@camunda/ccma-shared-types 10.7.1 → 10.9.0

package/dist/approvals/delete-cluster-corpses.js

@@ -1,15 +1,9 @@
-const DELETE_CLUSTER_CORPSES_FLAG = "control.deleteClusterCorpses";
 const CLUSTER_CORPSE_KINDS = ["db", "k8s"];
 const DELETE_CLUSTER_CORPSES_MAX = 500;
 const CLUSTER_CORPSE_MIN_AGE_MS = 60 * 60 * 1e3;
-const DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD = 2;
-const DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE = 1;
 export {
   CLUSTER_CORPSE_KINDS,
   CLUSTER_CORPSE_MIN_AGE_MS,
-  DELETE_CLUSTER_CORPSES_FLAG,
-  DELETE_CLUSTER_CORPSES_MAX,
-  DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD,
-  DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE
+  DELETE_CLUSTER_CORPSES_MAX
 };
 //# sourceMappingURL=delete-cluster-corpses.js.map

package/dist/approvals/delete-cluster-corpses.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/delete-cluster-corpses.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The flag of the `delete-cluster-corpses` use case.\n *\n * control-backend opens a request only while it is on. Control shows the\n * request in place of the direct \"Delete all corpses\" while it is on.\n */\nexport const DELETE_CLUSTER_CORPSES_FLAG = 'control.deleteClusterCorpses'\n\n/**\n * The two kinds of cluster corpse.\n *\n * - `db`: a cluster row of console with no ZeebeCluster resource in\n *   Kubernetes. The delete removes the row and what belongs to it.\n * - `k8s`: a ZeebeCluster resource in Kubernetes with no cluster row of\n *   console. The delete removes the resource.\n */\nexport const CLUSTER_CORPSE_KINDS = ['db', 'k8s'] as const\n\nexport type ClusterCorpseKind = (typeof CLUSTER_CORPSE_KINDS)[number]\n\n/**\n * The most corpses that one request deletes.\n *\n * The request lists each corpse, so that the approvers read what they delete.\n * When there are more, the request takes the oldest ones, and a later request\n * takes the rest.\n */\nexport const DELETE_CLUSTER_CORPSES_MAX = 500\n\n/**\n * The youngest corpse that a request takes, in milliseconds.\n *\n * Console creates the Kubernetes resource of a new cluster before it commits\n * the row, and its watch of Kubernetes sees a new resource some time later.\n * So a cluster that is being created can look like either kind of corpse for\n * a short time.\n */\nexport const CLUSTER_CORPSE_MIN_AGE_MS = 60 * 60 * 1000\n\n/**\n * The approvals of a corpse deletion on prod: two people other than the\n * person who asks, the same as a cluster bulk deletion\n * (`CLUSTER_BULK_OPERATION_MIN_ACKS`).\n */\nexport const DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD = 2\n\n/** The approvals of a corpse deletion on dev, int and local. */\nexport const DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE = 1\n\n/** One corpse, as console answers it to control-backend. */\nexport interface ClusterCorpseDto {\n  /** The uuid of the cluster row, or the name of the Kubernetes resource. */\n  clusterId: string\n  orgId: string\n  /** The name of the cluster. Only a `db` corpse has one. */\n  name?: string\n  /**\n   * The Kubernetes context. A `k8s` corpse always has one. A `db` corpse has\n   * the context of its row, when the row names one.\n   */\n  k8sContextUuid?: string\n  /**\n   * The `metadata.uid` of the resource of a `k8s` corpse. Console deletes the\n   * resource only while it has this uid, so a new resource with the same name\n   * stays. A `k8s` corpse without it never goes into a request.\n   */\n  resourceUid?: string\n  /**\n   * When the row or the resource was created, as an ISO 8601 string. A\n   * corpse without it is never old enough for a request.\n   */\n  created?: string\n}\n\n/**\n * The corpses of one kind now. Console answers it on\n * `GET api/admin/approvals/cluster-corpses/:kind`.\n */\nexport interface ClusterCorpsesDto {\n  kind: ClusterCorpseKind\n  corpses: ClusterCorpseDto[]\n}\n\n/**\n * What console did with one corpse of a request.\n *\n * Console reads the live source again before it deletes. `not-a-corpse` means\n * that the cluster is not a corpse any more: a `db` corpse has a resource in\n * Kubernetes now, or a `k8s` corpse has a row now. `gone` means that there was\n * nothing to delete: the row or the resource does not exist, or the resource\n * of a `k8s` corpse has another uid now. Console deletes nothing for both.\n */\nexport interface DeleteClusterCorpseResult {\n  outcome: 'deleted' | 'gone' | 'not-a-corpse'\n}\n"],
-  "mappings": "AAYO,MAAM,8BAA8B;AAUpC,MAAM,uBAAuB,CAAC,MAAM,KAAK;AAWzC,MAAM,6BAA6B;AAUnC,MAAM,4BAA4B,KAAK,KAAK;AAO5C,MAAM,uCAAuC;AAG7C,MAAM,6CAA6C;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The two kinds of cluster corpse.\n *\n * - `db`: a cluster row of console with no ZeebeCluster resource in\n *   Kubernetes. The delete removes the row and what belongs to it.\n * - `k8s`: a ZeebeCluster resource in Kubernetes with no cluster row of\n *   console. The delete removes the resource.\n */\nexport const CLUSTER_CORPSE_KINDS = ['db', 'k8s'] as const\n\nexport type ClusterCorpseKind = (typeof CLUSTER_CORPSE_KINDS)[number]\n\n/**\n * The most corpses that one request deletes.\n *\n * The request lists each corpse, so that the approvers read what they delete.\n * When there are more, the request takes the oldest ones, and a later request\n * takes the rest.\n */\nexport const DELETE_CLUSTER_CORPSES_MAX = 500\n\n/**\n * The youngest corpse that a request takes, in milliseconds.\n *\n * Console creates the Kubernetes resource of a new cluster before it commits\n * the row, and its watch of Kubernetes sees a new resource some time later.\n * So a cluster that is being created can look like either kind of corpse for\n * a short time.\n */\nexport const CLUSTER_CORPSE_MIN_AGE_MS = 60 * 60 * 1000\n\n/** One corpse, as console answers it to control-backend. */\nexport interface ClusterCorpseDto {\n  /** The uuid of the cluster row, or the name of the Kubernetes resource. */\n  clusterId: string\n  orgId: string\n  /** The name of the cluster. Only a `db` corpse has one. */\n  name?: string\n  /**\n   * The Kubernetes context. A `k8s` corpse always has one. A `db` corpse has\n   * the context of its row, when the row names one.\n   */\n  k8sContextUuid?: string\n  /**\n   * The `metadata.uid` of the resource of a `k8s` corpse. Console deletes the\n   * resource only while it has this uid, so a new resource with the same name\n   * stays. A `k8s` corpse without it never goes into a request.\n   */\n  resourceUid?: string\n  /**\n   * When the row or the resource was created, as an ISO 8601 string. A\n   * corpse without it is never old enough for a request.\n   */\n  created?: string\n}\n\n/**\n * The corpses of one kind now. Console answers it on\n * `GET api/admin/approvals/cluster-corpses/:kind`.\n */\nexport interface ClusterCorpsesDto {\n  kind: ClusterCorpseKind\n  corpses: ClusterCorpseDto[]\n}\n\n/**\n * What console did with one corpse of a request.\n *\n * Console reads the live source again before it deletes. `not-a-corpse` means\n * that the cluster is not a corpse any more: a `db` corpse has a resource in\n * Kubernetes now, or a `k8s` corpse has a row now. `gone` means that there was\n * nothing to delete: the row or the resource does not exist, or the resource\n * of a `k8s` corpse has another uid now. Console deletes nothing for both.\n */\nexport interface DeleteClusterCorpseResult {\n  outcome: 'deleted' | 'gone' | 'not-a-corpse'\n}\n"],
+  "mappings": "AAcO,MAAM,uBAAuB,CAAC,MAAM,KAAK;AAWzC,MAAM,6BAA6B;AAUnC,MAAM,4BAA4B,KAAK,KAAK;",
   "names": []
 }

package/dist/approvals/edit-generation.d.ts

@@ -1,12 +1,4 @@
 import type { GenerationEnvVarsKey } from '../types/C8ClusterComponentVersions.type.js';
-/**
- * The flag of the `edit-generation` use case.
- *
- * control-backend opens a request only while it is on. While it is on, the
- * Edit dialog of a generation in Control saves the name and the env vars
- * through a request.
- */
-export declare const EDIT_GENERATION_FLAG = "control.editGeneration";
 /** The longest name that an `edit-generation` request writes. */
 export declare const EDIT_GENERATION_NAME_MAX_LENGTH = 200;
 /**

package/dist/approvals/edit-generation.js

@@ -1,11 +1,9 @@
-const EDIT_GENERATION_FLAG = "control.editGeneration";
 const EDIT_GENERATION_NAME_MAX_LENGTH = 200;
 const EDIT_GENERATION_ENV_VARS_MAX_LENGTH = 2e4;
 const EDIT_GENERATION_EXPECTED_MAX_LENGTH = 1048576;
 export {
   EDIT_GENERATION_ENV_VARS_MAX_LENGTH,
   EDIT_GENERATION_EXPECTED_MAX_LENGTH,
-  EDIT_GENERATION_FLAG,
   EDIT_GENERATION_NAME_MAX_LENGTH
 };
 //# sourceMappingURL=edit-generation.js.map

package/dist/approvals/edit-generation.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/edit-generation.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { GenerationEnvVarsKey } from '../types/C8ClusterComponentVersions.type.js'\n\n/**\n * The flag of the `edit-generation` use case.\n *\n * control-backend opens a request only while it is on. While it is on, the\n * Edit dialog of a generation in Control saves the name and the env vars\n * through a request.\n */\nexport const EDIT_GENERATION_FLAG = 'control.editGeneration'\n\n/** The longest name that an `edit-generation` request writes. */\nexport const EDIT_GENERATION_NAME_MAX_LENGTH = 200\n\n/**\n * The longest env var text of one field in an `edit-generation` request.\n *\n * A request holds the text before and after for each of the 8 fields, thus\n * 320,000 characters at most. Plain env var text (`KEY=value` lines) stays\n * under the body limit of control-backend and of console (1 MiB each). A\n * text with many characters that JSON escapes can go over it, and the\n * backend then refuses the request.\n */\nexport const EDIT_GENERATION_ENV_VARS_MAX_LENGTH = 20_000\n\n/**\n * The longest value that an `edit-generation` request carries as the value\n * that it read (`expectedName` and `expectedEnvVars`).\n *\n * The limits of a new value do not apply to it. A generation can hold a\n * value from before those limits, and a request must still be able to\n * change that value, or another field beside it. Thus this number is the\n * body limit of control-backend and of console (1 MiB), and the body limit\n * is the true bound.\n */\nexport const EDIT_GENERATION_EXPECTED_MAX_LENGTH = 1_048_576\n\n/**\n * What console-backend answers when an approved request edited ONE\n * generation (`PATCH api/admin/approvals/generations/:generationId/edit`).\n *\n * It holds no env var text. control-backend keeps it in the result of the\n * request.\n */\nexport interface EditGenerationResult {\n  generationId: string\n  /** The name of the generation after the call. */\n  name: string\n  /**\n   * The clusters of the generation that console sent the spec to. Zero when\n   * the generation already held every requested value and no earlier call\n   * of the request wrote it: console then wrote nothing and sent nothing.\n   */\n  clusterCount: number\n  /**\n   * The clusters of `clusterCount` that refused the spec: Kubernetes read\n   * the write and said no. They run the old spec, and a second call meets\n   * the same answer.\n   */\n  rejectedClusters: number\n  /**\n   * The clusters of `clusterCount` whose write failed before or after\n   * Kubernetes read it. A second call sends the spec again.\n   */\n  failedClusters: number\n  /**\n   * True when the generation already held every requested value because an\n   * earlier call of the same request wrote it, and console sent the spec to\n   * the clusters again instead of writing.\n   */\n  reapplied: boolean\n  /**\n   * The env var fields that this call changed. Only the keys, never the\n   * text. Empty when the call wrote no env var.\n   */\n  changedEnvVars: GenerationEnvVarsKey[]\n}\n"],
-  "mappings": "AAeO,MAAM,uBAAuB;AAG7B,MAAM,kCAAkC;AAWxC,MAAM,sCAAsC;AAY5C,MAAM,sCAAsC;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { GenerationEnvVarsKey } from '../types/C8ClusterComponentVersions.type.js'\n\n/** The longest name that an `edit-generation` request writes. */\nexport const EDIT_GENERATION_NAME_MAX_LENGTH = 200\n\n/**\n * The longest env var text of one field in an `edit-generation` request.\n *\n * A request holds the text before and after for each of the 8 fields, thus\n * 320,000 characters at most. Plain env var text (`KEY=value` lines) stays\n * under the body limit of control-backend and of console (1 MiB each). A\n * text with many characters that JSON escapes can go over it, and the\n * backend then refuses the request.\n */\nexport const EDIT_GENERATION_ENV_VARS_MAX_LENGTH = 20_000\n\n/**\n * The longest value that an `edit-generation` request carries as the value\n * that it read (`expectedName` and `expectedEnvVars`).\n *\n * The limits of a new value do not apply to it. A generation can hold a\n * value from before those limits, and a request must still be able to\n * change that value, or another field beside it. Thus this number is the\n * body limit of control-backend and of console (1 MiB), and the body limit\n * is the true bound.\n */\nexport const EDIT_GENERATION_EXPECTED_MAX_LENGTH = 1_048_576\n\n/**\n * What console-backend answers when an approved request edited ONE\n * generation (`PATCH api/admin/approvals/generations/:generationId/edit`).\n *\n * It holds no env var text. control-backend keeps it in the result of the\n * request.\n */\nexport interface EditGenerationResult {\n  generationId: string\n  /** The name of the generation after the call. */\n  name: string\n  /**\n   * The clusters of the generation that console sent the spec to. Zero when\n   * the generation already held every requested value and no earlier call\n   * of the request wrote it: console then wrote nothing and sent nothing.\n   */\n  clusterCount: number\n  /**\n   * The clusters of `clusterCount` that refused the spec: Kubernetes read\n   * the write and said no. They run the old spec, and a second call meets\n   * the same answer.\n   */\n  rejectedClusters: number\n  /**\n   * The clusters of `clusterCount` whose write failed before or after\n   * Kubernetes read it. A second call sends the spec again.\n   */\n  failedClusters: number\n  /**\n   * True when the generation already held every requested value because an\n   * earlier call of the same request wrote it, and console sent the spec to\n   * the clusters again instead of writing.\n   */\n  reapplied: boolean\n  /**\n   * The env var fields that this call changed. Only the keys, never the\n   * text. Empty when the call wrote no env var.\n   */\n  changedEnvVars: GenerationEnvVarsKey[]\n}\n"],
+  "mappings": "AASO,MAAM,kCAAkC;AAWxC,MAAM,sCAAsC;AAY5C,MAAM,sCAAsC;",
   "names": []
 }

package/dist/approvals/force-delete-cluster-plan-type.d.ts

@@ -1,13 +1,3 @@
-/**
- * The flag of the `force-delete-cluster-plan-type` use case.
- *
- * Three services read it. control-backend opens a request only while it is
- * on. Control shows the request in place of the direct force delete. Console
- * refuses the direct force delete route to a person only while
- * `control.lockDirectRoutes` is on too. While the lock is off, a person who
- * holds `cptfd` can still call that route and skip the approvals.
- */
-export declare const FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG = "control.forceDeleteClusterPlanType";
 /**
  * The most clusters that one force delete request can delete.
  *
@@ -15,14 +5,6 @@ export declare const FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG = "control.forceDeleteC
  * delete. A plan type with more clusters needs a cluster bulk deletion first.
  */
 export declare const FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS = 500;
-/**
- * The approvals of a force delete on prod: two people other than the person
- * who asks. The request deletes customer clusters of many organizations, the
- * same harm as a cluster bulk deletion (`CLUSTER_BULK_OPERATION_MIN_ACKS`).
- */
-export declare const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_PROD = 2;
-/** The approvals of a force delete on dev, int and local. */
-export declare const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_TEST_STAGE = 1;
 /** One cluster of a plan type, as console answers it to control-backend. */
 export interface ClusterPlanTypeClusterDto {
     id: string;

package/dist/approvals/force-delete-cluster-plan-type.js

@@ -1,11 +1,5 @@
-const FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG = "control.forceDeleteClusterPlanType";
 const FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS = 500;
-const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_PROD = 2;
-const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_TEST_STAGE = 1;
 export {
-  FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG,
-  FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS,
-  FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_PROD,
-  FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_TEST_STAGE
+  FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS
 };
 //# sourceMappingURL=force-delete-cluster-plan-type.js.map

package/dist/approvals/force-delete-cluster-plan-type.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/force-delete-cluster-plan-type.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The flag of the `force-delete-cluster-plan-type` use case.\n *\n * Three services read it. control-backend opens a request only while it is\n * on. Control shows the request in place of the direct force delete. Console\n * refuses the direct force delete route to a person only while\n * `control.lockDirectRoutes` is on too. While the lock is off, a person who\n * holds `cptfd` can still call that route and skip the approvals.\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG =\n  'control.forceDeleteClusterPlanType'\n\n/**\n * The most clusters that one force delete request can delete.\n *\n * The request lists each cluster, so that the approvers read what they\n * delete. A plan type with more clusters needs a cluster bulk deletion first.\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS = 500\n\n/**\n * The approvals of a force delete on prod: two people other than the person\n * who asks. The request deletes customer clusters of many organizations, the\n * same harm as a cluster bulk deletion (`CLUSTER_BULK_OPERATION_MIN_ACKS`).\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_PROD = 2\n\n/** The approvals of a force delete on dev, int and local. */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_TEST_STAGE = 1\n\n/** One cluster of a plan type, as console answers it to control-backend. */\nexport interface ClusterPlanTypeClusterDto {\n  id: string\n  name: string\n  orgId: string\n}\n\n/**\n * The clusters of a plan type now. Console answers it on\n * `GET api/admin/approvals/cluster-plan-types/:planTypeId/clusters`.\n */\nexport interface ClusterPlanTypeClustersDto {\n  planTypeId: string\n  planTypeName: string\n  clusters: ClusterPlanTypeClusterDto[]\n}\n\n/**\n * What console did with one step of a force delete.\n *\n * `gone` means that there was nothing to delete: the cluster or the plan type\n * does not exist, or the cluster moved to another plan type. A second run\n * then reads `gone` for a step that the first run finished.\n */\nexport interface ForceDeleteClusterPlanTypeStepResult {\n  outcome: 'deleted' | 'gone'\n}\n"],
-  "mappings": "AAeO,MAAM,sCACX;AAQK,MAAM,8CAA8C;AAOpD,MAAM,+CAA+C;AAGrD,MAAM,qDAAqD;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The most clusters that one force delete request can delete.\n *\n * The request lists each cluster, so that the approvers read what they\n * delete. A plan type with more clusters needs a cluster bulk deletion first.\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS = 500\n\n/** One cluster of a plan type, as console answers it to control-backend. */\nexport interface ClusterPlanTypeClusterDto {\n  id: string\n  name: string\n  orgId: string\n}\n\n/**\n * The clusters of a plan type now. Console answers it on\n * `GET api/admin/approvals/cluster-plan-types/:planTypeId/clusters`.\n */\nexport interface ClusterPlanTypeClustersDto {\n  planTypeId: string\n  planTypeName: string\n  clusters: ClusterPlanTypeClusterDto[]\n}\n\n/**\n * What console did with one step of a force delete.\n *\n * `gone` means that there was nothing to delete: the cluster or the plan type\n * does not exist, or the cluster moved to another plan type. A second run\n * then reads `gone` for a step that the first run finished.\n */\nexport interface ForceDeleteClusterPlanTypeStepResult {\n  outcome: 'deleted' | 'gone'\n}\n"],
+  "mappings": "AAYO,MAAM,8CAA8C;",
   "names": []
 }

package/dist/approvals/policy.d.ts

@@ -1,4 +1,4 @@
-import type { ApprovalJobDto, ApprovalUseCaseDto } from '../dtos/ApprovalJob.dto.js';
+import type { ApprovalJobDto, ApprovalOverrideGrantDto, ApprovalUseCaseDto } from '../dtos/ApprovalJob.dto.js';
 /**
  * The rules of the approval mechanism, as pure functions.
  *
@@ -88,7 +88,7 @@ export declare function hasActorEmail(actor: ApprovalActorView): boolean;
  * frontend can branch on it. The message is for a person, and it is shown as
  * written.
  */
-export type ApprovalDenialCode = 'forbidden' | 'not-pending' | 'self-approval' | 'self-rejection' | 'already-acknowledged' | 'expired' | 'not-creator' | 'not-executable' | 'no-reason' | 'too-few-acks' | 'no-creator-email';
+export type ApprovalDenialCode = 'forbidden' | 'not-pending' | 'self-approval' | 'self-rejection' | 'already-acknowledged' | 'expired' | 'not-creator' | 'not-executable' | 'no-reason' | 'too-few-acks' | 'no-creator-email' | 'no-override-grant' | 'not-overridable';
 export type ApprovalDecision = {
     allowed: true;
 } | {
@@ -148,6 +148,26 @@ export declare function requiredPermissionsOf(job: ApprovalJobDto): string[];
  * the same page that a person is allowed to read.
  */
 export declare function canView(job: ApprovalJobDto, actor: ApprovalActorView, useCase: ApprovalUseCaseDto): ApprovalDecision;
+/**
+ * The person that a request of the two override use cases names, or
+ * `undefined` for every other request.
+ *
+ * Four rules read it. The grantee cannot approve their own grant, also not
+ * when they open it (`opensWithOwnApproval`), the grantee can read both
+ * requests, and the grantee can end their own grant before its time.
+ */
+export declare function overrideGranteeOf(job: Pick<ApprovalJobDto, 'type' | 'payload'>): {
+    userId: string;
+    email?: string;
+} | undefined;
+/**
+ * Reports whether an approval override grant lets its holder act now.
+ *
+ * It fails closed: an absent grant, a revoked one, and a date that does not
+ * parse are all inactive. control-backend reads the grant from its table at
+ * every call. A token never carries it.
+ */
+export declare function isOverrideGrantActive(grant: Pick<ApprovalOverrideGrantDto, 'expiresAt' | 'revokedAt'> | undefined, now: Date): boolean;
 /**
  * Who can OPEN a request, and with what.
  *
@@ -171,6 +191,30 @@ export declare function canCreate(actor: ApprovalActorView, useCase: ApprovalUse
      */
     requiredPermissions?: string[];
 }): ApprovalDecision;
+/**
+ * Reports whether the opener approves a new request when it is created.
+ *
+ * The opener approves when the request needs an approval and the opener holds
+ * every run permission of it. `APPROVAL_RULES` counts this approval. A request
+ * that needs no approval gets none, so its `approvedBy` stays empty.
+ *
+ * When `request` is given, the grantee of an approval override grant does not
+ * approve the grant that they open for themselves, as `canAcknowledge`
+ * refuses their approval later. Every approval of such a request then comes
+ * from another person.
+ */
+export declare function opensWithOwnApproval(actor: ApprovalActorView, requiredAcks: number, requiredPermissions: string[], request?: Pick<ApprovalJobDto, 'type' | 'payload'>): boolean;
+/**
+ * Reports whether a new request needs a reason.
+ *
+ * A request needs no reason when its opener holds every run permission and
+ * needs no second person. Nobody else reads the reason before the action
+ * runs, and the audit record names the opener.
+ */
+export declare function needsReason(actor: ApprovalActorView, useCase: ApprovalUseCaseDto, request?: {
+    requiredAcks?: number;
+    requiredPermissions?: string[];
+}): boolean;
 /**
  * The approvals that a new request asks for.
  *
@@ -229,9 +273,11 @@ export declare function canWithdraw(job: ApprovalJobDto, actor: ApprovalActorVie
  *
  * ANY holder of the permission may press it, and not only the person who
  * opened the request. The decision was made when the request reached
- * `approved`: `canAcknowledge` refuses the creator, so the approvals on the
- * row came from other people, and the button only carries out what they
- * already agreed to. Holding the button to the creator would let one Camundi
+ * `approved`, when the row got all the approvals that the request asks for.
+ * One of them can be the approval of the opener at create (see
+ * `opensWithOwnApproval`), and `canAcknowledge` keeps each person to one
+ * approval. The button only carries out what these people already agreed to.
+ * Holding the button to the creator would let one Camundi
  * on holiday freeze an approved action, and a use case that must not run
  * without its author has `executionMode: 'auto'` instead.
  *
@@ -241,6 +287,45 @@ export declare function canWithdraw(job: ApprovalJobDto, actor: ApprovalActorVie
  * `onBehalfOf` of `extend-trial`.
  */
 export declare function canExecute(job: ApprovalJobDto, actor: ApprovalActorView, now?: Date): ApprovalDecision;
+/**
+ * Why a request that an override approved can no longer run: the grant that
+ * the override used ended. The revoke of a grant writes it as `closedReason`
+ * on each such request, and `canRunOverridden` answers it.
+ */
+export declare const OVERRIDE_GRANT_ENDED_MESSAGE = "The approval override grant that ran this request ended. Open a new request.";
+/**
+ * Reports whether a request that an override ran can still run.
+ *
+ * An override of a request in the explicit mode moves it to `approved`, and a
+ * person runs it later. A failed run can also run again. The grant is the only
+ * thing that stood in for the approvals, so each run needs it to be active
+ * still: a revoke or the end of the grant stops the request too.
+ *
+ * `grant` is the grant that the override used (`job.overrideGrantId`), which
+ * the caller reads from the grant table at the run. A later grant of the same
+ * person does not count: a revoke ends the requests that its grant ran, and a
+ * new grant must not bring them back. A request with no override is not
+ * affected. A type that joined `APPROVAL_OVERRIDE_DENYLIST` after the
+ * override needs its approvals, as `canOverride` says.
+ */
+export declare function canRunOverridden(job: Pick<ApprovalJobDto, 'type' | 'overriddenBy'>, grant: Pick<ApprovalOverrideGrantDto, 'expiresAt' | 'revokedAt'> | undefined, now: Date): ApprovalDecision;
+/**
+ * Runs a `pending` request with an approval override grant, in place of the
+ * approvals that it still needs.
+ *
+ * `grant` is the active grant of the actor. The caller reads it from the
+ * grant table at every call, and never from a token: a token keeps its
+ * permissions until it expires, and a revoked grant must stop at once.
+ *
+ * The creator may override their own request, because that is what a grant
+ * is for. The actor still needs the permissions of the request: a grant
+ * takes the place of the second person, and not of the permission. A use case
+ * in `APPROVAL_OVERRIDE_DENYLIST` always needs its approvals.
+ */
+export declare function canOverride(job: ApprovalJobDto, actor: ApprovalActorView, now: Date, args: {
+    grant?: Pick<ApprovalOverrideGrantDto, 'userId' | 'email' | 'expiresAt' | 'revokedAt'>;
+    reason: string;
+}): ApprovalDecision;
 /**
  * How many days a request can run after its last approval.
  *
@@ -256,8 +341,10 @@ export declare const EXECUTE_WINDOW_DAYS = 7;
 /**
  * Reports the end of the run window of a request.
  *
- * The window starts at the last approval. A use case that needs zero
- * approvals has none, so its window starts when the request was opened.
+ * The window starts at the last decision that let the request run: the last
+ * approval, the override (`overriddenAt`), or the time of a `scheduled`
+ * request (`runAt`). A use case that needs zero approvals has none of them,
+ * so its window starts when the request was opened.
  */
 export declare function runWindowEnd(job: ApprovalJobDto): Date;
 /**

package/dist/approvals/policy.js

@@ -1,5 +1,9 @@
 import { UNKNOWN_ACTOR_EMAIL } from "../constants/misc.const.js";
 import { ConsolePermissions } from "../permissions/console.permissions.js";
+import {
+  APPROVAL_USE_CASE_TYPES,
+  isApprovalOverridable
+} from "./use-cases.const.js";
 function approvalPermissionCheck(held) {
   const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES);
   return (permission) => all || held.has(permission);
@@ -41,11 +45,34 @@ function requiredPermissionsOf(job) {
   return job.requiredPermissions;
 }
 function canView(job, actor, useCase) {
-  if (actor.has(useCase.requiredPermission) || isSameActor(job.createdBy, actor)) {
+  if (actor.has(useCase.requiredPermission) || isSameActor(job.createdBy, actor) || isOverrideGrantee(job, actor)) {
     return ALLOWED;
   }
   return deny("forbidden", "You cannot see this request.");
 }
+function overrideGranteeOf(job) {
+  if (job.type !== APPROVAL_USE_CASE_TYPES.grantApprovalOverride && job.type !== APPROVAL_USE_CASE_TYPES.revokeApprovalOverride) {
+    return void 0;
+  }
+  const { granteeUserId, granteeEmail } = job.payload;
+  if (typeof granteeUserId !== "string" && typeof granteeEmail !== "string") {
+    return void 0;
+  }
+  return {
+    userId: typeof granteeUserId === "string" ? granteeUserId : "",
+    email: typeof granteeEmail === "string" ? granteeEmail : void 0
+  };
+}
+function isOverrideGrantee(job, actor) {
+  const grantee = overrideGranteeOf(job);
+  return grantee !== void 0 && isSameActor(grantee, actor);
+}
+function isOverrideGrantActive(grant, now) {
+  if (!grant || grant.revokedAt) {
+    return false;
+  }
+  return new Date(grant.expiresAt).getTime() > now.getTime();
+}
 function canCreate(actor, useCase, request = {}) {
   if (useCase.createPermission && !actor.has(useCase.createPermission)) {
     return deny(
@@ -76,7 +103,10 @@ function canCreate(actor, useCase, request = {}) {
       "This action needs the email address of the person who asks for it, and your session carries none. Sign in as a person to open this request."
     );
   }
-  if (useCase.reasonRequired && (request.reason ?? "").trim().length === 0) {
+  if (needsReason(actor, useCase, {
+    requiredAcks: request.requiredAcks,
+    requiredPermissions: toRun
+  }) && (request.reason ?? "").trim().length === 0) {
     return deny("no-reason", "Give a reason to open this request.");
   }
   if (request.requiredAcks !== void 0 && request.requiredAcks < useCase.minAcks) {
@@ -87,6 +117,21 @@ function canCreate(actor, useCase, request = {}) {
   }
   return ALLOWED;
 }
+function opensWithOwnApproval(actor, requiredAcks, requiredPermissions, request) {
+  if (request !== void 0 && isOverrideGrantee(request, actor)) {
+    return false;
+  }
+  return requiredAcks > 0 && hasEveryPermission(actor, requiredPermissions);
+}
+function needsReason(actor, useCase, request = {}) {
+  if (!useCase.reasonRequired) {
+    return false;
+  }
+  return !(resolveRequiredAcks(useCase, request.requiredAcks) <= 1 && hasEveryPermission(
+    actor,
+    request.requiredPermissions ?? [useCase.requiredPermission]
+  ));
+}
 function resolveRequiredAcks(useCase, requested) {
   if (requested === void 0) {
     return Math.max(useCase.defaultAcks, useCase.minAcks);
@@ -115,6 +160,12 @@ function canAcknowledge(job, actor, now) {
       "You opened this request, so you cannot approve it."
     );
   }
+  if (isOverrideGrantee(job, actor)) {
+    return deny(
+      "self-approval",
+      "This request gives you an override grant, so you cannot approve it."
+    );
+  }
   if (job.acks.some((ack) => isSameActor(ack, actor))) {
     return deny("already-acknowledged", "You already approved this request.");
   }
@@ -169,13 +220,20 @@ function canWithdraw(job, actor, now) {
   return ALLOWED;
 }
 function canExecute(job, actor, now = /* @__PURE__ */ new Date()) {
-  if (!hasEveryPermission(actor, job.requiredPermissions)) {
+  const endsOwnGrant = (job.status === "scheduled" || job.status === "failed") && job.type === APPROVAL_USE_CASE_TYPES.revokeApprovalOverride && isOverrideGrantee(job, actor);
+  if (!endsOwnGrant && !hasEveryPermission(actor, job.requiredPermissions)) {
     return deny("forbidden", "You cannot run this request.");
   }
+  if (job.type === APPROVAL_USE_CASE_TYPES.grantApprovalOverride && isOverrideGrantee(job, actor)) {
+    return deny(
+      "self-approval",
+      "This request gives you an override grant, so you cannot run it."
+    );
+  }
   if (job.status === "expired") {
     return deny("expired", "This request is expired. Open a new request.");
   }
-  if (job.status !== "approved" && job.status !== "failed") {
+  if (job.status !== "approved" && job.status !== "failed" && job.status !== "scheduled") {
     return deny(
       "not-executable",
       `This request is ${job.status} and cannot be run.`
@@ -189,11 +247,65 @@ function canExecute(job, actor, now = /* @__PURE__ */ new Date()) {
   }
   return ALLOWED;
 }
+const OVERRIDE_GRANT_ENDED_MESSAGE = "The approval override grant that ran this request ended. Open a new request.";
+function canRunOverridden(job, grant, now) {
+  if (!job.overriddenBy) {
+    return ALLOWED;
+  }
+  if (!isApprovalOverridable(job.type)) {
+    return deny(
+      "not-overridable",
+      "An override cannot run this type of request. It needs its approvals."
+    );
+  }
+  if (isOverrideGrantActive(grant, now)) {
+    return ALLOWED;
+  }
+  return deny("no-override-grant", OVERRIDE_GRANT_ENDED_MESSAGE);
+}
+function canOverride(job, actor, now, args) {
+  if (!args.grant || !isOverrideGrantActive(args.grant, now) || !isSameActor(args.grant, actor)) {
+    return deny(
+      "no-override-grant",
+      "You hold no active approval override grant."
+    );
+  }
+  if (!isApprovalOverridable(job.type)) {
+    return deny(
+      "not-overridable",
+      "An override cannot run this type of request. It needs its approvals."
+    );
+  }
+  if (!hasEveryPermission(actor, job.requiredPermissions)) {
+    return deny("forbidden", "You cannot run this request.");
+  }
+  if (isExpired(job, now)) {
+    return deny("expired", "This request expired and can no longer be run.");
+  }
+  if (job.status !== "pending") {
+    return deny(
+      "not-pending",
+      `This request is ${job.status} and cannot be run with an override.`
+    );
+  }
+  if (args.reason.trim().length === 0) {
+    return deny(
+      "no-reason",
+      "Give a reason to run this request with an override."
+    );
+  }
+  return ALLOWED;
+}
 const EXECUTE_WINDOW_DAYS = 7;
 const DAY_MS = 24 * 60 * 60 * 1e3;
 function runWindowEnd(job) {
-  const start = job.acks.reduce(
-    (latest, ack) => Math.max(latest, new Date(ack.date).getTime()),
+  const decisions = [
+    ...job.acks.map((ack) => ack.date),
+    job.overriddenAt,
+    job.runAt
+  ];
+  const start = decisions.reduce(
+    (latest, date) => date === void 0 ? latest : Math.max(latest, new Date(date).getTime()),
     new Date(job.createdAt).getTime()
   );
   return new Date(start + EXECUTE_WINDOW_DAYS * DAY_MS);
@@ -209,11 +321,14 @@ function hasFailedRun(job) {
 }
 export {
   EXECUTE_WINDOW_DAYS,
+  OVERRIDE_GRANT_ENDED_MESSAGE,
   approvalPermissionCheck,
   canAcknowledge,
   canCreate,
   canExecute,
+  canOverride,
   canReject,
+  canRunOverridden,
   canView,
   canWithdraw,
   effectiveStatus,
@@ -221,9 +336,13 @@ export {
   hasEveryPermission,
   hasFailedRun,
   isExpired,
+  isOverrideGrantActive,
   isRunWindowClosed,
   isSameActor,
   isSameActorEmail,
+  needsReason,
+  opensWithOwnApproval,
+  overrideGranteeOf,
   remainingAcks,
   requiredPermissionsOf,
   resolveRequiredAcks,