permdock 0.3.1 → 0.5.0

package/dist/standard-webhooks-6lg8v_is.d.ts

@@ -0,0 +1,88 @@
+import { Rt as Instant, tr as JsonWebKeyLike } from "./policy-types-DzwivBgR.js";
+import { l as ReplayStore } from "./types-DiQjupG2.js";
+//#region src/server/standard-webhooks.d.ts
+/** The three Standard Webhooks headers a delivery carries. */
+type WebhookHeaders = {
+  readonly "webhook-id": string;
+  readonly "webhook-timestamp": string;
+  readonly "webhook-signature": string;
+};
+/** An OKP JWK; only `kty: "OKP"` with `crv: "Ed25519"` signs or verifies `v1a`. */
+type WebhookJwk = JsonWebKeyLike & {
+  readonly kid?: string;
+  readonly crv?: string;
+  readonly x?: string;
+  readonly d?: string;
+};
+/** A Standard Webhooks signature version: `v1` HMAC-SHA256 or `v1a` Ed25519. */
+type WebhookAlgorithm = "v1" | "v1a";
+type WebhookSigningKey = {
+  readonly alg: "v1";
+  readonly secret: string;
+} | {
+  readonly alg: "v1a";
+  readonly privateKey: WebhookJwk;
+};
+type WebhookSignerOptions = {
+  /** Every key signs each delivery, so a receiver can rotate between them. */
+  readonly keys: readonly WebhookSigningKey[];
+};
+type WebhookMessage = {
+  /** A unique message id, kept across retries of the same message. */
+  readonly id: string;
+  readonly body: string;
+  readonly now?: Instant;
+};
+type WebhookSigner = {
+  sign(message: WebhookMessage): Promise<WebhookHeaders>;
+};
+/** An Ed25519 public JWK set for `v1a`, or the URL that serves one. */
+type WebhookJwks = {
+  readonly keys: readonly WebhookJwk[];
+} | URL | string;
+type WebhookVerifierOptions = {
+  /** `v1` secrets in `whsec_` form; more than one during a rotation. */
+  readonly secret?: string | readonly string[];
+  /** `v1a` public keys. */
+  readonly jwks?: WebhookJwks;
+  /** Records each `webhook-id` so a replayed delivery fails. */
+  readonly replay: ReplayStore;
+  /** Seconds a timestamp may differ from the clock. Defaults to 300. */
+  readonly tolerance?: number;
+  readonly now?: () => Instant;
+  /** Fetches a `jwks` URL. Defaults to the global `fetch`. */
+  readonly fetch?: typeof fetch;
+};
+type WebhookFailureCause = "missing-headers" | "malformed" | "timestamp-out-of-range" | "invalid-signature" | "keys-unavailable" | "replayed";
+type WebhookInput = Request | {
+  readonly headers: Headers | Readonly<Record<string, string | undefined>>;
+  readonly body: string;
+};
+type VerifiedWebhookMessage = {
+  readonly ok: true;
+  readonly id: string;
+  /** The `webhook-timestamp` as an RFC 3339 instant. */
+  readonly timestamp: string;
+  readonly body: string;
+} | {
+  readonly ok: false;
+  readonly cause: WebhookFailureCause;
+};
+type WebhookVerifier = {
+  /** Never throws; claims the `webhook-id` only after a signature verifies. */
+  verify(input: WebhookInput): Promise<VerifiedWebhookMessage>;
+};
+/**
+ * Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_`
+ * secret, `v1a` Ed25519 with a private JWK. Throws on an invalid key or id,
+ * because both come from the sender's own configuration.
+ */
+declare function webhookSigner(options: WebhookSignerOptions): WebhookSigner;
+/**
+ * Verifies Standard Webhooks deliveries signed `v1` with one of `secret` or
+ * `v1a` with a key from `jwks`, within `tolerance` seconds, and records each
+ * `webhook-id` in `replay`. Throws only on an invalid `secret`.
+ */
+declare function webhookVerifier(options: WebhookVerifierOptions): WebhookVerifier;
+//#endregion
+export { WebhookInput as a, WebhookMessage as c, WebhookSigningKey as d, WebhookVerifier as f, webhookVerifier as h, WebhookHeaders as i, WebhookSigner as l, webhookSigner as m, WebhookAlgorithm as n, WebhookJwk as o, WebhookVerifierOptions as p, WebhookFailureCause as r, WebhookJwks as s, VerifiedWebhookMessage as t, WebhookSignerOptions as u };

package/dist/standard-webhooks-DgFFD-Ga.js

@@ -0,0 +1,228 @@
+import { m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as readBodyText } from "./body-text-QcXok_SI.js";
+//#region src/server/standard-webhooks.ts
+const DEFAULT_TOLERANCE = 300;
+const JWKS_TTL_SECONDS = 300;
+const encoder = /* @__PURE__ */ new TextEncoder();
+function decodeBase64(value) {
+	if (!/^[A-Za-z0-9+/]*={0,2}$/u.test(value) || value.length % 4 !== 0) return;
+	try {
+		const binary = atob(value);
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+		return bytes;
+	} catch {
+		return;
+	}
+}
+function encodeBase64(bytes) {
+	let binary = "";
+	for (const byte of new Uint8Array(bytes)) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+function secretBytes(secret) {
+	const bytes = decodeBase64(secret.startsWith("whsec_") ? secret.slice(6) : secret);
+	if (bytes === void 0 || bytes.length < 24 || bytes.length > 64) throw new TypeError("PermDock: a v1 webhook secret is whsec_ followed by 24 to 64 bytes in base64");
+	return bytes;
+}
+function hmacKey(secret, usage) {
+	return crypto.subtle.importKey("raw", secretBytes(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, [usage]);
+}
+function isEd25519(jwk) {
+	return jwk.kty === "OKP" && jwk.crv === "Ed25519" && typeof jwk.x === "string";
+}
+function signedContent(id, timestamp, body) {
+	return encoder.encode(`${id}.${timestamp}.${body}`);
+}
+function validId(id) {
+	return id.length > 0 && id.length <= 256 && !/\s/u.test(id);
+}
+/**
+* Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_`
+* secret, `v1a` Ed25519 with a private JWK. Throws on an invalid key or id,
+* because both come from the sender's own configuration.
+*/
+function webhookSigner(options) {
+	if (options.keys.length === 0) throw new TypeError("PermDock: webhookSigner() needs at least one key");
+	const keys = options.keys.map(async (key) => {
+		switch (key.alg) {
+			case "v1": return {
+				alg: key.alg,
+				key: await hmacKey(key.secret, "sign")
+			};
+			case "v1a":
+				if (!isEd25519(key.privateKey) || typeof key.privateKey.d !== "string") throw new TypeError("PermDock: a v1a webhook key is an Ed25519 private JWK");
+				return {
+					alg: key.alg,
+					key: await importEd25519(key.privateKey, "sign")
+				};
+			default: return key;
+		}
+	});
+	for (const pending of keys) pending.catch(() => void 0);
+	return { async sign(message) {
+		if (!validId(message.id)) throw new TypeError("PermDock: a webhook id is 1 to 256 characters without whitespace");
+		const timestamp = String(nowSeconds(message.now));
+		const content = signedContent(message.id, timestamp, message.body);
+		const signatures = await Promise.all(keys.map(async (pending) => {
+			const { alg, key } = await pending;
+			return `${alg},${encodeBase64(await crypto.subtle.sign(alg === "v1" ? "HMAC" : "Ed25519", key, content))}`;
+		}));
+		return {
+			"webhook-id": message.id,
+			"webhook-timestamp": timestamp,
+			"webhook-signature": signatures.join(" ")
+		};
+	} };
+}
+function header(input, name) {
+	const headers = input.headers;
+	if (headers instanceof Headers) return headers.get(name) ?? void 0;
+	return Object.hasOwn(headers, name) ? headers[name] : void 0;
+}
+async function bodyOf(input) {
+	if (input instanceof Request) {
+		const read = await readBodyText(input);
+		return read.ok ? read.text : void 0;
+	}
+	return input.body;
+}
+function parseSignatures(value) {
+	const parsed = [];
+	for (const entry of value.split(" ")) {
+		const comma = entry.indexOf(",");
+		const alg = entry.slice(0, comma);
+		if (comma <= 0 || alg !== "v1" && alg !== "v1a") continue;
+		const bytes = decodeBase64(entry.slice(comma + 1));
+		if (bytes?.length === (alg === "v1" ? 32 : 64)) parsed.push({
+			alg,
+			bytes
+		});
+	}
+	return parsed;
+}
+function importEd25519(jwk, usage) {
+	const material = usage === "sign" ? {
+		kty: "OKP",
+		crv: "Ed25519",
+		x: jwk.x,
+		d: jwk.d
+	} : {
+		kty: "OKP",
+		crv: "Ed25519",
+		x: jwk.x
+	};
+	return crypto.subtle.importKey("jwk", material, "Ed25519", false, [usage]);
+}
+async function publicKeys(jwks) {
+	return (await Promise.all(jwks.keys.filter(isEd25519).map((jwk) => importEd25519(jwk, "verify").catch(() => void 0)))).filter((key) => key !== void 0);
+}
+async function anyVerifies(algorithm, keys, signatures, content) {
+	return (await Promise.all(keys.flatMap((key) => signatures.map((signature) => crypto.subtle.verify(algorithm, key, signature.bytes, content))))).includes(true);
+}
+function isJwks(value) {
+	return typeof value === "object" && value !== null && "keys" in value && Array.isArray(value.keys);
+}
+/**
+* Verifies Standard Webhooks deliveries signed `v1` with one of `secret` or
+* `v1a` with a key from `jwks`, within `tolerance` seconds, and records each
+* `webhook-id` in `replay`. Throws only on an invalid `secret`.
+*/
+function webhookVerifier(options) {
+	const secrets = options.secret === void 0 ? [] : typeof options.secret === "string" ? [options.secret] : options.secret;
+	for (const secret of secrets) secretBytes(secret);
+	const hmacKeys = Promise.all(secrets.map((secret) => hmacKey(secret, "verify")));
+	const tolerance = options.tolerance ?? DEFAULT_TOLERANCE;
+	const jwks = options.jwks;
+	let cached;
+	async function ed25519Keys(now) {
+		if (jwks === void 0) return [];
+		if (isJwks(jwks)) {
+			cached ??= {
+				keys: await publicKeys(jwks),
+				until: Number.POSITIVE_INFINITY
+			};
+			return cached.keys;
+		}
+		if (cached !== void 0 && cached.until > now) return cached.keys;
+		try {
+			const response = await (options.fetch ?? fetch)(String(jwks), { headers: { accept: "application/jwk-set+json, application/json" } });
+			const parsed = response.ok ? await response.json() : void 0;
+			if (!isJwks(parsed)) return;
+			cached = {
+				keys: await publicKeys(parsed),
+				until: now + JWKS_TTL_SECONDS
+			};
+			return cached.keys;
+		} catch {
+			return;
+		}
+	}
+	async function signatureValid(signatures, content, now) {
+		const v1 = signatures.filter((signature) => signature.alg === "v1");
+		const v1a = signatures.filter((signature) => signature.alg === "v1a");
+		if (v1.length > 0 && await anyVerifies("HMAC", await hmacKeys, v1, content)) return;
+		if (v1a.length === 0) return "invalid-signature";
+		const keys = await ed25519Keys(now);
+		if (keys === void 0) return "keys-unavailable";
+		if (await anyVerifies("Ed25519", keys, v1a, content)) return;
+		return "invalid-signature";
+	}
+	async function claim(id, expiresAt) {
+		const key = `webhook:${id}`;
+		try {
+			if (options.replay.claim !== void 0) return await options.replay.claim(key, expiresAt);
+			if (await options.replay.seen(key)) return false;
+			await options.replay.remember(key, expiresAt);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	return { async verify(input) {
+		const id = header(input, "webhook-id");
+		const timestamp = header(input, "webhook-timestamp");
+		const signature = header(input, "webhook-signature");
+		if (id === void 0 || timestamp === void 0 || signature === void 0) return {
+			ok: false,
+			cause: "missing-headers"
+		};
+		const body = await bodyOf(input);
+		const signatures = parseSignatures(signature);
+		if (body === void 0 || !validId(id) || !/^\d{1,12}$/u.test(timestamp) || signatures.length === 0) return {
+			ok: false,
+			cause: "malformed"
+		};
+		const now = nowSeconds(options.now?.());
+		const sent = Number(timestamp);
+		if (Math.abs(now - sent) > tolerance) return {
+			ok: false,
+			cause: "timestamp-out-of-range"
+		};
+		let failure;
+		try {
+			failure = await signatureValid(signatures, signedContent(id, timestamp, body), now);
+		} catch {
+			failure = "invalid-signature";
+		}
+		if (failure !== void 0) return {
+			ok: false,
+			cause: failure
+		};
+		if (!await claim(id, sent + tolerance)) return {
+			ok: false,
+			cause: "replayed"
+		};
+		return {
+			ok: true,
+			id,
+			timestamp: rfc3339(sent),
+			body
+		};
+	} };
+}
+//#endregion
+export { webhookVerifier as n, webhookSigner as t };

package/dist/storage-C2bWdvJH.js

@@ -0,0 +1,132 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { homedir } from "node:os";
+//#region src/terminal/storage.ts
+const FILE_MODE = 384;
+const DIR_MODE = 448;
+const GROUP_OR_WORLD = 63;
+function credentialsPath(service, runtime) {
+	if (runtime.configDir !== void 0) return path.join(runtime.configDir, "credentials.json");
+	const home = runtime.homedir ?? homedir;
+	const env = runtime.env ?? process.env;
+	if ((runtime.platform ?? process.platform) === "win32") {
+		const appData = env["APPDATA"] ?? path.join(home(), "AppData", "Roaming");
+		return path.join(appData, service, "credentials.json");
+	}
+	const xdg = env["XDG_CONFIG_HOME"] ?? path.join(home(), ".config");
+	return path.join(xdg, service, "credentials.json");
+}
+function parseCredential(value) {
+	if (!isRecord(value) || typeof value["access_token"] !== "string") return null;
+	return compact({
+		access_token: value["access_token"],
+		refresh_token: typeof value["refresh_token"] === "string" ? value["refresh_token"] : void 0,
+		expires_at: typeof value["expires_at"] === "number" ? value["expires_at"] : void 0,
+		token_type: typeof value["token_type"] === "string" ? value["token_type"] : void 0,
+		scope: typeof value["scope"] === "string" ? value["scope"] : void 0
+	});
+}
+function keyringEntry(storage, profile) {
+	if (storage.keyring === void 0) return null;
+	try {
+		return new storage.keyring(storage.service, profile);
+	} catch {
+		return null;
+	}
+}
+function readKeyring(storage, profile) {
+	const entry = keyringEntry(storage, profile);
+	if (entry === null) return null;
+	try {
+		const raw = entry.getPassword();
+		return typeof raw === "string" ? parseCredential(JSON.parse(raw)) : null;
+	} catch {
+		return null;
+	}
+}
+function readCredentials(storage, profile, runtime) {
+	return readKeyring(storage, profile) ?? readFile(storage.service, profile, runtime);
+}
+function readFile(service, profile, runtime) {
+	const file = credentialsPath(service, runtime);
+	let raw;
+	try {
+		const stat = statSync(file);
+		if ((runtime.platform ?? process.platform) !== "win32" && (stat.mode & GROUP_OR_WORLD) !== 0) return null;
+		raw = readFileSync(file, "utf8");
+	} catch {
+		return null;
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return null;
+		return parseCredential(parsed["profiles"][profile]);
+	} catch {
+		return null;
+	}
+}
+/**
+* The OS keychain when `storage.keyring` is set and works; otherwise the
+* mode-0600 file. Answers the store it wrote.
+*/
+function writeCredentials(storage, profile, credential, runtime) {
+	const entry = keyringEntry(storage, profile);
+	if (entry !== null) try {
+		entry.setPassword(JSON.stringify(credential));
+		deleteFile(storage.service, profile, runtime);
+		return "keychain";
+	} catch {}
+	writeFile(storage.service, profile, credential, runtime);
+	return "file";
+}
+function writeFile(service, profile, credential, runtime) {
+	const file = credentialsPath(service, runtime);
+	mkdirSync(path.dirname(file), {
+		recursive: true,
+		mode: DIR_MODE
+	});
+	let profiles = {};
+	try {
+		const existing = JSON.parse(readFileSync(file, "utf8"));
+		if (isRecord(existing) && isRecord(existing["profiles"])) profiles = existing["profiles"];
+	} catch {
+		profiles = {};
+	}
+	profiles[profile] = credential;
+	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: FILE_MODE
+	});
+}
+function deleteCredentials(storage, profile, runtime) {
+	const entry = keyringEntry(storage, profile);
+	if (entry !== null) try {
+		entry.deletePassword();
+	} catch {}
+	deleteFile(storage.service, profile, runtime);
+}
+function deleteFile(service, profile, runtime) {
+	const file = credentialsPath(service, runtime);
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return;
+	const profiles = {};
+	for (const key of Object.keys(parsed["profiles"])) if (key !== profile) profiles[key] = parsed["profiles"][key];
+	if (Object.keys(profiles).length === 0) {
+		try {
+			unlinkSync(file);
+		} catch {}
+		return;
+	}
+	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: FILE_MODE
+	});
+}
+//#endregion
+export { writeCredentials as i, deleteCredentials as n, readCredentials as r, credentialsPath as t };

package/dist/{store-DMAWwAJV.js → store-4u_hxjWa.js}

@@ -1,46 +1,10 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as flattenApprovers } from "./approvers-DT4AVyIg.js";
-import { s as rootMembershipId } from "./scopes-CVdPrWN-.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { d as matchGrantee } from "./grantee-Cv5Sogfv.js";
-import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-//#region src/approvals/types.ts
-const APPROVAL_HEADER = "PermDock-Approval";
-const DEFAULT_APPROVAL_TTL_MS = 36e5;
-/** The approvals a request needs in total: `approvers.quorum` (or 1), or the sum of its stages' quorums. */
-function approvalQuorum(request) {
-	const stages = request.approvers?.stages;
-	if (stages !== void 0) return stages.reduce((sum, stage) => sum + (stage.quorum ?? 1), 0);
-	return request.approvers?.quorum ?? 1;
-}
-/**
-* The instant from which `approvers.escalation.to` may approve, in epoch
-* milliseconds, or `undefined` when the request has no escalation or its
-* `after` does not parse (then nobody escalates: fail-closed).
-*/
-function escalationOpenAt(request) {
-	const after = request.approvers?.escalation?.after;
-	const seconds = parseDuration(after);
-	if (seconds === void 0) return;
-	return Date.parse(request.createdAt) + seconds * 1e3;
-}
-/** The instant from which a stage's own `escalation.to` may approve it, in epoch milliseconds; `undefined` when it has none or `after` does not parse. */
-function stageEscalationOpenAt(request, stage) {
-	const seconds = parseDuration(stage.escalation?.after);
-	if (seconds === void 0) return;
-	return Date.parse(request.createdAt) + seconds * 1e3;
-}
-/** The key a verdict's `relations` lists a relation approver under. */
-function approverRelationKey(item) {
-	return JSON.stringify([
-		item.resource,
-		item.relation,
-		item.through ?? null,
-		item.depth ?? null
-	]);
-}
-//#endregion
+import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
+import { a as durationOf, i as dateAt } from "./time-DkWjdL98.js";
+import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
+import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-DqzsnlSA.js";
 //#region src/approvals/page.ts
 const DEFAULT_PAGE_SIZE = 50;
 const MAX_PAGE_SIZE = 200;
@@ -187,12 +151,14 @@ function matchesFilter(request, filter) {
 function assertSeparateApprover(request, by, requireDistinctApprover) {
 	const principal = by.principal;
 	if (principal === null) throw new ApprovalError("approver-unauthenticated", "approver must be authenticated");
+	if (principal.kind === "link" || principal.kind === "feed" || principal.kind === "contact") throw new ApprovalError("approver-not-eligible", "a link, a feed or a contact cannot approve");
+	if (by.actor?.kind === "support") throw new ApprovalError("approver-not-eligible", "a support session cannot approve");
 	if (request.subject.actor !== void 0 && principal.id === request.subject.actor.id) throw new ApprovalError("approver-is-actor", "approver is the actor of this request");
 	if ((requireDistinctApprover || request.approvers?.distinct !== false) && request.subject.principal !== null && principal.id === request.subject.principal.id) throw new ApprovalError("approver-is-principal", "approver is the principal of this request");
 	return principal;
 }
 function assertNotRepeated(request, id) {
-	if ((request.approvals ?? []).some((item) => item.by === id)) throw new ApprovalError("approver-repeated", "approver has already approved this request");
+	if ((request.approvals ?? []).some((item) => item.by === id || item.onBehalfOf === id)) throw new ApprovalError("approver-repeated", "approver has already approved this request");
 }
 function vouchedRule(verdict) {
 	return typeof verdict.vouched === "string" && verdict.vouched !== "" ? verdict.vouched : void 0;
@@ -207,7 +173,8 @@ function vouchedRule(verdict) {
 * two stages. `relations` are the relation approvers `by` holds on the
 * request's resource (see `ApprovalVerdict.relations`).
 */
-function assertApprover(request, by, requireDistinctApprover, now = /* @__PURE__ */ new Date(), relations = [], permissions = []) {
+function assertApprover(request, by, requireDistinctApprover, at, relations = [], permissions = []) {
+	const now = dateAt(at);
 	const principal = assertSeparateApprover(request, by, requireDistinctApprover);
 	const tenant = request.subject.principal?.tenant;
 	if (tenant !== void 0 && !belongsToTenant(by, tenant)) throw new ApprovalError("approver-not-eligible", "approver does not belong to the request tenant");
@@ -251,13 +218,24 @@ function isSystemSubject(by) {
 * should write the result only when the stored row is still pending with the
 * same number of approvals, so two approvers racing both count.
 */
-function applyApprovalVerdict(request, verdict, now = /* @__PURE__ */ new Date()) {
+function applyApprovalVerdict(request, verdict, at) {
+	const now = dateAt(at);
 	const principal = verdict.by.principal;
 	if (principal === null) throw new ApprovalError("approver-unauthenticated", "approver must be authenticated");
 	if (request.status !== "pending") throw new ApprovalError("approval-not-pending", "approval is not pending");
 	if (Date.parse(request.expiresAt) <= now.getTime()) throw new ApprovalError("approval-expired", "approval has expired");
 	const vouched = vouchedRule(verdict);
-	const stage = verdict.status === "rejected" && isSystemSubject(verdict.by) || vouched !== void 0 ? void 0 : assertApprover(request, verdict.by, false, now, verdict.relations, verdict.permissions);
+	const behalf = vouched === void 0 ? verdict.onBehalfOf : void 0;
+	let stage;
+	if (verdict.status === "rejected" && isSystemSubject(verdict.by) || vouched !== void 0) stage = void 0;
+	else if (behalf === void 0) stage = assertApprover(request, verdict.by, false, { epochMilliseconds: now.getTime() }, verdict.relations, verdict.permissions);
+	else {
+		const delegate = assertSeparateApprover(request, verdict.by, false);
+		const tenant = request.subject.principal?.tenant;
+		if (tenant !== void 0 && !belongsToTenant(verdict.by, tenant)) throw new ApprovalError("approver-not-eligible", "approver does not belong to the request tenant");
+		assertNotRepeated(request, delegate.id);
+		stage = assertApprover(request, behalf.subject, false, { epochMilliseconds: now.getTime() }, behalf.relations ?? [], behalf.permissions ?? []);
+	}
 	if (vouched !== void 0) assertNotRepeated(request, assertSeparateApprover(request, verdict.by, false).id);
 	if (verdict.status === "rejected") return freezeDeep(compact({
 		...request,
@@ -271,7 +249,9 @@ function applyApprovalVerdict(request, verdict, now = /* @__PURE__ */ new Date()
 		by: principal.id,
 		at: now.toISOString(),
 		stage,
-		vouched
+		vouched,
+		onBehalfOf: behalf === void 0 ? void 0 : behalf.subject.principal?.id,
+		delegation: behalf?.delegation
 	})];
 	if (vouched === void 0 && !isComplete(request, approvals)) return freezeDeep(compact({
 		...request,
@@ -302,26 +282,32 @@ function isStale(request, now) {
 	return request.status === "expired" || Date.parse(request.expiresAt) <= now.getTime();
 }
 function memoryApprovalStore(options = {}) {
-	const ttl = options.ttl ?? 36e5;
+	if (options.ttl !== void 0 && durationOf(options.ttl) === void 0) throw new RangeError(`PermDock: memoryApprovalStore ttl must be a whole number of seconds above 0, got ${String(options.ttl)}`);
+	const ttl = options.ttl ?? 3600;
 	const records = /* @__PURE__ */ new Map();
+	const clock = (at) => dateAt(at ?? options.now?.());
 	return {
 		ttl,
 		create(request) {
 			const current = records.get(request.token);
-			if (current !== void 0 && !isStale(current, /* @__PURE__ */ new Date())) return;
+			if (current !== void 0 && !isStale(current, clock())) return;
 			records.set(request.token, freezeDeep(request));
 		},
 		get(token) {
 			return records.get(token) ?? null;
 		},
+		getById(id) {
+			return records.values().find((request) => request.id === id) ?? null;
+		},
 		resolve(token, verdict) {
 			const current = records.get(token);
 			if (current === void 0) throw new ApprovalError("approval-not-found", "approval was not found");
-			const next = applyApprovalVerdict(current, verdict, /* @__PURE__ */ new Date());
+			const next = applyApprovalVerdict(current, verdict);
 			records.set(token, next);
 			return next;
 		},
-		consume(token, now = /* @__PURE__ */ new Date()) {
+		consume(token, at) {
+			const now = clock(at);
 			const current = records.get(token);
 			if (current?.status !== "approved" || current.consumedAt !== void 0 || Date.parse(current.expiresAt) <= now.getTime()) return null;
 			const next = freezeDeep({
@@ -336,12 +322,13 @@ function memoryApprovalStore(options = {}) {
 			for (const request of records.values()) if (matchesFilter(request, query)) matching.push(request);
 			return pageApprovals(matching, query);
 		},
-		expire(now = /* @__PURE__ */ new Date()) {
+		expire(at) {
+			const now = clock(at);
 			let count = 0;
 			const instant = now.getTime();
 			for (const [token, request] of records) {
 				const deadline = Date.parse(request.expiresAt);
-				if (request.status !== "pending" && deadline + ttl <= instant) {
+				if (request.status !== "pending" && deadline + ttl * 1e3 <= instant) {
 					records.delete(token);
 					continue;
 				}
@@ -356,7 +343,7 @@ function memoryApprovalStore(options = {}) {
 			return count;
 		},
 		cancel(filter, meta) {
-			const now = /* @__PURE__ */ new Date();
+			const now = clock();
 			let count = 0;
 			for (const [token, request] of records) {
 				if (request.status !== "pending" || !matchesFilter(request, filter)) continue;
@@ -368,4 +355,4 @@ function memoryApprovalStore(options = {}) {
 	};
 }
 //#endregion
-export { decodeApprovalCursor as a, pageApprovals as c, approvalQuorum as d, approverRelationKey as f, approvalPageSize as i, APPROVAL_HEADER as l, assertApprover as n, encodeApprovalCursor as o, escalationOpenAt as p, memoryApprovalStore as r, listAllApprovals as s, applyApprovalVerdict as t, DEFAULT_APPROVAL_TTL_MS as u };
+export { approvalPageSize as a, listAllApprovals as c, memoryApprovalStore as i, pageApprovals as l, assertApprover as n, decodeApprovalCursor as o, matchesApprovers as r, encodeApprovalCursor as s, applyApprovalVerdict as t };