@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.2

package/src/authorization/approval.js

@@ -0,0 +1,249 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { canonicalJson } from '../canonical-json.js';
+import { isBoundedSafeReference } from '../safe-reference.js';
+import { allowAuthorization, denyAuthorization, } from './model.js';
+export const APPROVAL_REQUEST_SCHEMA_VERSION = 1;
+export const DEFAULT_MAX_APPROVAL_TTL_SECONDS = 24 * 60 * 60;
+const SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+function requiredReference(value, label) {
+    const normalized = value.trim();
+    if (!isBoundedSafeReference(normalized)) {
+        throw new Error(`[runtime/authorization] Approval ${label} must be a bounded safe reference.`);
+    }
+    return normalized;
+}
+function instant(value, label) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        throw new Error(`[runtime/authorization] Approval ${label} must be a valid instant.`);
+    }
+    return parsed;
+}
+/**
+ * Binds approval to the exact action, safe resource reference, and canonical
+ * command. The command itself is never retained on the approval record.
+ */
+export function digestApprovalRequest(input) {
+    const material = {
+        action: requiredReference(input.action, 'action'),
+        command: input.command,
+        resource: Object.assign(Object.assign({}, (input.resource.id
+            ? { id: requiredReference(input.resource.id, 'resource id') }
+            : {})), { type: requiredReference(input.resource.type, 'resource type') }),
+    };
+    return createHash('sha256')
+        .update(canonicalJson(material, {
+        maximumKeyLength: 256,
+        rejectControlCharactersInKeys: true,
+        rejectEmptyKeys: true,
+    }), 'utf8')
+        .digest('hex');
+}
+export function toApprovalActorReference(principal) {
+    const effectiveHumanId = principal.authority.mode === 'delegated'
+        ? principal.authority.delegatedBy.id
+        : principal.authority.mode === 'direct' && principal.actor.type === 'user'
+            ? principal.actor.id
+            : undefined;
+    return Object.freeze(Object.assign(Object.assign({ actorId: requiredReference(principal.actor.id, 'actor id'), authorityMode: principal.authority.mode }, (effectiveHumanId
+        ? {
+            effectiveHumanId: requiredReference(effectiveHumanId, 'effective human id'),
+        }
+        : {})), { subjectType: principal.actor.type }));
+}
+export function createApprovalRequest(input) {
+    if (!SAFE_NAME.test(input.slice)) {
+        throw new Error('[runtime/authorization] Approval Slice must be a safe name.');
+    }
+    const now = instant(input.now, 'requestedAt');
+    const expiresAt = instant(input.expiresAt, 'expiresAt');
+    if (expiresAt <= now ||
+        expiresAt - now > DEFAULT_MAX_APPROVAL_TTL_SECONDS * 1000) {
+        throw new Error(`[runtime/authorization] Approval lifetime must be positive and no longer than ${DEFAULT_MAX_APPROVAL_TTL_SECONDS} seconds.`);
+    }
+    return Object.freeze({
+        action: requiredReference(input.action, 'action'),
+        author: toApprovalActorReference(input.author),
+        expiresAt: new Date(expiresAt).toISOString(),
+        id: randomUUID(),
+        policyVersion: requiredReference(input.policyVersion, 'policy version'),
+        requestDigest: digestApprovalRequest(input),
+        requestedAt: new Date(now).toISOString(),
+        resource: Object.freeze(Object.assign(Object.assign({}, (input.resource.id
+            ? { id: requiredReference(input.resource.id, 'resource id') }
+            : {})), { type: requiredReference(input.resource.type, 'resource type') })),
+        revision: 0,
+        schemaVersion: APPROVAL_REQUEST_SCHEMA_VERSION,
+        slice: input.slice,
+        status: 'pending',
+    });
+}
+function cloneRequest(request) {
+    return structuredClone(request);
+}
+export function expireApprovalRequest(request, now) {
+    const at = instant(now, 'expiry check');
+    if (['executed', 'executing', 'expired', 'rejected'].includes(request.status) ||
+        at < Date.parse(request.expiresAt)) {
+        return request;
+    }
+    return Object.freeze(Object.assign(Object.assign({}, cloneRequest(request)), { revision: request.revision + 1, status: 'expired' }));
+}
+/**
+ * Enforces direct-human, non-author review. A human who authored through a
+ * delegated agent remains the effective author and cannot approve through a
+ * different session.
+ */
+export function decideApprovalRequest(request, input) {
+    const requiredPolicyVersion = requiredReference(input.requiredPolicyVersion, 'required policy version');
+    if (request.policyVersion !== requiredPolicyVersion) {
+        return {
+            decision: denyAuthorization('policy-stale', requiredPolicyVersion),
+            request,
+        };
+    }
+    const expired = expireApprovalRequest(request, input.now);
+    if (expired.status === 'expired') {
+        return {
+            decision: denyAuthorization('approval-expired', request.policyVersion),
+            request: expired,
+        };
+    }
+    const approver = toApprovalActorReference(input.approver);
+    const decidedAt = instant(input.now, 'decision time');
+    const selfReview = approver.actorId === request.author.actorId ||
+        (approver.effectiveHumanId !== undefined &&
+            approver.effectiveHumanId === request.author.effectiveHumanId) ||
+        (approver.effectiveHumanId !== undefined &&
+            approver.effectiveHumanId === request.author.actorId) ||
+        (request.author.effectiveHumanId !== undefined &&
+            request.author.effectiveHumanId === approver.actorId);
+    if (request.status !== 'pending' ||
+        decidedAt < Date.parse(request.requestedAt) ||
+        input.expectedRequestDigest !== request.requestDigest ||
+        input.approver.authority.mode !== 'direct' ||
+        input.approver.actor.type !== 'user' ||
+        selfReview) {
+        return {
+            decision: denyAuthorization('approval-invalid', request.policyVersion),
+            request,
+        };
+    }
+    const outcome = input.outcome;
+    const next = Object.freeze(Object.assign(Object.assign({}, cloneRequest(request)), { decision: Object.freeze({
+            at: new Date(decidedAt).toISOString(),
+            decidedBy: approver,
+            outcome,
+            reasonReference: requiredReference(input.reasonReference, 'decision reason reference'),
+        }), revision: request.revision + 1, status: outcome }));
+    return {
+        decision: allowAuthorization(request.policyVersion),
+        request: next,
+    };
+}
+export function authorizeApprovalExecution(request, input) {
+    var _a, _b, _c;
+    const now = instant(input.now, 'execution check');
+    const requiredPolicyVersion = requiredReference(input.requiredPolicyVersion, 'required policy version');
+    if (request.policyVersion !== requiredPolicyVersion) {
+        return denyAuthorization('policy-stale', requiredPolicyVersion);
+    }
+    if (request.status === 'expired' || now >= Date.parse(request.expiresAt)) {
+        return denyAuthorization('approval-expired', request.policyVersion);
+    }
+    if (digestApprovalRequest(input) !== request.requestDigest) {
+        return denyAuthorization('approval-invalid', request.policyVersion);
+    }
+    if (request.status === 'pending') {
+        return denyAuthorization('approval-pending', request.policyVersion);
+    }
+    const approver = (_a = request.decision) === null || _a === void 0 ? void 0 : _a.decidedBy;
+    const selfReview = (approver === null || approver === void 0 ? void 0 : approver.actorId) === request.author.actorId ||
+        ((approver === null || approver === void 0 ? void 0 : approver.effectiveHumanId) !== undefined &&
+            approver.effectiveHumanId === request.author.effectiveHumanId) ||
+        ((approver === null || approver === void 0 ? void 0 : approver.effectiveHumanId) !== undefined &&
+            approver.effectiveHumanId === request.author.actorId) ||
+        (request.author.effectiveHumanId !== undefined &&
+            request.author.effectiveHumanId === (approver === null || approver === void 0 ? void 0 : approver.actorId));
+    if (((_b = request.decision) === null || _b === void 0 ? void 0 : _b.outcome) !== 'approved' ||
+        (approver === null || approver === void 0 ? void 0 : approver.authorityMode) !== 'direct' ||
+        approver.subjectType !== 'user' ||
+        selfReview) {
+        return denyAuthorization('approval-invalid', request.policyVersion);
+    }
+    const decisionAt = (_c = request.decision) === null || _c === void 0 ? void 0 : _c.at;
+    if (now < Date.parse(request.requestedAt) ||
+        (decisionAt !== undefined && now < Date.parse(decisionAt))) {
+        return denyAuthorization('approval-invalid', request.policyVersion);
+    }
+    if (request.status !== 'approved') {
+        return denyAuthorization('approval-invalid', request.policyVersion);
+    }
+    return allowAuthorization(request.policyVersion);
+}
+/**
+ * Claims an approved command before its protected effect. Persist this
+ * revision with compare-and-set, then execute idempotently under executionId.
+ */
+export function beginApprovalExecution(request, input) {
+    var _a, _b;
+    const startedAt = instant(input.now, 'execution start');
+    const requiredPolicyVersion = requiredReference(input.requiredPolicyVersion, 'required policy version');
+    if (request.policyVersion !== requiredPolicyVersion) {
+        return {
+            decision: denyAuthorization('policy-stale', requiredPolicyVersion),
+            request,
+        };
+    }
+    if (request.status === 'executing') {
+        const executionId = input.executionId === undefined
+            ? undefined
+            : requiredReference(input.executionId, 'execution id');
+        const exactRetry = executionId !== undefined &&
+            ((_a = request.execution) === null || _a === void 0 ? void 0 : _a.executionId) === executionId &&
+            digestApprovalRequest(input) === request.requestDigest &&
+            startedAt >= Date.parse(request.execution.startedAt) &&
+            Date.parse(request.execution.startedAt) < Date.parse(request.expiresAt);
+        return {
+            decision: exactRetry
+                ? allowAuthorization(request.policyVersion)
+                : denyAuthorization('approval-invalid', request.policyVersion),
+            request,
+        };
+    }
+    const decision = authorizeApprovalExecution(request, input);
+    if (decision.decision === 'deny')
+        return { decision, request };
+    const executionId = requiredReference((_b = input.executionId) !== null && _b !== void 0 ? _b : randomUUID(), 'execution id');
+    return {
+        decision,
+        request: Object.freeze(Object.assign(Object.assign({}, cloneRequest(request)), { execution: Object.freeze({
+                executionId,
+                startedAt: new Date(startedAt).toISOString(),
+            }), revision: request.revision + 1, status: 'executing' })),
+    };
+}
+export function completeApprovalExecution(request, input) {
+    var _a;
+    const completedAt = instant(input.now, 'execution completion');
+    const requiredPolicyVersion = requiredReference(input.requiredPolicyVersion, 'required policy version');
+    if (request.policyVersion !== requiredPolicyVersion) {
+        return {
+            decision: denyAuthorization('policy-stale', requiredPolicyVersion),
+            request,
+        };
+    }
+    if (request.status !== 'executing' ||
+        ((_a = request.execution) === null || _a === void 0 ? void 0 : _a.executionId) !== input.executionId ||
+        completedAt < Date.parse(request.execution.startedAt)) {
+        return {
+            decision: denyAuthorization('approval-invalid', request.policyVersion),
+            request,
+        };
+    }
+    return {
+        decision: allowAuthorization(request.policyVersion),
+        request: Object.freeze(Object.assign(Object.assign({}, cloneRequest(request)), { execution: Object.freeze(Object.assign(Object.assign({}, request.execution), { completedAt: new Date(completedAt).toISOString() })), revision: request.revision + 1, status: 'executed' })),
+    };
+}
+//# sourceMappingURL=approval.js.map

package/src/authorization/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAU,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAyF7D,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAE3C,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,oCAAoC,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,KAAa;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,2BAA2B,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAkC;IAElC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,kCACH,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC,KACP,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,GAC9D;KACF,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,aAAa,CAAC,QAAQ,EAAE;QACtB,gBAAgB,EAAE,GAAG;QACrB,6BAA6B,EAAE,IAAI;QACnC,eAAe,EAAE,IAAI;KACtB,CAAC,EACF,MAAM,CACP;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,SAAiC;IAEjC,MAAM,gBAAgB,GACpB,SAAS,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;QACtC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;QACpC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YACxE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACpB,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO,MAAM,CAAC,MAAM,+BAClB,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,EAC1D,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,IAAI,IACpC,CAAC,gBAAgB;QAClB,CAAC,CAAC;YACE,gBAAgB,EAAE,iBAAiB,CACjC,gBAAgB,EAChB,oBAAoB,CACrB;SACF;QACH,CAAC,CAAC,EAAE,CAAC,KACP,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,IACjC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAyC;IAEzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,IACE,SAAS,IAAI,GAAG;QAChB,SAAS,GAAG,GAAG,GAAG,gCAAgC,GAAG,IAAK,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iFAAiF,gCAAgC,WAAW,CAC7H,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAW;QAC3D,MAAM,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9C,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,EAAE,EAAE,UAAU,EAAE;QAChB,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC;QACvE,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC;QAC3C,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,iCAClB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC,KACP,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,IAC7D;QACF,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,+BAA+B;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,SAAkB;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,OAAgC;IAEhC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgC,EAChC,GAAW;IAEX,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACxC,IACE,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACzE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,iCACf,YAAY,CAAC,OAAO,CAAC,KACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAC9B,MAAM,EAAE,SAAkB,IAC1B,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC,EAChC,KAAiC;IAEjC,MAAM,qBAAqB,GAAG,iBAAiB,CAC7C,KAAK,CAAC,qBAAqB,EAC3B,yBAAyB,CAC1B,CAAC;IACF,IAAI,OAAO,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,cAAc,EAAE,qBAAqB,CAAC;YAClE,OAAO;SACR,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC;YACtE,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,MAAM,UAAU,GACd,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO;QAC3C,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS;YACtC,QAAQ,CAAC,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChE,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS;YACtC,QAAQ,CAAC,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAC5C,OAAO,CAAC,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAC3C,KAAK,CAAC,qBAAqB,KAAK,OAAO,CAAC,aAAa;QACrD,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;QAC1C,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;QACpC,UAAU,EACV,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC;YACtE,OAAO;SACR,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,IAAI,GAA4B,MAAM,CAAC,MAAM,iCAC9C,YAAY,CAAC,OAAO,CAAC,KACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,EAAE,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,QAAQ;YACnB,OAAO;YACP,eAAe,EAAE,iBAAiB,CAChC,KAAK,CAAC,eAAe,EACrB,2BAA2B,CAC5B;SACF,CAAC,EACF,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAC9B,MAAM,EAAE,OAAO,IACf,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACnD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAgC,EAChC,KAGC;;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAClD,MAAM,qBAAqB,GAAG,iBAAiB,CAC7C,KAAK,CAAC,qBAAqB,EAC3B,yBAAyB,CAC1B,CAAC;IACF,IAAI,OAAO,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACpD,OAAO,iBAAiB,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,OAAO,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3D,OAAO,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,0CAAE,SAAS,CAAC;IAC7C,MAAM,UAAU,GACd,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,MAAK,OAAO,CAAC,MAAM,CAAC,OAAO;QAC5C,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,gBAAgB,MAAK,SAAS;YACvC,QAAQ,CAAC,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,gBAAgB,MAAK,SAAS;YACvC,QAAQ,CAAC,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAC5C,OAAO,CAAC,MAAM,CAAC,gBAAgB,MAAK,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,CAAC,CAAC;IAC3D,IACE,CAAA,MAAA,OAAO,CAAC,QAAQ,0CAAE,OAAO,MAAK,UAAU;QACxC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,MAAK,QAAQ;QACpC,QAAQ,CAAC,WAAW,KAAK,MAAM;QAC/B,UAAU,EACV,CAAC;QACD,OAAO,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,QAAQ,0CAAE,EAAE,CAAC;IACxC,IACE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QACrC,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAC1D,CAAC;QACD,OAAO,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC,EAChC,KAA0C;;IAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACxD,MAAM,qBAAqB,GAAG,iBAAiB,CAC7C,KAAK,CAAC,qBAAqB,EAC3B,yBAAyB,CAC1B,CAAC;IACF,IAAI,OAAO,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,cAAc,EAAE,qBAAqB,CAAC;YAClE,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,KAAK,SAAS;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC3D,MAAM,UAAU,GACd,WAAW,KAAK,SAAS;YACzB,CAAA,MAAA,OAAO,CAAC,SAAS,0CAAE,WAAW,MAAK,WAAW;YAC9C,qBAAqB,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,aAAa;YACtD,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1E,OAAO;YACL,QAAQ,EAAE,UAAU;gBAClB,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC3C,CAAC,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC;YAChE,OAAO;SACR,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,iBAAiB,CACnC,MAAA,KAAK,CAAC,WAAW,mCAAI,UAAU,EAAE,EACjC,cAAc,CACf,CAAC;IACF,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,MAAM,iCACjB,YAAY,CAAC,OAAO,CAAC,KACxB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;gBACvB,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aAC7C,CAAC,EACF,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAC9B,MAAM,EAAE,WAAoB,IAC5B;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAgC,EAChC,KAAqC;;IAErC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC/D,MAAM,qBAAqB,GAAG,iBAAiB,CAC7C,KAAK,CAAC,qBAAqB,EAC3B,yBAAyB,CAC1B,CAAC;IACF,IAAI,OAAO,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,cAAc,EAAE,qBAAqB,CAAC;YAClE,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,MAAM,KAAK,WAAW;QAC9B,CAAA,MAAA,OAAO,CAAC,SAAS,0CAAE,WAAW,MAAK,KAAK,CAAC,WAAW;QACpD,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EACrD,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC;YACtE,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACnD,OAAO,EAAE,MAAM,CAAC,MAAM,iCACjB,YAAY,CAAC,OAAO,CAAC,KACxB,SAAS,EAAE,MAAM,CAAC,MAAM,iCACnB,OAAO,CAAC,SAAS,KACpB,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,IAChD,EACF,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAC9B,MAAM,EAAE,UAAmB,IAC3B;KACH,CAAC;AACJ,CAAC"}

package/src/authorization/audit.d.ts

@@ -0,0 +1,35 @@
+import type { AuthorizationDecision, AuthorizationDenialCategory, AuthorizationInput, AuthorizationObligation } from './model.js';
+export interface AuthorizationAuditProjectionOptions {
+    approvalReference?: string;
+    correlationId: string;
+    delegationReference?: string;
+    pseudonymousSubjectId: string;
+    resourceReference?: string;
+    slice: string;
+    stage: string;
+    timestamp: string;
+}
+export interface AuthorizationAuditRecord {
+    action: string;
+    approvalReference?: string;
+    authorityMode: 'delegated' | 'direct' | 'machine';
+    correlationId: string;
+    decision: 'allow' | 'deny';
+    delegationReference?: string;
+    policyVersion: string;
+    principalKind: 'admin' | 'agent' | 'customer';
+    pseudonymousSubjectId: string;
+    reasonCategory: 'authorized' | AuthorizationDenialCategory;
+    resourceReference?: string;
+    resourceType: string;
+    slice: string;
+    stage: string;
+    subjectType: 'service' | 'system' | 'user';
+    timestamp: string;
+}
+/**
+ * Projects only the fixed semantic fields accepted by the authorization
+ * proposal. It never copies resource attributes, context facts, token claims,
+ * roles, scopes, email, or raw policy input into audit output.
+ */
+export declare function toAuthorizationAuditRecord<Input extends AuthorizationInput, Obligation extends AuthorizationObligation>(input: Input, decision: AuthorizationDecision<Obligation>, options: AuthorizationAuditProjectionOptions): AuthorizationAuditRecord;

package/src/authorization/audit.js

@@ -0,0 +1,35 @@
+import { isBoundedSafeReference } from '../safe-reference.js';
+const SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+function assertSafeReference(value, label) {
+    if (!isBoundedSafeReference(value)) {
+        throw new Error(`[runtime/authorization] ${label} must be a bounded safe reference.`);
+    }
+    return value;
+}
+/**
+ * Projects only the fixed semantic fields accepted by the authorization
+ * proposal. It never copies resource attributes, context facts, token claims,
+ * roles, scopes, email, or raw policy input into audit output.
+ */
+export function toAuthorizationAuditRecord(input, decision, options) {
+    if (!Number.isFinite(Date.parse(options.timestamp))) {
+        throw new Error('[runtime/authorization] Audit timestamp must be an ISO-compatible instant.');
+    }
+    if (!SAFE_NAME.test(options.slice) || !SAFE_NAME.test(options.stage)) {
+        throw new Error('[runtime/authorization] Audit Slice and stage must be safe names.');
+    }
+    return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ action: assertSafeReference(input.action, 'audit action') }, (options.approvalReference
+        ? {
+            approvalReference: assertSafeReference(options.approvalReference, 'approval reference'),
+        }
+        : {})), { authorityMode: input.principal.authority.mode, correlationId: assertSafeReference(options.correlationId, 'correlation id'), decision: decision.decision }), (options.delegationReference
+        ? {
+            delegationReference: assertSafeReference(options.delegationReference, 'delegation reference'),
+        }
+        : {})), { policyVersion: assertSafeReference(decision.policyVersion, 'policy version'), principalKind: input.principal.kind, pseudonymousSubjectId: assertSafeReference(options.pseudonymousSubjectId, 'pseudonymous subject id'), reasonCategory: decision.decision === 'allow' ? 'authorized' : decision.category }), (options.resourceReference
+        ? {
+            resourceReference: assertSafeReference(options.resourceReference, 'resource reference'),
+        }
+        : {})), { resourceType: assertSafeReference(input.resource.type, 'audit resource type'), slice: options.slice, stage: options.stage, subjectType: input.principal.actor.type, timestamp: options.timestamp });
+}
+//# sourceMappingURL=audit.js.map

package/src/authorization/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/audit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAgC9D,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAE3C,SAAS,mBAAmB,CAAC,KAAa,EAAE,KAAa;IACvD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,oCAAoC,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAIxC,KAAY,EACZ,QAA2C,EAC3C,OAA4C;IAE5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,6FACE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,IACtD,CAAC,OAAO,CAAC,iBAAiB;QAC3B,CAAC,CAAC;YACE,iBAAiB,EAAE,mBAAmB,CACpC,OAAO,CAAC,iBAAiB,EACzB,oBAAoB,CACrB;SACF;QACH,CAAC,CAAC,EAAE,CAAC,KACP,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAC7C,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAC3E,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KACxB,CAAC,OAAO,CAAC,mBAAmB;QAC7B,CAAC,CAAC;YACE,mBAAmB,EAAE,mBAAmB,CACtC,OAAO,CAAC,mBAAmB,EAC3B,sBAAsB,CACvB;SACF;QACH,CAAC,CAAC,EAAE,CAAC,KACP,aAAa,EAAE,mBAAmB,CAChC,QAAQ,CAAC,aAAa,EACtB,gBAAgB,CACjB,EACD,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EACnC,qBAAqB,EAAE,mBAAmB,CACxC,OAAO,CAAC,qBAAqB,EAC7B,yBAAyB,CAC1B,EACD,cAAc,EACZ,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAC/D,CAAC,OAAO,CAAC,iBAAiB;QAC3B,CAAC,CAAC;YACE,iBAAiB,EAAE,mBAAmB,CACpC,OAAO,CAAC,iBAAiB,EACzB,oBAAoB,CACrB;SACF;QACH,CAAC,CAAC,EAAE,CAAC,KACP,YAAY,EAAE,mBAAmB,CAC/B,KAAK,CAAC,QAAQ,CAAC,IAAI,EACnB,qBAAqB,CACtB,EACD,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAC5B;AACJ,CAAC"}

package/src/authorization/delegation.d.ts

@@ -0,0 +1,149 @@
+import type { RequestActor } from '../request-context.js';
+import type { AuthorizationEvaluator } from './evaluator.js';
+import { type AuthorizationContext, type AuthorizationDecision, type AuthorizationInput, type AuthorizationObligation, type AuthorizationPrincipal, type AuthorizationResource } from './model.js';
+export declare const DELEGATION_GRANT_SCHEMA_VERSION: 1;
+export declare const DEFAULT_MAX_DELEGATION_TTL_SECONDS: number;
+export declare const MAX_DELEGATION_WRITE_ATTEMPTS = 4;
+export interface ExactDelegationResourceBoundary {
+    kind: 'exact';
+    resourceIds: readonly string[];
+    resourceType: string;
+}
+export interface ConstraintDelegationResourceBoundary {
+    constraintId: string;
+    kind: 'constraint';
+    resourceType: string;
+}
+export type DelegationResourceBoundary = ConstraintDelegationResourceBoundary | ExactDelegationResourceBoundary;
+export interface DelegationRateLimit {
+    maximumUses: number;
+    windowSeconds: number;
+}
+export interface DelegationUsage {
+    lastUsedAt?: string;
+    rateWindowStartedAt?: string;
+    rateWindowUses: number;
+    totalUses: number;
+}
+export interface DelegationSubjectReference {
+    id: string;
+    type: RequestActor['type'];
+}
+export interface DelegationGrant<Action extends string = string> {
+    actions: readonly Action[];
+    agent: DelegationSubjectReference;
+    audience: string;
+    /**
+     * SHA-256 digest of the audience-bound opaque capability. Plaintext is
+     * returned once from issueDelegation and is never persisted in the grant.
+     */
+    capabilityDigest: string;
+    capabilityScopes: readonly string[];
+    delegator: DelegationSubjectReference & {
+        type: 'user';
+    };
+    expiresAt: string;
+    id: string;
+    issuedAt: string;
+    issuedUnderPolicyVersion: string;
+    maxUses?: number;
+    nonDelegableApprovalActions: readonly Action[];
+    purposeReference: string;
+    rateLimit?: DelegationRateLimit;
+    resourceBoundary: DelegationResourceBoundary;
+    revision: number;
+    revokedAt?: string;
+    revokedBy?: DelegationSubjectReference;
+    schemaVersion: typeof DELEGATION_GRANT_SCHEMA_VERSION;
+    slice: string;
+    status: 'active' | 'expired' | 'revoked';
+    usage: DelegationUsage;
+}
+export interface DelegationStore<Action extends string = string> {
+    /**
+     * Must create only when the id does not already exist.
+     */
+    create(grant: DelegationGrant<Action>): boolean | Promise<boolean>;
+    read(delegationId: string): DelegationGrant<Action> | undefined | Promise<DelegationGrant<Action> | undefined>;
+    /**
+     * Must atomically compare revision and replace. Returning false forces the
+     * caller to re-read and revalidate revocation, expiry, and rate state.
+     */
+    write(delegationId: string, expectedRevision: number, grant: DelegationGrant<Action>): boolean | Promise<boolean>;
+}
+export interface IssueDelegationInput<Action extends string = string> {
+    actions: readonly Action[];
+    agent: AuthorizationPrincipal;
+    audience: string;
+    capabilityScopes?: readonly string[];
+    delegator: AuthorizationPrincipal;
+    expiresAt: string;
+    issuedUnderPolicyVersion: string;
+    maxUses?: number;
+    nonDelegableApprovalActions?: readonly Action[];
+    now: string;
+    purposeReference: string;
+    rateLimit?: DelegationRateLimit;
+    resourceBoundary: DelegationResourceBoundary;
+    slice: string;
+}
+export interface IssuedDelegation<Action extends string = string> {
+    /**
+     * Opaque bearer capability returned once. It must be delivered only through
+     * an audience-bound server exchange and never logged or stored in plaintext.
+     */
+    capability: string;
+    grant: DelegationGrant<Action>;
+}
+export interface DelegationUseResult<Action extends string, Obligation extends AuthorizationObligation> {
+    decision: AuthorizationDecision<Obligation>;
+    grant?: DelegationGrant<Action>;
+    /** Present only after online grant validation and the persisted use transition. */
+    principal?: AuthorizationPrincipal;
+}
+export interface UseDelegationInput<Action extends string, Resource extends AuthorizationResource, Context extends AuthorizationContext, Obligation extends AuthorizationObligation> {
+    action: Action;
+    agent: AuthorizationPrincipal;
+    audience: string;
+    capability: string;
+    context: Context;
+    delegationId: string;
+    evaluator: Pick<AuthorizationEvaluator<AuthorizationInput<Action, Resource, Context>, Obligation>, 'evaluate' | 'policyVersion'>;
+    matchesConstraint?: (constraintId: string, resource: Resource, context: Context) => boolean | Promise<boolean>;
+    /**
+     * Resolves the delegator's current direct authority from Slice-owned state.
+     * Delegated use fails closed when the subject cannot be resolved or no
+     * longer receives an allow decision for the requested action/resource.
+     */
+    resolveDelegator(input: {
+        context: Context;
+        delegator: DelegationSubjectReference & {
+            type: 'user';
+        };
+        resource: Resource;
+    }): AuthorizationPrincipal | undefined | Promise<AuthorizationPrincipal | undefined>;
+    requiredCapabilityScopes?: readonly string[];
+    resource: Resource;
+    store: DelegationStore<Action>;
+}
+/**
+ * Issues and persists an attended grant. The operation caller must already
+ * have authorized the grant-creation action; this function enforces the
+ * structural delegation invariants and never persists the opaque capability.
+ */
+export declare function issueDelegation<Action extends string>(store: DelegationStore<Action>, input: IssueDelegationInput<Action>): Promise<IssuedDelegation<Action>>;
+/**
+ * Re-reads the grant online and persists a rate/use transition before
+ * returning allow. The store's compare-and-set is the concurrency boundary;
+ * the protected business effect must run only after this function allows.
+ */
+export declare function useDelegation<Action extends string, Resource extends AuthorizationResource, Context extends AuthorizationContext, Obligation extends AuthorizationObligation = AuthorizationObligation>(input: UseDelegationInput<Action, Resource, Context, Obligation>): Promise<DelegationUseResult<Action, Obligation>>;
+export interface RevokeDelegationInput {
+    delegationId: string;
+    now: string;
+    revokedBy: AuthorizationPrincipal;
+}
+export declare function revokeDelegationGrant<Action extends string>(grant: DelegationGrant<Action>, input: Pick<RevokeDelegationInput, 'now' | 'revokedBy'>): DelegationGrant<Action>;
+export declare function revokeDelegation<Action extends string>(store: DelegationStore<Action>, input: RevokeDelegationInput): Promise<DelegationGrant<Action> | undefined>;
+export declare function expireDelegationGrant<Action extends string>(grant: DelegationGrant<Action>, now: string): DelegationGrant<Action>;
+export declare function expireDelegation<Action extends string>(store: DelegationStore<Action>, delegationId: string, now: string): Promise<DelegationGrant<Action> | undefined>;