@voltro/plugin-gm 0.0.0-stage → 0.88.0

package/dist/rpc.d.ts

@@ -0,0 +1,103 @@
+import { ActionProcedureDescriptor } from '@voltro/protocol';
+import { PluginRpcClientDescriptor } from '@voltro/protocol';
+import { QueryProcedureDescriptor } from '@voltro/protocol';
+import { Schema } from 'effect';
+import { YieldableError } from 'effect/Cause';
+
+export declare const actionsDescriptor: QueryProcedureDescriptor<"gm.actions", Schema.Struct<{}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly title: Schema.String;
+    readonly risk: Schema.Literals<readonly ["routine", "sensitive"]>;
+    readonly input: Schema.Unknown;
+}>>, typeof GmError>;
+
+export declare const approveDescriptor: ActionProcedureDescriptor<"gm.approve", Schema.Struct<{
+    readonly id: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly id: Schema.String;
+    readonly actionId: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "approved", "executed", "rejected"]>;
+    readonly targetId: Schema.NullOr<Schema.String>;
+    readonly input: Schema.Unknown;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly reason: Schema.String;
+    readonly ticket: Schema.NullOr<Schema.String>;
+    readonly requesterId: Schema.NullOr<Schema.String>;
+    readonly approverId: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.Number;
+    readonly decidedAt: Schema.NullOr<Schema.Number>;
+    readonly executedAt: Schema.NullOr<Schema.Number>;
+}>, typeof GmError>;
+
+export declare const BASE_NAME = "@voltro/plugin-gm";
+
+export declare const executeDescriptor: ActionProcedureDescriptor<"gm.execute", Schema.Struct<{
+    readonly requestId: Schema.NonEmptyString;
+    readonly actionId: Schema.NonEmptyString;
+    readonly input: Schema.Unknown;
+    readonly reason: Schema.NonEmptyString;
+    readonly ticket: Schema.optional<Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    readonly id: Schema.String;
+    readonly actionId: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "approved", "executed", "rejected"]>;
+    readonly targetId: Schema.NullOr<Schema.String>;
+    readonly input: Schema.Unknown;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly reason: Schema.String;
+    readonly ticket: Schema.NullOr<Schema.String>;
+    readonly requesterId: Schema.NullOr<Schema.String>;
+    readonly approverId: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.Number;
+    readonly decidedAt: Schema.NullOr<Schema.Number>;
+    readonly executedAt: Schema.NullOr<Schema.Number>;
+}>, typeof GmError>;
+
+/** `action_failed` carries the owning plugin's own error code (`insufficient_funds`, `conflict`, …) in `actionCode`. */
+declare class GmError extends GmError_base {
+}
+
+declare const GmError_base: Schema.Class<GmError, Schema.TaggedStruct<"GmError", {
+    readonly code: Schema.Literals<readonly ["identity_required", "invalid_input", "forbidden", "not_found", "conflict", "unavailable", "action_failed"]>;
+    readonly actionCode: Schema.optional<Schema.String>;
+}>, YieldableError>;
+
+export declare const gmRpcClientImports: ReadonlyArray<PluginRpcClientDescriptor>;
+
+export declare const rejectDescriptor: ActionProcedureDescriptor<"gm.reject", Schema.Struct<{
+    readonly id: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly id: Schema.String;
+    readonly actionId: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "approved", "executed", "rejected"]>;
+    readonly targetId: Schema.NullOr<Schema.String>;
+    readonly input: Schema.Unknown;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly reason: Schema.String;
+    readonly ticket: Schema.NullOr<Schema.String>;
+    readonly requesterId: Schema.NullOr<Schema.String>;
+    readonly approverId: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.Number;
+    readonly decidedAt: Schema.NullOr<Schema.Number>;
+    readonly executedAt: Schema.NullOr<Schema.Number>;
+}>, typeof GmError>;
+
+export declare const requestsDescriptor: QueryProcedureDescriptor<"gm.requests", Schema.Struct<{
+    readonly state: Schema.optional<Schema.Literals<readonly ["pending", "approved", "executed", "rejected"]>>;
+}>, Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly actionId: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "approved", "executed", "rejected"]>;
+    readonly targetId: Schema.NullOr<Schema.String>;
+    readonly input: Schema.Unknown;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly reason: Schema.String;
+    readonly ticket: Schema.NullOr<Schema.String>;
+    readonly requesterId: Schema.NullOr<Schema.String>;
+    readonly approverId: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.Number;
+    readonly decidedAt: Schema.NullOr<Schema.Number>;
+    readonly executedAt: Schema.NullOr<Schema.Number>;
+}>>, typeof GmError>;
+
+export { }

package/dist/rpc.js

@@ -0,0 +1,62 @@
+import { GmError as e } from "./errors.js";
+import { GmActionInfoSchema as t, GmRequestSchema as n, REQUESTS_TABLE as r, REQUEST_STATES as i } from "./contract.js";
+import { Schema as a } from "effect";
+import { defineAction as o, defineQuery as s } from "@voltro/protocol";
+// src/rpc.ts
+var c = "@voltro/plugin-gm", l = "Staff user or service account in an exact tenant. Each action requires its gm scope (or the configured authorize policy); approvals require the approver scope and a different person.", u = a.NonEmptyString, d = s({
+	name: "gm.actions",
+	input: a.Struct({}),
+	output: a.Array(t),
+	error: e,
+	openAccess: l
+}), f = s({
+	name: "gm.requests",
+	input: a.Struct({ state: a.optional(a.Literals(i)) }),
+	output: a.Array(n),
+	source: [r],
+	error: e,
+	openAccess: l
+}), p = o({
+	name: "gm.execute",
+	input: a.Struct({
+		requestId: u,
+		actionId: u,
+		input: a.Unknown,
+		reason: u,
+		ticket: a.optional(u)
+	}),
+	output: n,
+	error: e,
+	openAccess: l
+}), m = o({
+	name: "gm.approve",
+	input: a.Struct({ id: u }),
+	output: n,
+	error: e,
+	openAccess: l
+}), h = o({
+	name: "gm.reject",
+	input: a.Struct({ id: u }),
+	output: n,
+	error: e,
+	openAccess: l
+}), g = [...[
+	"execute",
+	"approve",
+	"reject"
+].map((e) => ({
+	tag: "gm." + e,
+	kind: "action",
+	import: {
+		module: "@voltro/plugin-gm/rpc",
+		name: e + "Descriptor"
+	}
+})), ...["actions", "requests"].map((e) => ({
+	tag: "gm." + e,
+	kind: "query",
+	import: {
+		module: "@voltro/plugin-gm/rpc",
+		name: e + "Descriptor"
+	}
+}))];
+export { c as BASE_NAME, d as actionsDescriptor, m as approveDescriptor, p as executeDescriptor, g as gmRpcClientImports, h as rejectDescriptor, f as requestsDescriptor };

package/dist/service.js

@@ -0,0 +1,257 @@
+import { GmError as e, gmError as t } from "./errors.js";
+import { ACTION_RISKS as n, GmRequestSchema as r, REQUEST_STATES as i } from "./contract.js";
+import { gmRequestsTable as a } from "./entities.js";
+import { Effect as o, Result as s, Schema as c, SchemaAST as l } from "effect";
+import { and as u, eq as d, or as f, queryFor as p } from "@voltro/database";
+import { createHash as m } from "node:crypto";
+import { effectiveScopes as h, jsonSchemaOf as g } from "@voltro/protocol";
+// src/service.ts
+var _ = /^[a-z][A-Za-z0-9]*(?:\.[a-z][A-Za-z0-9]*)*$/, v = /^[A-Za-z0-9][A-Za-z0-9:._*-]{0,127}$/, y = (e, t, n) => {
+	let r = e === void 0 ? t : e;
+	if (typeof r != "number" || !Number.isSafeInteger(r) || r < 1 || r > n) throw TypeError("Invalid GM option");
+	return r;
+}, b = (e, t) => e.scopes.some((e) => e === "admin:full" || e === "gm:*" || e === "gm:" + t.id || e.startsWith("gm:") && e.endsWith(".*") && e.length > 5 && t.id.startsWith(e.slice(3, -1))), x = ({ action: e }) => e.risk === "sensitive", S = (e) => {
+	if (!e || !Array.isArray(e.actions)) throw TypeError("gmPlugin requires an actions list");
+	let t = /* @__PURE__ */ new Map();
+	for (let r of e.actions) {
+		if (!r || typeof r.id != "string" || !_.test(r.id) || r.id.length > 128) throw TypeError("Invalid GM action id");
+		if (t.has(r.id)) throw TypeError("Duplicate GM action " + r.id);
+		if (typeof r.title != "string" || !r.title.trim() || !n.includes(r.risk) || typeof r.execute != "function" || !c.isSchema(r.input) || !c.isSchema(r.output) || r.target !== void 0 && typeof r.target != "function") throw TypeError("Invalid GM action " + r.id);
+		let e = c.toEncoded(r.input);
+		if (!l.isObjects(e.ast)) throw TypeError("GM action " + r.id + " input must encode to an object");
+		let i = g(e);
+		t.set(r.id, Object.freeze({
+			action: r,
+			summary: Object.freeze({
+				id: r.id,
+				title: r.title,
+				risk: r.risk
+			}),
+			schema: i
+		}));
+	}
+	let r = e.approval === void 0 ? null : {
+		when: e.approval.when ?? x,
+		approverScope: e.approval.approverScope ?? "gm:approve"
+	};
+	if (r && (typeof r.when != "function" || !v.test(r.approverScope))) throw TypeError("Invalid GM approval policy");
+	if (e.authorize !== void 0 && typeof e.authorize != "function") throw TypeError("Invalid GM authorize policy");
+	return Object.freeze({
+		actions: t,
+		authorize: e.authorize ?? b,
+		approval: r,
+		now: e.now ?? Date.now,
+		pageSize: y(e.pageSize, 100, 1e3),
+		maxExportRows: y(e.maxExportRows, 1e4, 1e5)
+	});
+}, C = (e) => m("sha256").update(JSON.stringify(e)).digest("hex"), w = (n) => n instanceof e ? n : t("unavailable"), T = (e) => o.tryPromise({
+	try: e,
+	catch: w
+}), E = (e, n = 256) => {
+	if (typeof e != "string" || !e.trim() || e.length > n || e.includes("\0")) throw t("invalid_input");
+	return e;
+}, D = (e, n) => {
+	if (typeof e != "string" || !e.trim() || e.length > n || e.includes("\0")) throw t("invalid_input");
+	return e;
+}, O = (e) => {
+	let n = e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : typeof e == "number" ? e : NaN;
+	if (!Number.isSafeInteger(n) || n < 0) throw t("unavailable");
+	return n;
+}, k = (e) => e == null ? null : O(e), A = (e) => typeof e == "string" ? e : null, j = (e) => typeof e == "object" && !!e && !Array.isArray(e), M = (e) => typeof e == "string" && /^[A-Z][A-Za-z0-9]{0,62}$/.test(e) ? e.replace(/(?<!^)([A-Z])/g, "_$1").toLowerCase() : void 0, N = (e) => {
+	let n = typeof e == "object" && e ? e : {}, r = typeof n.code == "string" && /^[a-z][a-z0-9_]{0,63}$/.test(n.code) ? n.code : M(n._tag);
+	return t("action_failed", r);
+}, P = (e) => {
+	if (e.type === "anonymous" || e.tenantId === null) throw t("identity_required");
+	if (e.type !== "user" && e.type !== "serviceAccount" || e.type === "user" && e.kind === "guest") throw t("forbidden");
+	return Object.freeze({
+		type: e.type,
+		id: E(e.id),
+		tenantId: E(e.tenantId),
+		scopes: Object.freeze([...h(e) ?? []].filter((e) => typeof e == "string"))
+	});
+}, F = (e) => {
+	let t = e.output, n = e.input;
+	return c.decodeUnknownSync(r)({
+		id: e.id,
+		actionId: e.actionId,
+		state: e.state,
+		targetId: A(e.targetId),
+		input: j(n) ? n : {},
+		output: j(t) && "value" in t ? t.value : null,
+		reason: e.reason ?? "",
+		ticket: A(e.ticket),
+		requesterId: A(e.requesterId),
+		approverId: A(e.approverId),
+		createdAt: O(e.createdAt),
+		decidedAt: k(e.decidedAt),
+		executedAt: k(e.executedAt)
+	});
+}, I = (e, n) => {
+	let r = a.tableName, l = () => {
+		let e = n.now();
+		if (!Number.isSafeInteger(e) || e < 0) throw t("unavailable");
+		return e;
+	}, m = (e) => {
+		try {
+			return e() === !0;
+		} catch {
+			throw t("unavailable");
+		}
+	}, h = (e, t) => m(() => n.authorize(e, t.summary)), g = (e) => n.approval !== null && e.scopes.some((e) => e === "admin:full" || e === n.approval.approverScope), _ = (e, r = "not_found") => {
+		let i = typeof e == "string" ? n.actions.get(e) : void 0;
+		if (!i) throw t(r);
+		return i;
+	}, v = (t, n) => e.query(p(a).where(t).orderBy("createdAt", "desc").orderBy("id", "asc").limit(n).descriptor), y = async (n, r) => {
+		let i = (await e.query(p(a).where(d("id", E(r))).limit(1).descriptor))[0];
+		if (!i || i.tenantId !== n) throw t("not_found");
+		return i;
+	}, b = async (n) => {
+		let i = _(n.actionId, "unavailable"), a = c.decodeUnknownResult(i.action.input)(n.input);
+		if (s.isFailure(a) || typeof n.requesterId != "string" || typeof n.id != "string") throw t("unavailable");
+		let f = Object.freeze({
+			tenantId: String(n.tenantId),
+			requestId: "gm-" + n.id.slice(6),
+			requesterId: n.requesterId,
+			approverId: A(n.approverId),
+			reason: String(n.reason),
+			ticket: A(n.ticket)
+		}), p = await o.runPromise(o.result(o.suspend(() => i.action.execute(a.success, f)).pipe(o.mapError(N), o.catchDefect(() => o.fail(t("unavailable"))))));
+		if (s.isFailure(p)) throw p.failure;
+		let m = c.encodeResult(i.action.output)(p.success);
+		if (s.isFailure(m)) throw t("unavailable");
+		return await e.updateMany(r, {
+			state: "executed",
+			output: { value: m.success },
+			executedAt: new Date(l())
+		}, { where: u(d("id", n.id), d("state", "approved")) }), F(await y(String(n.tenantId), n.id));
+	}, x = {
+		actions: (e) => T(async () => {
+			let t = P(e);
+			return [...n.actions.values()].filter((e) => h(t, e)).map((e) => ({
+				...e.summary,
+				input: e.schema
+			}));
+		}),
+		requests: (e, r) => T(async () => {
+			let a = P(e), o = r.state;
+			if (o !== void 0 && !i.includes(o)) throw t("invalid_input");
+			return (await v(o === void 0 ? d("tenantId", a.tenantId) : u(d("tenantId", a.tenantId), d("state", o)), n.pageSize)).filter((e) => e.tenantId === a.tenantId && (e.requesterId === a.id || g(a) || n.actions.has(String(e.actionId)) && h(a, _(e.actionId)))).map(F);
+		}),
+		execute: (i, a) => T(async () => {
+			let o = P(i), u = structuredClone(a);
+			if (!j(u)) throw t("invalid_input");
+			let d = E(u.requestId, 128), f = _(u.actionId);
+			if (!h(o, f)) throw t("forbidden");
+			let p = D(u.reason, 2e3), g = u.ticket === void 0 ? null : E(u.ticket, 256), v = c.decodeUnknownResult(f.action.input)(u.input);
+			if (s.isFailure(v)) throw t("invalid_input");
+			let x = c.encodeResult(f.action.input)(v.success);
+			if (s.isFailure(x) || !j(x.success)) throw t("invalid_input");
+			let S = JSON.parse(JSON.stringify(x.success)), w = f.action.target === void 0 ? null : (() => {
+				try {
+					let e = f.action.target(v.success);
+					return e === null ? null : E(e);
+				} catch {
+					throw t("invalid_input");
+				}
+			})(), T = n.approval !== null && m(() => n.approval.when({
+				action: f.summary,
+				input: v.success,
+				actor: o
+			})), O = "gmreq_" + C([
+				o.tenantId,
+				o.id,
+				d
+			]).slice(0, 54), k = C([
+				f.action.id,
+				S,
+				p,
+				g
+			]);
+			await e.insertIgnore(r, {
+				id: O,
+				tenantId: o.tenantId,
+				actionId: f.action.id,
+				state: T ? "pending" : "approved",
+				targetId: w,
+				input: S,
+				output: null,
+				reason: p,
+				ticket: g,
+				requesterId: o.id,
+				approverId: null,
+				digest: k,
+				createdAt: new Date(l()),
+				decidedAt: null,
+				executedAt: null
+			}, { conflictColumns: ["id"] });
+			let A = await y(o.tenantId, O);
+			if (A.requesterId !== o.id || A.digest !== k) throw t("conflict");
+			return A.state === "approved" ? b(A) : F(A);
+		}),
+		approve: (n, i) => T(async () => {
+			let a = P(n);
+			if (!g(a)) throw t("forbidden");
+			let o = await y(a.tenantId, i);
+			if (o.requesterId === a.id) throw t("forbidden");
+			if (o.state === "pending" && (await e.updateMany(r, {
+				state: "approved",
+				approverId: a.id,
+				decidedAt: new Date(l())
+			}, { where: u(d("id", o.id), d("state", "pending")) }), o = await y(a.tenantId, i)), o.state === "approved") return b(o);
+			if (o.state === "executed") return F(o);
+			throw t("conflict");
+		}),
+		reject: (n, i) => T(async () => {
+			let a = P(n), o = await y(a.tenantId, i);
+			if (!g(a) && o.requesterId !== a.id) throw t("forbidden");
+			o.state === "pending" && await e.updateMany(r, {
+				state: "rejected",
+				approverId: a.id,
+				decidedAt: new Date(l())
+			}, { where: u(d("id", o.id), d("state", "pending")) });
+			let s = await y(a.tenantId, i);
+			if (s.state !== "rejected") throw t("conflict");
+			return F(s);
+		})
+	}, S = (e, r) => {
+		if (r.tenantId === null) throw t("identity_required");
+		let i = E(r.tenantId), o = E(r.subjectId);
+		return e.query(p(a).where(u(d("tenantId", i), f(d("requesterId", o), d("approverId", o), d("targetId", o)))).orderBy("id", "asc").limit(n.maxExportRows + 1).descriptor);
+	};
+	return {
+		api: x,
+		exportSubject: (r) => T(async () => {
+			let i = await S(e, r);
+			if (i.length > n.maxExportRows) throw t("unavailable");
+			return i.map(F);
+		}),
+		eraseSubject: (n) => T(async () => {
+			for (let t = 0; t < 100; t++) if (await e.transactional(async (e) => {
+				let t = await S(e, n);
+				if (t.length === 0) return !0;
+				for (let i of t) {
+					let t = i.targetId === n.subjectId, a = i.requesterId === n.subjectId, o = i.state === "pending" || i.state === "approved";
+					await e.update(r, String(i.id), {
+						...t ? {
+							targetId: null,
+							input: {},
+							output: null,
+							reason: "",
+							ticket: null,
+							digest: ""
+						} : {},
+						...a ? { requesterId: null } : {},
+						...i.approverId === n.subjectId ? { approverId: null } : {},
+						...o && (t || a) ? {
+							state: "rejected",
+							decidedAt: new Date(l())
+						} : {}
+					});
+				}
+				return !1;
+			})) return;
+			throw t("unavailable");
+		})
+	};
+};
+export { I as dataStoreGm, x as defaultGmApprovalWhen, b as defaultGmAuthorize, S as resolveGmOptions, P as staffActor };

package/dist/testing.d.ts

@@ -0,0 +1,206 @@
+import { Effect } from 'effect';
+import { InMemoryDataStore } from '@voltro/runtime';
+import { PluginPrivacyTarget } from '@voltro/protocol';
+import { Schema } from 'effect';
+import { Subject } from '@voltro/protocol';
+import { YieldableError } from 'effect/Cause';
+
+declare const ACTION_RISKS: readonly ["routine", "sensitive"];
+
+declare namespace C {
+    export {
+        REQUESTS_TABLE,
+        REQUEST_STATES,
+        GmRequestState,
+        ACTION_RISKS,
+        GmActionRisk,
+        GmRequestSchema,
+        GmRequest,
+        GmActionInfoSchema,
+        GmActionInfo,
+        GmExecuteInput
+    }
+}
+
+/** The erased shape the plugin stores; build one with `defineGmAction`. */
+declare interface GmAction {
+    readonly id: string;
+    readonly title: string;
+    readonly input: Schema.Codec<unknown, unknown>;
+    readonly output: Schema.Codec<unknown, unknown>;
+    readonly risk: GmActionRisk;
+    readonly target?: ((input: never) => string | null) | undefined;
+    readonly execute: (input: never, ctx: GmActionContext) => Effect.Effect<unknown, unknown>;
+}
+
+/** What an action receives besides its decoded input. `requestId` is stable for the request
+ * (`[A-Za-z0-9-]`, at most 64 characters): pass it to the owning plugin as its idempotency key. */
+declare interface GmActionContext {
+    readonly tenantId: string;
+    readonly requestId: string;
+    readonly requesterId: string;
+    readonly approverId: string | null;
+    readonly reason: string;
+    readonly ticket: string | null;
+}
+
+declare type GmActionInfo = typeof GmActionInfoSchema.Type;
+
+/** One action the caller may run; `input` is the JSON Schema of the encoded input a console renders its form from. */
+declare const GmActionInfoSchema: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly title: Schema.String;
+    readonly risk: Schema.Literals<readonly ["routine", "sensitive"]>;
+    readonly input: Schema.Unknown;
+}>;
+
+declare type GmActionRisk = typeof ACTION_RISKS[number];
+
+declare interface GmActionSummary {
+    readonly id: string;
+    readonly title: string;
+    readonly risk: C.GmActionRisk;
+}
+
+/** The staff caller as the policies see it: resolved scopes, never a credential claim. */
+declare interface GmActor {
+    readonly type: 'user' | 'serviceAccount';
+    readonly id: string;
+    readonly tenantId: string;
+    readonly scopes: ReadonlyArray<string>;
+}
+
+declare interface GmApi {
+    readonly actions: (subject: Subject) => Effect.Effect<ReadonlyArray<C.GmActionInfo>, GmError>;
+    readonly requests: (subject: Subject, input: {
+        readonly state?: C.GmRequestState | undefined;
+    }) => Effect.Effect<ReadonlyArray<C.GmRequest>, GmError>;
+    readonly execute: (subject: Subject, input: C.GmExecuteInput) => Effect.Effect<C.GmRequest, GmError>;
+    readonly approve: (subject: Subject, id: string) => Effect.Effect<C.GmRequest, GmError>;
+    readonly reject: (subject: Subject, id: string) => Effect.Effect<C.GmRequest, GmError>;
+}
+
+declare interface GmApprovalPolicy {
+    /** Which requests wait for a second person. Default: actions whose risk is `sensitive`. */
+    readonly when?: (request: {
+        readonly action: GmActionSummary;
+        readonly input: unknown;
+        readonly actor: GmActor;
+    }) => boolean;
+    /** Scope an approver holds (`admin:full` also approves). Default `gm:approve`. */
+    readonly approverScope?: string;
+}
+
+/** Default `sensitive` rule versus a configured `approval.when`. */
+export declare const gmApprovalSlotFixture: {
+    kind: "slot";
+    defaultImplementation: ({ action }: {
+        readonly action: GmActionSummary;
+    }) => boolean;
+    defaultProbe: {
+        run: () => Effect.Effect<"rejected" | "pending" | "approved" | "executed", GmError, never>;
+        expected: string;
+    };
+    overrideProbe: {
+        run: () => Effect.Effect<"rejected" | "pending" | "approved" | "executed", GmError, never>;
+        expected: string;
+    };
+};
+
+/** Default scope rule versus a configured `authorize`. */
+export declare const gmAuthorizeSlotFixture: {
+    kind: "slot";
+    defaultImplementation: (actor: GmActor, action: GmActionSummary) => boolean;
+    defaultProbe: {
+        run: () => Effect.Effect<string[], GmError, never>;
+        expected: string[];
+    };
+    overrideProbe: {
+        run: () => Effect.Effect<string[], GmError, never>;
+        expected: never[];
+    };
+};
+
+/** `action_failed` carries the owning plugin's own error code (`insufficient_funds`, `conflict`, …) in `actionCode`. */
+declare class GmError extends GmError_base {
+}
+
+declare const GmError_base: Schema.Class<GmError, Schema.TaggedStruct<"GmError", {
+    readonly code: Schema.Literals<readonly ["identity_required", "invalid_input", "forbidden", "not_found", "conflict", "unavailable", "action_failed"]>;
+    readonly actionCode: Schema.optional<Schema.String>;
+}>, YieldableError>;
+
+declare interface GmExecuteInput {
+    readonly requestId: string;
+    readonly actionId: string;
+    readonly input: unknown;
+    readonly reason: string;
+    readonly ticket?: string | undefined;
+}
+
+/** A fresh in-memory GM adapter over the actual request table. */
+export declare const gmFixture: (options: Omit<GmOptions, "now"> & {
+    readonly now?: () => number;
+}) => {
+    store: InMemoryDataStore;
+    gm: {
+        api: GmApi;
+        exportSubject: (target: PluginPrivacyTarget) => Effect.Effect<{
+            readonly id: string;
+            readonly actionId: string;
+            readonly state: "rejected" | "pending" | "approved" | "executed";
+            readonly targetId: string | null;
+            readonly input: unknown;
+            readonly output: unknown;
+            readonly reason: string;
+            readonly ticket: string | null;
+            readonly requesterId: string | null;
+            readonly approverId: string | null;
+            readonly createdAt: number;
+            readonly decidedAt: number | null;
+            readonly executedAt: number | null;
+        }[], GmError, never>;
+        eraseSubject: (target: PluginPrivacyTarget) => Effect.Effect<void, GmError, never>;
+    };
+};
+
+declare interface GmOptions {
+    readonly actions: ReadonlyArray<GmAction>;
+    /** Replaces the default rule: `gm:<id>`, `gm:<namespace>.*`, `gm:*` or `admin:full`. */
+    readonly authorize?: (actor: GmActor, action: GmActionSummary) => boolean;
+    /** Omitted: every authorized request runs at once. */
+    readonly approval?: GmApprovalPolicy;
+    readonly now?: () => number;
+    readonly pageSize?: number;
+    readonly maxExportRows?: number;
+}
+
+/** A side-effect-free action for fixtures and probes. */
+export declare const gmProbeAction: (risk?: "routine" | "sensitive") => GmAction;
+
+declare type GmRequest = typeof GmRequestSchema.Type;
+
+declare const GmRequestSchema: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly actionId: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "approved", "executed", "rejected"]>;
+    readonly targetId: Schema.NullOr<Schema.String>;
+    readonly input: Schema.Unknown;
+    readonly output: Schema.NullOr<Schema.Unknown>;
+    readonly reason: Schema.String;
+    readonly ticket: Schema.NullOr<Schema.String>;
+    readonly requesterId: Schema.NullOr<Schema.String>;
+    readonly approverId: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.Number;
+    readonly decidedAt: Schema.NullOr<Schema.Number>;
+    readonly executedAt: Schema.NullOr<Schema.Number>;
+}>;
+
+declare type GmRequestState = typeof REQUEST_STATES[number];
+
+/** pending: waits for a second person. approved: may run (retries re-run the idempotent action). executed and rejected are terminal. */
+declare const REQUEST_STATES: readonly ["pending", "approved", "executed", "rejected"];
+
+declare const REQUESTS_TABLE = "_voltro_gm_requests";
+
+export { }