.expiresAt !== undefined) input.expiresAt = options.expiresAt;\n  if (options.schema) input.schema = toJSONSchema(options.schema) as Record<string, unknown>;\n\n  const record = store.create(input);\n  return {\n    id: record.id,\n    record,\n    wait: (waitOptions = {}) => {\n      const merged: WaitOptions<T> = { ...waitOptions };\n      if (options.schema) merged.schema = options.schema;\n      return waitForGate<T>(store, record.id, merged);\n    },\n  };\n}\n\n/**\n * Await a gate by id from any process, including one that restarted after the\n * gate was opened. Polls rather than subscribes because the resolver may be a\n * different process writing the same SQLite file.\n */\nexport async function waitForGate<T = unknown>(\n  store: GateStore,\n  id: string,\n  options: WaitOptions<T> = {},\n): Promise<T> {\n  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;\n  for (;;) {\n    throwIfAborted(id, options.signal);\n    const record = store.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"resolved\") return validate(record, options.schema);\n    if (record.status === \"cancelled\") throw new GateCancelled(id, record.reason ?? \"no reason given\");\n    if (record.status === \"expired\") throw new GateExpired(id);\n    await sleep(pollMs, options.signal);\n  }\n}\n\n/** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */\nexport function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord {\n  return store.resolve(id, payload, resolvedBy);\n}\n\nexport function cancelGate(store: GateStore, id: string, reason: string): GateRecord {\n  return store.cancel(id, reason);\n}\n\nfunction validate<T>(record: GateRecord, schema: ZodType<T> | undefined): T {\n  if (!schema) return record.payload as T;\n  const parsed = schema.safeParse(record.payload);\n  if (parsed.success) return parsed.data;\n  throw new GatePayloadInvalid(\n    record.id,\n    parsed.error.issues.map((issue) => `${issue.path.join(\".\") || \"$\"}: ${issue.message}`),\n  );\n}\n\nfunction throwIfAborted(id: string, signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new GateAborted(id, String(signal.reason ?? \"aborted\"));\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve) => {\n    const timer = setTimeout(finish, ms);\n    signal?.addEventListener(\"abort\", finish, { once: true });\n    function finish(): void {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", finish);\n      resolve();\n    }\n  });\n}\n","import { BaseGateStore } from \"./base-store.js\";\nimport type { GateAuthorize, GateRecord } from \"./types.js\";\n\nexport interface MemoryGateStoreOptions {\n  /** Epoch-millis clock, injectable so expiry is testable without waiting. */\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n}\n\n/**\n * In-process gates. Right for tests and for a single-process product that only\n * needs the pause, not the durability; anything that must survive a restart\n * wants `SqliteGateStore`.\n */\nexport class MemoryGateStore extends BaseGateStore {\n  private readonly rows = new Map<string, GateRecord>();\n\n  constructor(options: MemoryGateStoreOptions = {}) {\n    super(options.now ?? Date.now, options.authorize);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.rows.get(id);\n    return row ? copy(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected readByStatus(status: GateRecord[\"status\"]): GateRecord[] {\n    return [...this.rows.values()].filter((row) => row.status === status).map(copy);\n  }\n}\n\n/** `resolvedBy` is nested, so a shallow spread would let a caller rewrite the stored resolver. */\nfunction copy(record: GateRecord): GateRecord {\n  return { ...record, resolvedBy: record.resolvedBy && { ...record.resolvedBy } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAkC;AAYpC,IAAM,kBAAkB;AA2BxB,SAAS,SAAsB,OAAkB,SAA4C;AAClG,QAAM,QAA4C,EAAE,QAAQ,QAAQ,OAAO;AAC3E,MAAI,QAAQ,OAAO,OAAW,OAAM,KAAK,QAAQ;AACjD,MAAI,QAAQ,cAAc,OAAW,OAAM,YAAY,QAAQ;AAC/D,MAAI,QAAQ,OAAQ,OAAM,SAAS,aAAa,QAAQ,MAAM;AAE9D,QAAM,SAAS,MAAM,OAAO,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX;AAAA,IACA,MAAM,CAAC,cAAc,CAAC,MAAM;AAC1B,YAAM,SAAyB,EAAE,GAAG,YAAY;AAChD,UAAI,QAAQ,OAAQ,QAAO,SAAS,QAAQ;AAC5C,aAAO,YAAe,OAAO,OAAO,IAAI,MAAM;AAAA,IAChD;AAAA,EACF;AACF;AAOA,eAAsB,YACpB,OACA,IACA,UAA0B,CAAC,GACf;AACZ,QAAM,SAAS,QAAQ,UAAU;AACjC,aAAS;AACP,mBAAe,IAAI,QAAQ,MAAM;AACjC,UAAM,SAAS,MAAM,IAAI,EAAE;AAC3B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,WAAY,QAAO,SAAS,QAAQ,QAAQ,MAAM;AACxE,QAAI,OAAO,WAAW,YAAa,OAAM,IAAI,cAAc,IAAI,OAAO,UAAU,iBAAiB;AACjG,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,UAAM,MAAM,QAAQ,QAAQ,MAAM;AAAA,EACpC;AACF;AAGO,SAAS,YAAY,OAAkB,IAAY,SAAkB,YAAuC;AACjH,SAAO,MAAM,QAAQ,IAAI,SAAS,UAAU;AAC9C;AAEO,SAAS,WAAW,OAAkB,IAAY,QAA4B;AACnF,SAAO,MAAM,OAAO,IAAI,MAAM;AAChC;AAEA,SAAS,SAAY,QAAoB,QAAmC;AAC1E,MAAI,CAAC,OAAQ,QAAO,OAAO;AAC3B,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO;AAC9C,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IACP,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,MAAM,OAAO,EAAE;AAAA,EACvF;AACF;AAEA,SAAS,eAAe,IAAY,QAAuC;AACzE,MAAI,QAAQ,QAAS,OAAM,IAAI,YAAY,IAAI,OAAO,OAAO,UAAU,SAAS,CAAC;AACnF;AAEA,SAAS,MAAM,IAAY,QAAgD;AACzE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,WAAW,QAAQ,EAAE;AACnC,YAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,aAAS,SAAe;AACtB,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,MAAM;AAC3C,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;ACjGO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAChC,OAAO,oBAAI,IAAwB;AAAA,EAEpD,YAAY,UAAkC,CAAC,GAAG;AAChD,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS;AAAA,EAClD;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,KAAK,IAAI,EAAE;AAC5B,WAAO,MAAM,KAAK,GAAG,IAAI;AAAA,EAC3B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,aAAa,QAA4C;AACjE,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,EAAE,IAAI,IAAI;AAAA,EAChF;AACF;AAGA,SAAS,KAAK,QAAgC;AAC5C,SAAO,EAAE,GAAG,QAAQ,YAAY,OAAO,cAAc,EAAE,GAAG,OAAO,WAAW,EAAE;AAChF;","names":[]}
+{"version":3,"sources":["../src/gate.ts","../src/memory-store.ts"],"sourcesContent":["import { toJSONSchema, type ZodType } from \"zod\";\nimport {\n  GateAborted,\n  GateCancelled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\nexport const DEFAULT_POLL_MS = 250;\n\nexport interface OpenGateOptions<T> {\n  id?: string;\n  prompt: string;\n  /** Stored as JSON Schema so the resolving process can validate without it, and reused here to type the answer. */\n  schema?: ZodType<T>;\n  expiresAt?: Date | string;\n}\n\nexport interface WaitOptions<T> {\n  pollMs?: number;\n  signal?: AbortSignal;\n  /** Needed only when re-attaching to a gate this process did not open. */\n  schema?: ZodType<T>;\n}\n\nexport interface GateHandle<T> {\n  id: string;\n  record: GateRecord;\n  wait(options?: Omit<WaitOptions<T>, \"schema\">): Promise<T>;\n}\n\n/**\n * Open a gate and hand back something to await. The row exists before this\n * returns, so a crash here leaves a resolvable gate rather than a lost one.\n */\nexport function openGate<T = unknown>(store: GateStore, options: OpenGateOptions<T>): GateHandle<T> {\n  const input: Parameters<GateStore[\"create\"]>[0] = { prompt: options.prompt };\n  if (options.id !== undefined) input.id = options.id;\n  if (options.expiresAt !== undefined) input.expiresAt = options.expiresAt;\n  if (options.schema) input.schema = toJSONSchema(options.schema) as Record<string, unknown>;\n\n  const record = store.create(input);\n  return {\n    id: record.id,\n    record,\n    wait: (waitOptions = {}) => {\n      const merged: WaitOptions<T> = { ...waitOptions };\n      if (options.schema) merged.schema = options.schema;\n      return waitForGate<T>(store, record.id, merged);\n    },\n  };\n}\n\n/**\n * Await a gate by id from any process, including one that restarted after the\n * gate was opened. Polls rather than subscribes because the resolver may be a\n * different process writing the same SQLite file.\n */\nexport async function waitForGate<T = unknown>(\n  store: GateStore,\n  id: string,\n  options: WaitOptions<T> = {},\n): Promise<T> {\n  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;\n  for (;;) {\n    throwIfAborted(id, options.signal);\n    const record = store.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"resolved\") return validate(record, options.schema);\n    if (record.status === \"cancelled\") throw new GateCancelled(id, record.reason ?? \"no reason given\");\n    if (record.status === \"expired\") throw new GateExpired(id);\n    await sleep(pollMs, options.signal);\n  }\n}\n\n/** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */\nexport function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy: GateResolver): GateRecord {\n  return store.resolve(id, payload, resolvedBy);\n}\n\nexport function cancelGate(store: GateStore, id: string, reason: string): GateRecord {\n  return store.cancel(id, reason);\n}\n\nfunction validate<T>(record: GateRecord, schema: ZodType<T> | undefined): T {\n  if (!schema) return record.payload as T;\n  const parsed = schema.safeParse(record.payload);\n  if (parsed.success) return parsed.data;\n  throw new GatePayloadInvalid(\n    record.id,\n    parsed.error.issues.map((issue) => `${issue.path.join(\".\") || \"$\"}: ${issue.message}`),\n  );\n}\n\nfunction throwIfAborted(id: string, signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new GateAborted(id, String(signal.reason ?? \"aborted\"));\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve) => {\n    const timer = setTimeout(finish, ms);\n    signal?.addEventListener(\"abort\", finish, { once: true });\n    function finish(): void {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", finish);\n      resolve();\n    }\n  });\n}\n","import { BaseGateStore } from \"./base-store.js\";\nimport type { GateAuthorize, GateRecord } from \"./types.js\";\n\nexport interface MemoryGateStoreOptions {\n  /** Epoch-millis clock, injectable so expiry is testable without waiting. */\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n}\n\n/**\n * In-process gates. Right for tests and for a single-process product that only\n * needs the pause, not the durability; anything that must survive a restart\n * wants `SqliteGateStore`.\n */\nexport class MemoryGateStore extends BaseGateStore {\n  private readonly rows = new Map<string, GateRecord>();\n\n  constructor(options: MemoryGateStoreOptions = {}) {\n    super(options.now ?? Date.now, options.authorize);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.rows.get(id);\n    return row ? copy(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected readByStatus(status: GateRecord[\"status\"]): GateRecord[] {\n    return [...this.rows.values()].filter((row) => row.status === status).map(copy);\n  }\n}\n\n/** `resolvedBy` and `rule` are nested, so a shallow spread would let a caller rewrite what the store holds. */\nfunction copy(record: GateRecord): GateRecord {\n  return {\n    ...record,\n    resolvedBy: record.resolvedBy && { ...record.resolvedBy },\n    rule: record.rule && { ...record.rule, resolvers: [...record.rule.resolvers] },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAkC;AAYpC,IAAM,kBAAkB;AA2BxB,SAAS,SAAsB,OAAkB,SAA4C;AAClG,QAAM,QAA4C,EAAE,QAAQ,QAAQ,OAAO;AAC3E,MAAI,QAAQ,OAAO,OAAW,OAAM,KAAK,QAAQ;AACjD,MAAI,QAAQ,cAAc,OAAW,OAAM,YAAY,QAAQ;AAC/D,MAAI,QAAQ,OAAQ,OAAM,SAAS,aAAa,QAAQ,MAAM;AAE9D,QAAM,SAAS,MAAM,OAAO,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX;AAAA,IACA,MAAM,CAAC,cAAc,CAAC,MAAM;AAC1B,YAAM,SAAyB,EAAE,GAAG,YAAY;AAChD,UAAI,QAAQ,OAAQ,QAAO,SAAS,QAAQ;AAC5C,aAAO,YAAe,OAAO,OAAO,IAAI,MAAM;AAAA,IAChD;AAAA,EACF;AACF;AAOA,eAAsB,YACpB,OACA,IACA,UAA0B,CAAC,GACf;AACZ,QAAM,SAAS,QAAQ,UAAU;AACjC,aAAS;AACP,mBAAe,IAAI,QAAQ,MAAM;AACjC,UAAM,SAAS,MAAM,IAAI,EAAE;AAC3B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,WAAY,QAAO,SAAS,QAAQ,QAAQ,MAAM;AACxE,QAAI,OAAO,WAAW,YAAa,OAAM,IAAI,cAAc,IAAI,OAAO,UAAU,iBAAiB;AACjG,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,UAAM,MAAM,QAAQ,QAAQ,MAAM;AAAA,EACpC;AACF;AAGO,SAAS,YAAY,OAAkB,IAAY,SAAkB,YAAsC;AAChH,SAAO,MAAM,QAAQ,IAAI,SAAS,UAAU;AAC9C;AAEO,SAAS,WAAW,OAAkB,IAAY,QAA4B;AACnF,SAAO,MAAM,OAAO,IAAI,MAAM;AAChC;AAEA,SAAS,SAAY,QAAoB,QAAmC;AAC1E,MAAI,CAAC,OAAQ,QAAO,OAAO;AAC3B,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO;AAC9C,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IACP,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,MAAM,OAAO,EAAE;AAAA,EACvF;AACF;AAEA,SAAS,eAAe,IAAY,QAAuC;AACzE,MAAI,QAAQ,QAAS,OAAM,IAAI,YAAY,IAAI,OAAO,OAAO,UAAU,SAAS,CAAC;AACnF;AAEA,SAAS,MAAM,IAAY,QAAgD;AACzE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,WAAW,QAAQ,EAAE;AACnC,YAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,aAAS,SAAe;AACtB,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,MAAM;AAC3C,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;ACjGO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAChC,OAAO,oBAAI,IAAwB;AAAA,EAEpD,YAAY,UAAkC,CAAC,GAAG;AAChD,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS;AAAA,EAClD;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,KAAK,IAAI,EAAE;AAC5B,WAAO,MAAM,KAAK,GAAG,IAAI;AAAA,EAC3B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,aAAa,QAA4C;AACjE,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,EAAE,IAAI,IAAI;AAAA,EAChF;AACF;AAGA,SAAS,KAAK,QAAgC;AAC5C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,OAAO,cAAc,EAAE,GAAG,OAAO,WAAW;AAAA,IACxD,MAAM,OAAO,QAAQ,EAAE,GAAG,OAAO,MAAM,WAAW,CAAC,GAAG,OAAO,KAAK,SAAS,EAAE;AAAA,EAC/E;AACF;","names":[]}

package/dist/sqlite.d.ts

@@ -1,5 +1,5 @@
 import { Db, Migration } from '@titan-design/store-sqlite';
-import { B as BaseGateStore, c as GateAuthorize, G as GateRecord, p as GateStatus } from './base-store-BvwOJL6M.js';
+import { B as BaseGateStore, c as GateAuthorize, G as GateRecord, r as GateStatus } from './base-store-BrVibYRJ.js';
 import '@titan-design/authority';
 
 declare const DEFAULT_GATE_TABLE = "hitl_gate";
@@ -16,9 +16,11 @@ declare function resolverRequiredTriggerDdl(name?: string): string;
  * gates resolved before it keep an unknown resolver rather than a guessed one.
  */
 declare function gateResolverMigration(version: number, name?: string): Migration;
+/** Adds `rule` and its trigger. Idempotent and backfill-free: gates opened before it carry no rule. */
+declare function gateRuleMigration(version: number, name?: string): Migration;
 interface SqliteGateStoreOptions {
     table?: string;
-    /** Run `gateMigration` on construction. Off when the product owns its migration list. */
+    /** Run `gateMigration`, `gateResolverMigration` and `gateRuleMigration` on construction. Off when the product owns its migration list. */
     migrate?: boolean;
     now?: () => number;
     /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */
@@ -32,16 +34,15 @@ interface SqliteGateStoreOptions {
 declare class SqliteGateStore extends BaseGateStore {
     private readonly db;
     private readonly table;
-    private resolverColumnSeen;
+    private ruleColumnSeen;
     constructor(db: Db, options?: SqliteGateStoreOptions);
     protected insert(record: GateRecord): void;
+    /** Refuses rather than dropping the rule when the table has no column to hold it. */
+    private insertWithRule;
     protected read(id: string): GateRecord | undefined;
     protected update(record: GateRecord): void;
-    /** Refuses rather than dropping the resolver when the table has no column to hold it. */
-    private updateWithResolver;
-    /** Only a positive probe is cached, so a migration run after construction is still noticed. */
-    private resolverColumnPresent;
+    private ruleColumnPresent;
     protected readByStatus(status: GateStatus): GateRecord[];
 }
 
-export { DEFAULT_GATE_TABLE, SqliteGateStore, type SqliteGateStoreOptions, gateMigration, gateResolverMigration, gateTableDdl, resolverRequiredTriggerDdl };
+export { DEFAULT_GATE_TABLE, SqliteGateStore, type SqliteGateStoreOptions, gateMigration, gateResolverMigration, gateRuleMigration, gateTableDdl, resolverRequiredTriggerDdl };

package/dist/sqlite.js

@@ -1,7 +1,7 @@
 import {
   BaseGateStore,
   GateStoreSchemaOutdated
-} from "./chunk-4GAZKT6Z.js";
+} from "./chunk-PMEJTMSE.js";
 
 // src/sqlite-store.ts
 import { quoteIdent, runMigrations } from "@titan-design/store-sqlite";
@@ -48,72 +48,124 @@ function gateResolverMigration(version, name = DEFAULT_GATE_TABLE) {
     up: (db) => {
       if (!hasResolverColumn(db, name)) db.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN resolved_by TEXT`);
       db.exec(resolverRequiredTriggerDdl(name));
+      if (hasColumn(db, name, "rule")) db.exec(ruleTriggerDdl(db, name));
     }
   };
 }
 function hasResolverColumn(db, table) {
-  return db.prepare("SELECT 1 FROM pragma_table_info(?) WHERE name = 'resolved_by'").get(table) !== void 0;
+  return hasColumn(db, table, "resolved_by");
+}
+function hasColumn(db, table, column) {
+  return db.prepare("SELECT 1 FROM pragma_table_info(?) WHERE name = ?").get(table, column) !== void 0;
+}
+var CANONICAL_STATUSES = "'pending', 'resolved', 'cancelled', 'expired'";
+function ruleTriggerDdl(db, name) {
+  const hasResolver = hasResolverColumn(db, name);
+  const update = ruleTrigger(name, "UPDATE", "OLD.rule", hasResolver, "NEW.rule IS NOT OLD.rule");
+  const insert = ruleTrigger(name, "INSERT", "NEW.rule", hasResolver, "0");
+  return `${update}
+${insert}
+${replaceGuard(name)}`;
+}
+function replaceGuard(name) {
+  const trigger = quoteIdent(`${name}_rule_replace`);
+  return `
+    DROP TRIGGER IF EXISTS ${trigger};
+    CREATE TRIGGER ${trigger}
+      BEFORE INSERT ON ${quoteIdent(name)}
+      FOR EACH ROW WHEN EXISTS (
+        SELECT 1 FROM ${quoteIdent(name)} WHERE id = NEW.id AND status = 'pending' AND rule IS NOT NULL AND rule IS NOT NEW.rule
+      )
+    BEGIN
+      SELECT RAISE(ABORT, 'hitl: a pending rule-bound gate cannot be replaced');
+    END;
+  `;
+}
+function ruleTrigger(name, event, rule, hasResolver, ruleChanged) {
+  const trigger = quoteIdent(event === "UPDATE" ? `${name}_rule_resolver` : `${name}_rule_resolver_insert`);
+  const outsideRule = hasResolver ? `COALESCE(json_extract(NEW.resolved_by, '$.class'), '') NOT IN (SELECT value FROM json_each(${rule}, '$.resolvers'))` : "1";
+  return `
+    DROP TRIGGER IF EXISTS ${trigger};
+    CREATE TRIGGER ${trigger}
+      BEFORE ${event} ON ${quoteIdent(name)}
+      FOR EACH ROW WHEN ${rule} IS NOT NULL OR ${ruleChanged}
+    BEGIN
+      SELECT RAISE(ABORT, 'hitl: status outside the canonical set') WHERE ${rule} IS NOT NULL AND NEW.status NOT IN (${CANONICAL_STATUSES});
+      SELECT RAISE(ABORT, 'hitl: resolver outside the gate rule')
+        WHERE ${ruleChanged} OR (NEW.status = 'resolved' AND ${outsideRule});
+    END;
+  `;
+}
+function gateRuleMigration(version, name = DEFAULT_GATE_TABLE) {
+  return {
+    version,
+    name: `hitl:rule:${name}`,
+    up: (db) => {
+      if (!hasColumn(db, name, "rule")) db.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN rule TEXT`);
+      db.exec(ruleTriggerDdl(db, name));
+    }
+  };
 }
 var SqliteGateStore = class extends BaseGateStore {
   constructor(db, options = {}) {
     super(options.now ?? Date.now, options.authorize);
     this.db = db;
     this.table = options.table ?? DEFAULT_GATE_TABLE;
-    if (options.migrate ?? true) runMigrations(db, [gateMigration(1, this.table)]);
+    if (options.migrate ?? true) runMigrations(db, defaultMigrations(this.table));
+    const missing = missingMigration(db, this.table);
+    if (missing) throw new GateStoreSchemaOutdated("", this.table, missing);
   }
   db;
   table;
-  resolverColumnSeen = false;
+  ruleColumnSeen = false;
   insert(record) {
+    if (record.rule) {
+      this.insertWithRule(record, record.rule);
+      return;
+    }
     this.db.prepare(
       `INSERT INTO ${quoteIdent(this.table)}
            (id, prompt, schema, status, payload, reason, created_at, resolved_at, expires_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
     ).run(...columns(record));
   }
+  /** Refuses rather than dropping the rule when the table has no column to hold it. */
+  insertWithRule(record, rule) {
+    if (!this.ruleColumnPresent()) throw new GateStoreSchemaOutdated(record.id, this.table, "gateRuleMigration");
+    this.db.prepare(
+      `INSERT INTO ${quoteIdent(this.table)}
+           (id, prompt, schema, status, payload, reason, created_at, resolved_at, expires_at, rule)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(...columns(record), JSON.stringify(rule));
+  }
   read(id) {
     const row = this.db.prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE id = ?`).get(id);
     return row ? toRecord(row) : void 0;
   }
   update(record) {
-    if (record.resolvedBy) {
-      this.updateWithResolver(record, record.resolvedBy);
-      return;
-    }
-    this.db.prepare(
-      `UPDATE ${quoteIdent(this.table)}
-            SET status = ?, payload = ?, reason = ?, resolved_at = ?
-          WHERE id = ?`
-    ).run(record.status, toJson(record.payload), record.reason ?? null, record.resolvedAt ?? null, record.id);
-  }
-  /** Refuses rather than dropping the resolver when the table has no column to hold it. */
-  updateWithResolver(record, resolvedBy) {
-    if (!this.resolverColumnPresent()) {
-      throw new GateStoreSchemaOutdated(record.id, this.table, "gateResolverMigration");
-    }
+    const resolvedBy = record.resolvedBy ? JSON.stringify(record.resolvedBy) : null;
     this.db.prepare(
       `UPDATE ${quoteIdent(this.table)}
             SET status = ?, payload = ?, reason = ?, resolved_at = ?, resolved_by = ?
           WHERE id = ?`
-    ).run(
-      record.status,
-      toJson(record.payload),
-      record.reason ?? null,
-      record.resolvedAt ?? null,
-      JSON.stringify(resolvedBy),
-      record.id
-    );
+    ).run(record.status, toJson(record.payload), record.reason ?? null, record.resolvedAt ?? null, resolvedBy, record.id);
   }
-  /** Only a positive probe is cached, so a migration run after construction is still noticed. */
-  resolverColumnPresent() {
-    if (!this.resolverColumnSeen) this.resolverColumnSeen = hasResolverColumn(this.db, this.table);
-    return this.resolverColumnSeen;
+  ruleColumnPresent() {
+    if (!this.ruleColumnSeen) this.ruleColumnSeen = hasColumn(this.db, this.table, "rule");
+    return this.ruleColumnSeen;
   }
   readByStatus(status) {
     const rows = this.db.prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE status = ? ORDER BY created_at`).all(status);
     return rows.map(toRecord);
   }
 };
+function missingMigration(db, table) {
+  if (!hasColumn(db, table, "id")) return "gateMigration";
+  return hasResolverColumn(db, table) ? void 0 : "gateResolverMigration";
+}
+function defaultMigrations(table) {
+  return [gateMigration(1, table), gateResolverMigration(2, table), gateRuleMigration(3, table)];
+}
 function columns(record) {
   return [
     record.id,
@@ -141,7 +193,8 @@ function toRecord(row) {
     createdAt: row.created_at,
     resolvedAt: row.resolved_at ?? void 0,
     expiresAt: row.expires_at ?? void 0,
-    resolvedBy: row.resolved_by ? JSON.parse(row.resolved_by) : void 0
+    resolvedBy: row.resolved_by ? JSON.parse(row.resolved_by) : void 0,
+    rule: row.rule ? JSON.parse(row.rule) : void 0
   };
 }
 export {
@@ -149,6 +202,7 @@ export {
   SqliteGateStore,
   gateMigration,
   gateResolverMigration,
+  gateRuleMigration,
   gateTableDdl,
   resolverRequiredTriggerDdl
 };

package/dist/sqlite.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/sqlite-store.ts"],"sourcesContent":["import { quoteIdent, runMigrations, type Db, type Migration } from \"@titan-design/store-sqlite\";\nimport { BaseGateStore } from \"./base-store.js\";\nimport {\n  GateStoreSchemaOutdated,\n  type GateAuthorize,\n  type GateRecord,\n  type GateResolver,\n  type GateStatus,\n  type JsonSchema,\n} from \"./types.js\";\n\nexport const DEFAULT_GATE_TABLE = \"hitl_gate\";\n\nexport function gateTableDdl(name: string = DEFAULT_GATE_TABLE): string {\n  const t = quoteIdent(name);\n  return `\n    CREATE TABLE IF NOT EXISTS ${t} (\n      id          TEXT PRIMARY KEY,\n      prompt      TEXT NOT NULL,\n      schema      TEXT,\n      status      TEXT NOT NULL DEFAULT 'pending',\n      payload     TEXT,\n      reason      TEXT,\n      created_at  TEXT NOT NULL,\n      resolved_at TEXT,\n      expires_at  TEXT\n    );\n    CREATE INDEX IF NOT EXISTS ${quoteIdent(`${name}_pending`)}\n      ON ${t} (created_at) WHERE status = 'pending';\n  `;\n}\n\n/** Drop into the product's own `runMigrations` list so hitl shares one database with its domain tables. */\nexport function gateMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return { version, name: `hitl:${name}`, up: (db) => db.exec(gateTableDdl(name)) };\n}\n\n/**\n * The triggers that refuse a resolved row naming no resolver, on update and on\n * insert, so a writer that predates `resolved_by` fails loudly instead of resolving anonymously.\n */\nexport function resolverRequiredTriggerDdl(name: string = DEFAULT_GATE_TABLE): string {\n  return ([\"UPDATE\", \"INSERT\"] as const).map((event) => resolverTrigger(name, event)).join(\"\\n\");\n}\n\nfunction resolverTrigger(name: string, event: \"UPDATE\" | \"INSERT\"): string {\n  const suffix = event === \"UPDATE\" ? \"resolver_required\" : \"resolver_required_insert\";\n  return `\n    CREATE TRIGGER IF NOT EXISTS ${quoteIdent(`${name}_${suffix}`)}\n      BEFORE ${event} ON ${quoteIdent(name)}\n      FOR EACH ROW WHEN NEW.status = 'resolved' AND NEW.resolved_by IS NULL\n    BEGIN\n      SELECT RAISE(ABORT, 'hitl: resolvedBy required');\n    END;\n  `;\n}\n\n/**\n * Adds `resolved_by` and the resolver trigger. Idempotent and backfill-free:\n * gates resolved before it keep an unknown resolver rather than a guessed one.\n */\nexport function gateResolverMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return {\n    version,\n    name: `hitl:resolver:${name}`,\n    up: (db) => {\n      if (!hasResolverColumn(db, name)) db.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN resolved_by TEXT`);\n      db.exec(resolverRequiredTriggerDdl(name));\n    },\n  };\n}\n\nfunction hasResolverColumn(db: Db, table: string): boolean {\n  return db.prepare(\"SELECT 1 FROM pragma_table_info(?) WHERE name = 'resolved_by'\").get(table) !== undefined;\n}\n\nexport interface SqliteGateStoreOptions {\n  table?: string;\n  /** Run `gateMigration` on construction. Off when the product owns its migration list. */\n  migrate?: boolean;\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n}\n\ninterface RawGateRow {\n  id: string;\n  prompt: string;\n  schema: string | null;\n  status: GateStatus;\n  payload: string | null;\n  reason: string | null;\n  created_at: string;\n  resolved_at: string | null;\n  expires_at: string | null;\n  /** Absent entirely on a table that has not run `gateResolverMigration`. */\n  resolved_by?: string | null;\n}\n\n/**\n * Durable gates. Two instances on the same file are two processes as far as the\n * gate is concerned, which is the entire point: whoever resolves the row does\n * not have to be whoever opened it.\n */\nexport class SqliteGateStore extends BaseGateStore {\n  private readonly table: string;\n  private resolverColumnSeen = false;\n\n  constructor(\n    private readonly db: Db,\n    options: SqliteGateStoreOptions = {},\n  ) {\n    super(options.now ?? Date.now, options.authorize);\n    this.table = options.table ?? DEFAULT_GATE_TABLE;\n    if (options.migrate ?? true) runMigrations(db, [gateMigration(1, this.table)]);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.db\n      .prepare(\n        `INSERT INTO ${quoteIdent(this.table)}\n           (id, prompt, schema, status, payload, reason, created_at, resolved_at, expires_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n      )\n      .run(...columns(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.db.prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE id = ?`).get(id) as\n      | RawGateRow\n      | undefined;\n    return row ? toRecord(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    if (record.resolvedBy) {\n      this.updateWithResolver(record, record.resolvedBy);\n      return;\n    }\n    this.db\n      .prepare(\n        `UPDATE ${quoteIdent(this.table)}\n            SET status = ?, payload = ?, reason = ?, resolved_at = ?\n          WHERE id = ?`,\n      )\n      .run(record.status, toJson(record.payload), record.reason ?? null, record.resolvedAt ?? null, record.id);\n  }\n\n  /** Refuses rather than dropping the resolver when the table has no column to hold it. */\n  private updateWithResolver(record: GateRecord, resolvedBy: GateResolver): void {\n    if (!this.resolverColumnPresent()) {\n      throw new GateStoreSchemaOutdated(record.id, this.table, \"gateResolverMigration\");\n    }\n    this.db\n      .prepare(\n        `UPDATE ${quoteIdent(this.table)}\n            SET status = ?, payload = ?, reason = ?, resolved_at = ?, resolved_by = ?\n          WHERE id = ?`,\n      )\n      .run(\n        record.status,\n        toJson(record.payload),\n        record.reason ?? null,\n        record.resolvedAt ?? null,\n        JSON.stringify(resolvedBy),\n        record.id,\n      );\n  }\n\n  /** Only a positive probe is cached, so a migration run after construction is still noticed. */\n  private resolverColumnPresent(): boolean {\n    if (!this.resolverColumnSeen) this.resolverColumnSeen = hasResolverColumn(this.db, this.table);\n    return this.resolverColumnSeen;\n  }\n\n  protected readByStatus(status: GateStatus): GateRecord[] {\n    const rows = this.db\n      .prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE status = ? ORDER BY created_at`)\n      .all(status) as RawGateRow[];\n    return rows.map(toRecord);\n  }\n}\n\nfunction columns(record: GateRecord): unknown[] {\n  return [\n    record.id,\n    record.prompt,\n    record.schema ? JSON.stringify(record.schema) : null,\n    record.status,\n    toJson(record.payload),\n    record.reason ?? null,\n    record.createdAt,\n    record.resolvedAt ?? null,\n    record.expiresAt ?? null,\n  ];\n}\n\n/** `undefined` and a stored JSON `null` are different states, so only the former becomes a SQL NULL. */\nfunction toJson(payload: unknown): string | null {\n  return payload === undefined ? null : JSON.stringify(payload);\n}\n\nfunction toRecord(row: RawGateRow): GateRecord {\n  return {\n    id: row.id,\n    prompt: row.prompt,\n    schema: row.schema ? (JSON.parse(row.schema) as JsonSchema) : undefined,\n    status: row.status,\n    payload: row.payload === null ? undefined : JSON.parse(row.payload),\n    reason: row.reason ?? undefined,\n    createdAt: row.created_at,\n    resolvedAt: row.resolved_at ?? undefined,\n    expiresAt: row.expires_at ?? undefined,\n    resolvedBy: row.resolved_by ? (JSON.parse(row.resolved_by) as GateResolver) : undefined,\n  };\n}\n"],"mappings":";;;;;;AAAA,SAAS,YAAY,qBAA8C;AAW5D,IAAM,qBAAqB;AAE3B,SAAS,aAAa,OAAe,oBAA4B;AACtE,QAAM,IAAI,WAAW,IAAI;AACzB,SAAO;AAAA,iCACwB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAWD,WAAW,GAAG,IAAI,UAAU,CAAC;AAAA,WACnD,CAAC;AAAA;AAEZ;AAGO,SAAS,cAAc,SAAiB,OAAe,oBAA+B;AAC3F,SAAO,EAAE,SAAS,MAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,aAAa,IAAI,CAAC,EAAE;AAClF;AAMO,SAAS,2BAA2B,OAAe,oBAA4B;AACpF,SAAQ,CAAC,UAAU,QAAQ,EAAY,IAAI,CAAC,UAAU,gBAAgB,MAAM,KAAK,CAAC,EAAE,KAAK,IAAI;AAC/F;AAEA,SAAS,gBAAgB,MAAc,OAAoC;AACzE,QAAM,SAAS,UAAU,WAAW,sBAAsB;AAC1D,SAAO;AAAA,mCAC0B,WAAW,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;AAAA,eACnD,KAAK,OAAO,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAM3C;AAMO,SAAS,sBAAsB,SAAiB,OAAe,oBAA+B;AACnG,SAAO;AAAA,IACL;AAAA,IACA,MAAM,iBAAiB,IAAI;AAAA,IAC3B,IAAI,CAAC,OAAO;AACV,UAAI,CAAC,kBAAkB,IAAI,IAAI,EAAG,IAAG,KAAK,eAAe,WAAW,IAAI,CAAC,8BAA8B;AACvG,SAAG,KAAK,2BAA2B,IAAI,CAAC;AAAA,IAC1C;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,IAAQ,OAAwB;AACzD,SAAO,GAAG,QAAQ,+DAA+D,EAAE,IAAI,KAAK,MAAM;AACpG;AA8BO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAIjD,YACmB,IACjB,UAAkC,CAAC,GACnC;AACA,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS;AAH/B;AAIjB,SAAK,QAAQ,QAAQ,SAAS;AAC9B,QAAI,QAAQ,WAAW,KAAM,eAAc,IAAI,CAAC,cAAc,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EAC/E;AAAA,EANmB;AAAA,EAJF;AAAA,EACT,qBAAqB;AAAA,EAWnB,OAAO,QAA0B;AACzC,SAAK,GACF;AAAA,MACC,eAAe,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGvC,EACC,IAAI,GAAG,QAAQ,MAAM,CAAC;AAAA,EAC3B;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,GAAG,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE;AAG1F,WAAO,MAAM,SAAS,GAAG,IAAI;AAAA,EAC/B;AAAA,EAEU,OAAO,QAA0B;AACzC,QAAI,OAAO,YAAY;AACrB,WAAK,mBAAmB,QAAQ,OAAO,UAAU;AACjD;AAAA,IACF;AACA,SAAK,GACF;AAAA,MACC,UAAU,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGlC,EACC,IAAI,OAAO,QAAQ,OAAO,OAAO,OAAO,GAAG,OAAO,UAAU,MAAM,OAAO,cAAc,MAAM,OAAO,EAAE;AAAA,EAC3G;AAAA;AAAA,EAGQ,mBAAmB,QAAoB,YAAgC;AAC7E,QAAI,CAAC,KAAK,sBAAsB,GAAG;AACjC,YAAM,IAAI,wBAAwB,OAAO,IAAI,KAAK,OAAO,uBAAuB;AAAA,IAClF;AACA,SAAK,GACF;AAAA,MACC,UAAU,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGlC,EACC;AAAA,MACC,OAAO;AAAA,MACP,OAAO,OAAO,OAAO;AAAA,MACrB,OAAO,UAAU;AAAA,MACjB,OAAO,cAAc;AAAA,MACrB,KAAK,UAAU,UAAU;AAAA,MACzB,OAAO;AAAA,IACT;AAAA,EACJ;AAAA;AAAA,EAGQ,wBAAiC;AACvC,QAAI,CAAC,KAAK,mBAAoB,MAAK,qBAAqB,kBAAkB,KAAK,IAAI,KAAK,KAAK;AAC7F,WAAO,KAAK;AAAA,EACd;AAAA,EAEU,aAAa,QAAkC;AACvD,UAAM,OAAO,KAAK,GACf,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,uCAAuC,EACtF,IAAI,MAAM;AACb,WAAO,KAAK,IAAI,QAAQ;AAAA,EAC1B;AACF;AAEA,SAAS,QAAQ,QAA+B;AAC9C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO,SAAS,KAAK,UAAU,OAAO,MAAM,IAAI;AAAA,IAChD,OAAO;AAAA,IACP,OAAO,OAAO,OAAO;AAAA,IACrB,OAAO,UAAU;AAAA,IACjB,OAAO;AAAA,IACP,OAAO,cAAc;AAAA,IACrB,OAAO,aAAa;AAAA,EACtB;AACF;AAGA,SAAS,OAAO,SAAiC;AAC/C,SAAO,YAAY,SAAY,OAAO,KAAK,UAAU,OAAO;AAC9D;AAEA,SAAS,SAAS,KAA6B;AAC7C,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,SAAU,KAAK,MAAM,IAAI,MAAM,IAAmB;AAAA,IAC9D,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI,YAAY,OAAO,SAAY,KAAK,MAAM,IAAI,OAAO;AAAA,IAClE,QAAQ,IAAI,UAAU;AAAA,IACtB,WAAW,IAAI;AAAA,IACf,YAAY,IAAI,eAAe;AAAA,IAC/B,WAAW,IAAI,cAAc;AAAA,IAC7B,YAAY,IAAI,cAAe,KAAK,MAAM,IAAI,WAAW,IAAqB;AAAA,EAChF;AACF;","names":[]}
+{"version":3,"sources":["../src/sqlite-store.ts"],"sourcesContent":["import { quoteIdent, runMigrations, type Db, type Migration } from \"@titan-design/store-sqlite\";\nimport { BaseGateStore } from \"./base-store.js\";\nimport {\n  GateStoreSchemaOutdated,\n  type GateAuthorize,\n  type GateRecord,\n  type GateResolver,\n  type GateRule,\n  type GateStatus,\n  type JsonSchema,\n} from \"./types.js\";\n\nexport const DEFAULT_GATE_TABLE = \"hitl_gate\";\n\nexport function gateTableDdl(name: string = DEFAULT_GATE_TABLE): string {\n  const t = quoteIdent(name);\n  return `\n    CREATE TABLE IF NOT EXISTS ${t} (\n      id          TEXT PRIMARY KEY,\n      prompt      TEXT NOT NULL,\n      schema      TEXT,\n      status      TEXT NOT NULL DEFAULT 'pending',\n      payload     TEXT,\n      reason      TEXT,\n      created_at  TEXT NOT NULL,\n      resolved_at TEXT,\n      expires_at  TEXT\n    );\n    CREATE INDEX IF NOT EXISTS ${quoteIdent(`${name}_pending`)}\n      ON ${t} (created_at) WHERE status = 'pending';\n  `;\n}\n\n/** Drop into the product's own `runMigrations` list so hitl shares one database with its domain tables. */\nexport function gateMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return { version, name: `hitl:${name}`, up: (db) => db.exec(gateTableDdl(name)) };\n}\n\n/**\n * The triggers that refuse a resolved row naming no resolver, on update and on\n * insert, so a writer that predates `resolved_by` fails loudly instead of resolving anonymously.\n */\nexport function resolverRequiredTriggerDdl(name: string = DEFAULT_GATE_TABLE): string {\n  return ([\"UPDATE\", \"INSERT\"] as const).map((event) => resolverTrigger(name, event)).join(\"\\n\");\n}\n\nfunction resolverTrigger(name: string, event: \"UPDATE\" | \"INSERT\"): string {\n  const suffix = event === \"UPDATE\" ? \"resolver_required\" : \"resolver_required_insert\";\n  return `\n    CREATE TRIGGER IF NOT EXISTS ${quoteIdent(`${name}_${suffix}`)}\n      BEFORE ${event} ON ${quoteIdent(name)}\n      FOR EACH ROW WHEN NEW.status = 'resolved' AND NEW.resolved_by IS NULL\n    BEGIN\n      SELECT RAISE(ABORT, 'hitl: resolvedBy required');\n    END;\n  `;\n}\n\n/**\n * Adds `resolved_by` and the resolver trigger. Idempotent and backfill-free:\n * gates resolved before it keep an unknown resolver rather than a guessed one.\n */\nexport function gateResolverMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return {\n    version,\n    name: `hitl:resolver:${name}`,\n    up: (db) => {\n      if (!hasResolverColumn(db, name)) db.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN resolved_by TEXT`);\n      db.exec(resolverRequiredTriggerDdl(name));\n      if (hasColumn(db, name, \"rule\")) db.exec(ruleTriggerDdl(db, name));\n    },\n  };\n}\n\nfunction hasResolverColumn(db: Db, table: string): boolean {\n  return hasColumn(db, table, \"resolved_by\");\n}\n\nfunction hasColumn(db: Db, table: string, column: string): boolean {\n  return db.prepare(\"SELECT 1 FROM pragma_table_info(?) WHERE name = ?\").get(table, column) !== undefined;\n}\n\nconst CANONICAL_STATUSES = \"'pending', 'resolved', 'cancelled', 'expired'\";\n\n/**\n * The triggers that refuse a resolve by a class outside the row's rule, and any\n * change to the rule, so a writer that predates `rule` cannot widen it. The\n * INSERT twin closes REPLACE INTO and DELETE then INSERT, which an UPDATE trigger never sees.\n * A rule-bound row also refuses a status outside the canonical set, so `RESOLVED` cannot slip past the `resolved` test.\n * Without `resolved_by` no resolver can be recorded, so they refuse every resolve\n * of a rule-bound row; whichever migration runs second installs the class-aware form.\n */\nfunction ruleTriggerDdl(db: Db, name: string): string {\n  const hasResolver = hasResolverColumn(db, name);\n  const update = ruleTrigger(name, \"UPDATE\", \"OLD.rule\", hasResolver, \"NEW.rule IS NOT OLD.rule\");\n  const insert = ruleTrigger(name, \"INSERT\", \"NEW.rule\", hasResolver, \"0\");\n  return `${update}\\n${insert}\\n${replaceGuard(name)}`;\n}\n\n/** REPLACE deletes the old row before any delete trigger fires without recursive_triggers, so refuse it up front. */\nfunction replaceGuard(name: string): string {\n  const trigger = quoteIdent(`${name}_rule_replace`);\n  return `\n    DROP TRIGGER IF EXISTS ${trigger};\n    CREATE TRIGGER ${trigger}\n      BEFORE INSERT ON ${quoteIdent(name)}\n      FOR EACH ROW WHEN EXISTS (\n        SELECT 1 FROM ${quoteIdent(name)} WHERE id = NEW.id AND status = 'pending' AND rule IS NOT NULL AND rule IS NOT NEW.rule\n      )\n    BEGIN\n      SELECT RAISE(ABORT, 'hitl: a pending rule-bound gate cannot be replaced');\n    END;\n  `;\n}\n\nfunction ruleTrigger(name: string, event: \"UPDATE\" | \"INSERT\", rule: string, hasResolver: boolean, ruleChanged: string): string {\n  const trigger = quoteIdent(event === \"UPDATE\" ? `${name}_rule_resolver` : `${name}_rule_resolver_insert`);\n  const outsideRule = hasResolver\n    ? `COALESCE(json_extract(NEW.resolved_by, '$.class'), '') NOT IN (SELECT value FROM json_each(${rule}, '$.resolvers'))`\n    : \"1\";\n  return `\n    DROP TRIGGER IF EXISTS ${trigger};\n    CREATE TRIGGER ${trigger}\n      BEFORE ${event} ON ${quoteIdent(name)}\n      FOR EACH ROW WHEN ${rule} IS NOT NULL OR ${ruleChanged}\n    BEGIN\n      SELECT RAISE(ABORT, 'hitl: status outside the canonical set') WHERE ${rule} IS NOT NULL AND NEW.status NOT IN (${CANONICAL_STATUSES});\n      SELECT RAISE(ABORT, 'hitl: resolver outside the gate rule')\n        WHERE ${ruleChanged} OR (NEW.status = 'resolved' AND ${outsideRule});\n    END;\n  `;\n}\n\n/** Adds `rule` and its trigger. Idempotent and backfill-free: gates opened before it carry no rule. */\nexport function gateRuleMigration(version: number, name: string = DEFAULT_GATE_TABLE): Migration {\n  return {\n    version,\n    name: `hitl:rule:${name}`,\n    up: (db) => {\n      if (!hasColumn(db, name, \"rule\")) db.exec(`ALTER TABLE ${quoteIdent(name)} ADD COLUMN rule TEXT`);\n      db.exec(ruleTriggerDdl(db, name));\n    },\n  };\n}\n\nexport interface SqliteGateStoreOptions {\n  table?: string;\n  /** Run `gateMigration`, `gateResolverMigration` and `gateRuleMigration` on construction. Off when the product owns its migration list. */\n  migrate?: boolean;\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n}\n\ninterface RawGateRow {\n  id: string;\n  prompt: string;\n  schema: string | null;\n  status: GateStatus;\n  payload: string | null;\n  reason: string | null;\n  created_at: string;\n  resolved_at: string | null;\n  expires_at: string | null;\n  resolved_by: string | null;\n  /** Absent entirely on a table that has not run `gateRuleMigration`. */\n  rule?: string | null;\n}\n\n/**\n * Durable gates. Two instances on the same file are two processes as far as the\n * gate is concerned, which is the entire point: whoever resolves the row does\n * not have to be whoever opened it.\n */\nexport class SqliteGateStore extends BaseGateStore {\n  private readonly table: string;\n  private ruleColumnSeen = false;\n\n  constructor(\n    private readonly db: Db,\n    options: SqliteGateStoreOptions = {},\n  ) {\n    super(options.now ?? Date.now, options.authorize);\n    this.table = options.table ?? DEFAULT_GATE_TABLE;\n    if (options.migrate ?? true) runMigrations(db, defaultMigrations(this.table));\n    const missing = missingMigration(db, this.table);\n    if (missing) throw new GateStoreSchemaOutdated(\"\", this.table, missing);\n  }\n\n  protected insert(record: GateRecord): void {\n    if (record.rule) {\n      this.insertWithRule(record, record.rule);\n      return;\n    }\n    this.db\n      .prepare(\n        `INSERT INTO ${quoteIdent(this.table)}\n           (id, prompt, schema, status, payload, reason, created_at, resolved_at, expires_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n      )\n      .run(...columns(record));\n  }\n\n  /** Refuses rather than dropping the rule when the table has no column to hold it. */\n  private insertWithRule(record: GateRecord, rule: GateRule): void {\n    if (!this.ruleColumnPresent()) throw new GateStoreSchemaOutdated(record.id, this.table, \"gateRuleMigration\");\n    this.db\n      .prepare(\n        `INSERT INTO ${quoteIdent(this.table)}\n           (id, prompt, schema, status, payload, reason, created_at, resolved_at, expires_at, rule)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n      )\n      .run(...columns(record), JSON.stringify(rule));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.db.prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE id = ?`).get(id) as\n      | RawGateRow\n      | undefined;\n    return row ? toRecord(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    const resolvedBy = record.resolvedBy ? JSON.stringify(record.resolvedBy) : null;\n    this.db\n      .prepare(\n        `UPDATE ${quoteIdent(this.table)}\n            SET status = ?, payload = ?, reason = ?, resolved_at = ?, resolved_by = ?\n          WHERE id = ?`,\n      )\n      .run(record.status, toJson(record.payload), record.reason ?? null, record.resolvedAt ?? null, resolvedBy, record.id);\n  }\n\n  private ruleColumnPresent(): boolean {\n    if (!this.ruleColumnSeen) this.ruleColumnSeen = hasColumn(this.db, this.table, \"rule\");\n    return this.ruleColumnSeen;\n  }\n\n  protected readByStatus(status: GateStatus): GateRecord[] {\n    const rows = this.db\n      .prepare(`SELECT * FROM ${quoteIdent(this.table)} WHERE status = ? ORDER BY created_at`)\n      .all(status) as RawGateRow[];\n    return rows.map(toRecord);\n  }\n}\n\n/** Names the earliest migration the table lacks, so the error points at the step to add. */\nfunction missingMigration(db: Db, table: string): string | undefined {\n  if (!hasColumn(db, table, \"id\")) return \"gateMigration\";\n  return hasResolverColumn(db, table) ? undefined : \"gateResolverMigration\";\n}\n\nfunction defaultMigrations(table: string): Migration[] {\n  return [gateMigration(1, table), gateResolverMigration(2, table), gateRuleMigration(3, table)];\n}\n\nfunction columns(record: GateRecord): unknown[] {\n  return [\n    record.id,\n    record.prompt,\n    record.schema ? JSON.stringify(record.schema) : null,\n    record.status,\n    toJson(record.payload),\n    record.reason ?? null,\n    record.createdAt,\n    record.resolvedAt ?? null,\n    record.expiresAt ?? null,\n  ];\n}\n\n/** `undefined` and a stored JSON `null` are different states, so only the former becomes a SQL NULL. */\nfunction toJson(payload: unknown): string | null {\n  return payload === undefined ? null : JSON.stringify(payload);\n}\n\nfunction toRecord(row: RawGateRow): GateRecord {\n  return {\n    id: row.id,\n    prompt: row.prompt,\n    schema: row.schema ? (JSON.parse(row.schema) as JsonSchema) : undefined,\n    status: row.status,\n    payload: row.payload === null ? undefined : JSON.parse(row.payload),\n    reason: row.reason ?? undefined,\n    createdAt: row.created_at,\n    resolvedAt: row.resolved_at ?? undefined,\n    expiresAt: row.expires_at ?? undefined,\n    resolvedBy: row.resolved_by ? (JSON.parse(row.resolved_by) as GateResolver) : undefined,\n    rule: row.rule ? (JSON.parse(row.rule) as GateRule) : undefined,\n  };\n}\n"],"mappings":";;;;;;AAAA,SAAS,YAAY,qBAA8C;AAY5D,IAAM,qBAAqB;AAE3B,SAAS,aAAa,OAAe,oBAA4B;AACtE,QAAM,IAAI,WAAW,IAAI;AACzB,SAAO;AAAA,iCACwB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAWD,WAAW,GAAG,IAAI,UAAU,CAAC;AAAA,WACnD,CAAC;AAAA;AAEZ;AAGO,SAAS,cAAc,SAAiB,OAAe,oBAA+B;AAC3F,SAAO,EAAE,SAAS,MAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,aAAa,IAAI,CAAC,EAAE;AAClF;AAMO,SAAS,2BAA2B,OAAe,oBAA4B;AACpF,SAAQ,CAAC,UAAU,QAAQ,EAAY,IAAI,CAAC,UAAU,gBAAgB,MAAM,KAAK,CAAC,EAAE,KAAK,IAAI;AAC/F;AAEA,SAAS,gBAAgB,MAAc,OAAoC;AACzE,QAAM,SAAS,UAAU,WAAW,sBAAsB;AAC1D,SAAO;AAAA,mCAC0B,WAAW,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;AAAA,eACnD,KAAK,OAAO,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAM3C;AAMO,SAAS,sBAAsB,SAAiB,OAAe,oBAA+B;AACnG,SAAO;AAAA,IACL;AAAA,IACA,MAAM,iBAAiB,IAAI;AAAA,IAC3B,IAAI,CAAC,OAAO;AACV,UAAI,CAAC,kBAAkB,IAAI,IAAI,EAAG,IAAG,KAAK,eAAe,WAAW,IAAI,CAAC,8BAA8B;AACvG,SAAG,KAAK,2BAA2B,IAAI,CAAC;AACxC,UAAI,UAAU,IAAI,MAAM,MAAM,EAAG,IAAG,KAAK,eAAe,IAAI,IAAI,CAAC;AAAA,IACnE;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,IAAQ,OAAwB;AACzD,SAAO,UAAU,IAAI,OAAO,aAAa;AAC3C;AAEA,SAAS,UAAU,IAAQ,OAAe,QAAyB;AACjE,SAAO,GAAG,QAAQ,mDAAmD,EAAE,IAAI,OAAO,MAAM,MAAM;AAChG;AAEA,IAAM,qBAAqB;AAU3B,SAAS,eAAe,IAAQ,MAAsB;AACpD,QAAM,cAAc,kBAAkB,IAAI,IAAI;AAC9C,QAAM,SAAS,YAAY,MAAM,UAAU,YAAY,aAAa,0BAA0B;AAC9F,QAAM,SAAS,YAAY,MAAM,UAAU,YAAY,aAAa,GAAG;AACvE,SAAO,GAAG,MAAM;AAAA,EAAK,MAAM;AAAA,EAAK,aAAa,IAAI,CAAC;AACpD;AAGA,SAAS,aAAa,MAAsB;AAC1C,QAAM,UAAU,WAAW,GAAG,IAAI,eAAe;AACjD,SAAO;AAAA,6BACoB,OAAO;AAAA,qBACf,OAAO;AAAA,yBACH,WAAW,IAAI,CAAC;AAAA;AAAA,wBAEjB,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMxC;AAEA,SAAS,YAAY,MAAc,OAA4B,MAAc,aAAsB,aAA6B;AAC9H,QAAM,UAAU,WAAW,UAAU,WAAW,GAAG,IAAI,mBAAmB,GAAG,IAAI,uBAAuB;AACxG,QAAM,cAAc,cAChB,8FAA8F,IAAI,sBAClG;AACJ,SAAO;AAAA,6BACoB,OAAO;AAAA,qBACf,OAAO;AAAA,eACb,KAAK,OAAO,WAAW,IAAI,CAAC;AAAA,0BACjB,IAAI,mBAAmB,WAAW;AAAA;AAAA,4EAEgB,IAAI,uCAAuC,kBAAkB;AAAA;AAAA,gBAEzH,WAAW,oCAAoC,WAAW;AAAA;AAAA;AAG1E;AAGO,SAAS,kBAAkB,SAAiB,OAAe,oBAA+B;AAC/F,SAAO;AAAA,IACL;AAAA,IACA,MAAM,aAAa,IAAI;AAAA,IACvB,IAAI,CAAC,OAAO;AACV,UAAI,CAAC,UAAU,IAAI,MAAM,MAAM,EAAG,IAAG,KAAK,eAAe,WAAW,IAAI,CAAC,uBAAuB;AAChG,SAAG,KAAK,eAAe,IAAI,IAAI,CAAC;AAAA,IAClC;AAAA,EACF;AACF;AA+BO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAIjD,YACmB,IACjB,UAAkC,CAAC,GACnC;AACA,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS;AAH/B;AAIjB,SAAK,QAAQ,QAAQ,SAAS;AAC9B,QAAI,QAAQ,WAAW,KAAM,eAAc,IAAI,kBAAkB,KAAK,KAAK,CAAC;AAC5E,UAAM,UAAU,iBAAiB,IAAI,KAAK,KAAK;AAC/C,QAAI,QAAS,OAAM,IAAI,wBAAwB,IAAI,KAAK,OAAO,OAAO;AAAA,EACxE;AAAA,EARmB;AAAA,EAJF;AAAA,EACT,iBAAiB;AAAA,EAaf,OAAO,QAA0B;AACzC,QAAI,OAAO,MAAM;AACf,WAAK,eAAe,QAAQ,OAAO,IAAI;AACvC;AAAA,IACF;AACA,SAAK,GACF;AAAA,MACC,eAAe,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGvC,EACC,IAAI,GAAG,QAAQ,MAAM,CAAC;AAAA,EAC3B;AAAA;AAAA,EAGQ,eAAe,QAAoB,MAAsB;AAC/D,QAAI,CAAC,KAAK,kBAAkB,EAAG,OAAM,IAAI,wBAAwB,OAAO,IAAI,KAAK,OAAO,mBAAmB;AAC3G,SAAK,GACF;AAAA,MACC,eAAe,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGvC,EACC,IAAI,GAAG,QAAQ,MAAM,GAAG,KAAK,UAAU,IAAI,CAAC;AAAA,EACjD;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,GAAG,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE;AAG1F,WAAO,MAAM,SAAS,GAAG,IAAI;AAAA,EAC/B;AAAA,EAEU,OAAO,QAA0B;AACzC,UAAM,aAAa,OAAO,aAAa,KAAK,UAAU,OAAO,UAAU,IAAI;AAC3E,SAAK,GACF;AAAA,MACC,UAAU,WAAW,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,IAGlC,EACC,IAAI,OAAO,QAAQ,OAAO,OAAO,OAAO,GAAG,OAAO,UAAU,MAAM,OAAO,cAAc,MAAM,YAAY,OAAO,EAAE;AAAA,EACvH;AAAA,EAEQ,oBAA6B;AACnC,QAAI,CAAC,KAAK,eAAgB,MAAK,iBAAiB,UAAU,KAAK,IAAI,KAAK,OAAO,MAAM;AACrF,WAAO,KAAK;AAAA,EACd;AAAA,EAEU,aAAa,QAAkC;AACvD,UAAM,OAAO,KAAK,GACf,QAAQ,iBAAiB,WAAW,KAAK,KAAK,CAAC,uCAAuC,EACtF,IAAI,MAAM;AACb,WAAO,KAAK,IAAI,QAAQ;AAAA,EAC1B;AACF;AAGA,SAAS,iBAAiB,IAAQ,OAAmC;AACnE,MAAI,CAAC,UAAU,IAAI,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO,kBAAkB,IAAI,KAAK,IAAI,SAAY;AACpD;AAEA,SAAS,kBAAkB,OAA4B;AACrD,SAAO,CAAC,cAAc,GAAG,KAAK,GAAG,sBAAsB,GAAG,KAAK,GAAG,kBAAkB,GAAG,KAAK,CAAC;AAC/F;AAEA,SAAS,QAAQ,QAA+B;AAC9C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO,SAAS,KAAK,UAAU,OAAO,MAAM,IAAI;AAAA,IAChD,OAAO;AAAA,IACP,OAAO,OAAO,OAAO;AAAA,IACrB,OAAO,UAAU;AAAA,IACjB,OAAO;AAAA,IACP,OAAO,cAAc;AAAA,IACrB,OAAO,aAAa;AAAA,EACtB;AACF;AAGA,SAAS,OAAO,SAAiC;AAC/C,SAAO,YAAY,SAAY,OAAO,KAAK,UAAU,OAAO;AAC9D;AAEA,SAAS,SAAS,KAA6B;AAC7C,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,SAAU,KAAK,MAAM,IAAI,MAAM,IAAmB;AAAA,IAC9D,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI,YAAY,OAAO,SAAY,KAAK,MAAM,IAAI,OAAO;AAAA,IAClE,QAAQ,IAAI,UAAU;AAAA,IACtB,WAAW,IAAI;AAAA,IACf,YAAY,IAAI,eAAe;AAAA,IAC/B,WAAW,IAAI,cAAc;AAAA,IAC7B,YAAY,IAAI,cAAe,KAAK,MAAM,IAAI,WAAW,IAAqB;AAAA,IAC9E,MAAM,IAAI,OAAQ,KAAK,MAAM,IAAI,IAAI,IAAiB;AAAA,EACxD;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@titan-design/hitl",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Human-in-the-loop gate()/resolve() primitive",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@titan-design/authority": "^0.2.0",
+    "@titan-design/authority": "^0.2.1",
     "@titan-design/store-sqlite": "0.3.1"
   },
   "peerDependencies": {

package/dist/chunk-4GAZKT6Z.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts","../src/json-schema.ts","../src/resolver-policy.ts","../src/base-store.ts"],"sourcesContent":["import type { ActorClass } from \"@titan-design/authority\";\n\n/** A gate is a row, never a promise: pending work survives the process that opened it. */\nexport type GateStatus = \"pending\" | \"resolved\" | \"cancelled\" | \"expired\";\n\n/** A JSON Schema document, stored so any process can validate a payload without the original zod schema. */\nexport type JsonSchema = Record<string, unknown>;\n\nexport interface GateRecord {\n  id: string;\n  prompt: string;\n  schema: JsonSchema | undefined;\n  status: GateStatus;\n  payload: unknown;\n  /** Why the gate was cancelled; unset for every other status. */\n  reason: string | undefined;\n  /** ISO-8601 with milliseconds, the shape store-sqlite writes and any surface can send as-is. */\n  createdAt: string;\n  resolvedAt: string | undefined;\n  expiresAt: string | undefined;\n  /** Who resolved the gate, as claimed by the caller; unset for gates resolved before stores recorded it. */\n  resolvedBy: GateResolver | undefined;\n}\n\n/** A claim about who answered a gate. hitl records it and checks its class; it cannot prove it. */\nexport interface GateResolver {\n  class: ActorClass;\n  id: string;\n  channel: string;\n  /** The channel's own id for the confirming event, such as a chat reaction. */\n  confirmEvent?: string;\n}\n\nexport type GateAuthorization = { allowed: true } | { allowed: false; reason: string };\n\n/**\n * Runs after the default resolver-class check, so it can refuse a resolver but\n * never admit one the default refused. Must return synchronously.\n */\nexport type GateAuthorize = (gate: Readonly<GateRecord>, resolver: Readonly<GateResolver>) => GateAuthorization;\n\nexport interface GateInput {\n  /** Defaults to a random UUID. Supply one to make the gate addressable by a name you already own. */\n  id?: string;\n  prompt: string;\n  schema?: JsonSchema;\n  expiresAt?: Date | string;\n}\n\n/**\n * Synchronous on purpose: both implementations are local (a Map, and\n * better-sqlite3), and `wait` is the only thing that needs to be async.\n */\nexport interface GateStore {\n  create(input: GateInput): GateRecord;\n  get(id: string): GateRecord | undefined;\n  resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;\n  cancel(id: string, reason: string): GateRecord;\n  listPending(): GateRecord[];\n}\n\nexport class GateError extends Error {\n  constructor(\n    message: string,\n    readonly gateId: string,\n  ) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\nexport class GateNotFound extends GateError {\n  constructor(gateId: string) {\n    super(`no gate with id ${gateId}`, gateId);\n  }\n}\n\nexport class GateAlreadyExists extends GateError {\n  constructor(gateId: string) {\n    super(`a gate with id ${gateId} already exists`, gateId);\n  }\n}\n\nexport class GateAlreadySettled extends GateError {\n  constructor(\n    gateId: string,\n    readonly status: GateStatus,\n  ) {\n    super(`gate ${gateId} is already ${status}`, gateId);\n  }\n}\n\nexport class GateCancelled extends GateError {\n  constructor(\n    gateId: string,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} was cancelled: ${reason}`, gateId);\n  }\n}\n\nexport class GateExpired extends GateError {\n  constructor(gateId: string) {\n    super(`gate ${gateId} expired before anyone resolved it`, gateId);\n  }\n}\n\nexport class GatePayloadInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly issues: string[],\n  ) {\n    super(`payload for gate ${gateId} does not match its schema: ${issues.join(\"; \")}`, gateId);\n  }\n}\n\nexport class GateAborted extends GateError {\n  constructor(gateId: string, reason: string) {\n    super(`stopped waiting on gate ${gateId}: ${reason}`, gateId);\n  }\n}\n\nexport class GateResolverRefused extends GateError {\n  constructor(\n    gateId: string,\n    readonly actorClass: string | undefined,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} refused a resolution by ${actorClass ?? \"an unnamed resolver\"}: ${reason}`, gateId);\n  }\n}\n\n/** The store cannot record a resolver because its table predates the resolver migration. */\nexport class GateStoreSchemaOutdated extends GateError {\n  constructor(\n    gateId: string,\n    readonly table: string,\n    readonly migration: string,\n  ) {\n    super(`gate ${gateId} cannot record its resolver: table ${table} needs ${migration}`, gateId);\n  }\n}\n\nexport class GateAuthorizeInvalid extends GateError {\n  constructor(gateId: string) {\n    super(`authorize for gate ${gateId} must return a decision { allowed: boolean } synchronously`, gateId);\n  }\n}\n","import type { JsonSchema } from \"./types.js\";\n\n/**\n * A deliberately small structural check over the JSON Schema subset `z.toJSONSchema`\n * emits. It exists so the process that resolves a gate can reject a bad payload\n * without holding the original zod schema, which by definition lives in another\n * process. The waiter still re-validates with the real zod schema, so this is the\n * boundary check, not the type guarantee.\n */\nexport function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path = \"$\"): string[] {\n  const issues: string[] = [];\n  collect(schema, value, path, issues);\n  return issues;\n}\n\nfunction collect(schema: JsonSchema, value: unknown, path: string, issues: string[]): void {\n  if (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf)) {\n    checkUnion((schema.anyOf ?? schema.oneOf) as JsonSchema[], value, path, issues);\n    return;\n  }\n  if (\"const\" in schema && !Object.is(schema.const, value)) {\n    issues.push(`${path}: expected ${JSON.stringify(schema.const)}`);\n    return;\n  }\n  if (Array.isArray(schema.enum) && !schema.enum.some((option) => Object.is(option, value))) {\n    issues.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);\n    return;\n  }\n  if (typeof schema.type !== \"string\") return;\n  if (!matchesType(schema.type, value)) {\n    issues.push(`${path}: expected ${schema.type}, received ${describe(value)}`);\n    return;\n  }\n  if (schema.type === \"object\") checkObject(schema, value as Record<string, unknown>, path, issues);\n  if (schema.type === \"array\") checkArray(schema, value as unknown[], path, issues);\n}\n\nfunction checkUnion(branches: JsonSchema[], value: unknown, path: string, issues: string[]): void {\n  const matched = branches.some((branch) => checkAgainstJsonSchema(branch, value, path).length === 0);\n  if (!matched) issues.push(`${path}: matched none of the ${branches.length} allowed shapes`);\n}\n\nfunction checkObject(schema: JsonSchema, value: Record<string, unknown>, path: string, issues: string[]): void {\n  const properties = (schema.properties ?? {}) as Record<string, JsonSchema>;\n  for (const key of (schema.required ?? []) as string[]) {\n    if (!(key in value)) issues.push(`${path}.${key}: required`);\n  }\n  if (schema.additionalProperties === false) {\n    for (const key of Object.keys(value)) {\n      if (!(key in properties)) issues.push(`${path}.${key}: unexpected property`);\n    }\n  }\n  for (const [key, sub] of Object.entries(properties)) {\n    if (key in value) collect(sub, value[key], `${path}.${key}`, issues);\n  }\n}\n\nfunction checkArray(schema: JsonSchema, value: unknown[], path: string, issues: string[]): void {\n  const items = schema.items as JsonSchema | undefined;\n  if (!items) return;\n  value.forEach((entry, index) => collect(items, entry, `${path}[${index}]`, issues));\n}\n\nfunction matchesType(type: string, value: unknown): boolean {\n  switch (type) {\n    case \"object\":\n      return typeof value === \"object\" && value !== null && !Array.isArray(value);\n    case \"array\":\n      return Array.isArray(value);\n    case \"integer\":\n      return Number.isInteger(value);\n    case \"number\":\n      return typeof value === \"number\" && Number.isFinite(value);\n    case \"null\":\n      return value === null;\n    default:\n      return typeof value === type;\n  }\n}\n\nfunction describe(value: unknown): string {\n  if (value === null) return \"null\";\n  return Array.isArray(value) ? \"array\" : typeof value;\n}\n","import { ACTOR_CLASSES, RESOLVER_CLASSES, type ActorClass } from \"@titan-design/authority\";\nimport { GateAuthorizeInvalid, GateResolverRefused, type GateAuthorization, type GateResolver } from \"./types.js\";\n\n/**\n * The default refusal: only an owner class may resolve a gate, so an agent or\n * automation never answers its own gate. Every store applies it before `authorize`.\n */\nexport function defaultResolverRefusal(resolver: GateResolver): string | undefined {\n  if ((RESOLVER_CLASSES as readonly string[]).includes(resolver.class)) return undefined;\n  return `actor class ${resolver.class} may not resolve a gate`;\n}\n\n/**\n * Reads each declared field exactly once into a frozen plain object, so the\n * checks and the stored row see the same resolver and nothing undeclared is kept.\n */\nexport function snapshotResolver(gateId: string, raw: unknown): Readonly<GateResolver> {\n  if (typeof raw !== \"object\" || raw === null) throw new GateResolverRefused(gateId, undefined, \"the resolver is not an object\");\n  const { class: actorClass, id, channel, confirmEvent } = raw as Record<string, unknown>;\n  if (!isActorClass(actorClass)) {\n    throw new GateResolverRefused(gateId, undefined, \"the resolver's class is not a known actor class\");\n  }\n  if (typeof id !== \"string\" || typeof channel !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's id and channel must be strings\");\n  }\n  if (confirmEvent === undefined) return Object.freeze({ class: actorClass, id, channel });\n  if (typeof confirmEvent !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's confirmEvent must be a string\");\n  }\n  return Object.freeze({ class: actorClass, id, channel, confirmEvent });\n}\n\n/** Accepts only a synchronous `{ allowed: boolean }`; a promise is refused because the row cannot wait on it. */\nexport function readDecision(gateId: string, decision: unknown): GateAuthorization {\n  if (typeof decision !== \"object\" || decision === null) throw new GateAuthorizeInvalid(gateId);\n  const { then, allowed, reason } = decision as Record<string, unknown>;\n  if (typeof then === \"function\") {\n    (then as (onFulfilled: undefined, onRejected: () => void) => unknown).call(decision, undefined, () => {});\n    throw new GateAuthorizeInvalid(gateId);\n  }\n  if (typeof allowed !== \"boolean\") throw new GateAuthorizeInvalid(gateId);\n  if (allowed) return { allowed: true };\n  return { allowed: false, reason: typeof reason === \"string\" ? reason : \"authorize refused the resolver\" };\n}\n\nfunction isActorClass(value: unknown): value is ActorClass {\n  return typeof value === \"string\" && (ACTOR_CLASSES as readonly string[]).includes(value);\n}\n","import { checkAgainstJsonSchema } from \"./json-schema.js\";\nimport { defaultResolverRefusal, readDecision, snapshotResolver } from \"./resolver-policy.js\";\nimport {\n  GateAlreadyExists,\n  GateAlreadySettled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  GateResolverRefused,\n  type GateAuthorize,\n  type GateInput,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\n/**\n * Every settle rule lives here so the memory and SQLite stores cannot drift\n * apart. Subclasses only move rows.\n */\nexport abstract class BaseGateStore implements GateStore {\n  protected constructor(\n    protected readonly clock: () => number,\n    private readonly authorize?: GateAuthorize,\n  ) {}\n\n  protected abstract insert(record: GateRecord): void;\n  protected abstract read(id: string): GateRecord | undefined;\n  protected abstract update(record: GateRecord): void;\n  protected abstract readByStatus(status: GateRecord[\"status\"]): GateRecord[];\n\n  create(input: GateInput): GateRecord {\n    const id = input.id ?? globalThis.crypto.randomUUID();\n    if (this.read(id)) throw new GateAlreadyExists(id);\n    const record: GateRecord = {\n      id,\n      prompt: input.prompt,\n      schema: input.schema,\n      status: \"pending\",\n      payload: undefined,\n      reason: undefined,\n      createdAt: this.nowIso(),\n      resolvedAt: undefined,\n      expiresAt: toIso(input.expiresAt),\n      resolvedBy: undefined,\n    };\n    this.insert(record);\n    return record;\n  }\n\n  get(id: string): GateRecord | undefined {\n    const record = this.read(id);\n    return record ? this.lapseIfExpired(record) : undefined;\n  }\n\n  resolve(id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord {\n    const resolver = resolvedBy === undefined ? undefined : snapshotResolver(id, resolvedBy);\n    const record = this.requirePending(id);\n    this.requireAuthorized(record, resolver);\n    if (record.schema) {\n      const issues = checkAgainstJsonSchema(record.schema, payload);\n      if (issues.length > 0) throw new GatePayloadInvalid(id, issues);\n    }\n    const resolved: GateRecord = { ...record, status: \"resolved\", payload, resolvedAt: this.nowIso(), resolvedBy: resolver };\n    this.update(resolved);\n    return resolved;\n  }\n\n  cancel(id: string, reason: string): GateRecord {\n    const record = this.requirePending(id);\n    const cancelled: GateRecord = { ...record, status: \"cancelled\", reason, resolvedAt: this.nowIso() };\n    this.update(cancelled);\n    return cancelled;\n  }\n\n  listPending(): GateRecord[] {\n    return this.readByStatus(\"pending\")\n      .map((record) => this.lapseIfExpired(record))\n      .filter((record) => record.status === \"pending\")\n      .sort((a, b) => a.createdAt.localeCompare(b.createdAt));\n  }\n\n  private requirePending(id: string): GateRecord {\n    const record = this.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"expired\") throw new GateExpired(id);\n    if (record.status !== \"pending\") throw new GateAlreadySettled(id, record.status);\n    return record;\n  }\n\n  /** The default check runs first and `authorize` second, so `authorize` can only narrow who may resolve. */\n  private requireAuthorized(record: GateRecord, resolver: Readonly<GateResolver> | undefined): void {\n    const refusal = resolver ? defaultResolverRefusal(resolver) : undefined;\n    if (resolver && refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);\n    if (!this.authorize) return;\n    if (!resolver) throw new GateResolverRefused(record.id, undefined, \"a resolver is required when authorize is installed\");\n    const decision = readDecision(record.id, this.authorize(Object.freeze({ ...record }), resolver));\n    if (!decision.allowed) throw new GateResolverRefused(record.id, resolver.class, decision.reason);\n  }\n\n  /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */\n  private lapseIfExpired(record: GateRecord): GateRecord {\n    if (record.status !== \"pending\" || !record.expiresAt) return record;\n    if (Date.parse(record.expiresAt) > this.clock()) return record;\n    const expired: GateRecord = { ...record, status: \"expired\", resolvedAt: this.nowIso() };\n    this.update(expired);\n    return expired;\n  }\n\n  protected nowIso(): string {\n    return new Date(this.clock()).toISOString();\n  }\n}\n\nfunction toIso(value: Date | string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  return typeof value === \"string\" ? value : value.toISOString();\n}\n"],"mappings":";AA6DO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO,WAAW;AAAA,EACzB;AAAA,EAJW;AAKb;AAEO,IAAM,eAAN,cAA2B,UAAU;AAAA,EAC1C,YAAY,QAAgB;AAC1B,UAAM,mBAAmB,MAAM,IAAI,MAAM;AAAA,EAC3C;AACF;AAEO,IAAM,oBAAN,cAAgC,UAAU;AAAA,EAC/C,YAAY,QAAgB;AAC1B,UAAM,kBAAkB,MAAM,mBAAmB,MAAM;AAAA,EACzD;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,eAAe,MAAM,IAAI,MAAM;AAF1C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,gBAAN,cAA4B,UAAU;AAAA,EAC3C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,mBAAmB,MAAM,IAAI,MAAM;AAF9C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB;AAC1B,UAAM,QAAQ,MAAM,sCAAsC,MAAM;AAAA,EAClE;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,oBAAoB,MAAM,+BAA+B,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM;AAFjF;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB,QAAgB;AAC1C,UAAM,2BAA2B,MAAM,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,IAAM,sBAAN,cAAkC,UAAU;AAAA,EACjD,YACE,QACS,YACA,QACT;AACA,UAAM,QAAQ,MAAM,4BAA4B,cAAc,qBAAqB,KAAK,MAAM,IAAI,MAAM;AAH/F;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAIb;AAGO,IAAM,0BAAN,cAAsC,UAAU;AAAA,EACrD,YACE,QACS,OACA,WACT;AACA,UAAM,QAAQ,MAAM,sCAAsC,KAAK,UAAU,SAAS,IAAI,MAAM;AAHnF;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAIb;AAEO,IAAM,uBAAN,cAAmC,UAAU;AAAA,EAClD,YAAY,QAAgB;AAC1B,UAAM,sBAAsB,MAAM,8DAA8D,MAAM;AAAA,EACxG;AACF;;;AC1IO,SAAS,uBAAuB,QAAoB,OAAgB,OAAO,KAAe;AAC/F,QAAM,SAAmB,CAAC;AAC1B,UAAQ,QAAQ,OAAO,MAAM,MAAM;AACnC,SAAO;AACT;AAEA,SAAS,QAAQ,QAAoB,OAAgB,MAAc,QAAwB;AACzF,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC9D,eAAY,OAAO,SAAS,OAAO,OAAwB,OAAO,MAAM,MAAM;AAC9E;AAAA,EACF;AACA,MAAI,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG;AACxD,WAAO,KAAK,GAAG,IAAI,cAAc,KAAK,UAAU,OAAO,KAAK,CAAC,EAAE;AAC/D;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,OAAO,GAAG,QAAQ,KAAK,CAAC,GAAG;AACzF,WAAO,KAAK,GAAG,IAAI,qBAAqB,KAAK,UAAU,OAAO,IAAI,CAAC,EAAE;AACrE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,SAAS,SAAU;AACrC,MAAI,CAAC,YAAY,OAAO,MAAM,KAAK,GAAG;AACpC,WAAO,KAAK,GAAG,IAAI,cAAc,OAAO,IAAI,cAAc,SAAS,KAAK,CAAC,EAAE;AAC3E;AAAA,EACF;AACA,MAAI,OAAO,SAAS,SAAU,aAAY,QAAQ,OAAkC,MAAM,MAAM;AAChG,MAAI,OAAO,SAAS,QAAS,YAAW,QAAQ,OAAoB,MAAM,MAAM;AAClF;AAEA,SAAS,WAAW,UAAwB,OAAgB,MAAc,QAAwB;AAChG,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,uBAAuB,QAAQ,OAAO,IAAI,EAAE,WAAW,CAAC;AAClG,MAAI,CAAC,QAAS,QAAO,KAAK,GAAG,IAAI,yBAAyB,SAAS,MAAM,iBAAiB;AAC5F;AAEA,SAAS,YAAY,QAAoB,OAAgC,MAAc,QAAwB;AAC7G,QAAM,aAAc,OAAO,cAAc,CAAC;AAC1C,aAAW,OAAQ,OAAO,YAAY,CAAC,GAAgB;AACrD,QAAI,EAAE,OAAO,OAAQ,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,YAAY;AAAA,EAC7D;AACA,MAAI,OAAO,yBAAyB,OAAO;AACzC,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,EAAE,OAAO,YAAa,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,uBAAuB;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACnD,QAAI,OAAO,MAAO,SAAQ,KAAK,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM;AAAA,EACrE;AACF;AAEA,SAAS,WAAW,QAAoB,OAAkB,MAAc,QAAwB;AAC9F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO;AACZ,QAAM,QAAQ,CAAC,OAAO,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AACpF;AAEA,SAAS,YAAY,MAAc,OAAyB;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA,IAC5E,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B,KAAK;AACH,aAAO,OAAO,UAAU,KAAK;AAAA,IAC/B,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU;AAAA,IACnB;AACE,aAAO,OAAO,UAAU;AAAA,EAC5B;AACF;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACjD;;;ACnFA,SAAS,eAAe,wBAAyC;AAO1D,SAAS,uBAAuB,UAA4C;AACjF,MAAK,iBAAuC,SAAS,SAAS,KAAK,EAAG,QAAO;AAC7E,SAAO,eAAe,SAAS,KAAK;AACtC;AAMO,SAAS,iBAAiB,QAAgB,KAAsC;AACrF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,oBAAoB,QAAQ,QAAW,+BAA+B;AAC7H,QAAM,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,IAAI;AACzD,MAAI,CAAC,aAAa,UAAU,GAAG;AAC7B,UAAM,IAAI,oBAAoB,QAAQ,QAAW,iDAAiD;AAAA,EACpG;AACA,MAAI,OAAO,OAAO,YAAY,OAAO,YAAY,UAAU;AACzD,UAAM,IAAI,oBAAoB,QAAQ,YAAY,+CAA+C;AAAA,EACnG;AACA,MAAI,iBAAiB,OAAW,QAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,QAAQ,CAAC;AACvF,MAAI,OAAO,iBAAiB,UAAU;AACpC,UAAM,IAAI,oBAAoB,QAAQ,YAAY,8CAA8C;AAAA,EAClG;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,CAAC;AACvE;AAGO,SAAS,aAAa,QAAgB,UAAsC;AACjF,MAAI,OAAO,aAAa,YAAY,aAAa,KAAM,OAAM,IAAI,qBAAqB,MAAM;AAC5F,QAAM,EAAE,MAAM,SAAS,OAAO,IAAI;AAClC,MAAI,OAAO,SAAS,YAAY;AAC9B,IAAC,KAAqE,KAAK,UAAU,QAAW,MAAM;AAAA,IAAC,CAAC;AACxG,UAAM,IAAI,qBAAqB,MAAM;AAAA,EACvC;AACA,MAAI,OAAO,YAAY,UAAW,OAAM,IAAI,qBAAqB,MAAM;AACvE,MAAI,QAAS,QAAO,EAAE,SAAS,KAAK;AACpC,SAAO,EAAE,SAAS,OAAO,QAAQ,OAAO,WAAW,WAAW,SAAS,iCAAiC;AAC1G;AAEA,SAAS,aAAa,OAAqC;AACzD,SAAO,OAAO,UAAU,YAAa,cAAoC,SAAS,KAAK;AACzF;;;AC3BO,IAAe,gBAAf,MAAkD;AAAA,EAC7C,YACW,OACF,WACjB;AAFmB;AACF;AAAA,EAChB;AAAA,EAFkB;AAAA,EACF;AAAA,EAQnB,OAAO,OAA8B;AACnC,UAAM,KAAK,MAAM,MAAM,WAAW,OAAO,WAAW;AACpD,QAAI,KAAK,KAAK,EAAE,EAAG,OAAM,IAAI,kBAAkB,EAAE;AACjD,UAAM,SAAqB;AAAA,MACzB;AAAA,MACA,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW,KAAK,OAAO;AAAA,MACvB,YAAY;AAAA,MACZ,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,YAAY;AAAA,IACd;AACA,SAAK,OAAO,MAAM;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAoC;AACtC,UAAM,SAAS,KAAK,KAAK,EAAE;AAC3B,WAAO,SAAS,KAAK,eAAe,MAAM,IAAI;AAAA,EAChD;AAAA,EAEA,QAAQ,IAAY,SAAkB,YAAuC;AAC3E,UAAM,WAAW,eAAe,SAAY,SAAY,iBAAiB,IAAI,UAAU;AACvF,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,SAAK,kBAAkB,QAAQ,QAAQ;AACvC,QAAI,OAAO,QAAQ;AACjB,YAAM,SAAS,uBAAuB,OAAO,QAAQ,OAAO;AAC5D,UAAI,OAAO,SAAS,EAAG,OAAM,IAAI,mBAAmB,IAAI,MAAM;AAAA,IAChE;AACA,UAAM,WAAuB,EAAE,GAAG,QAAQ,QAAQ,YAAY,SAAS,YAAY,KAAK,OAAO,GAAG,YAAY,SAAS;AACvH,SAAK,OAAO,QAAQ;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAY,QAA4B;AAC7C,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,UAAM,YAAwB,EAAE,GAAG,QAAQ,QAAQ,aAAa,QAAQ,YAAY,KAAK,OAAO,EAAE;AAClG,SAAK,OAAO,SAAS;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,cAA4B;AAC1B,WAAO,KAAK,aAAa,SAAS,EAC/B,IAAI,CAAC,WAAW,KAAK,eAAe,MAAM,CAAC,EAC3C,OAAO,CAAC,WAAW,OAAO,WAAW,SAAS,EAC9C,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC;AAAA,EAC1D;AAAA,EAEQ,eAAe,IAAwB;AAC7C,UAAM,SAAS,KAAK,IAAI,EAAE;AAC1B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,mBAAmB,IAAI,OAAO,MAAM;AAC/E,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,kBAAkB,QAAoB,UAAoD;AAChG,UAAM,UAAU,WAAW,uBAAuB,QAAQ,IAAI;AAC9D,QAAI,YAAY,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,OAAO;AACzF,QAAI,CAAC,KAAK,UAAW;AACrB,QAAI,CAAC,SAAU,OAAM,IAAI,oBAAoB,OAAO,IAAI,QAAW,oDAAoD;AACvH,UAAM,WAAW,aAAa,OAAO,IAAI,KAAK,UAAU,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAC;AAC/F,QAAI,CAAC,SAAS,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,SAAS,MAAM;AAAA,EACjG;AAAA;AAAA,EAGQ,eAAe,QAAgC;AACrD,QAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAW,QAAO;AAC7D,QAAI,KAAK,MAAM,OAAO,SAAS,IAAI,KAAK,MAAM,EAAG,QAAO;AACxD,UAAM,UAAsB,EAAE,GAAG,QAAQ,QAAQ,WAAW,YAAY,KAAK,OAAO,EAAE;AACtF,SAAK,OAAO,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEU,SAAiB;AACzB,WAAO,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,YAAY;AAAA,EAC5C;AACF;AAEA,SAAS,MAAM,OAAsD;AACnE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM,YAAY;AAC/D;","names":[]}