@aiwg/cli 2026.9.20 → 2026.9.21

package/dist/src/decision/result-cache/key.js

@@ -0,0 +1,28 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../../security/artifact-trust.js';
+export function digestResultCacheIdentity(identity) {
+    return resultCacheSha256(canonicalJson(normalizeSemanticStrings(identity)));
+}
+export function digestCachedResult(value) { return resultCacheSha256(canonicalJson(value)); }
+/** NFC normalizes equivalent Unicode input without conflating distinct object keys. */
+function normalizeSemanticStrings(value) {
+    if (typeof value === 'string')
+        return value.normalize('NFC');
+    if (Array.isArray(value))
+        return value.map(normalizeSemanticStrings);
+    if (value !== null && typeof value === 'object') {
+        const result = {};
+        for (const [rawKey, child] of Object.entries(value)) {
+            const key = rawKey.normalize('NFC');
+            if (Object.hasOwn(result, key))
+                throw new Error('Ambiguous Unicode keys in semantic identity');
+            result[key] = normalizeSemanticStrings(child);
+        }
+        return result;
+    }
+    return value;
+}
+export function resultCacheSha256(value) {
+    return `sha256:${createHash('sha256').update(value, 'utf8').digest('hex')}`;
+}
+//# sourceMappingURL=key.js.map

package/dist/src/decision/result-cache/service.js

@@ -0,0 +1,92 @@
+import { randomUUID } from 'node:crypto';
+import { digestCachedResult, digestResultCacheIdentity } from './key.js';
+import { entryIntegrityDigest } from './integrity.js';
+export class DecisionResultCache {
+    store;
+    telemetry;
+    flights = new Map();
+    constructor(store, telemetry = () => { }) {
+        this.store = store;
+        this.telemetry = telemetry;
+    }
+    async evaluate(request, fill) {
+        const now = request.nowEpochMs ?? Date.now();
+        const operationId = request.operationId ?? randomUUID();
+        if (!cacheable(request.policy))
+            return this.bypass(request, fill, now, operationId, 'policy-disabled');
+        if (!modelReusable(request.identity, now))
+            return this.bypass(request, fill, now, operationId, 'model-compatibility-unproven');
+        const key = digestResultCacheIdentity(request.identity);
+        const existing = await this.store.read(request.actor, key);
+        if (existing && reusable(existing, request, now)) {
+            this.emit({ event: 'hit', operationId, reason: 'fresh-compatible-entry', saved: savings(existing.evidence) });
+            return { evidence: structuredClone(existing.evidence), receipt: receipt('cache-hit', request.callerInvocationId, existing, existing.evidence, now, false) };
+        }
+        if (existing) {
+            this.emit({ event: 'stale', operationId, reason: 'expired-or-policy-incompatible' });
+            if (await this.store.invalidate(request.actor, key, existing.entryId)) {
+                this.emit({ event: 'invalidation', operationId, reason: 'expired-or-policy-incompatible' });
+            }
+        }
+        else
+            this.emit({ event: 'miss', operationId, reason: 'no-entry' });
+        // A flight must never cross an authorization or freshness-policy boundary.
+        const flightKey = JSON.stringify([request.actor.tenantId, request.actor.projectId,
+            request.actor.workspaceId, request.actor.subjectId, [...request.actor.permissions].sort(),
+            key, request.policy.policyVersion, request.policy.sensitivity, request.policy.ttlMs,
+            request.policy.negative]);
+        const pending = this.flights.get(flightKey);
+        if (pending) {
+            this.emit({ event: 'single-flight', operationId, reason: 'joined' });
+            const completed = await pending;
+            if (completed.entry)
+                this.emit({ event: 'hit', operationId, reason: 'single-flight-joined', saved: savings(completed.evidence) });
+            return { evidence: structuredClone(completed.evidence), receipt: receipt(completed.entry ? 'cache-hit' : 'cache-miss-fill', request.callerInvocationId, completed.entry, completed.evidence, now, false) };
+        }
+        const work = async () => {
+            // Recheck under the cross-process lock; a different worker may have filled
+            // while this one waited. Never call the backend merely because the first read missed.
+            const published = await this.store.read(request.actor, key);
+            if (published && reusable(published, request, now))
+                return { evidence: published.evidence, entry: published, reused: true };
+            if (published)
+                await this.store.invalidate(request.actor, key, published.entryId);
+            const evidence = await fill();
+            const ttl = cacheableEvidence(evidence, request.policy) && modelEvidenceApproved(request.identity, evidence) ? (evidence.status === 'success' ? request.policy.ttlMs : request.policy.negative.ttlMs) : 0;
+            if (ttl <= 0)
+                return { evidence, entry: null, reused: false };
+            const createdAt = Math.max(now, evidence.evaluatedAtEpochMs);
+            const unsigned = { schemaVersion: 'decision-result-cache/v1', revision: 1, entryId: randomUUID(), scope: { tenantId: request.actor.tenantId, projectId: request.actor.projectId, workspaceId: request.actor.workspaceId }, keyDigest: key, identityDigest: key, policyVersion: request.policy.policyVersion, sensitivity: request.policy.sensitivity, createdAtEpochMs: createdAt, expiresAtEpochMs: createdAt + ttl, evidence: { ...evidence, resultDigest: digestCachedResult(evidence.result) } };
+            const entry = await this.store.putIfAbsent(request.actor, { ...unsigned, integrityDigest: entryIntegrityDigest(unsigned) });
+            return { evidence: entry.evidence, entry, reused: false };
+        };
+        const promise = this.store.withKeyLock ? this.store.withKeyLock(request.actor, key, work) : work();
+        this.flights.set(flightKey, promise);
+        try {
+            const completed = await promise;
+            if (completed.reused)
+                this.emit({ event: 'hit', operationId, reason: 'cross-process-joined', saved: savings(completed.evidence) });
+            return { evidence: structuredClone(completed.evidence), receipt: receipt(completed.reused ? 'cache-hit' : 'cache-miss-fill', request.callerInvocationId, completed.entry, completed.evidence, now, !completed.reused) };
+        }
+        finally {
+            this.flights.delete(flightKey);
+        }
+    }
+    async bypass(request, fill, now, operationId, reason) { this.emit({ event: 'bypass', operationId, reason }); const evidence = await fill(); return { evidence, receipt: receipt('bypass', request.callerInvocationId, null, evidence, now, true) }; }
+    /** A failing telemetry sink must never alter, reject, or mask a cache decision. */
+    emit(event) { try {
+        this.telemetry(event);
+    }
+    catch { /* isolated */ } }
+}
+function cacheable(policy) { return policy.enabled && policy.sideEffectFree && policy.ttlMs > 0 && policy.scope === 'workspace' && policy.policyVersion.length > 0; }
+function modelReusable(identity, now) { const p = identity.modelCompatibility; return p.mode === 'pinned' ? p.actualModel === identity.requestedModel : p.alias === identity.requestedModel && p.snapshotId.length > 0 && p.validUntilEpochMs > now && p.approvedActualModels.length > 0; }
+function modelEvidenceApproved(identity, evidence) { const p = identity.modelCompatibility; return p.mode === 'pinned' ? evidence.actualModel === p.actualModel : p.approvedActualModels.includes(evidence.actualModel); }
+function reusable(entry, request, now) { return entry.expiresAtEpochMs > now && entry.policyVersion === request.policy.policyVersion && entry.sensitivity === request.policy.sensitivity && entry.identityDigest === digestResultCacheIdentity(request.identity) && modelEvidenceApproved(request.identity, entry.evidence); }
+function cacheableEvidence(e, policy) { return e.status === 'success' ? e.failureReason === 'none' : Boolean(policy.negative?.enabled && policy.negative.ttlMs > 0 && policy.negative.ttlMs <= policy.ttlMs && policy.negative.reasons.includes('invalid-input') && e.failureReason === 'invalid-input'); }
+function savings(e) {
+    return { inputTokens: e.usage.inputTokens, outputTokens: e.usage.outputTokens,
+        costUsd: e.usage.costUsd, latencyMs: e.durationMs, estimated: true };
+}
+function receipt(disposition, caller, entry, evidence, now, providerAttempted) { return { disposition, callerInvocationId: caller, sourceInvocationId: evidence.sourceInvocationId, sourceReceiptId: evidence.sourceReceiptId, originalEvaluatedAtEpochMs: evidence.evaluatedAtEpochMs, cacheEntryId: entry?.entryId ?? null, createdAtEpochMs: now, providerAttempted }; }
+//# sourceMappingURL=service.js.map

package/dist/src/decision/result-cache/store.js

@@ -0,0 +1,327 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { link, mkdir, open, readFile, readdir, rm, stat, unlink } from 'node:fs/promises';
+import { hostname } from 'node:os';
+import { join } from 'node:path';
+import { canonicalJson } from '../../security/artifact-trust.js';
+import { validateDecisionLifecyclePolicy } from '../lifecycle.js';
+import { assertResultCacheEntry } from './integrity.js';
+export class ResultCacheAccessDeniedError extends Error {
+    constructor() { super('Result cache operation denied'); }
+}
+/**
+ * Scope components are joined with NUL into the storage key. A component that
+ * contains NUL (or any control character) could re-split into another scope, so
+ * it is refused before any lookup with the same indistinguishable denial.
+ */
+const SCOPE_COMPONENT = /^[^\u0000-\u001f\u007f]{1,256}$/;
+function validScope(scope) {
+    return [scope.tenantId, scope.projectId, scope.workspaceId].every(value => typeof value === 'string' && SCOPE_COMPONENT.test(value));
+}
+function authorize(actor, permission, scope) {
+    if (!validScope(actor) || !actor.permissions.includes(permission) || (scope && (actor.tenantId !== scope.tenantId || actor.projectId !== scope.projectId || actor.workspaceId !== scope.workspaceId))) {
+        // Deliberately identical for absence, wrong scope, and missing permission.
+        throw new ResultCacheAccessDeniedError();
+    }
+}
+function mapKey(actor, key) { return `${actor.tenantId}\0${actor.projectId}\0${actor.workspaceId}\0${key}`; }
+export class MemoryResultCacheStore {
+    entries = new Map();
+    async read(actor, key) {
+        authorize(actor, 'read');
+        const value = this.entries.get(mapKey(actor, key));
+        if (!value)
+            return null;
+        authorize(actor, 'read', value.scope);
+        assertResultCacheEntry(value);
+        return structuredClone(value);
+    }
+    async putIfAbsent(actor, entry) {
+        authorize(actor, 'write', entry.scope);
+        assertResultCacheEntry(entry);
+        const key = mapKey(actor, entry.keyDigest);
+        const existing = this.entries.get(key);
+        if (existing) {
+            assertResultCacheEntry(existing);
+            return structuredClone(existing);
+        }
+        this.entries.set(key, structuredClone(entry));
+        return structuredClone(entry);
+    }
+    async invalidate(actor, key, expectedEntryId) { authorize(actor, 'invalidate'); const map = mapKey(actor, key); const current = this.entries.get(map); if (expectedEntryId && current?.entryId !== expectedEntryId)
+        return false; return this.entries.delete(map); }
+    async delete(actor, key) { authorize(actor, 'delete'); return this.entries.delete(mapKey(actor, key)); }
+    async export(actor, key) { authorize(actor, 'export'); const value = this.entries.get(mapKey(actor, key)); if (!value)
+        return null; authorize(actor, 'export', value.scope); assertResultCacheEntry(value); return structuredClone(value); }
+}
+const SENSITIVITY_RANK = { public: 0, internal: 1, confidential: 2, restricted: 3 };
+/** Single-file-per-key store. Atomic hard-link publication prevents overwrite/poisoning. */
+export class FileResultCacheStore {
+    directory;
+    options;
+    rule;
+    constructor(directory, options = {}) {
+        this.directory = directory;
+        this.options = options;
+        if (options.lifecycle)
+            validateDecisionLifecyclePolicy(options.lifecycle.policy);
+        this.rule = options.lifecycle ? structuredClone(options.lifecycle.policy.surfaces.cache) : null;
+    }
+    /** Opaque D10 references (entry IDs) for cache entries derived from one source receipt. */
+    async lifecycleReferences(actor, sourceReceiptId) {
+        authorize(actor, 'delete');
+        return (await this.scopedEntries(actor)).filter(entry => entry.evidence.sourceReceiptId === sourceReceiptId)
+            .map(entry => ({ surface: 'cache', opaqueId: entry.entryId }));
+    }
+    /** D10 `erase` for the `cache` surface: tombstone and unlink the entry with this opaque ID. */
+    async eraseLifecycleReference(actor, reference) {
+        authorize(actor, 'delete');
+        if (reference.surface !== 'cache' || !reference.opaqueId)
+            throw new Error('Result cache lifecycle reference invalid');
+        const entry = (await this.scopedEntries(actor)).find(value => value.entryId === reference.opaqueId);
+        return entry ? this.delete(actor, entry.keyDigest) : false;
+    }
+    /** Cascade a deleted source receipt to every cache entry in the authenticated scope that reused it. */
+    async eraseBySourceReceipt(actor, sourceReceiptId) {
+        const references = await this.lifecycleReferences(actor, sourceReceiptId);
+        for (const reference of references)
+            await this.eraseLifecycleReference(actor, reference);
+        return references;
+    }
+    async withKeyLock(actor, key, work) {
+        authorize(actor, 'read');
+        authorize(actor, 'write');
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const lock = `${this.path(actor, key)}.lock`;
+        const deadline = Date.now() + 60_000;
+        while (true) {
+            try {
+                const handle = await open(lock, 'wx', 0o600);
+                try {
+                    try {
+                        await handle.writeFile(JSON.stringify({ pid: process.pid, host: hostname() }));
+                        await handle.sync();
+                    }
+                    finally {
+                        await handle.close();
+                    }
+                    return await work();
+                }
+                finally {
+                    await rm(lock, { force: true });
+                }
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                // Only reclaim a dead process on this host; an unreadable or remote lock
+                // fails closed rather than risking two provider calls on a shared volume.
+                try {
+                    const before = await stat(lock);
+                    const owner = JSON.parse(await readFile(lock, 'utf8'));
+                    if (owner.host === hostname() && Number.isSafeInteger(owner.pid) && owner.pid > 0) {
+                        let alive = true;
+                        try {
+                            process.kill(owner.pid, 0);
+                        }
+                        catch (failure) {
+                            alive = failure.code !== 'ESRCH';
+                        }
+                        if (!alive && (await stat(lock)).ino === before.ino) {
+                            await rm(lock, { force: true });
+                            continue;
+                        }
+                    }
+                }
+                catch (failure) {
+                    // Lock creation and owner write are separate; a transient partial owner
+                    // is not proof of abandonment. Continue waiting, never break the lock.
+                    if (failure.code !== 'ENOENT' && !(failure instanceof SyntaxError))
+                        throw failure;
+                }
+                if (Date.now() >= deadline)
+                    throw new Error('Result cache fill lock unavailable');
+                await new Promise(resolve => setTimeout(resolve, 25));
+            }
+        }
+    }
+    /** Bounded retention sweep for the authenticated scope; never touches other projects. */
+    async purgeExpired(actor, nowEpochMs = Date.now()) {
+        authorize(actor, 'invalidate');
+        let removed = 0;
+        for (const entry of await this.scopedEntries(actor)) {
+            const expired = entry.expiresAtEpochMs <= nowEpochMs || !this.withinRetention(entry, nowEpochMs)
+                || await this.sourceErased(entry);
+            if (expired && await this.invalidate(actor, entry.keyDigest, entry.entryId))
+                removed += 1;
+        }
+        return removed;
+    }
+    async read(actor, key) { authorize(actor, 'read'); return this.load(actor, key, 'read'); }
+    async putIfAbsent(actor, entry) {
+        authorize(actor, 'write', entry.scope);
+        assertResultCacheEntry(entry);
+        // This store writes plaintext JSON. Refuse protected classes until the host
+        // provides a separately qualified encrypted storage implementation.
+        if (entry.sensitivity === 'confidential' || entry.sensitivity === 'restricted')
+            throw new ResultCacheAccessDeniedError();
+        // The D10 rule is a ceiling: no entry may outlive the surface retention or exceed its classification.
+        if (this.rule && (entry.expiresAtEpochMs - entry.createdAtEpochMs > this.rule.retentionMs
+            || SENSITIVITY_RANK[entry.sensitivity] > SENSITIVITY_RANK[this.rule.classification]))
+            throw new ResultCacheAccessDeniedError();
+        if (await this.sourceErased(entry))
+            throw new ResultCacheAccessDeniedError();
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const path = this.path(actor, entry.keyDigest);
+        if (await this.deleted(actor, entry.keyDigest))
+            throw new ResultCacheAccessDeniedError();
+        // An entry hidden by D10 retention or source erasure must not block its own replacement.
+        const hidden = await this.load(actor, entry.keyDigest, 'write', false);
+        if (hidden && (!this.withinRetention(hidden, this.now()) || await this.sourceErased(hidden)))
+            await this.remove(actor, entry.keyDigest);
+        const tmp = join(this.directory, `.cache-${randomUUID()}.tmp`);
+        const handle = await open(tmp, 'wx', 0o600);
+        try {
+            try {
+                await handle.writeFile(`${canonicalJson(entry)}\n`);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            try {
+                await link(tmp, path);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+        }
+        finally {
+            await rm(tmp, { force: true });
+        }
+        if (await this.deleted(actor, entry.keyDigest)) {
+            await rm(path, { force: true });
+            throw new ResultCacheAccessDeniedError();
+        }
+        const stored = await this.load(actor, entry.keyDigest, 'write');
+        if (!stored)
+            throw new Error('Cache publication failed');
+        return stored;
+    }
+    async invalidate(actor, key, expectedEntryId) { authorize(actor, 'invalidate'); if (expectedEntryId) {
+        const current = await this.load(actor, key, 'invalidate', false);
+        if (!current || current.entryId !== expectedEntryId)
+            return false;
+    } return this.remove(actor, key); }
+    async delete(actor, key) {
+        authorize(actor, 'delete');
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const marker = `${this.path(actor, key)}.deleted`;
+        try {
+            const handle = await open(marker, 'wx', 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({ schemaVersion: 'decision-result-cache-tombstone/v1',
+                    deletedAtEpochMs: Date.now(), legalHold: this.options.legalHold === true }));
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        return this.remove(actor, key);
+    }
+    async export(actor, key) {
+        authorize(actor, 'export');
+        // Denied regardless of presence, so the export policy is not an existence oracle.
+        if (this.rule?.export === 'denied')
+            throw new ResultCacheAccessDeniedError();
+        return this.load(actor, key, 'export');
+    }
+    async load(actor, key, permission, lifecycle = true) {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        if (await this.deleted(actor, key))
+            return null;
+        try {
+            const entry = JSON.parse(await readFile(this.path(actor, key), 'utf8'));
+            authorize(actor, permission, entry.scope);
+            assertResultCacheEntry(entry);
+            if (entry.sensitivity === 'confidential' || entry.sensitivity === 'restricted')
+                throw new ResultCacheAccessDeniedError();
+            if (entry.keyDigest !== key)
+                throw new Error('Cache key substitution');
+            // Beyond D10 retention, or derived from an erased source receipt: treated as absent.
+            if (lifecycle && (!this.withinRetention(entry, this.now()) || await this.sourceErased(entry)))
+                return null;
+            return entry;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+    }
+    now() { return this.options.lifecycle?.now?.() ?? Date.now(); }
+    withinRetention(entry, now) { return !this.rule || now - entry.createdAtEpochMs < this.rule.retentionMs; }
+    async sourceErased(entry) {
+        const erased = this.options.lifecycle?.sourceErased;
+        if (!erased)
+            return false;
+        try {
+            return await erased(structuredClone(entry.scope), entry.evidence.sourceReceiptId);
+        }
+        catch {
+            throw new ResultCacheAccessDeniedError();
+        } // An unavailable D10 authority fails closed.
+    }
+    /** Integrity-checked live entries of the authenticated scope only. */
+    async scopedEntries(actor) {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const entries = [];
+        for (const name of await readdir(this.directory)) {
+            if (!/^[a-f0-9]{64}\.json$/.test(name))
+                continue;
+            const path = join(this.directory, name);
+            try {
+                const entry = JSON.parse(await readFile(path, 'utf8'));
+                if (entry.scope.tenantId !== actor.tenantId || entry.scope.projectId !== actor.projectId
+                    || entry.scope.workspaceId !== actor.workspaceId)
+                    continue;
+                assertResultCacheEntry(entry);
+                if (this.path(actor, entry.keyDigest) !== path)
+                    throw new Error('Cache key substitution');
+                entries.push(entry);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        return entries;
+    }
+    async deleted(actor, key) {
+        try {
+            await stat(`${this.path(actor, key)}.deleted`);
+            return true;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+    }
+    async remove(actor, key) { try {
+        await unlink(this.path(actor, key));
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    } }
+    path(actor, key) { return join(this.directory, `${createHash('sha256').update(mapKey(actor, key)).digest('hex')}.json`); }
+}
+//# sourceMappingURL=store.js.map

package/dist/src/decision/result-cache/types.js

@@ -0,0 +1,3 @@
+export const RESULT_CACHE_SCHEMA_VERSION = 'decision-result-cache/v1';
+export const RESULT_CACHE_KEY_VERSION = 'decision-semantic-key/v2';
+//# sourceMappingURL=types.js.map

package/dist/src/decision/review/authorization.js

@@ -0,0 +1,110 @@
+import { reviewDigest } from './validate.js';
+/** Explicit offline/host adapter; no credential handling and no default allow on missing authority. */
+export class PinnedReviewAuthorization {
+    authority;
+    actionAllowed;
+    policyDigest;
+    policy;
+    constructor(policy, authority, actionAllowed) {
+        this.authority = authority;
+        this.actionAllowed = actionAllowed;
+        if (!policy.id || !policy.version || !policy.tenantId || !policy.projectId ||
+            Object.values(policy.minimumQuorumByRisk).some(value => !Number.isSafeInteger(value) || value < 1 || value > 16) ||
+            !policy.retentionWindowMsByRisk ||
+            (policy.sensitiveViewRoles !== undefined && (!Array.isArray(policy.sensitiveViewRoles) ||
+                policy.sensitiveViewRoles.some(role => typeof role !== 'string' || !role))) ||
+            Object.values(policy.retentionWindowMsByRisk).some(value => !Number.isSafeInteger(value) || value < 1)) {
+            throw new Error('Invalid pinned review policy');
+        }
+        this.policy = structuredClone(policy);
+        this.policyDigest = reviewDigest(this.policy);
+    }
+    inScope(scope) {
+        return scope.tenantId === this.policy.tenantId && scope.projectId === this.policy.projectId;
+    }
+    async actor(scope, actor) {
+        if (!this.inScope(scope) || (actor.id === scope.actor.id && !await this.authority.authenticate(scope)))
+            return null;
+        const current = await this.authority.resolve(scope.tenantId, scope.projectId, actor.id);
+        if (!current?.active || current.compromised)
+            return null;
+        return current;
+    }
+    hasRole(actual, required) { return actual.some(role => required.includes(role)); }
+    async pinned(review) {
+        const retention = this.policy.retentionWindowMsByRisk[review.riskTier];
+        if (review.tenantId !== this.policy.tenantId || review.projectId !== this.policy.projectId ||
+            review.quorum < (this.policy.minimumQuorumByRisk[review.riskTier] ?? Infinity) ||
+            retention === undefined || review.retentionUntilEpochMs !== review.createdAtEpochMs + retention)
+            return false;
+        const pin = review.policyPins.find(item => item.id === this.policy.id && item.version === this.policy.version && item.digest === this.policyDigest);
+        return Boolean(pin) && await this.authority.currentPolicyDigest(review.tenantId, review.projectId, this.policy.id) === this.policyDigest;
+    }
+    async authorize(scope, operation, review) {
+        const actor = await this.actor(scope, scope.actor);
+        if (!actor || (review && !await this.pinned(review)))
+            return false;
+        if (!review && operation === 'create')
+            return this.hasRole(actor.roles, this.policy.requesterRoles);
+        if (!review && operation === 'list')
+            return this.hasRole(actor.roles, [
+                ...this.policy.reviewerRoles, ...this.policy.auditorRoles, ...this.policy.operatorRoles,
+            ]);
+        if (!review && operation === 'purge')
+            return this.hasRole(actor.roles, this.policy.operatorRoles);
+        if (!review)
+            return false;
+        switch (operation) {
+            case 'create': return this.hasRole(actor.roles, this.policy.requesterRoles);
+            case 'list':
+            case 'read':
+            case 'export': return this.hasRole(actor.roles, [
+                ...this.policy.reviewerRoles, ...this.policy.auditorRoles, ...this.policy.operatorRoles,
+            ]);
+            case 'resume': return this.hasRole(actor.roles, this.policy.executorRoles);
+            case 'sensitive-view': return this.hasRole(actor.roles, this.policy.sensitiveViewRoles ?? []);
+            case 'claim':
+            case 'decide':
+            case 'edit': return this.hasRole(actor.roles, this.policy.reviewerRoles);
+            case 'escalate':
+            case 'cancel':
+            case 'legal-hold':
+            case 'delete':
+            case 'tombstone':
+            case 'purge':
+                return this.hasRole(actor.roles, this.policy.operatorRoles);
+        }
+    }
+    async eligible(scope, review, proposal) {
+        if (!await this.pinned(review) || proposal.version !== review.proposals.at(-1)?.version)
+            return false;
+        const actor = await this.actor(scope, scope.actor);
+        if (!actor || !this.hasRole(actor.roles, this.policy.reviewerRoles.concat(this.policy.executorRoles)))
+            return false;
+        if (actor.conflictsWith.includes(review.requesterId) || actor.conflictsWith.includes(proposal.editor.id))
+            return false;
+        if (this.policy.separateRequesterReviewer && scope.actor.id === review.requesterId)
+            return false;
+        if (this.policy.separateEditorReviewer && scope.actor.id === proposal.editor.id)
+            return false;
+        return true;
+    }
+    async eligibleApproval(scope, review, proposal, decision) {
+        if (!await this.pinned(review) || decision.proposalVersion !== proposal.version)
+            return false;
+        const reviewer = await this.actor(scope, decision.reviewer);
+        if (!reviewer || !this.hasRole(reviewer.roles, this.policy.reviewerRoles))
+            return false;
+        if (this.policy.separateRequesterReviewer && decision.reviewer.id === review.requesterId)
+            return false;
+        if (this.policy.separateEditorReviewer && decision.reviewer.id === proposal.editor.id)
+            return false;
+        if (this.policy.separateReviewerExecutor && decision.reviewer.id === scope.actor.id)
+            return false;
+        return !reviewer.conflictsWith.includes(review.requesterId) && !reviewer.conflictsWith.includes(proposal.editor.id);
+    }
+    async authorizeAction(scope, review, proposal) {
+        return await this.pinned(review) && Boolean(await this.actor(scope, scope.actor)) && await this.actionAllowed(scope, review, proposal);
+    }
+}
+//# sourceMappingURL=authorization.js.map