@pushary/server 1.3.3 → 1.5.0

package/dist/adapters.d.ts

@@ -0,0 +1,310 @@
+import { D as DecisionType, a7 as AskResult, z as DecisionParameters, N as AuthorizationBinding, R as ConsumeAuthorizationResult, M as AuthorizationEvaluation, P as PusharyServer, a5 as EnrollResult } from './util-DeGBh5at.js';
+export { H as AuthorizationVerdict, al as SIGNATURE_HEADER, am as deterministicKey, an as isApproved, ak as parseDecisionCallback, aj as verifyWebhookSignature } from './util-DeGBh5at.js';
+
+/** Config every adapter accepts, whatever framework it binds. */
+interface PusharyAdapterConfig {
+    /** Pushary API key (pk_xxx.sk_xxx). Defaults to `process.env.PUSHARY_API_KEY`. */
+    readonly apiKey?: string;
+    /** Shown on the approval so the human knows which agent is asking. */
+    readonly agentName?: string;
+    /** How long a blocking ask waits before returning (default 55s, serverless-safe). */
+    readonly timeoutMs?: number;
+    /** Override the API base URL (tests / self-host). */
+    readonly baseUrl?: string;
+}
+/** One ask, as an adapter hands it to the kernel. */
+interface AskHumanInput {
+    readonly question: string;
+    /** Your own stable id for the end-user who decides. */
+    readonly externalId: string;
+    /** Stable node/step/tool name, used to build a re-run-safe idempotency key. */
+    readonly node?: string;
+    readonly type?: DecisionType;
+    readonly options?: readonly string[];
+    readonly context?: string;
+    /** Present on the durable path; Pushary POSTs the answer here. */
+    readonly callbackUrl?: string;
+}
+/** A decision opened durably, before the framework parks its run. */
+interface CreatedDecision {
+    readonly decisionId: string;
+    readonly correlationId: string;
+    readonly status: string;
+    readonly reachable?: boolean;
+    readonly reachableChannels?: number;
+    readonly deviceCount?: number;
+}
+/** A verified, parsed answer callback, keyed by `correlationId`. */
+interface PusharyCallback {
+    readonly correlationId: string;
+    readonly answer: string;
+    readonly value: string;
+    readonly approved: boolean;
+    readonly context?: string;
+    readonly answeredAt: string;
+}
+/**
+ * What the human is shown when the caller names no question.
+ *
+ * The action and its target, not a rendering of the facts: a protected action is
+ * written by hand, so its name is already business language ("refund.create
+ * order_4471") in a way a tool's raw input never is.
+ */
+declare const defaultProtectQuestion: (action: string, target?: string) => string;
+/**
+ * Re-run-safe idempotency key. A node, step, or tool call that replays on resume
+ * lands on the same decision instead of paging the human twice.
+ */
+declare const idempotencyKeyFor: (input: AskHumanInput) => string;
+/** Fail-closed yes/no check for a confirm answer. */
+declare const isAffirmative: (answer: string | null | undefined) => boolean;
+/** Turn a decision outcome into an unambiguous instruction for the model. */
+declare const describeAnswer: (type: DecisionType, result: AskResult) => string;
+/**
+ * Verify a callback signature and parse it, or return null. The `answer` is what
+ * you feed back into the framework's resume seam.
+ */
+declare const resolvePusharyCallback: (rawBody: string, signature: string | null | undefined, secret: string) => PusharyCallback | null;
+/**
+ * Connection-level options for a request-time approval gate. Everything that
+ * varies per tool call lives on {@link ApprovalAsk} instead, so a gate holds one
+ * client and no per-call state.
+ */
+interface PusharyGateConfig {
+    /** Pushary API key. Defaults to `process.env.PUSHARY_API_KEY`. */
+    readonly apiKey?: string;
+    /** Shown on the approval so the human knows which agent is asking. */
+    readonly agentName?: string;
+    /** How long the decision stays answerable. */
+    readonly expiresInSeconds?: number;
+    /** How long to block waiting for an answer before failing closed. */
+    readonly timeoutMs?: number;
+    /**
+     * Refuse to open a decision nobody can receive, so an end-user with no connected
+     * device is denied at request time instead of silently expiring.
+     */
+    readonly requireReachable?: boolean;
+    /**
+     * Ask the site's policy before asking a person (default true). A rule that names
+     * the action resolves it without paging anyone; everything else still asks.
+     *
+     * Set false to restore the always-ask gate: a site whose rules were written for
+     * its own coding agents, and which happens to name a tool this gate also sits
+     * on, would otherwise start resolving that tool automatically.
+     */
+    readonly policy?: boolean;
+    /** Override the API base URL (tests / self-host). */
+    readonly baseUrl?: string;
+}
+/**
+ * One gated tool call, resolved down to what Pushary needs. The adapter owns the
+ * mapping from its framework's context, so per-call resolvers stay typed against
+ * the framework's own shapes rather than a lowest common denominator.
+ */
+interface ApprovalAsk {
+    /** The tool the model wants to run. */
+    readonly toolName: string;
+    /** Unique per tool call. Keys the decision together with `sessionId`. */
+    readonly callId: string;
+    /** Stable per run, session, or thread. */
+    readonly sessionId: string;
+    /** What the human is shown. */
+    readonly question: string;
+    /** The enrolled end-user who decides. */
+    readonly externalId: string;
+    /** What the tool acts on, e.g. an order id. Narrows which rule governs. */
+    readonly toolTarget?: string;
+    /** Whose authority the action claims, e.g. `user:u_44`. Not the approver. */
+    readonly actor?: string;
+    /** Which deployment the action runs against, e.g. `production`. */
+    readonly environment?: string;
+    /**
+     * The tool's raw input. Bounded scalars are derived from it so a rule can decide
+     * on the arguments and not only on the name; anything the bounds cannot carry
+     * sends nothing, which escalates. Already rendered into the default question, so
+     * passing it exposes nothing new.
+     */
+    readonly input?: unknown;
+    /** Explicit facts for policy, used instead of deriving them from `input`. */
+    readonly parameters?: DecisionParameters;
+}
+/**
+ * What a gate answers. Denials always carry a reason the model can read.
+ *
+ * An approval also carries the binding: which authorization settled it and the
+ * exact subject it was recorded against. Carried rather than rebuilt, because
+ * only the gate knows what it actually sent — the ask records the full subject
+ * only when the evaluation succeeded — and a caller that rebuilds it would send
+ * a subject the record does not hold and be refused for its own approval.
+ * Absent only from a server too old to name the authorization.
+ */
+type ApprovalDecision = {
+    readonly approved: true;
+    readonly authorization?: AuthorizationBinding;
+} | {
+    readonly approved: false;
+    readonly reason: string;
+};
+/**
+ * A request-time gate: ask the site's policy, ask a person when policy defers,
+ * fail closed either way.
+ */
+type ApprovalGate = (ask: ApprovalAsk) => Promise<ApprovalDecision>;
+declare const DENIED_UNANSWERED = "No answer from the approver, so this was denied. Do not retry the same action.";
+declare const DENIED_REFUSED = "The approver denied this action.";
+declare const DENIED_BY_POLICY = "Denied by policy. Do not retry the same action.";
+declare const UNBOUND_APPROVAL = "This was approved, but the approval could not be bound to a single execution, so it was not run. Do not retry the same action.";
+declare const UNCONFIRMED_PERMIT = "This was approved, but it could not be confirmed as still unspent, so it was not run. Ask again rather than retrying this one.";
+/**
+ * A refused permit, as the model reads it.
+ *
+ * `already_consumed` is worded to stop the caller rather than to invite a retry,
+ * because a retry is the failure: something already ran this action once, and
+ * the agent reading this cannot see that from its own state.
+ */
+declare const refusedPermit: (refused: Extract<ConsumeAuthorizationResult, {
+    consumed: false;
+}>) => string;
+/**
+ * A policy denial, as the model reads it. The server already words the reason
+ * ("Denied by policy rule refund.create."); the retry instruction is added here so
+ * every denial this gate returns ends the same way, whoever settled it.
+ */
+declare const deniedByPolicy: (evaluation: AuthorizationEvaluation) => string;
+/**
+ * Bounded facts for policy, derived from a tool's own input.
+ *
+ * All or nothing, deliberately. The bounds mirror what the API accepts, so a
+ * partial object is always representable — and that is exactly the danger: a rule
+ * reading `amount >= 500` stops denying the moment `amount` goes missing, so
+ * dropping one entry can only ever move a verdict toward allow. Sending nothing
+ * instead leaves the rule's parameter absent, which escalates to a person.
+ *
+ * The same bounds also mean this never turns a working tool call into a rejected
+ * one: an input this cannot carry is simply not sent.
+ */
+declare const deriveParameters: (input: unknown) => DecisionParameters | undefined;
+/**
+ * The default question: the tool name plus a truncated view of its input, so the
+ * human sees what they are approving without a wall of JSON on a lock screen.
+ */
+declare const renderApprovalQuestion: (toolName: string, toolInput: unknown) => string;
+/**
+ * One protected action: what it is, who it belongs to, and what it does.
+ *
+ * The shape a developer writes once instead of threading authorize, escalate and
+ * run through their business code by hand. Everything above `run` is the same
+ * subject `authorize()` and the decision both read, so the rule that governs the
+ * action and the sentence the human sees describe the one thing.
+ */
+interface ProtectedAction<TResult> {
+    /** What is being done, e.g. `refund.create`. A rule has to name this. */
+    readonly action: string;
+    /** What it is done to, e.g. an order id. Narrows which rule governs. */
+    readonly target?: string;
+    /** The end-user this action belongs to, and who decides if policy defers. */
+    readonly externalId: string;
+    /** Whose authority the action claims, e.g. `user:u_44`. Not the approver. */
+    readonly actor?: string;
+    /** Which deployment it runs against, e.g. `production`. */
+    readonly environment?: string;
+    /**
+     * The bounded facts a rule may decide on, e.g. `{ amount: 4800 }`. Scalars
+     * only. Passed as given rather than derived, because a protected action is
+     * written by hand and the author knows which of its arguments matter.
+     */
+    readonly facts?: DecisionParameters;
+    /** Unique per attempt. Keys the decision together with `runId`. */
+    readonly callId: string;
+    /** Stable per run, session or thread. */
+    readonly runId: string;
+    /** What the human is shown. Defaults to the action and its target. */
+    readonly question?: string;
+    /**
+     * The side effect. Called only after the action is authorized, and never on a
+     * denial or an unanswered escalation.
+     */
+    readonly run: () => Promise<TResult>;
+}
+/**
+ * What a protected action did.
+ *
+ * A discriminated union rather than a thrown error, because "policy said no" is
+ * an ordinary outcome an agent has to be able to read and report, not an
+ * exception. An error thrown by `run` itself is NOT caught: that is the caller's
+ * failure, about their side effect, and swallowing it here would turn a failed
+ * refund into a silent success.
+ */
+type ProtectResult<TResult> = {
+    readonly ok: true;
+    readonly result: TResult;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** Protect one action. Build it once per configuration, call it per action. */
+type Protect = <TResult>(action: ProtectedAction<TResult>) => Promise<ProtectResult<TResult>>;
+/**
+ * The calls an adapter makes, bound to one framework's name so a missing key or a
+ * missing end-user says which helpers to configure. Build one per adapter module.
+ */
+interface AdapterKernel {
+    /** The underlying client, for anything the kernel does not cover. */
+    readonly client: (config: PusharyAdapterConfig) => PusharyServer;
+    /**
+     * Blocking ask: create a decision and poll durably until the human answers or
+     * the deadline passes. Idempotency keyed by externalId + node + question.
+     */
+    readonly askExternalUser: (config: PusharyAdapterConfig, input: AskHumanInput) => Promise<AskResult>;
+    /**
+     * Durable create: open a decision with a `callbackUrl` and return at once, for
+     * a framework that parks its run and resumes on the webhook.
+     */
+    readonly createDurableDecision: (config: PusharyAdapterConfig, input: AskHumanInput) => Promise<CreatedDecision>;
+    /** Connect one end-user's phone (keyless). Show them the returned link. */
+    readonly connect: (config: PusharyAdapterConfig, externalId: string) => Promise<EnrollResult>;
+    /**
+     * Build a request-time approval gate. The client is created here, so a missing
+     * key throws where the gate is defined rather than on the first tool call.
+     */
+    readonly createGate: (config: PusharyGateConfig) => ApprovalGate;
+    /**
+     * Wrap one action so authorization, escalation and execution are one call.
+     *
+     * The whole of it is `createGate` plus "run it if the answer was yes", which is
+     * the point: there is no second policy engine, no durable runtime and no new
+     * abstraction under this. An adapter binds it by mapping its framework's
+     * context onto ProtectedAction, exactly as it already does for the gate.
+     *
+     * At most once. The decision is idempotent — a replay of the same
+     * `runId` + `callId` + action resolves to the same approval instead of asking
+     * twice — and the approval is then spent against a durable permit before the
+     * side effect runs. A retry, a concurrent worker and a resumed run all reach
+     * the same permit, and exactly one of them proceeds; the rest are refused with
+     * a reason that tells the model to stop rather than try again.
+     *
+     * `run` is called only after the permit is spent, never before, so the failure
+     * mode of a crash mid-action is a permit with no receipt — which is visible —
+     * rather than an action that runs twice, which is not recoverable.
+     */
+    readonly protect: (config: PusharyGateConfig) => Protect;
+    /**
+     * The end-user to ask, or a clear error naming these helpers. Adapters call this
+     * after applying their own resolver and the framework's own default.
+     */
+    readonly requireExternalId: (externalId: string | undefined) => string;
+}
+/**
+ * Build the kernel for one adapter.
+ *
+ * `helpersLabel` names the adapter in the missing-key error, so the message points
+ * at the helpers the caller is actually using ("the LangGraph helpers").
+ *
+ * ```ts
+ * const kernel = createAdapterKernel('the Acme helpers')
+ * export const askHuman = kernel.askExternalUser
+ * ```
+ */
+declare const createAdapterKernel: (helpersLabel: string) => AdapterKernel;
+
+export { type AdapterKernel, type ApprovalAsk, type ApprovalDecision, type ApprovalGate, type AskHumanInput, AskResult, AuthorizationEvaluation, type CreatedDecision, DENIED_BY_POLICY, DENIED_REFUSED, DENIED_UNANSWERED, DecisionParameters, DecisionType, EnrollResult, type Protect, type ProtectResult, type ProtectedAction, type PusharyAdapterConfig, type PusharyCallback, type PusharyGateConfig, PusharyServer, UNBOUND_APPROVAL, UNCONFIRMED_PERMIT, createAdapterKernel, defaultProtectQuestion, deniedByPolicy, deriveParameters, describeAnswer, idempotencyKeyFor, isAffirmative, refusedPermit, renderApprovalQuestion, resolvePusharyCallback };

package/dist/adapters.js

@@ -0,0 +1,316 @@
+import {
+  SIGNATURE_HEADER,
+  createPusharyServer,
+  deterministicKey,
+  isApproved,
+  parseDecisionCallback,
+  verifyWebhookSignature
+} from "./chunk-E6DWMKLZ.js";
+
+// src/adapters.ts
+var DEFAULT_NODE = "ask-human";
+var defaultProtectQuestion = (action, target) => `Approve ${action}${target ? ` ${target}` : ""}?`;
+var idempotencyKeyFor = (input) => deterministicKey([input.externalId, input.node ?? DEFAULT_NODE, input.question]);
+var isAffirmative = (answer) => isApproved({ status: "answered", type: "confirm", value: answer ?? null });
+var describeAnswer = (type, result) => {
+  if (!result.answered) {
+    return `No answer (status: ${result.status}). Treat this as NOT approved and do not proceed.`;
+  }
+  if (type === "confirm") {
+    return result.approved ? "The human approved. You may proceed." : "The human declined. Do not proceed.";
+  }
+  return `The human answered: ${result.value ?? ""}`;
+};
+var resolvePusharyCallback = (rawBody, signature, secret) => {
+  if (!verifyWebhookSignature(rawBody, signature, secret)) return null;
+  const callback = parseDecisionCallback(rawBody);
+  if (!callback) return null;
+  return {
+    correlationId: callback.correlationId,
+    answer: callback.answer,
+    value: callback.value,
+    approved: isAffirmative(callback.answer),
+    context: callback.context,
+    answeredAt: callback.answeredAt
+  };
+};
+var MAX_INPUT_CHARS = 300;
+var DENIED_UNANSWERED = "No answer from the approver, so this was denied. Do not retry the same action.";
+var DENIED_REFUSED = "The approver denied this action.";
+var DENIED_BY_POLICY = "Denied by policy. Do not retry the same action.";
+var UNBOUND_APPROVAL = "This was approved, but the approval could not be bound to a single execution, so it was not run. Do not retry the same action.";
+var UNCONFIRMED_PERMIT = "This was approved, but it could not be confirmed as still unspent, so it was not run. Ask again rather than retrying this one.";
+var REFUSED_REPLAY = "This authorization was already used. The action has run once and must not run again.";
+var refusedPermit = (refused) => refused.refusal === "already_consumed" ? REFUSED_REPLAY : `${refused.reason} Do not retry the same action.`;
+var deniedByPolicy = (evaluation) => evaluation.reason ? `${evaluation.reason} Do not retry the same action.` : DENIED_BY_POLICY;
+var PARAMETERS_MAX_KEYS = 32;
+var PARAMETER_KEY_MAX_LENGTH = 64;
+var PARAMETER_VALUE_MAX_LENGTH = 200;
+var deriveParameters = (input) => {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) return void 0;
+  const entries = Object.entries(input);
+  if (entries.length === 0 || entries.length > PARAMETERS_MAX_KEYS) return void 0;
+  const parameters = {};
+  for (const [key, value] of entries) {
+    if (key.length === 0 || key.length > PARAMETER_KEY_MAX_LENGTH) return void 0;
+    if (typeof value === "boolean") {
+      parameters[key] = value;
+    } else if (typeof value === "number") {
+      if (!Number.isFinite(value)) return void 0;
+      parameters[key] = value;
+    } else if (typeof value === "string") {
+      if (value.length > PARAMETER_VALUE_MAX_LENGTH) return void 0;
+      parameters[key] = value;
+    } else {
+      return void 0;
+    }
+  }
+  return parameters;
+};
+var renderApprovalQuestion = (toolName, toolInput) => {
+  if (toolInput === void 0 || toolInput === null) return `Approve ${toolName}?`;
+  const summary = summarise(toolInput);
+  return summary === void 0 ? `Approve ${toolName}?` : `Approve ${toolName}? ${summary}`;
+};
+var summarise = (toolInput) => {
+  let rendered;
+  if (typeof toolInput === "string") {
+    rendered = toolInput;
+  } else {
+    try {
+      rendered = JSON.stringify(toolInput);
+    } catch {
+      return void 0;
+    }
+  }
+  if (rendered === void 0) return void 0;
+  return rendered.length > MAX_INPUT_CHARS ? `${rendered.slice(0, MAX_INPUT_CHARS)}...` : rendered;
+};
+var createAdapterKernel = (helpersLabel) => {
+  const requireApiKey = (apiKey) => {
+    const resolved = apiKey ?? process.env.PUSHARY_API_KEY;
+    if (!resolved) {
+      throw new Error(`Pushary: set PUSHARY_API_KEY or pass { apiKey } to ${helpersLabel}.`);
+    }
+    return resolved;
+  };
+  const client = (config) => createPusharyServer({
+    apiKey: requireApiKey(config.apiKey),
+    ...config.baseUrl ? { baseUrl: config.baseUrl } : {}
+  });
+  const requireExternalId = (externalId) => {
+    if (!externalId) {
+      throw new Error(
+        `Pushary: no end-user to ask. Pass { externalId } to ${helpersLabel}, or run user-scoped auth so the framework supplies one.`
+      );
+    }
+    return externalId;
+  };
+  const createGate = (config) => {
+    const gateClient = createPusharyServer({
+      apiKey: requireApiKey(config.apiKey),
+      ...config.baseUrl ? { baseUrl: config.baseUrl } : {}
+    });
+    const usePolicy = config.policy ?? true;
+    const evaluate = async (ask, facts) => {
+      if (!usePolicy) return null;
+      try {
+        return await gateClient.evaluateAuthorization({
+          toolName: ask.toolName,
+          toolTarget: ask.toolTarget,
+          actor: ask.actor,
+          environment: ask.environment,
+          parameters: facts,
+          externalId: ask.externalId,
+          question: ask.question,
+          ...config.agentName ? { agentName: config.agentName } : {}
+        });
+      } catch {
+        return null;
+      }
+    };
+    return async (ask) => {
+      const facts = ask.parameters ?? deriveParameters(ask.input);
+      const evaluation = await evaluate(ask, facts);
+      if (evaluation?.verdict === "allow") {
+        return {
+          approved: true,
+          // Exactly the subject POST /authorize recorded, which is the whole of
+          // what it was sent.
+          ...evaluation.authorizationId ? {
+            authorization: {
+              authorizationId: evaluation.authorizationId,
+              toolName: ask.toolName,
+              toolTarget: ask.toolTarget,
+              actor: ask.actor,
+              environment: ask.environment,
+              externalId: ask.externalId,
+              parameters: facts
+            }
+          } : {}
+        };
+      }
+      if (evaluation?.verdict === "deny") {
+        return { approved: false, reason: deniedByPolicy(evaluation) };
+      }
+      const result = await gateClient.decisions.ask({
+        question: ask.question,
+        type: "confirm",
+        externalId: ask.externalId,
+        ...config.agentName ? { agentName: config.agentName } : {},
+        ...config.expiresInSeconds ? { expiresInSeconds: config.expiresInSeconds } : {},
+        ...config.timeoutMs !== void 0 ? { timeoutMs: config.timeoutMs } : {},
+        ...config.requireReachable ? { requireReachable: config.requireReachable } : {},
+        // The gated tool, recorded on the decision. The gate already knows it
+        // and keyed on it below; sending it is what lets the decision be grouped
+        // and matched later instead of surviving only as prose in the question.
+        toolName: ask.toolName,
+        // The rest of the subject only when the evaluation carried it and the
+        // server accepted it. An evaluation that failed proves nothing about what
+        // this ask would accept, and this path has to stay byte-for-byte the call
+        // that worked before policy existed.
+        ...evaluation ? {
+          toolTarget: ask.toolTarget,
+          actor: ask.actor,
+          environment: ask.environment,
+          parameters: facts
+        } : {},
+        // Stable across replays, so a re-run of this call resolves to the same
+        // decision instead of asking twice.
+        idempotencyKey: deterministicKey([ask.sessionId, ask.callId, ask.toolName])
+      });
+      if (result.approved) {
+        return {
+          approved: true,
+          authorization: {
+            authorizationId: result.decisionId,
+            toolName: ask.toolName,
+            externalId: ask.externalId,
+            // Mirrors the ask above exactly. The decision recorded the rest of
+            // the subject only when the evaluation carried it, so claiming it
+            // here regardless would describe an action the record does not hold.
+            ...evaluation ? {
+              toolTarget: ask.toolTarget,
+              actor: ask.actor,
+              environment: ask.environment,
+              parameters: facts
+            } : {}
+          }
+        };
+      }
+      return { approved: false, reason: result.answered ? DENIED_REFUSED : DENIED_UNANSWERED };
+    };
+  };
+  const askExternalUser = (config, input) => client(config).decisions.ask({
+    question: input.question,
+    type: input.type,
+    options: input.options,
+    externalId: input.externalId,
+    context: input.context,
+    agentName: config.agentName,
+    timeoutMs: config.timeoutMs,
+    // The node/step name doubles as the action label. The default is not
+    // sent: grouping every unnamed ask across every framework under one
+    // bucket would mine into a suggestion to auto-approve "ask-human", which
+    // spans unrelated questions.
+    toolName: input.node,
+    idempotencyKey: idempotencyKeyFor(input)
+  });
+  const createDurableDecision = async (config, input) => {
+    const created = await client(config).decisions.create({
+      question: input.question,
+      type: input.type,
+      options: input.options,
+      externalId: input.externalId,
+      context: input.context,
+      callbackUrl: input.callbackUrl,
+      agentName: config.agentName,
+      toolName: input.node,
+      idempotencyKey: idempotencyKeyFor(input),
+      wait: false
+    });
+    return {
+      decisionId: created.decisionId,
+      correlationId: created.decisionId,
+      status: created.status,
+      reachable: created.reachable,
+      reachableChannels: created.reachableChannels,
+      deviceCount: created.deviceCount
+    };
+  };
+  const connect = (config, externalId) => client(config).enroll(externalId);
+  const protect = (config) => {
+    const gate = createGate(config);
+    const permitClient = client(config);
+    const report = async (permitId, outcome, summary) => {
+      try {
+        await permitClient.recordExecution({ permitId, outcome, summary });
+      } catch {
+      }
+    };
+    return async (action) => {
+      const decision = await gate({
+        toolName: action.action,
+        toolTarget: action.target,
+        callId: action.callId,
+        sessionId: action.runId,
+        question: action.question ?? defaultProtectQuestion(action.action, action.target),
+        externalId: action.externalId,
+        actor: action.actor,
+        environment: action.environment,
+        parameters: action.facts
+      });
+      if (!decision.approved) return { ok: false, reason: decision.reason };
+      if (!decision.authorization) return { ok: false, reason: UNBOUND_APPROVAL };
+      let consumed;
+      try {
+        consumed = await permitClient.consumeAuthorization(decision.authorization);
+      } catch {
+        return { ok: false, reason: UNCONFIRMED_PERMIT };
+      }
+      if (!consumed.consumed) return { ok: false, reason: refusedPermit(consumed) };
+      const permitId = consumed.permit.permitId;
+      let result;
+      try {
+        result = await action.run();
+      } catch (error) {
+        await report(permitId, "failed", error instanceof Error ? error.message : "unknown error");
+        throw error;
+      }
+      await report(permitId, "succeeded");
+      return { ok: true, result };
+    };
+  };
+  return Object.freeze({
+    client,
+    askExternalUser,
+    createDurableDecision,
+    connect,
+    createGate,
+    protect,
+    requireExternalId
+  });
+};
+export {
+  DENIED_BY_POLICY,
+  DENIED_REFUSED,
+  DENIED_UNANSWERED,
+  SIGNATURE_HEADER,
+  UNBOUND_APPROVAL,
+  UNCONFIRMED_PERMIT,
+  createAdapterKernel,
+  defaultProtectQuestion,
+  deniedByPolicy,
+  deriveParameters,
+  describeAnswer,
+  deterministicKey,
+  idempotencyKeyFor,
+  isAffirmative,
+  isApproved,
+  parseDecisionCallback,
+  refusedPermit,
+  renderApprovalQuestion,
+  resolvePusharyCallback,
+  verifyWebhookSignature
+};
+//# sourceMappingURL=adapters.js.map