codexgpt 1.0.0

package/dist/policy/integration.js

@@ -0,0 +1,331 @@
+import { commitTransactionWithAudit, executionAuditFacts } from "../audit/transactionParticipant.js";
+import { pendingVerificationReceipt } from "../worktrees/verificationTerminal.js";
+import { TransactionError } from "../transactions/types.js";
+import { pendingWorkspaceMutation } from "../mutations/index.js";
+import { toolPolicyDefinition } from "./toolPolicy.js";
+export class PolicyInputUnavailableError extends Error {
+    code;
+    nextAction;
+    constructor() {
+        super("The semantic preview is unavailable or stale.");
+        this.name = "PolicyInputUnavailableError";
+        this.code = "SEMANTIC_PREVIEW_STALE";
+        this.nextAction = "Create a fresh semantic rename preview, then retry apply_patch once.";
+    }
+}
+const POLICY_FAILURE = Symbol("codexgpt.policy.failure");
+const POLICY_WRAPPED_HANDLER = Symbol("codexgpt.policy.wrapped-handler");
+const installedServers = new WeakSet();
+const AUTHORIZED_RESOURCE = Symbol.for("codexgpt.policy.authorized-resource");
+const AUTHORIZATION_V4 = Symbol.for("codexgpt.policy.authorization-v4");
+export function authorizedResourceFingerprint(args) {
+    return args[AUTHORIZED_RESOURCE] ?? null;
+}
+export function authorizedGitEventV4(args) {
+    return args[AUTHORIZATION_V4] ?? null;
+}
+export async function withAuthorizedResourceBinding(args, fingerprint, operation) {
+    Object.defineProperty(args, AUTHORIZED_RESOURCE, { value: fingerprint, configurable: true, enumerable: false });
+    try {
+        return await operation();
+    }
+    finally {
+        delete args[AUTHORIZED_RESOURCE];
+    }
+}
+async function withAuthorizationV4Binding(args, authorization, operation) {
+    if (!authorization)
+        return operation();
+    Object.defineProperty(args, AUTHORIZATION_V4, { value: authorization, configurable: true, enumerable: false });
+    try {
+        return await operation();
+    }
+    finally {
+        delete args[AUTHORIZATION_V4];
+    }
+}
+function safeId(value, fallback) {
+    return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(value)
+        ? value
+        : fallback;
+}
+function safeReason(value) {
+    const allowed = new Set([
+        "POLICY_DENIED",
+        "APPROVAL_REQUIRED",
+        "POLICY_CONTEXT_STALE",
+        "POLICY_RESOURCE_INVALID",
+        "POLICY_CONFIG_INVALID",
+        "SHELL_SANDBOX_UNAVAILABLE",
+        "PROCESS_SANDBOX_UNAVAILABLE",
+        "NETWORK_ENFORCEMENT_UNAVAILABLE"
+    ]);
+    return typeof value === "string" && allowed.has(value) ? value : "POLICY_CONFIG_INVALID";
+}
+export function createPolicyToolFailure(decision, localApproval) {
+    const reasonCode = safeReason(decision.reasonCode);
+    const policyRevision = safeId(decision.policyRevision, "policy-unavailable");
+    const approvalLines = localApproval && reasonCode === "APPROVAL_REQUIRED"
+        ? [
+            `Approval ID: ${safeId(localApproval.approvalId, "approval-unavailable")}`,
+            `Server: ${safeId(localApproval.serverId, "server-unavailable")}`,
+            `Next: codexgpt approvals list --server ${safeId(localApproval.serverId, "server-unavailable")}`,
+            "After a local decision, retry the identical operation."
+        ]
+        : [];
+    const result = {
+        content: [{
+                type: "text",
+                text: [
+                    "CodexGPT policy refused this operation.",
+                    `Code: ${reasonCode}`,
+                    `Policy revision: ${policyRevision}`,
+                    ...approvalLines
+                ].join("\n")
+            }],
+        isError: true
+    };
+    Object.defineProperty(result, POLICY_FAILURE, {
+        value: true,
+        enumerable: false,
+        writable: false,
+        configurable: false
+    });
+    return result;
+}
+export function isPolicyToolFailure(value) {
+    return Boolean(value && typeof value === "object" && value[POLICY_FAILURE] === true);
+}
+function unavailableFailure() {
+    return createPolicyToolFailure({
+        reasonCode: "POLICY_CONFIG_INVALID",
+        policyRevision: "policy-unavailable"
+    });
+}
+function inputUnavailableFailure(error) {
+    return {
+        content: [{
+                type: "text",
+                text: [
+                    "CodexGPT refused this stale bound input.",
+                    `Code: ${error.code}`,
+                    `Next: ${error.nextAction}`
+                ].join("\n")
+            }],
+        isError: true
+    };
+}
+export function installPolicyKernel(server, runtime) {
+    if (runtime.mode === "legacy")
+        return;
+    const candidate = server;
+    const tools = candidate._registeredTools;
+    if (!tools || typeof tools !== "object") {
+        throw new Error("CodexGPT server does not expose a registered-tool map for Policy Kernel installation.");
+    }
+    if (installedServers.has(server)) {
+        throw new Error("Policy Kernel is already installed on this server.");
+    }
+    for (const [toolName, entry] of Object.entries(tools)) {
+        const registered = entry.handler;
+        if (toolName === "codexgpt" ||
+            entry.enabled === false ||
+            registered[POLICY_WRAPPED_HANDLER] === true)
+            continue;
+        toolPolicyDefinition(toolName);
+        const original = registered;
+        entry.handler = async (args, extra) => {
+            let authorization;
+            try {
+                authorization = await runtime.authorize(toolName, args, extra);
+                if (authorization.auditEvent)
+                    await runtime.audit(authorization.auditEvent);
+            }
+            catch (error) {
+                if (authorization?.reservation) {
+                    try {
+                        await authorization.reservation.burn("AUTHORIZATION_AUDIT_FAILED");
+                    }
+                    catch { }
+                }
+                if (error instanceof PolicyInputUnavailableError)
+                    return inputUnavailableFailure(error);
+                if (runtime.mode === "enforce")
+                    return unavailableFailure();
+                return original(args, extra);
+            }
+            const auditContext = authorization.auditContext;
+            if (auditContext) {
+                try {
+                    if (!runtime.persistAuthorization)
+                        throw new Error("Persistent audit runtime is unavailable.");
+                    await runtime.persistAuthorization(auditContext);
+                }
+                catch {
+                    if (authorization.reservation) {
+                        try {
+                            await authorization.reservation.burn("AUTHORIZATION_AUDIT_FAILED");
+                        }
+                        catch { }
+                    }
+                    if (auditContext.requirement === "required")
+                        return unavailableFailure();
+                }
+            }
+            if (runtime.mode === "enforce" && authorization.decision.outcome !== "allow") {
+                if (authorization.reservation) {
+                    try {
+                        await authorization.reservation.burn("POLICY_NOT_ALLOWED");
+                    }
+                    catch { }
+                }
+                if (auditContext) {
+                    const notExecuted = {
+                        status: "not_executed",
+                        resultCode: authorization.decision.reasonCode,
+                        durationMs: 0,
+                        exitCode: null,
+                        boundedByteCounts: {},
+                        changeSetId: null,
+                        revertsChangeSetId: null,
+                        operationCount: 0,
+                        mutationKinds: [],
+                        recoveryRequired: false,
+                        ...(auditContext.semanticFacts ? { semanticFacts: auditContext.semanticFacts } : {})
+                    };
+                    try {
+                        if (!runtime.persistExecution)
+                            throw new Error("Persistent audit runtime is unavailable.");
+                        await runtime.persistExecution(auditContext, notExecuted);
+                    }
+                    catch {
+                        // A denied operation remains denied even when terminal audit persistence is degraded.
+                    }
+                }
+                return createPolicyToolFailure(authorization.decision, authorization.localApproval);
+            }
+            if (authorization.reservation) {
+                try {
+                    await authorization.reservation.commit();
+                }
+                catch {
+                    return unavailableFailure();
+                }
+            }
+            const startedAt = Date.now();
+            try {
+                let result = await withAuthorizedResourceBinding(args, authorization.decision.resourceFingerprint, () => withAuthorizationV4Binding(args, authorization.v4Authorization, () => original(args, extra)));
+                const workspaceMutation = pendingWorkspaceMutation(result);
+                if (workspaceMutation && (!auditContext ||
+                    auditContext.requirement !== "required" ||
+                    !runtime.persistExecution)) {
+                    await workspaceMutation.rollback("required_audit_unavailable");
+                    return unavailableFailure();
+                }
+                if (auditContext) {
+                    const facts = executionAuditFacts(result);
+                    const execution = {
+                        status: result.isError === true ? "failed" : "succeeded",
+                        resultCode: result.isError === true ? "TOOL_ERROR" : facts?.resultCode ?? "OK",
+                        durationMs: Math.max(0, Date.now() - startedAt),
+                        exitCode: facts?.exitCode ?? null,
+                        boundedByteCounts: facts?.boundedByteCounts ?? {},
+                        changeSetId: facts?.changeSetId ?? workspaceMutation?.changeSetId ?? null,
+                        revertsChangeSetId: workspaceMutation?.revertsChangeSetId ?? null,
+                        operationCount: facts?.operationCount ?? workspaceMutation?.operationCount ?? 0,
+                        mutationKinds: facts?.mutationKinds ?? [...(workspaceMutation?.mutationKinds ?? [])],
+                        recoveryRequired: false
+                    };
+                    try {
+                        if (!runtime.persistExecution)
+                            throw new Error("Persistent audit runtime is unavailable.");
+                        if (workspaceMutation) {
+                            result = await workspaceMutation.commit({
+                                result,
+                                persistAudit: async () => {
+                                    await runtime.persistExecution(auditContext, execution);
+                                }
+                            });
+                        }
+                        else if (facts?.pendingMutationCommit && auditContext.requirement === "required") {
+                            await commitTransactionWithAudit({
+                                pending: facts.pendingMutationCommit,
+                                runtime: {
+                                    persistExecution: async (context, input) => {
+                                        await runtime.persistExecution(context, input);
+                                    }
+                                },
+                                context: auditContext,
+                                execution
+                            });
+                        }
+                        else {
+                            const auditEvidence = await runtime.persistExecution(auditContext, execution);
+                            const pendingVerification = pendingVerificationReceipt(result);
+                            if (pendingVerification) {
+                                if (!auditEvidence)
+                                    return unavailableFailure();
+                                const receipt = pendingVerification.finalize(auditEvidence);
+                                pendingVerification.attach(receipt);
+                            }
+                        }
+                    }
+                    catch (error) {
+                        let projectedFailure = null;
+                        try {
+                            projectedFailure = workspaceMutation?.projectFailure(error, result) ?? null;
+                        }
+                        catch {
+                            return unavailableFailure();
+                        }
+                        if (projectedFailure)
+                            return projectedFailure;
+                        if (error instanceof TransactionError) {
+                            if (workspaceMutation)
+                                return unavailableFailure();
+                            throw error;
+                        }
+                        if (auditContext.requirement === "required")
+                            return unavailableFailure();
+                    }
+                }
+                return result;
+            }
+            catch (error) {
+                if (auditContext) {
+                    const execution = {
+                        status: "failed",
+                        resultCode: "HANDLER_EXCEPTION",
+                        durationMs: Math.max(0, Date.now() - startedAt),
+                        exitCode: null,
+                        boundedByteCounts: {},
+                        changeSetId: null,
+                        revertsChangeSetId: null,
+                        operationCount: 0,
+                        mutationKinds: [],
+                        recoveryRequired: false
+                    };
+                    try {
+                        if (!runtime.persistExecution)
+                            throw new Error("Persistent audit runtime is unavailable.");
+                        await runtime.persistExecution(auditContext, execution);
+                    }
+                    catch {
+                        if (auditContext.requirement === "required") {
+                            throw new Error("AUDIT_UNAVAILABLE", { cause: error });
+                        }
+                    }
+                }
+                throw error;
+            }
+        };
+        Object.defineProperty(entry.handler, POLICY_WRAPPED_HANDLER, {
+            value: true,
+            enumerable: false,
+            writable: false,
+            configurable: false
+        });
+    }
+    installedServers.add(server);
+}
+//# sourceMappingURL=integration.js.map

package/dist/policy/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../src/policy/integration.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,oCAAoC,CAAC;AAS5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAiBvD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,CAA2B;IAC/B,UAAU,CAAS;IAE5B;QACE,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,sEAAsE,CAAC;IAC3F,CAAC;CACF;AAgGD,MAAM,cAAc,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AACzD,MAAM,sBAAsB,GAAG,MAAM,CAAC,iCAAiC,CAAC,CAAC;AACzE,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAU,CAAC;AAC/C,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAC9E,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAExE,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACxD,OAAQ,IAAgC,CAAC,mBAAmB,CAAW,IAAI,IAAI,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAQ,IAAgC,CAAC,gBAAgB,CAA8B,IAAI,IAAI,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAI,IAAY,EAAE,WAAmB,EAAE,SAA+B;IACvH,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,OAAQ,IAAgC,CAAC,mBAAmB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAAY,EACZ,aAAoD,EACpD,SAA+B;IAE/B,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,EAAE,CAAC;IACvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,OAAQ,IAAgC,CAAC,gBAAgB,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,QAAgB;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QACnF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,eAAe;QACf,mBAAmB;QACnB,sBAAsB;QACtB,yBAAyB;QACzB,uBAAuB;QACvB,2BAA2B;QAC3B,6BAA6B;QAC7B,iCAAiC;KAClC,CAAC,CAAC;IACH,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAiE,EACjE,aAA0D;IAE1D,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,aAAa,IAAI,UAAU,KAAK,mBAAmB;QACvE,CAAC,CAAC;YACE,gBAAgB,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,sBAAsB,CAAC,EAAE;YAC1E,WAAW,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EAAE;YACjE,0CAA0C,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EAAE;YAChG,wDAAwD;SACzD;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE;oBACJ,yCAAyC;oBACzC,SAAS,UAAU,EAAE;oBACrB,oBAAoB,cAAc,EAAE;oBACpC,GAAG,aAAa;iBACjB,CAAC,IAAI,CAAC,IAAI,CAAC;aACb,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE;QAC5C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAiC,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,uBAAuB,CAAC;QAC7B,UAAU,EAAE,uBAAuB;QACnC,cAAc,EAAE,oBAAoB;KACrC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAkC;IACjE,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE;oBACJ,0CAA0C;oBAC1C,SAAS,KAAK,CAAC,IAAI,EAAE;oBACrB,SAAS,KAAK,CAAC,UAAU,EAAE;iBAC5B,CAAC,IAAI,CAAC,IAAI,CAAC;aACb,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,OAAsB;IACzE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtC,MAAM,SAAS,GAAG,MAA4C,CAAC;IAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAgB,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,KAAK,CAAC,OAExB,CAAC;QACF,IACE,QAAQ,KAAK,UAAU;YACvB,KAAK,CAAC,OAAO,KAAK,KAAK;YACvB,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;YAC3C,SAAS;QACX,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC5B,KAAK,CAAC,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpC,IAAI,aAAoD,CAAC;YACzD,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/D,IAAI,aAAa,CAAC,UAAU;oBAAE,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,aAAa,EAAE,WAAW,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBAAC,MAAM,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,KAAK,YAAY,2BAA2B;oBAAE,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBACxF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;oBAAE,OAAO,kBAAkB,EAAE,CAAC;gBAC5D,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;YAChD,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,CAAC,OAAO,CAAC,oBAAoB;wBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC/F,MAAM,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BAAC,MAAM,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,CAAC;oBACvF,CAAC;oBACD,IAAI,YAAY,CAAC,WAAW,KAAK,UAAU;wBAAE,OAAO,kBAAkB,EAAE,CAAC;gBAC3E,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC7E,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBAAC,MAAM,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,WAAW,GAA0B;wBACzC,MAAM,EAAE,cAAc;wBACtB,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU;wBAC7C,UAAU,EAAE,CAAC;wBACb,QAAQ,EAAE,IAAI;wBACd,iBAAiB,EAAE,EAAE;wBACrB,WAAW,EAAE,IAAI;wBACjB,kBAAkB,EAAE,IAAI;wBACxB,cAAc,EAAE,CAAC;wBACjB,aAAa,EAAE,EAAE;wBACjB,gBAAgB,EAAE,KAAK;wBACvB,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrF,CAAC;oBACF,IAAI,CAAC;wBACH,IAAI,CAAC,OAAO,CAAC,gBAAgB;4BAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;wBAC3F,MAAM,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;oBAC5D,CAAC;oBAAC,MAAM,CAAC;wBACP,sFAAsF;oBACxF,CAAC;gBACH,CAAC;gBACD,OAAO,uBAAuB,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;YACtF,CAAC;YAED,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,kBAAkB,EAAE,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,GAAG,MAAM,6BAA6B,CAC9C,IAAI,EACJ,aAAa,CAAC,QAAQ,CAAC,mBAAmB,EAC1C,GAAG,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,aAAa,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACnG,CAAC;gBACF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;gBAC3D,IAAI,iBAAiB,IAAI,CACvB,CAAC,YAAY;oBACb,YAAY,CAAC,WAAW,KAAK,UAAU;oBACvC,CAAC,OAAO,CAAC,gBAAgB,CAC1B,EAAE,CAAC;oBACF,MAAM,iBAAiB,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;oBAC/D,OAAO,kBAAkB,EAAE,CAAC;gBAC9B,CAAC;gBACD,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,SAAS,GAA0B;wBACvC,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;wBACxD,UAAU,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI;wBAC9E,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;wBAC/C,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,IAAI;wBACjC,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE;wBACjD,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,iBAAiB,EAAE,WAAW,IAAI,IAAI;wBACzE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,IAAI,IAAI;wBACjE,cAAc,EAAE,KAAK,EAAE,cAAc,IAAI,iBAAiB,EAAE,cAAc,IAAI,CAAC;wBAC/E,aAAa,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;wBACpF,gBAAgB,EAAE,KAAK;qBACxB,CAAC;oBACF,IAAI,CAAC;wBACH,IAAI,CAAC,OAAO,CAAC,gBAAgB;4BAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;wBAC3F,IAAI,iBAAiB,EAAE,CAAC;4BACtB,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC;gCACtC,MAAM;gCACN,YAAY,EAAE,KAAK,IAAI,EAAE;oCACvB,MAAM,OAAO,CAAC,gBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;gCAC3D,CAAC;6BACF,CAAC,CAAC;wBACL,CAAC;6BAAM,IAAI,KAAK,EAAE,qBAAqB,IAAI,YAAY,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;4BACnF,MAAM,0BAA0B,CAAC;gCAC/B,OAAO,EAAE,KAAK,CAAC,qBAAqB;gCACpC,OAAO,EAAE;oCACP,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;wCACzC,MAAM,OAAO,CAAC,gBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oCAClD,CAAC;iCACF;gCACD,OAAO,EAAE,YAAY;gCACrB,SAAS;6BACV,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;4BAC9E,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;4BAC/D,IAAI,mBAAmB,EAAE,CAAC;gCACxB,IAAI,CAAC,aAAa;oCAAE,OAAO,kBAAkB,EAAE,CAAC;gCAChD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gCAC5D,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,gBAAgB,GAA0B,IAAI,CAAC;wBACnD,IAAI,CAAC;4BACH,gBAAgB,GAAG,iBAAiB,EAAE,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;wBAC9E,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,kBAAkB,EAAE,CAAC;wBAC9B,CAAC;wBACD,IAAI,gBAAgB;4BAAE,OAAO,gBAAgB,CAAC;wBAC9C,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;4BACtC,IAAI,iBAAiB;gCAAE,OAAO,kBAAkB,EAAE,CAAC;4BACnD,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,IAAI,YAAY,CAAC,WAAW,KAAK,UAAU;4BAAE,OAAO,kBAAkB,EAAE,CAAC;oBAC3E,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,SAAS,GAA0B;wBACvC,MAAM,EAAE,QAAQ;wBAChB,UAAU,EAAE,mBAAmB;wBAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;wBAC/C,QAAQ,EAAE,IAAI;wBACd,iBAAiB,EAAE,EAAE;wBACrB,WAAW,EAAE,IAAI;wBACjB,kBAAkB,EAAE,IAAI;wBACxB,cAAc,EAAE,CAAC;wBACjB,aAAa,EAAE,EAAE;wBACjB,gBAAgB,EAAE,KAAK;qBACxB,CAAC;oBACF,IAAI,CAAC;wBACH,IAAI,CAAC,OAAO,CAAC,gBAAgB;4BAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;wBAC3F,MAAM,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;oBAC1D,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,YAAY,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;4BAC5C,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;wBACzD,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,EAAE;YAC3D,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;AACzC,CAAC"}

package/dist/policy/pendingApprovals.js

@@ -0,0 +1,301 @@
+import { randomBytes as nodeRandomBytes } from "node:crypto";
+import { riskLimits } from "./approval.js";
+export class ApprovalQueueError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ApprovalQueueError";
+    }
+}
+const ACTIVE_STATES = new Set(["pending", "prepared", "granted", "reserved"]);
+const TERMINAL_STATES = new Set(["denied", "expired", "consumed", "burned"]);
+function timestamp(milliseconds) {
+    if (!Number.isFinite(milliseconds))
+        throw new Error("Approval timestamp is invalid.");
+    return new Date(milliseconds).toISOString();
+}
+function safeText(name, value, maximum = 160) {
+    if (!value || value.length > maximum || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new Error(`${name} is not safe for approval display.`);
+    }
+    return value;
+}
+function normalizeSummary(summary) {
+    if (!Number.isSafeInteger(summary.argumentCount) || summary.argumentCount < 0 || summary.argumentCount > 100_000) {
+        throw new Error("Approval argument count is invalid.");
+    }
+    if (!/^[a-f0-9]{8,32}$/.test(summary.digestPrefix))
+        throw new Error("Approval digest prefix is invalid.");
+    const revealInput = summary.revealArguments ?? [];
+    if (!Array.isArray(revealInput) || revealInput.length > 32) {
+        throw new Error("Approval reveal arguments are invalid.");
+    }
+    const revealArguments = revealInput.map((value) => {
+        if (typeof value !== "string" || value.length > 4096)
+            throw new Error("Approval reveal argument is invalid.");
+        return value;
+    });
+    return Object.freeze({
+        backend: safeText("backend", summary.backend, 80),
+        actionKind: safeText("actionKind", summary.actionKind, 80),
+        argumentCount: summary.argumentCount,
+        logicalScope: safeText("logicalScope", summary.logicalScope, 160),
+        identityLabel: safeText("identityLabel", summary.identityLabel, 120),
+        authoritySummary: safeText("authoritySummary", summary.authoritySummary, 200),
+        digestPrefix: summary.digestPrefix,
+        revealArguments: Object.freeze(revealArguments)
+    });
+}
+export class PendingApprovalStore {
+    #records = new Map();
+    #dedupe = new Map();
+    #newRequestTimes = new Map();
+    #now;
+    #randomBytes;
+    #maxServerPending;
+    #maxSessionPending;
+    #maxNewPerSessionPerMinute;
+    #lifecycleSink;
+    #tail = Promise.resolve();
+    #sequence = 0;
+    constructor(options = {}) {
+        this.#now = options.now ?? Date.now;
+        this.#randomBytes = options.randomBytes ?? nodeRandomBytes;
+        this.#maxServerPending = options.maxServerPending ?? 32;
+        this.#maxSessionPending = options.maxSessionPending ?? 8;
+        this.#maxNewPerSessionPerMinute = options.maxNewPerSessionPerMinute ?? 10;
+        this.#lifecycleSink = options.lifecycleSink;
+    }
+    size() {
+        return this.#records.size;
+    }
+    snapshot() {
+        return [...this.#records.values()]
+            .sort((left, right) => left.createdAt.localeCompare(right.createdAt) || left.approvalId.localeCompare(right.approvalId))
+            .map((record) => structuredClone(record));
+    }
+    get(approvalId) {
+        const record = this.#records.get(approvalId);
+        return record ? structuredClone(record) : null;
+    }
+    getByGrantId(grantId) {
+        const record = [...this.#records.values()].find((candidate) => candidate.grantId === grantId);
+        return record ? structuredClone(record) : null;
+    }
+    expire(at) {
+        return this.#serialized(async () => {
+            const nowMs = at === undefined ? this.#now() : Date.parse(at);
+            const before = [...this.#records.values()].filter((record) => ACTIVE_STATES.has(record.state)).length;
+            await this.#expire(nowMs);
+            const after = [...this.#records.values()].filter((record) => ACTIVE_STATES.has(record.state)).length;
+            return before - after;
+        });
+    }
+    request(input) {
+        return this.#serialized(async () => {
+            const createdMs = input.createdAt === undefined ? this.#now() : Date.parse(input.createdAt);
+            if (!Number.isFinite(createdMs))
+                throw new Error("Approval creation time is invalid.");
+            await this.#expire(createdMs);
+            const existingId = this.#dedupe.get(input.facts.bindingFingerprint);
+            const existing = existingId ? this.#records.get(existingId) : undefined;
+            if (existing && ACTIVE_STATES.has(existing.state) && Date.parse(existing.expiresAt) > createdMs) {
+                return { approval: structuredClone(existing), deduplicated: true };
+            }
+            this.#enforceLimits(input.facts.transportSessionId, createdMs);
+            const random = this.#randomBytes(16);
+            if (!Buffer.isBuffer(random) || random.length !== 16)
+                throw new Error("Approval random source returned an invalid value.");
+            const limits = riskLimits(input.facts.riskClass);
+            this.#sequence += 1;
+            const approval = Object.freeze({
+                schemaVersion: 3,
+                contractVersion: 3,
+                approvalId: `approval_${random.toString("hex")}`,
+                state: "pending",
+                facts: structuredClone(input.facts),
+                summary: normalizeSummary(input.summary),
+                createdAt: timestamp(createdMs),
+                expiresAt: timestamp(createdMs + limits.maxTtlMs),
+                preparedAt: null,
+                decidedAt: null,
+                reservationId: null,
+                grantId: null,
+                terminalAt: null,
+                transitionSequence: this.#sequence
+            });
+            await this.#persist({ approval, from: null, to: "pending", at: approval.createdAt, resultCode: null });
+            this.#records.set(approval.approvalId, approval);
+            this.#dedupe.set(approval.facts.bindingFingerprint, approval.approvalId);
+            const times = this.#newRequestTimes.get(approval.facts.transportSessionId) ?? [];
+            times.push(createdMs);
+            this.#newRequestTimes.set(approval.facts.transportSessionId, times);
+            return { approval: structuredClone(approval), deduplicated: false };
+        });
+    }
+    prepare(approvalId, at) {
+        return this.#transitionDecision(approvalId, "prepared", at, null);
+    }
+    approve(approvalId, grantId, at) {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(grantId))
+            throw new Error("Grant ID is invalid.");
+        return this.#serialized(async () => {
+            const nowMs = at === undefined ? this.#now() : Date.parse(at);
+            await this.#expire(nowMs);
+            const current = this.#required(approvalId);
+            if (current.state === "granted" || current.state === "reserved" || current.state === "consumed" || current.state === "burned") {
+                return structuredClone(current);
+            }
+            if (current.state === "denied" || current.state === "expired") {
+                throw new ApprovalQueueError("APPROVAL_STATE_CONFLICT", "A terminal approval cannot be granted.");
+            }
+            return this.#apply(current, "granted", nowMs, {
+                grantId,
+                decidedAt: timestamp(nowMs)
+            }, null);
+        });
+    }
+    deny(approvalId, at) {
+        return this.#serialized(async () => {
+            const nowMs = at === undefined ? this.#now() : Date.parse(at);
+            await this.#expire(nowMs);
+            const current = this.#required(approvalId);
+            if (current.state === "denied")
+                return structuredClone(current);
+            if (current.state === "granted" || current.state === "reserved" || current.state === "consumed" || current.state === "burned") {
+                throw new ApprovalQueueError("APPROVAL_STATE_CONFLICT", "A granted approval cannot be denied.");
+            }
+            if (current.state === "expired")
+                return structuredClone(current);
+            return this.#apply(current, "denied", nowMs, {
+                decidedAt: timestamp(nowMs),
+                terminalAt: timestamp(nowMs)
+            }, "DENIED");
+        });
+    }
+    markReserved(grantId, reservationId, at) {
+        return this.#markGrantTransition(grantId, "reserved", reservationId, at, null);
+    }
+    markConsumed(grantId, reservationId, at) {
+        return this.#markGrantTransition(grantId, "consumed", reservationId, at, "CONSUMED");
+    }
+    markBurned(grantId, reservationId, at, resultCode = "BURNED") {
+        return this.#markGrantTransition(grantId, "burned", reservationId, at, resultCode);
+    }
+    revokeTransportSession(transportSessionId, at) {
+        return this.#revokeWhere((record) => record.facts.transportSessionId === transportSessionId, at, "TRANSPORT_REVOKED");
+    }
+    revokePolicyRevision(activeRevision, at) {
+        return this.#revokeWhere((record) => record.facts.policyRevision !== activeRevision, at, "POLICY_REVOKED");
+    }
+    revokeEvidenceRevision(activeRevision, at) {
+        return this.#revokeWhere((record) => record.facts.evidenceRevision !== activeRevision, at, "EVIDENCE_REVOKED");
+    }
+    closeServer(serverId, at) {
+        return this.#revokeWhere((record) => record.facts.serverId === serverId, at, "SERVER_CLOSED");
+    }
+    async #transitionDecision(approvalId, target, at, resultCode) {
+        return this.#serialized(async () => {
+            const nowMs = at === undefined ? this.#now() : Date.parse(at);
+            await this.#expire(nowMs);
+            const current = this.#required(approvalId);
+            if (current.state === target)
+                return structuredClone(current);
+            if (current.state !== "pending")
+                throw new ApprovalQueueError("APPROVAL_STATE_CONFLICT", "Approval cannot be prepared from its current state.");
+            return this.#apply(current, target, nowMs, { preparedAt: timestamp(nowMs) }, resultCode);
+        });
+    }
+    async #markGrantTransition(grantId, target, reservationId, at, resultCode) {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(reservationId))
+            throw new Error("Reservation ID is invalid.");
+        return this.#serialized(async () => {
+            const nowMs = at === undefined ? this.#now() : Date.parse(at);
+            const current = [...this.#records.values()].find((record) => record.grantId === grantId);
+            if (!current)
+                return null;
+            if (current.state === target && current.reservationId === reservationId)
+                return structuredClone(current);
+            if (target === "reserved" && current.state !== "granted") {
+                throw new ApprovalQueueError("APPROVAL_STATE_CONFLICT", "Grant cannot be reserved from its current state.");
+            }
+            if ((target === "consumed" || target === "burned") && (current.state !== "reserved" || current.reservationId !== reservationId)) {
+                throw new ApprovalQueueError("APPROVAL_STATE_CONFLICT", "Reservation does not match the approval state.");
+            }
+            return this.#apply(current, target, nowMs, {
+                reservationId,
+                terminalAt: target === "consumed" || target === "burned" ? timestamp(nowMs) : null
+            }, resultCode);
+        });
+    }
+    async #revokeWhere(predicate, at, resultCode) {
+        return this.#serialized(async () => {
+            const nowMs = at === undefined ? this.#now() : Date.parse(at);
+            let count = 0;
+            for (const current of [...this.#records.values()]) {
+                if (!predicate(current) || !ACTIVE_STATES.has(current.state))
+                    continue;
+                const target = current.state === "reserved" ? "burned" : "expired";
+                await this.#apply(current, target, nowMs, { terminalAt: timestamp(nowMs) }, resultCode);
+                count += 1;
+            }
+            return count;
+        });
+    }
+    #enforceLimits(sessionId, nowMs) {
+        const active = [...this.#records.values()].filter((record) => ACTIVE_STATES.has(record.state) && Date.parse(record.expiresAt) > nowMs);
+        if (active.length >= this.#maxServerPending)
+            throw new ApprovalQueueError("APPROVAL_QUEUE_FULL", "Server approval queue is full.");
+        if (active.filter((record) => record.facts.transportSessionId === sessionId).length >= this.#maxSessionPending) {
+            throw new ApprovalQueueError("APPROVAL_QUEUE_FULL", "Session approval queue is full.");
+        }
+        const cutoff = nowMs - 60_000;
+        const times = (this.#newRequestTimes.get(sessionId) ?? []).filter((value) => value > cutoff);
+        this.#newRequestTimes.set(sessionId, times);
+        if (times.length >= this.#maxNewPerSessionPerMinute) {
+            throw new ApprovalQueueError("APPROVAL_QUEUE_FULL", "Session approval request rate is exceeded.");
+        }
+    }
+    #required(approvalId) {
+        const current = this.#records.get(approvalId);
+        if (!current)
+            throw new ApprovalQueueError("APPROVAL_NOT_FOUND", "Approval was not found.");
+        return current;
+    }
+    async #apply(current, target, nowMs, patch, resultCode) {
+        if (!Number.isFinite(nowMs))
+            throw new Error("Approval transition time is invalid.");
+        this.#sequence += 1;
+        const next = Object.freeze({
+            ...current,
+            ...patch,
+            state: target,
+            transitionSequence: this.#sequence
+        });
+        await this.#persist({ approval: next, from: current.state, to: target, at: timestamp(nowMs), resultCode });
+        this.#records.set(next.approvalId, next);
+        if (TERMINAL_STATES.has(target))
+            this.#dedupe.delete(next.facts.bindingFingerprint);
+        return structuredClone(next);
+    }
+    async #expire(nowMs) {
+        if (!Number.isFinite(nowMs))
+            throw new Error("Approval expiry time is invalid.");
+        for (const current of [...this.#records.values()]) {
+            if (!ACTIVE_STATES.has(current.state) || Date.parse(current.expiresAt) > nowMs)
+                continue;
+            const target = current.state === "reserved" ? "burned" : "expired";
+            await this.#apply(current, target, nowMs, { terminalAt: timestamp(nowMs) }, "EXPIRED");
+        }
+    }
+    async #persist(transition) {
+        await this.#lifecycleSink?.(structuredClone(transition));
+    }
+    #serialized(action) {
+        const result = this.#tail.then(action, action);
+        this.#tail = result.then(() => undefined, () => undefined);
+        return result;
+    }
+}
+//# sourceMappingURL=pendingApprovals.js.map