permdock 0.3.1 → 0.5.0

package/dist/who-can-D0QoYbEb.js

@@ -0,0 +1,364 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { r as ownGet } from "./paths-DXSHAMIa.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { a as getResource } from "./permission-registry-Br4jSNVi.js";
+import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { s as instantAt } from "./time-DkWjdL98.js";
+import { a as normalizeMemberships, c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { r as relationCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { c as nowSeconds, p as scopeField } from "./tenancy-DN2QAx9z.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { C as emptyListeners, t as evaluate } from "./evaluate-_R8QkWaf.js";
+import { n as relationId, t as pendingRelations } from "./relations-BnCWnJGI.js";
+import { t as relationWalk } from "./relation-walk-3OyDBF0S.js";
+//#region src/core/who-can.ts
+const MAX_ROUNDS = 48;
+async function settle(cache) {
+	for (let round = 0; round < MAX_ROUNDS; round += 1) {
+		const pending = pendingRelations(cache);
+		if (pending.length === 0) return;
+		await Promise.all(pending);
+	}
+}
+/** The holders on each instance a graph relation reads, or `undefined` when the graph cannot say. */
+async function walkHolders(condition, row, reader, cache) {
+	let walk = relationWalk(condition, row, reader);
+	if (walk === "relation-unavailable") {
+		await settle(cache);
+		walk = relationWalk(condition, row, reader);
+	}
+	if (walk === void 0) return [];
+	if (walk === "relation-depth" || walk === "relation-unavailable") return;
+	const { ids } = walk;
+	const read = () => ids.map((id) => reader.holders({
+		resource: condition.resource,
+		id,
+		relation: condition.relation
+	}));
+	let answers = read();
+	if (answers.includes("pending")) {
+		await settle(cache);
+		answers = read();
+	}
+	const out = [];
+	for (const [index, answer] of answers.entries()) {
+		const id = ids[index];
+		if (answer === "pending" || answer === "failed" || id === void 0) return;
+		out.push({
+			id,
+			holders: answer
+		});
+	}
+	return out;
+}
+async function discoverRole(item, allow, ctx) {
+	if (typeof item.scope !== "string" || item.scope === "global") {
+		ctx.incomplete();
+		return;
+	}
+	const key = scopeField(ctx.resource, item.scope, ctx.scopes);
+	const id = key === void 0 ? void 0 : relationId(ownGet(ctx.row, key));
+	if (id === void 0) return;
+	const members = await ctx.list(item.scope, id);
+	if (members === null) {
+		ctx.incomplete();
+		return;
+	}
+	for (const member of members.filter((entry) => entry.membership.roles.includes(item.role))) ctx.add(member.id, allow ? {
+		kind: "role",
+		role: item.role,
+		membership: member.membership
+	} : void 0, member.membership);
+}
+function holderVia(holder, at, share, group) {
+	if (!share) return {
+		kind: "relation",
+		...at
+	};
+	return compact({
+		kind: "share",
+		...at,
+		expiresAt: holder.expiresAt,
+		group
+	});
+}
+/**
+* Principals holding `group`'s relation, through at most `budget` more groups
+* of its resource; `undefined` when a read failed. `memo` keeps each group's
+* members per budget across one discovery, so a group shared by many paths is
+* read once; a result cut short by a cycle is path-specific and not kept.
+*/
+async function groupMembers(group, ctx, budget, seen, memo) {
+	const key = JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+	const memoKey = `${budget}:${key}`;
+	const known = memo.get(memoKey);
+	if (known !== void 0) return {
+		members: known,
+		cut: false
+	};
+	let holders = ctx.reader.holders(group);
+	if (holders === "pending") {
+		await settle(ctx.cache);
+		holders = ctx.reader.holders(group);
+	}
+	if (holders === "pending" || holders === "failed") return;
+	const path = new Set(seen).add(key);
+	const out = /* @__PURE__ */ new Set();
+	let cut = false;
+	for (const holder of holders) {
+		if ("principal" in holder) {
+			out.add(holder.principal.id);
+			continue;
+		}
+		const nested = JSON.stringify([
+			holder.group.resource,
+			holder.group.id,
+			holder.group.relation
+		]);
+		const same = holder.group.resource === group.resource;
+		if (path.has(nested)) {
+			cut = true;
+			continue;
+		}
+		if (same && budget <= 0) continue;
+		const walk = await groupMembers(holder.group, ctx, same ? budget - 1 : 16, path, memo);
+		if (walk === void 0) return;
+		cut ||= walk.cut;
+		for (const member of walk.members) out.add(member);
+	}
+	const members = [...out];
+	if (!cut) memo.set(memoKey, members);
+	return {
+		members,
+		cut
+	};
+}
+async function discoverGraph(condition, allow, ctx) {
+	const nodes = await walkHolders(condition, ctx.row, ctx.reader, ctx.cache);
+	if (nodes === void 0) {
+		ctx.incomplete();
+		return;
+	}
+	const node = ctx.policy.resources.get(condition.resource);
+	const memo = /* @__PURE__ */ new Map();
+	for (const entry of nodes) for (const holder of entry.holders) {
+		const at = {
+			resource: condition.resource,
+			relation: holder.relation,
+			id: entry.id
+		};
+		const share = isEdgeRelation(node?.relations[holder.relation]);
+		if ("principal" in holder) {
+			ctx.add(holder.principal.id, allow ? holderVia(holder, at, share) : void 0);
+			continue;
+		}
+		const walk = await groupMembers(holder.group, ctx, holder.group.resource === condition.resource ? 15 : 16, /* @__PURE__ */ new Set(), memo);
+		if (walk === void 0) {
+			ctx.incomplete();
+			continue;
+		}
+		for (const member of walk.members) ctx.add(member, allow ? holderVia(holder, at, share, holder.group) : void 0);
+	}
+}
+async function discoverRelation(item, allow, ctx, expanded = false) {
+	const condition = relationCondition(item, ctx.resource, ctx.scopes, { resources: ctx.policy.resources });
+	if (condition?.op === "related") {
+		await discoverGraph(condition, allow, ctx);
+		return;
+	}
+	const spec = ctx.resource?.relations[item.relation];
+	if (spec?.includes !== void 0 && !expanded) {
+		for (const name of expandRelation(ctx.resource, item.relation)) await discoverRelation({
+			...item,
+			relation: name
+		}, allow, ctx, true);
+		return;
+	}
+	const via = allow ? {
+		kind: "relation",
+		resource: ctx.permission.resource,
+		relation: item.relation,
+		id: relationId(ownGet(ctx.row, ctx.resource?.id ?? "id")) ?? ""
+	} : void 0;
+	if (isFieldRelation(spec) && spec.memberOf !== void 0) {
+		const scope = resolveScope(ctx.scopes, spec.memberOf);
+		const id = relationId(ownGet(ctx.row, spec.field));
+		const members = scope === void 0 || id === void 0 ? [] : await ctx.list(scope, id);
+		if (members === null) {
+			ctx.incomplete();
+			return;
+		}
+		for (const member of members) ctx.add(member.id, via, member.membership);
+		return;
+	}
+	const column = isFieldRelation(spec) ? spec.field : isPrincipalRelation(spec) ? spec.principal : void 0;
+	const holder = column === void 0 ? void 0 : relationId(ownGet(ctx.row, column));
+	if (holder !== void 0) ctx.add(holder, via);
+}
+function discover(grant, item, ctx) {
+	const allow = grant.effect === "allow";
+	switch (item.kind) {
+		case "role": return discoverRole(item, allow, ctx);
+		case "relation": return discoverRelation(item, allow, ctx);
+		case "anyone":
+		case "authenticated":
+		case "plan":
+		case "actor":
+		case "assurance":
+		case "inherit":
+			ctx.incomplete();
+			return Promise.resolve();
+		default: return unknownKind(item, ctx);
+	}
+}
+/** Holders of a grantee kind this build does not know cannot be listed. */
+function unknownKind(_item, ctx) {
+	ctx.incomplete();
+	return Promise.resolve();
+}
+function memberLister(source, scopes) {
+	const listed = /* @__PURE__ */ new Map();
+	const load = async (scope, id) => {
+		if (source?.list === void 0) return null;
+		try {
+			return (await source.list({
+				scope,
+				id
+			})).flatMap((entry) => typeof entry.principal?.id === "string" ? normalizeMemberships([entry.membership], scopes).map((membership) => ({
+				id: entry.principal.id,
+				membership
+			})) : []);
+		} catch {
+			return null;
+		}
+	};
+	return (scope, id) => {
+		const key = JSON.stringify([scope, id]);
+		const known = listed.get(key) ?? load(scope, id);
+		listed.set(key, known);
+		return known;
+	};
+}
+/**
+* Who holds `permission` on `resource` for the instance's policy and how
+* (role, relation or share), from `MembershipSource.list` and
+* `RelationSource.related`. It lists and never grants; `complete: false`
+* means some holders could not be listed. An instance built from a
+* snapshot answers an empty, incomplete list.
+*/
+function whoCan(permdock, permission, resource) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		permission: permission.key,
+		holders: [],
+		complete: false
+	}));
+	return whoCanWith({
+		policy: internals.policy,
+		permission,
+		row: resource,
+		memberships: internals.env.memberships,
+		reader: internals.relations,
+		cache: internals.relationCache,
+		customGrants: internals.customGrants,
+		team: internals.team
+	});
+}
+async function whoCanWith(input) {
+	const { policy, permission, row } = input;
+	if (permission.kind !== "instance" || row === null || typeof row !== "object") return freezeDeep({
+		permission: permission.key,
+		holders: [],
+		complete: false
+	});
+	const scopes = scopeList(policy.scopes);
+	let complete = !input.customGrants.some((item) => item.grant.permission.key === permission.key);
+	const found = /* @__PURE__ */ new Map();
+	const ctx = {
+		policy,
+		scopes,
+		resource: getResource(policy.permissions, permission.resource),
+		permission,
+		row,
+		reader: input.reader,
+		cache: input.cache,
+		list: memberLister(input.memberships, scopes),
+		add(id, via, membership) {
+			const entry = found.get(id) ?? {
+				memberships: [],
+				via: []
+			};
+			found.set(id, entry);
+			if (via !== void 0) entry.via.push(via);
+			if (membership !== void 0) entry.memberships.push(membership);
+		},
+		incomplete() {
+			complete = false;
+		}
+	};
+	await Promise.all((policy.index.grantsByKey.get(permission.key) ?? []).flatMap((grant) => flattenGrantee(grant.to).map((item) => discover(grant, item, ctx))));
+	const root = rootScope(scopes);
+	const tenantKey = root === void 0 ? void 0 : scopeField(getResource(policy.permissions, permission.resource), root, scopes);
+	const tenant = tenantKey === void 0 ? void 0 : relationId(ownGet(row, tenantKey));
+	const env = {
+		emit: false,
+		simulated: true,
+		skipAlternatives: true,
+		customRoles: [],
+		customGrants: [],
+		listeners: emptyListeners(),
+		sink: void 0,
+		limits: void 0,
+		limitCache: /* @__PURE__ */ new Map(),
+		team: input.team,
+		relations: input.reader
+	};
+	const now = nowSeconds();
+	const ordered = [...found.entries()].toSorted(([a], [b]) => byCodePoint(a, b));
+	const decideAll = () => ordered.map(([id, entry]) => {
+		const subject = freezeDeep({
+			principal: {
+				id,
+				roles: [],
+				memberships: entry.memberships,
+				...tenant === void 0 ? {} : { tenant }
+			},
+			context: {}
+		});
+		return evaluate(policy, subject, permission, row, {
+			call: "simulate",
+			trusted: true,
+			now: instantAt(now)
+		}, env);
+	});
+	let decisions = decideAll();
+	if (pendingRelations(input.cache).length > 0) {
+		await settle(input.cache);
+		decisions = decideAll();
+	}
+	const holders = [];
+	for (const [index, [id, entry]] of ordered.entries()) {
+		const decision = decisions[index];
+		if (decision === void 0 || decision.outcome === "denied") {
+			if (decision?.outcome === "denied" && decision.denials.some((denial) => denial.reason === "relation-unavailable" || denial.reason === "relation-depth")) complete = false;
+			continue;
+		}
+		holders.push({
+			principal: { id },
+			via: entry.via
+		});
+	}
+	return freezeDeep({
+		permission: permission.key,
+		holders,
+		complete
+	});
+}
+//#endregion
+export { whoCan as t };

package/dist/wire-delegation-Cv3W2eaM.js

@@ -0,0 +1,36 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+//#region src/core/wire-delegation.ts
+function toWireDelegation(delegation) {
+	if (delegation === void 0) return;
+	return compact({
+		scope: delegation.scopes?.join(" "),
+		authorization_details: delegation.authorizationDetails,
+		access: delegation.access
+	});
+}
+function scopeList(value) {
+	if (typeof value !== "string") return;
+	return value.split(" ").filter((item) => item.length > 0);
+}
+/**
+* The runtime `Delegation` of a wire delegation. A field of the wrong type
+* becomes an empty scope list, so a malformed delegation narrows to nothing.
+*/
+function fromWireDelegation(value) {
+	if (value === void 0) return;
+	if (!isRecord(value)) return { scopes: [] };
+	const scope = value["scope"];
+	const details = value["authorization_details"];
+	const access = value["access"];
+	if (scope !== void 0 && typeof scope !== "string" || details !== void 0 && !(Array.isArray(details) && details.every(isDetail)) || access !== void 0 && !Array.isArray(access)) return { scopes: [] };
+	return compact({
+		scopes: scopeList(scope),
+		authorizationDetails: details,
+		access
+	});
+}
+function isDetail(value) {
+	return isRecord(value) && typeof value["type"] === "string";
+}
+//#endregion
+export { toWireDelegation as n, fromWireDelegation as t };

package/dist/wire-denial-C7PaVYEM.js

@@ -0,0 +1,27 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+//#region src/core/wire-denial.ts
+const IN_PROCESS = /* @__PURE__ */ new Set(["closure-error", "validation"]);
+function jsonDetail(value) {
+	if (value === void 0 || value === null || value instanceof Error) return;
+	if (typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value !== "object") return;
+	try {
+		return JSON.parse(JSON.stringify(value));
+	} catch {
+		return;
+	}
+}
+function wireDenial(denial) {
+	return compact({
+		role: denial.role,
+		reason: denial.reason,
+		to: denial.to,
+		detail: IN_PROCESS.has(denial.reason) ? void 0 : jsonDetail(denial.detail)
+	});
+}
+function wireDenials(denials) {
+	return denials.map(wireDenial);
+}
+//#endregion
+export { wireDenials as t };

package/dist/workflow/index.d.ts

@@ -0,0 +1,5 @@
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-BMZPIVUM.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CKy4MQSY.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BFfm17UA.js";
+import "../index-CaxrMD1A.js";
+export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -0,0 +1,223 @@
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { n as findPermission } from "../permission-registry-Br4jSNVi.js";
+import { n as isThenable } from "../thenable-yD7SabqG.js";
+import { n as memoryAutomationSource, r as parseAutomation } from "../automation-DVjOckjV.js";
+import { c as withApp, t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { o as automationEvent } from "../sink-BEZSlMS_.js";
+import { a as requestApproval, s as resumeDecision } from "../helpers-DTcZOzhF.js";
+import { n as signRunTicket, r as subjectFromRunTicket } from "../run-ticket-sxFI6LAk.js";
+import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
+//#region src/workflow/create.ts
+function writeQuietly(sink, event) {
+	try {
+		const written = sink.write([event]);
+		if (isThenable(written)) Promise.resolve(written).catch(() => void 0);
+	} catch {}
+}
+const DEFAULT_TTL = 86400;
+function deniedStart(reason, detail) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [compact({
+			role: null,
+			reason,
+			detail
+		})]
+	});
+}
+async function readAutomation(source, id, tenant) {
+	try {
+		const found = await source.automation(id, compact({ tenant }));
+		const parsed = found === null ? void 0 : parseAutomation(found);
+		return parsed === void 0 || parsed.revoked === true ? void 0 : parsed;
+	} catch {
+		return;
+	}
+}
+function idOf(row) {
+	if (row === null || typeof row !== "object") return;
+	const id = Reflect.get(row, "id");
+	return typeof id === "string" ? id : void 0;
+}
+function targetOf(permission, data, resource) {
+	return resource ?? compact({
+		type: permission.resource,
+		id: idOf(data)
+	});
+}
+/**
+* Creates the PermDock for durable runs of published automations. A run
+* acts as the automation's principal with that principal's rights at each
+* step, narrowed to the automation's operations; the trigger is recorded
+* and never grants.
+*/
+function createPermDock(policy, given) {
+	const { signer, verifier, principals, automations, store: approvals, waiter, audience, issuer, expiresIn = DEFAULT_TTL, onAuth, ...permdockOptions } = withApp(policy, given);
+	const instanceFor = (subject) => getPermDock(policy, subject, permdockOptions);
+	const publisherCanAssign = async (automation) => {
+		const publisher = await principals.principal(automation.publishedBy, compact({ tenant: automation.tenant }));
+		if (publisher === null) return false;
+		const instance = await instanceFor({
+			principal: publisher,
+			context: {}
+		});
+		const roles = new Set(instance.assignableRoles(compact({ tenant: automation.tenant })).map((role) => role.key));
+		const ceiling = new Set(instance.assignablePermissions(compact({ tenant: automation.tenant })).map((leaf) => leaf.key));
+		return (automation.roles ?? []).every((role) => roles.has(role)) && automation.permissions.every((key) => ceiling.has(key));
+	};
+	const getPermDock$1 = async (ticket) => {
+		let current;
+		const tracked = { async automation(id, readOptions) {
+			current = await readAutomation(automations, id, readOptions?.tenant);
+			return current ?? null;
+		} };
+		const live = { async principal(id, readOptions) {
+			if (current === void 0) return principals.principal(id, readOptions);
+			if (id !== current.principal) return null;
+			if (current.mode === "publisher") return principals.principal(id, readOptions);
+			if (current.tenant === void 0 || !await publisherCanAssign(current)) return null;
+			return freezeDeep({
+				id: current.principal,
+				kind: "service",
+				tenant: current.tenant,
+				memberships: [{
+					tenant: current.tenant,
+					roles: current.roles ?? []
+				}]
+			});
+		} };
+		let subject;
+		try {
+			subject = await subjectFromRunTicket(ticket, compact({
+				verifier,
+				principals: live,
+				automations: tracked,
+				audience,
+				issuer,
+				onAuth
+			}));
+		} catch {
+			subject = {
+				principal: null,
+				context: {}
+			};
+		}
+		return instanceFor(subject);
+	};
+	const start = async (id, startOptions = {}) => {
+		const automation = await readAutomation(automations, id, startOptions.tenant);
+		if (automation === void 0) return deniedStart("validation", { cause: "automation-unavailable" });
+		const { caller } = startOptions;
+		if (caller !== void 0) {
+			const run = automation.run === void 0 ? void 0 : findPermission(policy.permissions, automation.run);
+			if (run === void 0) return deniedStart("no-grant", { permission: automation.run ?? null });
+			const decision = caller.decide(run, startOptions.row);
+			if (decision.outcome !== "granted") return freezeDeep({
+				outcome: "denied",
+				denials: decision.outcome === "denied" ? decision.denials : [{
+					role: null,
+					reason: "approval"
+				}]
+			});
+		}
+		const scopes = [];
+		for (const key of automation.permissions) {
+			const leaf = findPermission(policy.permissions, key);
+			if (leaf === void 0) return deniedStart("validation", { permission: key });
+			scopes.push(leaf.scope);
+		}
+		const runId = startOptions.id ?? globalThis.crypto.randomUUID();
+		const runAutomation = {
+			id: automation.id,
+			version: automation.version
+		};
+		const signed = await signRunTicket(compact({
+			principal: automation.principal,
+			kind: "automation",
+			actor: {
+				id: automation.id,
+				kind: "automation"
+			},
+			delegation: { scopes },
+			automation: runAutomation,
+			tenant: automation.tenant,
+			trigger: startOptions.trigger,
+			binding: startOptions.binding,
+			id: runId,
+			expiresIn
+		}), signer, compact({
+			audience,
+			now: startOptions.now
+		}));
+		if (permdockOptions.sink !== void 0) writeQuietly(permdockOptions.sink, automationEvent({
+			operation: "run",
+			automation,
+			run: runId
+		}));
+		return freezeDeep({
+			outcome: "started",
+			ticket: signed,
+			run: {
+				id: runId,
+				automation: runAutomation
+			}
+		});
+	};
+	const opened = async (ticket, permission, data, decideOptions) => {
+		const { resource, ttl, signal: _signal, ...rest } = decideOptions;
+		const first = await getPermDock$1(ticket);
+		const decision = first.decide(permission, data, rest);
+		if (decision.outcome !== "approval-required" || approvals === void 0) return { decision };
+		return {
+			decision,
+			expiresAt: (await requestApproval(approvals, decision, compact({
+				permission,
+				resource: targetOf(permission, data, resource),
+				subject: first.subject,
+				adapter: "workflow",
+				ttl
+			}))).expiresAt
+		};
+	};
+	const openApproval = async (ticket, permission, data, decideOptions = {}) => (await opened(ticket, permission, data, decideOptions)).decision;
+	const resumeApproval = async (ticket, permission, token, data, decideOptions = {}) => {
+		const { resource, ttl: _ttl, signal: _signal, ...rest } = decideOptions;
+		const run = await getPermDock$1(ticket);
+		const decision = run.decide(permission, data, rest);
+		if (approvals === void 0) return decision;
+		return resumeDecision({
+			decision,
+			permission,
+			subject: run.subject,
+			store: approvals,
+			resource: targetOf(permission, data, resource),
+			adapter: "workflow",
+			token
+		});
+	};
+	const awaitApproval = async (ticket, permission, data, decideOptions = {}) => {
+		if (waiter === void 0) {
+			const { resource: _resource, ttl: _ttl, signal: _signal, ...rest } = decideOptions;
+			return (await getPermDock$1(ticket)).decide(permission, data, rest);
+		}
+		const { decision, expiresAt } = await opened(ticket, permission, data, decideOptions);
+		if (decision.outcome !== "approval-required" || expiresAt === void 0) return decision;
+		try {
+			await waiter.wait(decision.token, compact({
+				expiresAt: { epochMilliseconds: Date.parse(expiresAt) },
+				signal: decideOptions.signal
+			}));
+		} catch {}
+		return resumeApproval(ticket, permission, decision.token, data, decideOptions);
+	};
+	return Object.freeze({
+		start,
+		getPermDock: getPermDock$1,
+		awaitApproval,
+		openApproval,
+		resumeApproval
+	});
+}
+//#endregion
+export { createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };