@openagentsy/hooks 0.0.0-stage → 0.2.1

package/dist/approvals.js

@@ -0,0 +1,464 @@
+import { randomUUID } from 'node:crypto';
+import { link, mkdir, open, readFile, rename, rm, stat, utimes, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { appendAudit, POLICIES } from '@openagentsy/core';
+import { z } from 'zod';
+import { readPreToolCall } from './event.js';
+/** How long a grant lives when no other time is given. */
+export const DEFAULT_APPROVAL_TTL_MS = 15 * 60 * 1000;
+/**
+ * The largest moment a date can name, in milliseconds since the epoch.
+ *
+ * A grant that runs out at a moment no date can name never runs out, and a
+ * grant that never runs out is a permanent permission. The store refuses one
+ * that would.
+ */
+const MAX_DATE_MS = 8_640_000_000_000_000;
+/**
+ * Whether a moment is one a date can name.
+ */
+function isRepresentable(expiresAt) {
+    return Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= MAX_DATE_MS;
+}
+/** The grants, as they are written down. */
+const EntrySchema = z.object({ callID: z.string(), expiresAt: z.number() });
+const GrantsSchema = z.array(EntrySchema);
+/** How long a writer waits for the lock, in milliseconds. */
+const LOCK_TIMEOUT_MS = 2000;
+/**
+ * How old a lock must be before it is presumed abandoned.
+ *
+ * It is four times the wait, so a writer that is alive and slow is never
+ * mistaken for a writer that died. The two bounds are apart on purpose: a
+ * bound that is the same as the wait would take the lock away from a
+ * writer that is still holding it.
+ */
+const STALE_LOCK_MS = LOCK_TIMEOUT_MS * 4;
+/**
+ * How often the lock is refreshed while the action runs, in milliseconds.
+ *
+ * The refresh is what makes a lock stale only when its owner died: a
+ * writer that is slow keeps its lock alive.
+ */
+const HEARTBEAT_MS = STALE_LOCK_MS / 4;
+/** The pause between two tries for the lock, in milliseconds. */
+const LOCK_RETRY_MS = 5;
+/**
+ * Where the grants live.
+ *
+ * The file sits in the state root next to the board, so every session of
+ * the project reads the same grants. The path is a protected one: the file
+ * is written by a person and by the gate, never by an agent.
+ */
+export function approvalsPath(stateRoot) {
+    return join(stateRoot, '.openagentsy', 'approvals.json');
+}
+/**
+ * Where the audit of the project lives.
+ *
+ * It is the board's own log, beside the grants: the same file the leases and
+ * the records are audited in.
+ */
+function auditPathFor(approvalsFile) {
+    return join(dirname(approvalsFile), 'audit.jsonl');
+}
+/**
+ * Whether an error is the one the file system raises for a code.
+ */
+function isFileError(error, code) {
+    return typeof error === 'object' && error !== null && error.code === code;
+}
+/**
+ * A pause.
+ */
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+/**
+ * The lock that serialises a claim.
+ *
+ * Two calls that spend the same grant at the same time must not both pass,
+ * so the read and the write of the store are one step under a lock file
+ * that is created exclusively. The second caller waits and then finds the
+ * grant gone.
+ */
+export async function withLock(path, timing, action) {
+    const lockPath = `${path}.lock`;
+    await mkdir(dirname(lockPath), { recursive: true });
+    const release = await acquireLock(lockPath, timing);
+    const heartbeat = setInterval(() => {
+        // The refresh is not awaited: the action is what matters, and a
+        // refresh that fails leaves the lock as it was.
+        void utimes(lockPath, new Date(), new Date()).catch(() => undefined);
+    }, timing.heartbeatMs);
+    heartbeat.unref?.();
+    try {
+        return await action();
+    }
+    finally {
+        clearInterval(heartbeat);
+        await release();
+    }
+}
+/**
+ * The lock file, taken.
+ *
+ * The file is created exclusively, so only one writer holds it, and it
+ * carries the token of the writer that holds it, so a writer only gives
+ * back its own lock.
+ *
+ * A writer that cannot take the lock waits. Whether the lock may be taken
+ * over is decided once, when the lock is first seen: a lock that was
+ * alive then is not taken away from the writer that holds it now. A
+ * writer that waits for too long gives up with an error: the store is not
+ * left open.
+ */
+async function acquireLock(lockPath, timing) {
+    const deadline = Date.now() + timing.timeoutMs;
+    const token = randomUUID();
+    let seen = false;
+    for (;;) {
+        try {
+            const handle = await open(lockPath, 'wx');
+            await handle.writeFile(token);
+            await handle.close();
+            return async () => {
+                await releaseLock(lockPath, token);
+            };
+        }
+        catch (error) {
+            if (!isFileError(error, 'EEXIST'))
+                throw error;
+            if (!seen) {
+                seen = true;
+                await takeStaleLock(lockPath, timing);
+            }
+            if (Date.now() > deadline) {
+                throw new Error(`the approval store is locked by another writer: ${lockPath}`);
+            }
+            await sleep(LOCK_RETRY_MS);
+        }
+    }
+}
+/**
+ * A stale lock is taken over, once.
+ *
+ * The taking over is exclusive: exactly one waiter may take a stale lock
+ * over. The one that does not win waits and then fails cleanly, because
+ * two approvals out of one stale lock is one approval too many.
+ */
+async function takeStaleLock(lockPath, timing) {
+    if (!(await isStale(lockPath, timing)))
+        return;
+    if (await reclaimStaleLock(lockPath, timing))
+        return;
+    throw new Error(`the approval store is locked by another writer: ${lockPath}`);
+}
+/**
+ * The lock is given back.
+ *
+ * The lock is moved to a private path with a rename, which is one atomic
+ * step, and the token is read there: a lock that was taken away from this
+ * writer and given to another one is not removed by mistake, and the lock
+ * of the other writer is put back.
+ */
+export async function releaseLock(lockPath, token) {
+    const privatePath = `${lockPath}.release.${token}`;
+    try {
+        await rename(lockPath, privatePath);
+    }
+    catch (error) {
+        if (isFileError(error, 'ENOENT'))
+            return;
+        throw error;
+    }
+    let content;
+    try {
+        content = await readFile(privatePath, 'utf8');
+    }
+    catch (error) {
+        if (isFileError(error, 'ENOENT'))
+            return;
+        throw error;
+    }
+    if (content !== token) {
+        // The lock is not this writer's: it goes back where it was.
+        await restoreLock(privatePath, lockPath);
+        return;
+    }
+    await rm(privatePath, { force: true });
+}
+/**
+ * A lock that was moved aside goes back where it was.
+ *
+ * It is not put over a lock that is held now: the writer that holds that
+ * one would lose it. The link is one atomic step, so a lock that is taken
+ * in the window between the move and the restore is not lost either.
+ */
+export async function restoreLock(privatePath, lockPath) {
+    try {
+        await link(privatePath, lockPath);
+    }
+    catch (error) {
+        // A lock that is held now is not overwritten, and a lock that is
+        // gone cannot be restored.
+        if (isFileError(error, 'EEXIST') || isFileError(error, 'ENOENT'))
+            return;
+        throw error;
+    }
+    await rm(privatePath, { force: true });
+}
+/**
+ * Whether a lock is old enough to be presumed abandoned.
+ */
+async function isStale(path, timing) {
+    try {
+        const stats = await stat(path);
+        return Date.now() - stats.mtimeMs > timing.staleMs;
+    }
+    catch (error) {
+        if (isFileError(error, 'ENOENT'))
+            return true;
+        throw error;
+    }
+}
+/**
+ * A file that outlived its writer is removed.
+ *
+ * It answers whether the file was there to be removed.
+ */
+async function removeIfStale(path, timing) {
+    if (!(await isStale(path, timing)))
+        return false;
+    await rm(path, { force: true });
+    return true;
+}
+/**
+ * A stale lock is taken over.
+ *
+ * The taking over is exclusive: a second file says who is taking it
+ * over, so two waiters do not move the lock at the same time. The
+ * staleness is checked again under it, so a lock that a live writer took
+ * in the meantime is left alone, and the lock is moved aside with a
+ * rename, which is one atomic step: only one waiter moves it.
+ *
+ * It answers whether this waiter took the lock over: the one that does
+ * not goes on to wait, and then fails.
+ */
+async function reclaimStaleLock(lockPath, timing) {
+    const reclaimPath = `${lockPath}.reclaim`;
+    let handle;
+    try {
+        handle = await open(reclaimPath, 'wx');
+    }
+    catch (error) {
+        if (isFileError(error, 'EEXIST')) {
+            // An orphan reclaim file blocks every later reclaim, so it is
+            // removed when it is old enough to be one, and the reclaim is tried
+            // again.
+            if (!(await removeIfStale(reclaimPath, timing)))
+                return false;
+            return reclaimStaleLock(lockPath, timing);
+        }
+        throw error;
+    }
+    try {
+        if (!(await isStale(lockPath, timing)))
+            return false;
+        const aside = `${lockPath}.stale`;
+        await rm(aside, { force: true });
+        try {
+            await rename(lockPath, aside);
+        }
+        catch (error) {
+            if (isFileError(error, 'ENOENT'))
+                return false;
+            throw error;
+        }
+        await rm(aside, { force: true });
+        return true;
+    }
+    finally {
+        await handle.close();
+        await rm(reclaimPath, { force: true });
+    }
+}
+/**
+ * The grants, without the ones that have run out.
+ *
+ * A file that is not there yet is no grants. A file that cannot be read,
+ * or that holds something else, is an error: the error travels to the
+ * caller, so a grant is never granted on top of a file that was not
+ * understood.
+ */
+async function loadGrants(path, now) {
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (isFileError(error, 'ENOENT'))
+            return { entries: [], pruned: false };
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`the approval store at ${path} does not hold JSON`, { cause: error });
+    }
+    const result = GrantsSchema.safeParse(parsed);
+    if (!result.success) {
+        throw new Error(`the approval store at ${path} does not hold a list of grants`);
+    }
+    const entries = result.data.filter((entry) => entry.expiresAt > now);
+    return { entries, pruned: entries.length !== result.data.length };
+}
+/**
+ * The grants, written down.
+ *
+ * The directory is made first: the file is the first thing in the state
+ * root of a fresh project, and a write that fails on a missing directory
+ * is a grant nobody can give.
+ */
+async function saveGrants(path, entries) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(entries, null, 2)}\n`, 'utf8');
+}
+/**
+ * The store of grants for one project.
+ */
+export function createApprovalStore(stateRoot, timing = {}) {
+    const path = approvalsPath(stateRoot);
+    const resolved = {
+        timeoutMs: timing.timeoutMs ?? LOCK_TIMEOUT_MS,
+        staleMs: timing.staleMs ?? STALE_LOCK_MS,
+        heartbeatMs: timing.heartbeatMs ?? HEARTBEAT_MS,
+    };
+    return {
+        path,
+        async isApproved(callID, now) {
+            return withLock(path, resolved, async () => {
+                const { entries, pruned } = await loadGrants(path, now);
+                if (pruned)
+                    await saveGrants(path, entries);
+                return entries.some((entry) => entry.callID === callID);
+            });
+        },
+        async approve(callID, now, ttlMs = DEFAULT_APPROVAL_TTL_MS) {
+            return withLock(path, resolved, async () => {
+                // The window has to be a window: a grant that runs out at once is no
+                // grant, and a grant that never runs out is a permanent permission.
+                // The bound lives here, where the grant is written, so a caller that
+                // does not go through the command cannot write one either.
+                if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+                    throw new Error(`the grant would not live for a moment: ${ttlMs}`);
+                }
+                const { entries } = await loadGrants(path, now);
+                const held = entries.find((entry) => entry.callID === callID);
+                // A grant that is already on file keeps the expiry it has: two
+                // people approving the same call do not move the window under each
+                // other, and the caller is told the grant was found.
+                if (held !== undefined)
+                    return { entry: held, created: false };
+                const entry = { callID, expiresAt: now + ttlMs };
+                if (!isRepresentable(entry.expiresAt)) {
+                    throw new Error(`the grant would not run out at a moment a date can name: ${entry.expiresAt}`);
+                }
+                await saveGrants(path, [...entries, entry]);
+                return { entry, created: true };
+            });
+        },
+        async consumeApproval(callID, now, actor) {
+            return withLock(path, resolved, async () => {
+                const { entries, pruned } = await loadGrants(path, now);
+                const held = entries.find((entry) => entry.callID === callID);
+                if (held === undefined) {
+                    if (pruned)
+                        await saveGrants(path, entries);
+                    return false;
+                }
+                await saveGrants(path, entries.filter((entry) => entry.callID !== callID));
+                // The grant is spent, and the trail is part of the spend: a spend
+                // that cannot be written down takes the grant back, so a call is
+                // never approved and not on the record at the same time.
+                try {
+                    await appendAudit(auditPathFor(path), {
+                        policyId: POLICIES.approveUsed.id,
+                        policyVersion: POLICIES.approveUsed.version,
+                        actor: actor ?? 'unknown',
+                        action: 'approve_use',
+                        resource: callID,
+                        effect: 'allow',
+                        detail: 'the grant was spent',
+                    });
+                }
+                catch (error) {
+                    await saveGrants(path, entries);
+                    throw error;
+                }
+                return true;
+            });
+        },
+        async revokeApproval(callID, now) {
+            return withLock(path, resolved, async () => {
+                const { entries } = await loadGrants(path, now);
+                if (!entries.some((entry) => entry.callID === callID))
+                    return false;
+                await saveGrants(path, entries.filter((entry) => entry.callID !== callID));
+                return true;
+            });
+        },
+    };
+}
+/**
+ * The message of an error, when it has one.
+ */
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * The rule handler that asks for an approval.
+ *
+ * A command that matches needs a grant. A pattern is enough for a single
+ * shape, and a matcher is enough for the shapes a pattern cannot say: the
+ * flags of `rm` in any order, for example.
+ *
+ * A store that cannot be read passes nothing: the command is refused, and
+ * the reason names the failure. A refusal is the safe answer, and the
+ * failure is not swallowed: it is in the reason.
+ */
+export function approvalGate(matcher, store, now = Date.now) {
+    return async (event) => {
+        const call = readPreToolCall(event);
+        if (call === undefined || call.command === undefined)
+            return { continue: true };
+        const matches = typeof matcher === 'function' ? matcher(call.command) : matcher.test(call.command);
+        if (!matches)
+            return { continue: true };
+        const callID = call.callID;
+        if (callID !== undefined) {
+            try {
+                // The role is the agent the call was made for, and it is the actor
+                // of the spend: the person who granted it is not the one that used
+                // it.
+                if (await store.consumeApproval(callID, now(), call.role))
+                    return { continue: true };
+            }
+            catch (error) {
+                return {
+                    continue: false,
+                    reason: `The approval store could not be read, so the command is refused. ${describe(error)}`,
+                };
+            }
+        }
+        return {
+            continue: false,
+            reason: `A destructive command needs a person to approve it. The escape hatch is /oa approve <callID>${callID === undefined ? '' : ` (this call is ${callID})`}.`,
+        };
+    };
+}
+//# sourceMappingURL=approvals.js.map

package/dist/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAoB7C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAE1C;;GAEG;AACH,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,WAAW,CAAC;AACjF,CAAC;AAED,4CAA4C;AAC5C,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5E,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,eAAe,GAAG,CAAC,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,YAAY,GAAG,aAAa,GAAG,CAAC,CAAC;AAEvC,iEAAiE;AACjE,MAAM,aAAa,GAAG,CAAC,CAAC;AAmBxB;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AA8BD;;;;;GAKG;AACH,SAAS,YAAY,CAAC,aAAqB;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC;AACpG,CAAC;AAED;;GAEG;AACH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,MAAsB,EACtB,MAAwB;IAExB,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;IAChC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,gEAAgE;QAChE,gDAAgD;QAChD,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAsB;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,IAAI,EAAE;gBAChB,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAsB;IACnE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO;IAC/C,IAAI,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO;IACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,KAAa;IAC/D,MAAM,WAAW,GAAG,GAAG,QAAQ,YAAY,KAAK,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,4DAA4D;QAC5D,MAAM,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,QAAgB;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,2BAA2B;QAC3B,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAsB;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,MAAsB;IAC/D,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAsB;IACtE,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;IAC1C,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjC,8DAA8D;YAC9D,oEAAoE;YACpE,SAAS;YACT,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9D,OAAO,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,QAAQ,QAAQ,CAAC;QAClC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,GAAW;IAEX,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qBAAqB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,iCAAiC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAwB;IAC9D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,SAAyB,EAAE;IAChF,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAmB;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,eAAe;QAC9C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,aAAa;QACxC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY;KAChD,CAAC;IACF,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,GAAW;YAC1C,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACzC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACxD,IAAI,MAAM;oBAAE,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,GAAW,EAAE,KAAK,GAAG,uBAAuB;YACxE,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACzC,qEAAqE;gBACrE,oEAAoE;gBACpE,qEAAqE;gBACrE,2DAA2D;gBAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBAC9D,+DAA+D;gBAC/D,mEAAmE;gBACnE,qDAAqD;gBACrD,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAC/D,MAAM,KAAK,GAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,EAAE,CAAC;gBAChE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,KAAK,CACb,4DAA4D,KAAK,CAAC,SAAS,EAAE,CAC9E,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,GAAW,EAAE,KAAc;YAC/D,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACzC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,IAAI,MAAM;wBAAE,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC5C,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,UAAU,CACd,IAAI,EACJ,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CACnD,CAAC;gBACF,kEAAkE;gBAClE,iEAAiE;gBACjE,yDAAyD;gBACzD,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE;wBACpC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE;wBACjC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO;wBAC3C,KAAK,EAAE,KAAK,IAAI,SAAS;wBACzB,MAAM,EAAE,aAAa;wBACrB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,qBAAqB;qBAC9B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAChC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,GAAW;YAC9C,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACzC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACpE,MAAM,UAAU,CACd,IAAI,EACJ,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CACnD,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAgD,EAChD,KAAoB,EACpB,MAAoB,IAAI,CAAC,GAAG;IAE5B,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChF,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,mEAAmE;gBACnE,mEAAmE;gBACnE,MAAM;gBACN,IAAI,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,oEAAoE,QAAQ,CAAC,KAAK,CAAC,EAAE;iBAC9F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,+FACN,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,MAAM,GACtD,GAAG;SACJ,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/approvals.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=approvals.test.d.ts.map

package/dist/approvals.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.test.d.ts","sourceRoot":"","sources":["../src/approvals.test.ts"],"names":[],"mappings":""}