@flowdular/sdk 0.2.4 → 0.3.1

package/modules/approvals/src/services/eligibility.ts

@@ -0,0 +1,121 @@
+import type { ApprovalRequirement } from '@flowdular/sdk/kernel';
+import { APPROVAL_LIMITS } from '../domain/capability.ts';
+import type {
+	ApprovalMember,
+	ApprovalRequirementRecord,
+} from '../domain/types.ts';
+import {
+	ApprovalsServiceError,
+	bounded,
+	boundedInteger,
+} from './service-error.ts';
+
+/**
+ * The kernel requirement with both optional numbers resolved, so a stored row
+ * never has to be read back through a partially specified shape. A requirement
+ * naming neither a role nor a scope has no answer to who may decide, which is a
+ * rejection rather than a request nobody can resolve.
+ */
+export function normalizeRequirement(
+	requirement: ApprovalRequirement,
+	defaultExpiryDays: number,
+): ApprovalRequirementRecord {
+	const roleKey =
+		requirement.roleKey === undefined || requirement.roleKey === ''
+			? null
+			: bounded(requirement.roleKey, 'requirement.roleKey', 1, 64);
+	const scope =
+		requirement.scope === undefined || requirement.scope === ''
+			? null
+			: bounded(requirement.scope, 'requirement.scope', 1, 96);
+	if (roleKey === null && scope === null) {
+		throw new ApprovalsServiceError(
+			'APPROVAL_REQUIREMENT_INVALID',
+			'A requirement must name a role key or a scope.',
+		);
+	}
+	return {
+		roleKey,
+		scope,
+		decisions: boundedInteger(
+			requirement.decisions ?? 1,
+			'requirement.decisions',
+			1,
+			APPROVAL_LIMITS.decisions,
+		),
+		expiresInDays: boundedInteger(
+			requirement.expiresInDays ?? defaultExpiryDays,
+			'requirement.expiresInDays',
+			1,
+			APPROVAL_LIMITS.expiryDays,
+		),
+	};
+}
+
+/**
+ * Whether one member satisfies the requirement now. A requirement that names
+ * both a role and a scope asks for both: the narrower reading is the one that
+ * cannot widen who decides. The requester never decides their own request.
+ */
+export function memberSatisfies(
+	requirement: ApprovalRequirementRecord,
+	member: ApprovalMember,
+	requesterAccountId: string,
+): boolean {
+	if (member.accountId === requesterAccountId) return false;
+	if (requirement.roleKey !== null && member.roleKey !== requirement.roleKey) {
+		return false;
+	}
+	if (
+		requirement.scope !== null &&
+		!member.scopes.includes(requirement.scope)
+	) {
+		return false;
+	}
+	return true;
+}
+
+/**
+ * The snapshot taken when the request opens. It is what a screen shows and what
+ * the inbox filters on; a decision is checked again against live membership, so
+ * a member who lost the role after the request cannot decide even though the
+ * snapshot still names them.
+ */
+export function resolveEligible(
+	requirement: ApprovalRequirementRecord,
+	members: readonly ApprovalMember[],
+	requesterAccountId: string,
+): readonly string[] {
+	const eligible = members
+		.filter((member) =>
+			memberSatisfies(requirement, member, requesterAccountId),
+		)
+		.map((member) => member.accountId)
+		.sort();
+	const unique = [...new Set(eligible)];
+	if (unique.length === 0) {
+		throw new ApprovalsServiceError(
+			'APPROVAL_NO_ELIGIBLE_DECIDER',
+			'No member of this workspace satisfies the requirement.',
+			409,
+		);
+	}
+	if (unique.length < requirement.decisions) {
+		throw new ApprovalsServiceError(
+			'APPROVAL_ELIGIBLE_INSUFFICIENT',
+			`The requirement needs ${requirement.decisions} decisions and ${unique.length} members can give one.`,
+			409,
+		);
+	}
+	/* The snapshot decides whose inbox the request appears in, so truncating it
+	   would hide the request from a member who may decide. A requirement this
+	   wide is refused instead. */
+	if (unique.length > APPROVAL_LIMITS.eligible) {
+		throw new ApprovalsServiceError(
+			'APPROVAL_ELIGIBLE_TOO_MANY',
+			`A requirement may name at most ${APPROVAL_LIMITS.eligible} deciders.`,
+			409,
+		);
+	}
+	return unique;
+}

package/modules/approvals/src/services/expiry-runner.ts

@@ -0,0 +1,81 @@
+import {
+	createJobRunner,
+	createJobTraceSink,
+	jobBackoff,
+	serverLogger,
+	type JobEvent,
+	type JobRunner,
+	type Tracer,
+} from '@flowdular/sdk/server';
+import type { ApprovalRouting } from '../domain/types.ts';
+import type { ApprovalsService } from './approvals-service.ts';
+import type { ApprovalsRepository } from './repository.ts';
+
+/** Requests one expiry pass claims, and the page its routing read answers. */
+export const EXPIRY_BATCH = 100;
+
+export interface ApprovalsExpiryRunnerOptions {
+	readonly repository: () => Promise<ApprovalsRepository>;
+	readonly service: () => Promise<ApprovalsService>;
+	/** The platform setting, read once when the loop starts. */
+	readonly intervalMs: number;
+	readonly now?: (() => number) | undefined;
+	/** Absent turns every pass into spans; a sink of its own replaces that. */
+	readonly onEvent?: ((event: JobEvent) => void) | undefined;
+	/** Defaults to the process tracer, which is the one `context.tracer` carries. */
+	readonly tracer?: Tracer | undefined;
+}
+
+/**
+ * The expiry pass as the platform runner sees it: a claim over routing columns
+ * and one request expired per claim. The loop, its bound, the guard against
+ * overlapping passes, the isolation of one request from the next and the drain
+ * are the runner's (`@flowdular/sdk/server`); the routing read and the transition
+ * under the workspace stay here.
+ */
+export function createApprovalsExpiryRunner(
+	options: ApprovalsExpiryRunnerOptions,
+): JobRunner {
+	/* The routing read crosses workspaces on the background role and answers
+	   routing columns alone. It refills only once the page it filled is drained,
+	   and a page shorter than the bound means nothing further was due, so a pass
+	   reads it at most twice however many requests it expires. */
+	let queue: ApprovalRouting[] = [];
+	let refillable = true;
+
+	return createJobRunner<ApprovalRouting>({
+		name: 'approvals.core',
+		intervalMs: options.intervalMs,
+		/* Expiry claims nothing: the pending status the transition compares and
+		   swaps is its own fence, so no lease is held and no renewal runs. */
+		staleAfterMs: options.intervalMs,
+		backoff: jobBackoff(options.intervalMs),
+		batchLimit: EXPIRY_BATCH,
+		logger: serverLogger,
+		now: options.now,
+		onEvent:
+			options.onEvent ??
+			createJobTraceSink(options.tracer ? { tracer: options.tracer } : {}),
+		claim: async (at) => {
+			if (queue.length === 0) {
+				if (!refillable) {
+					refillable = true;
+					return null;
+				}
+				const repository = await options.repository();
+				const page = await repository.listDueExpiries(at, EXPIRY_BATCH);
+				refillable = page.length === EXPIRY_BATCH;
+				queue = [...page];
+			}
+			const routing = queue.shift();
+			if (!routing) {
+				refillable = true;
+				return null;
+			}
+			return routing;
+		},
+		perform: async (routing) => {
+			await (await options.service()).expireRequest(routing);
+		},
+	});
+}

package/modules/approvals/src/services/index.ts

@@ -0,0 +1,31 @@
+export { ApprovalsService, APPROVALS_PAGE_LIMIT } from './approvals-service.ts';
+export type { ApprovalsServiceOptions } from './approvals-service.ts';
+export { createApprovalsExpiryRunner, EXPIRY_BATCH } from './expiry-runner.ts';
+export type { ApprovalsExpiryRunnerOptions } from './expiry-runner.ts';
+export { createApprovalCallbackRegistry } from './callbacks.ts';
+export type {
+	ApprovalCallbackRegistry,
+	ApprovalResolvedCallback,
+} from './callbacks.ts';
+export {
+	memberSatisfies,
+	normalizeRequirement,
+	resolveEligible,
+} from './eligibility.ts';
+export { publishApprovalEvent } from './notifications.ts';
+export type {
+	NotificationPublisher,
+	NotificationPublisherResolver,
+} from './notifications.ts';
+export type {
+	ApprovalRequestFilters,
+	ApprovalsRepository,
+	CreateApprovalResult,
+	DecideApprovalInput,
+	DecideApprovalResult,
+} from './repository.ts';
+export {
+	DatabaseApprovalsRepository,
+	migrateApprovalsDatabase,
+} from './database-repository.ts';
+export { ApprovalsServiceError } from './service-error.ts';

package/modules/approvals/src/services/migration.ts

@@ -0,0 +1,256 @@
+import type { DatabaseMigration } from '@flowdular/sdk/database';
+import {
+	migrationObjectState,
+	postgresTenantTableState,
+} from '@flowdular/sdk/database';
+
+/* Mirrors migrations/0001_approvals_core.up.sql byte for byte. */
+export const APPROVALS_MIGRATION_001 = `CREATE TABLE IF NOT EXISTS approvals_requests (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  subject_module TEXT NOT NULL,
+  subject_ref TEXT NOT NULL,
+  permission TEXT NOT NULL,
+  action TEXT NOT NULL,
+  title TEXT NOT NULL,
+  summary TEXT,
+  requester_account_id TEXT NOT NULL,
+  requirement_json TEXT NOT NULL,
+  decisions_needed BIGINT NOT NULL CHECK (decisions_needed >= 1),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'rejected', 'expired', 'cancelled')),
+  expires_at BIGINT NOT NULL,
+  resolved_at BIGINT,
+  created_at BIGINT NOT NULL
+);
+-- A subject module that reopens after a crash has to find the request it
+-- already opened instead of asking the same question twice. One pending
+-- request per subject reference is what makes opening idempotent.
+CREATE UNIQUE INDEX IF NOT EXISTS approvals_requests_pending_subject_idx
+  ON approvals_requests (tenant_id, subject_module, subject_ref)
+  WHERE status = 'pending';
+CREATE INDEX IF NOT EXISTS approvals_requests_tenant_status_idx
+  ON approvals_requests (tenant_id, status, created_at DESC, id);
+CREATE INDEX IF NOT EXISTS approvals_requests_requester_idx
+  ON approvals_requests (tenant_id, requester_account_id, created_at DESC, id);
+-- The cross-tenant expiry poll reads in this order and stops at the first
+-- request that is not due yet.
+CREATE INDEX IF NOT EXISTS approvals_requests_routing_idx
+  ON approvals_requests (status, expires_at, tenant_id, id);
+ALTER TABLE approvals_requests ENABLE ROW LEVEL SECURITY;
+ALTER TABLE approvals_requests FORCE ROW LEVEL SECURITY;
+CREATE POLICY approvals_requests_tenant_policy ON approvals_requests
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+-- The eligibility snapshot taken when the request opened. It decides whose
+-- inbox the request appears in, so it is a row per decider with its own index
+-- rather than a list inside the request: the screen asks "what may I decide"
+-- once per open workspace and that question has to stay one index lookup.
+CREATE TABLE IF NOT EXISTS approvals_eligible (
+  tenant_id TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  account_id TEXT NOT NULL,
+  PRIMARY KEY (tenant_id, request_id, account_id)
+);
+CREATE INDEX IF NOT EXISTS approvals_eligible_account_idx
+  ON approvals_eligible (tenant_id, account_id, request_id);
+ALTER TABLE approvals_eligible ENABLE ROW LEVEL SECURITY;
+ALTER TABLE approvals_eligible FORCE ROW LEVEL SECURITY;
+CREATE POLICY approvals_eligible_tenant_policy ON approvals_eligible
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+CREATE TABLE IF NOT EXISTS approvals_decisions (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  decider_account_id TEXT,
+  decision TEXT NOT NULL CHECK (decision IN ('approve', 'reject', 'expire', 'cancel')),
+  comment TEXT,
+  decided_at BIGINT NOT NULL,
+  -- Expiry is the one decision no member makes. Every other row names the
+  -- account answerable for it, and the pair is checked here rather than only
+  -- in the service that writes it.
+  CHECK ((decision = 'expire') = (decider_account_id IS NULL))
+);
+-- One approval or rejection per member per request. The service checks first,
+-- but this index is what actually guarantees the conflict it reports.
+CREATE UNIQUE INDEX IF NOT EXISTS approvals_decisions_decider_idx
+  ON approvals_decisions (tenant_id, request_id, decider_account_id)
+  WHERE decision IN ('approve', 'reject');
+CREATE INDEX IF NOT EXISTS approvals_decisions_request_idx
+  ON approvals_decisions (tenant_id, request_id, decided_at, id);
+ALTER TABLE approvals_decisions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE approvals_decisions FORCE ROW LEVEL SECURITY;
+CREATE POLICY approvals_decisions_tenant_policy ON approvals_decisions
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+`;
+
+/* Mirrors migrations/0002_approvals_expiry_routing_role.up.sql byte for byte. */
+export const APPROVALS_MIGRATION_002_EXPIRY_ROUTING_ROLE = `-- The expiry loop has to find due pending requests before it knows whose they
+-- are, and the requests table is invisible to the cross-tenant role: it carries
+-- no background policy and the role holds no default table grant. This adds the
+-- four routing columns and nothing else. The subject, the requester, the
+-- requirement, the eligibility snapshot and the title stay unreadable on this
+-- connection, and every request it names is read again under its own tenant
+-- before anything about it is written.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY approvals_requests_background_policy ON approvals_requests
+  FOR SELECT TO coreloom_background
+  USING (true);
+REVOKE SELECT ON approvals_requests FROM coreloom_background;
+GRANT SELECT (tenant_id, id, expires_at, status) ON approvals_requests TO coreloom_background;
+`;
+
+/* Mirrors migrations/0003_approvals_retention_indexes.up.sql byte for byte. */
+export const APPROVALS_MIGRATION_003_RETENTION_INDEXES = `-- The retention sweep of approvals.core.requests asks one workspace for its
+-- oldest resolved requests, the export walks every request of a workspace in
+-- id order, and a subject erasure asks it for the decisions one account made.
+-- None of the three is covered by what the module already carries: the status
+-- index orders by creation rather than by resolution, the requester index
+-- answers who asked rather than who decided, and no index carries the export's
+-- own key order. All three are bounded batches, so all three need a range scan
+-- rather than a pass over the workspace's requests.
+CREATE INDEX IF NOT EXISTS approvals_requests_resolved_idx
+  ON approvals_requests (tenant_id, status, resolved_at, id);
+CREATE INDEX IF NOT EXISTS approvals_requests_export_idx
+  ON approvals_requests (tenant_id, id);
+CREATE INDEX IF NOT EXISTS approvals_decisions_decider_account_idx
+  ON approvals_decisions (tenant_id, decider_account_id, id);
+`;
+
+/* Mirrors migrations/0004_approvals_inbox_keyset_indexes.up.sql byte for byte. */
+export const APPROVALS_MIGRATION_004_INBOX_KEYSET_INDEXES = `-- The inbox pages by keyset on (created_at, id) in one direction, under a
+-- status filter, a requester filter, or neither. The two indexes 0001 carries
+-- order created_at DESC with id ASC, so a page walked in either direction ends
+-- in a sort, and a workspace-wide page has no index at all. These three carry
+-- both keys ascending: a newest-first page is a backward scan of the same
+-- index, and a page continued from a cursor starts where the cursor names.
+CREATE INDEX IF NOT EXISTS approvals_requests_status_created_idx
+  ON approvals_requests (tenant_id, status, created_at, id);
+CREATE INDEX IF NOT EXISTS approvals_requests_requester_created_idx
+  ON approvals_requests (tenant_id, requester_account_id, created_at, id);
+CREATE INDEX IF NOT EXISTS approvals_requests_created_idx
+  ON approvals_requests (tenant_id, created_at, id);
+`;
+
+/* Mirrors migrations/0005_approvals_grant_audit.up.sql byte for byte. */
+export const APPROVALS_MIGRATION_005_GRANT_AUDIT = `-- The grant an approved request yields is derived from the row and the key on
+-- every read, so nothing about the token itself is stored. What is stored is
+-- the fact of its issuance: one row per resolved request whose subject names
+-- a capability, with the capability, the input digest, the key that signs and
+-- the moment the grant stops verifying, written in the deciding transaction.
+CREATE TABLE IF NOT EXISTS approvals_audit (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  metadata_json TEXT NOT NULL,
+  occurred_at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS approvals_audit_request_idx
+  ON approvals_audit (tenant_id, request_id, occurred_at, id);
+ALTER TABLE approvals_audit ENABLE ROW LEVEL SECURITY;
+ALTER TABLE approvals_audit FORCE ROW LEVEL SECURITY;
+CREATE POLICY approvals_audit_tenant_policy ON approvals_audit
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+`;
+
+export const databaseMigrations: readonly DatabaseMigration[] = [
+	{
+		id: '0001_approvals_core',
+		sql: { postgresql: APPROVALS_MIGRATION_001 },
+		/* One migration creates three tables, so a schema carrying only some of
+		   them is partial and the runner refuses it rather than patching it. */
+		inspectExisting: async (database) => {
+			const states = await Promise.all([
+				postgresTenantTableState(
+					database,
+					'approvals_requests',
+					'approvals_requests_tenant_policy',
+					[
+						() =>
+							database.schema.hasIndex(
+								'approvals_requests_pending_subject_idx',
+							),
+						() =>
+							database.schema.hasIndex('approvals_requests_tenant_status_idx'),
+						() => database.schema.hasIndex('approvals_requests_requester_idx'),
+						() => database.schema.hasIndex('approvals_requests_routing_idx'),
+					],
+				),
+				postgresTenantTableState(
+					database,
+					'approvals_eligible',
+					'approvals_eligible_tenant_policy',
+					[() => database.schema.hasIndex('approvals_eligible_account_idx')],
+				),
+				postgresTenantTableState(
+					database,
+					'approvals_decisions',
+					'approvals_decisions_tenant_policy',
+					[
+						() => database.schema.hasIndex('approvals_decisions_decider_idx'),
+						() => database.schema.hasIndex('approvals_decisions_request_idx'),
+					],
+				),
+			]);
+			if (states.every((state) => state === 'complete')) return 'complete';
+			if (states.every((state) => state === 'absent')) return 'absent';
+			return 'partial';
+		},
+	},
+	{
+		id: '0002_approvals_expiry_routing_role',
+		sql: { postgresql: APPROVALS_MIGRATION_002_EXPIRY_ROUTING_ROLE },
+		/* A policy and a column grant leave no schema object behind, so the
+		   privilege itself is what proves this migration ran. */
+		inspectExisting: async (database) => {
+			const result = await database.query<{ granted: boolean }>({
+				text: `SELECT CASE WHEN to_regclass('approvals_requests') IS NOT NULL THEN
+				  has_column_privilege('coreloom_background', 'approvals_requests', 'expires_at', 'SELECT')
+				ELSE false END AS granted`,
+			});
+			return result.rows[0]?.granted === true ? 'complete' : 'absent';
+		},
+	},
+	{
+		id: '0003_approvals_retention_indexes',
+		sql: { postgresql: APPROVALS_MIGRATION_003_RETENTION_INDEXES },
+		inspectExisting: (database) =>
+			migrationObjectState([
+				() => database.schema.hasIndex('approvals_requests_resolved_idx'),
+				() => database.schema.hasIndex('approvals_requests_export_idx'),
+				() =>
+					database.schema.hasIndex('approvals_decisions_decider_account_idx'),
+			]),
+	},
+	{
+		id: '0004_approvals_inbox_keyset_indexes',
+		sql: { postgresql: APPROVALS_MIGRATION_004_INBOX_KEYSET_INDEXES },
+		inspectExisting: (database) =>
+			migrationObjectState([
+				() => database.schema.hasIndex('approvals_requests_status_created_idx'),
+				() =>
+					database.schema.hasIndex('approvals_requests_requester_created_idx'),
+				() => database.schema.hasIndex('approvals_requests_created_idx'),
+			]),
+	},
+	{
+		id: '0005_approvals_grant_audit',
+		sql: { postgresql: APPROVALS_MIGRATION_005_GRANT_AUDIT },
+		inspectExisting: (database) =>
+			postgresTenantTableState(
+				database,
+				'approvals_audit',
+				'approvals_audit_tenant_policy',
+				[() => database.schema.hasIndex('approvals_audit_request_idx')],
+			),
+	},
+];

package/modules/approvals/src/services/notifications.ts

@@ -0,0 +1,95 @@
+/* The notifications.core publish contract, declared here rather than imported.
+   notifications.core is optional: approvals.core composes, opens and resolves
+   requests with that module absent, so it is not a package dependency. This
+   mirror carries only the two kinds this module publishes; notifications.core
+   owns the full set and this must not drift from the shape it accepts. */
+export const NOTIFICATIONS_PUBLISH_CAPABILITY = 'notifications.publish.v1';
+
+export type ApprovalNotificationKind =
+	| 'approval-requested'
+	| 'approval-decided';
+
+export interface NotificationPublishInput {
+	readonly tenantId: string;
+	readonly kind: ApprovalNotificationKind;
+	readonly sourceModule: string;
+	readonly sourceRef: string;
+	readonly title: string;
+	readonly body?: string;
+	readonly recipients: readonly string[];
+}
+
+export interface NotificationPublishResult {
+	readonly inboxItemIds: readonly string[];
+	readonly deliveryIds: readonly string[];
+}
+
+export interface NotificationPublisher {
+	publish(input: NotificationPublishInput): Promise<NotificationPublishResult>;
+}
+
+/* Read at the point of use, never at composition time: the platform may
+   register notifications.core after approvals.core, or never. */
+export type NotificationPublisherResolver = () => NotificationPublisher | null;
+
+const LIMITS = {
+	sourceModule: 64,
+	sourceRef: 200,
+	title: 200,
+	body: 4_000,
+	recipients: 64,
+	recipientId: 128,
+} as const;
+
+function clamp(value: string, limit: number): string {
+	return value.length > limit ? value.slice(0, limit) : value;
+}
+
+/**
+ * Advisory and post-commit. An absent notifications module, nobody to notify,
+ * or a publisher that throws never changes a recorded decision, so this never
+ * rejects. The caller passes the request id as `sourceRef`, which makes a
+ * repeated publication of the same event idempotent on the receiving side.
+ *
+ * A requirement may name more deciders than notifications.core accepts in one
+ * call, so the recipients are published in batches of that size. Every batch
+ * carries the same `sourceRef`, which is what makes them one event on the
+ * receiving side; truncating instead would leave deciders unasked.
+ */
+export async function publishApprovalEvent(
+	resolve: NotificationPublisherResolver | undefined,
+	input: NotificationPublishInput,
+): Promise<void> {
+	if (input.recipients.length === 0) return;
+	try {
+		const publisher = resolve?.();
+		if (!publisher) return;
+		const event = {
+			tenantId: input.tenantId,
+			kind: input.kind,
+			sourceModule: clamp(input.sourceModule, LIMITS.sourceModule),
+			sourceRef: clamp(input.sourceRef, LIMITS.sourceRef),
+			title: clamp(input.title, LIMITS.title),
+			...(input.body === undefined
+				? {}
+				: { body: clamp(input.body, LIMITS.body) }),
+		};
+		for (
+			let index = 0;
+			index < input.recipients.length;
+			index += LIMITS.recipients
+		) {
+			await publisher.publish({
+				...event,
+				recipients: input.recipients
+					.slice(index, index + LIMITS.recipients)
+					.map((recipient) => clamp(recipient, LIMITS.recipientId)),
+			});
+		}
+	} catch (error) {
+		console.warn(
+			`[approvals] notification publish for request ${input.sourceRef} failed:`,
+			error instanceof Error ? error.message : error,
+		);
+	}
+}