@happyvertical/smrt-approvals 0.0.0-stage → 0.55.11

package/dist/index.js

@@ -0,0 +1,1307 @@
+import { APPROVAL_EVENT_TYPES, APPROVAL_PRINCIPAL_TYPES, APPROVAL_STATUSES, ApprovalError, approvalPrincipalFromPermissions } from "./types.js";
+import { ObjectRegistry, SmrtCollection, SmrtObject, appendChange, field, foreignKey, isEmbeddedDatabase, isUniqueViolationError, smrt, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
+import { registerPermissionDefinitions } from "@happyvertical/smrt-users";
+import { TenantScoped, getTenantId, isSystemContext, tenantId, withTenant } from "@happyvertical/smrt-tenancy";
+//#region src/__smrt-register__.ts
+ObjectRegistry.registerPackageManifest(JSON.parse(`{"version":"1.0.0","timestamp":0,"packageName":"@happyvertical/smrt-approvals","packageVersion":"0.55.11","objects":{"@happyvertical/smrt-approvals:ApprovalEventCollection":{"name":"approvaleventcollection","className":"ApprovalEventCollection","qualifiedName":"@happyvertical/smrt-approvals:ApprovalEventCollection","collection":"approvalevents","filePath":"/home/runner/work/smrt/smrt/packages/approvals/src/collections/ApprovalEventCollection.ts","packageName":"@happyvertical/smrt-approvals","fields":{},"methods":{},"decoratorConfig":{"api":{"include":["list","get"]},"mcp":{"include":["list","get"]},"cli":false,"tableName":"approval_events"},"extends":"SmrtCollection","extendsTypeArg":"ApprovalEvent","exportName":"ApprovalEventCollection","collectionExportName":"ApprovalEventCollectionCollection","schema":{"tableName":"approval_events","ddl":"CREATE TABLE IF NOT EXISTS \\"approval_events\\" (\\n  \\"id\\" UUID PRIMARY KEY NOT NULL,\\n  \\"slug\\" TEXT NOT NULL,\\n  \\"context\\" TEXT NOT NULL DEFAULT '',\\n  \\"created_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"updated_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"tenant_id\\" UUID NOT NULL,\\n  \\"request_id\\" UUID NOT NULL,\\n  \\"type\\" TEXT NOT NULL,\\n  \\"actor_id\\" TEXT NOT NULL,\\n  \\"actor_type\\" TEXT,\\n  \\"reason\\" TEXT,\\n  \\"subject_revision_hash\\" TEXT,\\n  \\"sequence\\" INTEGER,\\n  \\"vote_key\\" TEXT,\\n  \\"occurred_at\\" TIMESTAMP\\n);","columns":{"id":{"type":"UUID","primaryKey":true,"referenceKind":"id","notNull":true},"slug":{"type":"TEXT","notNull":true},"context":{"type":"TEXT","notNull":true,"default":""},"created_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"updated_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"tenant_id":{"type":"UUID","referenceKind":"tenantId","notNull":true,"unique":false},"request_id":{"type":"UUID","referenceKind":"foreignKey","notNull":true,"unique":false,"foreignKey":{"table":"approval_requests","column":"id","onDelete":"RESTRICT","onUpdate":"RESTRICT","engines":["postgres","sqlite"]}},"type":{"type":"TEXT","notNull":true,"unique":false},"actor_id":{"type":"TEXT","notNull":true,"unique":false},"actor_type":{"type":"TEXT","notNull":false,"unique":false},"reason":{"type":"TEXT","notNull":false,"unique":false},"subject_revision_hash":{"type":"TEXT","notNull":false,"unique":false},"sequence":{"type":"INTEGER","notNull":false,"unique":false},"vote_key":{"type":"TEXT","notNull":false,"unique":false},"occurred_at":{"type":"TIMESTAMP","notNull":false,"unique":false}},"indexes":[{"name":"approval_events_slug_context_idx","columns":["tenant_id","slug","context"],"unique":true},{"name":"approval_events_request_sequence_key","columns":["request_id","sequence"],"unique":true},{"name":"approval_events_request_vote_key","columns":["request_id","vote_key"],"unique":true},{"name":"approval_events_tenant_occurred_idx","columns":["tenant_id","occurred_at"]},{"name":"approval_events_tenant_id_created_at_idx","columns":["tenant_id","created_at"]}],"version":"4963053a"},"importPath":"@happyvertical/smrt-approvals"},"@happyvertical/smrt-approvals:ApprovalPolicyCollection":{"name":"approvalpolicycollection","className":"ApprovalPolicyCollection","qualifiedName":"@happyvertical/smrt-approvals:ApprovalPolicyCollection","collection":"approvalpolicies","filePath":"/home/runner/work/smrt/smrt/packages/approvals/src/collections/ApprovalPolicyCollection.ts","packageName":"@happyvertical/smrt-approvals","fields":{},"methods":{},"decoratorConfig":{"api":{"include":["list","get"]},"mcp":{"include":["list","get"]},"cli":false,"tableName":"approval_policies"},"extends":"SmrtCollection","extendsTypeArg":"ApprovalPolicy","exportName":"ApprovalPolicyCollection","collectionExportName":"ApprovalPolicyCollectionCollection","schema":{"tableName":"approval_policies","ddl":"CREATE TABLE IF NOT EXISTS \\"approval_policies\\" (\\n  \\"id\\" UUID PRIMARY KEY NOT NULL,\\n  \\"slug\\" TEXT NOT NULL,\\n  \\"context\\" TEXT NOT NULL DEFAULT '',\\n  \\"created_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"updated_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"tenant_id\\" UUID NOT NULL,\\n  \\"kind\\" TEXT NOT NULL,\\n  \\"required_approvals\\" INTEGER,\\n  \\"ttl_ms\\" INTEGER,\\n  \\"required_permission\\" TEXT,\\n  \\"updated_by\\" TEXT\\n);","columns":{"id":{"type":"UUID","primaryKey":true,"referenceKind":"id","notNull":true},"slug":{"type":"TEXT","notNull":true},"context":{"type":"TEXT","notNull":true,"default":""},"created_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"updated_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"tenant_id":{"type":"UUID","referenceKind":"tenantId","notNull":true,"unique":false},"kind":{"type":"TEXT","notNull":true,"unique":false},"required_approvals":{"type":"INTEGER","notNull":false,"unique":false},"ttl_ms":{"type":"INTEGER","notNull":false,"unique":false},"required_permission":{"type":"TEXT","notNull":false,"unique":false},"updated_by":{"type":"TEXT","notNull":false,"unique":false}},"indexes":[{"name":"approval_policies_slug_context_idx","columns":["tenant_id","slug","context"],"unique":true},{"name":"approval_policies_tenant_kind_key","columns":["tenant_id","kind"],"unique":true},{"name":"approval_policies_tenant_id_created_at_idx","columns":["tenant_id","created_at"]}],"version":"80929cc8"},"importPath":"@happyvertical/smrt-approvals"},"@happyvertical/smrt-approvals:ApprovalRequestCollection":{"name":"approvalrequestcollection","className":"ApprovalRequestCollection","qualifiedName":"@happyvertical/smrt-approvals:ApprovalRequestCollection","collection":"approvalrequests","filePath":"/home/runner/work/smrt/smrt/packages/approvals/src/collections/ApprovalRequestCollection.ts","packageName":"@happyvertical/smrt-approvals","fields":{},"methods":{},"decoratorConfig":{"api":{"include":["list","get"]},"mcp":{"include":["list","get"]},"cli":false,"tableName":"approval_requests"},"extends":"SmrtCollection","extendsTypeArg":"ApprovalRequest","exportName":"ApprovalRequestCollection","collectionExportName":"ApprovalRequestCollectionCollection","schema":{"tableName":"approval_requests","ddl":"CREATE TABLE IF NOT EXISTS \\"approval_requests\\" (\\n  \\"id\\" UUID PRIMARY KEY NOT NULL,\\n  \\"slug\\" TEXT NOT NULL,\\n  \\"context\\" TEXT NOT NULL DEFAULT '',\\n  \\"created_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"updated_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"tenant_id\\" UUID NOT NULL,\\n  \\"kind\\" TEXT NOT NULL,\\n  \\"subject_type\\" TEXT NOT NULL,\\n  \\"subject_id\\" TEXT NOT NULL,\\n  \\"subject_revision_hash\\" TEXT NOT NULL,\\n  \\"request_key\\" TEXT NOT NULL,\\n  \\"requested_by\\" TEXT NOT NULL,\\n  \\"requested_by_type\\" TEXT,\\n  \\"summary\\" TEXT,\\n  \\"status\\" TEXT,\\n  \\"required_approvals\\" INTEGER,\\n  \\"approval_count\\" INTEGER,\\n  \\"required_permissions\\" TEXT,\\n  \\"version\\" INTEGER,\\n  \\"expires_at\\" TIMESTAMP,\\n  \\"decided_at\\" TIMESTAMP,\\n  \\"consumed_at\\" TIMESTAMP,\\n  \\"consumed_by\\" TEXT\\n);","columns":{"id":{"type":"UUID","primaryKey":true,"referenceKind":"id","notNull":true},"slug":{"type":"TEXT","notNull":true},"context":{"type":"TEXT","notNull":true,"default":""},"created_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"updated_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"tenant_id":{"type":"UUID","referenceKind":"tenantId","notNull":true,"unique":false},"kind":{"type":"TEXT","notNull":true,"unique":false},"subject_type":{"type":"TEXT","notNull":true,"unique":false},"subject_id":{"type":"TEXT","notNull":true,"unique":false},"subject_revision_hash":{"type":"TEXT","notNull":true,"unique":false},"request_key":{"type":"TEXT","notNull":true,"unique":false},"requested_by":{"type":"TEXT","notNull":true,"unique":false},"requested_by_type":{"type":"TEXT","notNull":false,"unique":false},"summary":{"type":"TEXT","notNull":false,"unique":false},"status":{"type":"TEXT","notNull":false,"unique":false},"required_approvals":{"type":"INTEGER","notNull":false,"unique":false},"approval_count":{"type":"INTEGER","notNull":false,"unique":false},"required_permissions":{"type":"TEXT","notNull":false,"unique":false},"version":{"type":"INTEGER","notNull":false,"unique":false},"expires_at":{"type":"TIMESTAMP","notNull":false,"unique":false},"decided_at":{"type":"TIMESTAMP","notNull":false,"unique":false},"consumed_at":{"type":"TIMESTAMP","notNull":false,"unique":false},"consumed_by":{"type":"TEXT","notNull":false,"unique":false}},"indexes":[{"name":"approval_requests_slug_context_idx","columns":["tenant_id","slug","context"],"unique":true},{"name":"approval_requests_tenant_request_key","columns":["tenant_id","request_key"],"unique":true},{"name":"approval_requests_status_expiry_idx","columns":["tenant_id","status","expires_at"]},{"name":"approval_requests_subject_idx","columns":["tenant_id","subject_type","subject_id"]},{"name":"approval_requests_tenant_id_created_at_idx","columns":["tenant_id","created_at"]}],"version":"a5800bdd"},"importPath":"@happyvertical/smrt-approvals"},"@happyvertical/smrt-approvals:ApprovalEvent":{"name":"approvalevent","className":"ApprovalEvent","qualifiedName":"@happyvertical/smrt-approvals:ApprovalEvent","collection":"approvalevents","description":"One immutable entry in an approval request's history.","filePath":"/home/runner/work/smrt/smrt/packages/approvals/src/models/ApprovalEvent.ts","packageName":"@happyvertical/smrt-approvals","fields":{"tenantId":{"type":"text","required":true,"_meta":{"sqlType":"UUID","__tenancy":{"isTenantIdField":true,"autoFilter":true,"required":true,"autoPopulate":true,"nullable":false,"mode":"required","field":"tenantId","allowSuperAdminBypass":false}}},"requestId":{"type":"foreignKey","required":true,"related":"ApprovalRequest","_meta":{"required":true,"constraint":{"engines":["postgres","sqlite"]},"onDelete":"RESTRICT","onUpdate":"RESTRICT"}},"type":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"actorId":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"actorType":{"type":"text","required":false,"_meta":{"readonly":true},"enum":["human","agent","service"],"readonly":true},"reason":{"type":"text","required":false,"_meta":{"readonly":true},"readonly":true},"subjectRevisionHash":{"type":"text","required":false,"_meta":{"readonly":true},"readonly":true},"sequence":{"type":"integer","required":false,"_meta":{"readonly":true},"readonly":true},"voteKey":{"type":"text","required":false,"_meta":{"nullable":true,"readonly":true},"readonly":true},"occurredAt":{"type":"datetime","required":false,"_meta":{"readonly":true},"readonly":true}},"methods":{"save":{"name":"save","async":true,"parameters":[],"returnType":"Promise<this>","isStatic":false,"isPublic":true},"delete":{"name":"delete","async":true,"parameters":[],"returnType":"Promise<void>","isStatic":false,"isPublic":true}},"decoratorConfig":{"tableName":"approval_events","api":{"include":["list","get"]},"mcp":{"include":["list","get"]},"cli":false,"indexes":[{"name":"approval_events_request_sequence_key","columns":["requestId","sequence"],"unique":true},{"name":"approval_events_request_vote_key","columns":["requestId","voteKey"],"unique":true},{"name":"approval_events_tenant_occurred_idx","columns":["tenantId","occurredAt"]}],"tenantScoped":{"mode":"required"},"conflictColumns":["tenant_id","slug","context"]},"extends":"SmrtObject","exportName":"ApprovalEvent","collectionExportName":"ApprovalEventCollection","validationRules":[{"field":"requestId","rule":"required","fieldType":"foreignKey"},{"field":"type","rule":"required","fieldType":"text"},{"field":"actorId","rule":"required","fieldType":"text"}],"schema":{"tableName":"approval_events","ddl":"CREATE TABLE IF NOT EXISTS \\"approval_events\\" (\\n  \\"id\\" UUID PRIMARY KEY NOT NULL,\\n  \\"slug\\" TEXT NOT NULL,\\n  \\"context\\" TEXT NOT NULL DEFAULT '',\\n  \\"created_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"updated_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"tenant_id\\" UUID NOT NULL,\\n  \\"request_id\\" UUID NOT NULL,\\n  \\"type\\" TEXT NOT NULL,\\n  \\"actor_id\\" TEXT NOT NULL,\\n  \\"actor_type\\" TEXT,\\n  \\"reason\\" TEXT,\\n  \\"subject_revision_hash\\" TEXT,\\n  \\"sequence\\" INTEGER,\\n  \\"vote_key\\" TEXT,\\n  \\"occurred_at\\" TIMESTAMP\\n);","columns":{"id":{"type":"UUID","primaryKey":true,"referenceKind":"id","notNull":true},"slug":{"type":"TEXT","notNull":true},"context":{"type":"TEXT","notNull":true,"default":""},"created_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"updated_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"tenant_id":{"type":"UUID","referenceKind":"tenantId","notNull":true,"unique":false},"request_id":{"type":"UUID","referenceKind":"foreignKey","notNull":true,"unique":false,"foreignKey":{"table":"approval_requests","column":"id","onDelete":"RESTRICT","onUpdate":"RESTRICT","engines":["postgres","sqlite"]}},"type":{"type":"TEXT","notNull":true,"unique":false},"actor_id":{"type":"TEXT","notNull":true,"unique":false},"actor_type":{"type":"TEXT","notNull":false,"unique":false},"reason":{"type":"TEXT","notNull":false,"unique":false},"subject_revision_hash":{"type":"TEXT","notNull":false,"unique":false},"sequence":{"type":"INTEGER","notNull":false,"unique":false},"vote_key":{"type":"TEXT","notNull":false,"unique":false},"occurred_at":{"type":"TIMESTAMP","notNull":false,"unique":false}},"indexes":[{"name":"approval_events_slug_context_idx","columns":["tenant_id","slug","context"],"unique":true},{"name":"approval_events_request_sequence_key","columns":["request_id","sequence"],"unique":true},{"name":"approval_events_request_vote_key","columns":["request_id","vote_key"],"unique":true},{"name":"approval_events_tenant_occurred_idx","columns":["tenant_id","occurred_at"]},{"name":"approval_events_tenant_id_created_at_idx","columns":["tenant_id","created_at"]}],"version":"4963053a"},"importPath":"@happyvertical/smrt-approvals"},"@happyvertical/smrt-approvals:ApprovalPolicy":{"name":"approvalpolicy","className":"ApprovalPolicy","qualifiedName":"@happyvertical/smrt-approvals:ApprovalPolicy","collection":"approvalpolicies","description":"Tenant-level tightening of an approval kind. One row per tenant and kind.","filePath":"/home/runner/work/smrt/smrt/packages/approvals/src/models/ApprovalPolicy.ts","packageName":"@happyvertical/smrt-approvals","fields":{"tenantId":{"type":"text","required":true,"_meta":{"sqlType":"UUID","__tenancy":{"isTenantIdField":true,"autoFilter":true,"required":true,"autoPopulate":true,"nullable":false,"mode":"required","field":"tenantId","allowSuperAdminBypass":false}}},"kind":{"type":"text","required":true,"_meta":{"required":true}},"requiredApprovals":{"type":"integer","required":false,"_meta":{}},"ttlMs":{"type":"integer","required":false,"_meta":{}},"requiredPermission":{"type":"text","required":false,"_meta":{}},"updatedBy":{"type":"text","required":false,"_meta":{}}},"methods":{"save":{"name":"save","async":true,"parameters":[],"returnType":"Promise<this>","isStatic":false,"isPublic":true}},"decoratorConfig":{"tableName":"approval_policies","api":{"include":["list","get"]},"mcp":{"include":["list","get"]},"cli":false,"indexes":[{"name":"approval_policies_tenant_kind_key","columns":["tenantId","kind"],"unique":true}],"tenantScoped":{"mode":"required"},"conflictColumns":["tenant_id","slug","context"]},"extends":"SmrtObject","exportName":"ApprovalPolicy","collectionExportName":"ApprovalPolicyCollection","validationRules":[{"field":"kind","rule":"required","fieldType":"text"}],"schema":{"tableName":"approval_policies","ddl":"CREATE TABLE IF NOT EXISTS \\"approval_policies\\" (\\n  \\"id\\" UUID PRIMARY KEY NOT NULL,\\n  \\"slug\\" TEXT NOT NULL,\\n  \\"context\\" TEXT NOT NULL DEFAULT '',\\n  \\"created_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"updated_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"tenant_id\\" UUID NOT NULL,\\n  \\"kind\\" TEXT NOT NULL,\\n  \\"required_approvals\\" INTEGER,\\n  \\"ttl_ms\\" INTEGER,\\n  \\"required_permission\\" TEXT,\\n  \\"updated_by\\" TEXT\\n);","columns":{"id":{"type":"UUID","primaryKey":true,"referenceKind":"id","notNull":true},"slug":{"type":"TEXT","notNull":true},"context":{"type":"TEXT","notNull":true,"default":""},"created_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"updated_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"tenant_id":{"type":"UUID","referenceKind":"tenantId","notNull":true,"unique":false},"kind":{"type":"TEXT","notNull":true,"unique":false},"required_approvals":{"type":"INTEGER","notNull":false,"unique":false},"ttl_ms":{"type":"INTEGER","notNull":false,"unique":false},"required_permission":{"type":"TEXT","notNull":false,"unique":false},"updated_by":{"type":"TEXT","notNull":false,"unique":false}},"indexes":[{"name":"approval_policies_slug_context_idx","columns":["tenant_id","slug","context"],"unique":true},{"name":"approval_policies_tenant_kind_key","columns":["tenant_id","kind"],"unique":true},{"name":"approval_policies_tenant_id_created_at_idx","columns":["tenant_id","created_at"]}],"version":"80929cc8"},"importPath":"@happyvertical/smrt-approvals"},"@happyvertical/smrt-approvals:ApprovalRequest":{"name":"approvalrequest","className":"ApprovalRequest","qualifiedName":"@happyvertical/smrt-approvals:ApprovalRequest","collection":"approvalrequests","description":"A request for approval of one subject revision.","filePath":"/home/runner/work/smrt/smrt/packages/approvals/src/models/ApprovalRequest.ts","packageName":"@happyvertical/smrt-approvals","fields":{"tenantId":{"type":"text","required":true,"_meta":{"sqlType":"UUID","__tenancy":{"isTenantIdField":true,"autoFilter":true,"required":true,"autoPopulate":true,"nullable":false,"mode":"required","field":"tenantId","allowSuperAdminBypass":false}}},"kind":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"subjectType":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"subjectId":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"subjectRevisionHash":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"requestKey":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"requestedBy":{"type":"text","required":true,"_meta":{"required":true,"readonly":true},"readonly":true},"requestedByType":{"type":"text","required":false,"_meta":{"readonly":true},"enum":["human","agent","service"],"readonly":true},"summary":{"type":"text","required":false,"_meta":{"readonly":true},"readonly":true},"status":{"type":"text","required":false,"_meta":{"readonly":true},"readonly":true},"requiredApprovals":{"type":"integer","required":false,"_meta":{"readonly":true},"readonly":true},"approvalCount":{"type":"integer","required":false,"_meta":{"readonly":true},"readonly":true},"requiredPermissions":{"type":"text","required":false,"_meta":{"readonly":true},"readonly":true},"version":{"type":"integer","required":false,"_meta":{"readonly":true},"readonly":true},"expiresAt":{"type":"datetime","required":false,"_meta":{"readonly":true},"readonly":true},"decidedAt":{"type":"datetime","required":false,"_meta":{"readonly":true},"readonly":true},"consumedAt":{"type":"datetime","required":false,"_meta":{"readonly":true},"readonly":true},"consumedBy":{"type":"text","required":false,"_meta":{"readonly":true},"readonly":true}},"methods":{"getRequiredPermissions":{"name":"getRequiredPermissions","async":false,"parameters":[],"returnType":"string[]","isStatic":false,"isPublic":true},"setRequiredPermissions":{"name":"setRequiredPermissions","async":false,"parameters":[{"name":"slugs","type":"any","optional":false,"typeUnresolved":true}],"returnType":"void","isStatic":false,"isPublic":true},"expiresAtMs":{"name":"expiresAtMs","async":false,"parameters":[],"returnType":"number","isStatic":false,"isPublic":true},"isConsumed":{"name":"isConsumed","async":false,"parameters":[],"returnType":"boolean","isStatic":false,"isPublic":true},"save":{"name":"save","async":true,"parameters":[],"returnType":"Promise<this>","isStatic":false,"isPublic":true},"delete":{"name":"delete","async":true,"parameters":[],"returnType":"Promise<void>","isStatic":false,"isPublic":true}},"decoratorConfig":{"tableName":"approval_requests","api":{"include":["list","get"]},"mcp":{"include":["list","get"]},"cli":false,"indexes":[{"name":"approval_requests_tenant_request_key","columns":["tenantId","requestKey"],"unique":true},{"name":"approval_requests_status_expiry_idx","columns":["tenantId","status","expiresAt"]},{"name":"approval_requests_subject_idx","columns":["tenantId","subjectType","subjectId"]}],"tenantScoped":{"mode":"required"},"conflictColumns":["tenant_id","slug","context"]},"extends":"SmrtObject","exportName":"ApprovalRequest","collectionExportName":"ApprovalRequestCollection","validationRules":[{"field":"kind","rule":"required","fieldType":"text"},{"field":"subjectType","rule":"required","fieldType":"text"},{"field":"subjectId","rule":"required","fieldType":"text"},{"field":"subjectRevisionHash","rule":"required","fieldType":"text"},{"field":"requestKey","rule":"required","fieldType":"text"},{"field":"requestedBy","rule":"required","fieldType":"text"}],"schema":{"tableName":"approval_requests","ddl":"CREATE TABLE IF NOT EXISTS \\"approval_requests\\" (\\n  \\"id\\" UUID PRIMARY KEY NOT NULL,\\n  \\"slug\\" TEXT NOT NULL,\\n  \\"context\\" TEXT NOT NULL DEFAULT '',\\n  \\"created_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"updated_at\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\"tenant_id\\" UUID NOT NULL,\\n  \\"kind\\" TEXT NOT NULL,\\n  \\"subject_type\\" TEXT NOT NULL,\\n  \\"subject_id\\" TEXT NOT NULL,\\n  \\"subject_revision_hash\\" TEXT NOT NULL,\\n  \\"request_key\\" TEXT NOT NULL,\\n  \\"requested_by\\" TEXT NOT NULL,\\n  \\"requested_by_type\\" TEXT,\\n  \\"summary\\" TEXT,\\n  \\"status\\" TEXT,\\n  \\"required_approvals\\" INTEGER,\\n  \\"approval_count\\" INTEGER,\\n  \\"required_permissions\\" TEXT,\\n  \\"version\\" INTEGER,\\n  \\"expires_at\\" TIMESTAMP,\\n  \\"decided_at\\" TIMESTAMP,\\n  \\"consumed_at\\" TIMESTAMP,\\n  \\"consumed_by\\" TEXT\\n);","columns":{"id":{"type":"UUID","primaryKey":true,"referenceKind":"id","notNull":true},"slug":{"type":"TEXT","notNull":true},"context":{"type":"TEXT","notNull":true,"default":""},"created_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"updated_at":{"type":"TIMESTAMP","notNull":true,"default":"current_timestamp"},"tenant_id":{"type":"UUID","referenceKind":"tenantId","notNull":true,"unique":false},"kind":{"type":"TEXT","notNull":true,"unique":false},"subject_type":{"type":"TEXT","notNull":true,"unique":false},"subject_id":{"type":"TEXT","notNull":true,"unique":false},"subject_revision_hash":{"type":"TEXT","notNull":true,"unique":false},"request_key":{"type":"TEXT","notNull":true,"unique":false},"requested_by":{"type":"TEXT","notNull":true,"unique":false},"requested_by_type":{"type":"TEXT","notNull":false,"unique":false},"summary":{"type":"TEXT","notNull":false,"unique":false},"status":{"type":"TEXT","notNull":false,"unique":false},"required_approvals":{"type":"INTEGER","notNull":false,"unique":false},"approval_count":{"type":"INTEGER","notNull":false,"unique":false},"required_permissions":{"type":"TEXT","notNull":false,"unique":false},"version":{"type":"INTEGER","notNull":false,"unique":false},"expires_at":{"type":"TIMESTAMP","notNull":false,"unique":false},"decided_at":{"type":"TIMESTAMP","notNull":false,"unique":false},"consumed_at":{"type":"TIMESTAMP","notNull":false,"unique":false},"consumed_by":{"type":"TEXT","notNull":false,"unique":false}},"indexes":[{"name":"approval_requests_slug_context_idx","columns":["tenant_id","slug","context"],"unique":true},{"name":"approval_requests_tenant_request_key","columns":["tenant_id","request_key"],"unique":true},{"name":"approval_requests_status_expiry_idx","columns":["tenant_id","status","expires_at"]},{"name":"approval_requests_subject_idx","columns":["tenant_id","subject_type","subject_id"]},{"name":"approval_requests_tenant_id_created_at_idx","columns":["tenant_id","created_at"]}],"version":"a5800bdd"},"importPath":"@happyvertical/smrt-approvals"}},"moduleType":"smrt","smrtDependencies":["@happyvertical/smrt-core","@happyvertical/smrt-tenancy","@happyvertical/smrt-users"],"browser":{"status":"server-only","issues":["#3617","#3624","#3626"],"via":["@happyvertical/smrt-profiles","@happyvertical/smrt-tenancy","@happyvertical/smrt-users"]},"stampsConstructors":true}`));
+//#endregion
+//#region src/permissions.ts
+var CANCEL_ANY_APPROVAL_PERMISSION = "approvals.cancel-any";
+var MANAGE_APPROVAL_POLICY_PERMISSION = "approvals.manage-policy";
+var APPROVAL_PERMISSION_DEFINITIONS = [{
+	slug: CANCEL_ANY_APPROVAL_PERMISSION,
+	category: "approvals",
+	name: "Cancel Any Approval Request",
+	description: "Cancel a pending approval request made by someone else in the tenant"
+}, {
+	slug: MANAGE_APPROVAL_POLICY_PERMISSION,
+	category: "approvals",
+	name: "Manage Approval Policy",
+	description: "Tighten an approval kind's quorum, expiry, or required permission for the tenant"
+}];
+var registered = false;
+function registerApprovalPermissions() {
+	return registerPermissionDefinitions(APPROVAL_PERMISSION_DEFINITIONS);
+}
+function ensureApprovalPermissionsRegistered() {
+	if (registered) return;
+	registered = true;
+	registerApprovalPermissions();
+}
+//#endregion
+//#region src/write-capability.ts
+var SERVICE_WRITE = /* @__PURE__ */ Symbol("smrt-approvals.serviceWrite");
+var TOKEN = Object.freeze({ capability: "smrt-approvals.serviceWrite" });
+var minted = /* @__PURE__ */ new WeakSet();
+function serviceWriteOption() {
+	return { [SERVICE_WRITE]: TOKEN };
+}
+function adoptServiceWrite(instance, options) {
+	if (options && typeof options === "object" && options[SERVICE_WRITE] === TOKEN) minted.add(instance);
+}
+function hasServiceWrite(instance) {
+	return minted.has(instance);
+}
+//#endregion
+//#region src/models/ApprovalRequest.ts
+var __defProp$5 = Object.defineProperty;
+var __getOwnPropDesc$5 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$5 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$5(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$5(target, key, result);
+	return result;
+};
+var __publicField$5 = (obj, key, value) => __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
+var ApprovalRequest = class extends SmrtObject {
+	tenantId = "";
+	kind = "";
+	subjectType = "";
+	subjectId = "";
+	subjectRevisionHash = "";
+	requestKey = "";
+	requestedBy = "";
+	requestedByType = "human";
+	summary = "";
+	status = "pending";
+	requiredApprovals = 1;
+	approvalCount = 0;
+	requiredPermissions = "[]";
+	version = 0;
+	expiresAt = null;
+	decidedAt = null;
+	consumedAt = null;
+	consumedBy = "";
+	constructor(options = {}) {
+		super(options);
+		adoptServiceWrite(this, options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.kind !== void 0) this.kind = options.kind;
+		if (options.subjectType !== void 0) this.subjectType = options.subjectType;
+		if (options.subjectId !== void 0) this.subjectId = options.subjectId;
+		if (options.subjectRevisionHash !== void 0) this.subjectRevisionHash = options.subjectRevisionHash;
+		if (options.requestKey !== void 0) this.requestKey = options.requestKey;
+		if (options.requestedBy !== void 0) this.requestedBy = options.requestedBy;
+		if (options.requestedByType !== void 0) this.requestedByType = options.requestedByType;
+		if (options.summary !== void 0) this.summary = options.summary;
+		if (options.status !== void 0) this.status = options.status;
+		if (options.requiredApprovals !== void 0) this.requiredApprovals = options.requiredApprovals;
+		if (options.approvalCount !== void 0) this.approvalCount = options.approvalCount;
+		if (options.requiredPermissions !== void 0) this.requiredPermissions = options.requiredPermissions;
+		if (options.version !== void 0) this.version = options.version;
+		if (options.expiresAt !== void 0) this.expiresAt = options.expiresAt;
+		if (options.decidedAt !== void 0) this.decidedAt = options.decidedAt;
+		if (options.consumedAt !== void 0) this.consumedAt = options.consumedAt;
+		if (options.consumedBy !== void 0) this.consumedBy = options.consumedBy;
+	}
+	/** The permission slugs a decider must hold (never throws; bad JSON = none valid). */
+	getRequiredPermissions() {
+		try {
+			const parsed = JSON.parse(this.requiredPermissions || "[]");
+			return Array.isArray(parsed) ? parsed.filter((slug) => typeof slug === "string") : [];
+		} catch {
+			return [];
+		}
+	}
+	/** Store the permission slugs a decider must hold. */
+	setRequiredPermissions(slugs) {
+		this.requiredPermissions = JSON.stringify([...slugs]);
+	}
+	/** The expiry as epoch milliseconds (`NaN` when unset or unparseable). */
+	expiresAtMs() {
+		const value = this.expiresAt;
+		if (value instanceof Date) return value.getTime();
+		if (typeof value === "string" || typeof value === "number") return new Date(value).getTime();
+		return NaN;
+	}
+	/** True when the approval was consumed. */
+	isConsumed() {
+		return this.consumedAt !== null && this.consumedAt !== void 0;
+	}
+	/**
+	* Refuse any insert `ApprovalService` did not mint (see
+	* `write-capability.ts`), and any minted insert that does not start in the
+	* initial state. Runs for ordinary saves and bulk creates alike (core
+	* wraps an error thrown here; `save()` checks first so callers see it).
+	*
+	* @throws {ApprovalError} `APPROVAL_FORBIDDEN`.
+	*/
+	async validateBeforeSave() {
+		await super.validateBeforeSave();
+		this.assertInsertAllowed();
+	}
+	assertInsertAllowed() {
+		if (this.isPersisted) return;
+		if (!hasServiceWrite(this)) throw new ApprovalError("APPROVAL_FORBIDDEN", "ApprovalRequest rows are created only by ApprovalService.requestApproval().");
+		if (this.status !== "pending" || Number(this.approvalCount) !== 0 || Number(this.version) !== 1 || this.decidedAt || this.consumedAt || this.consumedBy) throw new ApprovalError("APPROVAL_FORBIDDEN", "A new ApprovalRequest must start pending, undecided, and unconsumed.");
+	}
+	/**
+	* Insert a new request. A loaded request is never re-saved: every later
+	* change is a guarded transition in `ApprovalService`.
+	*
+	* @throws {ApprovalError} `APPROVAL_FORBIDDEN` for a persisted request.
+	*/
+	async save() {
+		if (this.isPersisted) throw new ApprovalError("APPROVAL_FORBIDDEN", `ApprovalRequest ${this.id} is changed only through ApprovalService transitions.`);
+		this.assertInsertAllowed();
+		this.requireInsertOnSave();
+		return await super.save();
+	}
+	/**
+	* Requests are durable records of a decision.
+	*
+	* @throws {ApprovalError} always.
+	*/
+	async delete() {
+		throw new ApprovalError("APPROVAL_FORBIDDEN", `ApprovalRequest ${this.id} cannot be deleted.`);
+	}
+};
+__publicField$5(ApprovalRequest, "__smrtPackage__", "@happyvertical/smrt-approvals");
+__decorateClass$5([tenantId()], ApprovalRequest.prototype, "tenantId", 2);
+__decorateClass$5([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalRequest.prototype, "kind", 2);
+__decorateClass$5([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalRequest.prototype, "subjectType", 2);
+__decorateClass$5([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalRequest.prototype, "subjectId", 2);
+__decorateClass$5([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalRequest.prototype, "subjectRevisionHash", 2);
+__decorateClass$5([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalRequest.prototype, "requestKey", 2);
+__decorateClass$5([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalRequest.prototype, "requestedBy", 2);
+__decorateClass$5([field({
+	type: "text",
+	readonly: true
+})], ApprovalRequest.prototype, "requestedByType", 2);
+__decorateClass$5([field({
+	type: "text",
+	readonly: true
+})], ApprovalRequest.prototype, "summary", 2);
+__decorateClass$5([field({
+	type: "text",
+	readonly: true
+})], ApprovalRequest.prototype, "status", 2);
+__decorateClass$5([field({
+	type: "integer",
+	readonly: true
+})], ApprovalRequest.prototype, "requiredApprovals", 2);
+__decorateClass$5([field({
+	type: "integer",
+	readonly: true
+})], ApprovalRequest.prototype, "approvalCount", 2);
+__decorateClass$5([field({
+	type: "text",
+	readonly: true
+})], ApprovalRequest.prototype, "requiredPermissions", 2);
+__decorateClass$5([field({
+	type: "integer",
+	readonly: true
+})], ApprovalRequest.prototype, "version", 2);
+__decorateClass$5([field({
+	type: "datetime",
+	readonly: true
+})], ApprovalRequest.prototype, "expiresAt", 2);
+__decorateClass$5([field({
+	type: "datetime",
+	readonly: true
+})], ApprovalRequest.prototype, "decidedAt", 2);
+__decorateClass$5([field({
+	type: "datetime",
+	readonly: true
+})], ApprovalRequest.prototype, "consumedAt", 2);
+__decorateClass$5([field({
+	type: "text",
+	readonly: true
+})], ApprovalRequest.prototype, "consumedBy", 2);
+ApprovalRequest = __decorateClass$5([TenantScoped({ mode: "required" }), smrt({
+	tableName: "approval_requests",
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: false,
+	indexes: [
+		{
+			name: "approval_requests_tenant_request_key",
+			columns: ["tenantId", "requestKey"],
+			unique: true
+		},
+		{
+			name: "approval_requests_status_expiry_idx",
+			columns: [
+				"tenantId",
+				"status",
+				"expiresAt"
+			]
+		},
+		{
+			name: "approval_requests_subject_idx",
+			columns: [
+				"tenantId",
+				"subjectType",
+				"subjectId"
+			]
+		}
+	]
+})], ApprovalRequest);
+//#endregion
+//#region src/models/ApprovalEvent.ts
+var __defProp$4 = Object.defineProperty;
+var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$4 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$4(target, key, result);
+	return result;
+};
+var __publicField$4 = (obj, key, value) => __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
+var ApprovalEvent = class extends SmrtObject {
+	tenantId = "";
+	requestId = "";
+	type = "created";
+	actorId = "";
+	actorType = "human";
+	reason = "";
+	subjectRevisionHash = "";
+	sequence = 0;
+	voteKey = null;
+	occurredAt = null;
+	constructor(options = {}) {
+		super(options);
+		adoptServiceWrite(this, options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.requestId !== void 0) this.requestId = options.requestId;
+		if (options.type !== void 0) this.type = options.type;
+		if (options.actorId !== void 0) this.actorId = options.actorId;
+		if (options.actorType !== void 0) this.actorType = options.actorType;
+		if (options.reason !== void 0) this.reason = options.reason;
+		if (options.subjectRevisionHash !== void 0) this.subjectRevisionHash = options.subjectRevisionHash;
+		if (options.sequence !== void 0) this.sequence = options.sequence;
+		if (options.voteKey !== void 0) this.voteKey = options.voteKey;
+		if (options.occurredAt !== void 0) this.occurredAt = options.occurredAt;
+	}
+	/**
+	* Append the event. An event is written once and never updated.
+	*
+	* @throws {ApprovalError} `APPROVAL_FORBIDDEN` for a persisted event.
+	*/
+	async save() {
+		if (this.isPersisted) throw new ApprovalError("APPROVAL_FORBIDDEN", `ApprovalEvent ${this.id} is append-only and cannot be updated.`);
+		this.assertInsertAllowed();
+		if (!this.occurredAt) this.occurredAt = /* @__PURE__ */ new Date();
+		this.requireInsertOnSave();
+		return await super.save();
+	}
+	/**
+	* Refuse any insert `ApprovalService` did not mint in the same transaction
+	* as its guarded UPDATE (see `write-capability.ts`): a forged `approved`
+	* event would otherwise count toward quorum. Runs for ordinary saves and
+	* bulk creates alike.
+	*
+	* @throws {ApprovalError} `APPROVAL_FORBIDDEN`.
+	*/
+	async validateBeforeSave() {
+		await super.validateBeforeSave();
+		this.assertInsertAllowed();
+	}
+	assertInsertAllowed() {
+		if (this.isPersisted || hasServiceWrite(this)) return;
+		throw new ApprovalError("APPROVAL_FORBIDDEN", "ApprovalEvent rows are appended only by ApprovalService transitions.");
+	}
+	/**
+	* Events are append-only.
+	*
+	* @throws {ApprovalError} always.
+	*/
+	async delete() {
+		throw new ApprovalError("APPROVAL_FORBIDDEN", `ApprovalEvent ${this.id} is append-only and cannot be deleted.`);
+	}
+};
+__publicField$4(ApprovalEvent, "__smrtPackage__", "@happyvertical/smrt-approvals");
+__decorateClass$4([tenantId()], ApprovalEvent.prototype, "tenantId", 2);
+__decorateClass$4([foreignKey(ApprovalRequest, {
+	required: true,
+	readonly: true,
+	onDelete: "RESTRICT",
+	onUpdate: "RESTRICT",
+	constraint: { engines: ["postgres", "sqlite"] }
+})], ApprovalEvent.prototype, "requestId", 2);
+__decorateClass$4([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalEvent.prototype, "type", 2);
+__decorateClass$4([field({
+	type: "text",
+	required: true,
+	readonly: true
+})], ApprovalEvent.prototype, "actorId", 2);
+__decorateClass$4([field({
+	type: "text",
+	readonly: true
+})], ApprovalEvent.prototype, "actorType", 2);
+__decorateClass$4([field({
+	type: "text",
+	readonly: true
+})], ApprovalEvent.prototype, "reason", 2);
+__decorateClass$4([field({
+	type: "text",
+	readonly: true
+})], ApprovalEvent.prototype, "subjectRevisionHash", 2);
+__decorateClass$4([field({
+	type: "integer",
+	readonly: true
+})], ApprovalEvent.prototype, "sequence", 2);
+__decorateClass$4([field({
+	type: "text",
+	nullable: true,
+	readonly: true
+})], ApprovalEvent.prototype, "voteKey", 2);
+__decorateClass$4([field({
+	type: "datetime",
+	readonly: true
+})], ApprovalEvent.prototype, "occurredAt", 2);
+ApprovalEvent = __decorateClass$4([TenantScoped({ mode: "required" }), smrt({
+	tableName: "approval_events",
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: false,
+	indexes: [
+		{
+			name: "approval_events_request_sequence_key",
+			columns: ["requestId", "sequence"],
+			unique: true
+		},
+		{
+			name: "approval_events_request_vote_key",
+			columns: ["requestId", "voteKey"],
+			unique: true
+		},
+		{
+			name: "approval_events_tenant_occurred_idx",
+			columns: ["tenantId", "occurredAt"]
+		}
+	]
+})], ApprovalEvent);
+//#endregion
+//#region src/collections/ApprovalEventCollection.ts
+var __defProp$3 = Object.defineProperty;
+var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$3 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$3(target, key, result);
+	return result;
+};
+var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
+var ApprovalEventCollection = class extends SmrtCollection {};
+__publicField$3(ApprovalEventCollection, "__smrtPackage__", "@happyvertical/smrt-approvals");
+__publicField$3(ApprovalEventCollection, "_itemClass", ApprovalEvent);
+ApprovalEventCollection = __decorateClass$3([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: false
+})], ApprovalEventCollection);
+//#endregion
+//#region src/kinds.ts
+var MAX_REQUIRED_APPROVALS = 25;
+var DEFAULT_APPROVAL_TTL_MS = 10080 * 60 * 1e3;
+var MAX_APPROVAL_TTL_MS = 366 * 24 * 60 * 60 * 1e3;
+var MIN_APPROVAL_TTL_MS = 60 * 1e3;
+var KIND_KEY = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9_-]*)+$/;
+var QUALIFIED_CLASS = /^@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*:[A-Za-z_$][\w$]*$/;
+var PERMISSION_SLUG = /^[a-z][a-z0-9_-]*(?:\.[a-z0-9][a-z0-9_-]*)+$/;
+var kinds = /* @__PURE__ */ new Map();
+function isPermissionSlug(value) {
+	return typeof value === "string" && PERMISSION_SLUG.test(value);
+}
+function assertQuorum(value, label) {
+	if (!Number.isSafeInteger(value) || value < 1 || value > 25) throw new ApprovalError("APPROVAL_INVALID", `${label} must be an integer from 1 to 25, got ${String(value)}.`);
+}
+function assertTtl(value, label) {
+	if (!Number.isSafeInteger(value) || value < 6e4 || value > 316224e5) throw new ApprovalError("APPROVAL_INVALID", `${label} must be an integer number of milliseconds from ${MIN_APPROVAL_TTL_MS} to ${MAX_APPROVAL_TTL_MS}, got ${String(value)}.`);
+}
+function defineApprovalKind(input) {
+	if (!KIND_KEY.test(input.key ?? "")) throw new ApprovalError("APPROVAL_INVALID", `Approval kind key must be dotted lower case such as 'social.post.publish', got '${String(input.key)}'.`);
+	if (!QUALIFIED_CLASS.test(input.subject ?? "")) throw new ApprovalError("APPROVAL_INVALID", `Approval kind '${input.key}' subject must be a qualified class name such as '@happyvertical/smrt-social:SocialPost', got '${String(input.subject)}'.`);
+	if (!isPermissionSlug(input.permission)) throw new ApprovalError("APPROVAL_INVALID", `Approval kind '${input.key}' permission must be a slug such as 'social.approve-post', got '${String(input.permission)}'.`);
+	const requiredApprovals = input.defaults?.requiredApprovals ?? 1;
+	const ttlMs = input.defaults?.ttlMs ?? 6048e5;
+	assertQuorum(requiredApprovals, `Approval kind '${input.key}' requiredApprovals`);
+	assertTtl(ttlMs, `Approval kind '${input.key}' ttlMs`);
+	const kind = Object.freeze({
+		key: input.key,
+		subject: input.subject,
+		permission: input.permission,
+		defaults: Object.freeze({
+			requiredApprovals,
+			ttlMs
+		})
+	});
+	const existing = kinds.get(kind.key);
+	if (existing) {
+		if (existing.subject === kind.subject && existing.permission === kind.permission && existing.defaults.requiredApprovals === requiredApprovals && existing.defaults.ttlMs === ttlMs) return existing;
+		throw new ApprovalError("APPROVAL_KIND_CONFLICT", `Approval kind '${kind.key}' is already defined with different rules.`);
+	}
+	kinds.set(kind.key, kind);
+	return kind;
+}
+function getApprovalKind(key) {
+	return kinds.get(key);
+}
+function listApprovalKinds() {
+	return [...kinds.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+function requireApprovalKind(key) {
+	const kind = kinds.get(key);
+	if (!kind) throw new ApprovalError("APPROVAL_KIND_UNKNOWN", `Approval kind '${key}' is not defined in this process. Import the package that calls defineApprovalKind() for it.`);
+	return kind;
+}
+function unregisterApprovalKind(key) {
+	return kinds.delete(key);
+}
+function assertPolicyTightens(kind, rules) {
+	const quorum = rules.requiredApprovals ?? 0;
+	if (quorum !== 0) {
+		assertQuorum(quorum, `Approval policy for '${kind.key}' requiredApprovals`);
+		if (quorum < kind.defaults.requiredApprovals) throw new ApprovalError("APPROVAL_POLICY_LOOSENS", `Approval policy for '${kind.key}' may only raise requiredApprovals (default ${kind.defaults.requiredApprovals}), got ${quorum}.`);
+	}
+	const ttl = rules.ttlMs ?? 0;
+	if (ttl !== 0) {
+		assertTtl(ttl, `Approval policy for '${kind.key}' ttlMs`);
+		if (ttl > kind.defaults.ttlMs) throw new ApprovalError("APPROVAL_POLICY_LOOSENS", `Approval policy for '${kind.key}' may only shorten ttlMs (default ${kind.defaults.ttlMs}), got ${ttl}.`);
+	}
+	const permission = rules.requiredPermission ?? "";
+	if (permission !== "" && !isPermissionSlug(permission)) throw new ApprovalError("APPROVAL_INVALID", `Approval policy for '${kind.key}' requiredPermission must be a permission slug, got '${permission}'.`);
+}
+function effectiveRules(kind, policy) {
+	const policyQuorum = Number(policy?.requiredApprovals ?? 0);
+	const policyTtl = Number(policy?.ttlMs ?? 0);
+	const requiredApprovals = Number.isSafeInteger(policyQuorum) && policyQuorum > 0 ? Math.min(Math.max(kind.defaults.requiredApprovals, policyQuorum), 25) : kind.defaults.requiredApprovals;
+	const ttlMs = Number.isSafeInteger(policyTtl) && policyTtl > 0 ? Math.max(Math.min(kind.defaults.ttlMs, policyTtl), MIN_APPROVAL_TTL_MS) : kind.defaults.ttlMs;
+	const requiredPermissions = [kind.permission];
+	const extra = String(policy?.requiredPermission ?? "").trim();
+	if (extra && !requiredPermissions.includes(extra)) requiredPermissions.push(extra);
+	return {
+		requiredApprovals,
+		ttlMs,
+		requiredPermissions
+	};
+}
+//#endregion
+//#region src/models/ApprovalPolicy.ts
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$2 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$2(target, key, result);
+	return result;
+};
+var __publicField$2 = (obj, key, value) => __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
+var ApprovalPolicy = class extends SmrtObject {
+	tenantId = "";
+	kind = "";
+	requiredApprovals = 0;
+	ttlMs = 0;
+	requiredPermission = "";
+	updatedBy = "";
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.kind !== void 0) this.kind = options.kind;
+		if (options.requiredApprovals !== void 0) this.requiredApprovals = options.requiredApprovals;
+		if (options.ttlMs !== void 0) this.ttlMs = options.ttlMs;
+		if (options.requiredPermission !== void 0) this.requiredPermission = options.requiredPermission;
+		if (options.updatedBy !== void 0) this.updatedBy = options.updatedBy;
+	}
+	/**
+	* Validate against the registered kind, then persist. A row for an unknown
+	* kind, or one that would loosen the kind, is refused.
+	*
+	* @throws {ApprovalError} `APPROVAL_KIND_UNKNOWN`,
+	*   `APPROVAL_POLICY_LOOSENS`, or `APPROVAL_INVALID`.
+	*/
+	async save() {
+		this.requiredPermission = String(this.requiredPermission ?? "").trim();
+		this.requiredApprovals = Number(this.requiredApprovals ?? 0);
+		this.ttlMs = Number(this.ttlMs ?? 0);
+		assertPolicyTightens(requireApprovalKind(this.kind), {
+			requiredApprovals: this.requiredApprovals,
+			ttlMs: this.ttlMs,
+			requiredPermission: this.requiredPermission
+		});
+		return await super.save();
+	}
+};
+__publicField$2(ApprovalPolicy, "__smrtPackage__", "@happyvertical/smrt-approvals");
+__decorateClass$2([tenantId()], ApprovalPolicy.prototype, "tenantId", 2);
+__decorateClass$2([field({
+	type: "text",
+	required: true
+})], ApprovalPolicy.prototype, "kind", 2);
+__decorateClass$2([field({ type: "integer" })], ApprovalPolicy.prototype, "requiredApprovals", 2);
+__decorateClass$2([field({ type: "integer" })], ApprovalPolicy.prototype, "ttlMs", 2);
+__decorateClass$2([field({ type: "text" })], ApprovalPolicy.prototype, "requiredPermission", 2);
+__decorateClass$2([field({ type: "text" })], ApprovalPolicy.prototype, "updatedBy", 2);
+ApprovalPolicy = __decorateClass$2([TenantScoped({ mode: "required" }), smrt({
+	tableName: "approval_policies",
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: false,
+	indexes: [{
+		name: "approval_policies_tenant_kind_key",
+		columns: ["tenantId", "kind"],
+		unique: true
+	}]
+})], ApprovalPolicy);
+//#endregion
+//#region src/collections/ApprovalPolicyCollection.ts
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$1(target, key, result);
+	return result;
+};
+var __publicField$1 = (obj, key, value) => __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
+var ApprovalPolicyCollection = class extends SmrtCollection {};
+__publicField$1(ApprovalPolicyCollection, "__smrtPackage__", "@happyvertical/smrt-approvals");
+__publicField$1(ApprovalPolicyCollection, "_itemClass", ApprovalPolicy);
+ApprovalPolicyCollection = __decorateClass$1([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: false
+})], ApprovalPolicyCollection);
+//#endregion
+//#region src/collections/ApprovalRequestCollection.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var ApprovalRequestCollection = class extends SmrtCollection {};
+__publicField(ApprovalRequestCollection, "__smrtPackage__", "@happyvertical/smrt-approvals");
+__publicField(ApprovalRequestCollection, "_itemClass", ApprovalRequest);
+ApprovalRequestCollection = __decorateClass([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: false
+})], ApprovalRequestCollection);
+//#endregion
+//#region src/service.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var MAX_TOKEN_LENGTH = 256;
+var MAX_TEXT_LENGTH = 4e3;
+var DEFAULT_MAX_ATTEMPTS = 8;
+var REQUESTS_TABLE = "approval_requests";
+var DECISION_EVENT = {
+	approve: "approved",
+	reject: "rejected",
+	request_changes: "changes_requested"
+};
+function refusal(reason, detail, id = null) {
+	return {
+		kind: "refused",
+		reason,
+		detail,
+		id
+	};
+}
+function isoNow(date) {
+	return date.toISOString();
+}
+function assertToken(value, label) {
+	const text = typeof value === "string" ? value.trim() : "";
+	if (!text || text.length > MAX_TOKEN_LENGTH) throw new ApprovalError("APPROVAL_INVALID", `${label} must be a non-empty string of at most ${MAX_TOKEN_LENGTH} characters.`);
+	return text;
+}
+function assertText(value, label) {
+	if (value === void 0 || value === null) return "";
+	if (typeof value !== "string" || value.length > MAX_TEXT_LENGTH) throw new ApprovalError("APPROVAL_INVALID", `${label} must be a string of at most ${MAX_TEXT_LENGTH} characters.`);
+	return value.trim();
+}
+function assertPrincipal(principal) {
+	if (!principal || typeof principal.can !== "function") throw new ApprovalError("APPROVAL_INVALID", "An approval principal must provide can(slug).");
+	assertToken(principal.id, "Approval principal id");
+	if (typeof principal.tenantId !== "string" || !UUID_RE.test(principal.tenantId)) throw new ApprovalError("APPROVAL_INVALID", "An approval principal must carry the UUID of the tenant its permissions were resolved for.");
+	if (!APPROVAL_PRINCIPAL_TYPES.includes(principal.type)) throw new ApprovalError("APPROVAL_INVALID", `Approval principal type must be one of ${APPROVAL_PRINCIPAL_TYPES.join(", ")}.`);
+}
+function countedApprovers(approvals, request) {
+	return new Set(approvals.filter((event) => event.type === "approved" && event.actorType === "human" && event.actorId !== request.requestedBy).map((event) => event.actorId));
+}
+function rowVersion(rows) {
+	const row = rows?.[0];
+	if (!row) return null;
+	const version = Number(row.version);
+	return Number.isSafeInteger(version) ? version : null;
+}
+var ApprovalService = class ApprovalService {
+	db;
+	clock;
+	maxAttempts;
+	constructor(options) {
+		if (!options?.db || typeof options.db.query !== "function") throw new ApprovalError("APPROVAL_INVALID", "ApprovalService requires an initialized database.");
+		if (typeof options.db.transaction !== "function") throw new ApprovalError("APPROVAL_NO_TRANSACTION", "ApprovalService requires a database adapter with transaction support.");
+		this.db = options.db;
+		this.clock = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.maxAttempts = Math.max(1, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+	}
+	/** One request in the principal's tenant, or `null`. */
+	async getRequest(principal, requestId) {
+		assertPrincipal(principal);
+		if (!UUID_RE.test(String(requestId ?? ""))) return null;
+		return await this.inTenant(principal, () => this.loadRequest(this.db, principal.tenantId, requestId));
+	}
+	/** A request's events in order, in the principal's tenant. */
+	async listEvents(principal, requestId) {
+		assertPrincipal(principal);
+		if (!UUID_RE.test(String(requestId ?? ""))) return [];
+		return await this.inTenant(principal, async () => {
+			return await (await ApprovalEventCollection.create({ db: this.db })).list({
+				where: {
+					tenantId: principal.tenantId,
+					requestId
+				},
+				orderBy: "sequence ASC",
+				limit: 1e3
+			});
+		});
+	}
+	/**
+	* Open a request for approval of one subject revision. Any principal type
+	* may request. The quorum, expiry, and required permissions are fixed now
+	* from the kind's defaults tightened by the tenant's policy.
+	*/
+	async requestApproval(principal, input) {
+		assertPrincipal(principal);
+		const kind = requireApprovalKind(typeof input.kind === "string" ? input.kind : input.kind?.key);
+		const subjectId = assertToken(input.subjectId, "subjectId");
+		const subjectRevisionHash = assertToken(input.subjectRevisionHash, "subjectRevisionHash");
+		const requestKey = input.requestKey === void 0 ? globalThis.crypto.randomUUID() : assertToken(input.requestKey, "requestKey");
+		const summary = assertText(input.summary, "summary");
+		const tenantId = principal.tenantId;
+		const sameContent = (row) => row.kind === kind.key && row.subjectType === kind.subject && row.subjectId === subjectId && row.subjectRevisionHash === subjectRevisionHash;
+		if (this.contextMismatch(principal)) return ApprovalService.mismatchResult();
+		return await this.inTenant(principal, async () => {
+			let outcome;
+			try {
+				outcome = await this.runTransaction(async (tx) => {
+					const requests = await this.txCollection(ApprovalRequestCollection, tx);
+					const [existing] = await requests.list({
+						where: {
+							tenantId,
+							requestKey
+						},
+						limit: 1
+					});
+					if (existing) return sameContent(existing) ? {
+						kind: "done",
+						outcome: "already_applied",
+						id: String(existing.id)
+					} : refusal("request_key_conflict", `requestKey '${requestKey}' already names a different request`);
+					const policy = await this.loadPolicy(tx, tenantId, kind.key);
+					const rules = effectiveRules(kind, policy);
+					const now = this.clock();
+					const request = await requests.create({
+						tenantId,
+						kind: kind.key,
+						subjectType: kind.subject,
+						subjectId,
+						subjectRevisionHash,
+						requestKey,
+						requestedBy: principal.id,
+						requestedByType: principal.type,
+						summary,
+						status: "pending",
+						requiredApprovals: rules.requiredApprovals,
+						approvalCount: 0,
+						requiredPermissions: JSON.stringify(rules.requiredPermissions),
+						version: 1,
+						expiresAt: new Date(now.getTime() + rules.ttlMs),
+						...serviceWriteOption()
+					});
+					const id = String(request.id);
+					await this.appendEvent(tx, {
+						tenantId,
+						requestId: id,
+						type: "created",
+						principal,
+						reason: summary,
+						subjectRevisionHash,
+						sequence: 1,
+						now
+					});
+					return {
+						kind: "done",
+						outcome: "transitioned",
+						id
+					};
+				});
+			} catch (error) {
+				if (!isUniqueViolationError(error)) throw error;
+				const [winner] = await (await ApprovalRequestCollection.create({ db: this.db })).list({
+					where: {
+						tenantId,
+						requestKey
+					},
+					limit: 1
+				});
+				if (!winner) throw error;
+				outcome = sameContent(winner) ? {
+					kind: "done",
+					outcome: "already_applied",
+					id: String(winner.id)
+				} : refusal("request_key_conflict", `requestKey '${requestKey}' already names a different request`);
+			}
+			return await this.toResult(principal.tenantId, outcome);
+		});
+	}
+	/**
+	* Record a decision. Only a `human` principal of the request's tenant who
+	* is not the requester and holds every required permission may decide,
+	* once, while the request is pending and unexpired. `approve` counts
+	* toward the quorum of distinct approvers; `reject` and `request_changes`
+	* end the request.
+	*/
+	async decide(principal, requestId, input) {
+		assertPrincipal(principal);
+		const eventType = DECISION_EVENT[input?.decision];
+		if (!eventType) throw new ApprovalError("APPROVAL_INVALID", `Unknown decision '${String(input?.decision)}'.`);
+		const reason = assertText(input.reason, "reason");
+		if (input.decision !== "approve" && !reason) throw new ApprovalError("APPROVAL_INVALID", `A '${input.decision}' decision requires a reason.`);
+		const tenantId = principal.tenantId;
+		return await this.transition(principal, requestId, async (tx, request, now) => {
+			if (principal.type !== "human") return refusal("not_human", `a ${principal.type} principal cannot decide`, request.id);
+			if (principal.id === request.requestedBy) return refusal("self_approval", "the requester cannot decide their own request", request.id);
+			const missing = (await this.requiredPermissionsFor(tx, request)).filter((slug) => !principal.can(slug));
+			if (missing.length > 0) return refusal("forbidden", `missing permission: ${missing.join(", ")}`, request.id);
+			if (request.status !== "pending") return refusal("not_pending", `request is ${request.status}`, request.id);
+			if (!(request.expiresAtMs() > now.getTime())) return refusal("expired", "the request expired", request.id);
+			const events = await this.txCollection(ApprovalEventCollection, tx);
+			if ((await events.list({
+				where: {
+					tenantId,
+					requestId: request.id,
+					voteKey: principal.id
+				},
+				limit: 1
+			})).length > 0) return refusal("already_decided", "this principal already decided", request.id);
+			const version = Number(request.version);
+			const nowIso = isoNow(now);
+			let updated;
+			if (input.decision === "approve") {
+				const voters = countedApprovers(await events.list({
+					where: {
+						tenantId,
+						requestId: request.id,
+						type: "approved"
+					},
+					limit: 1e3
+				}), request);
+				voters.add(principal.id);
+				const count = voters.size;
+				const reached = count >= Number(request.requiredApprovals);
+				updated = await tx.query(`UPDATE ${REQUESTS_TABLE}
+              SET approval_count = ?, status = ?, decided_at = ${reached ? "?" : "decided_at"},
+                  version = version + 1, updated_at = ?
+            WHERE id = ? AND tenant_id = ? AND status = 'pending'
+              AND version = ? AND expires_at > ?
+        RETURNING version`, ...[
+					count,
+					reached ? "approved" : "pending",
+					...reached ? [nowIso] : [],
+					nowIso,
+					request.id,
+					tenantId,
+					version,
+					nowIso
+				]);
+			} else {
+				const status = input.decision === "reject" ? "rejected" : "changes_requested";
+				updated = await tx.query(`UPDATE ${REQUESTS_TABLE}
+              SET status = ?, decided_at = ?, version = version + 1, updated_at = ?
+            WHERE id = ? AND tenant_id = ? AND status = 'pending'
+              AND version = ? AND expires_at > ?
+        RETURNING version`, status, nowIso, nowIso, request.id, tenantId, version, nowIso);
+			}
+			const next = rowVersion(updated.rows);
+			if (next === null) return { kind: "retry" };
+			await this.appendEvent(tx, {
+				tenantId,
+				requestId: String(request.id),
+				type: eventType,
+				principal,
+				reason,
+				subjectRevisionHash: request.subjectRevisionHash,
+				sequence: next,
+				voteKey: principal.id,
+				now
+			});
+			await this.recordChange(tx, String(request.id), tenantId);
+			return {
+				kind: "done",
+				outcome: "transitioned",
+				id: String(request.id)
+			};
+		});
+	}
+	/**
+	* Cancel a pending request. The requester may cancel their own request;
+	* anyone else needs `approvals.cancel-any`.
+	*/
+	async cancel(principal, requestId, input = {}) {
+		assertPrincipal(principal);
+		const reason = assertText(input.reason, "reason");
+		const tenantId = principal.tenantId;
+		return await this.transition(principal, requestId, async (tx, request, now) => {
+			if (principal.id !== request.requestedBy && !principal.can("approvals.cancel-any")) return refusal("forbidden", `only the requester or a holder of ${CANCEL_ANY_APPROVAL_PERMISSION} may cancel`, request.id);
+			if (request.status !== "pending") return refusal("not_pending", `request is ${request.status}`, request.id);
+			if (!(request.expiresAtMs() > now.getTime())) return refusal("expired", "the request expired", request.id);
+			const nowIso = isoNow(now);
+			const next = rowVersion((await tx.query(`UPDATE ${REQUESTS_TABLE}
+            SET status = 'cancelled', decided_at = ?, version = version + 1, updated_at = ?
+          WHERE id = ? AND tenant_id = ? AND status = 'pending'
+            AND version = ? AND expires_at > ?
+      RETURNING version`, nowIso, nowIso, request.id, tenantId, Number(request.version), nowIso)).rows);
+			if (next === null) return { kind: "retry" };
+			await this.appendEvent(tx, {
+				tenantId,
+				requestId: String(request.id),
+				type: "cancelled",
+				principal,
+				reason,
+				subjectRevisionHash: request.subjectRevisionHash,
+				sequence: next,
+				now
+			});
+			await this.recordChange(tx, String(request.id), tenantId);
+			return {
+				kind: "done",
+				outcome: "transitioned",
+				id: String(request.id)
+			};
+		});
+	}
+	/**
+	* Mark one request expired: a pending request, or an approved one that
+	* was never consumed, whose expiry has passed. Needs no permission (it
+	* only records what time already decided), so a job may call it.
+	*/
+	async expire(principal, requestId) {
+		assertPrincipal(principal);
+		const tenantId = principal.tenantId;
+		return await this.transition(principal, requestId, async (tx, request, now) => {
+			if (!(request.status === "pending" || request.status === "approved" && !request.isConsumed())) return refusal("not_pending", request.status === "approved" ? "the approval was consumed" : `request is ${request.status}`, request.id);
+			if (request.expiresAtMs() > now.getTime()) return refusal("not_expired", "the request has not expired", request.id);
+			const nowIso = isoNow(now);
+			const next = rowVersion((await tx.query(`UPDATE ${REQUESTS_TABLE}
+            SET status = 'expired', decided_at = ?, version = version + 1, updated_at = ?
+          WHERE id = ? AND tenant_id = ? AND status IN ('pending', 'approved')
+            AND consumed_at IS NULL AND version = ? AND expires_at <= ?
+      RETURNING version`, nowIso, nowIso, request.id, tenantId, Number(request.version), nowIso)).rows);
+			if (next === null) return { kind: "retry" };
+			await this.appendEvent(tx, {
+				tenantId,
+				requestId: String(request.id),
+				type: "expired",
+				principal,
+				reason: "",
+				subjectRevisionHash: request.subjectRevisionHash,
+				sequence: next,
+				now
+			});
+			await this.recordChange(tx, String(request.id), tenantId);
+			return {
+				kind: "done",
+				outcome: "transitioned",
+				id: String(request.id)
+			};
+		});
+	}
+	/**
+	* Expire every due request in the principal's tenant: pending requests
+	* and unconsumed approvals past their deadline, oldest expiry first, at
+	* most `limit`. Returns the ids this call expired.
+	*/
+	async expireDue(principal, options = {}) {
+		assertPrincipal(principal);
+		const limit = Math.min(Math.max(1, Math.trunc(options.limit ?? 100)), 1e3);
+		const now = this.clock();
+		const candidates = await this.inTenant(principal, async () => {
+			return await (await ApprovalRequestCollection.create({ db: this.db })).list({
+				where: {
+					tenantId: principal.tenantId,
+					status: ["pending", "approved"],
+					consumedAt: null,
+					"expiresAt <=": now
+				},
+				orderBy: "expires_at ASC",
+				limit
+			});
+		});
+		const expired = [];
+		for (const candidate of candidates) if ((await this.expire(principal, String(candidate.id))).outcome === "transitioned") expired.push(String(candidate.id));
+		return expired;
+	}
+	/**
+	* Consume an approval exactly once. The presented hash must equal the
+	* revision that was approved; the request must be approved, unconsumed,
+	* and unexpired. Any principal type of the tenant may consume (the
+	* consumer's own service is the executor). Pass `options.transaction` to
+	* make the consumption part of the consumer's own transaction.
+	*/
+	async consume(principal, requestId, subjectRevisionHash, options = {}) {
+		assertPrincipal(principal);
+		const hash = assertToken(subjectRevisionHash, "subjectRevisionHash");
+		const tenantId = principal.tenantId;
+		return await this.transition(principal, requestId, async (tx, request, now) => {
+			if (request.status !== "approved") return refusal("not_approved", `request is ${request.status}`, request.id);
+			if (request.isConsumed()) return refusal("already_consumed", "the approval was already used", request.id);
+			if (request.subjectRevisionHash !== hash) return refusal("revision_mismatch", "the subject changed after it was approved", request.id);
+			if (!(request.expiresAtMs() > now.getTime())) return refusal("expired", "the approval expired", request.id);
+			if (!await this.ledgerBacksApproval(tx, request)) return refusal("unbacked_approval", "the ledger does not record this approval", request.id);
+			const nowIso = isoNow(now);
+			const next = rowVersion((await tx.query(`UPDATE ${REQUESTS_TABLE}
+              SET consumed_at = ?, consumed_by = ?, version = version + 1, updated_at = ?
+            WHERE id = ? AND tenant_id = ? AND status = 'approved'
+              AND consumed_at IS NULL AND subject_revision_hash = ?
+              AND version = ? AND expires_at > ?
+        RETURNING version`, nowIso, principal.id, nowIso, request.id, tenantId, hash, Number(request.version), nowIso)).rows);
+			if (next === null) return { kind: "retry" };
+			await this.appendEvent(tx, {
+				tenantId,
+				requestId: String(request.id),
+				type: "consumed",
+				principal,
+				reason: "",
+				subjectRevisionHash: hash,
+				sequence: next,
+				now
+			});
+			await this.recordChange(tx, String(request.id), tenantId);
+			return {
+				kind: "done",
+				outcome: "transitioned",
+				id: String(request.id)
+			};
+		}, options.transaction);
+	}
+	/**
+	* Write the tenant's tightening of a kind. Needs
+	* `approvals.manage-policy`; a rule that would loosen the kind's defaults
+	* throws `APPROVAL_POLICY_LOOSENS`. `0`/`''` clear a rule back to the
+	* default. Applies to requests made afterwards.
+	*/
+	async setPolicy(principal, kindKey, rules) {
+		assertPrincipal(principal);
+		if (principal.type !== "human" || !principal.can("approvals.manage-policy")) throw new ApprovalError("APPROVAL_FORBIDDEN", `Setting approval policy needs a human principal holding ${MANAGE_APPROVAL_POLICY_PERMISSION}.`);
+		const kind = requireApprovalKind(typeof kindKey === "string" ? kindKey : kindKey?.key);
+		const normalized = {
+			requiredApprovals: rules.requiredApprovals ?? 0,
+			ttlMs: rules.ttlMs ?? 0,
+			requiredPermission: String(rules.requiredPermission ?? "").trim()
+		};
+		if (normalized.requiredPermission && !isPermissionSlug(normalized.requiredPermission)) throw new ApprovalError("APPROVAL_INVALID", `requiredPermission must be a permission slug, got '${normalized.requiredPermission}'.`);
+		assertPolicyTightens(kind, normalized);
+		const tenantId = principal.tenantId;
+		return await this.inTenant(principal, async () => {
+			const id = await this.runTransaction(async (tx) => {
+				const policies2 = await this.txCollection(ApprovalPolicyCollection, tx);
+				const [existing] = await policies2.list({
+					where: {
+						tenantId,
+						kind: kind.key
+					},
+					limit: 1
+				});
+				if (existing) {
+					existing.requiredApprovals = normalized.requiredApprovals;
+					existing.ttlMs = normalized.ttlMs;
+					existing.requiredPermission = normalized.requiredPermission;
+					existing.updatedBy = principal.id;
+					await existing.save();
+					return String(existing.id);
+				}
+				const created = await policies2.create({
+					tenantId,
+					kind: kind.key,
+					...normalized,
+					updatedBy: principal.id
+				});
+				return String(created.id);
+			});
+			const [saved] = await (await ApprovalPolicyCollection.create({ db: this.db })).list({
+				where: {
+					tenantId,
+					id
+				},
+				limit: 1
+			});
+			if (!saved) throw new ApprovalError("APPROVAL_INVALID", "Saved approval policy vanished.");
+			return saved;
+		});
+	}
+	/** The effective rules a new request of `kind` would get in the tenant. */
+	async rulesFor(principal, kindKey) {
+		assertPrincipal(principal);
+		const kind = requireApprovalKind(typeof kindKey === "string" ? kindKey : kindKey?.key);
+		return await this.inTenant(principal, async () => effectiveRules(kind, await this.loadPolicy(this.db, principal.tenantId, kind.key)));
+	}
+	/**
+	* Run a guarded transition with retry. `body` runs inside a transaction
+	* on a fresh read of the request and returns `retry` when its guarded
+	* UPDATE matched no row (a concurrent transition won).
+	*/
+	async transition(principal, requestId, body, callerTransaction) {
+		if (!UUID_RE.test(String(requestId ?? ""))) return {
+			outcome: "refused",
+			request: null,
+			refusal: {
+				reason: "not_found",
+				detail: "not a request id"
+			}
+		};
+		if (this.contextMismatch(principal)) return ApprovalService.mismatchResult();
+		const tenantId = principal.tenantId;
+		return await this.inTenant(principal, async () => {
+			const attempt = async (tx) => {
+				const request = await this.loadRequest(tx, tenantId, requestId);
+				if (!request) return refusal("not_found", "no such request in this tenant");
+				return await body(tx, request, this.clock());
+			};
+			if (callerTransaction) {
+				const outcome = await attempt(callerTransaction);
+				if (outcome.kind === "retry") return await this.toResult(tenantId, refusal("contention", "a concurrent transition won", requestId), callerTransaction);
+				return await this.toResult(tenantId, outcome, callerTransaction);
+			}
+			for (let i = 0; i < this.maxAttempts; i++) {
+				let outcome;
+				try {
+					outcome = await this.runTransaction(attempt);
+				} catch (error) {
+					if (isUniqueViolationError(error)) continue;
+					throw error;
+				}
+				if (outcome.kind !== "retry") return await this.toResult(tenantId, outcome);
+			}
+			return await this.toResult(tenantId, refusal("contention", "concurrent transitions kept winning", requestId));
+		});
+	}
+	/** True when an active tenant context names a different tenant. */
+	contextMismatch(principal) {
+		const active = getTenantId();
+		return !isSystemContext() && active !== void 0 && active !== principal.tenantId;
+	}
+	/** The refusal returned when {@link contextMismatch} holds. */
+	static mismatchResult() {
+		return {
+			outcome: "refused",
+			request: null,
+			refusal: {
+				reason: "tenant_mismatch",
+				detail: "the principal's tenant does not match the active tenant context"
+			}
+		};
+	}
+	/** Pin the work to the principal's tenant; refuse a conflicting context. */
+	async inTenant(principal, fn) {
+		if (this.contextMismatch(principal)) throw new ApprovalError("APPROVAL_FORBIDDEN", `The principal's tenant does not match the active tenant context.`);
+		return await withTenant({ tenantId: principal.tenantId }, fn);
+	}
+	/**
+	* Run `fn` in a transaction through core's embedded write queue.
+	*
+	* On embedded engines (SQLite, DuckDB, libsql) the transaction takes the
+	* queue for its database BEFORE the adapter's connection lock, and the
+	* model writes inside it (event inserts, change-feed appends) re-enter that
+	* hold. Taking the connection lock first deadlocks against an unrelated
+	* save that holds the queue and then opens its own write transaction, and
+	* lets other root writes land inside this BEGIN..COMMIT. The queue also
+	* serializes these transactions per database in-process, which is what
+	* the former per-handle promise chain did, so that chain is gone.
+	* PostgreSQL is not queued: each transaction has its own pooled
+	* connection and the guarded UPDATE's row lock arbitrates.
+	*/
+	async runTransaction(fn) {
+		return await withEmbeddedWriteTransaction(this.db, isEmbeddedDatabase(this.db), fn);
+	}
+	/** A collection bound to a transaction database. */
+	async txCollection(Collection, tx) {
+		return await Collection.create({
+			db: tx,
+			_reuseInitializedDb: true,
+			_deferRuntimeInitialization: true
+		});
+	}
+	async loadRequest(db, tenantId, requestId) {
+		const [request] = await (db === this.db ? await ApprovalRequestCollection.create({ db }) : await this.txCollection(ApprovalRequestCollection, db)).list({
+			where: {
+				tenantId,
+				id: requestId
+			},
+			limit: 1
+		});
+		return request && request.tenantId === tenantId ? request : null;
+	}
+	async loadPolicy(db, tenantId, kind) {
+		const [policy] = await (db === this.db ? await ApprovalPolicyCollection.create({ db }) : await this.txCollection(ApprovalPolicyCollection, db)).list({
+			where: {
+				tenantId,
+				kind
+			},
+			limit: 1
+		});
+		return policy ?? null;
+	}
+	/**
+	* Every slug a decider must hold now: the slugs fixed at request time
+	* plus the kind's and the tenant policy's current ones (tightening only:
+	* a later policy can add a slug, never remove one).
+	*/
+	async requiredPermissionsFor(tx, request) {
+		const kind = requireApprovalKind(request.kind);
+		const current = effectiveRules(kind, await this.loadPolicy(tx, request.tenantId, kind.key));
+		const slugs = new Set(request.getRequiredPermissions());
+		for (const slug of current.requiredPermissions) slugs.add(slug);
+		return [...slugs];
+	}
+	async appendEvent(tx, input) {
+		await (await this.txCollection(ApprovalEventCollection, tx)).create({
+			tenantId: input.tenantId,
+			requestId: input.requestId,
+			type: input.type,
+			actorId: input.principal.id,
+			actorType: input.principal.type,
+			reason: input.reason,
+			subjectRevisionHash: input.subjectRevisionHash,
+			sequence: input.sequence,
+			voteKey: input.voteKey ?? null,
+			occurredAt: input.now,
+			...serviceWriteOption()
+		});
+	}
+	/**
+	* Defence in depth for `consume`: the request row says `approved`, so the
+	* ledger must agree. It needs the `created` event at sequence 1, no
+	* terminal event, and approvals from at least `requiredApprovals` distinct
+	* human actors other than the requester. Catches a status written around
+	* the service (raw SQL); model-layer inserts are already capability-gated.
+	*/
+	async ledgerBacksApproval(tx, request) {
+		const ledger = await (await this.txCollection(ApprovalEventCollection, tx)).list({
+			where: {
+				tenantId: request.tenantId,
+				requestId: request.id
+			},
+			limit: 1e3
+		});
+		const created = ledger.some((event) => event.type === "created" && Number(event.sequence) === 1);
+		const terminal = ledger.some((event) => [
+			"rejected",
+			"changes_requested",
+			"cancelled",
+			"expired",
+			"consumed"
+		].includes(event.type));
+		const approvers = countedApprovers(ledger.filter((event) => event.type === "approved"), request);
+		return created && !terminal && approvers.size >= Math.max(1, Number(request.requiredApprovals));
+	}
+	/**
+	* The guarded UPDATE bypasses save hooks, so record the change-feed entry
+	* the save path would have written. Best effort, like the save path.
+	*/
+	async recordChange(tx, requestId, tenantId) {
+		try {
+			await appendChange(tx, {
+				table: REQUESTS_TABLE,
+				rowId: requestId,
+				operation: "update",
+				tenantId
+			});
+		} catch {}
+	}
+	/** Re-read the request after commit (ids only cross the boundary). */
+	async toResult(tenantId, outcome, db = this.db) {
+		if (outcome.kind === "retry") throw new Error("ApprovalService: unresolved retry outcome");
+		const id = outcome.id;
+		const request = id ? await this.loadRequest(db, tenantId, id) : null;
+		if (outcome.kind === "refused") return {
+			outcome: "refused",
+			request: outcome.reason === "not_found" ? null : request,
+			refusal: {
+				reason: outcome.reason,
+				detail: outcome.detail
+			}
+		};
+		return {
+			outcome: outcome.outcome,
+			request
+		};
+	}
+};
+//#endregion
+//#region src/index.ts
+ensureApprovalPermissionsRegistered();
+//#endregion
+export { APPROVAL_EVENT_TYPES, APPROVAL_PERMISSION_DEFINITIONS, APPROVAL_PRINCIPAL_TYPES, APPROVAL_STATUSES, ApprovalError, ApprovalEvent, ApprovalEventCollection, ApprovalPolicy, ApprovalPolicyCollection, ApprovalRequest, ApprovalRequestCollection, ApprovalService, CANCEL_ANY_APPROVAL_PERMISSION, DEFAULT_APPROVAL_TTL_MS, MANAGE_APPROVAL_POLICY_PERMISSION, MAX_APPROVAL_TTL_MS, MAX_REQUIRED_APPROVALS, MIN_APPROVAL_TTL_MS, approvalPrincipalFromPermissions, assertPolicyTightens, defineApprovalKind, effectiveRules, ensureApprovalPermissionsRegistered, getApprovalKind, listApprovalKinds, registerApprovalPermissions, requireApprovalKind, unregisterApprovalKind };
+
+//# sourceMappingURL=index.js.map