emdash 1.0.1 → 1.1.0

package/dist/approvals-DycwI6lZ.mjs

@@ -0,0 +1,460 @@
+import { u as isPostgres } from "./dialect-helpers-7_IqPdh9.mjs";
+import { t as TransferError } from "./errors-CuHQRiBW.mjs";
+import { o as TRANSFER_LIMITS } from "./canonical-Y1dpjCnp.mjs";
+import { a as isSha256Digest } from "./digest-xIpR3o64.mjs";
+import { i as RECORD_KINDS } from "./kinds-BQl5gN6e.mjs";
+import { sql } from "kysely";
+import { z } from "zod";
+import { ulid } from "ulidx";
+import { TRANSFER_SCOPES } from "@emdash-cms/auth";
+
+//#region src/transfer/auth.ts
+/** Token scope a bearer-token caller needs for each transfer action. */
+const TRANSFER_ACTION_SCOPE = Object.freeze({
+	export: "transfer:export",
+	analyze: "transfer:analyze",
+	execute: "transfer:execute"
+});
+/** RBAC permission a session caller needs for each transfer action. */
+const TRANSFER_ACTION_PERMISSION = Object.freeze({
+	export: "transfer:export",
+	analyze: "transfer:import",
+	execute: "transfer:import"
+});
+/** Actions an MCP approval grant can authorize. */
+const TRANSFER_APPROVAL_ACTIONS = ["export", "import"];
+
+//#endregion
+//#region src/transfer/ops/states.ts
+/**
+* Transfer operation states, stages, and typed cursors.
+*
+* Export:  pending → running → complete | failed | expired
+* Import:  uploading → analyzing → planned → running → verifying
+*          → complete | failed | cancelled | abandoned | expired
+*
+* An import "occupies" the target from creation until it reaches a terminal
+* state. A failed or cancelled import that already started writing
+* (`mutation_started_at` set) keeps occupying the target, and keeps site
+* writes fenced, until it is explicitly abandoned. The partial unique index
+* `idx__emdash_transfer_operations_active_import` (migration 084) enforces
+* one occupying import per target with the same predicate as
+* {@link isOccupyingImport}.
+*/
+const TRANSFER_RUNTIME_GENERATION = 1;
+const TRANSFER_OPERATION_KINDS = ["export", "import"];
+const EXPORT_STATES = [
+	"pending",
+	"running",
+	"complete",
+	"failed",
+	"expired"
+];
+const IMPORT_STATES = [
+	"uploading",
+	"analyzing",
+	"planned",
+	"running",
+	"verifying",
+	"complete",
+	"failed",
+	"cancelled",
+	"abandoned",
+	"expired"
+];
+const OPERATION_KINDS = new Set(TRANSFER_OPERATION_KINDS);
+const OPERATION_STATES = new Set([...EXPORT_STATES, ...IMPORT_STATES]);
+function isTransferOperationKind(value) {
+	return OPERATION_KINDS.has(value);
+}
+function isTransferOperationState(value) {
+	return OPERATION_STATES.has(value);
+}
+/** Import states before execution starts; they expire after the pending TTL. */
+const PRE_EXECUTION_IMPORT_STATES = [
+	"uploading",
+	"analyzing",
+	"planned"
+];
+/** Import states in which the importer is writing to the target. */
+const EXECUTING_IMPORT_STATES = ["running", "verifying"];
+const TERMINAL_EXPORT_STATES = [
+	"complete",
+	"failed",
+	"expired"
+];
+const TERMINAL_IMPORT_STATES = [
+	"complete",
+	"failed",
+	"cancelled",
+	"abandoned",
+	"expired"
+];
+function isTerminalState(kind, state) {
+	return kind === "export" ? TERMINAL_EXPORT_STATES.includes(state) : TERMINAL_IMPORT_STATES.includes(state);
+}
+/**
+* Import stages in execution order. The record stages write the kinds listed
+* in `IMPORT_STAGE_KINDS` (format/kinds.ts).
+*/
+const IMPORT_STAGES = [
+	"reserve",
+	"clear_scaffold",
+	"schema",
+	"media",
+	"terms_bylines",
+	"content",
+	"relations",
+	"presentation",
+	"rebuild",
+	"verify"
+];
+const REBUILD_STEPS = [
+	"search",
+	"media_usage",
+	"options",
+	"taxonomies",
+	"caches"
+];
+const recordKindSchema = z.enum(RECORD_KINDS);
+const nonNegativeInt = z.number().int().nonnegative();
+/** Next record to process in a package stream: chunk `seq`, zero-based `line`. */
+const streamPositionSchema = z.strictObject({
+	kind: recordKindSchema,
+	seq: nonNegativeInt,
+	line: nonNegativeInt
+});
+/** Last stream-order key processed (`depth` only for topological kinds). */
+const streamKeySchema = z.strictObject({
+	id: z.string(),
+	depth: nonNegativeInt.optional()
+});
+/**
+* Optimistic-read fence captured before an export attempt and re-checked
+* after it. `writeEpoch` is the export operation's `write_epoch` column,
+* which fenced writes bump while the export runs.
+*/
+const exportFenceSchema = z.strictObject({
+	writeEpoch: nonNegativeInt,
+	tables: z.array(z.strictObject({
+		table: z.string(),
+		count: nonNegativeInt,
+		maxChanged: z.string().optional(),
+		maxId: z.string().optional()
+	}))
+});
+const exportAttempt = z.number().int().min(1);
+const exportCursorSchema = z.discriminatedUnion("stage", [
+	z.strictObject({
+		stage: z.literal("export_records"),
+		attempt: exportAttempt,
+		fence: exportFenceSchema,
+		kind: recordKindSchema,
+		collection: z.string().optional(),
+		after: streamKeySchema.nullable(),
+		nextSeq: nonNegativeInt,
+		summary: z.json().optional()
+	}),
+	z.strictObject({
+		stage: z.literal("export_media"),
+		attempt: exportAttempt,
+		fence: exportFenceSchema,
+		afterMediaId: z.string().nullable(),
+		summary: z.json().optional()
+	}),
+	z.strictObject({
+		stage: z.literal("export_finalize"),
+		attempt: exportAttempt,
+		fence: exportFenceSchema,
+		nextIndexSeq: nonNegativeInt,
+		afterPath: z.string().nullable(),
+		summary: z.json().optional()
+	}),
+	z.strictObject({
+		stage: z.literal("export_validate"),
+		position: streamPositionSchema.nullable(),
+		validation: z.json().optional()
+	})
+]);
+const analysisCursorSchema = z.discriminatedUnion("stage", [
+	z.strictObject({
+		stage: z.literal("analyze_structure"),
+		nextIndexSeq: nonNegativeInt
+	}),
+	z.strictObject({
+		stage: z.literal("analyze_records"),
+		position: streamPositionSchema
+	}),
+	z.strictObject({
+		stage: z.literal("analyze_references"),
+		check: nonNegativeInt,
+		after: z.string().nullable()
+	}),
+	z.strictObject({ stage: z.literal("analyze_target") })
+]);
+const recordStage = (stage) => z.strictObject({
+	stage: z.literal(stage),
+	position: streamPositionSchema
+});
+const importCursorSchema = z.discriminatedUnion("stage", [
+	z.strictObject({ stage: z.literal("reserve") }),
+	z.strictObject({
+		stage: z.literal("clear_scaffold"),
+		step: nonNegativeInt
+	}),
+	recordStage("schema"),
+	recordStage("media"),
+	recordStage("terms_bylines"),
+	recordStage("content"),
+	recordStage("relations"),
+	recordStage("presentation"),
+	z.strictObject({
+		stage: z.literal("rebuild"),
+		step: z.enum(REBUILD_STEPS),
+		after: z.string().nullable()
+	}),
+	z.strictObject({
+		stage: z.literal("verify"),
+		position: streamPositionSchema.nullable(),
+		mediaAfter: z.string().nullable(),
+		mismatches: nonNegativeInt,
+		verifier: z.json().optional()
+	})
+]);
+const transferCursorSchema = z.union([
+	exportCursorSchema,
+	analysisCursorSchema,
+	importCursorSchema
+]);
+/**
+* Bounded progress summary shown by status endpoints. `done` of `total`
+* counts stages (and, for an export, record kinds). `records` is the number
+* of records an export has written so far; the byte counts cover package
+* files once they are known.
+*/
+const transferProgressSchema = z.strictObject({
+	done: nonNegativeInt,
+	total: nonNegativeInt,
+	records: nonNegativeInt.optional(),
+	bytesDone: nonNegativeInt.optional(),
+	bytesTotal: nonNegativeInt.optional()
+});
+
+//#endregion
+//#region src/transfer/ops/time.ts
+/**
+* Database-clock timestamps for transfer state. Every lease and expiry
+* comparison runs in SQL against the database clock, never a worker clock,
+* and every stored timestamp uses the sortable `YYYY-MM-DDTHH:MM:SS.sssZ`
+* form so plain string comparison orders them.
+*/
+function timestampOffset(db, seconds) {
+	if (!Number.isFinite(seconds)) throw new RangeError("Invalid timestamp offset");
+	if (isPostgres(db)) return sql`to_char(
+			clock_timestamp() AT TIME ZONE 'UTC' + (${seconds} * interval '1 second'),
+			'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
+		)`;
+	return sql`strftime('%Y-%m-%dT%H:%M:%fZ', 'now', ${`${seconds >= 0 ? "+" : ""}${seconds} seconds`})`;
+}
+function timestampNow(db) {
+	return timestampOffset(db, 0);
+}
+/** `column <= now` */
+function timestampIsDue(db, column) {
+	return isPostgres(db) ? sql`${sql.ref(column)}::timestamptz <= clock_timestamp()` : sql`${sql.ref(column)} <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
+}
+/** `column > now` */
+function timestampIsLive(db, column) {
+	return isPostgres(db) ? sql`${sql.ref(column)}::timestamptz > clock_timestamp()` : sql`${sql.ref(column)} > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
+}
+/** `column <= now - seconds` */
+function timestampIsOlderThan(db, column, seconds) {
+	if (!Number.isFinite(seconds) || seconds < 0) throw new RangeError("Invalid timestamp age");
+	return isPostgres(db) ? sql`${sql.ref(column)}::timestamptz <= clock_timestamp() - (${seconds} * interval '1 second')` : sql`${sql.ref(column)} <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', ${`-${seconds} seconds`})`;
+}
+
+//#endregion
+//#region src/transfer/ops/approvals.ts
+const APPROVAL_STATUSES = [
+	"pending",
+	"approved",
+	"denied",
+	"consumed",
+	"expired"
+];
+const STATUS_SET = new Set(APPROVAL_STATUSES);
+const ACTION_SET = new Set(TRANSFER_APPROVAL_ACTIONS);
+function isApprovalStatus(value) {
+	return STATUS_SET.has(value);
+}
+function isApprovalAction(value) {
+	return ACTION_SET.has(value);
+}
+function toApproval(row) {
+	const { status, action } = row;
+	if (!isApprovalStatus(status) || !isApprovalAction(action)) throw new TransferError("TRANSFER_APPROVAL_INVALID", "Unknown approval status or action");
+	return {
+		id: row.id,
+		status,
+		action,
+		userId: row.user_id,
+		requestedByTokenId: row.requested_by_token_id,
+		approvedBy: row.approved_by,
+		operationId: row.operation_id,
+		paramsDigest: isSha256Digest(row.params_digest) ? row.params_digest : null,
+		packageDigest: isSha256Digest(row.package_digest) ? row.package_digest : null,
+		planDigest: isSha256Digest(row.plan_digest) ? row.plan_digest : null,
+		expiresAt: row.expires_at,
+		createdAt: row.created_at,
+		decidedAt: row.decided_at,
+		consumedAt: row.consumed_at
+	};
+}
+/** Every column a grant binds besides user and action, with the value it must hold (undefined = NULL). */
+function boundColumns(binding) {
+	return [
+		["operation_id", binding.operationId],
+		["params_digest", binding.paramsDigest],
+		["package_digest", binding.packageDigest],
+		["plan_digest", binding.planDigest],
+		["requested_by_token_id", binding.tokenId]
+	];
+}
+function invalid() {
+	return new TransferError("TRANSFER_APPROVAL_INVALID", "Approval is missing, expired, or does not match");
+}
+var TransferApprovalRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	async createPending(input) {
+		if (input.action === "import" && (!input.packageDigest || !input.planDigest)) throw new TransferError("TRANSFER_APPROVAL_INVALID", "An import approval must bind a package digest and a plan digest");
+		return toApproval(await this.db.insertInto("_emdash_transfer_approvals").values({
+			id: ulid(),
+			status: "pending",
+			action: input.action,
+			user_id: input.userId,
+			requested_by_token_id: input.requestedByTokenId ?? null,
+			approved_by: null,
+			operation_id: input.operationId ?? null,
+			params_digest: input.paramsDigest ?? null,
+			package_digest: input.packageDigest ?? null,
+			plan_digest: input.planDigest ?? null,
+			expires_at: timestampOffset(this.db, input.ttlSeconds ?? TRANSFER_LIMITS.approvalTtlSeconds),
+			decided_at: null,
+			consumed_at: null
+		}).returningAll().executeTakeFirstOrThrow());
+	}
+	async get(id) {
+		const row = await this.db.selectFrom("_emdash_transfer_approvals").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? toApproval(row) : null;
+	}
+	/**
+	* Approve a pending, unexpired grant. The grant then stays usable for the
+	* approval TTL from now.
+	*/
+	async approve(id, approvedBy, options = {}) {
+		return this.decide(id, "approved", approvedBy, options.ttlSeconds);
+	}
+	async deny(id, deniedBy) {
+		return this.decide(id, "denied", deniedBy);
+	}
+	async decide(id, status, decidedBy, ttlSeconds) {
+		const now = timestampNow(this.db);
+		const row = await this.db.updateTable("_emdash_transfer_approvals").set({
+			status,
+			approved_by: decidedBy,
+			decided_at: now,
+			...status === "approved" ? { expires_at: timestampOffset(this.db, ttlSeconds ?? TRANSFER_LIMITS.approvalTtlSeconds) } : {}
+		}).where("id", "=", id).where("status", "=", "pending").where(timestampIsLive(this.db, "expires_at")).returningAll().executeTakeFirst();
+		if (!row) throw invalid();
+		return toApproval(row);
+	}
+	/**
+	* Consume an approved grant in one statement. Every digest or operation id
+	* the grant was created with must be supplied and equal; a grant created
+	* without one must be consumed without it. The same holds for the token:
+	* a grant requested by token `T` can only be consumed by a caller
+	* authenticated with `T` (pass `tokenId`), and a grant requested without a
+	* token only by a caller without one. Throws `TRANSFER_APPROVAL_INVALID`
+	* otherwise.
+	*/
+	async consume(id, binding) {
+		const now = timestampNow(this.db);
+		let query = this.db.updateTable("_emdash_transfer_approvals").set({
+			status: "consumed",
+			consumed_at: now
+		}).where("id", "=", id).where("status", "=", "approved").where(timestampIsLive(this.db, "expires_at")).where("user_id", "=", binding.userId).where("action", "=", binding.action);
+		for (const [column, value] of boundColumns(binding)) query = value === void 0 ? query.where(column, "is", null) : query.where(column, "=", value);
+		const row = await query.returningAll().executeTakeFirst();
+		if (!row) throw invalid();
+		return toApproval(row);
+	}
+	/**
+	* Return a grant `consume` took back to `approved`, for when the
+	* operation it was consumed for could not be started. Its expiry is
+	* unchanged, so an expired grant stays unusable.
+	*/
+	async restore(id) {
+		await this.db.updateTable("_emdash_transfer_approvals").set({
+			status: "approved",
+			consumed_at: null
+		}).where("id", "=", id).where("status", "=", "consumed").execute();
+	}
+	/**
+	* The newest pending, unexpired grant with exactly this binding, so a
+	* caller retrying without an approval id reuses its open request instead
+	* of adding another one for an admin to review.
+	*/
+	async findPending(binding) {
+		let query = this.db.selectFrom("_emdash_transfer_approvals").selectAll().where("status", "=", "pending").where(timestampIsLive(this.db, "expires_at")).where("user_id", "=", binding.userId).where("action", "=", binding.action);
+		for (const [column, value] of boundColumns(binding)) query = value === void 0 ? query.where(column, "is", null) : query.where(column, "=", value);
+		const row = await query.orderBy("created_at", "desc").orderBy("id", "desc").executeTakeFirst();
+		return row ? toApproval(row) : null;
+	}
+	/**
+	* Whether a grant for `action` on `operationId` was consumed by this user
+	* authenticated with this token (or, without `tokenId`, without a token).
+	*/
+	async hasConsumed(binding) {
+		let query = this.db.selectFrom("_emdash_transfer_approvals").select("id").where("status", "=", "consumed").where("user_id", "=", binding.userId).where("action", "=", binding.action).where("operation_id", "=", binding.operationId);
+		query = binding.tokenId === void 0 ? query.where("requested_by_token_id", "is", null) : query.where("requested_by_token_id", "=", binding.tokenId);
+		return await query.executeTakeFirst() !== void 0;
+	}
+	/**
+	* Record the operation a consumed export grant created. Export grants are
+	* requested before the operation exists, so they bind no operation id
+	* until they are used.
+	*/
+	async linkOperation(id, operationId) {
+		await this.db.updateTable("_emdash_transfer_approvals").set({ operation_id: operationId }).where("id", "=", id).where("status", "=", "consumed").where("action", "=", "export").where("operation_id", "is", null).execute();
+	}
+	/** Approvals newest first. */
+	async list(options = {}) {
+		const limit = Math.min(Math.max(options.limit ?? 50, 1), 100);
+		let query = this.db.selectFrom("_emdash_transfer_approvals").selectAll();
+		if (options.userId) query = query.where("user_id", "=", options.userId);
+		if (options.status) query = query.where("status", "=", options.status);
+		const cursor = options.cursor;
+		if (cursor) query = query.where((eb) => eb.or([eb("created_at", "<", cursor.createdAt), eb.and([eb("created_at", "=", cursor.createdAt), eb("id", "<", cursor.id)])]));
+		const rows = await query.orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1).execute();
+		const items = rows.slice(0, limit).map(toApproval);
+		const last = items.at(-1);
+		return rows.length > limit && last ? {
+			items,
+			next: {
+				createdAt: last.createdAt,
+				id: last.id
+			}
+		} : { items };
+	}
+	/** Mark pending and approved grants past their expiry as `expired`; returns how many. */
+	async expireDue() {
+		const result = await this.db.updateTable("_emdash_transfer_approvals").set({ status: "expired" }).where("status", "in", ["pending", "approved"]).where(timestampIsDue(this.db, "expires_at")).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0n);
+	}
+};
+
+//#endregion
+export { TRANSFER_SCOPES as S, isTerminalState as _, timestampIsOlderThan as a, transferCursorSchema as b, EXECUTING_IMPORT_STATES as c, IMPORT_STATES as d, PRE_EXECUTION_IMPORT_STATES as f, analysisCursorSchema as g, TRANSFER_RUNTIME_GENERATION as h, timestampIsLive as i, EXPORT_STATES as l, TERMINAL_IMPORT_STATES as m, TransferApprovalRepository as n, timestampNow as o, REBUILD_STEPS as p, timestampIsDue as r, timestampOffset as s, APPROVAL_STATUSES as t, IMPORT_STAGES as u, isTransferOperationKind as v, transferProgressSchema as x, isTransferOperationState as y };
+//# sourceMappingURL=approvals-DycwI6lZ.mjs.map

package/dist/approvals-DycwI6lZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-DycwI6lZ.mjs","names":[],"sources":["../src/transfer/auth.ts","../src/transfer/ops/states.ts","../src/transfer/ops/time.ts","../src/transfer/ops/approvals.ts"],"sourcesContent":["import type { Permission, TransferScope } from \"@emdash-cms/auth\";\n\nexport { TRANSFER_SCOPES, isTransferScope } from \"@emdash-cms/auth\";\nexport type { TransferScope } from \"@emdash-cms/auth\";\n\nexport type TransferAction = \"export\" | \"analyze\" | \"execute\";\n\n/** Token scope a bearer-token caller needs for each transfer action. */\nexport const TRANSFER_ACTION_SCOPE = Object.freeze({\n\texport: \"transfer:export\",\n\tanalyze: \"transfer:analyze\",\n\texecute: \"transfer:execute\",\n} as const satisfies Record<TransferAction, TransferScope>);\n\n/** RBAC permission a session caller needs for each transfer action. */\nexport const TRANSFER_ACTION_PERMISSION = Object.freeze({\n\texport: \"transfer:export\",\n\tanalyze: \"transfer:import\",\n\texecute: \"transfer:import\",\n} as const satisfies Record<TransferAction, Permission>);\n\n/** Actions an MCP approval grant can authorize. */\nexport const TRANSFER_APPROVAL_ACTIONS = [\"export\", \"import\"] as const;\n\nexport type TransferApprovalAction = (typeof TRANSFER_APPROVAL_ACTIONS)[number];\n","/**\n * Transfer operation states, stages, and typed cursors.\n *\n * Export:  pending → running → complete | failed | expired\n * Import:  uploading → analyzing → planned → running → verifying\n *          → complete | failed | cancelled | abandoned | expired\n *\n * An import \"occupies\" the target from creation until it reaches a terminal\n * state. A failed or cancelled import that already started writing\n * (`mutation_started_at` set) keeps occupying the target, and keeps site\n * writes fenced, until it is explicitly abandoned. The partial unique index\n * `idx__emdash_transfer_operations_active_import` (migration 084) enforces\n * one occupying import per target with the same predicate as\n * {@link isOccupyingImport}.\n */\n\nimport { z } from \"zod\";\n\nimport { RECORD_KINDS } from \"../format/kinds.js\";\n\nexport const TRANSFER_RUNTIME_GENERATION = 1;\n\nexport const TRANSFER_OPERATION_KINDS = [\"export\", \"import\"] as const;\nexport type TransferOperationKind = (typeof TRANSFER_OPERATION_KINDS)[number];\n\nexport const EXPORT_STATES = [\"pending\", \"running\", \"complete\", \"failed\", \"expired\"] as const;\nexport type ExportState = (typeof EXPORT_STATES)[number];\n\nexport const IMPORT_STATES = [\n\t\"uploading\",\n\t\"analyzing\",\n\t\"planned\",\n\t\"running\",\n\t\"verifying\",\n\t\"complete\",\n\t\"failed\",\n\t\"cancelled\",\n\t\"abandoned\",\n\t\"expired\",\n] as const;\nexport type ImportState = (typeof IMPORT_STATES)[number];\n\nexport type TransferOperationState = ExportState | ImportState;\n\nconst OPERATION_KINDS: ReadonlySet<string> = new Set(TRANSFER_OPERATION_KINDS);\nconst OPERATION_STATES: ReadonlySet<string> = new Set([...EXPORT_STATES, ...IMPORT_STATES]);\n\nexport function isTransferOperationKind(value: string): value is TransferOperationKind {\n\treturn OPERATION_KINDS.has(value);\n}\n\nexport function isTransferOperationState(value: string): value is TransferOperationState {\n\treturn OPERATION_STATES.has(value);\n}\n\n/** Import states before execution starts; they expire after the pending TTL. */\nexport const PRE_EXECUTION_IMPORT_STATES = [\"uploading\", \"analyzing\", \"planned\"] as const;\n\n/** Import states in which the importer is writing to the target. */\nexport const EXECUTING_IMPORT_STATES = [\"running\", \"verifying\"] as const;\n\nexport const TERMINAL_EXPORT_STATES: readonly ExportState[] = [\"complete\", \"failed\", \"expired\"];\nexport const TERMINAL_IMPORT_STATES: readonly ImportState[] = [\n\t\"complete\",\n\t\"failed\",\n\t\"cancelled\",\n\t\"abandoned\",\n\t\"expired\",\n];\n\nexport function isTerminalState(kind: TransferOperationKind, state: string): boolean {\n\treturn kind === \"export\"\n\t\t? (TERMINAL_EXPORT_STATES as readonly string[]).includes(state)\n\t\t: (TERMINAL_IMPORT_STATES as readonly string[]).includes(state);\n}\n\n/** Whether an import occupies the target (see the module comment). */\nexport function isOccupyingImport(state: string, mutationStarted: boolean): boolean {\n\tif ((PRE_EXECUTION_IMPORT_STATES as readonly string[]).includes(state)) return true;\n\tif ((EXECUTING_IMPORT_STATES as readonly string[]).includes(state)) return true;\n\treturn (state === \"failed\" || state === \"cancelled\") && mutationStarted;\n}\n\n/** Whether an import fences site writes: executing, or incomplete after writing started. */\nexport function isWriteFencingImport(state: string, mutationStarted: boolean): boolean {\n\tif ((EXECUTING_IMPORT_STATES as readonly string[]).includes(state)) return true;\n\treturn (state === \"failed\" || state === \"cancelled\") && mutationStarted;\n}\n\n// ── Stages ──────────────────────────────────────────────────────\n\nexport const EXPORT_STAGES = [\n\t\"export_records\",\n\t\"export_media\",\n\t\"export_finalize\",\n\t\"export_validate\",\n] as const;\nexport type ExportStage = (typeof EXPORT_STAGES)[number];\n\nexport const ANALYSIS_STAGES = [\n\t\"analyze_structure\",\n\t\"analyze_records\",\n\t\"analyze_references\",\n\t\"analyze_target\",\n] as const;\nexport type AnalysisStage = (typeof ANALYSIS_STAGES)[number];\n\n/**\n * Import stages in execution order. The record stages write the kinds listed\n * in `IMPORT_STAGE_KINDS` (format/kinds.ts).\n */\nexport const IMPORT_STAGES = [\n\t\"reserve\",\n\t\"clear_scaffold\",\n\t\"schema\",\n\t\"media\",\n\t\"terms_bylines\",\n\t\"content\",\n\t\"relations\",\n\t\"presentation\",\n\t\"rebuild\",\n\t\"verify\",\n] as const;\nexport type ImportStage = (typeof IMPORT_STAGES)[number];\n\nexport const REBUILD_STEPS = [\"search\", \"media_usage\", \"options\", \"taxonomies\", \"caches\"] as const;\nexport type RebuildStep = (typeof REBUILD_STEPS)[number];\n\n// ── Cursors ─────────────────────────────────────────────────────\n\nconst recordKindSchema = z.enum(RECORD_KINDS);\nconst nonNegativeInt = z.number().int().nonnegative();\n\n/** Next record to process in a package stream: chunk `seq`, zero-based `line`. */\nexport const streamPositionSchema = z.strictObject({\n\tkind: recordKindSchema,\n\tseq: nonNegativeInt,\n\tline: nonNegativeInt,\n});\nexport type StreamPosition = z.infer<typeof streamPositionSchema>;\n\n/** Last stream-order key processed (`depth` only for topological kinds). */\nexport const streamKeySchema = z.strictObject({\n\tid: z.string(),\n\tdepth: nonNegativeInt.optional(),\n});\n\n/**\n * Optimistic-read fence captured before an export attempt and re-checked\n * after it. `writeEpoch` is the export operation's `write_epoch` column,\n * which fenced writes bump while the export runs.\n */\nexport const exportFenceSchema = z.strictObject({\n\twriteEpoch: nonNegativeInt,\n\ttables: z.array(\n\t\tz.strictObject({\n\t\t\ttable: z.string(),\n\t\t\tcount: nonNegativeInt,\n\t\t\tmaxChanged: z.string().optional(),\n\t\t\tmaxId: z.string().optional(),\n\t\t}),\n\t),\n});\nexport type ExportFence = z.infer<typeof exportFenceSchema>;\n\nconst exportAttempt = z.number().int().min(1);\n\nexport const exportCursorSchema = z.discriminatedUnion(\"stage\", [\n\tz.strictObject({\n\t\tstage: z.literal(\"export_records\"),\n\t\tattempt: exportAttempt,\n\t\tfence: exportFenceSchema,\n\t\tkind: recordKindSchema,\n\t\t/** For `entry`, the collection slug being read. */\n\t\tcollection: z.string().optional(),\n\t\tafter: streamKeySchema.nullable(),\n\t\tnextSeq: nonNegativeInt,\n\t\t/** Exporter-owned running totals (see `transfer/export`). */\n\t\tsummary: z.json().optional(),\n\t}),\n\tz.strictObject({\n\t\tstage: z.literal(\"export_media\"),\n\t\tattempt: exportAttempt,\n\t\tfence: exportFenceSchema,\n\t\tafterMediaId: z.string().nullable(),\n\t\tsummary: z.json().optional(),\n\t}),\n\tz.strictObject({\n\t\tstage: z.literal(\"export_finalize\"),\n\t\tattempt: exportAttempt,\n\t\tfence: exportFenceSchema,\n\t\tnextIndexSeq: nonNegativeInt,\n\t\tafterPath: z.string().nullable(),\n\t\tsummary: z.json().optional(),\n\t}),\n\tz.strictObject({\n\t\tstage: z.literal(\"export_validate\"),\n\t\tposition: streamPositionSchema.nullable(),\n\t\t/** Exporter-owned validation progress (see `transfer/export`). */\n\t\tvalidation: z.json().optional(),\n\t}),\n]);\nexport type ExportCursor = z.infer<typeof exportCursorSchema>;\n\nexport const analysisCursorSchema = z.discriminatedUnion(\"stage\", [\n\tz.strictObject({ stage: z.literal(\"analyze_structure\"), nextIndexSeq: nonNegativeInt }),\n\tz.strictObject({ stage: z.literal(\"analyze_records\"), position: streamPositionSchema }),\n\tz.strictObject({\n\t\tstage: z.literal(\"analyze_references\"),\n\t\tcheck: nonNegativeInt,\n\t\tafter: z.string().nullable(),\n\t}),\n\tz.strictObject({ stage: z.literal(\"analyze_target\") }),\n]);\nexport type AnalysisCursor = z.infer<typeof analysisCursorSchema>;\n\nconst recordStage = <S extends string>(stage: S) =>\n\tz.strictObject({ stage: z.literal(stage), position: streamPositionSchema });\n\nexport const importCursorSchema = z.discriminatedUnion(\"stage\", [\n\tz.strictObject({ stage: z.literal(\"reserve\") }),\n\tz.strictObject({ stage: z.literal(\"clear_scaffold\"), step: nonNegativeInt }),\n\trecordStage(\"schema\"),\n\trecordStage(\"media\"),\n\trecordStage(\"terms_bylines\"),\n\trecordStage(\"content\"),\n\trecordStage(\"relations\"),\n\trecordStage(\"presentation\"),\n\tz.strictObject({\n\t\tstage: z.literal(\"rebuild\"),\n\t\tstep: z.enum(REBUILD_STEPS),\n\t\tafter: z.string().nullable(),\n\t}),\n\tz.strictObject({\n\t\tstage: z.literal(\"verify\"),\n\t\tposition: streamPositionSchema.nullable(),\n\t\tmediaAfter: z.string().nullable(),\n\t\tmismatches: nonNegativeInt,\n\t\t/** The verifier's own resumable state, stored as given. */\n\t\tverifier: z.json().optional(),\n\t}),\n]);\nexport type ImportCursor = z.infer<typeof importCursorSchema>;\n\nexport const transferCursorSchema = z.union([\n\texportCursorSchema,\n\tanalysisCursorSchema,\n\timportCursorSchema,\n]);\nexport type TransferCursor = ExportCursor | AnalysisCursor | ImportCursor;\n\n/**\n * Bounded progress summary shown by status endpoints. `done` of `total`\n * counts stages (and, for an export, record kinds). `records` is the number\n * of records an export has written so far; the byte counts cover package\n * files once they are known.\n */\nexport const transferProgressSchema = z.strictObject({\n\tdone: nonNegativeInt,\n\ttotal: nonNegativeInt,\n\trecords: nonNegativeInt.optional(),\n\tbytesDone: nonNegativeInt.optional(),\n\tbytesTotal: nonNegativeInt.optional(),\n});\nexport type TransferProgress = z.infer<typeof transferProgressSchema>;\n","/**\n * Database-clock timestamps for transfer state. Every lease and expiry\n * comparison runs in SQL against the database clock, never a worker clock,\n * and every stored timestamp uses the sortable `YYYY-MM-DDTHH:MM:SS.sssZ`\n * form so plain string comparison orders them.\n */\n\nimport { sql, type Kysely, type RawBuilder } from \"kysely\";\n\nimport { isPostgres } from \"../../database/dialect-helpers.js\";\nimport type { Database } from \"../../database/types.js\";\n\ntype AnyKysely = Kysely<Database>;\n\nexport function timestampOffset(db: AnyKysely, seconds: number): RawBuilder<string> {\n\tif (!Number.isFinite(seconds)) throw new RangeError(\"Invalid timestamp offset\");\n\tif (isPostgres(db)) {\n\t\treturn sql<string>`to_char(\n\t\t\tclock_timestamp() AT TIME ZONE 'UTC' + (${seconds} * interval '1 second'),\n\t\t\t'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'\n\t\t)`;\n\t}\n\treturn sql<string>`strftime('%Y-%m-%dT%H:%M:%fZ', 'now', ${`${seconds >= 0 ? \"+\" : \"\"}${seconds} seconds`})`;\n}\n\nexport function timestampNow(db: AnyKysely): RawBuilder<string> {\n\treturn timestampOffset(db, 0);\n}\n\n/** `column <= now` */\nexport function timestampIsDue(db: AnyKysely, column: string): RawBuilder<boolean> {\n\treturn isPostgres(db)\n\t\t? sql<boolean>`${sql.ref(column)}::timestamptz <= clock_timestamp()`\n\t\t: sql<boolean>`${sql.ref(column)} <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;\n}\n\n/** `column > now` */\nexport function timestampIsLive(db: AnyKysely, column: string): RawBuilder<boolean> {\n\treturn isPostgres(db)\n\t\t? sql<boolean>`${sql.ref(column)}::timestamptz > clock_timestamp()`\n\t\t: sql<boolean>`${sql.ref(column)} > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;\n}\n\n/** `column <= now - seconds` */\nexport function timestampIsOlderThan(\n\tdb: AnyKysely,\n\tcolumn: string,\n\tseconds: number,\n): RawBuilder<boolean> {\n\tif (!Number.isFinite(seconds) || seconds < 0) throw new RangeError(\"Invalid timestamp age\");\n\treturn isPostgres(db)\n\t\t? sql<boolean>`${sql.ref(column)}::timestamptz <= clock_timestamp() - (${seconds} * interval '1 second')`\n\t\t: sql<boolean>`${sql.ref(column)} <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', ${`-${seconds} seconds`})`;\n}\n","/**\n * One-time approval grants that let an MCP caller without a transfer scope\n * start an export or import.\n *\n * Flow: the MCP tool creates a `pending` approval and fails with\n * `TRANSFER_APPROVAL_REQUIRED { approvalId }`; an admin approves it in a\n * session (never via MCP or a token); the MCP caller retries with the\n * approval id, and `consume` atomically turns an `approved`, unexpired grant\n * whose binding matches into `consumed`; `restore` hands it back if the\n * operation then fails to start. Each grant is bound to the user it is for,\n * the action, and every digest it was created with.\n */\n\nimport type { Kysely, Selectable } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport type { Database, TransferApprovalTable } from \"../../database/types.js\";\nimport { TRANSFER_APPROVAL_ACTIONS, type TransferApprovalAction } from \"../auth.js\";\nimport { TransferError } from \"../errors.js\";\nimport { isSha256Digest, type Sha256Digest } from \"../format/digest.js\";\nimport { TRANSFER_LIMITS } from \"../format/limits.js\";\nimport { timestampIsDue, timestampIsLive, timestampNow, timestampOffset } from \"./time.js\";\n\nexport const APPROVAL_STATUSES = [\"pending\", \"approved\", \"denied\", \"consumed\", \"expired\"] as const;\nexport type ApprovalStatus = (typeof APPROVAL_STATUSES)[number];\n\nexport interface TransferApproval {\n\tid: string;\n\tstatus: ApprovalStatus;\n\taction: TransferApprovalAction;\n\tuserId: string;\n\trequestedByTokenId: string | null;\n\tapprovedBy: string | null;\n\toperationId: string | null;\n\tparamsDigest: Sha256Digest | null;\n\tpackageDigest: Sha256Digest | null;\n\tplanDigest: Sha256Digest | null;\n\texpiresAt: string;\n\tcreatedAt: string;\n\tdecidedAt: string | null;\n\tconsumedAt: string | null;\n}\n\nexport interface ApprovalBinding {\n\tuserId: string;\n\taction: TransferApprovalAction;\n\toperationId?: string;\n\tparamsDigest?: Sha256Digest;\n\tpackageDigest?: Sha256Digest;\n\tplanDigest?: Sha256Digest;\n}\n\nconst STATUS_SET: ReadonlySet<string> = new Set(APPROVAL_STATUSES);\nconst ACTION_SET: ReadonlySet<string> = new Set(TRANSFER_APPROVAL_ACTIONS);\n\nfunction isApprovalStatus(value: string): value is ApprovalStatus {\n\treturn STATUS_SET.has(value);\n}\n\nfunction isApprovalAction(value: string): value is TransferApprovalAction {\n\treturn ACTION_SET.has(value);\n}\n\nfunction toApproval(row: Selectable<TransferApprovalTable>): TransferApproval {\n\tconst { status, action } = row;\n\tif (!isApprovalStatus(status) || !isApprovalAction(action)) {\n\t\tthrow new TransferError(\"TRANSFER_APPROVAL_INVALID\", \"Unknown approval status or action\");\n\t}\n\treturn {\n\t\tid: row.id,\n\t\tstatus,\n\t\taction,\n\t\tuserId: row.user_id,\n\t\trequestedByTokenId: row.requested_by_token_id,\n\t\tapprovedBy: row.approved_by,\n\t\toperationId: row.operation_id,\n\t\tparamsDigest: isSha256Digest(row.params_digest) ? row.params_digest : null,\n\t\tpackageDigest: isSha256Digest(row.package_digest) ? row.package_digest : null,\n\t\tplanDigest: isSha256Digest(row.plan_digest) ? row.plan_digest : null,\n\t\texpiresAt: row.expires_at,\n\t\tcreatedAt: row.created_at,\n\t\tdecidedAt: row.decided_at,\n\t\tconsumedAt: row.consumed_at,\n\t};\n}\n\ntype BoundColumn =\n\t| \"operation_id\"\n\t| \"params_digest\"\n\t| \"package_digest\"\n\t| \"plan_digest\"\n\t| \"requested_by_token_id\";\n\n/** Every column a grant binds besides user and action, with the value it must hold (undefined = NULL). */\nfunction boundColumns(\n\tbinding: ApprovalBinding & { tokenId?: string },\n): ReadonlyArray<readonly [BoundColumn, string | undefined]> {\n\treturn [\n\t\t[\"operation_id\", binding.operationId],\n\t\t[\"params_digest\", binding.paramsDigest],\n\t\t[\"package_digest\", binding.packageDigest],\n\t\t[\"plan_digest\", binding.planDigest],\n\t\t[\"requested_by_token_id\", binding.tokenId],\n\t];\n}\n\nfunction invalid(): TransferError {\n\treturn new TransferError(\n\t\t\"TRANSFER_APPROVAL_INVALID\",\n\t\t\"Approval is missing, expired, or does not match\",\n\t);\n}\n\nexport class TransferApprovalRepository {\n\tconstructor(private readonly db: Kysely<Database>) {}\n\n\tasync createPending(\n\t\tinput: ApprovalBinding & { requestedByTokenId?: string; ttlSeconds?: number },\n\t): Promise<TransferApproval> {\n\t\tif (input.action === \"import\" && (!input.packageDigest || !input.planDigest)) {\n\t\t\tthrow new TransferError(\n\t\t\t\t\"TRANSFER_APPROVAL_INVALID\",\n\t\t\t\t\"An import approval must bind a package digest and a plan digest\",\n\t\t\t);\n\t\t}\n\t\tconst row = await this.db\n\t\t\t.insertInto(\"_emdash_transfer_approvals\")\n\t\t\t.values({\n\t\t\t\tid: ulid(),\n\t\t\t\tstatus: \"pending\",\n\t\t\t\taction: input.action,\n\t\t\t\tuser_id: input.userId,\n\t\t\t\trequested_by_token_id: input.requestedByTokenId ?? null,\n\t\t\t\tapproved_by: null,\n\t\t\t\toperation_id: input.operationId ?? null,\n\t\t\t\tparams_digest: input.paramsDigest ?? null,\n\t\t\t\tpackage_digest: input.packageDigest ?? null,\n\t\t\t\tplan_digest: input.planDigest ?? null,\n\t\t\t\texpires_at: timestampOffset(\n\t\t\t\t\tthis.db,\n\t\t\t\t\tinput.ttlSeconds ?? TRANSFER_LIMITS.approvalTtlSeconds,\n\t\t\t\t),\n\t\t\t\tdecided_at: null,\n\t\t\t\tconsumed_at: null,\n\t\t\t})\n\t\t\t.returningAll()\n\t\t\t.executeTakeFirstOrThrow();\n\t\treturn toApproval(row);\n\t}\n\n\tasync get(id: string): Promise<TransferApproval | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"_emdash_transfer_approvals\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn row ? toApproval(row) : null;\n\t}\n\n\t/**\n\t * Approve a pending, unexpired grant. The grant then stays usable for the\n\t * approval TTL from now.\n\t */\n\tasync approve(\n\t\tid: string,\n\t\tapprovedBy: string,\n\t\toptions: { ttlSeconds?: number } = {},\n\t): Promise<TransferApproval> {\n\t\treturn this.decide(id, \"approved\", approvedBy, options.ttlSeconds);\n\t}\n\n\tasync deny(id: string, deniedBy: string): Promise<TransferApproval> {\n\t\treturn this.decide(id, \"denied\", deniedBy);\n\t}\n\n\tprivate async decide(\n\t\tid: string,\n\t\tstatus: \"approved\" | \"denied\",\n\t\tdecidedBy: string,\n\t\tttlSeconds?: number,\n\t): Promise<TransferApproval> {\n\t\tconst now = timestampNow(this.db);\n\t\tconst row = await this.db\n\t\t\t.updateTable(\"_emdash_transfer_approvals\")\n\t\t\t.set({\n\t\t\t\tstatus,\n\t\t\t\tapproved_by: decidedBy,\n\t\t\t\tdecided_at: now,\n\t\t\t\t...(status === \"approved\"\n\t\t\t\t\t? {\n\t\t\t\t\t\t\texpires_at: timestampOffset(\n\t\t\t\t\t\t\t\tthis.db,\n\t\t\t\t\t\t\t\tttlSeconds ?? TRANSFER_LIMITS.approvalTtlSeconds,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t})\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.where(\"status\", \"=\", \"pending\")\n\t\t\t.where(timestampIsLive(this.db, \"expires_at\"))\n\t\t\t.returningAll()\n\t\t\t.executeTakeFirst();\n\t\tif (!row) throw invalid();\n\t\treturn toApproval(row);\n\t}\n\n\t/**\n\t * Consume an approved grant in one statement. Every digest or operation id\n\t * the grant was created with must be supplied and equal; a grant created\n\t * without one must be consumed without it. The same holds for the token:\n\t * a grant requested by token `T` can only be consumed by a caller\n\t * authenticated with `T` (pass `tokenId`), and a grant requested without a\n\t * token only by a caller without one. Throws `TRANSFER_APPROVAL_INVALID`\n\t * otherwise.\n\t */\n\tasync consume(\n\t\tid: string,\n\t\tbinding: ApprovalBinding & { tokenId?: string },\n\t): Promise<TransferApproval> {\n\t\tconst now = timestampNow(this.db);\n\t\tlet query = this.db\n\t\t\t.updateTable(\"_emdash_transfer_approvals\")\n\t\t\t.set({ status: \"consumed\", consumed_at: now })\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.where(\"status\", \"=\", \"approved\")\n\t\t\t.where(timestampIsLive(this.db, \"expires_at\"))\n\t\t\t.where(\"user_id\", \"=\", binding.userId)\n\t\t\t.where(\"action\", \"=\", binding.action);\n\t\tfor (const [column, value] of boundColumns(binding)) {\n\t\t\tquery =\n\t\t\t\tvalue === undefined ? query.where(column, \"is\", null) : query.where(column, \"=\", value);\n\t\t}\n\t\tconst row = await query.returningAll().executeTakeFirst();\n\t\tif (!row) throw invalid();\n\t\treturn toApproval(row);\n\t}\n\n\t/**\n\t * Return a grant `consume` took back to `approved`, for when the\n\t * operation it was consumed for could not be started. Its expiry is\n\t * unchanged, so an expired grant stays unusable.\n\t */\n\tasync restore(id: string): Promise<void> {\n\t\tawait this.db\n\t\t\t.updateTable(\"_emdash_transfer_approvals\")\n\t\t\t.set({ status: \"approved\", consumed_at: null })\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.where(\"status\", \"=\", \"consumed\")\n\t\t\t.execute();\n\t}\n\n\t/**\n\t * The newest pending, unexpired grant with exactly this binding, so a\n\t * caller retrying without an approval id reuses its open request instead\n\t * of adding another one for an admin to review.\n\t */\n\tasync findPending(\n\t\tbinding: ApprovalBinding & { tokenId?: string },\n\t): Promise<TransferApproval | null> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"_emdash_transfer_approvals\")\n\t\t\t.selectAll()\n\t\t\t.where(\"status\", \"=\", \"pending\")\n\t\t\t.where(timestampIsLive(this.db, \"expires_at\"))\n\t\t\t.where(\"user_id\", \"=\", binding.userId)\n\t\t\t.where(\"action\", \"=\", binding.action);\n\t\tfor (const [column, value] of boundColumns(binding)) {\n\t\t\tquery =\n\t\t\t\tvalue === undefined ? query.where(column, \"is\", null) : query.where(column, \"=\", value);\n\t\t}\n\t\tconst row = await query.orderBy(\"created_at\", \"desc\").orderBy(\"id\", \"desc\").executeTakeFirst();\n\t\treturn row ? toApproval(row) : null;\n\t}\n\n\t/**\n\t * Whether a grant for `action` on `operationId` was consumed by this user\n\t * authenticated with this token (or, without `tokenId`, without a token).\n\t */\n\tasync hasConsumed(binding: {\n\t\tuserId: string;\n\t\taction: TransferApprovalAction;\n\t\toperationId: string;\n\t\ttokenId?: string;\n\t}): Promise<boolean> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"_emdash_transfer_approvals\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"status\", \"=\", \"consumed\")\n\t\t\t.where(\"user_id\", \"=\", binding.userId)\n\t\t\t.where(\"action\", \"=\", binding.action)\n\t\t\t.where(\"operation_id\", \"=\", binding.operationId);\n\t\tquery =\n\t\t\tbinding.tokenId === undefined\n\t\t\t\t? query.where(\"requested_by_token_id\", \"is\", null)\n\t\t\t\t: query.where(\"requested_by_token_id\", \"=\", binding.tokenId);\n\t\treturn (await query.executeTakeFirst()) !== undefined;\n\t}\n\n\t/**\n\t * Record the operation a consumed export grant created. Export grants are\n\t * requested before the operation exists, so they bind no operation id\n\t * until they are used.\n\t */\n\tasync linkOperation(id: string, operationId: string): Promise<void> {\n\t\tawait this.db\n\t\t\t.updateTable(\"_emdash_transfer_approvals\")\n\t\t\t.set({ operation_id: operationId })\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.where(\"status\", \"=\", \"consumed\")\n\t\t\t.where(\"action\", \"=\", \"export\")\n\t\t\t.where(\"operation_id\", \"is\", null)\n\t\t\t.execute();\n\t}\n\n\t/** Approvals newest first. */\n\tasync list(\n\t\toptions: {\n\t\t\tuserId?: string;\n\t\t\tstatus?: ApprovalStatus;\n\t\t\tlimit?: number;\n\t\t\tcursor?: { createdAt: string; id: string };\n\t\t} = {},\n\t): Promise<{ items: TransferApproval[]; next?: { createdAt: string; id: string } }> {\n\t\tconst limit = Math.min(Math.max(options.limit ?? 50, 1), 100);\n\t\tlet query = this.db.selectFrom(\"_emdash_transfer_approvals\").selectAll();\n\t\tif (options.userId) query = query.where(\"user_id\", \"=\", options.userId);\n\t\tif (options.status) query = query.where(\"status\", \"=\", options.status);\n\t\tconst cursor = options.cursor;\n\t\tif (cursor) {\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"created_at\", \"<\", cursor.createdAt),\n\t\t\t\t\teb.and([eb(\"created_at\", \"=\", cursor.createdAt), eb(\"id\", \"<\", cursor.id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\t\tconst rows = await query\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.orderBy(\"id\", \"desc\")\n\t\t\t.limit(limit + 1)\n\t\t\t.execute();\n\t\tconst items = rows.slice(0, limit).map(toApproval);\n\t\tconst last = items.at(-1);\n\t\treturn rows.length > limit && last\n\t\t\t? { items, next: { createdAt: last.createdAt, id: last.id } }\n\t\t\t: { items };\n\t}\n\n\t/** Mark pending and approved grants past their expiry as `expired`; returns how many. */\n\tasync expireDue(): Promise<number> {\n\t\tconst result = await this.db\n\t\t\t.updateTable(\"_emdash_transfer_approvals\")\n\t\t\t.set({ status: \"expired\" })\n\t\t\t.where(\"status\", \"in\", [\"pending\", \"approved\"])\n\t\t\t.where(timestampIsDue(this.db, \"expires_at\"))\n\t\t\t.executeTakeFirst();\n\t\treturn Number(result.numUpdatedRows ?? 0n);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AAQA,MAAa,wBAAwB,OAAO,OAAO;CAClD,QAAQ;CACR,SAAS;CACT,SAAS;CACT,CAA0D;;AAG3D,MAAa,6BAA6B,OAAO,OAAO;CACvD,QAAQ;CACR,SAAS;CACT,SAAS;CACT,CAAuD;;AAGxD,MAAa,4BAA4B,CAAC,UAAU,SAAS;;;;;;;;;;;;;;;;;;;ACF7D,MAAa,8BAA8B;AAE3C,MAAa,2BAA2B,CAAC,UAAU,SAAS;AAG5D,MAAa,gBAAgB;CAAC;CAAW;CAAW;CAAY;CAAU;CAAU;AAGpF,MAAa,gBAAgB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAKD,MAAM,kBAAuC,IAAI,IAAI,yBAAyB;AAC9E,MAAM,mBAAwC,IAAI,IAAI,CAAC,GAAG,eAAe,GAAG,cAAc,CAAC;AAE3F,SAAgB,wBAAwB,OAA+C;AACtF,QAAO,gBAAgB,IAAI,MAAM;;AAGlC,SAAgB,yBAAyB,OAAgD;AACxF,QAAO,iBAAiB,IAAI,MAAM;;;AAInC,MAAa,8BAA8B;CAAC;CAAa;CAAa;CAAU;;AAGhF,MAAa,0BAA0B,CAAC,WAAW,YAAY;AAE/D,MAAa,yBAAiD;CAAC;CAAY;CAAU;CAAU;AAC/F,MAAa,yBAAiD;CAC7D;CACA;CACA;CACA;CACA;CACA;AAED,SAAgB,gBAAgB,MAA6B,OAAwB;AACpF,QAAO,SAAS,WACZ,uBAA6C,SAAS,MAAM,GAC5D,uBAA6C,SAAS,MAAM;;;;;;AAsCjE,MAAa,gBAAgB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAGD,MAAa,gBAAgB;CAAC;CAAU;CAAe;CAAW;CAAc;CAAS;AAKzF,MAAM,mBAAmB,EAAE,KAAK,aAAa;AAC7C,MAAM,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;;AAGrD,MAAa,uBAAuB,EAAE,aAAa;CAClD,MAAM;CACN,KAAK;CACL,MAAM;CACN,CAAC;;AAIF,MAAa,kBAAkB,EAAE,aAAa;CAC7C,IAAI,EAAE,QAAQ;CACd,OAAO,eAAe,UAAU;CAChC,CAAC;;;;;;AAOF,MAAa,oBAAoB,EAAE,aAAa;CAC/C,YAAY;CACZ,QAAQ,EAAE,MACT,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ;EACjB,OAAO;EACP,YAAY,EAAE,QAAQ,CAAC,UAAU;EACjC,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,CAAC,CACF;CACD,CAAC;AAGF,MAAM,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE;AAE7C,MAAa,qBAAqB,EAAE,mBAAmB,SAAS;CAC/D,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ,iBAAiB;EAClC,SAAS;EACT,OAAO;EACP,MAAM;EAEN,YAAY,EAAE,QAAQ,CAAC,UAAU;EACjC,OAAO,gBAAgB,UAAU;EACjC,SAAS;EAET,SAAS,EAAE,MAAM,CAAC,UAAU;EAC5B,CAAC;CACF,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ,eAAe;EAChC,SAAS;EACT,OAAO;EACP,cAAc,EAAE,QAAQ,CAAC,UAAU;EACnC,SAAS,EAAE,MAAM,CAAC,UAAU;EAC5B,CAAC;CACF,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ,kBAAkB;EACnC,SAAS;EACT,OAAO;EACP,cAAc;EACd,WAAW,EAAE,QAAQ,CAAC,UAAU;EAChC,SAAS,EAAE,MAAM,CAAC,UAAU;EAC5B,CAAC;CACF,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ,kBAAkB;EACnC,UAAU,qBAAqB,UAAU;EAEzC,YAAY,EAAE,MAAM,CAAC,UAAU;EAC/B,CAAC;CACF,CAAC;AAGF,MAAa,uBAAuB,EAAE,mBAAmB,SAAS;CACjE,EAAE,aAAa;EAAE,OAAO,EAAE,QAAQ,oBAAoB;EAAE,cAAc;EAAgB,CAAC;CACvF,EAAE,aAAa;EAAE,OAAO,EAAE,QAAQ,kBAAkB;EAAE,UAAU;EAAsB,CAAC;CACvF,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ,qBAAqB;EACtC,OAAO;EACP,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,CAAC;CACF,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,iBAAiB,EAAE,CAAC;CACtD,CAAC;AAGF,MAAM,eAAiC,UACtC,EAAE,aAAa;CAAE,OAAO,EAAE,QAAQ,MAAM;CAAE,UAAU;CAAsB,CAAC;AAE5E,MAAa,qBAAqB,EAAE,mBAAmB,SAAS;CAC/D,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,UAAU,EAAE,CAAC;CAC/C,EAAE,aAAa;EAAE,OAAO,EAAE,QAAQ,iBAAiB;EAAE,MAAM;EAAgB,CAAC;CAC5E,YAAY,SAAS;CACrB,YAAY,QAAQ;CACpB,YAAY,gBAAgB;CAC5B,YAAY,UAAU;CACtB,YAAY,YAAY;CACxB,YAAY,eAAe;CAC3B,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ,UAAU;EAC3B,MAAM,EAAE,KAAK,cAAc;EAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,CAAC;CACF,EAAE,aAAa;EACd,OAAO,EAAE,QAAQ,SAAS;EAC1B,UAAU,qBAAqB,UAAU;EACzC,YAAY,EAAE,QAAQ,CAAC,UAAU;EACjC,YAAY;EAEZ,UAAU,EAAE,MAAM,CAAC,UAAU;EAC7B,CAAC;CACF,CAAC;AAGF,MAAa,uBAAuB,EAAE,MAAM;CAC3C;CACA;CACA;CACA,CAAC;;;;;;;AASF,MAAa,yBAAyB,EAAE,aAAa;CACpD,MAAM;CACN,OAAO;CACP,SAAS,eAAe,UAAU;CAClC,WAAW,eAAe,UAAU;CACpC,YAAY,eAAe,UAAU;CACrC,CAAC;;;;;;;;;;ACzPF,SAAgB,gBAAgB,IAAe,SAAqC;AACnF,KAAI,CAAC,OAAO,SAAS,QAAQ,CAAE,OAAM,IAAI,WAAW,2BAA2B;AAC/E,KAAI,WAAW,GAAG,CACjB,QAAO,GAAW;6CACyB,QAAQ;;;AAIpD,QAAO,GAAW,yCAAyC,GAAG,WAAW,IAAI,MAAM,KAAK,QAAQ,UAAU;;AAG3G,SAAgB,aAAa,IAAmC;AAC/D,QAAO,gBAAgB,IAAI,EAAE;;;AAI9B,SAAgB,eAAe,IAAe,QAAqC;AAClF,QAAO,WAAW,GAAG,GAClB,GAAY,GAAG,IAAI,IAAI,OAAO,CAAC,sCAC/B,GAAY,GAAG,IAAI,IAAI,OAAO,CAAC;;;AAInC,SAAgB,gBAAgB,IAAe,QAAqC;AACnF,QAAO,WAAW,GAAG,GAClB,GAAY,GAAG,IAAI,IAAI,OAAO,CAAC,qCAC/B,GAAY,GAAG,IAAI,IAAI,OAAO,CAAC;;;AAInC,SAAgB,qBACf,IACA,QACA,SACsB;AACtB,KAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,UAAU,EAAG,OAAM,IAAI,WAAW,wBAAwB;AAC3F,QAAO,WAAW,GAAG,GAClB,GAAY,GAAG,IAAI,IAAI,OAAO,CAAC,wCAAwC,QAAQ,2BAC/E,GAAY,GAAG,IAAI,IAAI,OAAO,CAAC,4CAA4C,IAAI,QAAQ,UAAU;;;;;AC7BrG,MAAa,oBAAoB;CAAC;CAAW;CAAY;CAAU;CAAY;CAAU;AA6BzF,MAAM,aAAkC,IAAI,IAAI,kBAAkB;AAClE,MAAM,aAAkC,IAAI,IAAI,0BAA0B;AAE1E,SAAS,iBAAiB,OAAwC;AACjE,QAAO,WAAW,IAAI,MAAM;;AAG7B,SAAS,iBAAiB,OAAgD;AACzE,QAAO,WAAW,IAAI,MAAM;;AAG7B,SAAS,WAAW,KAA0D;CAC7E,MAAM,EAAE,QAAQ,WAAW;AAC3B,KAAI,CAAC,iBAAiB,OAAO,IAAI,CAAC,iBAAiB,OAAO,CACzD,OAAM,IAAI,cAAc,6BAA6B,oCAAoC;AAE1F,QAAO;EACN,IAAI,IAAI;EACR;EACA;EACA,QAAQ,IAAI;EACZ,oBAAoB,IAAI;EACxB,YAAY,IAAI;EAChB,aAAa,IAAI;EACjB,cAAc,eAAe,IAAI,cAAc,GAAG,IAAI,gBAAgB;EACtE,eAAe,eAAe,IAAI,eAAe,GAAG,IAAI,iBAAiB;EACzE,YAAY,eAAe,IAAI,YAAY,GAAG,IAAI,cAAc;EAChE,WAAW,IAAI;EACf,WAAW,IAAI;EACf,WAAW,IAAI;EACf,YAAY,IAAI;EAChB;;;AAWF,SAAS,aACR,SAC4D;AAC5D,QAAO;EACN,CAAC,gBAAgB,QAAQ,YAAY;EACrC,CAAC,iBAAiB,QAAQ,aAAa;EACvC,CAAC,kBAAkB,QAAQ,cAAc;EACzC,CAAC,eAAe,QAAQ,WAAW;EACnC,CAAC,yBAAyB,QAAQ,QAAQ;EAC1C;;AAGF,SAAS,UAAyB;AACjC,QAAO,IAAI,cACV,6BACA,kDACA;;AAGF,IAAa,6BAAb,MAAwC;CACvC,YAAY,AAAiB,IAAsB;EAAtB;;CAE7B,MAAM,cACL,OAC4B;AAC5B,MAAI,MAAM,WAAW,aAAa,CAAC,MAAM,iBAAiB,CAAC,MAAM,YAChE,OAAM,IAAI,cACT,6BACA,kEACA;AAwBF,SAAO,WAtBK,MAAM,KAAK,GACrB,WAAW,6BAA6B,CACxC,OAAO;GACP,IAAI,MAAM;GACV,QAAQ;GACR,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,uBAAuB,MAAM,sBAAsB;GACnD,aAAa;GACb,cAAc,MAAM,eAAe;GACnC,eAAe,MAAM,gBAAgB;GACrC,gBAAgB,MAAM,iBAAiB;GACvC,aAAa,MAAM,cAAc;GACjC,YAAY,gBACX,KAAK,IACL,MAAM,cAAc,gBAAgB,mBACpC;GACD,YAAY;GACZ,aAAa;GACb,CAAC,CACD,cAAc,CACd,yBAAyB,CACL;;CAGvB,MAAM,IAAI,IAA8C;EACvD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,6BAA6B,CACxC,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AACpB,SAAO,MAAM,WAAW,IAAI,GAAG;;;;;;CAOhC,MAAM,QACL,IACA,YACA,UAAmC,EAAE,EACT;AAC5B,SAAO,KAAK,OAAO,IAAI,YAAY,YAAY,QAAQ,WAAW;;CAGnE,MAAM,KAAK,IAAY,UAA6C;AACnE,SAAO,KAAK,OAAO,IAAI,UAAU,SAAS;;CAG3C,MAAc,OACb,IACA,QACA,WACA,YAC4B;EAC5B,MAAM,MAAM,aAAa,KAAK,GAAG;EACjC,MAAM,MAAM,MAAM,KAAK,GACrB,YAAY,6BAA6B,CACzC,IAAI;GACJ;GACA,aAAa;GACb,YAAY;GACZ,GAAI,WAAW,aACZ,EACA,YAAY,gBACX,KAAK,IACL,cAAc,gBAAgB,mBAC9B,EACD,GACA,EAAE;GACL,CAAC,CACD,MAAM,MAAM,KAAK,GAAG,CACpB,MAAM,UAAU,KAAK,UAAU,CAC/B,MAAM,gBAAgB,KAAK,IAAI,aAAa,CAAC,CAC7C,cAAc,CACd,kBAAkB;AACpB,MAAI,CAAC,IAAK,OAAM,SAAS;AACzB,SAAO,WAAW,IAAI;;;;;;;;;;;CAYvB,MAAM,QACL,IACA,SAC4B;EAC5B,MAAM,MAAM,aAAa,KAAK,GAAG;EACjC,IAAI,QAAQ,KAAK,GACf,YAAY,6BAA6B,CACzC,IAAI;GAAE,QAAQ;GAAY,aAAa;GAAK,CAAC,CAC7C,MAAM,MAAM,KAAK,GAAG,CACpB,MAAM,UAAU,KAAK,WAAW,CAChC,MAAM,gBAAgB,KAAK,IAAI,aAAa,CAAC,CAC7C,MAAM,WAAW,KAAK,QAAQ,OAAO,CACrC,MAAM,UAAU,KAAK,QAAQ,OAAO;AACtC,OAAK,MAAM,CAAC,QAAQ,UAAU,aAAa,QAAQ,CAClD,SACC,UAAU,SAAY,MAAM,MAAM,QAAQ,MAAM,KAAK,GAAG,MAAM,MAAM,QAAQ,KAAK,MAAM;EAEzF,MAAM,MAAM,MAAM,MAAM,cAAc,CAAC,kBAAkB;AACzD,MAAI,CAAC,IAAK,OAAM,SAAS;AACzB,SAAO,WAAW,IAAI;;;;;;;CAQvB,MAAM,QAAQ,IAA2B;AACxC,QAAM,KAAK,GACT,YAAY,6BAA6B,CACzC,IAAI;GAAE,QAAQ;GAAY,aAAa;GAAM,CAAC,CAC9C,MAAM,MAAM,KAAK,GAAG,CACpB,MAAM,UAAU,KAAK,WAAW,CAChC,SAAS;;;;;;;CAQZ,MAAM,YACL,SACmC;EACnC,IAAI,QAAQ,KAAK,GACf,WAAW,6BAA6B,CACxC,WAAW,CACX,MAAM,UAAU,KAAK,UAAU,CAC/B,MAAM,gBAAgB,KAAK,IAAI,aAAa,CAAC,CAC7C,MAAM,WAAW,KAAK,QAAQ,OAAO,CACrC,MAAM,UAAU,KAAK,QAAQ,OAAO;AACtC,OAAK,MAAM,CAAC,QAAQ,UAAU,aAAa,QAAQ,CAClD,SACC,UAAU,SAAY,MAAM,MAAM,QAAQ,MAAM,KAAK,GAAG,MAAM,MAAM,QAAQ,KAAK,MAAM;EAEzF,MAAM,MAAM,MAAM,MAAM,QAAQ,cAAc,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,kBAAkB;AAC9F,SAAO,MAAM,WAAW,IAAI,GAAG;;;;;;CAOhC,MAAM,YAAY,SAKG;EACpB,IAAI,QAAQ,KAAK,GACf,WAAW,6BAA6B,CACxC,OAAO,KAAK,CACZ,MAAM,UAAU,KAAK,WAAW,CAChC,MAAM,WAAW,KAAK,QAAQ,OAAO,CACrC,MAAM,UAAU,KAAK,QAAQ,OAAO,CACpC,MAAM,gBAAgB,KAAK,QAAQ,YAAY;AACjD,UACC,QAAQ,YAAY,SACjB,MAAM,MAAM,yBAAyB,MAAM,KAAK,GAChD,MAAM,MAAM,yBAAyB,KAAK,QAAQ,QAAQ;AAC9D,SAAQ,MAAM,MAAM,kBAAkB,KAAM;;;;;;;CAQ7C,MAAM,cAAc,IAAY,aAAoC;AACnE,QAAM,KAAK,GACT,YAAY,6BAA6B,CACzC,IAAI,EAAE,cAAc,aAAa,CAAC,CAClC,MAAM,MAAM,KAAK,GAAG,CACpB,MAAM,UAAU,KAAK,WAAW,CAChC,MAAM,UAAU,KAAK,SAAS,CAC9B,MAAM,gBAAgB,MAAM,KAAK,CACjC,SAAS;;;CAIZ,MAAM,KACL,UAKI,EAAE,EAC6E;EACnF,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,QAAQ,SAAS,IAAI,EAAE,EAAE,IAAI;EAC7D,IAAI,QAAQ,KAAK,GAAG,WAAW,6BAA6B,CAAC,WAAW;AACxE,MAAI,QAAQ,OAAQ,SAAQ,MAAM,MAAM,WAAW,KAAK,QAAQ,OAAO;AACvE,MAAI,QAAQ,OAAQ,SAAQ,MAAM,MAAM,UAAU,KAAK,QAAQ,OAAO;EACtE,MAAM,SAAS,QAAQ;AACvB,MAAI,OACH,SAAQ,MAAM,OAAO,OACpB,GAAG,GAAG,CACL,GAAG,cAAc,KAAK,OAAO,UAAU,EACvC,GAAG,IAAI,CAAC,GAAG,cAAc,KAAK,OAAO,UAAU,EAAE,GAAG,MAAM,KAAK,OAAO,GAAG,CAAC,CAAC,CAC3E,CAAC,CACF;EAEF,MAAM,OAAO,MAAM,MACjB,QAAQ,cAAc,OAAO,CAC7B,QAAQ,MAAM,OAAO,CACrB,MAAM,QAAQ,EAAE,CAChB,SAAS;EACX,MAAM,QAAQ,KAAK,MAAM,GAAG,MAAM,CAAC,IAAI,WAAW;EAClD,MAAM,OAAO,MAAM,GAAG,GAAG;AACzB,SAAO,KAAK,SAAS,SAAS,OAC3B;GAAE;GAAO,MAAM;IAAE,WAAW,KAAK;IAAW,IAAI,KAAK;IAAI;GAAE,GAC3D,EAAE,OAAO;;;CAIb,MAAM,YAA6B;EAClC,MAAM,SAAS,MAAM,KAAK,GACxB,YAAY,6BAA6B,CACzC,IAAI,EAAE,QAAQ,WAAW,CAAC,CAC1B,MAAM,UAAU,MAAM,CAAC,WAAW,WAAW,CAAC,CAC9C,MAAM,eAAe,KAAK,IAAI,aAAa,CAAC,CAC5C,kBAAkB;AACpB,SAAO,OAAO,OAAO,kBAAkB,GAAG"}