@titan-design/hitl 0.3.1 → 0.6.0

package/dist/{chunk-4GAZKT6Z.js → chunk-TE2NXWWK.js}

@@ -59,19 +59,122 @@ var GateResolverRefused = class extends GateError {
 };
 var GateStoreSchemaOutdated = class extends GateError {
   constructor(gateId, table, migration) {
-    super(`gate ${gateId} cannot record its resolver: table ${table} needs ${migration}`, gateId);
+    const message = gateId === "" ? `cannot open a gate store on table ${table}: it needs ${migration}` : `gate ${gateId} cannot be recorded: table ${table} needs ${migration}`;
+    super(message, gateId);
     this.table = table;
     this.migration = migration;
   }
   table;
   migration;
 };
+var GateRuleInvalid = class extends GateError {
+  constructor(gateId, reason) {
+    super(`gate ${gateId} has an invalid rule: ${reason}`, gateId);
+    this.reason = reason;
+  }
+  reason;
+};
+var GateBriefInvalid = class extends GateError {
+  constructor(gateId, issues) {
+    super(`gate ${gateId} brief is invalid: ${issues.join("; ")}`, gateId);
+    this.issues = issues;
+  }
+  issues;
+};
 var GateAuthorizeInvalid = class extends GateError {
   constructor(gateId) {
     super(`authorize for gate ${gateId} must return a decision { allowed: boolean } synchronously`, gateId);
   }
 };
 
+// src/gate-brief.ts
+var MAX_SUMMARY = 280;
+var MAX_EVIDENCE_REF = 500;
+var MAX_QUESTIONS = 4;
+var MIN_OPTIONS = 2;
+var MAX_OPTIONS = 4;
+var MAX_OPTION_LABEL = 75;
+var MAX_QUESTION_TEXT = 500;
+var ID_PATTERN = /^[A-Za-z0-9_-]{1,40}$/;
+var ID_RULE = 'id must be 1-40 letters, digits, "-" or "_"';
+var CONTROL_CHAR = /[\u0000-\u001f\u007f]/;
+function snapshotBrief(gateId, raw, required) {
+  const { summary, evidenceRef, questions } = raw ?? {};
+  const issues = [
+    ...lineIssues("summary", summary, MAX_SUMMARY, required),
+    ...lineIssues("evidenceRef", evidenceRef, MAX_EVIDENCE_REF, required)
+  ];
+  const questionIssue = questions === void 0 ? void 0 : questionsIssue(questions);
+  if (questionIssue) issues.push(questionIssue);
+  if (issues.length > 0) throw new GateBriefInvalid(gateId, issues);
+  return Object.freeze({
+    summary,
+    evidenceRef,
+    questions: questions === void 0 ? void 0 : copyQuestions(questions)
+  });
+}
+function lineIssues(field, value, max, required) {
+  if (value === void 0) return required ? [`${field} is required`] : [];
+  if (typeof value !== "string") return [`${field} must be a string`];
+  if (value.trim() === "") return [`${field} is blank`];
+  if (value.length > max) return [`${field} is over ${max} characters`];
+  if (CONTROL_CHAR.test(value)) return [`${field} must be one line with no control characters`];
+  return [];
+}
+function questionsIssue(value) {
+  if (!Array.isArray(value)) return "questions must be an array";
+  if (value.length < 1 || value.length > MAX_QUESTIONS) return `ask 1 to ${MAX_QUESTIONS} questions (got ${value.length})`;
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, raw] of value.entries()) {
+    const question = raw ?? {};
+    const where = `question ${index + 1}`;
+    if (typeof question.id !== "string" || !ID_PATTERN.test(question.id)) return `${where}: ${ID_RULE}`;
+    if (ids.has(question.id)) return `${where}: duplicate question id "${question.id}"`;
+    ids.add(question.id);
+    const issue = questionTextIssue(question.question) ?? optionsIssue(question.options);
+    if (issue) return `${where}: ${issue}`;
+  }
+  return void 0;
+}
+function questionTextIssue(text) {
+  if (typeof text !== "string" || text.trim() === "") return "question text is required";
+  if (text.length > MAX_QUESTION_TEXT) return `question text is over ${MAX_QUESTION_TEXT} characters`;
+  return void 0;
+}
+function optionsIssue(options) {
+  if (!Array.isArray(options) || options.length < MIN_OPTIONS || options.length > MAX_OPTIONS) {
+    return `give ${MIN_OPTIONS} to ${MAX_OPTIONS} options`;
+  }
+  const ids = /* @__PURE__ */ new Set();
+  let recommended = 0;
+  for (const [index, raw] of options.entries()) {
+    const option = raw ?? {};
+    const issue = optionIssue(option, ids);
+    if (issue) return `option ${index + 1}: ${issue}`;
+    ids.add(option.id);
+    if (option.recommended === true) recommended++;
+  }
+  return recommended > 1 ? "mark at most one option as recommended" : void 0;
+}
+function optionIssue(option, seen) {
+  if (typeof option.id !== "string" || !ID_PATTERN.test(option.id)) return ID_RULE;
+  if (seen.has(option.id)) return `duplicate option id "${option.id}"`;
+  if (typeof option.label !== "string" || option.label.trim() === "") return "label is required";
+  if (option.label.length > MAX_OPTION_LABEL) return `label is over ${MAX_OPTION_LABEL} characters`;
+  if (option.recommended !== void 0 && typeof option.recommended !== "boolean") return "recommended must be true or false";
+  return void 0;
+}
+function copyQuestions(questions) {
+  return questions.map((question) => ({
+    id: question.id,
+    question: question.question,
+    options: question.options.map(copyOption)
+  }));
+}
+function copyOption(option) {
+  return option.recommended === true ? { id: option.id, label: option.label, recommended: true } : { id: option.id, label: option.label };
+}
+
 // src/json-schema.ts
 function checkAgainstJsonSchema(schema, value, path = "$") {
   const issues = [];
@@ -149,6 +252,52 @@ function defaultResolverRefusal(resolver) {
   if (RESOLVER_CLASSES.includes(resolver.class)) return void 0;
   return `actor class ${resolver.class} may not resolve a gate`;
 }
+function snapshotAllowances(raw) {
+  return Object.freeze(
+    (raw ?? []).map(
+      ({ resolverClass, stepId, payload }) => Object.freeze({ resolverClass, stepId, payload: Object.freeze(structuredClone(payload)) })
+    )
+  );
+}
+function resolverRefusal(gateId, resolver, payload, allowances) {
+  const refusal = defaultResolverRefusal(resolver);
+  if (refusal === void 0) return void 0;
+  if (!matchesAllowance(allowances, gateId, resolver, payload)) return refusal;
+  return resolver.id.trim() === "" ? `actor class ${resolver.class} must name itself to resolve this gate` : void 0;
+}
+function matchesAllowance(allowances, gateId, resolver, payload) {
+  return allowances.some((a) => a.resolverClass === resolver.class && stepOf(gateId) === a.stepId && jsonEqual(payload, a.payload));
+}
+function jsonEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  const proto = Object.getPrototypeOf(a);
+  if (proto !== Object.getPrototypeOf(b) || proto !== Object.prototype && proto !== Array.prototype && proto !== null) return false;
+  const keys = Object.keys(a);
+  if (keys.length !== Object.keys(b).length) return false;
+  return keys.every((key) => Object.hasOwn(b, key) && jsonEqual(a[key], b[key]));
+}
+function stepOf(gateId) {
+  return gateId.slice(gateId.lastIndexOf("/") + 1).replace(/:\d+$/, "");
+}
+function ruleResolverRefusal(record, resolver) {
+  if (!record.rule) return void 0;
+  if (record.rule.resolvers.includes(resolver.class)) return void 0;
+  return `rule ${record.rule.ruleId} does not let ${resolver.class} resolve this gate`;
+}
+function snapshotRule(gateId, raw) {
+  if (typeof raw !== "object" || raw === null) throw new GateRuleInvalid(gateId, "the rule is not an object");
+  const { table, version, ruleId, resolvers } = raw;
+  if (typeof table !== "string" || typeof version !== "string" || typeof ruleId !== "string") {
+    throw new GateRuleInvalid(gateId, "the rule's table, version and ruleId must be strings");
+  }
+  const classes = Array.isArray(resolvers) ? [...resolvers] : [];
+  if (classes.length === 0 || !classes.every(isResolverClass)) {
+    throw new GateRuleInvalid(gateId, "the rule's resolvers must be a non-empty list of resolver classes");
+  }
+  return Object.freeze({ table, version, ruleId, resolvers: Object.freeze(classes) });
+}
 function snapshotResolver(gateId, raw) {
   if (typeof raw !== "object" || raw === null) throw new GateResolverRefused(gateId, void 0, "the resolver is not an object");
   const { class: actorClass, id, channel, confirmEvent } = raw;
@@ -176,20 +325,29 @@ function readDecision(gateId, decision) {
   if (allowed) return { allowed: true };
   return { allowed: false, reason: typeof reason === "string" ? reason : "authorize refused the resolver" };
 }
+function isResolverClass(value) {
+  return typeof value === "string" && RESOLVER_CLASSES.includes(value);
+}
 function isActorClass(value) {
   return typeof value === "string" && ACTOR_CLASSES.includes(value);
 }
 
 // src/base-store.ts
 var BaseGateStore = class {
-  constructor(clock, authorize) {
+  constructor(clock, authorize, requireBrief = false, allowances) {
     this.clock = clock;
     this.authorize = authorize;
+    this.requireBrief = requireBrief;
+    this.allowances = snapshotAllowances(allowances);
   }
   clock;
   authorize;
+  requireBrief;
+  allowances;
   create(input) {
     const id = input.id ?? globalThis.crypto.randomUUID();
+    const rule = input.rule === void 0 ? void 0 : snapshotRule(id, input.rule);
+    const brief = snapshotBrief(id, input, this.requireBrief);
     if (this.read(id)) throw new GateAlreadyExists(id);
     const record = {
       id,
@@ -201,7 +359,9 @@ var BaseGateStore = class {
       createdAt: this.nowIso(),
       resolvedAt: void 0,
       expiresAt: toIso(input.expiresAt),
-      resolvedBy: void 0
+      resolvedBy: void 0,
+      rule,
+      ...brief
     };
     this.insert(record);
     return record;
@@ -211,9 +371,10 @@ var BaseGateStore = class {
     return record ? this.lapseIfExpired(record) : void 0;
   }
   resolve(id, payload, resolvedBy) {
-    const resolver = resolvedBy === void 0 ? void 0 : snapshotResolver(id, resolvedBy);
+    if (!resolvedBy) throw new GateResolverRefused(id, void 0, "a resolver is required");
+    const resolver = snapshotResolver(id, resolvedBy);
     const record = this.requirePending(id);
-    this.requireAuthorized(record, resolver);
+    this.requireAuthorized(record, resolver, payload);
     if (record.schema) {
       const issues = checkAgainstJsonSchema(record.schema, payload);
       if (issues.length > 0) throw new GatePayloadInvalid(id, issues);
@@ -238,12 +399,13 @@ var BaseGateStore = class {
     if (record.status !== "pending") throw new GateAlreadySettled(id, record.status);
     return record;
   }
-  /** The default check runs first and `authorize` second, so `authorize` can only narrow who may resolve. */
-  requireAuthorized(record, resolver) {
-    const refusal = resolver ? defaultResolverRefusal(resolver) : void 0;
-    if (resolver && refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);
+  /** The default check (or a listed allowance) runs first, the gate's rule second and `authorize` last, so each can only narrow who may resolve. */
+  requireAuthorized(record, resolver, payload) {
+    const refusal = resolverRefusal(record.id, resolver, payload, this.allowances);
+    if (refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);
+    const ruleRefusal = ruleResolverRefusal(record, resolver);
+    if (ruleRefusal) throw new GateResolverRefused(record.id, resolver.class, ruleRefusal);
     if (!this.authorize) return;
-    if (!resolver) throw new GateResolverRefused(record.id, void 0, "a resolver is required when authorize is installed");
     const decision = readDecision(record.id, this.authorize(Object.freeze({ ...record }), resolver));
     if (!decision.allowed) throw new GateResolverRefused(record.id, resolver.class, decision.reason);
   }
@@ -275,10 +437,24 @@ export {
   GateAborted,
   GateResolverRefused,
   GateStoreSchemaOutdated,
+  GateRuleInvalid,
+  GateBriefInvalid,
   GateAuthorizeInvalid,
+  snapshotBrief,
   checkAgainstJsonSchema,
   defaultResolverRefusal,
+  matchesAllowance,
+  ruleResolverRefusal,
   snapshotResolver,
   BaseGateStore
 };
-//# sourceMappingURL=chunk-4GAZKT6Z.js.map
+/*!
+ * The question bounds and `questionsIssue` are adapted from openrig,
+ * https://github.com/mvschwarz/openrig, packages/daemon/src/domain/human-questions.ts
+ * (parseHumanQuestions). Copyright 2026 Mike Schwarz, licensed under the Apache License 2.0,
+ * http://www.apache.org/licenses/LICENSE-2.0.
+ * Changed here: the checks report through GateBriefInvalid instead of a result union, and
+ * `recommended` keeps only `true`.
+ * @license Apache-2.0
+ */
+//# sourceMappingURL=chunk-TE2NXWWK.js.map

package/dist/chunk-TE2NXWWK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/gate-brief.ts","../src/json-schema.ts","../src/resolver-policy.ts","../src/base-store.ts"],"sourcesContent":["import type { ActorClass, ResolverClass } from \"@titan-design/authority\";\n\n/** A gate is a row, never a promise: pending work survives the process that opened it. */\nexport type GateStatus = \"pending\" | \"resolved\" | \"cancelled\" | \"expired\";\n\n/** A JSON Schema document, stored so any process can validate a payload without the original zod schema. */\nexport type JsonSchema = Record<string, unknown>;\n\nexport interface GateRecord {\n  id: string;\n  prompt: string;\n  schema: JsonSchema | undefined;\n  status: GateStatus;\n  payload: unknown;\n  /** Why the gate was cancelled; unset for every other status. */\n  reason: string | undefined;\n  /** ISO-8601 with milliseconds, the shape store-sqlite writes and any surface can send as-is. */\n  createdAt: string;\n  resolvedAt: string | undefined;\n  expiresAt: string | undefined;\n  /** Who resolved the gate, as claimed by the caller; unset for gates resolved before stores recorded it. */\n  resolvedBy: GateResolver | undefined;\n  /** The authority rule that opened the gate; unset for a gate no rule governs. */\n  rule: GateRule | undefined;\n  /** One line for the owner: the decision and the recommendation. Unset for a gate opened without a brief. */\n  summary: string | undefined;\n  /** Where the owner checks the facts: an https URL, an absolute path, or `$ <command>`. */\n  evidenceRef: string | undefined;\n  /** A fixed menu a surface can render as buttons; the gate's `schema` still validates the answer. */\n  questions: GateQuestion[] | undefined;\n}\n\nexport interface GateQuestionOption {\n  /** 1-40 letters, digits, `-` or `_`; unique within its question. */\n  id: string;\n  /** 1-75 characters, the Slack button limit. */\n  label: string;\n  /** At most one option per question; omitted means false. */\n  recommended?: true;\n}\n\nexport interface GateQuestion {\n  /** 1-40 letters, digits, `-` or `_`; unique within the gate. */\n  id: string;\n  /** 1-500 characters. */\n  question: string;\n  /** 2-4 options. */\n  options: GateQuestionOption[];\n}\n\n/** What the owner reads instead of the machine-facing prompt. A store with `requireBrief` refuses a gate without one. */\nexport interface GateBrief {\n  /** 1-280 characters on one line. */\n  summary: string;\n  /** 1-500 characters on one line. */\n  evidenceRef: string;\n  /** 1-4 questions; absent means the gate's schema alone defines the answer. */\n  questions?: GateQuestion[];\n}\n\n/** Binds a gate to the authority rule that opened it, so only that rule's resolver classes may answer. */\nexport interface GateRule {\n  table: string;\n  version: string;\n  ruleId: string;\n  resolvers: ResolverClass[];\n}\n\n/** A claim about who answered a gate. hitl records it and checks its class; it cannot prove it. */\nexport interface GateResolver {\n  class: ActorClass;\n  id: string;\n  channel: string;\n  /** The channel's own id for the confirming event, such as a chat reaction. */\n  confirmEvent?: string;\n}\n\nexport type GateAuthorization = { allowed: true } | { allowed: false; reason: string };\n\n/**\n * Runs after the default resolver-class check, so it can refuse a resolver but\n * never admit one the default refused. Must return synchronously.\n */\nexport type GateAuthorize = (gate: Readonly<GateRecord>, resolver: Readonly<GateResolver>) => GateAuthorization;\n\n/**\n * One answer a non-owner class may give, declared by the product when it builds the store.\n * It admits exactly: `resolverClass`, a gate whose step is `stepId` (a bare id or `<id>:<n>` after\n * the last `/`), and a payload deep-equal to `payload`. Evaluated in place of the default refusal for\n * those gates only; the gate's rule and `authorize` still run after it. The resolver's id must be non-blank.\n */\nexport interface GateAnswerAllowance {\n  resolverClass: ActorClass;\n  stepId: string;\n  payload: Readonly<Record<string, unknown>>;\n}\n\nexport interface GateInput {\n  /** Defaults to a random UUID. Supply one to make the gate addressable by a name you already own. */\n  id?: string;\n  prompt: string;\n  schema?: JsonSchema;\n  expiresAt?: Date | string;\n  rule?: GateRule;\n  /** Required, with `evidenceRef`, when the store has `requireBrief`. */\n  summary?: string;\n  evidenceRef?: string;\n  questions?: GateQuestion[];\n}\n\n/**\n * Synchronous on purpose: both implementations are local (a Map, and\n * better-sqlite3), and `wait` is the only thing that needs to be async.\n */\nexport interface GateStore {\n  create(input: GateInput): GateRecord;\n  get(id: string): GateRecord | undefined;\n  resolve(id: string, payload: unknown, resolvedBy: GateResolver): GateRecord;\n  cancel(id: string, reason: string): GateRecord;\n  listPending(): GateRecord[];\n}\n\nexport class GateError extends Error {\n  constructor(\n    message: string,\n    readonly gateId: string,\n  ) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\nexport class GateNotFound extends GateError {\n  constructor(gateId: string) {\n    super(`no gate with id ${gateId}`, gateId);\n  }\n}\n\nexport class GateAlreadyExists extends GateError {\n  constructor(gateId: string) {\n    super(`a gate with id ${gateId} already exists`, gateId);\n  }\n}\n\nexport class GateAlreadySettled extends GateError {\n  constructor(\n    gateId: string,\n    readonly status: GateStatus,\n  ) {\n    super(`gate ${gateId} is already ${status}`, gateId);\n  }\n}\n\nexport class GateCancelled extends GateError {\n  constructor(\n    gateId: string,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} was cancelled: ${reason}`, gateId);\n  }\n}\n\nexport class GateExpired extends GateError {\n  constructor(gateId: string) {\n    super(`gate ${gateId} expired before anyone resolved it`, gateId);\n  }\n}\n\nexport class GatePayloadInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly issues: string[],\n  ) {\n    super(`payload for gate ${gateId} does not match its schema: ${issues.join(\"; \")}`, gateId);\n  }\n}\n\nexport class GateAborted extends GateError {\n  constructor(gateId: string, reason: string) {\n    super(`stopped waiting on gate ${gateId}: ${reason}`, gateId);\n  }\n}\n\nexport class GateResolverRefused extends GateError {\n  constructor(\n    gateId: string,\n    readonly actorClass: string | undefined,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} refused a resolution by ${actorClass ?? \"an unnamed resolver\"}: ${reason}`, gateId);\n  }\n}\n\n/**\n * The store cannot record a resolver or a rule because its table predates the migration that adds the column.\n * `gateId` is empty when the store refuses at construction, before any gate is named.\n */\nexport class GateStoreSchemaOutdated extends GateError {\n  constructor(\n    gateId: string,\n    readonly table: string,\n    readonly migration: string,\n  ) {\n    const message =\n      gateId === \"\"\n        ? `cannot open a gate store on table ${table}: it needs ${migration}`\n        : `gate ${gateId} cannot be recorded: table ${table} needs ${migration}`;\n    super(message, gateId);\n  }\n}\n\nexport class GateRuleInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly reason: string,\n  ) {\n    super(`gate ${gateId} has an invalid rule: ${reason}`, gateId);\n  }\n}\n\nexport class GateBriefInvalid extends GateError {\n  constructor(\n    gateId: string,\n    readonly issues: string[],\n  ) {\n    super(`gate ${gateId} brief is invalid: ${issues.join(\"; \")}`, gateId);\n  }\n}\n\nexport class GateAuthorizeInvalid extends GateError {\n  constructor(gateId: string) {\n    super(`authorize for gate ${gateId} must return a decision { allowed: boolean } synchronously`, gateId);\n  }\n}\n","/*!\n * The question bounds and `questionsIssue` are adapted from openrig,\n * https://github.com/mvschwarz/openrig, packages/daemon/src/domain/human-questions.ts\n * (parseHumanQuestions). Copyright 2026 Mike Schwarz, licensed under the Apache License 2.0,\n * http://www.apache.org/licenses/LICENSE-2.0.\n * Changed here: the checks report through GateBriefInvalid instead of a result union, and\n * `recommended` keeps only `true`.\n * @license Apache-2.0\n */\nimport { GateBriefInvalid, type GateQuestion, type GateQuestionOption } from \"./types.js\";\n\nconst MAX_SUMMARY = 280;\nconst MAX_EVIDENCE_REF = 500;\nconst MAX_QUESTIONS = 4;\nconst MIN_OPTIONS = 2;\nconst MAX_OPTIONS = 4;\n/** Slack's button text limit, so every option fits on a button. */\nconst MAX_OPTION_LABEL = 75;\nconst MAX_QUESTION_TEXT = 500;\n\nconst ID_PATTERN = /^[A-Za-z0-9_-]{1,40}$/;\nconst ID_RULE = 'id must be 1-40 letters, digits, \"-\" or \"_\"';\n// eslint-disable-next-line no-control-regex -- a control character is exactly what a one-line field refuses\nconst CONTROL_CHAR = /[\\u0000-\\u001f\\u007f]/;\n\nexport interface GateBriefSnapshot {\n  summary: string | undefined;\n  evidenceRef: string | undefined;\n  questions: GateQuestion[] | undefined;\n}\n\n/**\n * Checks the brief fields and returns a copy holding only the declared ones, so a caller\n * cannot change the stored questions after `create`. `required` makes `summary` and `evidenceRef` mandatory; without it they are still checked when present.\n */\nexport function snapshotBrief(gateId: string, raw: unknown, required: boolean): Readonly<GateBriefSnapshot> {\n  const { summary, evidenceRef, questions } = (raw ?? {}) as Record<string, unknown>;\n  const issues = [\n    ...lineIssues(\"summary\", summary, MAX_SUMMARY, required),\n    ...lineIssues(\"evidenceRef\", evidenceRef, MAX_EVIDENCE_REF, required),\n  ];\n  const questionIssue = questions === undefined ? undefined : questionsIssue(questions);\n  if (questionIssue) issues.push(questionIssue);\n  if (issues.length > 0) throw new GateBriefInvalid(gateId, issues);\n  return Object.freeze({\n    summary: summary as string | undefined,\n    evidenceRef: evidenceRef as string | undefined,\n    questions: questions === undefined ? undefined : copyQuestions(questions as GateQuestion[]),\n  });\n}\n\nfunction lineIssues(field: string, value: unknown, max: number, required: boolean): string[] {\n  if (value === undefined) return required ? [`${field} is required`] : [];\n  if (typeof value !== \"string\") return [`${field} must be a string`];\n  if (value.trim() === \"\") return [`${field} is blank`];\n  if (value.length > max) return [`${field} is over ${max} characters`];\n  if (CONTROL_CHAR.test(value)) return [`${field} must be one line with no control characters`];\n  return [];\n}\n\nfunction questionsIssue(value: unknown): string | undefined {\n  if (!Array.isArray(value)) return \"questions must be an array\";\n  if (value.length < 1 || value.length > MAX_QUESTIONS) return `ask 1 to ${MAX_QUESTIONS} questions (got ${value.length})`;\n  const ids = new Set<string>();\n  for (const [index, raw] of value.entries()) {\n    const question = (raw ?? {}) as Record<string, unknown>;\n    const where = `question ${index + 1}`;\n    if (typeof question.id !== \"string\" || !ID_PATTERN.test(question.id)) return `${where}: ${ID_RULE}`;\n    if (ids.has(question.id)) return `${where}: duplicate question id \"${question.id}\"`;\n    ids.add(question.id);\n    const issue = questionTextIssue(question.question) ?? optionsIssue(question.options);\n    if (issue) return `${where}: ${issue}`;\n  }\n  return undefined;\n}\n\nfunction questionTextIssue(text: unknown): string | undefined {\n  if (typeof text !== \"string\" || text.trim() === \"\") return \"question text is required\";\n  if (text.length > MAX_QUESTION_TEXT) return `question text is over ${MAX_QUESTION_TEXT} characters`;\n  return undefined;\n}\n\nfunction optionsIssue(options: unknown): string | undefined {\n  if (!Array.isArray(options) || options.length < MIN_OPTIONS || options.length > MAX_OPTIONS) {\n    return `give ${MIN_OPTIONS} to ${MAX_OPTIONS} options`;\n  }\n  const ids = new Set<string>();\n  let recommended = 0;\n  for (const [index, raw] of options.entries()) {\n    const option = (raw ?? {}) as Record<string, unknown>;\n    const issue = optionIssue(option, ids);\n    if (issue) return `option ${index + 1}: ${issue}`;\n    ids.add(option.id as string);\n    if (option.recommended === true) recommended++;\n  }\n  return recommended > 1 ? \"mark at most one option as recommended\" : undefined;\n}\n\nfunction optionIssue(option: Record<string, unknown>, seen: ReadonlySet<string>): string | undefined {\n  if (typeof option.id !== \"string\" || !ID_PATTERN.test(option.id)) return ID_RULE;\n  if (seen.has(option.id)) return `duplicate option id \"${option.id}\"`;\n  if (typeof option.label !== \"string\" || option.label.trim() === \"\") return \"label is required\";\n  if (option.label.length > MAX_OPTION_LABEL) return `label is over ${MAX_OPTION_LABEL} characters`;\n  if (option.recommended !== undefined && typeof option.recommended !== \"boolean\") return \"recommended must be true or false\";\n  return undefined;\n}\n\n/** Keeps only the declared fields, so nothing a caller attached rides along into the row. */\nfunction copyQuestions(questions: readonly GateQuestion[]): GateQuestion[] {\n  return questions.map((question) => ({\n    id: question.id,\n    question: question.question,\n    options: question.options.map(copyOption),\n  }));\n}\n\nfunction copyOption(option: GateQuestionOption): GateQuestionOption {\n  return option.recommended === true ? { id: option.id, label: option.label, recommended: true } : { id: option.id, label: option.label };\n}\n","import type { JsonSchema } from \"./types.js\";\n\n/**\n * A deliberately small structural check over the JSON Schema subset `z.toJSONSchema`\n * emits. It exists so the process that resolves a gate can reject a bad payload\n * without holding the original zod schema, which by definition lives in another\n * process. The waiter still re-validates with the real zod schema, so this is the\n * boundary check, not the type guarantee.\n */\nexport function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path = \"$\"): string[] {\n  const issues: string[] = [];\n  collect(schema, value, path, issues);\n  return issues;\n}\n\nfunction collect(schema: JsonSchema, value: unknown, path: string, issues: string[]): void {\n  if (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf)) {\n    checkUnion((schema.anyOf ?? schema.oneOf) as JsonSchema[], value, path, issues);\n    return;\n  }\n  if (\"const\" in schema && !Object.is(schema.const, value)) {\n    issues.push(`${path}: expected ${JSON.stringify(schema.const)}`);\n    return;\n  }\n  if (Array.isArray(schema.enum) && !schema.enum.some((option) => Object.is(option, value))) {\n    issues.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);\n    return;\n  }\n  if (typeof schema.type !== \"string\") return;\n  if (!matchesType(schema.type, value)) {\n    issues.push(`${path}: expected ${schema.type}, received ${describe(value)}`);\n    return;\n  }\n  if (schema.type === \"object\") checkObject(schema, value as Record<string, unknown>, path, issues);\n  if (schema.type === \"array\") checkArray(schema, value as unknown[], path, issues);\n}\n\nfunction checkUnion(branches: JsonSchema[], value: unknown, path: string, issues: string[]): void {\n  const matched = branches.some((branch) => checkAgainstJsonSchema(branch, value, path).length === 0);\n  if (!matched) issues.push(`${path}: matched none of the ${branches.length} allowed shapes`);\n}\n\nfunction checkObject(schema: JsonSchema, value: Record<string, unknown>, path: string, issues: string[]): void {\n  const properties = (schema.properties ?? {}) as Record<string, JsonSchema>;\n  for (const key of (schema.required ?? []) as string[]) {\n    if (!(key in value)) issues.push(`${path}.${key}: required`);\n  }\n  if (schema.additionalProperties === false) {\n    for (const key of Object.keys(value)) {\n      if (!(key in properties)) issues.push(`${path}.${key}: unexpected property`);\n    }\n  }\n  for (const [key, sub] of Object.entries(properties)) {\n    if (key in value) collect(sub, value[key], `${path}.${key}`, issues);\n  }\n}\n\nfunction checkArray(schema: JsonSchema, value: unknown[], path: string, issues: string[]): void {\n  const items = schema.items as JsonSchema | undefined;\n  if (!items) return;\n  value.forEach((entry, index) => collect(items, entry, `${path}[${index}]`, issues));\n}\n\nfunction matchesType(type: string, value: unknown): boolean {\n  switch (type) {\n    case \"object\":\n      return typeof value === \"object\" && value !== null && !Array.isArray(value);\n    case \"array\":\n      return Array.isArray(value);\n    case \"integer\":\n      return Number.isInteger(value);\n    case \"number\":\n      return typeof value === \"number\" && Number.isFinite(value);\n    case \"null\":\n      return value === null;\n    default:\n      return typeof value === type;\n  }\n}\n\nfunction describe(value: unknown): string {\n  if (value === null) return \"null\";\n  return Array.isArray(value) ? \"array\" : typeof value;\n}\n","import { ACTOR_CLASSES, RESOLVER_CLASSES, type ActorClass, type ResolverClass } from \"@titan-design/authority\";\nimport {\n  GateAuthorizeInvalid,\n  GateResolverRefused,\n  GateRuleInvalid,\n  type GateAnswerAllowance,\n  type GateAuthorization,\n  type GateRecord,\n  type GateResolver,\n  type GateRule,\n} from \"./types.js\";\n\n/**\n * The default refusal: only an owner class may resolve a gate, so an agent or\n * automation never answers its own gate. Every store applies it before `authorize`.\n */\nexport function defaultResolverRefusal(resolver: GateResolver): string | undefined {\n  if ((RESOLVER_CLASSES as readonly string[]).includes(resolver.class)) return undefined;\n  return `actor class ${resolver.class} may not resolve a gate`;\n}\n\n/** Reads each allowance once into a frozen deep copy, so a caller cannot widen the list after the store is built. */\nexport function snapshotAllowances(raw: readonly GateAnswerAllowance[] | undefined): readonly GateAnswerAllowance[] {\n  return Object.freeze(\n    (raw ?? []).map(({ resolverClass, stepId, payload }) =>\n      Object.freeze({ resolverClass, stepId, payload: Object.freeze(structuredClone(payload)) }),\n    ),\n  );\n}\n\n/**\n * Like `defaultResolverRefusal`, but a listed (class, step, payload) triple is admitted. Anything not\n * listed gets the default refusal unchanged.\n */\nexport function resolverRefusal(\n  gateId: string,\n  resolver: GateResolver,\n  payload: unknown,\n  allowances: readonly GateAnswerAllowance[],\n): string | undefined {\n  const refusal = defaultResolverRefusal(resolver);\n  if (refusal === undefined) return undefined;\n  if (!matchesAllowance(allowances, gateId, resolver, payload)) return refusal;\n  return resolver.id.trim() === \"\" ? `actor class ${resolver.class} must name itself to resolve this gate` : undefined;\n}\n\n/** True when an allowance names this resolver's class, the gate's step and exactly this payload. The store and its callers share this test. */\nexport function matchesAllowance(allowances: readonly GateAnswerAllowance[], gateId: string, resolver: GateResolver, payload: unknown): boolean {\n  return allowances.some((a) => a.resolverClass === resolver.class && stepOf(gateId) === a.stepId && jsonEqual(payload, a.payload));\n}\n\n/** Deep equality over plain JSON data (objects, arrays, primitives); anything else, such as a class instance, is unequal. */\nfunction jsonEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (typeof a !== \"object\" || typeof b !== \"object\" || a === null || b === null) return false;\n  if (Array.isArray(a) !== Array.isArray(b)) return false;\n  const proto = Object.getPrototypeOf(a) as unknown;\n  if (proto !== Object.getPrototypeOf(b) || (proto !== Object.prototype && proto !== Array.prototype && proto !== null)) return false;\n  const keys = Object.keys(a);\n  if (keys.length !== Object.keys(b).length) return false;\n  return keys.every((key) => Object.hasOwn(b, key) && jsonEqual((a as Record<string, unknown>)[key], (b as Record<string, unknown>)[key]));\n}\n\n/** The step id of a gate id: the text after the last `/`, without a repeat suffix `:<n>`. */\nfunction stepOf(gateId: string): string {\n  return gateId.slice(gateId.lastIndexOf(\"/\") + 1).replace(/:\\d+$/, \"\");\n}\n\n/** A rule-bound gate admits only its rule's resolver classes. Runs after the default refusal, so it only narrows. */\nexport function ruleResolverRefusal(record: GateRecord, resolver: GateResolver): string | undefined {\n  if (!record.rule) return undefined;\n  if ((record.rule.resolvers as readonly string[]).includes(resolver.class)) return undefined;\n  return `rule ${record.rule.ruleId} does not let ${resolver.class} resolve this gate`;\n}\n\n/** Reads each declared rule field once into a frozen copy, so a caller cannot widen the rule after `create`. */\nexport function snapshotRule(gateId: string, raw: unknown): Readonly<GateRule> {\n  if (typeof raw !== \"object\" || raw === null) throw new GateRuleInvalid(gateId, \"the rule is not an object\");\n  const { table, version, ruleId, resolvers } = raw as Record<string, unknown>;\n  if (typeof table !== \"string\" || typeof version !== \"string\" || typeof ruleId !== \"string\") {\n    throw new GateRuleInvalid(gateId, \"the rule's table, version and ruleId must be strings\");\n  }\n  const classes = Array.isArray(resolvers) ? [...(resolvers as unknown[])] : [];\n  if (classes.length === 0 || !classes.every(isResolverClass)) {\n    throw new GateRuleInvalid(gateId, \"the rule's resolvers must be a non-empty list of resolver classes\");\n  }\n  return Object.freeze({ table, version, ruleId, resolvers: Object.freeze(classes) as ResolverClass[] });\n}\n\n/**\n * Reads each declared field exactly once into a frozen plain object, so the\n * checks and the stored row see the same resolver and nothing undeclared is kept.\n */\nexport function snapshotResolver(gateId: string, raw: unknown): Readonly<GateResolver> {\n  if (typeof raw !== \"object\" || raw === null) throw new GateResolverRefused(gateId, undefined, \"the resolver is not an object\");\n  const { class: actorClass, id, channel, confirmEvent } = raw as Record<string, unknown>;\n  if (!isActorClass(actorClass)) {\n    throw new GateResolverRefused(gateId, undefined, \"the resolver's class is not a known actor class\");\n  }\n  if (typeof id !== \"string\" || typeof channel !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's id and channel must be strings\");\n  }\n  if (confirmEvent === undefined) return Object.freeze({ class: actorClass, id, channel });\n  if (typeof confirmEvent !== \"string\") {\n    throw new GateResolverRefused(gateId, actorClass, \"the resolver's confirmEvent must be a string\");\n  }\n  return Object.freeze({ class: actorClass, id, channel, confirmEvent });\n}\n\n/** Accepts only a synchronous `{ allowed: boolean }`; a promise is refused because the row cannot wait on it. */\nexport function readDecision(gateId: string, decision: unknown): GateAuthorization {\n  if (typeof decision !== \"object\" || decision === null) throw new GateAuthorizeInvalid(gateId);\n  const { then, allowed, reason } = decision as Record<string, unknown>;\n  if (typeof then === \"function\") {\n    (then as (onFulfilled: undefined, onRejected: () => void) => unknown).call(decision, undefined, () => {});\n    throw new GateAuthorizeInvalid(gateId);\n  }\n  if (typeof allowed !== \"boolean\") throw new GateAuthorizeInvalid(gateId);\n  if (allowed) return { allowed: true };\n  return { allowed: false, reason: typeof reason === \"string\" ? reason : \"authorize refused the resolver\" };\n}\n\nfunction isResolverClass(value: unknown): value is ResolverClass {\n  return typeof value === \"string\" && (RESOLVER_CLASSES as readonly string[]).includes(value);\n}\n\nfunction isActorClass(value: unknown): value is ActorClass {\n  return typeof value === \"string\" && (ACTOR_CLASSES as readonly string[]).includes(value);\n}\n","import { snapshotBrief } from \"./gate-brief.js\";\nimport { checkAgainstJsonSchema } from \"./json-schema.js\";\nimport { readDecision, resolverRefusal, ruleResolverRefusal, snapshotAllowances, snapshotResolver, snapshotRule } from \"./resolver-policy.js\";\nimport {\n  GateAlreadyExists,\n  GateAlreadySettled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  GateResolverRefused,\n  type GateAnswerAllowance,\n  type GateAuthorize,\n  type GateInput,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\n/**\n * Every settle rule lives here so the memory and SQLite stores cannot drift\n * apart. Subclasses only move rows.\n */\nexport abstract class BaseGateStore implements GateStore {\n  protected constructor(\n    protected readonly clock: () => number,\n    private readonly authorize?: GateAuthorize,\n    private readonly requireBrief = false,\n    allowances?: readonly GateAnswerAllowance[],\n  ) {\n    this.allowances = snapshotAllowances(allowances);\n  }\n\n  private readonly allowances: readonly GateAnswerAllowance[];\n\n  protected abstract insert(record: GateRecord): void;\n  protected abstract read(id: string): GateRecord | undefined;\n  protected abstract update(record: GateRecord): void;\n  protected abstract readByStatus(status: GateRecord[\"status\"]): GateRecord[];\n\n  create(input: GateInput): GateRecord {\n    const id = input.id ?? globalThis.crypto.randomUUID();\n    const rule = input.rule === undefined ? undefined : snapshotRule(id, input.rule);\n    const brief = snapshotBrief(id, input, this.requireBrief);\n    if (this.read(id)) throw new GateAlreadyExists(id);\n    const record: GateRecord = {\n      id,\n      prompt: input.prompt,\n      schema: input.schema,\n      status: \"pending\",\n      payload: undefined,\n      reason: undefined,\n      createdAt: this.nowIso(),\n      resolvedAt: undefined,\n      expiresAt: toIso(input.expiresAt),\n      resolvedBy: undefined,\n      rule,\n      ...brief,\n    };\n    this.insert(record);\n    return record;\n  }\n\n  get(id: string): GateRecord | undefined {\n    const record = this.read(id);\n    return record ? this.lapseIfExpired(record) : undefined;\n  }\n\n  resolve(id: string, payload: unknown, resolvedBy: GateResolver): GateRecord {\n    if (!resolvedBy) throw new GateResolverRefused(id, undefined, \"a resolver is required\");\n    const resolver = snapshotResolver(id, resolvedBy);\n    const record = this.requirePending(id);\n    this.requireAuthorized(record, resolver, payload);\n    if (record.schema) {\n      const issues = checkAgainstJsonSchema(record.schema, payload);\n      if (issues.length > 0) throw new GatePayloadInvalid(id, issues);\n    }\n    const resolved: GateRecord = { ...record, status: \"resolved\", payload, resolvedAt: this.nowIso(), resolvedBy: resolver };\n    this.update(resolved);\n    return resolved;\n  }\n\n  cancel(id: string, reason: string): GateRecord {\n    const record = this.requirePending(id);\n    const cancelled: GateRecord = { ...record, status: \"cancelled\", reason, resolvedAt: this.nowIso() };\n    this.update(cancelled);\n    return cancelled;\n  }\n\n  listPending(): GateRecord[] {\n    return this.readByStatus(\"pending\")\n      .map((record) => this.lapseIfExpired(record))\n      .filter((record) => record.status === \"pending\")\n      .sort((a, b) => a.createdAt.localeCompare(b.createdAt));\n  }\n\n  private requirePending(id: string): GateRecord {\n    const record = this.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"expired\") throw new GateExpired(id);\n    if (record.status !== \"pending\") throw new GateAlreadySettled(id, record.status);\n    return record;\n  }\n\n  /** The default check (or a listed allowance) runs first, the gate's rule second and `authorize` last, so each can only narrow who may resolve. */\n  private requireAuthorized(record: GateRecord, resolver: Readonly<GateResolver>, payload: unknown): void {\n    const refusal = resolverRefusal(record.id, resolver, payload, this.allowances);\n    if (refusal) throw new GateResolverRefused(record.id, resolver.class, refusal);\n    const ruleRefusal = ruleResolverRefusal(record, resolver);\n    if (ruleRefusal) throw new GateResolverRefused(record.id, resolver.class, ruleRefusal);\n    if (!this.authorize) return;\n    const decision = readDecision(record.id, this.authorize(Object.freeze({ ...record }), resolver));\n    if (!decision.allowed) throw new GateResolverRefused(record.id, resolver.class, decision.reason);\n  }\n\n  /** Expiry is lazy: nothing sweeps the table, so a read is what notices the deadline passed. */\n  private lapseIfExpired(record: GateRecord): GateRecord {\n    if (record.status !== \"pending\" || !record.expiresAt) return record;\n    if (Date.parse(record.expiresAt) > this.clock()) return record;\n    const expired: GateRecord = { ...record, status: \"expired\", resolvedAt: this.nowIso() };\n    this.update(expired);\n    return expired;\n  }\n\n  protected nowIso(): string {\n    return new Date(this.clock()).toISOString();\n  }\n}\n\nfunction toIso(value: Date | string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  return typeof value === \"string\" ? value : value.toISOString();\n}\n"],"mappings":";AA0HO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO,WAAW;AAAA,EACzB;AAAA,EAJW;AAKb;AAEO,IAAM,eAAN,cAA2B,UAAU;AAAA,EAC1C,YAAY,QAAgB;AAC1B,UAAM,mBAAmB,MAAM,IAAI,MAAM;AAAA,EAC3C;AACF;AAEO,IAAM,oBAAN,cAAgC,UAAU;AAAA,EAC/C,YAAY,QAAgB;AAC1B,UAAM,kBAAkB,MAAM,mBAAmB,MAAM;AAAA,EACzD;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,eAAe,MAAM,IAAI,MAAM;AAF1C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,gBAAN,cAA4B,UAAU;AAAA,EAC3C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,mBAAmB,MAAM,IAAI,MAAM;AAF9C;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB;AAC1B,UAAM,QAAQ,MAAM,sCAAsC,MAAM;AAAA,EAClE;AACF;AAEO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YACE,QACS,QACT;AACA,UAAM,oBAAoB,MAAM,+BAA+B,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM;AAFjF;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,cAAN,cAA0B,UAAU;AAAA,EACzC,YAAY,QAAgB,QAAgB;AAC1C,UAAM,2BAA2B,MAAM,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,IAAM,sBAAN,cAAkC,UAAU;AAAA,EACjD,YACE,QACS,YACA,QACT;AACA,UAAM,QAAQ,MAAM,4BAA4B,cAAc,qBAAqB,KAAK,MAAM,IAAI,MAAM;AAH/F;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAIb;AAMO,IAAM,0BAAN,cAAsC,UAAU;AAAA,EACrD,YACE,QACS,OACA,WACT;AACA,UAAM,UACJ,WAAW,KACP,qCAAqC,KAAK,cAAc,SAAS,KACjE,QAAQ,MAAM,8BAA8B,KAAK,UAAU,SAAS;AAC1E,UAAM,SAAS,MAAM;AAPZ;AACA;AAAA,EAOX;AAAA,EARW;AAAA,EACA;AAQb;AAEO,IAAM,kBAAN,cAA8B,UAAU;AAAA,EAC7C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,yBAAyB,MAAM,IAAI,MAAM;AAFpD;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,mBAAN,cAA+B,UAAU;AAAA,EAC9C,YACE,QACS,QACT;AACA,UAAM,QAAQ,MAAM,sBAAsB,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM;AAF5D;AAAA,EAGX;AAAA,EAHW;AAIb;AAEO,IAAM,uBAAN,cAAmC,UAAU;AAAA,EAClD,YAAY,QAAgB;AAC1B,UAAM,sBAAsB,MAAM,8DAA8D,MAAM;AAAA,EACxG;AACF;;;AC9NA,IAAM,cAAc;AACpB,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,cAAc;AACpB,IAAM,cAAc;AAEpB,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAE1B,IAAM,aAAa;AACnB,IAAM,UAAU;AAEhB,IAAM,eAAe;AAYd,SAAS,cAAc,QAAgB,KAAc,UAAgD;AAC1G,QAAM,EAAE,SAAS,aAAa,UAAU,IAAK,OAAO,CAAC;AACrD,QAAM,SAAS;AAAA,IACb,GAAG,WAAW,WAAW,SAAS,aAAa,QAAQ;AAAA,IACvD,GAAG,WAAW,eAAe,aAAa,kBAAkB,QAAQ;AAAA,EACtE;AACA,QAAM,gBAAgB,cAAc,SAAY,SAAY,eAAe,SAAS;AACpF,MAAI,cAAe,QAAO,KAAK,aAAa;AAC5C,MAAI,OAAO,SAAS,EAAG,OAAM,IAAI,iBAAiB,QAAQ,MAAM;AAChE,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,WAAW,cAAc,SAAY,SAAY,cAAc,SAA2B;AAAA,EAC5F,CAAC;AACH;AAEA,SAAS,WAAW,OAAe,OAAgB,KAAa,UAA6B;AAC3F,MAAI,UAAU,OAAW,QAAO,WAAW,CAAC,GAAG,KAAK,cAAc,IAAI,CAAC;AACvE,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC,GAAG,KAAK,mBAAmB;AAClE,MAAI,MAAM,KAAK,MAAM,GAAI,QAAO,CAAC,GAAG,KAAK,WAAW;AACpD,MAAI,MAAM,SAAS,IAAK,QAAO,CAAC,GAAG,KAAK,YAAY,GAAG,aAAa;AACpE,MAAI,aAAa,KAAK,KAAK,EAAG,QAAO,CAAC,GAAG,KAAK,8CAA8C;AAC5F,SAAO,CAAC;AACV;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,SAAS,KAAK,MAAM,SAAS,cAAe,QAAO,YAAY,aAAa,mBAAmB,MAAM,MAAM;AACrH,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,CAAC,OAAO,GAAG,KAAK,MAAM,QAAQ,GAAG;AAC1C,UAAM,WAAY,OAAO,CAAC;AAC1B,UAAM,QAAQ,YAAY,QAAQ,CAAC;AACnC,QAAI,OAAO,SAAS,OAAO,YAAY,CAAC,WAAW,KAAK,SAAS,EAAE,EAAG,QAAO,GAAG,KAAK,KAAK,OAAO;AACjG,QAAI,IAAI,IAAI,SAAS,EAAE,EAAG,QAAO,GAAG,KAAK,4BAA4B,SAAS,EAAE;AAChF,QAAI,IAAI,SAAS,EAAE;AACnB,UAAM,QAAQ,kBAAkB,SAAS,QAAQ,KAAK,aAAa,SAAS,OAAO;AACnF,QAAI,MAAO,QAAO,GAAG,KAAK,KAAK,KAAK;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAmC;AAC5D,MAAI,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,GAAI,QAAO;AAC3D,MAAI,KAAK,SAAS,kBAAmB,QAAO,yBAAyB,iBAAiB;AACtF,SAAO;AACT;AAEA,SAAS,aAAa,SAAsC;AAC1D,MAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,eAAe,QAAQ,SAAS,aAAa;AAC3F,WAAO,QAAQ,WAAW,OAAO,WAAW;AAAA,EAC9C;AACA,QAAM,MAAM,oBAAI,IAAY;AAC5B,MAAI,cAAc;AAClB,aAAW,CAAC,OAAO,GAAG,KAAK,QAAQ,QAAQ,GAAG;AAC5C,UAAM,SAAU,OAAO,CAAC;AACxB,UAAM,QAAQ,YAAY,QAAQ,GAAG;AACrC,QAAI,MAAO,QAAO,UAAU,QAAQ,CAAC,KAAK,KAAK;AAC/C,QAAI,IAAI,OAAO,EAAY;AAC3B,QAAI,OAAO,gBAAgB,KAAM;AAAA,EACnC;AACA,SAAO,cAAc,IAAI,2CAA2C;AACtE;AAEA,SAAS,YAAY,QAAiC,MAA+C;AACnG,MAAI,OAAO,OAAO,OAAO,YAAY,CAAC,WAAW,KAAK,OAAO,EAAE,EAAG,QAAO;AACzE,MAAI,KAAK,IAAI,OAAO,EAAE,EAAG,QAAO,wBAAwB,OAAO,EAAE;AACjE,MAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,MAAM,GAAI,QAAO;AAC3E,MAAI,OAAO,MAAM,SAAS,iBAAkB,QAAO,iBAAiB,gBAAgB;AACpF,MAAI,OAAO,gBAAgB,UAAa,OAAO,OAAO,gBAAgB,UAAW,QAAO;AACxF,SAAO;AACT;AAGA,SAAS,cAAc,WAAoD;AACzE,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,SAAS;AAAA,IACb,UAAU,SAAS;AAAA,IACnB,SAAS,SAAS,QAAQ,IAAI,UAAU;AAAA,EAC1C,EAAE;AACJ;AAEA,SAAS,WAAW,QAAgD;AAClE,SAAO,OAAO,gBAAgB,OAAO,EAAE,IAAI,OAAO,IAAI,OAAO,OAAO,OAAO,aAAa,KAAK,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO,OAAO,MAAM;AACxI;;;AC7GO,SAAS,uBAAuB,QAAoB,OAAgB,OAAO,KAAe;AAC/F,QAAM,SAAmB,CAAC;AAC1B,UAAQ,QAAQ,OAAO,MAAM,MAAM;AACnC,SAAO;AACT;AAEA,SAAS,QAAQ,QAAoB,OAAgB,MAAc,QAAwB;AACzF,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC9D,eAAY,OAAO,SAAS,OAAO,OAAwB,OAAO,MAAM,MAAM;AAC9E;AAAA,EACF;AACA,MAAI,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG;AACxD,WAAO,KAAK,GAAG,IAAI,cAAc,KAAK,UAAU,OAAO,KAAK,CAAC,EAAE;AAC/D;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,OAAO,GAAG,QAAQ,KAAK,CAAC,GAAG;AACzF,WAAO,KAAK,GAAG,IAAI,qBAAqB,KAAK,UAAU,OAAO,IAAI,CAAC,EAAE;AACrE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,SAAS,SAAU;AACrC,MAAI,CAAC,YAAY,OAAO,MAAM,KAAK,GAAG;AACpC,WAAO,KAAK,GAAG,IAAI,cAAc,OAAO,IAAI,cAAc,SAAS,KAAK,CAAC,EAAE;AAC3E;AAAA,EACF;AACA,MAAI,OAAO,SAAS,SAAU,aAAY,QAAQ,OAAkC,MAAM,MAAM;AAChG,MAAI,OAAO,SAAS,QAAS,YAAW,QAAQ,OAAoB,MAAM,MAAM;AAClF;AAEA,SAAS,WAAW,UAAwB,OAAgB,MAAc,QAAwB;AAChG,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,uBAAuB,QAAQ,OAAO,IAAI,EAAE,WAAW,CAAC;AAClG,MAAI,CAAC,QAAS,QAAO,KAAK,GAAG,IAAI,yBAAyB,SAAS,MAAM,iBAAiB;AAC5F;AAEA,SAAS,YAAY,QAAoB,OAAgC,MAAc,QAAwB;AAC7G,QAAM,aAAc,OAAO,cAAc,CAAC;AAC1C,aAAW,OAAQ,OAAO,YAAY,CAAC,GAAgB;AACrD,QAAI,EAAE,OAAO,OAAQ,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,YAAY;AAAA,EAC7D;AACA,MAAI,OAAO,yBAAyB,OAAO;AACzC,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,EAAE,OAAO,YAAa,QAAO,KAAK,GAAG,IAAI,IAAI,GAAG,uBAAuB;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACnD,QAAI,OAAO,MAAO,SAAQ,KAAK,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM;AAAA,EACrE;AACF;AAEA,SAAS,WAAW,QAAoB,OAAkB,MAAc,QAAwB;AAC9F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO;AACZ,QAAM,QAAQ,CAAC,OAAO,UAAU,QAAQ,OAAO,OAAO,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AACpF;AAEA,SAAS,YAAY,MAAc,OAAyB;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA,IAC5E,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B,KAAK;AACH,aAAO,OAAO,UAAU,KAAK;AAAA,IAC/B,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU;AAAA,IACnB;AACE,aAAO,OAAO,UAAU;AAAA,EAC5B;AACF;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACjD;;;ACnFA,SAAS,eAAe,wBAA6D;AAgB9E,SAAS,uBAAuB,UAA4C;AACjF,MAAK,iBAAuC,SAAS,SAAS,KAAK,EAAG,QAAO;AAC7E,SAAO,eAAe,SAAS,KAAK;AACtC;AAGO,SAAS,mBAAmB,KAAiF;AAClH,SAAO,OAAO;AAAA,KACX,OAAO,CAAC,GAAG;AAAA,MAAI,CAAC,EAAE,eAAe,QAAQ,QAAQ,MAChD,OAAO,OAAO,EAAE,eAAe,QAAQ,SAAS,OAAO,OAAO,gBAAgB,OAAO,CAAC,EAAE,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;AAMO,SAAS,gBACd,QACA,UACA,SACA,YACoB;AACpB,QAAM,UAAU,uBAAuB,QAAQ;AAC/C,MAAI,YAAY,OAAW,QAAO;AAClC,MAAI,CAAC,iBAAiB,YAAY,QAAQ,UAAU,OAAO,EAAG,QAAO;AACrE,SAAO,SAAS,GAAG,KAAK,MAAM,KAAK,eAAe,SAAS,KAAK,2CAA2C;AAC7G;AAGO,SAAS,iBAAiB,YAA4C,QAAgB,UAAwB,SAA2B;AAC9I,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,kBAAkB,SAAS,SAAS,OAAO,MAAM,MAAM,EAAE,UAAU,UAAU,SAAS,EAAE,OAAO,CAAC;AAClI;AAGA,SAAS,UAAU,GAAY,GAAqB;AAClD,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY,MAAM,QAAQ,MAAM,KAAM,QAAO;AACvF,MAAI,MAAM,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AAClD,QAAM,QAAQ,OAAO,eAAe,CAAC;AACrC,MAAI,UAAU,OAAO,eAAe,CAAC,KAAM,UAAU,OAAO,aAAa,UAAU,MAAM,aAAa,UAAU,KAAO,QAAO;AAC9H,QAAM,OAAO,OAAO,KAAK,CAAC;AAC1B,MAAI,KAAK,WAAW,OAAO,KAAK,CAAC,EAAE,OAAQ,QAAO;AAClD,SAAO,KAAK,MAAM,CAAC,QAAQ,OAAO,OAAO,GAAG,GAAG,KAAK,UAAW,EAA8B,GAAG,GAAI,EAA8B,GAAG,CAAC,CAAC;AACzI;AAGA,SAAS,OAAO,QAAwB;AACtC,SAAO,OAAO,MAAM,OAAO,YAAY,GAAG,IAAI,CAAC,EAAE,QAAQ,SAAS,EAAE;AACtE;AAGO,SAAS,oBAAoB,QAAoB,UAA4C;AAClG,MAAI,CAAC,OAAO,KAAM,QAAO;AACzB,MAAK,OAAO,KAAK,UAAgC,SAAS,SAAS,KAAK,EAAG,QAAO;AAClF,SAAO,QAAQ,OAAO,KAAK,MAAM,iBAAiB,SAAS,KAAK;AAClE;AAGO,SAAS,aAAa,QAAgB,KAAkC;AAC7E,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,gBAAgB,QAAQ,2BAA2B;AAC1G,QAAM,EAAE,OAAO,SAAS,QAAQ,UAAU,IAAI;AAC9C,MAAI,OAAO,UAAU,YAAY,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAC1F,UAAM,IAAI,gBAAgB,QAAQ,sDAAsD;AAAA,EAC1F;AACA,QAAM,UAAU,MAAM,QAAQ,SAAS,IAAI,CAAC,GAAI,SAAuB,IAAI,CAAC;AAC5E,MAAI,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,eAAe,GAAG;AAC3D,UAAM,IAAI,gBAAgB,QAAQ,mEAAmE;AAAA,EACvG;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,SAAS,QAAQ,WAAW,OAAO,OAAO,OAAO,EAAqB,CAAC;AACvG;AAMO,SAAS,iBAAiB,QAAgB,KAAsC;AACrF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,oBAAoB,QAAQ,QAAW,+BAA+B;AAC7H,QAAM,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,IAAI;AACzD,MAAI,CAAC,aAAa,UAAU,GAAG;AAC7B,UAAM,IAAI,oBAAoB,QAAQ,QAAW,iDAAiD;AAAA,EACpG;AACA,MAAI,OAAO,OAAO,YAAY,OAAO,YAAY,UAAU;AACzD,UAAM,IAAI,oBAAoB,QAAQ,YAAY,+CAA+C;AAAA,EACnG;AACA,MAAI,iBAAiB,OAAW,QAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,QAAQ,CAAC;AACvF,MAAI,OAAO,iBAAiB,UAAU;AACpC,UAAM,IAAI,oBAAoB,QAAQ,YAAY,8CAA8C;AAAA,EAClG;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,YAAY,IAAI,SAAS,aAAa,CAAC;AACvE;AAGO,SAAS,aAAa,QAAgB,UAAsC;AACjF,MAAI,OAAO,aAAa,YAAY,aAAa,KAAM,OAAM,IAAI,qBAAqB,MAAM;AAC5F,QAAM,EAAE,MAAM,SAAS,OAAO,IAAI;AAClC,MAAI,OAAO,SAAS,YAAY;AAC9B,IAAC,KAAqE,KAAK,UAAU,QAAW,MAAM;AAAA,IAAC,CAAC;AACxG,UAAM,IAAI,qBAAqB,MAAM;AAAA,EACvC;AACA,MAAI,OAAO,YAAY,UAAW,OAAM,IAAI,qBAAqB,MAAM;AACvE,MAAI,QAAS,QAAO,EAAE,SAAS,KAAK;AACpC,SAAO,EAAE,SAAS,OAAO,QAAQ,OAAO,WAAW,WAAW,SAAS,iCAAiC;AAC1G;AAEA,SAAS,gBAAgB,OAAwC;AAC/D,SAAO,OAAO,UAAU,YAAa,iBAAuC,SAAS,KAAK;AAC5F;AAEA,SAAS,aAAa,OAAqC;AACzD,SAAO,OAAO,UAAU,YAAa,cAAoC,SAAS,KAAK;AACzF;;;AC1GO,IAAe,gBAAf,MAAkD;AAAA,EAC7C,YACW,OACF,WACA,eAAe,OAChC,YACA;AAJmB;AACF;AACA;AAGjB,SAAK,aAAa,mBAAmB,UAAU;AAAA,EACjD;AAAA,EANqB;AAAA,EACF;AAAA,EACA;AAAA,EAMF;AAAA,EAOjB,OAAO,OAA8B;AACnC,UAAM,KAAK,MAAM,MAAM,WAAW,OAAO,WAAW;AACpD,UAAM,OAAO,MAAM,SAAS,SAAY,SAAY,aAAa,IAAI,MAAM,IAAI;AAC/E,UAAM,QAAQ,cAAc,IAAI,OAAO,KAAK,YAAY;AACxD,QAAI,KAAK,KAAK,EAAE,EAAG,OAAM,IAAI,kBAAkB,EAAE;AACjD,UAAM,SAAqB;AAAA,MACzB;AAAA,MACA,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW,KAAK,OAAO;AAAA,MACvB,YAAY;AAAA,MACZ,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,YAAY;AAAA,MACZ;AAAA,MACA,GAAG;AAAA,IACL;AACA,SAAK,OAAO,MAAM;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAoC;AACtC,UAAM,SAAS,KAAK,KAAK,EAAE;AAC3B,WAAO,SAAS,KAAK,eAAe,MAAM,IAAI;AAAA,EAChD;AAAA,EAEA,QAAQ,IAAY,SAAkB,YAAsC;AAC1E,QAAI,CAAC,WAAY,OAAM,IAAI,oBAAoB,IAAI,QAAW,wBAAwB;AACtF,UAAM,WAAW,iBAAiB,IAAI,UAAU;AAChD,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,SAAK,kBAAkB,QAAQ,UAAU,OAAO;AAChD,QAAI,OAAO,QAAQ;AACjB,YAAM,SAAS,uBAAuB,OAAO,QAAQ,OAAO;AAC5D,UAAI,OAAO,SAAS,EAAG,OAAM,IAAI,mBAAmB,IAAI,MAAM;AAAA,IAChE;AACA,UAAM,WAAuB,EAAE,GAAG,QAAQ,QAAQ,YAAY,SAAS,YAAY,KAAK,OAAO,GAAG,YAAY,SAAS;AACvH,SAAK,OAAO,QAAQ;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAY,QAA4B;AAC7C,UAAM,SAAS,KAAK,eAAe,EAAE;AACrC,UAAM,YAAwB,EAAE,GAAG,QAAQ,QAAQ,aAAa,QAAQ,YAAY,KAAK,OAAO,EAAE;AAClG,SAAK,OAAO,SAAS;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,cAA4B;AAC1B,WAAO,KAAK,aAAa,SAAS,EAC/B,IAAI,CAAC,WAAW,KAAK,eAAe,MAAM,CAAC,EAC3C,OAAO,CAAC,WAAW,OAAO,WAAW,SAAS,EAC9C,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC;AAAA,EAC1D;AAAA,EAEQ,eAAe,IAAwB;AAC7C,UAAM,SAAS,KAAK,IAAI,EAAE;AAC1B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,mBAAmB,IAAI,OAAO,MAAM;AAC/E,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,kBAAkB,QAAoB,UAAkC,SAAwB;AACtG,UAAM,UAAU,gBAAgB,OAAO,IAAI,UAAU,SAAS,KAAK,UAAU;AAC7E,QAAI,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,OAAO;AAC7E,UAAM,cAAc,oBAAoB,QAAQ,QAAQ;AACxD,QAAI,YAAa,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,WAAW;AACrF,QAAI,CAAC,KAAK,UAAW;AACrB,UAAM,WAAW,aAAa,OAAO,IAAI,KAAK,UAAU,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAC;AAC/F,QAAI,CAAC,SAAS,QAAS,OAAM,IAAI,oBAAoB,OAAO,IAAI,SAAS,OAAO,SAAS,MAAM;AAAA,EACjG;AAAA;AAAA,EAGQ,eAAe,QAAgC;AACrD,QAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAW,QAAO;AAC7D,QAAI,KAAK,MAAM,OAAO,SAAS,IAAI,KAAK,MAAM,EAAG,QAAO;AACxD,UAAM,UAAsB,EAAE,GAAG,QAAQ,QAAQ,WAAW,YAAY,KAAK,OAAO,EAAE;AACtF,SAAK,OAAO,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEU,SAAiB;AACzB,WAAO,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,YAAY;AAAA,EAC5C;AACF;AAEA,SAAS,MAAM,OAAsD;AACnE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM,YAAY;AAC/D;","names":[]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ZodType } from 'zod';
-import { G as GateRecord, a as GateStore, b as GateResolver, B as BaseGateStore, c as GateAuthorize, J as JsonSchema } from './base-store-BvwOJL6M.js';
-export { d as GateAborted, e as GateAlreadyExists, f as GateAlreadySettled, g as GateAuthorization, h as GateAuthorizeInvalid, i as GateCancelled, j as GateError, k as GateExpired, l as GateInput, m as GateNotFound, n as GatePayloadInvalid, o as GateResolverRefused, p as GateStatus, q as GateStoreSchemaOutdated } from './base-store-BvwOJL6M.js';
+import { G as GateRecord, a as GateQuestion, b as GateStore, c as GateResolver, B as BaseGateStore, d as GateAuthorize, e as GateAnswerAllowance, J as JsonSchema } from './base-store-B-IPO0UN.js';
+export { f as GateAborted, g as GateAlreadyExists, h as GateAlreadySettled, i as GateAuthorization, j as GateAuthorizeInvalid, k as GateBrief, l as GateBriefInvalid, m as GateCancelled, n as GateError, o as GateExpired, p as GateInput, q as GateNotFound, r as GatePayloadInvalid, s as GateQuestionOption, t as GateResolverRefused, u as GateRule, v as GateRuleInvalid, w as GateStatus, x as GateStoreSchemaOutdated } from './base-store-B-IPO0UN.js';
 import '@titan-design/authority';
 
 declare const DEFAULT_POLL_MS = 250;
@@ -10,6 +10,10 @@ interface OpenGateOptions<T> {
     /** Stored as JSON Schema so the resolving process can validate without it, and reused here to type the answer. */
     schema?: ZodType<T>;
     expiresAt?: Date | string;
+    /** Required, with `evidenceRef`, when the store has `requireBrief`. */
+    summary?: string;
+    evidenceRef?: string;
+    questions?: GateQuestion[];
 }
 interface WaitOptions<T> {
     pollMs?: number;
@@ -34,7 +38,7 @@ declare function openGate<T = unknown>(store: GateStore, options: OpenGateOption
  */
 declare function waitForGate<T = unknown>(store: GateStore, id: string, options?: WaitOptions<T>): Promise<T>;
 /** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */
-declare function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord;
+declare function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy: GateResolver): GateRecord;
 declare function cancelGate(store: GateStore, id: string, reason: string): GateRecord;
 
 interface MemoryGateStoreOptions {
@@ -42,6 +46,10 @@ interface MemoryGateStoreOptions {
     now?: () => number;
     /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */
     authorize?: GateAuthorize;
+    /** Refuse `create` without a `summary` and an `evidenceRef`. Off by default. */
+    requireBrief?: boolean;
+    /** Answers a non-owner class may give, each exact in class, step and payload. Nothing else widens the default class check. */
+    allowances?: readonly GateAnswerAllowance[];
 }
 /**
  * In-process gates. Right for tests and for a single-process product that only
@@ -62,12 +70,37 @@ declare class MemoryGateStore extends BaseGateStore {
  * automation never answers its own gate. Every store applies it before `authorize`.
  */
 declare function defaultResolverRefusal(resolver: GateResolver): string | undefined;
+/** True when an allowance names this resolver's class, the gate's step and exactly this payload. The store and its callers share this test. */
+declare function matchesAllowance(allowances: readonly GateAnswerAllowance[], gateId: string, resolver: GateResolver, payload: unknown): boolean;
+/** A rule-bound gate admits only its rule's resolver classes. Runs after the default refusal, so it only narrows. */
+declare function ruleResolverRefusal(record: GateRecord, resolver: GateResolver): string | undefined;
 /**
  * Reads each declared field exactly once into a frozen plain object, so the
  * checks and the stored row see the same resolver and nothing undeclared is kept.
  */
 declare function snapshotResolver(gateId: string, raw: unknown): Readonly<GateResolver>;
 
+/*!
+ * The question bounds and `questionsIssue` are adapted from openrig,
+ * https://github.com/mvschwarz/openrig, packages/daemon/src/domain/human-questions.ts
+ * (parseHumanQuestions). Copyright 2026 Mike Schwarz, licensed under the Apache License 2.0,
+ * http://www.apache.org/licenses/LICENSE-2.0.
+ * Changed here: the checks report through GateBriefInvalid instead of a result union, and
+ * `recommended` keeps only `true`.
+ * @license Apache-2.0
+ */
+
+interface GateBriefSnapshot {
+    summary: string | undefined;
+    evidenceRef: string | undefined;
+    questions: GateQuestion[] | undefined;
+}
+/**
+ * Checks the brief fields and returns a copy holding only the declared ones, so a caller
+ * cannot change the stored questions after `create`. `required` makes `summary` and `evidenceRef` mandatory; without it they are still checked when present.
+ */
+declare function snapshotBrief(gateId: string, raw: unknown, required: boolean): Readonly<GateBriefSnapshot>;
+
 /**
  * A deliberately small structural check over the JSON Schema subset `z.toJSONSchema`
  * emits. It exists so the process that resolves a gate can reject a bad payload
@@ -77,4 +110,4 @@ declare function snapshotResolver(gateId: string, raw: unknown): Readonly<GateRe
  */
 declare function checkAgainstJsonSchema(schema: JsonSchema, value: unknown, path?: string): string[];
 
-export { BaseGateStore, DEFAULT_POLL_MS, GateAuthorize, type GateHandle, GateRecord, GateResolver, GateStore, JsonSchema, MemoryGateStore, type MemoryGateStoreOptions, type OpenGateOptions, type WaitOptions, cancelGate, checkAgainstJsonSchema, defaultResolverRefusal, openGate, resolveGate, snapshotResolver, waitForGate };
+export { BaseGateStore, DEFAULT_POLL_MS, GateAnswerAllowance, GateAuthorize, type GateBriefSnapshot, type GateHandle, GateQuestion, GateRecord, GateResolver, GateStore, JsonSchema, MemoryGateStore, type MemoryGateStoreOptions, type OpenGateOptions, type WaitOptions, cancelGate, checkAgainstJsonSchema, defaultResolverRefusal, matchesAllowance, openGate, resolveGate, ruleResolverRefusal, snapshotBrief, snapshotResolver, waitForGate };

package/dist/index.js

@@ -4,17 +4,22 @@ import {
   GateAlreadyExists,
   GateAlreadySettled,
   GateAuthorizeInvalid,
+  GateBriefInvalid,
   GateCancelled,
   GateError,
   GateExpired,
   GateNotFound,
   GatePayloadInvalid,
   GateResolverRefused,
+  GateRuleInvalid,
   GateStoreSchemaOutdated,
   checkAgainstJsonSchema,
   defaultResolverRefusal,
+  matchesAllowance,
+  ruleResolverRefusal,
+  snapshotBrief,
   snapshotResolver
-} from "./chunk-4GAZKT6Z.js";
+} from "./chunk-TE2NXWWK.js";
 
 // src/gate.ts
 import { toJSONSchema } from "zod";
@@ -23,6 +28,9 @@ function openGate(store, options) {
   const input = { prompt: options.prompt };
   if (options.id !== void 0) input.id = options.id;
   if (options.expiresAt !== void 0) input.expiresAt = options.expiresAt;
+  if (options.summary !== void 0) input.summary = options.summary;
+  if (options.evidenceRef !== void 0) input.evidenceRef = options.evidenceRef;
+  if (options.questions !== void 0) input.questions = options.questions;
   if (options.schema) input.schema = toJSONSchema(options.schema);
   const record = store.create(input);
   return {
@@ -81,7 +89,7 @@ function sleep(ms, signal) {
 var MemoryGateStore = class extends BaseGateStore {
   rows = /* @__PURE__ */ new Map();
   constructor(options = {}) {
-    super(options.now ?? Date.now, options.authorize);
+    super(options.now ?? Date.now, options.authorize, options.requireBrief, options.allowances);
   }
   insert(record) {
     this.rows.set(record.id, copy(record));
@@ -98,7 +106,12 @@ var MemoryGateStore = class extends BaseGateStore {
   }
 };
 function copy(record) {
-  return { ...record, resolvedBy: record.resolvedBy && { ...record.resolvedBy } };
+  return {
+    ...record,
+    resolvedBy: record.resolvedBy && { ...record.resolvedBy },
+    rule: record.rule && { ...record.rule, resolvers: [...record.rule.resolvers] },
+    questions: record.questions?.map((question) => ({ ...question, options: question.options.map((option) => ({ ...option })) }))
+  };
 }
 export {
   BaseGateStore,
@@ -107,19 +120,24 @@ export {
   GateAlreadyExists,
   GateAlreadySettled,
   GateAuthorizeInvalid,
+  GateBriefInvalid,
   GateCancelled,
   GateError,
   GateExpired,
   GateNotFound,
   GatePayloadInvalid,
   GateResolverRefused,
+  GateRuleInvalid,
   GateStoreSchemaOutdated,
   MemoryGateStore,
   cancelGate,
   checkAgainstJsonSchema,
   defaultResolverRefusal,
+  matchesAllowance,
   openGate,
   resolveGate,
+  ruleResolverRefusal,
+  snapshotBrief,
   snapshotResolver,
   waitForGate
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/gate.ts","../src/memory-store.ts"],"sourcesContent":["import { toJSONSchema, type ZodType } from \"zod\";\nimport {\n  GateAborted,\n  GateCancelled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\nexport const DEFAULT_POLL_MS = 250;\n\nexport interface OpenGateOptions<T> {\n  id?: string;\n  prompt: string;\n  /** Stored as JSON Schema so the resolving process can validate without it, and reused here to type the answer. */\n  schema?: ZodType<T>;\n  expiresAt?: Date | string;\n}\n\nexport interface WaitOptions<T> {\n  pollMs?: number;\n  signal?: AbortSignal;\n  /** Needed only when re-attaching to a gate this process did not open. */\n  schema?: ZodType<T>;\n}\n\nexport interface GateHandle<T> {\n  id: string;\n  record: GateRecord;\n  wait(options?: Omit<WaitOptions<T>, \"schema\">): Promise<T>;\n}\n\n/**\n * Open a gate and hand back something to await. The row exists before this\n * returns, so a crash here leaves a resolvable gate rather than a lost one.\n */\nexport function openGate<T = unknown>(store: GateStore, options: OpenGateOptions<T>): GateHandle<T> {\n  const input: Parameters<GateStore[\"create\"]>[0] = { prompt: options.prompt };\n  if (options.id !== undefined) input.id = options.id;\n  if (options.expiresAt !== undefined) input.expiresAt = options.expiresAt;\n  if (options.schema) input.schema = toJSONSchema(options.schema) as Record<string, unknown>;\n\n  const record = store.create(input);\n  return {\n    id: record.id,\n    record,\n    wait: (waitOptions = {}) => {\n      const merged: WaitOptions<T> = { ...waitOptions };\n      if (options.schema) merged.schema = options.schema;\n      return waitForGate<T>(store, record.id, merged);\n    },\n  };\n}\n\n/**\n * Await a gate by id from any process, including one that restarted after the\n * gate was opened. Polls rather than subscribes because the resolver may be a\n * different process writing the same SQLite file.\n */\nexport async function waitForGate<T = unknown>(\n  store: GateStore,\n  id: string,\n  options: WaitOptions<T> = {},\n): Promise<T> {\n  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;\n  for (;;) {\n    throwIfAborted(id, options.signal);\n    const record = store.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"resolved\") return validate(record, options.schema);\n    if (record.status === \"cancelled\") throw new GateCancelled(id, record.reason ?? \"no reason given\");\n    if (record.status === \"expired\") throw new GateExpired(id);\n    await sleep(pollMs, options.signal);\n  }\n}\n\n/** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */\nexport function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy?: GateResolver): GateRecord {\n  return store.resolve(id, payload, resolvedBy);\n}\n\nexport function cancelGate(store: GateStore, id: string, reason: string): GateRecord {\n  return store.cancel(id, reason);\n}\n\nfunction validate<T>(record: GateRecord, schema: ZodType<T> | undefined): T {\n  if (!schema) return record.payload as T;\n  const parsed = schema.safeParse(record.payload);\n  if (parsed.success) return parsed.data;\n  throw new GatePayloadInvalid(\n    record.id,\n    parsed.error.issues.map((issue) => `${issue.path.join(\".\") || \"$\"}: ${issue.message}`),\n  );\n}\n\nfunction throwIfAborted(id: string, signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new GateAborted(id, String(signal.reason ?? \"aborted\"));\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve) => {\n    const timer = setTimeout(finish, ms);\n    signal?.addEventListener(\"abort\", finish, { once: true });\n    function finish(): void {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", finish);\n      resolve();\n    }\n  });\n}\n","import { BaseGateStore } from \"./base-store.js\";\nimport type { GateAuthorize, GateRecord } from \"./types.js\";\n\nexport interface MemoryGateStoreOptions {\n  /** Epoch-millis clock, injectable so expiry is testable without waiting. */\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n}\n\n/**\n * In-process gates. Right for tests and for a single-process product that only\n * needs the pause, not the durability; anything that must survive a restart\n * wants `SqliteGateStore`.\n */\nexport class MemoryGateStore extends BaseGateStore {\n  private readonly rows = new Map<string, GateRecord>();\n\n  constructor(options: MemoryGateStoreOptions = {}) {\n    super(options.now ?? Date.now, options.authorize);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.rows.get(id);\n    return row ? copy(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected readByStatus(status: GateRecord[\"status\"]): GateRecord[] {\n    return [...this.rows.values()].filter((row) => row.status === status).map(copy);\n  }\n}\n\n/** `resolvedBy` is nested, so a shallow spread would let a caller rewrite the stored resolver. */\nfunction copy(record: GateRecord): GateRecord {\n  return { ...record, resolvedBy: record.resolvedBy && { ...record.resolvedBy } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAkC;AAYpC,IAAM,kBAAkB;AA2BxB,SAAS,SAAsB,OAAkB,SAA4C;AAClG,QAAM,QAA4C,EAAE,QAAQ,QAAQ,OAAO;AAC3E,MAAI,QAAQ,OAAO,OAAW,OAAM,KAAK,QAAQ;AACjD,MAAI,QAAQ,cAAc,OAAW,OAAM,YAAY,QAAQ;AAC/D,MAAI,QAAQ,OAAQ,OAAM,SAAS,aAAa,QAAQ,MAAM;AAE9D,QAAM,SAAS,MAAM,OAAO,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX;AAAA,IACA,MAAM,CAAC,cAAc,CAAC,MAAM;AAC1B,YAAM,SAAyB,EAAE,GAAG,YAAY;AAChD,UAAI,QAAQ,OAAQ,QAAO,SAAS,QAAQ;AAC5C,aAAO,YAAe,OAAO,OAAO,IAAI,MAAM;AAAA,IAChD;AAAA,EACF;AACF;AAOA,eAAsB,YACpB,OACA,IACA,UAA0B,CAAC,GACf;AACZ,QAAM,SAAS,QAAQ,UAAU;AACjC,aAAS;AACP,mBAAe,IAAI,QAAQ,MAAM;AACjC,UAAM,SAAS,MAAM,IAAI,EAAE;AAC3B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,WAAY,QAAO,SAAS,QAAQ,QAAQ,MAAM;AACxE,QAAI,OAAO,WAAW,YAAa,OAAM,IAAI,cAAc,IAAI,OAAO,UAAU,iBAAiB;AACjG,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,UAAM,MAAM,QAAQ,QAAQ,MAAM;AAAA,EACpC;AACF;AAGO,SAAS,YAAY,OAAkB,IAAY,SAAkB,YAAuC;AACjH,SAAO,MAAM,QAAQ,IAAI,SAAS,UAAU;AAC9C;AAEO,SAAS,WAAW,OAAkB,IAAY,QAA4B;AACnF,SAAO,MAAM,OAAO,IAAI,MAAM;AAChC;AAEA,SAAS,SAAY,QAAoB,QAAmC;AAC1E,MAAI,CAAC,OAAQ,QAAO,OAAO;AAC3B,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO;AAC9C,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IACP,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,MAAM,OAAO,EAAE;AAAA,EACvF;AACF;AAEA,SAAS,eAAe,IAAY,QAAuC;AACzE,MAAI,QAAQ,QAAS,OAAM,IAAI,YAAY,IAAI,OAAO,OAAO,UAAU,SAAS,CAAC;AACnF;AAEA,SAAS,MAAM,IAAY,QAAgD;AACzE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,WAAW,QAAQ,EAAE;AACnC,YAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,aAAS,SAAe;AACtB,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,MAAM;AAC3C,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;ACjGO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAChC,OAAO,oBAAI,IAAwB;AAAA,EAEpD,YAAY,UAAkC,CAAC,GAAG;AAChD,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS;AAAA,EAClD;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,KAAK,IAAI,EAAE;AAC5B,WAAO,MAAM,KAAK,GAAG,IAAI;AAAA,EAC3B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,aAAa,QAA4C;AACjE,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,EAAE,IAAI,IAAI;AAAA,EAChF;AACF;AAGA,SAAS,KAAK,QAAgC;AAC5C,SAAO,EAAE,GAAG,QAAQ,YAAY,OAAO,cAAc,EAAE,GAAG,OAAO,WAAW,EAAE;AAChF;","names":[]}
+{"version":3,"sources":["../src/gate.ts","../src/memory-store.ts"],"sourcesContent":["import { toJSONSchema, type ZodType } from \"zod\";\nimport {\n  GateAborted,\n  GateCancelled,\n  GateExpired,\n  GateNotFound,\n  GatePayloadInvalid,\n  type GateQuestion,\n  type GateRecord,\n  type GateResolver,\n  type GateStore,\n} from \"./types.js\";\n\nexport const DEFAULT_POLL_MS = 250;\n\nexport interface OpenGateOptions<T> {\n  id?: string;\n  prompt: string;\n  /** Stored as JSON Schema so the resolving process can validate without it, and reused here to type the answer. */\n  schema?: ZodType<T>;\n  expiresAt?: Date | string;\n  /** Required, with `evidenceRef`, when the store has `requireBrief`. */\n  summary?: string;\n  evidenceRef?: string;\n  questions?: GateQuestion[];\n}\n\nexport interface WaitOptions<T> {\n  pollMs?: number;\n  signal?: AbortSignal;\n  /** Needed only when re-attaching to a gate this process did not open. */\n  schema?: ZodType<T>;\n}\n\nexport interface GateHandle<T> {\n  id: string;\n  record: GateRecord;\n  wait(options?: Omit<WaitOptions<T>, \"schema\">): Promise<T>;\n}\n\n/**\n * Open a gate and hand back something to await. The row exists before this\n * returns, so a crash here leaves a resolvable gate rather than a lost one.\n */\nexport function openGate<T = unknown>(store: GateStore, options: OpenGateOptions<T>): GateHandle<T> {\n  const input: Parameters<GateStore[\"create\"]>[0] = { prompt: options.prompt };\n  if (options.id !== undefined) input.id = options.id;\n  if (options.expiresAt !== undefined) input.expiresAt = options.expiresAt;\n  if (options.summary !== undefined) input.summary = options.summary;\n  if (options.evidenceRef !== undefined) input.evidenceRef = options.evidenceRef;\n  if (options.questions !== undefined) input.questions = options.questions;\n  if (options.schema) input.schema = toJSONSchema(options.schema) as Record<string, unknown>;\n\n  const record = store.create(input);\n  return {\n    id: record.id,\n    record,\n    wait: (waitOptions = {}) => {\n      const merged: WaitOptions<T> = { ...waitOptions };\n      if (options.schema) merged.schema = options.schema;\n      return waitForGate<T>(store, record.id, merged);\n    },\n  };\n}\n\n/**\n * Await a gate by id from any process, including one that restarted after the\n * gate was opened. Polls rather than subscribes because the resolver may be a\n * different process writing the same SQLite file.\n */\nexport async function waitForGate<T = unknown>(\n  store: GateStore,\n  id: string,\n  options: WaitOptions<T> = {},\n): Promise<T> {\n  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;\n  for (;;) {\n    throwIfAborted(id, options.signal);\n    const record = store.get(id);\n    if (!record) throw new GateNotFound(id);\n    if (record.status === \"resolved\") return validate(record, options.schema);\n    if (record.status === \"cancelled\") throw new GateCancelled(id, record.reason ?? \"no reason given\");\n    if (record.status === \"expired\") throw new GateExpired(id);\n    await sleep(pollMs, options.signal);\n  }\n}\n\n/** Resolve a gate from wherever the human answered: a CLI, an MCP tool, a dashboard route. */\nexport function resolveGate(store: GateStore, id: string, payload: unknown, resolvedBy: GateResolver): GateRecord {\n  return store.resolve(id, payload, resolvedBy);\n}\n\nexport function cancelGate(store: GateStore, id: string, reason: string): GateRecord {\n  return store.cancel(id, reason);\n}\n\nfunction validate<T>(record: GateRecord, schema: ZodType<T> | undefined): T {\n  if (!schema) return record.payload as T;\n  const parsed = schema.safeParse(record.payload);\n  if (parsed.success) return parsed.data;\n  throw new GatePayloadInvalid(\n    record.id,\n    parsed.error.issues.map((issue) => `${issue.path.join(\".\") || \"$\"}: ${issue.message}`),\n  );\n}\n\nfunction throwIfAborted(id: string, signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new GateAborted(id, String(signal.reason ?? \"aborted\"));\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve) => {\n    const timer = setTimeout(finish, ms);\n    signal?.addEventListener(\"abort\", finish, { once: true });\n    function finish(): void {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", finish);\n      resolve();\n    }\n  });\n}\n","import { BaseGateStore } from \"./base-store.js\";\nimport type { GateAnswerAllowance, GateAuthorize, GateRecord } from \"./types.js\";\n\nexport interface MemoryGateStoreOptions {\n  /** Epoch-millis clock, injectable so expiry is testable without waiting. */\n  now?: () => number;\n  /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */\n  authorize?: GateAuthorize;\n  /** Refuse `create` without a `summary` and an `evidenceRef`. Off by default. */\n  requireBrief?: boolean;\n  /** Answers a non-owner class may give, each exact in class, step and payload. Nothing else widens the default class check. */\n  allowances?: readonly GateAnswerAllowance[];\n}\n\n/**\n * In-process gates. Right for tests and for a single-process product that only\n * needs the pause, not the durability; anything that must survive a restart\n * wants `SqliteGateStore`.\n */\nexport class MemoryGateStore extends BaseGateStore {\n  private readonly rows = new Map<string, GateRecord>();\n\n  constructor(options: MemoryGateStoreOptions = {}) {\n    super(options.now ?? Date.now, options.authorize, options.requireBrief, options.allowances);\n  }\n\n  protected insert(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected read(id: string): GateRecord | undefined {\n    const row = this.rows.get(id);\n    return row ? copy(row) : undefined;\n  }\n\n  protected update(record: GateRecord): void {\n    this.rows.set(record.id, copy(record));\n  }\n\n  protected readByStatus(status: GateRecord[\"status\"]): GateRecord[] {\n    return [...this.rows.values()].filter((row) => row.status === status).map(copy);\n  }\n}\n\n/** `resolvedBy`, `rule` and `questions` are nested, so a shallow spread would let a caller rewrite what the store holds. */\nfunction copy(record: GateRecord): GateRecord {\n  return {\n    ...record,\n    resolvedBy: record.resolvedBy && { ...record.resolvedBy },\n    rule: record.rule && { ...record.rule, resolvers: [...record.rule.resolvers] },\n    questions: record.questions?.map((question) => ({ ...question, options: question.options.map((option) => ({ ...option })) })),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAkC;AAapC,IAAM,kBAAkB;AA+BxB,SAAS,SAAsB,OAAkB,SAA4C;AAClG,QAAM,QAA4C,EAAE,QAAQ,QAAQ,OAAO;AAC3E,MAAI,QAAQ,OAAO,OAAW,OAAM,KAAK,QAAQ;AACjD,MAAI,QAAQ,cAAc,OAAW,OAAM,YAAY,QAAQ;AAC/D,MAAI,QAAQ,YAAY,OAAW,OAAM,UAAU,QAAQ;AAC3D,MAAI,QAAQ,gBAAgB,OAAW,OAAM,cAAc,QAAQ;AACnE,MAAI,QAAQ,cAAc,OAAW,OAAM,YAAY,QAAQ;AAC/D,MAAI,QAAQ,OAAQ,OAAM,SAAS,aAAa,QAAQ,MAAM;AAE9D,QAAM,SAAS,MAAM,OAAO,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX;AAAA,IACA,MAAM,CAAC,cAAc,CAAC,MAAM;AAC1B,YAAM,SAAyB,EAAE,GAAG,YAAY;AAChD,UAAI,QAAQ,OAAQ,QAAO,SAAS,QAAQ;AAC5C,aAAO,YAAe,OAAO,OAAO,IAAI,MAAM;AAAA,IAChD;AAAA,EACF;AACF;AAOA,eAAsB,YACpB,OACA,IACA,UAA0B,CAAC,GACf;AACZ,QAAM,SAAS,QAAQ,UAAU;AACjC,aAAS;AACP,mBAAe,IAAI,QAAQ,MAAM;AACjC,UAAM,SAAS,MAAM,IAAI,EAAE;AAC3B,QAAI,CAAC,OAAQ,OAAM,IAAI,aAAa,EAAE;AACtC,QAAI,OAAO,WAAW,WAAY,QAAO,SAAS,QAAQ,QAAQ,MAAM;AACxE,QAAI,OAAO,WAAW,YAAa,OAAM,IAAI,cAAc,IAAI,OAAO,UAAU,iBAAiB;AACjG,QAAI,OAAO,WAAW,UAAW,OAAM,IAAI,YAAY,EAAE;AACzD,UAAM,MAAM,QAAQ,QAAQ,MAAM;AAAA,EACpC;AACF;AAGO,SAAS,YAAY,OAAkB,IAAY,SAAkB,YAAsC;AAChH,SAAO,MAAM,QAAQ,IAAI,SAAS,UAAU;AAC9C;AAEO,SAAS,WAAW,OAAkB,IAAY,QAA4B;AACnF,SAAO,MAAM,OAAO,IAAI,MAAM;AAChC;AAEA,SAAS,SAAY,QAAoB,QAAmC;AAC1E,MAAI,CAAC,OAAQ,QAAO,OAAO;AAC3B,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO;AAC9C,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IACP,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,GAAG,KAAK,MAAM,OAAO,EAAE;AAAA,EACvF;AACF;AAEA,SAAS,eAAe,IAAY,QAAuC;AACzE,MAAI,QAAQ,QAAS,OAAM,IAAI,YAAY,IAAI,OAAO,OAAO,UAAU,SAAS,CAAC;AACnF;AAEA,SAAS,MAAM,IAAY,QAAgD;AACzE,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQ,WAAW,QAAQ,EAAE;AACnC,YAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,aAAS,SAAe;AACtB,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,MAAM;AAC3C,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACH;;;ACrGO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EAChC,OAAO,oBAAI,IAAwB;AAAA,EAEpD,YAAY,UAAkC,CAAC,GAAG;AAChD,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,WAAW,QAAQ,cAAc,QAAQ,UAAU;AAAA,EAC5F;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,KAAK,IAAoC;AACjD,UAAM,MAAM,KAAK,KAAK,IAAI,EAAE;AAC5B,WAAO,MAAM,KAAK,GAAG,IAAI;AAAA,EAC3B;AAAA,EAEU,OAAO,QAA0B;AACzC,SAAK,KAAK,IAAI,OAAO,IAAI,KAAK,MAAM,CAAC;AAAA,EACvC;AAAA,EAEU,aAAa,QAA4C;AACjE,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,EAAE,IAAI,IAAI;AAAA,EAChF;AACF;AAGA,SAAS,KAAK,QAAgC;AAC5C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,OAAO,cAAc,EAAE,GAAG,OAAO,WAAW;AAAA,IACxD,MAAM,OAAO,QAAQ,EAAE,GAAG,OAAO,MAAM,WAAW,CAAC,GAAG,OAAO,KAAK,SAAS,EAAE;AAAA,IAC7E,WAAW,OAAO,WAAW,IAAI,CAAC,cAAc,EAAE,GAAG,UAAU,SAAS,SAAS,QAAQ,IAAI,CAAC,YAAY,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE;AAAA,EAC9H;AACF;","names":[]}

package/dist/sqlite.d.ts

@@ -1,5 +1,5 @@
 import { Db, Migration } from '@titan-design/store-sqlite';
-import { B as BaseGateStore, c as GateAuthorize, G as GateRecord, p as GateStatus } from './base-store-BvwOJL6M.js';
+import { B as BaseGateStore, d as GateAuthorize, e as GateAnswerAllowance, G as GateRecord, w as GateStatus } from './base-store-B-IPO0UN.js';
 import '@titan-design/authority';
 
 declare const DEFAULT_GATE_TABLE = "hitl_gate";
@@ -16,13 +16,21 @@ declare function resolverRequiredTriggerDdl(name?: string): string;
  * gates resolved before it keep an unknown resolver rather than a guessed one.
  */
 declare function gateResolverMigration(version: number, name?: string): Migration;
+/** Adds `rule` and its trigger. Idempotent and backfill-free: gates opened before it carry no rule. */
+declare function gateRuleMigration(version: number, name?: string): Migration;
+/** Adds `summary`, `evidence_ref` and `questions`. Idempotent and backfill-free: gates opened before it carry no brief. */
+declare function gateBriefMigration(version: number, name?: string): Migration;
 interface SqliteGateStoreOptions {
     table?: string;
-    /** Run `gateMigration` on construction. Off when the product owns its migration list. */
+    /** Run `gateMigration`, `gateResolverMigration`, `gateRuleMigration` and `gateBriefMigration` on construction. Off when the product owns its migration list. */
     migrate?: boolean;
     now?: () => number;
     /** Refuses resolvers beyond the default class check; it cannot admit one the default refused. */
     authorize?: GateAuthorize;
+    /** Refuse `create` without a `summary` and an `evidenceRef`. Off by default; needs `gateBriefMigration`. */
+    requireBrief?: boolean;
+    /** Answers a non-owner class may give, each exact in class, step and payload. Nothing else widens the default class check. */
+    allowances?: readonly GateAnswerAllowance[];
 }
 /**
  * Durable gates. Two instances on the same file are two processes as far as the
@@ -32,16 +40,16 @@ interface SqliteGateStoreOptions {
 declare class SqliteGateStore extends BaseGateStore {
     private readonly db;
     private readonly table;
-    private resolverColumnSeen;
+    private readonly columnsSeen;
     constructor(db: Db, options?: SqliteGateStoreOptions);
+    /** Refuses rather than dropping a rule or a brief when the table has no column to hold it. */
     protected insert(record: GateRecord): void;
+    private optionalColumns;
     protected read(id: string): GateRecord | undefined;
     protected update(record: GateRecord): void;
-    /** Refuses rather than dropping the resolver when the table has no column to hold it. */
-    private updateWithResolver;
-    /** Only a positive probe is cached, so a migration run after construction is still noticed. */
-    private resolverColumnPresent;
+    /** Only a present column is cached: a migration can add one while the store is open, never remove one. */
+    private requireColumn;
     protected readByStatus(status: GateStatus): GateRecord[];
 }
 
-export { DEFAULT_GATE_TABLE, SqliteGateStore, type SqliteGateStoreOptions, gateMigration, gateResolverMigration, gateTableDdl, resolverRequiredTriggerDdl };
+export { DEFAULT_GATE_TABLE, SqliteGateStore, type SqliteGateStoreOptions, gateBriefMigration, gateMigration, gateResolverMigration, gateRuleMigration, gateTableDdl, resolverRequiredTriggerDdl };