@pushary/server 1.3.3 → 1.5.0

package/dist/adapters.cjs

@@ -0,0 +1,733 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/adapters.ts
+var adapters_exports = {};
+__export(adapters_exports, {
+  DENIED_BY_POLICY: () => DENIED_BY_POLICY,
+  DENIED_REFUSED: () => DENIED_REFUSED,
+  DENIED_UNANSWERED: () => DENIED_UNANSWERED,
+  SIGNATURE_HEADER: () => SIGNATURE_HEADER,
+  UNBOUND_APPROVAL: () => UNBOUND_APPROVAL,
+  UNCONFIRMED_PERMIT: () => UNCONFIRMED_PERMIT,
+  createAdapterKernel: () => createAdapterKernel,
+  defaultProtectQuestion: () => defaultProtectQuestion,
+  deniedByPolicy: () => deniedByPolicy,
+  deriveParameters: () => deriveParameters,
+  describeAnswer: () => describeAnswer,
+  deterministicKey: () => deterministicKey,
+  idempotencyKeyFor: () => idempotencyKeyFor,
+  isAffirmative: () => isAffirmative,
+  isApproved: () => isApproved,
+  parseDecisionCallback: () => parseDecisionCallback,
+  refusedPermit: () => refusedPermit,
+  renderApprovalQuestion: () => renderApprovalQuestion,
+  resolvePusharyCallback: () => resolvePusharyCallback,
+  verifyWebhookSignature: () => verifyWebhookSignature
+});
+module.exports = __toCommonJS(adapters_exports);
+
+// src/error.ts
+var PusharyApiError = class _PusharyApiError extends Error {
+  constructor(message, init) {
+    super(message);
+    this.name = "PusharyApiError";
+    this.status = init.status;
+    this.statusText = init.statusText ?? "";
+    this.code = init.code;
+    this.body = init.body;
+    Object.setPrototypeOf(this, _PusharyApiError.prototype);
+  }
+  /** The key is missing, malformed, or revoked. Re-authenticate; do not retry. */
+  get isAuthError() {
+    return this.status === 401 || this.status === 403;
+  }
+  /** Rate limited. Back off and retry. */
+  get isRateLimited() {
+    return this.status === 429;
+  }
+  /** Server-side fault. Safe to retry an idempotent call. */
+  get isServerError() {
+    return this.status >= 500;
+  }
+};
+
+// src/request.ts
+var buildUrl = (baseUrl, path, params) => {
+  const url = new URL(`${baseUrl}${path}`);
+  if (params) {
+    Object.entries(params).forEach(([key, value]) => {
+      if (value !== void 0 && value !== null) {
+        url.searchParams.set(key, String(value));
+      }
+    });
+  }
+  return url.toString();
+};
+var handleResponse = async (response) => {
+  if (!response.ok) {
+    const body = await response.json().catch(() => ({}));
+    throw new PusharyApiError(body.message || body.error || `HTTP ${response.status}`, {
+      status: response.status,
+      statusText: response.statusText,
+      code: body.code,
+      body
+    });
+  }
+  return response.json();
+};
+var createRequest = (ctx) => async (method, path, body) => {
+  const isGet = method === "GET";
+  const url = isGet && body ? buildUrl(ctx.baseUrl, path, body) : `${ctx.baseUrl}${path}`;
+  const response = await fetch(url, {
+    method,
+    headers: ctx.headers,
+    body: !isGet && body ? JSON.stringify(body) : void 0
+  });
+  return handleResponse(response);
+};
+
+// src/resources/subscribers.ts
+var createSubscribersResource = (request) => Object.freeze({
+  list: (params) => request("GET", "/subscribers", params),
+  get: (id) => request("GET", `/subscribers/${id}`),
+  update: (id, data) => request("PATCH", `/subscribers/${id}`, data),
+  delete: (id) => request("DELETE", `/subscribers/${id}`),
+  count: () => request("GET", "/subscribers/count")
+});
+
+// src/resources/campaigns.ts
+var createCampaignsResource = (request) => Object.freeze({
+  list: (params) => request("GET", "/campaigns", params),
+  create: (data) => request("POST", "/campaigns", data),
+  get: (id) => request("GET", `/campaigns/${id}`),
+  update: (id, data) => request("PATCH", `/campaigns/${id}`, data),
+  delete: (id) => request("DELETE", `/campaigns/${id}`),
+  send: (id) => request("POST", `/campaigns/${id}/send`),
+  pause: (id) => request("POST", `/campaigns/${id}/pause`),
+  resume: (id) => request("POST", `/campaigns/${id}/resume`),
+  stats: (id) => request("GET", `/campaigns/${id}/stats`)
+});
+
+// src/resources/templates.ts
+var createTemplatesResource = (request) => Object.freeze({
+  list: (params) => request("GET", "/templates", params),
+  create: (data) => request("POST", "/templates", data),
+  get: (id) => request("GET", `/templates/${id}`),
+  update: (id, data) => request("PATCH", `/templates/${id}`, data),
+  delete: (id) => request("DELETE", `/templates/${id}`)
+});
+
+// src/resources/notifications.ts
+var createNotificationsResource = (request) => Object.freeze({
+  send: (data) => request("POST", "/send", data)
+});
+
+// src/resources/flows.ts
+var createFlowsResource = (request) => Object.freeze({
+  list: (params) => request("GET", "/flows", params),
+  create: (data) => request("POST", "/flows", data),
+  get: (id) => request("GET", `/flows/${id}`),
+  update: (id, data) => request("PATCH", `/flows/${id}`, data),
+  delete: (id) => request("DELETE", `/flows/${id}`),
+  activate: (id) => request("POST", `/flows/${id}/activate`),
+  pause: (id) => request("POST", `/flows/${id}/pause`)
+});
+
+// src/resources/decisions.ts
+var import_crypto2 = require("crypto");
+
+// src/util.ts
+var import_crypto = require("crypto");
+var deterministicKey = (parts) => (0, import_crypto.createHash)("sha256").update(parts.join("\0")).digest("hex").slice(0, 40);
+var AFFIRMATIVE = /* @__PURE__ */ new Set([
+  "yes",
+  "y",
+  "approve",
+  "approved",
+  "ok",
+  "okay",
+  "confirm",
+  "accept",
+  "true"
+]);
+var isApproved = (decision) => {
+  if (decision.status !== "answered") return false;
+  if (decision.type && decision.type !== "confirm") return true;
+  return decision.value != null && AFFIRMATIVE.has(decision.value.trim().toLowerCase());
+};
+
+// src/resources/decisions.ts
+var POLL_WINDOW_SECONDS = 50;
+var DEFAULT_ASK_TIMEOUT_MS = 55e3;
+var createDecisionsResource = (request) => {
+  const ask = async (data) => {
+    const idempotencyKey = data.idempotencyKey ?? (0, import_crypto2.randomUUID)();
+    const created = await request("POST", "/decisions", {
+      question: data.question,
+      type: data.type,
+      options: data.options,
+      externalId: data.externalId,
+      email: data.email,
+      agentName: data.agentName,
+      context: data.context,
+      placeholder: data.placeholder,
+      toolName: data.toolName,
+      toolTarget: data.toolTarget,
+      actor: data.actor,
+      environment: data.environment,
+      parameters: data.parameters,
+      // Its changes name parameters rather than carrying values, so what the
+      // person sees is read from the same numbers a rule compares.
+      presentation: data.presentation,
+      approvalUrl: data.approvalUrl,
+      expiresInSeconds: data.expiresInSeconds,
+      poweredBy: data.poweredBy,
+      callbackUrl: data.callbackUrl,
+      requireReachable: data.requireReachable,
+      // Read only by a key issued on your workspace's sandbox site, where the
+      // simulator answers instead of a person. Ignored in production.
+      sandboxOutcome: data.sandboxOutcome,
+      idempotencyKey,
+      wait: false
+    });
+    const type = created.type ?? data.type ?? "confirm";
+    let status = created.status;
+    let answered = created.answered;
+    let value = created.value ?? null;
+    const deadline = Date.now() + Math.max(0, data.timeoutMs ?? DEFAULT_ASK_TIMEOUT_MS);
+    while (status === "pending" && Date.now() < deadline) {
+      const waitSeconds = Math.max(
+        1,
+        Math.min(POLL_WINDOW_SECONDS, Math.ceil((deadline - Date.now()) / 1e3))
+      );
+      const polled = await request("GET", `/decisions/${created.decisionId}`, {
+        wait: waitSeconds
+      });
+      status = polled.status;
+      answered = polled.answered;
+      value = polled.value;
+    }
+    return {
+      decisionId: created.decisionId,
+      status,
+      answered,
+      value,
+      type,
+      approved: isApproved({ status, type, value }),
+      // Surfaced from the create response so a caller can tell an unanswered
+      // decision that reached nobody (reachable:false) apart from a real decline.
+      reachable: created.reachable,
+      reachableChannels: created.reachableChannels,
+      deviceCount: created.deviceCount
+    };
+  };
+  return Object.freeze({
+    create: (data) => request("POST", "/decisions", data),
+    get: (id, opts) => request("GET", `/decisions/${id}`, opts?.wait ? { wait: opts.wait } : void 0),
+    ask,
+    answer: (id, answer) => request("POST", `/decisions/${id}`, { answer }),
+    cancel: (id) => request("DELETE", `/decisions/${id}`),
+    getWebhookSecret: () => request("GET", "/webhook-secret"),
+    rotateWebhookSecret: () => request("POST", "/webhook-secret")
+  });
+};
+
+// src/resources/keys.ts
+var createKeysResource = (request) => Object.freeze({
+  issue: (data) => request("POST", "/keys", data),
+  list: () => request("GET", "/keys").then((r) => r.keys),
+  revoke: (keyPrefix) => request("DELETE", `/keys/${encodeURIComponent(keyPrefix)}`)
+});
+
+// src/authorize.ts
+var defaultQuestion = (toolName, toolTarget) => `Approve ${toolName}${toolTarget ? ` ${toolTarget}` : ""}?`;
+var authorizationSubject = (input) => ({
+  toolName: input.toolName,
+  toolTarget: input.toolTarget,
+  actor: input.actor,
+  environment: input.environment,
+  parameters: input.parameters
+});
+var createEvaluateAuthorization = (request) => (input) => request("POST", "/authorize", {
+  ...authorizationSubject(input),
+  externalId: input.externalId,
+  question: input.question,
+  agentName: input.agentName
+});
+var createAuthorize = (request, decisions) => {
+  const evaluate = createEvaluateAuthorization(request);
+  return async (input) => {
+    const subject = authorizationSubject(input);
+    const evaluation = await evaluate(input);
+    if (evaluation.verdict !== "requires_human") {
+      return {
+        approved: evaluation.verdict === "allow",
+        resolvedBy: "policy",
+        policy: evaluation.policy,
+        reason: evaluation.reason,
+        decisionId: null,
+        authorizationId: evaluation.authorizationId
+      };
+    }
+    const answer = await decisions.ask({
+      question: input.question ?? defaultQuestion(input.toolName, input.toolTarget),
+      type: "confirm",
+      externalId: input.externalId,
+      agentName: input.agentName,
+      ...subject,
+      timeoutMs: input.timeoutMs,
+      expiresInSeconds: input.expiresInSeconds,
+      idempotencyKey: input.idempotencyKey,
+      requireReachable: input.requireReachable
+    });
+    return {
+      approved: answer.approved,
+      resolvedBy: "human",
+      policy: evaluation.policy,
+      reason: answer.approved ? "A person approved it." : answer.answered ? "A person denied it." : "Nobody answered, so this was not approved.",
+      decisionId: answer.decisionId,
+      authorizationId: null
+    };
+  };
+};
+
+// src/permits.ts
+var REFUSALS = [
+  "not_authorized",
+  "action_mismatch",
+  "expired",
+  "already_consumed"
+];
+var EXECUTION_STATES = ["running", "succeeded", "failed"];
+var refusalOf = (error) => {
+  if (!(error instanceof PusharyApiError)) return null;
+  const body = error.body;
+  const refusal = body?.refusal;
+  if (typeof refusal !== "string" || !REFUSALS.includes(refusal)) return null;
+  const state = body?.executionState;
+  return {
+    consumed: false,
+    refusal,
+    reason: error.message,
+    ...typeof state === "string" && EXECUTION_STATES.includes(state) ? { executionState: state } : {}
+  };
+};
+var createConsumeAuthorization = (request) => async (binding) => {
+  try {
+    const permit = await request("POST", "/authorizations/consume", {
+      authorizationId: binding.authorizationId,
+      toolName: binding.toolName,
+      toolTarget: binding.toolTarget,
+      actor: binding.actor,
+      environment: binding.environment,
+      externalId: binding.externalId,
+      parameters: binding.parameters
+    });
+    return { consumed: true, permit };
+  } catch (error) {
+    const refused = refusalOf(error);
+    if (refused) return refused;
+    throw error;
+  }
+};
+var createRecordExecution = (request) => (receipt) => request("POST", `/authorizations/${encodeURIComponent(receipt.permitId)}/receipt`, {
+  outcome: receipt.outcome,
+  summary: receipt.summary
+});
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://pushary.com/api/v1/server";
+var validateApiKey = (apiKey) => {
+  if (!apiKey) {
+    throw new Error("API key is required. Get your API key from https://pushary.com/dashboard/settings");
+  }
+  if (!apiKey.includes(".")) {
+    throw new Error("Invalid API key format. Use the full API key (pk_xxx.sk_xxx)");
+  }
+};
+var createContext = (config) => {
+  validateApiKey(config.apiKey);
+  return Object.freeze({
+    baseUrl: config.baseUrl ?? DEFAULT_BASE_URL,
+    headers: Object.freeze({
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${config.apiKey}`
+    })
+  });
+};
+var createPusharyServer = (config) => {
+  const ctx = createContext(config);
+  const request = createRequest(ctx);
+  const decisions = createDecisionsResource(request);
+  return Object.freeze({
+    subscribers: createSubscribersResource(request),
+    campaigns: createCampaignsResource(request),
+    templates: createTemplatesResource(request),
+    notifications: createNotificationsResource(request),
+    flows: createFlowsResource(request),
+    decisions,
+    keys: createKeysResource(request),
+    authorize: createAuthorize(request, decisions),
+    evaluateAuthorization: createEvaluateAuthorization(request),
+    consumeAuthorization: createConsumeAuthorization(request),
+    recordExecution: createRecordExecution(request),
+    enroll: (externalId) => request("POST", "/enroll", { externalId }),
+    reachability: (externalId) => request("GET", "/reachability", { externalId })
+  });
+};
+
+// src/webhook.ts
+var import_crypto3 = require("crypto");
+var SIGNATURE_HEADER = "x-pushary-signature";
+var verifyWebhookSignature = (rawBody, signature, secret) => {
+  if (!signature || !secret) return false;
+  const expected = (0, import_crypto3.createHmac)("sha256", secret).update(rawBody).digest("hex");
+  const a = Buffer.from(expected);
+  const b = Buffer.from(signature);
+  if (a.length !== b.length) return false;
+  return (0, import_crypto3.timingSafeEqual)(a, b);
+};
+var parseDecisionCallback = (rawBody) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawBody);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const p = parsed;
+  if (typeof p.correlationId !== "string" || typeof p.answer !== "string") return null;
+  return {
+    correlationId: p.correlationId,
+    answer: p.answer,
+    value: typeof p.value === "string" ? p.value : p.answer,
+    answeredAt: typeof p.answeredAt === "string" ? p.answeredAt : "",
+    ...typeof p.context === "string" ? { context: p.context } : {}
+  };
+};
+
+// src/adapters.ts
+var DEFAULT_NODE = "ask-human";
+var defaultProtectQuestion = (action, target) => `Approve ${action}${target ? ` ${target}` : ""}?`;
+var idempotencyKeyFor = (input) => deterministicKey([input.externalId, input.node ?? DEFAULT_NODE, input.question]);
+var isAffirmative = (answer) => isApproved({ status: "answered", type: "confirm", value: answer ?? null });
+var describeAnswer = (type, result) => {
+  if (!result.answered) {
+    return `No answer (status: ${result.status}). Treat this as NOT approved and do not proceed.`;
+  }
+  if (type === "confirm") {
+    return result.approved ? "The human approved. You may proceed." : "The human declined. Do not proceed.";
+  }
+  return `The human answered: ${result.value ?? ""}`;
+};
+var resolvePusharyCallback = (rawBody, signature, secret) => {
+  if (!verifyWebhookSignature(rawBody, signature, secret)) return null;
+  const callback = parseDecisionCallback(rawBody);
+  if (!callback) return null;
+  return {
+    correlationId: callback.correlationId,
+    answer: callback.answer,
+    value: callback.value,
+    approved: isAffirmative(callback.answer),
+    context: callback.context,
+    answeredAt: callback.answeredAt
+  };
+};
+var MAX_INPUT_CHARS = 300;
+var DENIED_UNANSWERED = "No answer from the approver, so this was denied. Do not retry the same action.";
+var DENIED_REFUSED = "The approver denied this action.";
+var DENIED_BY_POLICY = "Denied by policy. Do not retry the same action.";
+var UNBOUND_APPROVAL = "This was approved, but the approval could not be bound to a single execution, so it was not run. Do not retry the same action.";
+var UNCONFIRMED_PERMIT = "This was approved, but it could not be confirmed as still unspent, so it was not run. Ask again rather than retrying this one.";
+var REFUSED_REPLAY = "This authorization was already used. The action has run once and must not run again.";
+var refusedPermit = (refused) => refused.refusal === "already_consumed" ? REFUSED_REPLAY : `${refused.reason} Do not retry the same action.`;
+var deniedByPolicy = (evaluation) => evaluation.reason ? `${evaluation.reason} Do not retry the same action.` : DENIED_BY_POLICY;
+var PARAMETERS_MAX_KEYS = 32;
+var PARAMETER_KEY_MAX_LENGTH = 64;
+var PARAMETER_VALUE_MAX_LENGTH = 200;
+var deriveParameters = (input) => {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) return void 0;
+  const entries = Object.entries(input);
+  if (entries.length === 0 || entries.length > PARAMETERS_MAX_KEYS) return void 0;
+  const parameters = {};
+  for (const [key, value] of entries) {
+    if (key.length === 0 || key.length > PARAMETER_KEY_MAX_LENGTH) return void 0;
+    if (typeof value === "boolean") {
+      parameters[key] = value;
+    } else if (typeof value === "number") {
+      if (!Number.isFinite(value)) return void 0;
+      parameters[key] = value;
+    } else if (typeof value === "string") {
+      if (value.length > PARAMETER_VALUE_MAX_LENGTH) return void 0;
+      parameters[key] = value;
+    } else {
+      return void 0;
+    }
+  }
+  return parameters;
+};
+var renderApprovalQuestion = (toolName, toolInput) => {
+  if (toolInput === void 0 || toolInput === null) return `Approve ${toolName}?`;
+  const summary = summarise(toolInput);
+  return summary === void 0 ? `Approve ${toolName}?` : `Approve ${toolName}? ${summary}`;
+};
+var summarise = (toolInput) => {
+  let rendered;
+  if (typeof toolInput === "string") {
+    rendered = toolInput;
+  } else {
+    try {
+      rendered = JSON.stringify(toolInput);
+    } catch {
+      return void 0;
+    }
+  }
+  if (rendered === void 0) return void 0;
+  return rendered.length > MAX_INPUT_CHARS ? `${rendered.slice(0, MAX_INPUT_CHARS)}...` : rendered;
+};
+var createAdapterKernel = (helpersLabel) => {
+  const requireApiKey = (apiKey) => {
+    const resolved = apiKey ?? process.env.PUSHARY_API_KEY;
+    if (!resolved) {
+      throw new Error(`Pushary: set PUSHARY_API_KEY or pass { apiKey } to ${helpersLabel}.`);
+    }
+    return resolved;
+  };
+  const client = (config) => createPusharyServer({
+    apiKey: requireApiKey(config.apiKey),
+    ...config.baseUrl ? { baseUrl: config.baseUrl } : {}
+  });
+  const requireExternalId = (externalId) => {
+    if (!externalId) {
+      throw new Error(
+        `Pushary: no end-user to ask. Pass { externalId } to ${helpersLabel}, or run user-scoped auth so the framework supplies one.`
+      );
+    }
+    return externalId;
+  };
+  const createGate = (config) => {
+    const gateClient = createPusharyServer({
+      apiKey: requireApiKey(config.apiKey),
+      ...config.baseUrl ? { baseUrl: config.baseUrl } : {}
+    });
+    const usePolicy = config.policy ?? true;
+    const evaluate = async (ask, facts) => {
+      if (!usePolicy) return null;
+      try {
+        return await gateClient.evaluateAuthorization({
+          toolName: ask.toolName,
+          toolTarget: ask.toolTarget,
+          actor: ask.actor,
+          environment: ask.environment,
+          parameters: facts,
+          externalId: ask.externalId,
+          question: ask.question,
+          ...config.agentName ? { agentName: config.agentName } : {}
+        });
+      } catch {
+        return null;
+      }
+    };
+    return async (ask) => {
+      const facts = ask.parameters ?? deriveParameters(ask.input);
+      const evaluation = await evaluate(ask, facts);
+      if (evaluation?.verdict === "allow") {
+        return {
+          approved: true,
+          // Exactly the subject POST /authorize recorded, which is the whole of
+          // what it was sent.
+          ...evaluation.authorizationId ? {
+            authorization: {
+              authorizationId: evaluation.authorizationId,
+              toolName: ask.toolName,
+              toolTarget: ask.toolTarget,
+              actor: ask.actor,
+              environment: ask.environment,
+              externalId: ask.externalId,
+              parameters: facts
+            }
+          } : {}
+        };
+      }
+      if (evaluation?.verdict === "deny") {
+        return { approved: false, reason: deniedByPolicy(evaluation) };
+      }
+      const result = await gateClient.decisions.ask({
+        question: ask.question,
+        type: "confirm",
+        externalId: ask.externalId,
+        ...config.agentName ? { agentName: config.agentName } : {},
+        ...config.expiresInSeconds ? { expiresInSeconds: config.expiresInSeconds } : {},
+        ...config.timeoutMs !== void 0 ? { timeoutMs: config.timeoutMs } : {},
+        ...config.requireReachable ? { requireReachable: config.requireReachable } : {},
+        // The gated tool, recorded on the decision. The gate already knows it
+        // and keyed on it below; sending it is what lets the decision be grouped
+        // and matched later instead of surviving only as prose in the question.
+        toolName: ask.toolName,
+        // The rest of the subject only when the evaluation carried it and the
+        // server accepted it. An evaluation that failed proves nothing about what
+        // this ask would accept, and this path has to stay byte-for-byte the call
+        // that worked before policy existed.
+        ...evaluation ? {
+          toolTarget: ask.toolTarget,
+          actor: ask.actor,
+          environment: ask.environment,
+          parameters: facts
+        } : {},
+        // Stable across replays, so a re-run of this call resolves to the same
+        // decision instead of asking twice.
+        idempotencyKey: deterministicKey([ask.sessionId, ask.callId, ask.toolName])
+      });
+      if (result.approved) {
+        return {
+          approved: true,
+          authorization: {
+            authorizationId: result.decisionId,
+            toolName: ask.toolName,
+            externalId: ask.externalId,
+            // Mirrors the ask above exactly. The decision recorded the rest of
+            // the subject only when the evaluation carried it, so claiming it
+            // here regardless would describe an action the record does not hold.
+            ...evaluation ? {
+              toolTarget: ask.toolTarget,
+              actor: ask.actor,
+              environment: ask.environment,
+              parameters: facts
+            } : {}
+          }
+        };
+      }
+      return { approved: false, reason: result.answered ? DENIED_REFUSED : DENIED_UNANSWERED };
+    };
+  };
+  const askExternalUser = (config, input) => client(config).decisions.ask({
+    question: input.question,
+    type: input.type,
+    options: input.options,
+    externalId: input.externalId,
+    context: input.context,
+    agentName: config.agentName,
+    timeoutMs: config.timeoutMs,
+    // The node/step name doubles as the action label. The default is not
+    // sent: grouping every unnamed ask across every framework under one
+    // bucket would mine into a suggestion to auto-approve "ask-human", which
+    // spans unrelated questions.
+    toolName: input.node,
+    idempotencyKey: idempotencyKeyFor(input)
+  });
+  const createDurableDecision = async (config, input) => {
+    const created = await client(config).decisions.create({
+      question: input.question,
+      type: input.type,
+      options: input.options,
+      externalId: input.externalId,
+      context: input.context,
+      callbackUrl: input.callbackUrl,
+      agentName: config.agentName,
+      toolName: input.node,
+      idempotencyKey: idempotencyKeyFor(input),
+      wait: false
+    });
+    return {
+      decisionId: created.decisionId,
+      correlationId: created.decisionId,
+      status: created.status,
+      reachable: created.reachable,
+      reachableChannels: created.reachableChannels,
+      deviceCount: created.deviceCount
+    };
+  };
+  const connect = (config, externalId) => client(config).enroll(externalId);
+  const protect = (config) => {
+    const gate = createGate(config);
+    const permitClient = client(config);
+    const report = async (permitId, outcome, summary) => {
+      try {
+        await permitClient.recordExecution({ permitId, outcome, summary });
+      } catch {
+      }
+    };
+    return async (action) => {
+      const decision = await gate({
+        toolName: action.action,
+        toolTarget: action.target,
+        callId: action.callId,
+        sessionId: action.runId,
+        question: action.question ?? defaultProtectQuestion(action.action, action.target),
+        externalId: action.externalId,
+        actor: action.actor,
+        environment: action.environment,
+        parameters: action.facts
+      });
+      if (!decision.approved) return { ok: false, reason: decision.reason };
+      if (!decision.authorization) return { ok: false, reason: UNBOUND_APPROVAL };
+      let consumed;
+      try {
+        consumed = await permitClient.consumeAuthorization(decision.authorization);
+      } catch {
+        return { ok: false, reason: UNCONFIRMED_PERMIT };
+      }
+      if (!consumed.consumed) return { ok: false, reason: refusedPermit(consumed) };
+      const permitId = consumed.permit.permitId;
+      let result;
+      try {
+        result = await action.run();
+      } catch (error) {
+        await report(permitId, "failed", error instanceof Error ? error.message : "unknown error");
+        throw error;
+      }
+      await report(permitId, "succeeded");
+      return { ok: true, result };
+    };
+  };
+  return Object.freeze({
+    client,
+    askExternalUser,
+    createDurableDecision,
+    connect,
+    createGate,
+    protect,
+    requireExternalId
+  });
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DENIED_BY_POLICY,
+  DENIED_REFUSED,
+  DENIED_UNANSWERED,
+  SIGNATURE_HEADER,
+  UNBOUND_APPROVAL,
+  UNCONFIRMED_PERMIT,
+  createAdapterKernel,
+  defaultProtectQuestion,
+  deniedByPolicy,
+  deriveParameters,
+  describeAnswer,
+  deterministicKey,
+  idempotencyKeyFor,
+  isAffirmative,
+  isApproved,
+  parseDecisionCallback,
+  refusedPermit,
+  renderApprovalQuestion,
+  resolvePusharyCallback,
+  verifyWebhookSignature
+});
+//# sourceMappingURL=adapters.cjs.map