permdock 0.1.0 → 0.2.0

package/dist/helpers-DnSOrhB9.js

@@ -1,682 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { s as getRegistry } from "./permissions-DC7GROPA.js";
-import { t as flattenApprovers } from "./approvers-aH0PJkmf.js";
-import { o as rootMembershipId } from "./scopes-cKVp_WTw.js";
-import { l as matchGrantee } from "./grantee-Bv04_Vzf.js";
-import { t as describe } from "./describe-Bt1YD5uS.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { i as relationReader, n as pendingRelations, o as resolveRelated } from "./relations-r4soIFZB.js";
-import { t as ApprovalError } from "./errors-m3u9TmDu.js";
-//#region src/approvals/types.ts
-const APPROVAL_HEADER = "PermDock-Approval";
-const DEFAULT_APPROVAL_TTL_MS = 36e5;
-/** The approvals a request needs in total: `approvers.quorum` (or 1), or the sum of its stages' quorums. */
-function approvalQuorum(request) {
-	const stages = request.approvers?.stages;
-	if (stages !== void 0) return stages.reduce((sum, stage) => sum + (stage.quorum ?? 1), 0);
-	return request.approvers?.quorum ?? 1;
-}
-/**
-* The instant from which `approvers.escalation.to` may approve, in epoch
-* milliseconds, or `undefined` when the request has no escalation or its
-* `after` does not parse (then nobody escalates: fail-closed).
-*/
-function escalationOpenAt(request) {
-	const after = request.approvers?.escalation?.after;
-	const seconds = parseDuration(after);
-	if (seconds === void 0) return;
-	return Date.parse(request.createdAt) + seconds * 1e3;
-}
-/** The key a verdict's `relations` lists a relation approver under. */
-function approverRelationKey(item) {
-	return JSON.stringify([
-		item.resource,
-		item.relation,
-		item.through ?? null,
-		item.depth ?? null
-	]);
-}
-//#endregion
-//#region src/approvals/relations.ts
-const DEFAULT_PARENT_DEPTH = 16;
-/** Reads until nothing is in flight: each round loads one more layer of facts. */
-async function settled(read, unread, cache) {
-	for (;;) {
-		const value = read();
-		if (!unread(value)) return value;
-		const pending = pendingRelations(cache);
-		if (pending.length === 0) return value;
-		await Promise.all(pending);
-	}
-}
-/** The id of `item.resource` the walk starts from, after following `through` links. */
-async function startOf(item, resource, id, reader, cache, registry) {
-	if (!Array.isArray(item.through)) return resource === item.resource ? id : void 0;
-	let current = resource;
-	let at = id;
-	for (const link of item.through) {
-		const node = registry.get(current);
-		const target = node !== void 0 && Object.hasOwn(node.links, link) ? node.links[link] : void 0;
-		if (target === void 0) return;
-		const query = {
-			resource: current,
-			id: at,
-			depth: 1,
-			through: link
-		};
-		const chain = await settled(() => reader.chain(query), (value) => value === "pending", cache);
-		const next = chain === "pending" || chain === "failed" ? void 0 : chain.ancestors[0]?.id;
-		if (next === void 0) return;
-		current = target.resource;
-		at = next;
-	}
-	return current === item.resource ? at : void 0;
-}
-function depthOf(item) {
-	if (item.through === "parent") return item.depth ?? DEFAULT_PARENT_DEPTH;
-	return item.depth ?? 0;
-}
-/**
-* The relation approvers of `request` that `subject` holds on its resource,
-* keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
-* through `relations` by the request's resource id; a request without an id,
-* a missing source or a read that fails holds nothing.
-*/
-async function approverRelations(request, subject, options) {
-	const approvers = request.approvers;
-	const id = request.resource.id;
-	if (approvers === void 0 || id === void 0 || options.relations === void 0 || options.permissions === void 0 || subject.principal === null) return [];
-	const items = /* @__PURE__ */ new Map();
-	for (const item of [
-		...flattenApprovers(approvers.by),
-		...(approvers.stages ?? []).flatMap((stage) => flattenApprovers(stage.by)),
-		...flattenApprovers(approvers.escalation?.to)
-	]) if (item.kind === "relation") items.set(approverRelationKey(item), item);
-	if (items.size === 0) return [];
-	const registry = getRegistry(options.permissions);
-	const cache = /* @__PURE__ */ new Map();
-	const reader = relationReader(options.relations, cache, registry);
-	const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
-	const holds = async (item) => {
-		const start = await startOf(item, request.resource.type, id, reader, cache, registry);
-		if (start === void 0) return false;
-		const condition = {
-			op: "related",
-			resource: item.resource,
-			relation: item.relation,
-			field: "id",
-			depth: depthOf(item)
-		};
-		return await settled(() => resolveRelated(condition, { id: start }, subject, now, reader), (value) => value === "relation-unavailable", cache) === true;
-	};
-	const entries = [...items];
-	const verdicts = await Promise.all(entries.map(([, item]) => holds(item)));
-	return entries.flatMap(([key], index) => verdicts[index] === true ? [key] : []);
-}
-//#endregion
-//#region src/approvals/page.ts
-const DEFAULT_PAGE_SIZE = 50;
-const MAX_PAGE_SIZE = 200;
-const MAX_PAGES = 1e3;
-function pageSizeOf(limit) {
-	if (limit === void 0 || !Number.isFinite(limit)) return DEFAULT_PAGE_SIZE;
-	return Math.min(Math.max(Math.trunc(limit), 1), MAX_PAGE_SIZE);
-}
-function positionOf(request) {
-	return [request.createdAt, request.token];
-}
-function compare(a, b) {
-	if (a[0] !== b[0]) return a[0] < b[0] ? -1 : 1;
-	if (a[1] === b[1]) return 0;
-	return a[1] < b[1] ? -1 : 1;
-}
-function encodeCursor(request) {
-	return JSON.stringify(positionOf(request));
-}
-function decodeCursor(cursor) {
-	try {
-		const parsed = JSON.parse(cursor);
-		return Array.isArray(parsed) && parsed.length === 2 && typeof parsed[0] === "string" && typeof parsed[1] === "string" ? [parsed[0], parsed[1]] : null;
-	} catch {
-		return null;
-	}
-}
-/** Pages already-filtered requests in `(createdAt, token)` order. */
-function pageOf(matching, query) {
-	const after = query.cursor === void 0 ? void 0 : decodeCursor(query.cursor);
-	if (after === null) return { items: [] };
-	const sorted = matching.filter((request) => after === void 0 || compare(positionOf(request), after) > 0).toSorted((a, b) => compare(positionOf(a), positionOf(b)));
-	const size = pageSizeOf(query.limit);
-	const items = sorted.slice(0, size);
-	const last = items.at(-1);
-	return sorted.length > size && last !== void 0 ? {
-		items,
-		next: encodeCursor(last)
-	} : { items };
-}
-/** Every matching request, following `next` until the last page. */
-function listAll(store, filter) {
-	const collect = async (cursor, pages, items) => {
-		const page = await store.list(cursor === void 0 ? {
-			...filter,
-			limit: MAX_PAGE_SIZE
-		} : {
-			...filter,
-			limit: MAX_PAGE_SIZE,
-			cursor
-		});
-		const next = [...items, ...page.items];
-		return page.next === void 0 || pages + 1 >= MAX_PAGES ? next : collect(page.next, pages + 1, next);
-	};
-	return collect(void 0, 0, []);
-}
-//#endregion
-//#region src/approvals/store.ts
-function tenantOf(request) {
-	return request.subject.principal?.tenant;
-}
-function membershipTenants(subject) {
-	const principal = subject.principal;
-	if (principal === null) return [];
-	const tenants = /* @__PURE__ */ new Set();
-	if (principal.tenant !== void 0) tenants.add(principal.tenant);
-	for (const membership of principal.memberships ?? []) {
-		const tenant = rootMembershipId(membership);
-		if (tenant !== void 0) tenants.add(tenant);
-	}
-	return [...tenants];
-}
-function belongsToTenant(subject, tenant) {
-	return membershipTenants(subject).includes(tenant);
-}
-function holdsRole(subject, role, tenant) {
-	const principal = subject.principal;
-	if (principal === null) return false;
-	if ((principal.roles ?? []).includes(role)) return true;
-	for (const membership of principal.memberships ?? []) {
-		if (!membership.roles.includes(role)) continue;
-		if (tenant !== void 0 && rootMembershipId(membership) !== tenant) continue;
-		return true;
-	}
-	return false;
-}
-function matchesApprovers(by, subject, tenant, now, relations) {
-	const items = flattenApprovers(by);
-	if (items.length === 0) return false;
-	for (const item of items) {
-		if (item.kind === "role") {
-			if (!holdsRole(subject, item.role, tenant)) return false;
-			continue;
-		}
-		if (item.kind === "user") {
-			if (subject.principal?.id !== item.id) return false;
-			continue;
-		}
-		if (item.kind === "relation") {
-			if (!relations.has(approverRelationKey(item))) return false;
-			continue;
-		}
-		const result = matchGrantee(item, subject, now, void 0);
-		if (!result.matched || result.where !== void 0) return false;
-	}
-	return true;
-}
-/** Approvals recorded per stage index. */
-function stageCounts(approvals, stages) {
-	const counts = stages.map(() => 0);
-	for (const item of approvals ?? []) if (item.stage !== void 0 && item.stage < counts.length) counts[item.stage] = (counts[item.stage] ?? 0) + 1;
-	return counts;
-}
-function isComplete(request, approvals) {
-	const stages = request.approvers?.stages;
-	if (stages === void 0) return approvals.length >= approvalQuorum(request);
-	const counts = stageCounts(approvals, stages);
-	return stages.every((stage, index) => (counts[index] ?? 0) >= (stage.quorum ?? 1));
-}
-function matchesFilter(request, filter) {
-	if (filter.status !== void 0 && request.status !== filter.status) return false;
-	if (filter.principalId !== void 0 && request.subject.principal?.id !== filter.principalId) return false;
-	if (filter.actorId !== void 0 && request.subject.actor?.id !== filter.actorId) return false;
-	if (filter.tenant !== void 0 && tenantOf(request) !== filter.tenant) return false;
-	if (filter.session !== void 0 && request.subject.session !== filter.session) return false;
-	return true;
-}
-/**
-* Refuses `by` as an approver of `request`, or returns the index of the
-* stage the approval counts for (`undefined` without `stages`). Eligibility
-* is `approvers.by` or, under `stages`, the first incomplete stage
-* (`sequential`) or any incomplete stage (`all`); `approvers.escalation.to`
-* is eligible too once the request has waited `escalation.after`. A
-* principal who already approved is refused, so one person never completes
-* two stages. `relations` are the relation approvers `by` holds on the
-* request's resource (see `ApprovalVerdict.relations`).
-*/
-function assertApprover(request, by, requireDistinctApprover, now = /* @__PURE__ */ new Date(), relations = []) {
-	const principal = by.principal;
-	if (principal === null) throw new ApprovalError("approver-unauthenticated", "approver must be authenticated");
-	if (request.subject.actor !== void 0 && principal.id === request.subject.actor.id) throw new ApprovalError("approver-is-actor", "approver is the actor of this request");
-	if ((requireDistinctApprover || request.approvers?.distinct !== false) && request.subject.principal !== null && principal.id === request.subject.principal.id) throw new ApprovalError("approver-is-principal", "approver is the principal of this request");
-	const tenant = request.subject.principal?.tenant;
-	if (tenant !== void 0 && !belongsToTenant(by, tenant)) throw new ApprovalError("approver-not-eligible", "approver does not belong to the request tenant");
-	if ((request.approvals ?? []).some((item) => item.by === principal.id)) throw new ApprovalError("approver-repeated", "approver has already approved this request");
-	const approvers = request.approvers;
-	if (approvers === void 0) return;
-	const held = new Set(relations);
-	const instant = now.getTime() / 1e3;
-	const eligible = (target) => matchesApprovers(target, by, tenant, instant, held);
-	const openAt = escalationOpenAt(request);
-	const escalated = approvers.escalation !== void 0 && openAt !== void 0 && now.getTime() >= openAt && eligible(approvers.escalation.to);
-	const stages = approvers.stages;
-	if (stages === void 0) {
-		if (escalated || approvers.by !== void 0 && eligible(approvers.by)) return;
-		throw new ApprovalError("approver-not-eligible", "approver does not hold an eligible role");
-	}
-	const counts = stageCounts(request.approvals, stages);
-	const open = stages.flatMap((stage, index) => (counts[index] ?? 0) < (stage.quorum ?? 1) ? [index] : []);
-	const candidates = approvers.mode === "sequential" ? open.slice(0, 1) : open;
-	for (const index of candidates) {
-		const stage = stages[index];
-		if (stage !== void 0 && (escalated || eligible(stage.by))) return index;
-	}
-	throw new ApprovalError("approver-not-eligible", approvers.mode === "sequential" ? "approver is not eligible for the current stage" : "approver is not eligible for an open stage");
-}
-function isSystemSubject(by) {
-	return by.actor?.kind === "system";
-}
-/**
-* The request after `verdict`, for a store to persist: a rejection resolves
-* it; an approval is appended to `approvals` and resolves it once there are
-* `approvers.quorum` (default 1). Throws an `ApprovalError` when the request
-* is not pending, has expired or `verdict.by` may not approve it. Stores
-* should write the result only when the stored row is still pending with the
-* same number of approvals, so two approvers racing both count.
-*/
-function applyApprovalVerdict(request, verdict, now = /* @__PURE__ */ new Date()) {
-	const principal = verdict.by.principal;
-	if (principal === null) throw new ApprovalError("approver-unauthenticated", "approver must be authenticated");
-	if (request.status !== "pending") throw new ApprovalError("approval-not-pending", "approval is not pending");
-	if (Date.parse(request.expiresAt) <= now.getTime()) throw new ApprovalError("approval-expired", "approval has expired");
-	const stage = verdict.status === "rejected" && isSystemSubject(verdict.by) ? void 0 : assertApprover(request, verdict.by, false, now, verdict.relations);
-	if (verdict.status === "rejected") return freezeDeep(compact({
-		...request,
-		status: "rejected",
-		resolvedAt: now.toISOString(),
-		resolvedBy: principal.id,
-		note: verdict.note ?? request.note
-	}));
-	const approvals = [...request.approvals ?? [], compact({
-		by: principal.id,
-		at: now.toISOString(),
-		stage
-	})];
-	if (!isComplete(request, approvals)) return freezeDeep(compact({
-		...request,
-		approvals,
-		note: verdict.note ?? request.note
-	}));
-	return freezeDeep(compact({
-		...request,
-		status: "approved",
-		approvals,
-		resolvedAt: now.toISOString(),
-		resolvedBy: principal.id,
-		note: verdict.note ?? request.note
-	}));
-}
-function rejectPending(request, meta, now) {
-	return freezeDeep(compact({
-		...request,
-		status: "rejected",
-		resolvedAt: now.toISOString(),
-		resolvedBy: `system:${meta.by}`,
-		note: meta.note
-	}));
-}
-/** A request a new ask may replace: expired, or past its deadline. */
-function isStale(request, now) {
-	return request.status === "expired" || Date.parse(request.expiresAt) <= now.getTime();
-}
-function memoryApprovalStore(options = {}) {
-	const ttl = options.ttl ?? 36e5;
-	const records = /* @__PURE__ */ new Map();
-	return {
-		ttl,
-		create(request) {
-			const current = records.get(request.token);
-			if (current !== void 0 && !isStale(current, /* @__PURE__ */ new Date())) return;
-			records.set(request.token, freezeDeep(request));
-		},
-		get(token) {
-			return records.get(token) ?? null;
-		},
-		resolve(token, verdict) {
-			const current = records.get(token);
-			if (current === void 0) throw new ApprovalError("approval-not-found", "approval was not found");
-			const next = applyApprovalVerdict(current, verdict, /* @__PURE__ */ new Date());
-			records.set(token, next);
-			return next;
-		},
-		consume(token, now = /* @__PURE__ */ new Date()) {
-			const current = records.get(token);
-			if (current?.status !== "approved" || current.consumedAt !== void 0 || Date.parse(current.expiresAt) <= now.getTime()) return null;
-			const next = freezeDeep({
-				...current,
-				consumedAt: now.toISOString()
-			});
-			records.set(token, next);
-			return next;
-		},
-		list(query) {
-			const matching = [];
-			for (const request of records.values()) if (matchesFilter(request, query)) matching.push(request);
-			return pageOf(matching, query);
-		},
-		expire(now = /* @__PURE__ */ new Date()) {
-			let count = 0;
-			const instant = now.getTime();
-			for (const [token, request] of records) {
-				const deadline = Date.parse(request.expiresAt);
-				if (request.status !== "pending" && deadline + ttl <= instant) {
-					records.delete(token);
-					continue;
-				}
-				if (request.status === "pending" && deadline <= instant) {
-					records.set(token, freezeDeep(compact({
-						...request,
-						status: "expired"
-					})));
-					count += 1;
-				}
-			}
-			return count;
-		},
-		cancel(filter, meta) {
-			const now = /* @__PURE__ */ new Date();
-			let count = 0;
-			for (const [token, request] of records) {
-				if (request.status !== "pending" || !matchesFilter(request, filter)) continue;
-				records.set(token, rejectPending(request, meta, now));
-				count += 1;
-			}
-			return count;
-		}
-	};
-}
-//#endregion
-//#region src/approvals/helpers.ts
-function permissionMeta(permission) {
-	return {
-		key: permission.key,
-		scope: permission.scope,
-		resource: permission.resource
-	};
-}
-function summariseSubject(subject) {
-	const principal = subject.principal;
-	return compact({
-		principal: principal === null ? null : compact({
-			id: principal.id,
-			roles: principal.roles ?? [],
-			tenant: principal.tenant
-		}),
-		actor: subject.actor === void 0 ? void 0 : {
-			id: subject.actor.id,
-			kind: subject.actor.kind
-		},
-		session: subject.session,
-		delegation: subject.delegation === void 0 ? void 0 : compact({
-			scopes: subject.delegation.scopes,
-			authorizationDetails: subject.delegation.authorizationDetails
-		})
-	});
-}
-/**
-* The store's window (`meta.ttl`, else the default) capped by the grant's
-* `approval.ttl`: a grant shortens how long a request stays open, never
-* extends it.
-*/
-function approvalTtl(storeTtl, approval) {
-	const base = storeTtl ?? 36e5;
-	const grant = approval === void 0 || approval === "human" ? void 0 : parseDuration(approval.ttl);
-	return grant === void 0 ? base : Math.min(base, grant * 1e3);
-}
-async function requestApproval(store, decision, meta) {
-	const now = meta.now ?? /* @__PURE__ */ new Date();
-	const leaf = permissionMeta(meta.permission);
-	const approval = decision.grant.approval;
-	const approvers = approval === void 0 || approval === "human" ? void 0 : compact({
-		by: approval.by,
-		mode: approval.mode,
-		stages: approval.stages,
-		distinct: approval.distinct,
-		staleOn: approval.staleOn,
-		quorum: approval.quorum,
-		escalation: approval.escalation
-	});
-	const ttl = approvalTtl(meta.ttl, approval);
-	const request = freezeDeep(compact({
-		v: 1,
-		token: decision.token,
-		permission: leaf.key,
-		scope: leaf.scope,
-		resource: meta.resource ?? { type: leaf.resource },
-		subject: summariseSubject(meta.subject),
-		membership: meta.membership,
-		approvers,
-		detail: meta.detail ?? describe(decision).detail,
-		adapter: meta.adapter,
-		createdAt: now.toISOString(),
-		expiresAt: new Date(now.getTime() + ttl).toISOString(),
-		status: "pending"
-	}));
-	await store.create(request);
-	return request;
-}
-/**
-* Checks `verdict.by` and resolves the request. Relation approvers are read
-* through `options.relations` unless `verdict.relations` is already set.
-*/
-async function resolveApproval(store, token, verdict, options = {}) {
-	const current = await store.get(token);
-	if (current === null) throw new ApprovalError("approval-not-found", "approval was not found");
-	const relations = verdict.relations ?? await approverRelations(current, verdict.by, options);
-	assertApprover(current, verdict.by, options.requireDistinctApprover === true, options.now, relations);
-	return store.resolve(token, {
-		...verdict,
-		relations
-	});
-}
-async function inspectApproval(store, token, now = /* @__PURE__ */ new Date()) {
-	await store.expire(now);
-	const request = await store.get(token);
-	if (request === null) return {
-		ok: false,
-		detail: "approval-not-found"
-	};
-	if (request.status === "pending") return {
-		ok: false,
-		detail: "approval-pending"
-	};
-	if (request.status === "rejected") return {
-		ok: false,
-		detail: "approval-rejected"
-	};
-	if (request.consumedAt !== void 0) return {
-		ok: false,
-		detail: "approval-consumed"
-	};
-	if (request.status === "expired" || Date.parse(request.expiresAt) <= now.getTime()) return {
-		ok: false,
-		detail: "approval-expired"
-	};
-	return {
-		ok: true,
-		request
-	};
-}
-/** Inspects `token` and, when it is approved, consumes it so it resumes once. */
-async function consumeApproval(store, token, now = /* @__PURE__ */ new Date()) {
-	const inspected = await inspectApproval(store, token, now);
-	if (!inspected.ok) return inspected;
-	if (typeof store.consume !== "function") return {
-		ok: false,
-		detail: "approval-not-found"
-	};
-	const consumed = await store.consume(token, now);
-	if (consumed === null) return {
-		ok: false,
-		detail: "approval-consumed"
-	};
-	return {
-		ok: true,
-		request: consumed
-	};
-}
-function approvalDenied(detail) {
-	return {
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: "approval",
-			detail
-		}],
-		alternatives: []
-	};
-}
-function staleOnChange(decision) {
-	const approval = decision.grant.approval;
-	return approval !== void 0 && approval !== "human" && approval.staleOn === "resource-change";
-}
-/**
-* True when `token` names a pending or approved request for this permission,
-* resource and principal: the same request, issued while the row had another
-* `version`.
-*/
-async function isStaleToken(store, token, input) {
-	const principal = input.subject.principal;
-	if (principal === null) return false;
-	let request;
-	try {
-		request = await store.get(token);
-	} catch {
-		return false;
-	}
-	return request !== null && (request.status === "approved" || request.status === "pending") && request.permission === input.permission.key && request.resource.type === input.resource.type && request.resource.id === input.resource.id && request.subject.principal?.id === principal.id;
-}
-/**
-* Applies a resume token to a decision. The token only matters when the
-* decision is `approval-required` and the token is the one this call was
-* issued; otherwise a new approval is requested. A matching token is consumed
-* unless `consume` is `false`, so an approval resumes exactly one call. Under
-* `staleOn: 'resource-change'`, a token issued for an earlier version of the
-* same row denies with `stale-approval`; the next call without it asks again.
-*/
-async function resumeDecision(input) {
-	const { decision, store, token } = input;
-	if (decision.outcome !== "approval-required") return decision;
-	if (token === void 0 || token !== decision.token) {
-		if (store !== void 0 && token !== void 0 && staleOnChange(decision) && await isStaleToken(store, token, input)) return {
-			outcome: "denied",
-			denials: [{
-				role: null,
-				reason: "stale-approval"
-			}],
-			alternatives: []
-		};
-		if (store !== void 0) await requestApproval(store, decision, compact({
-			permission: input.permission,
-			resource: input.resource,
-			subject: input.subject,
-			adapter: input.adapter
-		}));
-		return decision;
-	}
-	if (store === void 0) return approvalDenied("approval-not-found");
-	let inspected;
-	try {
-		inspected = await inspectApproval(store, token, input.now);
-		if (inspected.ok) {
-			const { request } = inspected;
-			if (request.permission !== input.permission.key || request.resource.id !== void 0 && request.resource.id !== input.resource.id) return approvalDenied("approval-mismatch");
-			if (input.consume !== false) inspected = await consumeApproval(store, token, input.now);
-		}
-	} catch {
-		return approvalDenied("approval-not-found");
-	}
-	if (!inspected.ok) return approvalDenied(inspected.detail);
-	const principal = input.subject.principal;
-	if (principal === null) return approvalDenied("approval-mismatch");
-	return {
-		outcome: "granted",
-		subject: {
-			...input.subject,
-			principal
-		},
-		matched: decision.grant,
-		token: decision.token
-	};
-}
-const SYSTEM_KIND = "system";
-async function cancelApprovals(store, filter, meta) {
-	if (store.cancel !== void 0) return store.cancel(filter, meta);
-	const pending = await listAll(store, {
-		...filter,
-		status: "pending"
-	});
-	const by = {
-		principal: {
-			id: `system:${meta.by}`,
-			kind: "service",
-			roles: []
-		},
-		actor: {
-			id: `system:${meta.by}`,
-			kind: SYSTEM_KIND
-		},
-		context: {}
-	};
-	return (await Promise.all(pending.map(async (request) => {
-		try {
-			await store.resolve(request.token, compact({
-				status: "rejected",
-				by,
-				note: meta.note
-			}));
-			return true;
-		} catch {
-			return false;
-		}
-	}))).filter(Boolean).length;
-}
-function readApprovalHeader(headers) {
-	const value = headers.get(APPROVAL_HEADER);
-	if (value === null || value.trim() === "") return;
-	return value.trim();
-}
-function resumeFromHeader(store, headers, now) {
-	const token = readApprovalHeader(headers);
-	if (token === void 0) return Promise.resolve({
-		ok: false,
-		detail: "approval-not-found"
-	});
-	return inspectApproval(store, token, now);
-}
-/**
-* The stored token for a decision that is waiting on approval: an approved or
-* rejected record for the recomputed token resumes without the caller
-* carrying it, since the token already binds permission, resource (or the
-* call's data when there is no row id), subject and actor.
-*/
-async function storedApprovalToken(store, decision, denyPending) {
-	if (store === void 0 || decision.outcome !== "approval-required") return;
-	try {
-		const record = await store.get(decision.token);
-		if (record === null || record.status === "pending" && !denyPending || record.status === "expired" || Date.parse(record.expiresAt) <= Date.now()) return;
-		return decision.token;
-	} catch {
-		return;
-	}
-}
-//#endregion
-export { approvalQuorum as _, requestApproval as a, resumeFromHeader as c, applyApprovalVerdict as d, assertApprover as f, DEFAULT_APPROVAL_TTL_MS as g, APPROVAL_HEADER as h, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, memoryApprovalStore as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summariseSubject as u, approverRelationKey as v, escalationOpenAt as y };

package/dist/index-fG6NSXlc.d.ts

@@ -1,9 +0,0 @@
-import { C as Policy, mr as Principal } from "./policy-CInmNGkM.js";
-import { a as ReplayStore, f as SsfPermDock, p as SsfPermDockOptions } from "./types-i4BAOvdb.js";
-//#region src/ssf/create.d.ts
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
-//#endregion
-//#region src/ssf/replay.d.ts
-declare function memoryReplayStore(): ReplayStore;
-//#endregion
-export { createPermDock as n, memoryReplayStore as t };