@agent-native/core 0.210.2 → 0.211.0-nightly-20261020183616

package/dist/deploy/build.js

@@ -1127,7 +1127,9 @@ export function generateWorkerEntry(routes, pluginPaths, defaultPluginStems = []
         actionRegistrations.push(`  const ${handlerName} = defineEventHandler(async (event) => {
     setResponseHeader(event, "Cache-Control", "no-" + "store");
     const actionIsUiOnly = ${a.uiOnly ? "true" : `${varName}.uiOnly === true`};
-    const uiActionContext = actionIsUiOnly
+    const actionDeclaresApproval =
+      ${varName}.needsApproval !== undefined && ${varName}.needsApproval !== false;
+    const uiActionContext = actionIsUiOnly || actionDeclaresApproval
       ? await getGeneratedUiActionContext(event)
       : undefined;
     if (actionIsUiOnly && !uiActionContext) {
@@ -1175,10 +1177,29 @@ export function generateWorkerEntry(routes, pluginPaths, defaultPluginStems = []
         actionName: ${JSON.stringify(a.name)},
         ...(actionContext ?? {}),
       };
-      const runAction = () => ${varName}.run(params, actionRunContext);
+      const runAction = async () => {
+        if (
+          actionDeclaresApproval &&
+          !(uiActionContext && caller === "frontend")
+        ) {
+          const refusal = await generatedActionApprovalRefusal(
+            ${varName},
+            params,
+            actionRunContext,
+          );
+          if (refusal) {
+            return new Response(
+              JSON.stringify({ error: refusal.message, errorCode: refusal.errorCode }),
+              { status: refusal.statusCode, headers: { "Content-Type": "application/json" } },
+            );
+          }
+        }
+        return ${varName}.run(params, actionRunContext);
+      };
       const result = actionContext
         ? await runWithGeneratedRequestContext(actionContext, runAction)
         : await runAction();
+      if (result instanceof Response) return result;
       if (typeof result === "string") { try { return JSON.parse(result); } catch { return result; } }
       return result;
     } catch (err) {
@@ -1200,7 +1221,7 @@ ${["post", "put", "delete"]
   getFrameworkRoutePrefix as getAgentNativeFrameworkRoutePrefix,
   getSsrAuthRedirectScript as getAgentNativeSsrAuthRedirectScript,
   resolveAppHomePath as resolveAgentNativeAppHomePath,
-${hasActions ? "  getSession as getGeneratedSession,\n  hasUiActionCapability as hasGeneratedUiActionCapability,\n  isSameOriginRequest as isGeneratedSameOriginRequest,\n  mountUiActionCapabilityRoute as mountGeneratedUiActionCapabilityRoute,\n  resolveOrgIdForEmailViaEvent as resolveGeneratedOrgId,\n  runWithRequestContext as runWithGeneratedRequestContext,\n" : ""}
+${hasActions ? "  directHttpActionApprovalRefusal as generatedActionApprovalRefusal,\n  getSession as getGeneratedSession,\n  hasUiActionCapability as hasGeneratedUiActionCapability,\n  isSameOriginRequest as isGeneratedSameOriginRequest,\n  mountUiActionCapabilityRoute as mountGeneratedUiActionCapabilityRoute,\n  resolveOrgIdForEmailViaEvent as resolveGeneratedOrgId,\n  runWithRequestContext as runWithGeneratedRequestContext,\n" : ""}
 } from "${EDGE_SERVER_ENTRYPOINT}";`);
     for (let i = 0; i < edgePlugins.length; i++) {
         const varName = `plugin_${i}`;

package/dist/file-upload/actions/upload-image.d.ts

@@ -33,9 +33,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     idempotencyKey: string;
     deleted: boolean;
 } | {
+    id?: undefined;
     error: string;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
     configured?: undefined;
 } | {
@@ -45,8 +45,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     configured?: undefined;
     error?: undefined;
 } | {
-    url?: undefined;
     id?: undefined;
+    url?: undefined;
     provider?: undefined;
     error: string;
     configured: boolean;

package/dist/mcp/actions/revoke-org-service-token.js

@@ -10,11 +10,15 @@ import { defineAction } from "../../action.js";
 import { revokeOrgServiceToken } from "../connect-store.js";
 import { requireServiceTokenCaller } from "./service-token-access.js";
 export default defineAction({
-    description: "Revoke one of your organization's service tokens by id (get ids from list-org-service-tokens). The token stops working immediately. Org owner/admin only. Idempotent.",
+    description: "Revoke one of your organization's service tokens by id (get ids from list-org-service-tokens). The token stops working immediately. Every call needs the user's approval. Org owner/admin only. Idempotent.",
     schema: z.object({
         id: z.string().min(1).describe("Service token id to revoke"),
     }),
     toolCallable: false,
+    // It creates, changes, or revokes a credential or who may use one: every
+    // call needs the user's approval, and "always allow" is not offered.
+    needsApproval: true,
+    allowPersistentApproval: false,
     run: async (args, ctx) => {
         const caller = await requireServiceTokenCaller({
             userEmail: ctx?.userEmail,

package/dist/mcp/execute-action-call.js

@@ -1,6 +1,6 @@
 import { isMcpReadOnlyTool } from "../action-call-classification.js";
 import { vouchedOutcome } from "../action-frame.js";
-import { actionCallIntent, isActionContractError, recordInvalidActionCall, preparedCallArguments, runPreparedActionCall, } from "../action.js";
+import { actionCallIntent, isActionContractError, recordInvalidActionCall, preparedCallNeedsApproval, runPreparedActionCall, } from "../action.js";
 import { AGENT_IMAGES_FIELD } from "../agent/tool-result-images.js";
 import { MCP_ACTION_RESULT_MARKER, isMcpActionResult, mcpActionResultText, } from "../mcp-client/app-result.js";
 import { assertServicePrincipalMayCall, assertServicePrincipalMayRun, recordServicePrincipalDenial, ServicePrincipalRefusedError, } from "../org/service-principal-guard.js";
@@ -564,22 +564,13 @@ async function authorizeApproval(context, call, entry, args, prepared) {
     if (entry.needsApproval === undefined) {
         return { status: "authorized", clientAccepted: false };
     }
-    let mustApprove = false;
-    try {
-        mustApprove =
-            typeof entry.needsApproval === "function"
-                ? Boolean(await entry.needsApproval(preparedCallArguments(prepared), {
-                    userEmail: getRequestUserEmail(),
-                    orgId: getRequestOrgId() ?? null,
-                    appId: context.appId,
-                    caller: "mcp",
-                    actionName: name,
-                }))
-                : entry.needsApproval === true;
-    }
-    catch {
-        mustApprove = true;
-    }
+    const mustApprove = await preparedCallNeedsApproval(entry, prepared, {
+        userEmail: getRequestUserEmail(),
+        orgId: getRequestOrgId() ?? null,
+        appId: context.appId,
+        caller: "mcp",
+        actionName: name,
+    });
     if (!mustApprove)
         return { status: "authorized", clientAccepted: false };
     if (!hasVerifiedUserIdentity) {

package/dist/mcp/screen-memory-stdio.d.ts

@@ -140,13 +140,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -171,13 +171,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -196,13 +196,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -231,13 +231,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -260,12 +260,12 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -317,7 +317,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -337,6 +336,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 type: string;
             };
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -352,7 +352,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -361,6 +360,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             requestId: {
                 type: string;
             };
+            count?: undefined;
         };
     };
 })[];

package/dist/notifications/routes.d.ts

@@ -16,6 +16,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -27,39 +27,39 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
-    ok?: undefined;
 } | {
     error?: undefined;
+    ok?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
-    ok?: undefined;
 } | {
     error?: undefined;
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing: true;
     id: string;
-    ok?: undefined;
 } | {
     error?: undefined;
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing?: undefined;
     id: string;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     error: any;
-    ok?: undefined;
 } | {
     error?: undefined;
     message?: undefined;

package/dist/org/actions/set-app-member-roles.js

@@ -19,6 +19,10 @@ export default defineAction({
             return `Updated ${args.appId} roles for ${args.email}: [${(change.previousRoles ?? []).join(", ")}] -> [${(change.roles ?? []).join(", ")}]`;
         },
     }),
+    // It changes who may use an app or what they may do in it: every call
+    // needs the user's approval, and "always allow" is not offered.
+    needsApproval: true,
+    allowPersistentApproval: false,
     run: async ({ appId, email, roles }, ctx) => {
         const caller = await requireOrgMember(ctx, true);
         const descriptor = getRegisteredAppRoles(appId);

package/dist/org/actions/set-app-permission-roles.js

@@ -19,6 +19,10 @@ export default defineAction({
             return `${args.reset ? "Reset" : "Updated"} ${args.appId} permission ${args.permission}: [${(change.previousRoles ?? []).join(", ")}] -> [${(change.roles ?? []).join(", ")}]`;
         },
     }),
+    // It changes who may use an app or what they may do in it: every call
+    // needs the user's approval, and "always allow" is not offered.
+    needsApproval: true,
+    allowPersistentApproval: false,
     run: async ({ appId, permission, roles, reset }, ctx) => {
         const caller = await requireOrgMember(ctx, true);
         const descriptor = getRegisteredAppRoles(appId);

package/dist/org/actions/set-workspace-app-access.js

@@ -16,6 +16,10 @@ export default defineAction({
         targetId: (args) => args.appId,
         summary: (args) => `Set ${args.appId} workspace access to ${args.mode}`,
     }),
+    // It changes who may use an app or what they may do in it: every call
+    // needs the user's approval, and "always allow" is not offered.
+    needsApproval: true,
+    allowPersistentApproval: false,
     run: async ({ appId, mode }, ctx) => {
         const caller = await requireOrgMember(ctx, true);
         const db = getDbExec();

package/dist/org/index.d.ts

@@ -162,10 +162,10 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     soloDeploymentAdmin: boolean;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    name?: undefined;
     success: boolean;
-    role?: undefined;
     id?: undefined;
+    name?: undefined;
+    role?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,10 +75,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    provider?: undefined;
+    message?: undefined;
     id?: undefined;
-    deleted?: undefined;
-    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -89,45 +87,47 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
+    provider?: undefined;
+    found?: undefined;
+    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
     id?: undefined;
-    count?: undefined;
-    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
+    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
-    count?: undefined;
-    deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
+    count?: undefined;
+    provider?: undefined;
     found: boolean;
     id: string;
+    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
+    message?: undefined;
+    providers?: undefined;
     count?: undefined;
+    provider?: undefined;
     found?: undefined;
-    providers?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
+    providers?: undefined;
     count?: undefined;
-    deleted?: undefined;
+    provider?: undefined;
     found?: undefined;
-    providers?: undefined;
+    deleted?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -316,11 +316,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        id?: undefined;
         provider?: undefined;
-        message?: undefined;
+        id?: undefined;
         deleted?: undefined;
-        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -331,44 +329,46 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        found?: undefined;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         id?: undefined;
-        count?: undefined;
-        message?: undefined;
         deleted?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         provider?: undefined;
-        count?: undefined;
-        message?: undefined;
         deleted?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         provider?: undefined;
+        providers?: undefined;
         count?: undefined;
-        message?: undefined;
         found?: undefined;
-        providers?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         provider?: undefined;
-        count?: undefined;
         deleted?: undefined;
-        found?: undefined;
         providers?: undefined;
+        count?: undefined;
+        found?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/resources/handlers.d.ts

@@ -39,8 +39,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
     error: string;
 }>;
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/review/suggestions/actions.d.ts

@@ -83,6 +83,7 @@ export declare const createResourceSuggestionProposal: import("../../action.js")
         }[];
         metadata?: Record<string, unknown>;
     }[];
+    supersedes?: string[];
 }, {
     proposal: import("./types.js").ResourceSuggestionProposal;
     suggestions: ResourceSuggestion[];

package/dist/review/suggestions/actions.js

@@ -58,6 +58,50 @@ function assertCreationReplay(receipt, requestHash, authorEmail, actorKind) {
     }
     return receipt.suggestion;
 }
+// One revised proposal can replace every edit of the one before it.
+const MAX_SUPERSEDED = 100;
+async function supersedeSuggestions(tx, args, authorEmail, replacementId) {
+    for (const supersededId of new Set(args.supersedes ?? [])) {
+        const prior = await getSuggestion(supersededId, tx);
+        if (!prior ||
+            prior.resourceType !== args.resourceType ||
+            prior.resourceId !== args.resourceId) {
+            fail("A superseded suggestion was not found on this resource", {
+                statusCode: 404,
+                errorCode: "not_found",
+            });
+        }
+        if (!authorEmail || prior.authorEmail !== authorEmail) {
+            fail("Only the author can supersede this suggestion", {
+                statusCode: 403,
+                errorCode: "forbidden",
+            });
+        }
+        if (prior.status !== "pending")
+            continue;
+        const claimed = await updateSuggestionStatus(tx, prior.id, "superseded", prior.revision);
+        if (!claimed) {
+            const latest = await getSuggestion(prior.id, tx);
+            // A reviewer decided it first; only pending proposals are replaced.
+            if (latest && latest.status !== "pending")
+                continue;
+            fail("The superseded suggestion changed; refresh and try again", {
+                statusCode: 409,
+                errorCode: "suggestion_conflict",
+            });
+        }
+        await recordDecision(tx, {
+            suggestionId: prior.id,
+            idempotencyKey: `${args.idempotencyKey}:supersedes:${prior.id}`,
+            reviewer: authorEmail,
+            decision: "superseded",
+            observedBase: prior.baseRevision,
+            outcome: "superseded",
+            detail: replacementId,
+        });
+        await resolveReviewThreadWithClient(tx, prior.threadId, authorEmail, { resourceType: prior.resourceType, resourceId: prior.resourceId }, "superseded");
+    }
+}
 export const createResourceSuggestion = defineAction({
     description: "Create a typed pending suggestion without changing the canonical resource. Pass supersedes to replace your own earlier pending suggestions on the same resource in the same step.",
     schema: z.object({
@@ -70,7 +114,7 @@ export const createResourceSuggestion = defineAction({
         metadata: z.record(z.string(), z.unknown()).optional(),
         supersedes: z
             .array(z.string().min(1))
-            .max(20)
+            .max(MAX_SUPERSEDED)
             .optional()
             .describe("IDs of your own earlier suggestions on this resource that this one replaces. Pending ones become superseded atomically with this creation; already decided ones are left as they are."),
     }),
@@ -133,46 +177,7 @@ export const createResourceSuggestion = defineAction({
                     threadComment: null,
                 };
             }
-            for (const supersededId of new Set(args.supersedes ?? [])) {
-                const prior = await getSuggestion(supersededId, tx);
-                if (!prior ||
-                    prior.resourceType !== args.resourceType ||
-                    prior.resourceId !== args.resourceId) {
-                    fail("A superseded suggestion was not found on this resource", {
-                        statusCode: 404,
-                        errorCode: "not_found",
-                    });
-                }
-                if (!authorEmail || prior.authorEmail !== authorEmail) {
-                    fail("Only the author can supersede this suggestion", {
-                        statusCode: 403,
-                        errorCode: "forbidden",
-                    });
-                }
-                if (prior.status !== "pending")
-                    continue;
-                const claimed = await updateSuggestionStatus(tx, prior.id, "superseded", prior.revision);
-                if (!claimed) {
-                    const latest = await getSuggestion(prior.id, tx);
-                    // A reviewer decided it first; only pending proposals are replaced.
-                    if (latest && latest.status !== "pending")
-                        continue;
-                    fail("The superseded suggestion changed; refresh and try again", {
-                        statusCode: 409,
-                        errorCode: "suggestion_conflict",
-                    });
-                }
-                await recordDecision(tx, {
-                    suggestionId: prior.id,
-                    idempotencyKey: `${args.idempotencyKey}:supersedes:${prior.id}`,
-                    reviewer: authorEmail,
-                    decision: "superseded",
-                    observedBase: prior.baseRevision,
-                    outcome: "superseded",
-                    detail: created.id,
-                });
-                await resolveReviewThreadWithClient(tx, prior.threadId, authorEmail, { resourceType: prior.resourceType, resourceId: prior.resourceId }, "superseded");
-            }
+            await supersedeSuggestions(tx, args, authorEmail, created.id);
             const threadComment = await insertReviewCommentWithClient({
                 resourceType: created.resourceType,
                 resourceId: created.resourceId,
@@ -533,6 +538,11 @@ const proposalCreationSchema = z.object({
         metadata: z.record(z.string(), z.unknown()).optional(),
     }))
         .min(1),
+    supersedes: z
+        .array(z.string().min(1))
+        .max(MAX_SUPERSEDED)
+        .optional()
+        .describe("IDs of your own earlier suggestions on this resource that this proposal replaces. Pending ones become superseded atomically with this creation; already decided ones are left as they are."),
 });
 export const getResourceSuggestionProposalByCreationKey = defineAction({
     description: "Find an earlier proposal creation by its idempotency key before recomputing an edit.",
@@ -565,7 +575,7 @@ export const getResourceSuggestionProposalByCreationKey = defineAction({
     },
 });
 export const createResourceSuggestionProposal = defineAction({
-    description: "Create or append independently reviewable suggestions under one durable proposal.",
+    description: "Create or append independently reviewable suggestions under one durable proposal. Pass supersedes to replace your own earlier pending suggestions on the same resource in the same step.",
     schema: proposalCreationSchema,
     run: async (args, ctx) => {
         await assertReviewableResourceAccess(args.resourceType, args.resourceId, ctx, "commenter");
@@ -582,6 +592,7 @@ export const createResourceSuggestionProposal = defineAction({
             summary: args.summary,
             operations: args.suggestions,
             metadata: { proposalId: args.proposalId ?? null },
+            supersedes: args.supersedes,
         });
         const db = getDbExec();
         await ensureSuggestionTables();
@@ -701,6 +712,7 @@ export const createResourceSuggestionProposal = defineAction({
             const recorded = await recordProposalCreation(tx, args.idempotencyKey, proposal.id, authorEmail, actorKind, requestHash, suggestions.map((suggestion) => suggestion.id));
             if (!recorded)
                 throw concurrentCreation;
+            await supersedeSuggestions(tx, args, authorEmail, suggestions[0].id);
             return { proposal, suggestions, comments };
         })
             .catch(async (error) => {

package/dist/secrets/actions/delete-api-key.js

@@ -29,6 +29,10 @@ export default defineAction({
             ? `Deleted organization key ${args.name}`
             : `Deleted personal key ${args.name}`,
     },
+    // It creates, changes, or revokes a credential or who may use one: every
+    // call needs the user's approval, and "always allow" is not offered.
+    needsApproval: true,
+    allowPersistentApproval: false,
     run: async (args, ctx) => {
         const email = ctx?.userEmail?.trim().toLowerCase();
         if (!email)