@yiaany/ghostapi 0.1.9 → 0.2.1

package/dist/approvals/approvalInbox.js

@@ -1,11 +1,10 @@
 import { createHash, randomUUID } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
-import { actionApprovalHash, actionHash, createLocalActionGateway, createSyntheticActionAdapter, validateActionApproval, validateActionEnvelope } from "../actions/index.js";
+import { actionApprovalHash, actionHash, createLocalActionGateway, createSyntheticActionAdapter, validateActionApproval, validateActionEnvelope, } from "../actions/index.js";
 import { getDataPaths } from "../config/dataPaths.js";
 import { sanitizeSecretString } from "../security/secrets.js";
-import { atomicWriteJson, ensurePrivateDirectory, withFileLock } from "../storage/fileStore.js";
-const SCHEMA_VERSION = 1;
+import { atomicWriteJson, ensurePrivateDirectory, withFileLock, } from "../storage/fileStore.js";
 const MAX_STORE_BYTES = 1024 * 1024;
 const MAX_REQUESTS = 1_000;
 const MAX_DECISIONS = 4;
@@ -13,7 +12,10 @@ const MAX_AUDIT = 10_000;
 const IDENTIFIER = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 const HASH = /^[a-f0-9]{64}$/;
 export class ApprovalInboxError extends Error {
-    constructor(message) { super(message); this.name = "ApprovalInboxError"; }
+    constructor(message) {
+        super(message);
+        this.name = "ApprovalInboxError";
+    }
 }
 export function createLocalApprovalInbox(options) {
     return new LocalApprovalInbox(options);
@@ -40,13 +42,24 @@ export class LocalApprovalInbox {
                 const approval = validateActionApproval(approvalValue);
                 const state = await this.read();
                 const request = state.requests.find((candidate) => candidate.id === approval.approvalId);
-                const active = request?.status === "executing" || (request?.status === "executed" && request.executionReceiptHash !== undefined);
-                if (request === undefined || !active || request.consumedAt === undefined || request.artifact === undefined || request.actionHash !== actionHash(action) || actionApprovalHash(request.artifact) !== actionApprovalHash(approval))
+                const active = request?.status === "executing" ||
+                    (request?.status === "executed" &&
+                        request.executionReceiptHash !== undefined);
+                if (request === undefined ||
+                    !active ||
+                    request.consumedAt === undefined ||
+                    request.artifact === undefined ||
+                    request.actionHash !== actionHash(action) ||
+                    actionApprovalHash(request.artifact) !== actionApprovalHash(approval))
                     throw new ApprovalInboxError("Approval inbox provenance is not active for execution.");
                 return { ...verified, approvalInboxRequestId: request.id };
-            }
+            },
         };
-        this.actionGateway = createLocalActionGateway({ ...options.actionGatewayOptions, now: this.now, approvalVerifier: inboxVerifier });
+        this.actionGateway = createLocalActionGateway({
+            ...options.actionGatewayOptions,
+            now: this.now,
+            approvalVerifier: inboxVerifier,
+        });
     }
     async request(actionValue, policyValue, contextValue) {
         const action = validateActionEnvelope(actionValue);
@@ -60,7 +73,8 @@ export class LocalApprovalInbox {
         return this.mutate((state, timestamp) => {
             refresh(state, timestamp);
             const actionDigest = actionHash(action);
-            const existing = state.requests.find((request) => request.actionHash === actionDigest && request.status !== "superseded");
+            const existing = state.requests.find((request) => request.actionHash === actionDigest &&
+                request.status !== "superseded");
             if (existing !== undefined)
                 return clone(existing);
             const decision = evaluate(policy, action, context, state.requests, timestamp);
@@ -68,10 +82,23 @@ export class LocalApprovalInbox {
                 throw new ApprovalInboxError(`Approval policy denies this action: ${decision.reasons.join("; ")}`);
             const expiresAt = new Date(Math.min(Date.parse(action.expiresAt), Date.parse(timestamp) + policy.approvalTtlMs)).toISOString();
             const request = {
-                id: identifier(`approval-${randomUUID().replace(/-/g, "")}`, "Approval request id"), action, actionHash: actionDigest, risk: classify(action), context,
-                policy: { id: policy.id, version: policy.version, hash: policyHash(policy), requiredApprovals: decision.requiredApprovals },
-                display: display(action, context, decision.reasons), status: "pending", createdAt: timestamp, expiresAt,
-                escalationAt: new Date(Date.parse(timestamp) + policy.escalationTimeoutMs).toISOString(), decisions: []
+                id: identifier(`approval-${randomUUID().replace(/-/g, "")}`, "Approval request id"),
+                action,
+                actionHash: actionDigest,
+                risk: classify(action),
+                context,
+                policy: {
+                    id: policy.id,
+                    version: policy.version,
+                    hash: policyHash(policy),
+                    requiredApprovals: decision.requiredApprovals,
+                },
+                display: display(action, context, decision.reasons),
+                status: "pending",
+                createdAt: timestamp,
+                expiresAt,
+                escalationAt: new Date(Date.parse(timestamp) + policy.escalationTimeoutMs).toISOString(),
+                decisions: [],
             };
             state.requests.push(request);
             appendAudit(state, "request.created", request, action.actor.id, timestamp);
@@ -86,12 +113,23 @@ export class LocalApprovalInbox {
             const request = findRequest(state, requestId);
             requirePending(request);
             assertIndependent(request, approver);
-            if (request.decisions.some((decision) => decision.kind === "approve" && (decision.approverId === approver.id || decision.principalId === approver.principalId || decision.independenceKey === approver.independenceKey)))
+            if (request.decisions.some((decision) => decision.kind === "approve" &&
+                (decision.approverId === approver.id ||
+                    decision.principalId === approver.principalId ||
+                    decision.independenceKey === approver.independenceKey)))
                 throw new ApprovalInboxError("An independent approver can approve this action only once.");
-            const decision = { id: identifier(`decision-${randomUUID().replace(/-/g, "")}`, "Approval decision id"), kind: "approve", approverId: approver.id, principalId: approver.principalId, independenceKey: approver.independenceKey, decidedAt: now };
+            const decision = {
+                id: identifier(`decision-${randomUUID().replace(/-/g, "")}`, "Approval decision id"),
+                kind: "approve",
+                approverId: approver.id,
+                principalId: approver.principalId,
+                independenceKey: approver.independenceKey,
+                decidedAt: now,
+            };
             request.decisions.push(decision);
             appendAudit(state, "request.approved", request, approver.id, now);
-            if (request.decisions.filter((entry) => entry.kind === "approve").length >= request.policy.requiredApprovals) {
+            if (request.decisions.filter((entry) => entry.kind === "approve").length >=
+                request.policy.requiredApprovals) {
                 request.status = "approved";
                 request.artifact = await createArtifact(request, now, this.approvalSigner);
                 appendAudit(state, "artifact.issued", request, "approval-inbox", now);
@@ -111,7 +149,9 @@ export class LocalApprovalInbox {
         const old = await this.mutate((state, now) => {
             refresh(state, now);
             const request = findRequest(state, requestId);
-            if (request.status === "executing" || request.status === "executed" || request.consumedAt !== undefined)
+            if (request.status === "executing" ||
+                request.status === "executed" ||
+                request.consumedAt !== undefined)
                 throw new ApprovalInboxError("Executed or executing approvals cannot be edited.");
             request.status = "superseded";
             appendAudit(state, "request.superseded", request, approver.id, now);
@@ -134,18 +174,26 @@ export class LocalApprovalInbox {
             const now = this.timestamp();
             refresh(state, now);
             const request = findRequest(state, requestId);
-            if ((request.status !== "approved" && request.status !== "executing" && request.status !== "executed") || request.artifact === undefined)
+            if ((request.status !== "approved" &&
+                request.status !== "executing" &&
+                request.status !== "executed") ||
+                request.artifact === undefined)
                 throw new ApprovalInboxError("Approval is not active for execution.");
-            if (request.policy.id !== policy.id || request.policy.version !== policy.version || request.policy.hash !== policyHash(policy))
+            if (request.policy.id !== policy.id ||
+                request.policy.version !== policy.version ||
+                request.policy.hash !== policyHash(policy))
                 throw new ApprovalInboxError("Approval policy changed after approval.");
             const decision = evaluate(policy, request.action, request.context, state.requests, now, request.id);
-            if (!decision.allowed || decision.requiredApprovals !== request.policy.requiredApprovals)
+            if (!decision.allowed ||
+                decision.requiredApprovals !== request.policy.requiredApprovals)
                 throw new ApprovalInboxError("Current approval policy no longer authorizes execution.");
-            if (identity.actorId !== request.action.actor.id || identity.workloadId !== request.action.actor.workloadId)
+            if (identity.actorId !== request.action.actor.id ||
+                identity.workloadId !== request.action.actor.workloadId)
                 throw new ApprovalInboxError("Execution identity does not match the approved action.");
             if (request.status === "executed") {
                 const receipt = await this.actionGateway.execute(request.action, identity, actionPolicy);
-                if (receipt.status !== "verified" || receipt.receiptHash !== request.executionReceiptHash)
+                if (receipt.status !== "verified" ||
+                    receipt.receiptHash !== request.executionReceiptHash)
                     throw new ApprovalInboxError("Executed approval does not match its durable action receipt.");
                 return receipt;
             }
@@ -185,12 +233,22 @@ export class LocalApprovalInbox {
     }
     async get(requestIdValue) {
         const requestId = identifier(requestIdValue, "Approval request id");
-        return this.mutate((state, now) => { refresh(state, now); return clone(findRequest(state, requestId)); });
+        return this.mutate((state, now) => {
+            refresh(state, now);
+            return clone(findRequest(state, requestId));
+        });
     }
     async list(status) {
-        return this.mutate((state, now) => { refresh(state, now); return state.requests.filter((request) => status === undefined || request.status === status).map(clone); });
+        return this.mutate((state, now) => {
+            refresh(state, now);
+            return state.requests
+                .filter((request) => status === undefined || request.status === status)
+                .map(clone);
+        });
+    }
+    async readStateForTesting() {
+        return this.read();
     }
-    async readStateForTesting() { return this.read(); }
     async decideTerminal(requestIdValue, identity, reasonValue, kind) {
         const approver = await this.approverVerifier.authenticate(identity);
         const requestId = identifier(requestIdValue, "Approval request id");
@@ -198,11 +256,21 @@ export class LocalApprovalInbox {
         return this.mutate((state, now) => {
             refresh(state, now);
             const request = findRequest(state, requestId);
-            if (request.status === "executing" || request.status === "executed" || request.status === "execution_failed")
+            if (request.status === "executing" ||
+                request.status === "executed" ||
+                request.status === "execution_failed")
                 throw new ApprovalInboxError("Execution has already started; approval cannot be revoked.");
             if (request.status !== "pending" && request.status !== "approved")
                 throw new ApprovalInboxError("Approval is not active.");
-            const decision = { id: identifier(`decision-${randomUUID().replace(/-/g, "")}`, "Approval decision id"), kind, approverId: approver.id, principalId: approver.principalId, independenceKey: approver.independenceKey, reason, decidedAt: now };
+            const decision = {
+                id: identifier(`decision-${randomUUID().replace(/-/g, "")}`, "Approval decision id"),
+                kind,
+                approverId: approver.id,
+                principalId: approver.principalId,
+                independenceKey: approver.independenceKey,
+                reason,
+                decidedAt: now,
+            };
             request.decisions.push(decision);
             request.status = kind === "reject" ? "rejected" : "revoked";
             appendAudit(state, kind === "reject" ? "request.rejected" : "request.revoked", request, approver.id, now);
@@ -229,31 +297,67 @@ export class LocalApprovalInbox {
         }
     }
     async mutate(operation) {
-        return withFileLock(this.path, async () => { const state = await this.read(); const result = await operation(state, this.timestamp()); await this.write(state); return result; });
+        return withFileLock(this.path, async () => {
+            const state = await this.read();
+            const result = await operation(state, this.timestamp());
+            await this.write(state);
+            return result;
+        });
+    }
+    async write(state) {
+        await atomicWriteJson(this.path, validateState(state));
     }
-    async write(state) { await atomicWriteJson(this.path, validateState(state)); }
     async latestDurableFailedReceipt(actionId) {
         try {
             const record = await this.actionGateway.inspect(actionId);
-            return [...record.receipts].reverse().find((receipt) => receipt.status === "failed");
+            return [...record.receipts]
+                .reverse()
+                .find((receipt) => receipt.status === "failed");
         }
         catch {
             return undefined;
         }
     }
-    timestamp() { const value = this.now(); if (!(value instanceof Date) || !Number.isFinite(value.getTime()))
-        throw new ApprovalInboxError("Approval inbox clock is invalid."); return value.toISOString(); }
+    timestamp() {
+        const value = this.now();
+        if (!(value instanceof Date) || !Number.isFinite(value.getTime()))
+            throw new ApprovalInboxError("Approval inbox clock is invalid.");
+        return value.toISOString();
+    }
 }
 export function createTestApprovalApproverVerifier() {
     const issued = new WeakSet();
     return {
-        verifier: { async authenticate(identity) { if (identity === null || typeof identity !== "object" || !issued.has(identity))
-                throw new ApprovalInboxError("Approver identity is not authenticated."); return validateApprover(identity); } },
-        issue(input) { const result = Object.freeze(validateApprover({ ...input, principalId: input.principalId ?? input.id })); issued.add(result); return result; }
+        verifier: {
+            async authenticate(identity) {
+                if (identity === null ||
+                    typeof identity !== "object" ||
+                    !issued.has(identity))
+                    throw new ApprovalInboxError("Approver identity is not authenticated.");
+                return validateApprover(identity);
+            },
+        },
+        issue(input) {
+            const result = Object.freeze(validateApprover({
+                ...input,
+                principalId: input.principalId ?? input.id,
+            }));
+            issued.add(result);
+            return result;
+        },
+    };
+}
+export function approvalPolicyHash(value) {
+    return policyHash(validatePolicy(value));
+}
+function emptyState() {
+    return {
+        schemaVersion: 1,
+        requests: [],
+        auditAnchor: sha256("ghostapi.approval.audit.v1"),
+        audit: [],
     };
 }
-export function approvalPolicyHash(value) { return policyHash(validatePolicy(value)); }
-function emptyState() { return { schemaVersion: 1, requests: [], auditAnchor: sha256("ghostapi.approval.audit.v1"), audit: [] }; }
 function validateState(value) {
     const state = object(value, "Approval inbox store must be an object.");
     exactKeys(state, ["schemaVersion", "requests", "auditAnchor", "audit"], "Approval inbox store");
@@ -269,10 +373,28 @@ function validateState(value) {
 }
 function validateRequest(value) {
     const request = object(value, "Approval request is invalid.");
-    exactKeys(request, ["id", "action", "actionHash", "risk", "context", "policy", "display", "status", "createdAt", "expiresAt", "escalationAt", "decisions", "artifact", "consumedAt", "executionReceiptHash", "supersedesRequestId"], "Approval request", ["artifact", "consumedAt", "executionReceiptHash", "supersedesRequestId"]);
+    exactKeys(request, [
+        "id",
+        "action",
+        "actionHash",
+        "risk",
+        "context",
+        "policy",
+        "display",
+        "status",
+        "createdAt",
+        "expiresAt",
+        "escalationAt",
+        "decisions",
+        "artifact",
+        "consumedAt",
+        "executionReceiptHash",
+        "supersedesRequestId",
+    ], "Approval request", ["artifact", "consumedAt", "executionReceiptHash", "supersedesRequestId"]);
     const action = validateActionEnvelope(request.action);
     const actionDigest = hash(request.actionHash, "Approval action hash");
-    if (actionHash(action) !== actionDigest || classify(action) !== risk(request.risk))
+    if (actionHash(action) !== actionDigest ||
+        classify(action) !== risk(request.risk))
         throw new ApprovalInboxError("Approval request action is invalid.");
     const context = validateContext(request.context);
     const policy = policyRecord(request.policy);
@@ -281,41 +403,148 @@ function validateRequest(value) {
     const createdAt = timestamp(request.createdAt, "Approval creation time");
     const expiresAt = timestamp(request.expiresAt, "Approval expiry");
     const escalationAt = timestamp(request.escalationAt, "Approval escalation time");
-    if (!validStatus(request.status) || Date.parse(expiresAt) <= Date.parse(createdAt) || Date.parse(escalationAt) > Date.parse(expiresAt))
+    if (!validStatus(request.status) ||
+        Date.parse(expiresAt) <= Date.parse(createdAt) ||
+        Date.parse(escalationAt) > Date.parse(expiresAt))
         throw new ApprovalInboxError("Approval request lifecycle is invalid.");
-    const artifact = request.artifact === undefined ? undefined : validateArtifact(request.artifact, actionDigest);
-    if ((request.status === "approved" || request.status === "executing" || request.status === "executed" || request.status === "execution_failed") && artifact === undefined)
+    const artifact = request.artifact === undefined
+        ? undefined
+        : validateArtifact(request.artifact, actionDigest);
+    if ((request.status === "approved" ||
+        request.status === "executing" ||
+        request.status === "executed" ||
+        request.status === "execution_failed") &&
+        artifact === undefined)
         throw new ApprovalInboxError("Approved requests require an approval artifact.");
-    const consumedAt = request.consumedAt === undefined ? undefined : timestamp(request.consumedAt, "Approval consumption time");
-    if ((request.status === "executing" || request.status === "executed" || request.status === "execution_failed") && consumedAt === undefined)
+    const consumedAt = request.consumedAt === undefined
+        ? undefined
+        : timestamp(request.consumedAt, "Approval consumption time");
+    if ((request.status === "executing" ||
+        request.status === "executed" ||
+        request.status === "execution_failed") &&
+        consumedAt === undefined)
         throw new ApprovalInboxError("Executed approvals require consumption metadata.");
-    const executionReceiptHash = request.executionReceiptHash === undefined ? undefined : hash(request.executionReceiptHash, "Approval execution receipt hash");
+    const executionReceiptHash = request.executionReceiptHash === undefined
+        ? undefined
+        : hash(request.executionReceiptHash, "Approval execution receipt hash");
     if (request.status === "executed" && executionReceiptHash === undefined)
         throw new ApprovalInboxError("Executed approvals require an action receipt hash.");
-    return { id: identifier(request.id, "Approval request id"), action, actionHash: actionDigest, risk: risk(request.risk), context, policy, display: displayValue, status: request.status, createdAt, expiresAt, escalationAt, decisions, ...(artifact === undefined ? {} : { artifact }), ...(consumedAt === undefined ? {} : { consumedAt }), ...(executionReceiptHash === undefined ? {} : { executionReceiptHash }), ...(request.supersedesRequestId === undefined ? {} : { supersedesRequestId: identifier(request.supersedesRequestId, "Superseded approval request id") }) };
+    return {
+        id: identifier(request.id, "Approval request id"),
+        action,
+        actionHash: actionDigest,
+        risk: risk(request.risk),
+        context,
+        policy,
+        display: displayValue,
+        status: request.status,
+        createdAt,
+        expiresAt,
+        escalationAt,
+        decisions,
+        ...(artifact === undefined ? {} : { artifact }),
+        ...(consumedAt === undefined ? {} : { consumedAt }),
+        ...(executionReceiptHash === undefined ? {} : { executionReceiptHash }),
+        ...(request.supersedesRequestId === undefined
+            ? {}
+            : {
+                supersedesRequestId: identifier(request.supersedesRequestId, "Superseded approval request id"),
+            }),
+    };
 }
 function validateAudit(value) {
     const record = object(value, "Approval audit record is invalid.");
-    exactKeys(record, ["sequence", "event", "requestId", "actionHash", "actionReceiptHash", "actorId", "timestamp", "previousHash", "recordHash"], "Approval audit record", ["actionReceiptHash"]);
-    const base = { sequence: positive(record.sequence, "Approval audit sequence"), event: text(record.event, "Approval audit event", 80), requestId: identifier(record.requestId, "Approval audit request id"), actionHash: hash(record.actionHash, "Approval audit action hash"), ...(record.actionReceiptHash === undefined ? {} : { actionReceiptHash: hash(record.actionReceiptHash, "Approval audit receipt hash") }), actorId: identifier(record.actorId, "Approval audit actor id"), timestamp: timestamp(record.timestamp, "Approval audit timestamp"), previousHash: hash(record.previousHash, "Approval audit previous hash") };
-    if (hash(record.recordHash, "Approval audit record hash") !== sha256(canonical(base)))
+    exactKeys(record, [
+        "sequence",
+        "event",
+        "requestId",
+        "actionHash",
+        "actionReceiptHash",
+        "actorId",
+        "timestamp",
+        "previousHash",
+        "recordHash",
+    ], "Approval audit record", ["actionReceiptHash"]);
+    const base = {
+        sequence: positive(record.sequence, "Approval audit sequence"),
+        event: text(record.event, "Approval audit event", 80),
+        requestId: identifier(record.requestId, "Approval audit request id"),
+        actionHash: hash(record.actionHash, "Approval audit action hash"),
+        ...(record.actionReceiptHash === undefined
+            ? {}
+            : {
+                actionReceiptHash: hash(record.actionReceiptHash, "Approval audit receipt hash"),
+            }),
+        actorId: identifier(record.actorId, "Approval audit actor id"),
+        timestamp: timestamp(record.timestamp, "Approval audit timestamp"),
+        previousHash: hash(record.previousHash, "Approval audit previous hash"),
+    };
+    if (hash(record.recordHash, "Approval audit record hash") !==
+        sha256(canonical(base)))
         throw new ApprovalInboxError("Approval audit record hash is invalid.");
     return { ...base, recordHash: record.recordHash };
 }
-function validateAuditChain(anchor, audit) { let previous = anchor; let sequence = 1; for (const record of audit) {
-    if (record.sequence !== sequence || record.previousHash !== previous)
-        throw new ApprovalInboxError("Approval audit chain is invalid.");
-    previous = record.recordHash;
-    sequence += 1;
-} }
+function validateAuditChain(anchor, audit) {
+    let previous = anchor;
+    let sequence = 1;
+    for (const record of audit) {
+        if (record.sequence !== sequence || record.previousHash !== previous)
+            throw new ApprovalInboxError("Approval audit chain is invalid.");
+        previous = record.recordHash;
+        sequence += 1;
+    }
+}
 function validatePolicy(value) {
     const policy = object(value, "Approval policy is invalid.");
-    exactKeys(policy, ["schemaVersion", "kind", "id", "version", "allowedEnvironments", "allowedActors", "allowedResources", "maxAmountMinor", "minimumConfidence", "criticalRisks", "velocity", "approvalTtlMs", "escalationTimeoutMs"], "Approval policy", ["allowedActors", "allowedResources", "maxAmountMinor"]);
+    exactKeys(policy, [
+        "schemaVersion",
+        "kind",
+        "id",
+        "version",
+        "allowedEnvironments",
+        "allowedActors",
+        "allowedResources",
+        "maxAmountMinor",
+        "minimumConfidence",
+        "criticalRisks",
+        "velocity",
+        "approvalTtlMs",
+        "escalationTimeoutMs",
+    ], "Approval policy", ["allowedActors", "allowedResources", "maxAmountMinor"]);
     if (policy.schemaVersion !== 1 || policy.kind !== "ghostapi.approval-policy")
         throw new ApprovalInboxError("Unsupported approval policy schema.");
     const velocity = object(policy.velocity, "Approval velocity policy is invalid.");
     exactKeys(velocity, ["maxActions", "windowMs"], "Approval velocity policy");
-    const result = { schemaVersion: 1, kind: "ghostapi.approval-policy", id: identifier(policy.id, "Approval policy id"), version: positive(policy.version, "Approval policy version"), allowedEnvironments: identifiers(policy.allowedEnvironments, "Approval allowed environments"), ...(policy.allowedActors === undefined ? {} : { allowedActors: identifiers(policy.allowedActors, "Approval allowed actors") }), ...(policy.allowedResources === undefined ? {} : { allowedResources: identifiers(policy.allowedResources, "Approval allowed resources") }), ...(policy.maxAmountMinor === undefined ? {} : { maxAmountMinor: nonNegative(policy.maxAmountMinor, "Approval max amount") }), minimumConfidence: percentage(policy.minimumConfidence, "Approval minimum confidence"), criticalRisks: risks(policy.criticalRisks), velocity: { maxActions: positive(velocity.maxActions, "Approval velocity maximum"), windowMs: boundedMs(velocity.windowMs, "Approval velocity window") }, approvalTtlMs: boundedMs(policy.approvalTtlMs, "Approval TTL"), escalationTimeoutMs: boundedMs(policy.escalationTimeoutMs, "Approval escalation timeout") };
+    const result = {
+        schemaVersion: 1,
+        kind: "ghostapi.approval-policy",
+        id: identifier(policy.id, "Approval policy id"),
+        version: positive(policy.version, "Approval policy version"),
+        allowedEnvironments: identifiers(policy.allowedEnvironments, "Approval allowed environments"),
+        ...(policy.allowedActors === undefined
+            ? {}
+            : {
+                allowedActors: identifiers(policy.allowedActors, "Approval allowed actors"),
+            }),
+        ...(policy.allowedResources === undefined
+            ? {}
+            : {
+                allowedResources: identifiers(policy.allowedResources, "Approval allowed resources"),
+            }),
+        ...(policy.maxAmountMinor === undefined
+            ? {}
+            : {
+                maxAmountMinor: nonNegative(policy.maxAmountMinor, "Approval max amount"),
+            }),
+        minimumConfidence: percentage(policy.minimumConfidence, "Approval minimum confidence"),
+        criticalRisks: risks(policy.criticalRisks),
+        velocity: {
+            maxActions: positive(velocity.maxActions, "Approval velocity maximum"),
+            windowMs: boundedMs(velocity.windowMs, "Approval velocity window"),
+        },
+        approvalTtlMs: boundedMs(policy.approvalTtlMs, "Approval TTL"),
+        escalationTimeoutMs: boundedMs(policy.escalationTimeoutMs, "Approval escalation timeout"),
+    };
     if (result.escalationTimeoutMs > result.approvalTtlMs)
         throw new ApprovalInboxError("Approval escalation timeout cannot exceed approval TTL.");
     return result;
@@ -325,88 +554,375 @@ function evaluate(policy, action, context, history, now, currentId) {
     const actionRisk = classify(action);
     if (!policy.allowedEnvironments.includes(action.project.environment))
         reasons.push("environment is not approved");
-    if (policy.allowedActors !== undefined && !policy.allowedActors.includes(action.actor.id))
+    if (policy.allowedActors !== undefined &&
+        !policy.allowedActors.includes(action.actor.id))
         reasons.push("actor is not approved");
-    if (policy.allowedResources !== undefined && !policy.allowedResources.includes(action.resource.id))
+    if (policy.allowedResources !== undefined &&
+        !policy.allowedResources.includes(action.resource.id))
         reasons.push("resource is not approved");
-    if (policy.maxAmountMinor !== undefined && (context.amountMinor === undefined || context.amountMinor > policy.maxAmountMinor))
+    if (policy.maxAmountMinor !== undefined &&
+        (context.amountMinor === undefined ||
+            context.amountMinor > policy.maxAmountMinor))
         reasons.push("amount is missing or exceeds the policy limit");
     const cutoff = Date.parse(now) - policy.velocity.windowMs;
-    if (history.filter((request) => request.id !== currentId && request.action.actor.id === action.actor.id && Date.parse(request.createdAt) >= cutoff && request.status !== "superseded").length >= policy.velocity.maxActions)
+    if (history.filter((request) => request.id !== currentId &&
+        request.action.actor.id === action.actor.id &&
+        Date.parse(request.createdAt) >= cutoff &&
+        request.status !== "superseded").length >= policy.velocity.maxActions)
         reasons.push("action velocity limit was reached");
-    const requiredApprovals = policy.criticalRisks.includes(actionRisk) || context.confidence < policy.minimumConfidence ? 2 : 1;
-    reasons.push(requiredApprovals === 2 ? "independent two-person approval is required" : "independent human approval is required");
+    const requiredApprovals = policy.criticalRisks.includes(actionRisk) ||
+        context.confidence < policy.minimumConfidence
+        ? 2
+        : 1;
+    reasons.push(requiredApprovals === 2
+        ? "independent two-person approval is required"
+        : "independent human approval is required");
     return { allowed: reasons.length === 1, requiredApprovals, reasons };
 }
-function display(action, context, policyReason) { return { intent: "Update a local synthetic subscription failure workflow.", target: `${action.resource.type}/${action.resource.id}`, normalizedArgumentDiff: { before: {}, after: clone(action.arguments) }, expectedSideEffects: [...action.expectedSideEffects], reversibility: action.reversibility, impact: { amountMinor: context.amountMinor ?? null, amountKnown: context.amountMinor !== undefined, irreversible: action.reversibility === "none" }, policyReason, evidenceHash: action.evidence.hash, simulation: { status: "passed", summary: "Synthetic adapter preflight found the local target world." } }; }
-function displayRecord(value, action, context) { const candidate = object(value, "Approval display is invalid."); exactKeys(candidate, ["intent", "target", "normalizedArgumentDiff", "expectedSideEffects", "reversibility", "impact", "policyReason", "evidenceHash", "simulation"], "Approval display"); const generated = display(action, context, array(candidate.policyReason, "Approval policy reason", 16).map((item) => text(item, "Approval policy reason", 200))); if (canonical(candidate) !== canonical(generated))
-    throw new ApprovalInboxError("Approval display does not match normalized action data."); return generated; }
-async function createArtifact(request, now, signer) { return signer.issue({ schemaVersion: 1, kind: "ghostapi.action-approval", approvalId: request.id, actionHash: request.actionHash, approvedBy: "approval-inbox", approvedAt: now, expiresAt: request.expiresAt, nonce: `inbox-${request.actionHash.slice(0, 32)}` }); }
-function validateArtifact(value, actionDigest) { const artifact = object(value, "Approval artifact is invalid."); exactKeys(artifact, ["schemaVersion", "kind", "approvalId", "actionHash", "approvedBy", "approvedAt", "expiresAt", "nonce", "provenance"], "Approval artifact"); if (artifact.schemaVersion !== 1 || artifact.kind !== "ghostapi.action-approval" || artifact.actionHash !== actionDigest || artifact.approvedBy !== "approval-inbox")
-    throw new ApprovalInboxError("Approval artifact is invalid."); const provenance = object(artifact.provenance, "Approval artifact provenance is invalid."); exactKeys(provenance, ["kind", "keyId", "signature"], "Approval artifact provenance"); if (provenance.kind !== "ghostapi.ed25519-signature" || typeof provenance.signature !== "string" || !/^[A-Za-z0-9_-]{86}$/.test(provenance.signature))
-    throw new ApprovalInboxError("Approval artifact provenance is invalid."); return { schemaVersion: 1, kind: "ghostapi.action-approval", approvalId: identifier(artifact.approvalId, "Approval artifact id"), actionHash: actionDigest, approvedBy: "approval-inbox", approvedAt: timestamp(artifact.approvedAt, "Approval artifact issue time"), expiresAt: timestamp(artifact.expiresAt, "Approval artifact expiry"), nonce: identifier(artifact.nonce, "Approval artifact nonce"), provenance: { kind: "ghostapi.ed25519-signature", keyId: identifier(provenance.keyId, "Approval artifact key id"), signature: provenance.signature } }; }
-function policyRecord(value) { const policy = object(value, "Approval policy record is invalid."); exactKeys(policy, ["id", "version", "hash", "requiredApprovals"], "Approval policy record"); const requiredApprovals = policy.requiredApprovals; if (requiredApprovals !== 1 && requiredApprovals !== 2)
-    throw new ApprovalInboxError("Approval requirement is invalid."); return { id: identifier(policy.id, "Approval policy id"), version: positive(policy.version, "Approval policy version"), hash: hash(policy.hash, "Approval policy hash"), requiredApprovals }; }
-function validateContext(value) { const context = object(value, "Approval context is invalid."); exactKeys(context, ["confidence", "amountMinor"], "Approval context", ["amountMinor"]); return { confidence: percentage(context.confidence, "Approval confidence"), ...(context.amountMinor === undefined ? {} : { amountMinor: nonNegative(context.amountMinor, "Approval amount") }) }; }
-function validateApprover(value) { const approver = object(value, "Approver identity is invalid."); exactKeys(approver, ["id", "principalId", "independenceKey"], "Approver identity"); return { id: identifier(approver.id, "Approver id"), principalId: identifier(approver.principalId, "Approver principal id"), independenceKey: identifier(approver.independenceKey, "Approver independence key") }; }
-function validateDecision(value) { const decision = object(value, "Approval decision is invalid."); exactKeys(decision, ["id", "kind", "approverId", "principalId", "independenceKey", "reason", "decidedAt"], "Approval decision", ["reason"]); if (decision.kind !== "approve" && decision.kind !== "reject" && decision.kind !== "revoke")
-    throw new ApprovalInboxError("Approval decision kind is invalid."); return { id: identifier(decision.id, "Approval decision id"), kind: decision.kind, approverId: identifier(decision.approverId, "Approver id"), principalId: identifier(decision.principalId, "Approver principal id"), independenceKey: identifier(decision.independenceKey, "Approver independence key"), ...(decision.reason === undefined ? {} : { reason: text(decision.reason, "Approval decision reason", 200) }), decidedAt: timestamp(decision.decidedAt, "Approval decision time") }; }
-function appendAudit(state, event, request, actorId, timestampValue, actionReceiptHash) { const previous = state.audit.at(-1)?.recordHash ?? state.auditAnchor; const base = { sequence: state.audit.length + 1, event, requestId: request.id, actionHash: request.actionHash, ...(actionReceiptHash === undefined ? {} : { actionReceiptHash }), actorId: identifier(actorId, "Approval audit actor id"), timestamp: timestampValue, previousHash: previous }; state.audit.push({ ...base, recordHash: sha256(canonical(base)) }); }
-function refresh(state, now) { for (const request of state.requests) {
-    if (request.status === "pending" && Date.parse(now) >= Date.parse(request.escalationAt)) {
-        request.status = "timed_out";
-        appendAudit(state, "request.timed_out", request, "approval-inbox", now);
-    }
-    else if ((request.status === "pending" || request.status === "approved") && Date.parse(now) >= Date.parse(request.expiresAt)) {
-        request.status = "expired";
-        appendAudit(state, "request.expired", request, "approval-inbox", now);
+function display(action, context, policyReason) {
+    return {
+        intent: "Update a local synthetic subscription failure workflow.",
+        target: `${action.resource.type}/${action.resource.id}`,
+        normalizedArgumentDiff: { before: {}, after: clone(action.arguments) },
+        expectedSideEffects: [...action.expectedSideEffects],
+        reversibility: action.reversibility,
+        impact: {
+            amountMinor: context.amountMinor ?? null,
+            amountKnown: context.amountMinor !== undefined,
+            irreversible: action.reversibility === "none",
+        },
+        policyReason,
+        evidenceHash: action.evidence.hash,
+        simulation: {
+            status: "passed",
+            summary: "Synthetic adapter preflight found the local target world.",
+        },
+    };
+}
+function displayRecord(value, action, context) {
+    const candidate = object(value, "Approval display is invalid.");
+    exactKeys(candidate, [
+        "intent",
+        "target",
+        "normalizedArgumentDiff",
+        "expectedSideEffects",
+        "reversibility",
+        "impact",
+        "policyReason",
+        "evidenceHash",
+        "simulation",
+    ], "Approval display");
+    const generated = display(action, context, array(candidate.policyReason, "Approval policy reason", 16).map((item) => text(item, "Approval policy reason", 200)));
+    if (canonical(candidate) !== canonical(generated))
+        throw new ApprovalInboxError("Approval display does not match normalized action data.");
+    return generated;
+}
+async function createArtifact(request, now, signer) {
+    return signer.issue({
+        schemaVersion: 1,
+        kind: "ghostapi.action-approval",
+        approvalId: request.id,
+        actionHash: request.actionHash,
+        approvedBy: "approval-inbox",
+        approvedAt: now,
+        expiresAt: request.expiresAt,
+        nonce: `inbox-${request.actionHash.slice(0, 32)}`,
+    });
+}
+function validateArtifact(value, actionDigest) {
+    const artifact = object(value, "Approval artifact is invalid.");
+    exactKeys(artifact, [
+        "schemaVersion",
+        "kind",
+        "approvalId",
+        "actionHash",
+        "approvedBy",
+        "approvedAt",
+        "expiresAt",
+        "nonce",
+        "provenance",
+    ], "Approval artifact");
+    if (artifact.schemaVersion !== 1 ||
+        artifact.kind !== "ghostapi.action-approval" ||
+        artifact.actionHash !== actionDigest ||
+        artifact.approvedBy !== "approval-inbox")
+        throw new ApprovalInboxError("Approval artifact is invalid.");
+    const provenance = object(artifact.provenance, "Approval artifact provenance is invalid.");
+    exactKeys(provenance, ["kind", "keyId", "signature"], "Approval artifact provenance");
+    if (provenance.kind !== "ghostapi.ed25519-signature" ||
+        typeof provenance.signature !== "string" ||
+        !/^[A-Za-z0-9_-]{86}$/.test(provenance.signature))
+        throw new ApprovalInboxError("Approval artifact provenance is invalid.");
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.action-approval",
+        approvalId: identifier(artifact.approvalId, "Approval artifact id"),
+        actionHash: actionDigest,
+        approvedBy: "approval-inbox",
+        approvedAt: timestamp(artifact.approvedAt, "Approval artifact issue time"),
+        expiresAt: timestamp(artifact.expiresAt, "Approval artifact expiry"),
+        nonce: identifier(artifact.nonce, "Approval artifact nonce"),
+        provenance: {
+            kind: "ghostapi.ed25519-signature",
+            keyId: identifier(provenance.keyId, "Approval artifact key id"),
+            signature: provenance.signature,
+        },
+    };
+}
+function policyRecord(value) {
+    const policy = object(value, "Approval policy record is invalid.");
+    exactKeys(policy, ["id", "version", "hash", "requiredApprovals"], "Approval policy record");
+    const requiredApprovals = policy.requiredApprovals;
+    if (requiredApprovals !== 1 && requiredApprovals !== 2)
+        throw new ApprovalInboxError("Approval requirement is invalid.");
+    return {
+        id: identifier(policy.id, "Approval policy id"),
+        version: positive(policy.version, "Approval policy version"),
+        hash: hash(policy.hash, "Approval policy hash"),
+        requiredApprovals,
+    };
+}
+function validateContext(value) {
+    const context = object(value, "Approval context is invalid.");
+    exactKeys(context, ["confidence", "amountMinor"], "Approval context", [
+        "amountMinor",
+    ]);
+    return {
+        confidence: percentage(context.confidence, "Approval confidence"),
+        ...(context.amountMinor === undefined
+            ? {}
+            : { amountMinor: nonNegative(context.amountMinor, "Approval amount") }),
+    };
+}
+function validateApprover(value) {
+    const approver = object(value, "Approver identity is invalid.");
+    exactKeys(approver, ["id", "principalId", "independenceKey"], "Approver identity");
+    return {
+        id: identifier(approver.id, "Approver id"),
+        principalId: identifier(approver.principalId, "Approver principal id"),
+        independenceKey: identifier(approver.independenceKey, "Approver independence key"),
+    };
+}
+function validateDecision(value) {
+    const decision = object(value, "Approval decision is invalid.");
+    exactKeys(decision, [
+        "id",
+        "kind",
+        "approverId",
+        "principalId",
+        "independenceKey",
+        "reason",
+        "decidedAt",
+    ], "Approval decision", ["reason"]);
+    if (decision.kind !== "approve" &&
+        decision.kind !== "reject" &&
+        decision.kind !== "revoke")
+        throw new ApprovalInboxError("Approval decision kind is invalid.");
+    return {
+        id: identifier(decision.id, "Approval decision id"),
+        kind: decision.kind,
+        approverId: identifier(decision.approverId, "Approver id"),
+        principalId: identifier(decision.principalId, "Approver principal id"),
+        independenceKey: identifier(decision.independenceKey, "Approver independence key"),
+        ...(decision.reason === undefined
+            ? {}
+            : { reason: text(decision.reason, "Approval decision reason", 200) }),
+        decidedAt: timestamp(decision.decidedAt, "Approval decision time"),
+    };
+}
+function appendAudit(state, event, request, actorId, timestampValue, actionReceiptHash) {
+    const previous = state.audit.at(-1)?.recordHash ?? state.auditAnchor;
+    const base = {
+        sequence: state.audit.length + 1,
+        event,
+        requestId: request.id,
+        actionHash: request.actionHash,
+        ...(actionReceiptHash === undefined ? {} : { actionReceiptHash }),
+        actorId: identifier(actorId, "Approval audit actor id"),
+        timestamp: timestampValue,
+        previousHash: previous,
+    };
+    state.audit.push({ ...base, recordHash: sha256(canonical(base)) });
+}
+function refresh(state, now) {
+    for (const request of state.requests) {
+        if (request.status === "pending" &&
+            Date.parse(now) >= Date.parse(request.escalationAt)) {
+            request.status = "timed_out";
+            appendAudit(state, "request.timed_out", request, "approval-inbox", now);
+        }
+        else if ((request.status === "pending" || request.status === "approved") &&
+            Date.parse(now) >= Date.parse(request.expiresAt)) {
+            request.status = "expired";
+            appendAudit(state, "request.expired", request, "approval-inbox", now);
+        }
     }
-} }
-function classify(action) { if (action.provider === "ghostapi-synthetic" && action.operation === "synthetic.subscription_failure")
-    return "update"; throw new ApprovalInboxError("No approval risk taxonomy rule exists for this action."); }
-function risk(value) { if (value !== "read" && value !== "create" && value !== "update" && value !== "communicate" && value !== "money_movement" && value !== "delete" && value !== "permission_change" && value !== "deployment")
-    throw new ApprovalInboxError("Approval risk is invalid."); return value; }
-function risks(value) { const parsed = array(value, "Approval critical risks", 8).map(risk); unique(parsed, "Approval critical risks"); return parsed.sort(); }
-function requirePending(request) { if (request.status !== "pending")
-    throw new ApprovalInboxError("Approval is not pending."); }
-function assertIndependent(request, approver) { if (approver.id === request.action.actor.id || approver.principalId === request.action.actor.id || approver.principalId === request.action.actor.workloadId || approver.independenceKey === request.action.actor.id || approver.independenceKey === request.action.actor.workloadId)
-    throw new ApprovalInboxError("Action workload cannot approve its own action."); }
-function findRequest(state, requestId) { const request = state.requests.find((candidate) => candidate.id === requestId); if (request === undefined)
-    throw new ApprovalInboxError("Approval request was not found."); return request; }
-function validStatus(value) { return value === "pending" || value === "approved" || value === "rejected" || value === "revoked" || value === "timed_out" || value === "expired" || value === "executing" || value === "executed" || value === "execution_failed" || value === "superseded"; }
-function policyHash(policy) { return sha256(canonical(policy)); }
-function canonical(value) { if (value === null || typeof value === "boolean" || typeof value === "string" || typeof value === "number")
-    return JSON.stringify(value); if (Array.isArray(value))
-    return `[${value.map(canonical).join(",")}]`; if (typeof value === "object")
-    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`; throw new ApprovalInboxError("Approval data must be JSON."); }
-function sha256(value) { return createHash("sha256").update(value, "utf8").digest("hex"); }
-function identifier(value, label) { if (typeof value !== "string" || !IDENTIFIER.test(value) || sanitizeSecretString(value) !== value)
-    throw new ApprovalInboxError(`${label} must be a safe identifier.`); return value; }
-function hash(value, label) { if (typeof value !== "string" || !HASH.test(value))
-    throw new ApprovalInboxError(`${label} must be a SHA-256 hash.`); return value; }
-function timestamp(value, label) { if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) || !Number.isFinite(Date.parse(value)))
-    throw new ApprovalInboxError(`${label} must be an ISO UTC timestamp.`); return value; }
-function positive(value, label) { if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 100_000)
-    throw new ApprovalInboxError(`${label} is invalid.`); return value; }
-function nonNegative(value, label) { if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > Number.MAX_SAFE_INTEGER)
-    throw new ApprovalInboxError(`${label} is invalid.`); return value; }
-function percentage(value, label) { if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 100)
-    throw new ApprovalInboxError(`${label} must be an integer from 0 to 100.`); return value; }
-function boundedMs(value, label) { if (typeof value !== "number" || !Number.isInteger(value) || value < 1_000 || value > 24 * 60 * 60 * 1000)
-    throw new ApprovalInboxError(`${label} is invalid.`); return value; }
-function text(value, label, max) { if (typeof value !== "string" || value.trim() === "" || value.length > max || /[\u0000-\u001f]/.test(value) || sanitizeSecretString(value) !== value)
-    throw new ApprovalInboxError(`${label} is invalid.`); return value.trim(); }
-function identifiers(value, label) { const result = array(value, label, 100).map((entry) => identifier(entry, label)); if (result.length === 0)
-    throw new ApprovalInboxError(`${label} must not be empty.`); unique(result, label); return result.sort(); }
-function object(value, message) { if (value === null || typeof value !== "object" || Array.isArray(value))
-    throw new ApprovalInboxError(message); return value; }
-function array(value, label, max) { if (!Array.isArray(value) || value.length > max)
-    throw new ApprovalInboxError(`${label} is invalid.`); return value; }
-function exactKeys(value, keys, label, optional = []) { for (const key of Object.keys(value))
-    if (!keys.includes(key) || (value[key] === undefined && !optional.includes(key)))
-        throw new ApprovalInboxError(`${label} contains unsupported field: ${key}`); }
-function unique(values, label) { if (new Set(values).size !== values.length)
-    throw new ApprovalInboxError(`${label} must be unique.`); }
-function clone(value) { return structuredClone(value); }
-function isErrorCode(error, code) { return error instanceof Error && "code" in error && error.code === code; }
+}
+function classify(action) {
+    if (action.provider === "ghostapi-synthetic" &&
+        action.operation === "synthetic.subscription_failure")
+        return "update";
+    throw new ApprovalInboxError("No approval risk taxonomy rule exists for this action.");
+}
+function risk(value) {
+    if (value !== "read" &&
+        value !== "create" &&
+        value !== "update" &&
+        value !== "communicate" &&
+        value !== "money_movement" &&
+        value !== "delete" &&
+        value !== "permission_change" &&
+        value !== "deployment")
+        throw new ApprovalInboxError("Approval risk is invalid.");
+    return value;
+}
+function risks(value) {
+    const parsed = array(value, "Approval critical risks", 8).map(risk);
+    unique(parsed, "Approval critical risks");
+    return parsed.sort();
+}
+function requirePending(request) {
+    if (request.status !== "pending")
+        throw new ApprovalInboxError("Approval is not pending.");
+}
+function assertIndependent(request, approver) {
+    if (approver.id === request.action.actor.id ||
+        approver.principalId === request.action.actor.id ||
+        approver.principalId === request.action.actor.workloadId ||
+        approver.independenceKey === request.action.actor.id ||
+        approver.independenceKey === request.action.actor.workloadId)
+        throw new ApprovalInboxError("Action workload cannot approve its own action.");
+}
+function findRequest(state, requestId) {
+    const request = state.requests.find((candidate) => candidate.id === requestId);
+    if (request === undefined)
+        throw new ApprovalInboxError("Approval request was not found.");
+    return request;
+}
+function validStatus(value) {
+    return (value === "pending" ||
+        value === "approved" ||
+        value === "rejected" ||
+        value === "revoked" ||
+        value === "timed_out" ||
+        value === "expired" ||
+        value === "executing" ||
+        value === "executed" ||
+        value === "execution_failed" ||
+        value === "superseded");
+}
+function policyHash(policy) {
+    return sha256(canonical(policy));
+}
+function canonical(value) {
+    if (value === null ||
+        typeof value === "boolean" ||
+        typeof value === "string" ||
+        typeof value === "number")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (typeof value === "object")
+        return `{${Object.keys(value)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+            .join(",")}}`;
+    throw new ApprovalInboxError("Approval data must be JSON.");
+}
+function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function identifier(value, label) {
+    if (typeof value !== "string" ||
+        !IDENTIFIER.test(value) ||
+        sanitizeSecretString(value) !== value)
+        throw new ApprovalInboxError(`${label} must be a safe identifier.`);
+    return value;
+}
+function hash(value, label) {
+    if (typeof value !== "string" || !HASH.test(value))
+        throw new ApprovalInboxError(`${label} must be a SHA-256 hash.`);
+    return value;
+}
+function timestamp(value, label) {
+    if (typeof value !== "string" ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) ||
+        !Number.isFinite(Date.parse(value)))
+        throw new ApprovalInboxError(`${label} must be an ISO UTC timestamp.`);
+    return value;
+}
+function positive(value, label) {
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < 1 ||
+        value > 100_000)
+        throw new ApprovalInboxError(`${label} is invalid.`);
+    return value;
+}
+function nonNegative(value, label) {
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < 0 ||
+        value > Number.MAX_SAFE_INTEGER)
+        throw new ApprovalInboxError(`${label} is invalid.`);
+    return value;
+}
+function percentage(value, label) {
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < 0 ||
+        value > 100)
+        throw new ApprovalInboxError(`${label} must be an integer from 0 to 100.`);
+    return value;
+}
+function boundedMs(value, label) {
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < 1_000 ||
+        value > 24 * 60 * 60 * 1000)
+        throw new ApprovalInboxError(`${label} is invalid.`);
+    return value;
+}
+function text(value, label, max) {
+    if (typeof value !== "string" ||
+        value.trim() === "" ||
+        value.length > max ||
+        /[\u0000-\u001f]/.test(value) ||
+        sanitizeSecretString(value) !== value)
+        throw new ApprovalInboxError(`${label} is invalid.`);
+    return value.trim();
+}
+function identifiers(value, label) {
+    const result = array(value, label, 100).map((entry) => identifier(entry, label));
+    if (result.length === 0)
+        throw new ApprovalInboxError(`${label} must not be empty.`);
+    unique(result, label);
+    return result.sort();
+}
+function object(value, message) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new ApprovalInboxError(message);
+    return value;
+}
+function array(value, label, max) {
+    if (!Array.isArray(value) || value.length > max)
+        throw new ApprovalInboxError(`${label} is invalid.`);
+    return value;
+}
+function exactKeys(value, keys, label, optional = []) {
+    for (const key of Object.keys(value))
+        if (!keys.includes(key) ||
+            (value[key] === undefined && !optional.includes(key)))
+            throw new ApprovalInboxError(`${label} contains unsupported field: ${key}`);
+}
+function unique(values, label) {
+    if (new Set(values).size !== values.length)
+        throw new ApprovalInboxError(`${label} must be unique.`);
+}
+function clone(value) {
+    return structuredClone(value);
+}
+function isErrorCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
 //# sourceMappingURL=approvalInbox.js.map