@peers-app/peers-sdk 0.21.7 → 0.23.0

package/dist/data/group-permissions.js

@@ -3,19 +3,41 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GroupMemberRole = void 0;
 exports.getUserRole = getUserRole;
 exports.getUserRoleFromPublicKey = getUserRoleFromPublicKey;
+exports.getCurrentUserAccessLevel = getCurrentUserAccessLevel;
+exports.getUserAccessLevel = getUserAccessLevel;
 exports.verifyGroupSignature = verifyGroupSignature;
 exports.isGroupMemberSignatureValid = isGroupMemberSignatureValid;
 const context_1 = require("../context");
 const keys_1 = require("../keys");
+const access_level_1 = require("./access-level");
 const group_member_roles_1 = require("./group-member-roles");
 Object.defineProperty(exports, "GroupMemberRole", { enumerable: true, get: function () { return group_member_roles_1.GroupMemberRole; } });
-async function getUserRole(groupId, userId) {
+/**
+ * Return a user's {@link GroupMemberRole} in `groupId`.
+ *
+ * Missing groups and the group's founder resolve to {@link GroupMemberRole.Founder},
+ * which is how a personal context (no Groups row) becomes access 100.
+ *
+ * Prefer passing `userContext` from the provider that owns the data. The
+ * process singleton is only a fallback and is not awaited — multi-device
+ * tests never set it, and hanging here would stall contract calls.
+ *
+ * @param groupId - Group id, or the user's id for their personal context.
+ * @param userId - User whose role is requested.
+ * @param userContext - Provider-owned context. Falls back to {@link peekUserContext}.
+ * @throws If neither an explicit context nor the process singleton is available.
+ */
+async function getUserRole(groupId, userId, userContext) {
     const { Groups } = await Promise.resolve().then(() => require("./groups"));
     const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
-    const userContext = await (0, context_1.getUserContext)();
-    const groupDataContext = userContext.getDataContext(groupId);
+    const ctx = userContext ?? (0, context_1.peekUserContext)();
+    if (!ctx) {
+        throw new Error("User context is not available");
+    }
+    await ctx.loadingPromise;
+    const groupDataContext = ctx.getDataContext(groupId);
     const group = (await Groups(groupDataContext).get(groupId)) ||
-        (await Groups(userContext.userDataContext).get(groupId));
+        (await Groups(ctx.userDataContext).get(groupId));
     // If the group doesn't exist or the current user is explicitly the founder, return Founder role
     if (!group || group.founderUserId === userId) {
         return group_member_roles_1.GroupMemberRole.Founder;
@@ -26,17 +48,57 @@ async function getUserRole(groupId, userId) {
     }
     return group.publicRole || group_member_roles_1.GroupMemberRole.None;
 }
+/**
+ * Resolve a group role from the signing public key of a Users record.
+ *
+ * Uses {@link peekUserContext}; throws if the process singleton is unset.
+ *
+ * @param groupId - Group or personal context id.
+ * @param publicKey - User public key that signed a record.
+ */
 async function getUserRoleFromPublicKey(groupId, publicKey) {
     const { Users } = await Promise.resolve().then(() => require("./users"));
-    const userContext = await (0, context_1.getUserContext)();
+    const userContext = (0, context_1.peekUserContext)();
+    if (!userContext) {
+        throw new Error("User context is not available");
+    }
+    await userContext.loadingPromise;
     const groupDataContext = userContext.getDataContext(groupId);
     const user = (await Users(groupDataContext).findOne({ publicKey })) ||
         (await Users(userContext.userDataContext).findOne({ publicKey }));
     if (user) {
-        return getUserRole(groupId, user?.userId);
+        return getUserRole(groupId, user?.userId, userContext);
     }
     return group_member_roles_1.GroupMemberRole.None;
 }
+/**
+ * Return the current user's access level in `dataContext`.
+ *
+ * Personal contexts (no `groupId`) use the user's id and resolve to 100.
+ *
+ * @param dataContext - Context whose group/personal role is evaluated.
+ */
+async function getCurrentUserAccessLevel(dataContext) {
+    const userId = dataContext.userContext.userId;
+    return getUserAccessLevel(dataContext, userId);
+}
+/**
+ * Return `userId`'s access level in `dataContext`.
+ *
+ * @param dataContext - Context whose group/personal role is evaluated.
+ * @param userId - User to resolve.
+ */
+async function getUserAccessLevel(dataContext, userId) {
+    const contextKey = dataContext.groupId ?? dataContext.userContext.userId;
+    const role = await getUserRole(contextKey, userId, dataContext.userContext);
+    return (0, access_level_1.accessLevelFromGroupRole)(role);
+}
+/**
+ * Verify that a group record was signed by an Admin+ member (Founder to change founder).
+ *
+ * @param group - Proposed group record.
+ * @param oldGroup - Previous record when this is an update.
+ */
 async function verifyGroupSignature(group, oldGroup) {
     (0, keys_1.verifyObjectSignature)(group);
     const publicKey = (0, keys_1.getPublicKeyFromObjectSignature)(group) ?? "";
@@ -50,6 +112,14 @@ async function verifyGroupSignature(group, oldGroup) {
         throw new Error("Only group admins can modify group settings");
     }
 }
+/**
+ * Return whether a group-member write is signed by someone allowed to make it.
+ *
+ * @param groupId - Group the membership belongs to.
+ * @param newGroupMember - Proposed membership row.
+ * @param oldGroupMember - Previous row when this is an update.
+ * @param signerRole - Optional precomputed signer role.
+ */
 async function isGroupMemberSignatureValid(groupId, newGroupMember, oldGroupMember, signerRole) {
     oldGroupMember ??= newGroupMember;
     // Basic signature verification

package/dist/data/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./access-level";
 export * from "./assistants";
 export * from "./change-tracking";
 export * from "./channels";
@@ -20,12 +21,13 @@ export * from "./peer-types";
 export * from "./persistent-vars";
 export * from "./sync-recovery-queue";
 export * from "./table-definitions-table";
+export * from "./tool-access";
+export * from "./tool-access-approvals";
 export * from "./tool-tests";
 export * from "./tools";
 export * from "./user-permissions";
 export * from "./user-trust-levels";
 export * from "./users";
-export * from "./voice-messages";
 export * from "./welcome-modal.pvar";
 export * from "./workflow-logs";
 export * from "./workflow-runs";

package/dist/data/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./access-level"), exports);
 __exportStar(require("./assistants"), exports);
 __exportStar(require("./change-tracking"), exports);
 __exportStar(require("./channels"), exports);
@@ -36,12 +37,13 @@ __exportStar(require("./peer-types"), exports);
 __exportStar(require("./persistent-vars"), exports);
 __exportStar(require("./sync-recovery-queue"), exports);
 __exportStar(require("./table-definitions-table"), exports);
+__exportStar(require("./tool-access"), exports);
+__exportStar(require("./tool-access-approvals"), exports);
 __exportStar(require("./tool-tests"), exports);
 __exportStar(require("./tools"), exports);
 __exportStar(require("./user-permissions"), exports);
 __exportStar(require("./user-trust-levels"), exports);
 __exportStar(require("./users"), exports);
-__exportStar(require("./voice-messages"), exports);
 __exportStar(require("./welcome-modal.pvar"), exports);
 __exportStar(require("./workflow-logs"), exports);
 __exportStar(require("./workflow-runs"), exports);

package/dist/data/orm/sql.data-source.d.ts

@@ -34,6 +34,16 @@ export declare class SQLDataSource<T extends {
     delete(idOrRecord: string | T): Promise<void>;
     dropTableIfExists(): Promise<void>;
     clearTable(): Promise<void>;
+    /**
+     * Validate `record` and copy Zod defaults onto missing keys so NOT NULL
+     * columns (for example `accessLevel`) are written on insert.
+     */
+    private applySchemaDefaults;
+    /**
+     * Columns to SET on update. Required fields that are missing are omitted so
+     * older peers without a new column do not overwrite a local value with NULL.
+     */
+    private fieldsForUpdate;
     initRecord(data?: Partial<T>): T;
     /**
      * Synchronous insert for use within transactions.

package/dist/data/orm/sql.data-source.js

@@ -245,13 +245,7 @@ class SQLDataSource {
             // @ts-expect-error - need to figure out how to get typescript to understand what's going on here
             record[this.metaData.primaryKeyName] = (0, utils_1.newid)();
         }
-        // validate data
-        try {
-            this.schema.parse(record);
-        }
-        catch (e) {
-            throw new Error(`Validation on insert failed for ${this.tableName}: ${e}`);
-        }
+        this.applySchemaDefaults(record);
         const fields = this.metaData.fields.map((field) => `"${field.name}"`).join(", ");
         const values = this.metaData.fields.map((field) => jsValueToSqlValue(record[field.name]));
         const placeholders = values.map((_v) => "?").join(", ");
@@ -265,16 +259,14 @@ class SQLDataSource {
             // @ts-expect-error - need to figure out how to get typescript to understand what's going on here
             record[this.metaData.primaryKeyName] = (0, utils_1.newid)();
         }
-        // validate data
         this.schema.parse(record);
         const primaryKey = record[this.metaData.primaryKeyName];
-        const fields = this.metaData.fields
-            .filter((field) => field.name !== this.metaData.primaryKeyName)
-            .map((field) => `"${field.name}" = ?`)
-            .join(",\n");
-        const values = this.metaData.fields
-            .filter((field) => field.name !== this.metaData.primaryKeyName)
-            .map((field) => jsValueToSqlValue(record[field.name]));
+        const updateFields = this.fieldsForUpdate(record);
+        if (updateFields.length === 0) {
+            return record;
+        }
+        const fields = updateFields.map((field) => `"${field.name}" = ?`).join(",\n");
+        const values = updateFields.map((field) => jsValueToSqlValue(record[field.name]));
         const sql = [
             `UPDATE "${this.tableName}"`,
             `SET ${fields}`,
@@ -299,6 +291,40 @@ class SQLDataSource {
         const sql = `DELETE FROM "${this.tableName}"`;
         await this.db.exec(sql, []);
     }
+    /**
+     * Validate `record` and copy Zod defaults onto missing keys so NOT NULL
+     * columns (for example `accessLevel`) are written on insert.
+     */
+    applySchemaDefaults(record) {
+        let parsed;
+        try {
+            parsed = this.schema.parse(record);
+        }
+        catch (e) {
+            throw new Error(`Validation on insert failed for ${this.tableName}: ${e}`);
+        }
+        const writable = record;
+        for (const field of this.metaData.fields) {
+            if (writable[field.name] === undefined && parsed[field.name] !== undefined) {
+                writable[field.name] = parsed[field.name];
+            }
+        }
+    }
+    /**
+     * Columns to SET on update. Required fields that are missing are omitted so
+     * older peers without a new column do not overwrite a local value with NULL.
+     */
+    fieldsForUpdate(record) {
+        return this.metaData.fields.filter((field) => {
+            if (field.name === this.metaData.primaryKeyName) {
+                return false;
+            }
+            if (record[field.name] === undefined && !field.optional) {
+                return false;
+            }
+            return true;
+        });
+    }
     initRecord(data = {}) {
         const defaults = {};
         for (const field of this.metaData.fields) {
@@ -323,13 +349,7 @@ class SQLDataSource {
             // @ts-expect-error - need to figure out how to get typescript to understand what's going on here
             record[this.metaData.primaryKeyName] = (0, utils_1.newid)();
         }
-        // validate data
-        try {
-            this.schema.parse(record);
-        }
-        catch (e) {
-            throw new Error(`Validation on insert failed for ${this.tableName}: ${e}`);
-        }
+        this.applySchemaDefaults(record);
         const fields = this.metaData.fields.map((field) => `"${field.name}"`).join(", ");
         const values = this.metaData.fields.map((field) => jsValueToSqlValue(record[field.name]));
         const placeholders = values.map((_v) => "?").join(", ");
@@ -346,16 +366,14 @@ class SQLDataSource {
             // @ts-expect-error - need to figure out how to get typescript to understand what's going on here
             record[this.metaData.primaryKeyName] = (0, utils_1.newid)();
         }
-        // validate data
         this.schema.parse(record);
         const primaryKey = record[this.metaData.primaryKeyName];
-        const fields = this.metaData.fields
-            .filter((field) => field.name !== this.metaData.primaryKeyName)
-            .map((field) => `"${field.name}" = ?`)
-            .join(",\n");
-        const values = this.metaData.fields
-            .filter((field) => field.name !== this.metaData.primaryKeyName)
-            .map((field) => jsValueToSqlValue(record[field.name]));
+        const updateFields = this.fieldsForUpdate(record);
+        if (updateFields.length === 0) {
+            return record;
+        }
+        const fields = updateFields.map((field) => `"${field.name}" = ?`).join(",\n");
+        const values = updateFields.map((field) => jsValueToSqlValue(record[field.name]));
         const sql = [
             `UPDATE "${this.tableName}"`,
             `SET ${fields}`,

package/dist/data/orm/sql.data-source.test.js

@@ -205,6 +205,19 @@ describe("table", () => {
             newTask.title = "Test Task";
             expect(() => TasksTable.schema.parse(newTask)).not.toThrow();
         });
+        it("applies schema defaults on insert and preserves required fields on partial update", async () => {
+            const inserted = await TasksTable.insert({ title: "Defaulted body" });
+            expect(inserted.body).toBe("");
+            const stored = await TasksTable.get(inserted.taskId);
+            expect(stored?.body).toBe("");
+            await TasksTable.update({
+                taskId: inserted.taskId,
+                title: "Renamed",
+            });
+            const afterUpdate = await TasksTable.get(inserted.taskId);
+            expect(afterUpdate?.title).toBe("Renamed");
+            expect(afterUpdate?.body).toBe("");
+        });
         afterAll(async () => {
             await TasksTable.dropTableIfExists();
             await TasksTable.db.close();

package/dist/data/package-version-resolver.test.js

@@ -7,6 +7,7 @@ const SQLiteDB = require("better-sqlite3");
 const user_context_1 = require("../context/user-context");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const utils_1 = require("../utils");
+const access_level_1 = require("./access-level");
 const assistants_1 = require("./assistants");
 const group_member_roles_1 = require("./group-member-roles");
 const groups_1 = require("./groups");
@@ -375,6 +376,7 @@ describe("resolveDevicePackageVersion — expected behavior (control)", () => {
         const savedAssistant = await (0, assistants_1.Assistants)(dc).get(testAssistantId);
         expect(savedAssistant).toBeDefined();
         expect(savedAssistant?.name).toBe("Upgrade Test Assistant");
+        expect(savedAssistant?.accessLevel).toBe(access_level_1.DEFAULT_ACCESS_LEVEL);
         const savedWorkflow = await (0, workflows_1.Workflows)(dc).get(testWorkflowId);
         expect(savedWorkflow).toBeDefined();
         expect(savedWorkflow?.name).toBe("Upgrade Test Workflow");

package/dist/data/tool-access-approvals.d.ts

@@ -0,0 +1,126 @@
+import { z } from "zod";
+import type { DataContext } from "../context/data-context";
+/** Lifecycle of a tool-access approval request or reusable grant. */
+export declare enum ToolAccessApprovalStatus {
+    pending = "pending",
+    approved = "approved",
+    executed = "executed",
+    rejected = "rejected",
+    expired = "expired",
+    failed = "failed"
+}
+/** How far a granted approval applies after the first execution. */
+export declare enum ToolAccessApprovalScope {
+    once = "once",
+    thread = "thread",
+    context = "context"
+}
+/**
+ * Local-only record of a step-up tool approval.
+ *
+ * Stores identifiers, a frozen argument hash, and sanitized preview text.
+ * Do not put secrets, tokens, or raw log bodies in this table.
+ */
+export declare const toolAccessApprovalSchema: z.ZodObject<{
+    toolAccessApprovalId: z.ZodEffects<z.ZodString, string, string>;
+    userId: z.ZodEffects<z.ZodString, string, string>;
+    assistantId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    toolId: z.ZodEffects<z.ZodString, string, string>;
+    toolName: z.ZodString;
+    dataContextId: z.ZodString;
+    workflowRunId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    threadMessageId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    workflowLogId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    argsHash: z.ZodString;
+    argsPreview: z.ZodDefault<z.ZodString>;
+    frozenArgs: z.ZodObject<{}, "strip", z.ZodAny, z.objectOutputType<{}, z.ZodAny, "strip">, z.objectInputType<{}, z.ZodAny, "strip">>;
+    requiredAccessLevel: z.ZodDefault<z.ZodNumber>;
+    scope: z.ZodDefault<z.ZodNativeEnum<typeof ToolAccessApprovalScope>>;
+    status: z.ZodDefault<z.ZodNativeEnum<typeof ToolAccessApprovalStatus>>;
+    nonce: z.ZodString;
+    expiresAt: z.ZodDate;
+    createdAt: z.ZodDefault<z.ZodDate>;
+    decidedAt: z.ZodOptional<z.ZodDate>;
+    executedAt: z.ZodOptional<z.ZodDate>;
+    resultSummary: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    nonce: string;
+    status: ToolAccessApprovalStatus;
+    scope: ToolAccessApprovalScope;
+    userId: string;
+    expiresAt: Date;
+    toolId: string;
+    createdAt: Date;
+    dataContextId: string;
+    toolAccessApprovalId: string;
+    toolName: string;
+    argsHash: string;
+    argsPreview: string;
+    frozenArgs: {} & {
+        [k: string]: any;
+    };
+    requiredAccessLevel: number;
+    assistantId?: string | undefined;
+    threadMessageId?: string | undefined;
+    workflowRunId?: string | undefined;
+    workflowLogId?: string | undefined;
+    decidedAt?: Date | undefined;
+    executedAt?: Date | undefined;
+    resultSummary?: string | undefined;
+}, {
+    nonce: string;
+    userId: string;
+    expiresAt: Date;
+    toolId: string;
+    dataContextId: string;
+    toolAccessApprovalId: string;
+    toolName: string;
+    argsHash: string;
+    frozenArgs: {} & {
+        [k: string]: any;
+    };
+    status?: ToolAccessApprovalStatus | undefined;
+    scope?: ToolAccessApprovalScope | undefined;
+    assistantId?: string | undefined;
+    createdAt?: Date | undefined;
+    threadMessageId?: string | undefined;
+    workflowRunId?: string | undefined;
+    workflowLogId?: string | undefined;
+    argsPreview?: string | undefined;
+    requiredAccessLevel?: number | undefined;
+    decidedAt?: Date | undefined;
+    executedAt?: Date | undefined;
+    resultSummary?: string | undefined;
+}>;
+/** A local-only tool-access approval or grant. */
+export type IToolAccessApproval = z.infer<typeof toolAccessApprovalSchema>;
+/**
+ * Accessor for the local-only {@link ToolAccessApprovals} table.
+ *
+ * @param dataContext - Optional data context; defaults to the current singleton.
+ */
+export declare function ToolAccessApprovals(dataContext?: DataContext): import("..").Table<{
+    nonce: string;
+    status: ToolAccessApprovalStatus;
+    scope: ToolAccessApprovalScope;
+    userId: string;
+    expiresAt: Date;
+    toolId: string;
+    createdAt: Date;
+    dataContextId: string;
+    toolAccessApprovalId: string;
+    toolName: string;
+    argsHash: string;
+    argsPreview: string;
+    frozenArgs: {} & {
+        [k: string]: any;
+    };
+    requiredAccessLevel: number;
+    assistantId?: string | undefined;
+    threadMessageId?: string | undefined;
+    workflowRunId?: string | undefined;
+    workflowLogId?: string | undefined;
+    decidedAt?: Date | undefined;
+    executedAt?: Date | undefined;
+    resultSummary?: string | undefined;
+}>;

package/dist/data/tool-access-approvals.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolAccessApprovalSchema = exports.ToolAccessApprovalScope = exports.ToolAccessApprovalStatus = void 0;
+exports.ToolAccessApprovals = ToolAccessApprovals;
+const zod_1 = require("zod");
+const user_context_singleton_1 = require("../context/user-context-singleton");
+const zod_types_1 = require("../types/zod-types");
+const access_level_1 = require("./access-level");
+const table_definitions_system_1 = require("./orm/table-definitions.system");
+const types_1 = require("./orm/types");
+/** Lifecycle of a tool-access approval request or reusable grant. */
+var ToolAccessApprovalStatus;
+(function (ToolAccessApprovalStatus) {
+    ToolAccessApprovalStatus["pending"] = "pending";
+    ToolAccessApprovalStatus["approved"] = "approved";
+    ToolAccessApprovalStatus["executed"] = "executed";
+    ToolAccessApprovalStatus["rejected"] = "rejected";
+    ToolAccessApprovalStatus["expired"] = "expired";
+    ToolAccessApprovalStatus["failed"] = "failed";
+})(ToolAccessApprovalStatus || (exports.ToolAccessApprovalStatus = ToolAccessApprovalStatus = {}));
+/** How far a granted approval applies after the first execution. */
+var ToolAccessApprovalScope;
+(function (ToolAccessApprovalScope) {
+    ToolAccessApprovalScope["once"] = "once";
+    ToolAccessApprovalScope["thread"] = "thread";
+    ToolAccessApprovalScope["context"] = "context";
+})(ToolAccessApprovalScope || (exports.ToolAccessApprovalScope = ToolAccessApprovalScope = {}));
+/**
+ * Local-only record of a step-up tool approval.
+ *
+ * Stores identifiers, a frozen argument hash, and sanitized preview text.
+ * Do not put secrets, tokens, or raw log bodies in this table.
+ */
+exports.toolAccessApprovalSchema = zod_1.z.object({
+    toolAccessApprovalId: zod_types_1.zodPeerId,
+    userId: zod_types_1.zodPeerId.describe("User who must approve and who requested the elevation"),
+    assistantId: zod_types_1.zodPeerId
+        .optional()
+        .describe("Assistant that requested the tool; omitted for direct user calls"),
+    toolId: zod_types_1.zodPeerId,
+    toolName: zod_1.z.string().describe("Display name of the tool at request time"),
+    dataContextId: zod_1.z.string().describe("Data context the tool would run in"),
+    workflowRunId: zod_types_1.zodPeerId.optional(),
+    threadMessageId: zod_types_1.zodPeerId
+        .optional()
+        .describe("User message / thread root that owns the workflow"),
+    workflowLogId: zod_types_1.zodPeerId.optional(),
+    argsHash: zod_1.z.string().describe("Canonical hash of the frozen tool arguments"),
+    argsPreview: zod_1.z
+        .string()
+        .default("")
+        .describe("Sanitized, truncated argument summary for the approval card"),
+    frozenArgs: zod_types_1.zodAnyObject.describe("Frozen arguments executed on approve; no secrets"),
+    requiredAccessLevel: access_level_1.accessLevelSchema,
+    scope: zod_1.z.nativeEnum(ToolAccessApprovalScope).default(ToolAccessApprovalScope.once),
+    status: zod_1.z.nativeEnum(ToolAccessApprovalStatus).default(ToolAccessApprovalStatus.pending),
+    nonce: zod_1.z.string().describe("Single-use token; empty after consume"),
+    expiresAt: zod_1.z.date(),
+    createdAt: zod_1.z.date().default(() => new Date()),
+    decidedAt: zod_1.z.date().optional(),
+    executedAt: zod_1.z.date().optional(),
+    resultSummary: zod_1.z.string().optional().describe("Sanitized outcome after execute or deny"),
+});
+const metaData = {
+    name: "ToolAccessApprovals",
+    description: "Local-only pending and granted step-up approvals for privileged tools.",
+    primaryKeyName: "toolAccessApprovalId",
+    fields: (0, types_1.schemaToFields)(exports.toolAccessApprovalSchema),
+    iconClassName: "bi bi-shield-lock",
+    localOnly: true,
+    indexes: [
+        { fields: ["threadMessageId"] },
+        { fields: ["workflowRunId"] },
+        { fields: ["status"] },
+        { fields: ["toolId"] },
+    ],
+};
+(0, table_definitions_system_1.registerSystemTableDefinition)(metaData, exports.toolAccessApprovalSchema);
+/**
+ * Accessor for the local-only {@link ToolAccessApprovals} table.
+ *
+ * @param dataContext - Optional data context; defaults to the current singleton.
+ */
+function ToolAccessApprovals(dataContext) {
+    return (0, user_context_singleton_1.getTableContainer)(dataContext).getTable(metaData, exports.toolAccessApprovalSchema);
+}