@undefineds.co/linx 0.2.12 → 0.2.14

package/dist/lib/watch/pod-approval.js

@@ -1,19 +1,18 @@
 import { setTimeout as delay } from 'node:timers/promises';
-import { getClientCredentialId, getClientCredentialKey } from '../credentials-store.js';
-import { AS_ACTOR, AS_ANNOUNCE, AS_OBJECT, DCT_CREATED, ODRL_ACTION, ODRL_POLICY, ODRL_TARGET, RDF_TYPE, UDFS_ACTION, UDFS_ACTOR, UDFS_ACTOR_ROLE, UDFS_APPROVAL_REQUEST, UDFS_ASSIGNED_TO, UDFS_AUDIT_ENTRY, UDFS_AUTONOMY_GRANT, UDFS_CONTEXT, UDFS_DECISION_BY, UDFS_DECISION_ROLE, UDFS_EFFECT, UDFS_ON_BEHALF_OF, UDFS_POLICY_VERSION, UDFS_REASON, UDFS_RESOLVED_AT, UDFS_REVOKED_AT, UDFS_RISK, UDFS_RISK_CEILING, UDFS_SESSION, UDFS_STATUS, UDFS_TOOL_CALL_ID, UDFS_TOOL_NAME, buildApprovalResourceUrl, buildAuditResourceUrl, buildGrantResourceUrl, buildInboxResourceUrl, firstIri, firstLiteral, iri, listTurtleResources, literal, parseManagedTurtleBlocks, readTurtleResource, subjectIdFromResourceUrl, upsertManagedTurtleBlock, } from '../pi-adapter/pod-native.js';
+import { getDefaultPodDataSession } from '../pod-data-session.js';
+import { AS, ODRL, UDFS } from '@undefineds.co/models/namespaces';
+import { ApprovalVocab, AuditVocab, GrantVocab, InboxNotificationVocab } from '@undefineds.co/models/vocab/sidecar';
+import { buildApprovalDocumentUrl, RDF_TYPE, buildApprovalResourceUrl, buildAuditDocumentUrl, buildAuditResourceUrl, buildGrantResourceUrl, buildInboxResourceUrl, firstIri, firstLiteral, iri, listTurtleResources, listTurtleResourcesRecursive, literal, parseManagedTurtleBlocks, readTurtleResource, subjectIdFromResourceUrl, upsertManagedTurtleBlock, } from '../pi-adapter/pod-native.js';
 const WATCH_CHAT_ID = 'linx-watch';
 const WATCH_AGENT_ID = 'linx-watch-assistant';
 const REMOTE_APPROVAL_POLICY_VERSION = 'linx-watch-remote-approval/v1';
 const DEFAULT_REMOTE_APPROVAL_POLL_MS = 1000;
+const remoteApprovalClientCache = new WeakMap();
 function createAbortError() {
     const error = new Error('The operation was aborted.');
     error.name = 'AbortError';
     return error;
 }
-async function dynamicImport(specifier) {
-    const loader = new Function('modulePath', 'return import(modulePath)');
-    return loader(specifier);
-}
 function normalizeString(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
@@ -43,10 +42,16 @@ function buildThreadUri(webId, threadId) {
     return `${getPodBaseUrl(webId)}/.data/chat/${WATCH_CHAT_ID}/index.ttl#${threadId}`;
 }
 function buildApprovalUri(webIdOrUri, approvalId) {
-    return `${getPodBaseUrl(webIdOrUri)}/.data/approvals/${approvalId}.ttl`;
+    return buildApprovalResourceUrl(webIdOrUri, approvalId);
+}
+function buildApprovalUriForDate(webIdOrUri, approvalId, createdAt) {
+    return buildApprovalResourceUrl(webIdOrUri, approvalId, createdAt);
 }
 function buildGrantUri(webIdOrUri, grantId) {
-    return `${getPodBaseUrl(webIdOrUri)}/settings/autonomy/grants/${grantId}.ttl`;
+    return buildGrantResourceUrl(webIdOrUri, grantId);
+}
+function buildGrantDocumentUrl(webIdOrUri) {
+    return `${getPodBaseUrl(webIdOrUri)}/settings/autonomy/grants.ttl`;
 }
 function buildAgentUri(webId) {
     return `${getPodBaseUrl(webId)}/.data/agents/${WATCH_AGENT_ID}.ttl`;
@@ -105,16 +110,6 @@ function buildRequestMessage(request) {
     }
     return request.message;
 }
-function buildRequestAuditContext(record, request) {
-    return {
-        kind: request.kind,
-        message: buildRequestMessage(request),
-        ...(request.kind === 'command-approval' && request.command ? { command: request.command } : {}),
-        ...(request.kind === 'command-approval' && request.cwd ? { cwd: request.cwd } : {}),
-        backend: record.backend,
-        sessionId: record.id,
-    };
-}
 function extractToolCallId(request) {
     if (!isRecord(request.raw)) {
         return crypto.randomUUID();
@@ -126,7 +121,7 @@ function extractToolCallId(request) {
         ?? crypto.randomUUID();
 }
 function encodeDecisionReason(decision, note) {
-    return JSON.stringify({
+    return safeJsonStringify({
         decision,
         ...(note?.trim() ? { note: note.trim() } : {}),
     });
@@ -153,34 +148,25 @@ function parseDecisionReason(value) {
         return null;
     }
 }
-function parseRequestAuditContext(value) {
-    if (typeof value !== 'string' || !value.trim()) {
-        return null;
-    }
+async function warnOnly(runtime, task) {
     try {
-        const parsed = JSON.parse(value);
-        if (!isRecord(parsed)) {
-            return null;
-        }
-        const kind = normalizeString(parsed.kind);
-        const message = normalizeString(parsed.message);
-        const sessionId = normalizeString(parsed.sessionId);
-        if (!kind || !message || !sessionId) {
-            return null;
+        await task();
+    }
+    catch (error) {
+        if (runtime.onWarning) {
+            runtime.onWarning(error);
+            return;
         }
-        return {
-            kind: kind,
-            message,
-            sessionId,
-            ...(normalizeString(parsed.backend) ? { backend: normalizeString(parsed.backend) } : {}),
-            ...(normalizeString(parsed.runtime) ? { runtime: normalizeString(parsed.runtime) } : {}),
-            ...(normalizeString(parsed.toolName) ? { toolName: normalizeString(parsed.toolName) } : {}),
-            ...(normalizeString(parsed.command) ? { command: normalizeString(parsed.command) } : {}),
-            ...(normalizeString(parsed.cwd) ? { cwd: normalizeString(parsed.cwd) } : {}),
-        };
+        const message = error instanceof Error ? error.message : String(error);
+        process.emitWarning(`LinX Pod sync failed: ${message}`);
+    }
+}
+function safeJsonStringify(value) {
+    try {
+        return JSON.stringify(value);
     }
     catch {
-        return null;
+        return JSON.stringify({ error: 'unserializable_context' });
     }
 }
 function extractSessionId(sessionUri) {
@@ -203,15 +189,7 @@ function decisionFromApprovalRow(row) {
     }
     return 'accept';
 }
-function requestAuditForApproval(approvalUri, audits) {
-    const matches = audits.filter((audit) => audit.approval === approvalUri && audit.action === 'approval_requested');
-    matches.sort((left, right) => toIsoString(right.createdAt, '').localeCompare(toIsoString(left.createdAt, '')));
-    return matches[0];
-}
-function normalizeApprovalSummary(row, audits) {
-    const approvalUri = buildApprovalUri(row.session, row.id);
-    const requestAudit = requestAuditForApproval(approvalUri, audits);
-    const requestContext = parseRequestAuditContext(requestAudit?.context);
+function normalizeApprovalSummary(row) {
     const createdAt = toIsoString(row.createdAt, new Date(0).toISOString());
     const sessionUri = row.session;
     const decision = decisionFromApprovalRow(row);
@@ -223,9 +201,7 @@ function normalizeApprovalSummary(row, audits) {
         toolName: row.toolName,
         risk: normalizeString(row.risk) ?? 'medium',
         status: normalizeString(row.status) ?? 'pending',
-        message: requestContext?.message ?? row.toolName,
-        ...(requestContext?.command ? { command: requestContext.command } : {}),
-        ...(requestContext?.cwd ? { cwd: requestContext.cwd } : {}),
+        message: formatApprovalMessage(row),
         ...(normalizeString(row.assignedTo) ? { assignedTo: normalizeString(row.assignedTo) } : {}),
         ...(normalizeString(row.decisionBy) ? { decisionBy: normalizeString(row.decisionBy) } : {}),
         ...(decision ? { decision } : {}),
@@ -233,6 +209,18 @@ function normalizeApprovalSummary(row, audits) {
         ...(row.resolvedAt ? { resolvedAt: toIsoString(row.resolvedAt, createdAt) } : {}),
     };
 }
+function formatApprovalMessage(row) {
+    if (row.toolName === 'commandExecution') {
+        return 'Command execution approval';
+    }
+    if (row.toolName === 'fileChange') {
+        return 'File change approval';
+    }
+    if (row.toolName === 'permissionRequest') {
+        return 'Permission approval';
+    }
+    return row.toolName;
+}
 function formatSummaryHeadline(summary) {
     return `${summary.id} | ${summary.status} | ${summary.risk} | session=${summary.sessionId}`;
 }
@@ -251,37 +239,11 @@ export function isRemoteApprovalAbortError(error) {
 function missingRemoteApprovalCredentialsMessage() {
     return 'LinX remote approval requires `linx login` first.';
 }
-function unsupportedRemoteApprovalAuthMessage() {
-    return 'LinX remote approval requires a valid LinX login in `~/.linx`.';
-}
 async function createDefaultRuntime() {
-    const [credentialsStore, solidAuth, oidcAuth] = await Promise.all([
-        dynamicImport(new URL('../credentials-store.js', import.meta.url).href),
-        dynamicImport(new URL('../solid-auth.js', import.meta.url).href),
-        dynamicImport(new URL('../oidc-auth.js', import.meta.url).href),
-    ]);
     return {
-        loadCredentials: credentialsStore.loadCredentials,
-        getClientCredentials: credentialsStore.getClientCredentials,
-        getOidcAccessToken: oidcAuth.getOidcAccessToken,
-        authenticate: solidAuth.authenticate,
-        authenticatedFetch(url, token, init) {
-            const headers = new Headers(init?.headers);
-            headers.set('Authorization', `Bearer ${token}`);
-            return fetch(url, { ...init, headers });
-        },
-        createStore(sessionOrWebId, fetcher) {
-            const webId = typeof sessionOrWebId === 'string' ? sessionOrWebId : sessionOrWebId.info.webId;
-            if (!webId) {
-                throw new Error('Remote approval authentication succeeded without a WebID.');
-            }
-            const activeFetcher = fetcher ?? (typeof sessionOrWebId === 'string'
-                ? undefined
-                : ((url, init) => sessionOrWebId.fetch(url, init)));
-            if (!activeFetcher) {
-                throw new Error('Remote approval authentication succeeded without a Pod fetcher.');
-            }
-            return createNativeRemoteApprovalStore(webId, activeFetcher);
+        getPodDataSession: getDefaultPodDataSession,
+        createStore(webId, fetcher) {
+            return createNativeRemoteApprovalStore(webId, fetcher);
         },
         sleep(ms) {
             return delay(ms);
@@ -292,39 +254,43 @@ async function createDefaultRuntime() {
     };
 }
 async function withRemoteApprovalStore(runtime, fn) {
-    const stored = runtime.loadCredentials();
-    if (!stored) {
+    const client = await getRemoteApprovalClient(runtime);
+    if (!client) {
         throw new Error(missingRemoteApprovalCredentialsMessage());
     }
-    const clientCredentials = runtime.getClientCredentials(stored);
-    if (clientCredentials) {
-        const { session } = await runtime.authenticate(getClientCredentialId(clientCredentials), getClientCredentialKey(clientCredentials), stored.url);
-        const webId = session.info.webId ?? stored.webId;
-        if (!webId) {
-            await session.logout().catch(() => undefined);
-            throw new Error('Remote approval authentication succeeded without a WebID.');
-        }
-        try {
-            return await fn({
-                store: runtime.createStore(session),
-                webId,
-                stored,
-            });
-        }
-        finally {
-            await session.logout().catch(() => undefined);
-        }
-    }
-    const accessToken = await runtime.getOidcAccessToken?.(stored);
-    if (accessToken && stored.webId && runtime.authenticatedFetch) {
-        const fetcher = (url, init) => runtime.authenticatedFetch(url, accessToken, init);
-        return await fn({
-            store: runtime.createStore(stored.webId, fetcher),
-            webId: stored.webId,
-            stored,
+    return await fn({
+        store: client.store,
+        webId: client.session.webId,
+        stored: client.session.credentials,
+    });
+}
+async function getRemoteApprovalClient(runtime) {
+    let promise = remoteApprovalClientCache.get(runtime);
+    if (!promise) {
+        promise = createRemoteApprovalClient(runtime)
+            .then((client) => {
+            if (!client) {
+                remoteApprovalClientCache.delete(runtime);
+            }
+            return client;
+        })
+            .catch((error) => {
+            remoteApprovalClientCache.delete(runtime);
+            throw error;
         });
+        remoteApprovalClientCache.set(runtime, promise);
     }
-    throw new Error(unsupportedRemoteApprovalAuthMessage());
+    return promise;
+}
+async function createRemoteApprovalClient(runtime) {
+    const session = await runtime.getPodDataSession();
+    if (!session) {
+        return null;
+    }
+    return {
+        session,
+        store: runtime.createStore(session.webId, session.fetch),
+    };
 }
 function createNativeRemoteApprovalStore(webId, fetcher) {
     return {
@@ -345,99 +311,109 @@ function createNativeRemoteApprovalStore(webId, fetcher) {
     };
 }
 async function listApprovalRows(webId, fetcher) {
-    const urls = await listTurtleResources(fetcher, `${getPodBaseUrl(webId)}/.data/approvals/`);
+    const [currentUrls, legacyUrls] = await Promise.all([
+        listTurtleResourcesRecursive(fetcher, `${getPodBaseUrl(webId)}/.data/approvals/`).catch(() => []),
+        listTurtleResources(fetcher, `${getPodBaseUrl(webId)}/.data/approvals/`).catch(() => []),
+    ]);
+    const urls = [...new Set([...currentUrls, ...legacyUrls])];
     const rows = [];
     for (const url of urls.filter((entry) => entry.endsWith('.ttl'))) {
         const turtle = await readTurtleResource(fetcher, url).catch(() => null);
         if (!turtle)
             continue;
-        const predicates = parseManagedTurtleBlocks(turtle, url).get(url);
-        if (!predicates)
-            continue;
-        const row = approvalRowFromPredicates(url, predicates);
-        if (row)
-            rows.push(row);
+        for (const [subject, predicates] of parseManagedTurtleBlocks(turtle, url)) {
+            const row = approvalRowFromPredicates(subject, predicates);
+            if (row)
+                rows.push(row);
+        }
     }
     return rows;
 }
 async function writeApprovalRow(webId, fetcher, row) {
-    const url = buildApprovalResourceUrl(webId, row.id);
-    await upsertManagedTurtleBlock(fetcher, url, {
-        subject: url,
+    const createdAt = new Date(toIsoString(row.createdAt, new Date().toISOString()));
+    const documentUrl = buildApprovalDocumentUrl(webId, createdAt);
+    const subjectUrl = buildApprovalResourceUrl(webId, row.id, createdAt);
+    await upsertManagedTurtleBlock(fetcher, documentUrl, {
+        subject: subjectUrl,
         triples: [
-            { predicate: RDF_TYPE, object: iri(UDFS_APPROVAL_REQUEST) },
-            { predicate: UDFS_SESSION, object: iri(row.session) },
-            { predicate: UDFS_TOOL_CALL_ID, object: literal(row.toolCallId) },
-            { predicate: UDFS_TOOL_NAME, object: literal(row.toolName) },
-            { predicate: ODRL_TARGET, object: iri(row.target) },
-            { predicate: ODRL_ACTION, object: iri(row.action) },
-            { predicate: UDFS_RISK, object: literal(row.risk) },
-            { predicate: UDFS_STATUS, object: literal(row.status) },
-            ...(row.assignedTo ? [{ predicate: UDFS_ASSIGNED_TO, object: iri(row.assignedTo) }] : []),
-            ...(row.decisionBy ? [{ predicate: UDFS_DECISION_BY, object: iri(row.decisionBy) }] : []),
-            ...(row.decisionRole ? [{ predicate: UDFS_DECISION_ROLE, object: literal(row.decisionRole) }] : []),
-            ...(row.onBehalfOf ? [{ predicate: UDFS_ON_BEHALF_OF, object: iri(row.onBehalfOf) }] : []),
-            ...(row.reason ? [{ predicate: UDFS_REASON, object: literal(row.reason) }] : []),
-            ...(row.policyVersion ? [{ predicate: UDFS_POLICY_VERSION, object: literal(row.policyVersion) }] : []),
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
-            ...(row.resolvedAt ? [{ predicate: UDFS_RESOLVED_AT, object: literal(toIsoString(row.resolvedAt, new Date().toISOString())) }] : []),
+            { predicate: RDF_TYPE, object: iri(UDFS.ApprovalRequest) },
+            { predicate: ApprovalVocab.session, object: iri(row.session) },
+            { predicate: ApprovalVocab.toolCallId, object: literal(row.toolCallId) },
+            { predicate: ApprovalVocab.toolName, object: literal(row.toolName) },
+            { predicate: ApprovalVocab.target, object: iri(row.target) },
+            { predicate: ApprovalVocab.action, object: iri(row.action) },
+            { predicate: ApprovalVocab.risk, object: literal(row.risk) },
+            { predicate: ApprovalVocab.status, object: literal(row.status) },
+            ...(row.assignedTo ? [{ predicate: ApprovalVocab.assignedTo, object: iri(row.assignedTo) }] : []),
+            ...(row.decisionBy ? [{ predicate: ApprovalVocab.decisionBy, object: iri(row.decisionBy) }] : []),
+            ...(row.decisionRole ? [{ predicate: ApprovalVocab.decisionRole, object: literal(row.decisionRole) }] : []),
+            ...(row.onBehalfOf ? [{ predicate: ApprovalVocab.onBehalfOf, object: iri(row.onBehalfOf) }] : []),
+            ...(row.reason ? [{ predicate: ApprovalVocab.reason, object: literal(row.reason) }] : []),
+            ...(row.policyVersion ? [{ predicate: ApprovalVocab.policyVersion, object: literal(row.policyVersion) }] : []),
+            { predicate: ApprovalVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            ...(row.resolvedAt ? [{ predicate: ApprovalVocab.resolvedAt, object: literal(toIsoString(row.resolvedAt, new Date().toISOString())) }] : []),
         ],
     });
 }
 async function listAuditRows(webId, fetcher) {
-    const urls = await listTurtleResources(fetcher, `${getPodBaseUrl(webId)}/.data/audit/`);
+    const urls = await listTurtleResourcesRecursive(fetcher, `${getPodBaseUrl(webId)}/.data/audits/`);
     const rows = [];
     for (const url of urls.filter((entry) => entry.endsWith('.ttl'))) {
         const turtle = await readTurtleResource(fetcher, url).catch(() => null);
         if (!turtle)
             continue;
-        const predicates = parseManagedTurtleBlocks(turtle, url).get(url);
-        if (!predicates)
-            continue;
-        const row = auditRowFromPredicates(url, predicates);
-        if (row)
-            rows.push(row);
+        for (const [subject, predicates] of parseManagedTurtleBlocks(turtle, url)) {
+            const row = auditRowFromPredicates(subject, predicates);
+            if (row)
+                rows.push(row);
+        }
     }
     return rows;
 }
 async function writeAuditRow(webId, fetcher, row) {
-    const url = buildAuditResourceUrl(webId, row.id);
-    await upsertManagedTurtleBlock(fetcher, url, {
-        subject: url,
+    const createdAt = new Date(toIsoString(row.createdAt, new Date().toISOString()));
+    const documentUrl = buildAuditDocumentUrl(webId, createdAt);
+    const subjectUrl = buildAuditResourceUrl(webId, row.id, createdAt);
+    await upsertManagedTurtleBlock(fetcher, documentUrl, {
+        subject: subjectUrl,
         triples: [
-            { predicate: RDF_TYPE, object: iri(UDFS_AUDIT_ENTRY) },
-            { predicate: UDFS_ACTION, object: literal(row.action) },
-            { predicate: UDFS_ACTOR, object: iri(row.actor) },
-            { predicate: UDFS_ACTOR_ROLE, object: literal(row.actorRole) },
-            ...(row.onBehalfOf ? [{ predicate: UDFS_ON_BEHALF_OF, object: iri(row.onBehalfOf) }] : []),
-            ...(row.session ? [{ predicate: UDFS_SESSION, object: iri(row.session) }] : []),
-            ...(row.toolCallId ? [{ predicate: UDFS_TOOL_CALL_ID, object: literal(row.toolCallId) }] : []),
-            ...(row.approval ? [{ predicate: 'https://undefineds.co/ns#approval', object: iri(row.approval) }] : []),
-            ...(row.context ? [{ predicate: UDFS_CONTEXT, object: literal(row.context) }] : []),
-            ...(row.policyVersion ? [{ predicate: UDFS_POLICY_VERSION, object: literal(row.policyVersion) }] : []),
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            { predicate: RDF_TYPE, object: iri(UDFS.AuditEntry) },
+            { predicate: AuditVocab.action, object: literal(row.action) },
+            { predicate: AuditVocab.actor, object: iri(row.actor) },
+            { predicate: AuditVocab.actorRole, object: literal(row.actorRole) },
+            ...(row.onBehalfOf ? [{ predicate: AuditVocab.onBehalfOf, object: iri(row.onBehalfOf) }] : []),
+            ...(row.session ? [{ predicate: AuditVocab.session, object: iri(row.session) }] : []),
+            ...(row.entry ? [{ predicate: AuditVocab.entry, object: iri(row.entry) }] : []),
+            ...(row.toolCallId ? [{ predicate: AuditVocab.toolCallId, object: literal(row.toolCallId) }] : []),
+            ...(row.toolName ? [{ predicate: AuditVocab.toolName, object: literal(row.toolName) }] : []),
+            ...(row.approval ? [{ predicate: AuditVocab.approval, object: iri(row.approval) }] : []),
+            ...(row.policyVersion ? [{ predicate: AuditVocab.policyVersion, object: literal(row.policyVersion) }] : []),
+            { predicate: AuditVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
         ],
     });
 }
 async function listGrantRows(webId, fetcher) {
-    const urls = await listTurtleResources(fetcher, `${getPodBaseUrl(webId)}/settings/autonomy/grants/`);
+    const urls = [
+        `${getPodBaseUrl(webId)}/settings/autonomy/grants.ttl`,
+        ...await listTurtleResources(fetcher, `${getPodBaseUrl(webId)}/settings/autonomy/grants/`).catch(() => []),
+    ];
     const rows = [];
     for (const url of urls.filter((entry) => entry.endsWith('.ttl'))) {
         const turtle = await readTurtleResource(fetcher, url).catch(() => null);
         if (!turtle)
             continue;
-        const predicates = parseManagedTurtleBlocks(turtle, url).get(url);
-        if (!predicates)
-            continue;
-        const row = grantRowFromPredicates(url, predicates);
-        if (row)
-            rows.push(row);
+        for (const [subject, predicates] of parseManagedTurtleBlocks(turtle, url)) {
+            const row = grantRowFromPredicates(subject, predicates);
+            if (row)
+                rows.push(row);
+        }
     }
     return rows;
 }
 async function writeGrantRow(webId, fetcher, row) {
     const id = normalizeString(row.id) ?? crypto.randomUUID();
-    const url = buildGrantResourceUrl(webId, id);
+    const documentUrl = buildGrantDocumentUrl(webId);
+    const subjectUrl = buildGrantResourceUrl(webId, id);
     const target = normalizeString(row.target);
     const action = normalizeString(row.action);
     const effect = normalizeString(row.effect);
@@ -446,20 +422,20 @@ async function writeGrantRow(webId, fetcher, row) {
     if (!target || !action || !effect || !decisionBy || !decisionRole) {
         throw new Error(`Invalid remote approval grant row: ${id}`);
     }
-    await upsertManagedTurtleBlock(fetcher, url, {
-        subject: url,
+    await upsertManagedTurtleBlock(fetcher, documentUrl, {
+        subject: subjectUrl,
         triples: [
-            { predicate: RDF_TYPE, object: iri(ODRL_POLICY) },
-            { predicate: RDF_TYPE, object: iri(UDFS_AUTONOMY_GRANT) },
-            { predicate: ODRL_TARGET, object: iri(target) },
-            { predicate: ODRL_ACTION, object: iri(action) },
-            { predicate: UDFS_EFFECT, object: literal(effect) },
-            ...(normalizeString(row.riskCeiling) ? [{ predicate: UDFS_RISK_CEILING, object: literal(normalizeString(row.riskCeiling)) }] : []),
-            { predicate: UDFS_DECISION_BY, object: iri(decisionBy) },
-            { predicate: UDFS_DECISION_ROLE, object: literal(decisionRole) },
-            ...(normalizeString(row.onBehalfOf) ? [{ predicate: UDFS_ON_BEHALF_OF, object: iri(normalizeString(row.onBehalfOf)) }] : []),
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
-            ...(normalizeString(row.revokedAt) ? [{ predicate: UDFS_REVOKED_AT, object: literal(normalizeString(row.revokedAt)) }] : []),
+            { predicate: RDF_TYPE, object: iri(ODRL.Policy) },
+            { predicate: RDF_TYPE, object: iri(UDFS.AutonomyGrant) },
+            { predicate: GrantVocab.target, object: iri(target) },
+            { predicate: GrantVocab.action, object: iri(action) },
+            { predicate: GrantVocab.effect, object: literal(effect) },
+            ...(normalizeString(row.riskCeiling) ? [{ predicate: GrantVocab.riskCeiling, object: literal(normalizeString(row.riskCeiling)) }] : []),
+            { predicate: GrantVocab.decisionBy, object: iri(decisionBy) },
+            { predicate: GrantVocab.decisionRole, object: literal(decisionRole) },
+            ...(normalizeString(row.onBehalfOf) ? [{ predicate: GrantVocab.onBehalfOf, object: iri(normalizeString(row.onBehalfOf)) }] : []),
+            { predicate: GrantVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            ...(normalizeString(row.revokedAt) ? [{ predicate: GrantVocab.revokedAt, object: literal(normalizeString(row.revokedAt)) }] : []),
         ],
     });
 }
@@ -468,22 +444,22 @@ async function writeInboxNotificationRow(webId, fetcher, row) {
     await upsertManagedTurtleBlock(fetcher, url, {
         subject: url,
         triples: [
-            { predicate: RDF_TYPE, object: iri(AS_ANNOUNCE) },
-            ...(row.actor ? [{ predicate: AS_ACTOR, object: iri(row.actor) }] : []),
-            { predicate: AS_OBJECT, object: iri(row.object) },
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            { predicate: RDF_TYPE, object: iri(AS.Announce) },
+            ...(row.actor ? [{ predicate: InboxNotificationVocab.actor, object: iri(row.actor) }] : []),
+            { predicate: InboxNotificationVocab.object, object: iri(row.object) },
+            { predicate: InboxNotificationVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
         ],
     });
 }
 function approvalRowFromPredicates(url, predicates) {
-    const session = firstIri(predicates, UDFS_SESSION);
-    const toolCallId = firstLiteral(predicates, UDFS_TOOL_CALL_ID);
-    const toolName = firstLiteral(predicates, UDFS_TOOL_NAME);
-    const target = firstIri(predicates, ODRL_TARGET);
-    const action = firstIri(predicates, ODRL_ACTION);
-    const risk = firstLiteral(predicates, UDFS_RISK);
-    const status = firstLiteral(predicates, UDFS_STATUS);
-    const createdAt = firstLiteral(predicates, DCT_CREATED);
+    const session = firstIri(predicates, ApprovalVocab.session);
+    const toolCallId = firstLiteral(predicates, ApprovalVocab.toolCallId);
+    const toolName = firstLiteral(predicates, ApprovalVocab.toolName);
+    const target = firstIri(predicates, ApprovalVocab.target);
+    const action = firstIri(predicates, ApprovalVocab.action);
+    const risk = firstLiteral(predicates, ApprovalVocab.risk);
+    const status = firstLiteral(predicates, ApprovalVocab.status);
+    const createdAt = firstLiteral(predicates, ApprovalVocab.createdAt);
     if (!session || !toolCallId || !toolName || !target || !action || !risk || !status || !createdAt) {
         return null;
     }
@@ -496,21 +472,21 @@ function approvalRowFromPredicates(url, predicates) {
         action,
         risk,
         status,
-        assignedTo: firstIri(predicates, UDFS_ASSIGNED_TO),
-        decisionBy: firstIri(predicates, UDFS_DECISION_BY),
-        decisionRole: firstLiteral(predicates, UDFS_DECISION_ROLE),
-        onBehalfOf: firstIri(predicates, UDFS_ON_BEHALF_OF),
-        reason: firstLiteral(predicates, UDFS_REASON),
-        policyVersion: firstLiteral(predicates, UDFS_POLICY_VERSION),
+        assignedTo: firstIri(predicates, ApprovalVocab.assignedTo),
+        decisionBy: firstIri(predicates, ApprovalVocab.decisionBy),
+        decisionRole: firstLiteral(predicates, ApprovalVocab.decisionRole),
+        onBehalfOf: firstIri(predicates, ApprovalVocab.onBehalfOf),
+        reason: firstLiteral(predicates, ApprovalVocab.reason),
+        policyVersion: firstLiteral(predicates, ApprovalVocab.policyVersion),
         createdAt,
-        resolvedAt: firstLiteral(predicates, UDFS_RESOLVED_AT),
+        resolvedAt: firstLiteral(predicates, ApprovalVocab.resolvedAt),
     };
 }
 function auditRowFromPredicates(url, predicates) {
-    const action = firstLiteral(predicates, UDFS_ACTION);
-    const actor = firstIri(predicates, UDFS_ACTOR);
-    const actorRole = firstLiteral(predicates, UDFS_ACTOR_ROLE);
-    const createdAt = firstLiteral(predicates, DCT_CREATED);
+    const action = firstLiteral(predicates, AuditVocab.action);
+    const actor = firstIri(predicates, AuditVocab.actor);
+    const actorRole = firstLiteral(predicates, AuditVocab.actorRole);
+    const createdAt = firstLiteral(predicates, AuditVocab.createdAt);
     if (!action || !actor || !actorRole || !createdAt) {
         return null;
     }
@@ -519,22 +495,23 @@ function auditRowFromPredicates(url, predicates) {
         action,
         actor,
         actorRole,
-        onBehalfOf: firstIri(predicates, UDFS_ON_BEHALF_OF),
-        session: firstIri(predicates, UDFS_SESSION),
-        toolCallId: firstLiteral(predicates, UDFS_TOOL_CALL_ID),
-        approval: firstIri(predicates, 'https://undefineds.co/ns#approval'),
-        context: firstLiteral(predicates, UDFS_CONTEXT),
-        policyVersion: firstLiteral(predicates, UDFS_POLICY_VERSION),
+        onBehalfOf: firstIri(predicates, AuditVocab.onBehalfOf),
+        session: firstIri(predicates, AuditVocab.session),
+        entry: firstIri(predicates, AuditVocab.entry),
+        toolCallId: firstLiteral(predicates, AuditVocab.toolCallId),
+        toolName: firstLiteral(predicates, AuditVocab.toolName),
+        approval: firstIri(predicates, AuditVocab.approval),
+        policyVersion: firstLiteral(predicates, AuditVocab.policyVersion),
         createdAt,
     };
 }
 function grantRowFromPredicates(url, predicates) {
-    const target = firstIri(predicates, ODRL_TARGET);
-    const action = firstIri(predicates, ODRL_ACTION);
-    const effect = firstLiteral(predicates, UDFS_EFFECT);
-    const decisionBy = firstIri(predicates, UDFS_DECISION_BY);
-    const decisionRole = firstLiteral(predicates, UDFS_DECISION_ROLE);
-    const createdAt = firstLiteral(predicates, DCT_CREATED);
+    const target = firstIri(predicates, GrantVocab.target);
+    const action = firstIri(predicates, GrantVocab.action);
+    const effect = firstLiteral(predicates, GrantVocab.effect);
+    const decisionBy = firstIri(predicates, GrantVocab.decisionBy);
+    const decisionRole = firstLiteral(predicates, GrantVocab.decisionRole);
+    const createdAt = firstLiteral(predicates, GrantVocab.createdAt);
     if (!target || !action || !effect || !decisionBy || !decisionRole || !createdAt) {
         return null;
     }
@@ -543,12 +520,12 @@ function grantRowFromPredicates(url, predicates) {
         target,
         action,
         effect,
-        riskCeiling: firstLiteral(predicates, UDFS_RISK_CEILING),
+        riskCeiling: firstLiteral(predicates, GrantVocab.riskCeiling),
         decisionBy,
         decisionRole,
-        onBehalfOf: firstIri(predicates, UDFS_ON_BEHALF_OF),
+        onBehalfOf: firstIri(predicates, GrantVocab.onBehalfOf),
         createdAt,
-        revokedAt: firstLiteral(predicates, UDFS_REVOKED_AT),
+        revokedAt: firstLiteral(predicates, GrantVocab.revokedAt),
     };
 }
 export async function createRemoteWatchApproval(options) {
@@ -568,7 +545,7 @@ export async function createRemoteWatchApproval(options) {
             risk: buildRisk(options.request),
             ...(options.request.kind === 'command-approval' && options.request.command ? { command: options.request.command } : {}),
             ...(options.request.kind === 'command-approval' && options.request.cwd ? { cwd: options.request.cwd } : {}),
-            context: buildRequestAuditContext(options.record, options.request),
+            entry: sessionUri,
         }),
         runtime: activeRuntime,
     });
@@ -585,19 +562,12 @@ export async function createRemoteApproval(options) {
         const approvalId = crypto.randomUUID();
         const now = activeRuntime.now();
         const sessionUri = subject.sessionUri;
-        const approvalUri = buildApprovalUri(webId, approvalId);
+        const approvalUri = buildApprovalUriForDate(webId, approvalId, now);
         const targetUri = subject.targetUri ?? sessionUri;
         const assignedTo = subject.assignedTo ?? webId;
         const onBehalfOf = subject.onBehalfOf ?? webId;
         const policyVersion = subject.policyVersion ?? REMOTE_APPROVAL_POLICY_VERSION;
-        const requestContext = request.context ?? {
-            kind: request.kind,
-            message: request.message,
-            sessionId: extractSessionId(sessionUri),
-            toolName: request.toolName,
-            ...(request.command ? { command: request.command } : {}),
-            ...(request.cwd ? { cwd: request.cwd } : {}),
-        };
+        const requestEntry = request.entry ?? approvalUri;
         await store.insertApproval({
             id: approvalId,
             session: sessionUri,
@@ -611,25 +581,27 @@ export async function createRemoteApproval(options) {
             policyVersion,
             createdAt: now,
         });
-        await store.insertAudit({
+        const requestAudit = {
             id: crypto.randomUUID(),
             action: 'approval_requested',
             actor: subject.actorUri,
             actorRole: 'secretary',
             onBehalfOf,
             session: sessionUri,
+            entry: requestEntry,
             toolCallId: request.toolCallId,
+            toolName: request.toolName,
             approval: approvalUri,
-            context: JSON.stringify(requestContext),
             policyVersion,
             createdAt: now,
-        });
-        await store.insertInboxNotification({
+        };
+        await warnOnly(activeRuntime, () => store.insertAudit(requestAudit));
+        await warnOnly(activeRuntime, () => store.insertInboxNotification({
             id: crypto.randomUUID(),
             actor: subject.actorUri,
             object: approvalUri,
             createdAt: now,
-        }).catch(() => undefined);
+        }));
         return normalizeApprovalSummary({
             id: approvalId,
             session: sessionUri,
@@ -642,19 +614,7 @@ export async function createRemoteApproval(options) {
             assignedTo,
             policyVersion,
             createdAt: now,
-        }, [{
-                id: crypto.randomUUID(),
-                action: 'approval_requested',
-                actor: subject.actorUri,
-                actorRole: 'secretary',
-                onBehalfOf,
-                session: sessionUri,
-                toolCallId: request.toolCallId,
-                approval: approvalUri,
-                context: JSON.stringify(requestContext),
-                policyVersion,
-                createdAt: now,
-            }]);
+        });
     });
 }
 export async function waitForRemoteWatchApproval(options) {
@@ -741,12 +701,9 @@ export async function listRemoteWatchApprovals(options = {}) {
     const activeRuntime = options.runtime ?? await createDefaultRuntime();
     const requestedStatus = options.status ?? 'pending';
     return withRemoteApprovalStore(activeRuntime, async ({ store, webId }) => {
-        const [approvals, audits] = await Promise.all([
-            store.listApprovals(),
-            store.listAudits(),
-        ]);
+        const approvals = await store.listApprovals();
         return approvals
-            .map((row) => normalizeApprovalSummary(row, audits))
+            .map((row) => normalizeApprovalSummary(row))
             .filter((summary) => !summary.assignedTo || summary.assignedTo === webId)
             .filter((summary) => requestedStatus === 'all' || summary.status === requestedStatus)
             .sort((left, right) => right.createdAt.localeCompare(left.createdAt));
@@ -761,11 +718,11 @@ export async function resolveRemoteWatchApproval(options) {
             throw new Error(`Remote approval not found: ${options.approvalId}`);
         }
         if (row.status !== 'pending') {
-            const audits = await store.listAudits();
-            return normalizeApprovalSummary(row, audits);
+            return normalizeApprovalSummary(row);
         }
         const now = activeRuntime.now();
-        const approvalUri = buildApprovalUri(row.session, row.id);
+        const approvalCreatedAt = new Date(toIsoString(row.createdAt, now.toISOString()));
+        const approvalUri = buildApprovalUriForDate(row.session, row.id, approvalCreatedAt);
         const nextStatus = options.decision === 'accept' || options.decision === 'accept_for_session'
             ? 'approved'
             : 'rejected';
@@ -777,22 +734,20 @@ export async function resolveRemoteWatchApproval(options) {
             reason: encodeDecisionReason(options.decision, options.note),
             resolvedAt: now,
         });
-        await store.insertAudit({
+        await warnOnly(activeRuntime, () => store.insertAudit({
             id: crypto.randomUUID(),
             action: nextStatus === 'approved' ? 'approval_approved' : 'approval_rejected',
             actor: webId,
             actorRole: 'human',
             onBehalfOf: webId,
             session: row.session,
+            entry: approvalUri,
             toolCallId: row.toolCallId,
+            toolName: row.toolName,
             approval: approvalUri,
-            context: JSON.stringify({
-                decision: options.decision,
-                ...(options.note?.trim() ? { note: options.note.trim() } : {}),
-            }),
             policyVersion: REMOTE_APPROVAL_POLICY_VERSION,
             createdAt: now,
-        });
+        }));
         if (options.decision === 'accept_for_session') {
             const grantId = crypto.randomUUID();
             await store.insertGrant({
@@ -806,19 +761,19 @@ export async function resolveRemoteWatchApproval(options) {
                 onBehalfOf: webId,
                 createdAt: now,
             });
-            await store.insertInboxNotification({
+            await warnOnly(activeRuntime, () => store.insertInboxNotification({
                 id: crypto.randomUUID(),
                 actor: webId,
                 object: buildGrantUri(row.session, grantId),
                 createdAt: now,
-            }).catch(() => undefined);
+            }));
         }
-        await store.insertInboxNotification({
+        await warnOnly(activeRuntime, () => store.insertInboxNotification({
             id: crypto.randomUUID(),
             actor: webId,
             object: approvalUri,
             createdAt: now,
-        }).catch(() => undefined);
+        }));
         const nextRow = {
             ...row,
             status: nextStatus,
@@ -828,15 +783,13 @@ export async function resolveRemoteWatchApproval(options) {
             reason: encodeDecisionReason(options.decision, options.note),
             resolvedAt: now,
         };
-        const audits = await store.listAudits();
-        return normalizeApprovalSummary(nextRow, audits);
+        return normalizeApprovalSummary(nextRow);
     });
 }
 export const __podApprovalInternal = {
     createAbortError,
     createDefaultRuntime,
     buildActionUri,
-    buildRequestAuditContext,
     buildRisk,
     buildToolName,
     createNativeRemoteApprovalStore,
@@ -847,6 +800,5 @@ export const __podApprovalInternal = {
     isRemoteApprovalAbortError,
     normalizeApprovalSummary,
     parseDecisionReason,
-    parseRequestAuditContext,
 };
 //# sourceMappingURL=pod-approval.js.map