@undefineds.co/linx 0.2.13 → 0.2.15

package/dist/lib/watch/pod-approval.js

@@ -1,6 +1,8 @@
 import { setTimeout as delay } from 'node:timers/promises';
 import { getDefaultPodDataSession } from '../pod-data-session.js';
-import { AS_ACTOR, AS_ANNOUNCE, AS_OBJECT, buildApprovalDocumentUrl, DCT_CREATED, ODRL_ACTION, ODRL_POLICY, ODRL_TARGET, RDF_TYPE, UDFS_ACTION, UDFS_ACTOR, UDFS_ACTOR_ROLE, UDFS_APPROVAL_REQUEST, UDFS_ASSIGNED_TO, UDFS_AUDIT_ENTRY, UDFS_AUTONOMY_GRANT, UDFS_CONTEXT, UDFS_DECISION_BY, UDFS_DECISION_ROLE, UDFS_EFFECT, UDFS_ON_BEHALF_OF, UDFS_POLICY_VERSION, UDFS_REASON, UDFS_RESOLVED_AT, UDFS_REVOKED_AT, UDFS_RISK, UDFS_RISK_CEILING, UDFS_SESSION, UDFS_STATUS, UDFS_TOOL_CALL_ID, UDFS_TOOL_NAME, buildApprovalResourceUrl, buildAuditDocumentUrl, buildAuditResourceUrl, buildGrantResourceUrl, buildInboxResourceUrl, firstIri, firstLiteral, iri, listTurtleResources, listTurtleResourcesRecursive, literal, parseManagedTurtleBlocks, readTurtleResource, subjectIdFromResourceUrl, upsertManagedTurtleBlock, } from '../pi-adapter/pod-native.js';
+import { AS, ODRL, UDFS } from '@undefineds.co/models/namespaces';
+import { ApprovalVocab, AuditVocab, GrantVocab, InboxNotificationVocab } from '@undefineds.co/models/vocab/sidecar';
+import { buildApprovalDocumentUrl, RDF_TYPE, buildApprovalResourceUrl, buildAuditDocumentUrl, buildAuditResourceUrl, buildGrantResourceUrl, buildInboxResourceUrl, firstIri, firstLiteral, iri, listTurtleResources, listTurtleResourcesRecursive, literal, parseManagedTurtleBlocks, readTurtleResource, subjectIdFromResourceUrl, upsertManagedTurtleBlock, } from '../pi-adapter/pod-native.js';
 const WATCH_CHAT_ID = 'linx-watch';
 const WATCH_AGENT_ID = 'linx-watch-assistant';
 const REMOTE_APPROVAL_POLICY_VERSION = 'linx-watch-remote-approval/v1';
@@ -45,6 +47,9 @@ function buildApprovalUri(webIdOrUri, approvalId) {
 function buildApprovalUriForDate(webIdOrUri, approvalId, createdAt) {
     return buildApprovalResourceUrl(webIdOrUri, approvalId, createdAt);
 }
+function documentUrlFromResourceUri(resourceUri) {
+    return resourceUri.split('#', 1)[0] ?? resourceUri;
+}
 function buildGrantUri(webIdOrUri, grantId) {
     return buildGrantResourceUrl(webIdOrUri, grantId);
 }
@@ -108,16 +113,6 @@ function buildRequestMessage(request) {
     }
     return request.message;
 }
-function buildRequestAuditContext(record, request) {
-    return {
-        kind: request.kind,
-        message: buildRequestMessage(request),
-        ...(request.kind === 'command-approval' && request.command ? { command: request.command } : {}),
-        ...(request.kind === 'command-approval' && request.cwd ? { cwd: request.cwd } : {}),
-        backend: record.backend,
-        sessionId: record.id,
-    };
-}
 function extractToolCallId(request) {
     if (!isRecord(request.raw)) {
         return crypto.randomUUID();
@@ -129,7 +124,7 @@ function extractToolCallId(request) {
         ?? crypto.randomUUID();
 }
 function encodeDecisionReason(decision, note) {
-    return JSON.stringify({
+    return safeJsonStringify({
         decision,
         ...(note?.trim() ? { note: note.trim() } : {}),
     });
@@ -156,34 +151,25 @@ function parseDecisionReason(value) {
         return null;
     }
 }
-function parseRequestAuditContext(value) {
-    if (typeof value !== 'string' || !value.trim()) {
-        return null;
-    }
+async function warnOnly(runtime, task) {
     try {
-        const parsed = JSON.parse(value);
-        if (!isRecord(parsed)) {
-            return null;
-        }
-        const kind = normalizeString(parsed.kind);
-        const message = normalizeString(parsed.message);
-        const sessionId = normalizeString(parsed.sessionId);
-        if (!kind || !message || !sessionId) {
-            return null;
+        await task();
+    }
+    catch (error) {
+        if (runtime.onWarning) {
+            runtime.onWarning(error);
+            return;
         }
-        return {
-            kind: kind,
-            message,
-            sessionId,
-            ...(normalizeString(parsed.backend) ? { backend: normalizeString(parsed.backend) } : {}),
-            ...(normalizeString(parsed.runtime) ? { runtime: normalizeString(parsed.runtime) } : {}),
-            ...(normalizeString(parsed.toolName) ? { toolName: normalizeString(parsed.toolName) } : {}),
-            ...(normalizeString(parsed.command) ? { command: normalizeString(parsed.command) } : {}),
-            ...(normalizeString(parsed.cwd) ? { cwd: normalizeString(parsed.cwd) } : {}),
-        };
+        const message = error instanceof Error ? error.message : String(error);
+        process.emitWarning(`LinX Pod sync failed: ${message}`);
+    }
+}
+function safeJsonStringify(value) {
+    try {
+        return JSON.stringify(value);
     }
     catch {
-        return null;
+        return JSON.stringify({ error: 'unserializable_context' });
     }
 }
 function extractSessionId(sessionUri) {
@@ -206,35 +192,20 @@ function decisionFromApprovalRow(row) {
     }
     return 'accept';
 }
-function requestAuditForApproval(row, approvalUris, audits) {
-    const uriSet = new Set(approvalUris);
-    const matches = audits.filter((audit) => (audit.action === 'approval_requested'
-        && ((audit.approval && uriSet.has(audit.approval))
-            || (audit.session === row.session && audit.toolCallId === row.toolCallId))));
-    matches.sort((left, right) => toIsoString(right.createdAt, '').localeCompare(toIsoString(left.createdAt, '')));
-    return matches[0];
-}
-function normalizeApprovalSummary(row, audits) {
+function normalizeApprovalSummary(row) {
     const createdAt = toIsoString(row.createdAt, new Date(0).toISOString());
-    const approvalUris = [
-        buildApprovalUriForDate(row.session, row.id, new Date(createdAt)),
-        buildApprovalUri(row.session, row.id),
-    ];
-    const requestAudit = requestAuditForApproval(row, approvalUris, audits);
-    const requestContext = parseRequestAuditContext(requestAudit?.context);
     const sessionUri = row.session;
     const decision = decisionFromApprovalRow(row);
     return {
         id: row.id,
+        ...(normalizeString(row.approvalUri) ? { approvalUri: normalizeString(row.approvalUri) } : {}),
         sessionId: extractSessionId(sessionUri),
         sessionUri,
         toolCallId: row.toolCallId,
         toolName: row.toolName,
         risk: normalizeString(row.risk) ?? 'medium',
         status: normalizeString(row.status) ?? 'pending',
-        message: requestContext?.message ?? row.toolName,
-        ...(requestContext?.command ? { command: requestContext.command } : {}),
-        ...(requestContext?.cwd ? { cwd: requestContext.cwd } : {}),
+        message: formatApprovalMessage(row),
         ...(normalizeString(row.assignedTo) ? { assignedTo: normalizeString(row.assignedTo) } : {}),
         ...(normalizeString(row.decisionBy) ? { decisionBy: normalizeString(row.decisionBy) } : {}),
         ...(decision ? { decision } : {}),
@@ -242,6 +213,18 @@ function normalizeApprovalSummary(row, audits) {
         ...(row.resolvedAt ? { resolvedAt: toIsoString(row.resolvedAt, createdAt) } : {}),
     };
 }
+function formatApprovalMessage(row) {
+    if (row.toolName === 'commandExecution') {
+        return 'Command execution approval';
+    }
+    if (row.toolName === 'fileChange') {
+        return 'File change approval';
+    }
+    if (row.toolName === 'permissionRequest') {
+        return 'Permission approval';
+    }
+    return row.toolName;
+}
 function formatSummaryHeadline(summary) {
     return `${summary.id} | ${summary.status} | ${summary.risk} | session=${summary.sessionId}`;
 }
@@ -316,6 +299,7 @@ async function createRemoteApprovalClient(runtime) {
 function createNativeRemoteApprovalStore(webId, fetcher) {
     return {
         listApprovals: () => listApprovalRows(webId, fetcher),
+        findApproval: (id, options) => findApprovalRow(webId, fetcher, id, options),
         insertApproval: (row) => writeApprovalRow(webId, fetcher, row),
         async updateApproval(id, patch) {
             const existing = (await listApprovalRows(webId, fetcher)).find((row) => row.id === id);
@@ -331,6 +315,32 @@ function createNativeRemoteApprovalStore(webId, fetcher) {
         insertInboxNotification: (row) => writeInboxNotificationRow(webId, fetcher, row),
     };
 }
+async function findApprovalRow(webId, fetcher, id, options = {}) {
+    if (options.resourceUri) {
+        return readApprovalRowFromResource(fetcher, options.resourceUri);
+    }
+    if (options.createdAt) {
+        const createdAt = new Date(toIsoString(options.createdAt, new Date().toISOString()));
+        return readApprovalRowFromResource(fetcher, buildApprovalResourceUrl(webId, id, createdAt));
+    }
+    return (await listApprovalRows(webId, fetcher)).find((row) => row.id === id) ?? null;
+}
+async function readApprovalRowFromResource(fetcher, resourceUri) {
+    const turtle = await readTurtleResource(fetcher, documentUrlFromResourceUri(resourceUri));
+    if (!turtle) {
+        return null;
+    }
+    for (const [subject, predicates] of parseManagedTurtleBlocks(turtle, documentUrlFromResourceUri(resourceUri))) {
+        if (subject !== resourceUri) {
+            continue;
+        }
+        const row = approvalRowFromPredicates(subject, predicates);
+        if (row) {
+            return row;
+        }
+    }
+    return null;
+}
 async function listApprovalRows(webId, fetcher) {
     const [currentUrls, legacyUrls] = await Promise.all([
         listTurtleResourcesRecursive(fetcher, `${getPodBaseUrl(webId)}/.data/approvals/`).catch(() => []),
@@ -357,22 +367,22 @@ async function writeApprovalRow(webId, fetcher, row) {
     await upsertManagedTurtleBlock(fetcher, documentUrl, {
         subject: subjectUrl,
         triples: [
-            { predicate: RDF_TYPE, object: iri(UDFS_APPROVAL_REQUEST) },
-            { predicate: UDFS_SESSION, object: iri(row.session) },
-            { predicate: UDFS_TOOL_CALL_ID, object: literal(row.toolCallId) },
-            { predicate: UDFS_TOOL_NAME, object: literal(row.toolName) },
-            { predicate: ODRL_TARGET, object: iri(row.target) },
-            { predicate: ODRL_ACTION, object: iri(row.action) },
-            { predicate: UDFS_RISK, object: literal(row.risk) },
-            { predicate: UDFS_STATUS, object: literal(row.status) },
-            ...(row.assignedTo ? [{ predicate: UDFS_ASSIGNED_TO, object: iri(row.assignedTo) }] : []),
-            ...(row.decisionBy ? [{ predicate: UDFS_DECISION_BY, object: iri(row.decisionBy) }] : []),
-            ...(row.decisionRole ? [{ predicate: UDFS_DECISION_ROLE, object: literal(row.decisionRole) }] : []),
-            ...(row.onBehalfOf ? [{ predicate: UDFS_ON_BEHALF_OF, object: iri(row.onBehalfOf) }] : []),
-            ...(row.reason ? [{ predicate: UDFS_REASON, object: literal(row.reason) }] : []),
-            ...(row.policyVersion ? [{ predicate: UDFS_POLICY_VERSION, object: literal(row.policyVersion) }] : []),
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
-            ...(row.resolvedAt ? [{ predicate: UDFS_RESOLVED_AT, object: literal(toIsoString(row.resolvedAt, new Date().toISOString())) }] : []),
+            { predicate: RDF_TYPE, object: iri(UDFS.ApprovalRequest) },
+            { predicate: ApprovalVocab.session, object: iri(row.session) },
+            { predicate: ApprovalVocab.toolCallId, object: literal(row.toolCallId) },
+            { predicate: ApprovalVocab.toolName, object: literal(row.toolName) },
+            { predicate: ApprovalVocab.target, object: iri(row.target) },
+            { predicate: ApprovalVocab.action, object: iri(row.action) },
+            { predicate: ApprovalVocab.risk, object: literal(row.risk) },
+            { predicate: ApprovalVocab.status, object: literal(row.status) },
+            ...(row.assignedTo ? [{ predicate: ApprovalVocab.assignedTo, object: iri(row.assignedTo) }] : []),
+            ...(row.decisionBy ? [{ predicate: ApprovalVocab.decisionBy, object: iri(row.decisionBy) }] : []),
+            ...(row.decisionRole ? [{ predicate: ApprovalVocab.decisionRole, object: literal(row.decisionRole) }] : []),
+            ...(row.onBehalfOf ? [{ predicate: ApprovalVocab.onBehalfOf, object: iri(row.onBehalfOf) }] : []),
+            ...(row.reason ? [{ predicate: ApprovalVocab.reason, object: literal(row.reason) }] : []),
+            ...(row.policyVersion ? [{ predicate: ApprovalVocab.policyVersion, object: literal(row.policyVersion) }] : []),
+            { predicate: ApprovalVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            ...(row.resolvedAt ? [{ predicate: ApprovalVocab.resolvedAt, object: literal(toIsoString(row.resolvedAt, new Date().toISOString())) }] : []),
         ],
     });
 }
@@ -398,17 +408,18 @@ async function writeAuditRow(webId, fetcher, row) {
     await upsertManagedTurtleBlock(fetcher, documentUrl, {
         subject: subjectUrl,
         triples: [
-            { predicate: RDF_TYPE, object: iri(UDFS_AUDIT_ENTRY) },
-            { predicate: UDFS_ACTION, object: literal(row.action) },
-            { predicate: UDFS_ACTOR, object: iri(row.actor) },
-            { predicate: UDFS_ACTOR_ROLE, object: literal(row.actorRole) },
-            ...(row.onBehalfOf ? [{ predicate: UDFS_ON_BEHALF_OF, object: iri(row.onBehalfOf) }] : []),
-            ...(row.session ? [{ predicate: UDFS_SESSION, object: iri(row.session) }] : []),
-            ...(row.toolCallId ? [{ predicate: UDFS_TOOL_CALL_ID, object: literal(row.toolCallId) }] : []),
-            ...(row.approval ? [{ predicate: 'https://undefineds.co/ns#approval', object: iri(row.approval) }] : []),
-            ...(row.context ? [{ predicate: UDFS_CONTEXT, object: literal(row.context) }] : []),
-            ...(row.policyVersion ? [{ predicate: UDFS_POLICY_VERSION, object: literal(row.policyVersion) }] : []),
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            { predicate: RDF_TYPE, object: iri(UDFS.AuditEntry) },
+            { predicate: AuditVocab.action, object: literal(row.action) },
+            { predicate: AuditVocab.actor, object: iri(row.actor) },
+            { predicate: AuditVocab.actorRole, object: literal(row.actorRole) },
+            ...(row.onBehalfOf ? [{ predicate: AuditVocab.onBehalfOf, object: iri(row.onBehalfOf) }] : []),
+            ...(row.session ? [{ predicate: AuditVocab.session, object: iri(row.session) }] : []),
+            ...(row.entry ? [{ predicate: AuditVocab.entry, object: iri(row.entry) }] : []),
+            ...(row.toolCallId ? [{ predicate: AuditVocab.toolCallId, object: literal(row.toolCallId) }] : []),
+            ...(row.toolName ? [{ predicate: AuditVocab.toolName, object: literal(row.toolName) }] : []),
+            ...(row.approval ? [{ predicate: AuditVocab.approval, object: iri(row.approval) }] : []),
+            ...(row.policyVersion ? [{ predicate: AuditVocab.policyVersion, object: literal(row.policyVersion) }] : []),
+            { predicate: AuditVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
         ],
     });
 }
@@ -445,17 +456,17 @@ async function writeGrantRow(webId, fetcher, row) {
     await upsertManagedTurtleBlock(fetcher, documentUrl, {
         subject: subjectUrl,
         triples: [
-            { predicate: RDF_TYPE, object: iri(ODRL_POLICY) },
-            { predicate: RDF_TYPE, object: iri(UDFS_AUTONOMY_GRANT) },
-            { predicate: ODRL_TARGET, object: iri(target) },
-            { predicate: ODRL_ACTION, object: iri(action) },
-            { predicate: UDFS_EFFECT, object: literal(effect) },
-            ...(normalizeString(row.riskCeiling) ? [{ predicate: UDFS_RISK_CEILING, object: literal(normalizeString(row.riskCeiling)) }] : []),
-            { predicate: UDFS_DECISION_BY, object: iri(decisionBy) },
-            { predicate: UDFS_DECISION_ROLE, object: literal(decisionRole) },
-            ...(normalizeString(row.onBehalfOf) ? [{ predicate: UDFS_ON_BEHALF_OF, object: iri(normalizeString(row.onBehalfOf)) }] : []),
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
-            ...(normalizeString(row.revokedAt) ? [{ predicate: UDFS_REVOKED_AT, object: literal(normalizeString(row.revokedAt)) }] : []),
+            { predicate: RDF_TYPE, object: iri(ODRL.Policy) },
+            { predicate: RDF_TYPE, object: iri(UDFS.AutonomyGrant) },
+            { predicate: GrantVocab.target, object: iri(target) },
+            { predicate: GrantVocab.action, object: iri(action) },
+            { predicate: GrantVocab.effect, object: literal(effect) },
+            ...(normalizeString(row.riskCeiling) ? [{ predicate: GrantVocab.riskCeiling, object: literal(normalizeString(row.riskCeiling)) }] : []),
+            { predicate: GrantVocab.decisionBy, object: iri(decisionBy) },
+            { predicate: GrantVocab.decisionRole, object: literal(decisionRole) },
+            ...(normalizeString(row.onBehalfOf) ? [{ predicate: GrantVocab.onBehalfOf, object: iri(normalizeString(row.onBehalfOf)) }] : []),
+            { predicate: GrantVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            ...(normalizeString(row.revokedAt) ? [{ predicate: GrantVocab.revokedAt, object: literal(normalizeString(row.revokedAt)) }] : []),
         ],
     });
 }
@@ -464,22 +475,22 @@ async function writeInboxNotificationRow(webId, fetcher, row) {
     await upsertManagedTurtleBlock(fetcher, url, {
         subject: url,
         triples: [
-            { predicate: RDF_TYPE, object: iri(AS_ANNOUNCE) },
-            ...(row.actor ? [{ predicate: AS_ACTOR, object: iri(row.actor) }] : []),
-            { predicate: AS_OBJECT, object: iri(row.object) },
-            { predicate: DCT_CREATED, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
+            { predicate: RDF_TYPE, object: iri(AS.Announce) },
+            ...(row.actor ? [{ predicate: InboxNotificationVocab.actor, object: iri(row.actor) }] : []),
+            { predicate: InboxNotificationVocab.object, object: iri(row.object) },
+            { predicate: InboxNotificationVocab.createdAt, object: literal(toIsoString(row.createdAt, new Date().toISOString())) },
         ],
     });
 }
 function approvalRowFromPredicates(url, predicates) {
-    const session = firstIri(predicates, UDFS_SESSION);
-    const toolCallId = firstLiteral(predicates, UDFS_TOOL_CALL_ID);
-    const toolName = firstLiteral(predicates, UDFS_TOOL_NAME);
-    const target = firstIri(predicates, ODRL_TARGET);
-    const action = firstIri(predicates, ODRL_ACTION);
-    const risk = firstLiteral(predicates, UDFS_RISK);
-    const status = firstLiteral(predicates, UDFS_STATUS);
-    const createdAt = firstLiteral(predicates, DCT_CREATED);
+    const session = firstIri(predicates, ApprovalVocab.session);
+    const toolCallId = firstLiteral(predicates, ApprovalVocab.toolCallId);
+    const toolName = firstLiteral(predicates, ApprovalVocab.toolName);
+    const target = firstIri(predicates, ApprovalVocab.target);
+    const action = firstIri(predicates, ApprovalVocab.action);
+    const risk = firstLiteral(predicates, ApprovalVocab.risk);
+    const status = firstLiteral(predicates, ApprovalVocab.status);
+    const createdAt = firstLiteral(predicates, ApprovalVocab.createdAt);
     if (!session || !toolCallId || !toolName || !target || !action || !risk || !status || !createdAt) {
         return null;
     }
@@ -492,21 +503,21 @@ function approvalRowFromPredicates(url, predicates) {
         action,
         risk,
         status,
-        assignedTo: firstIri(predicates, UDFS_ASSIGNED_TO),
-        decisionBy: firstIri(predicates, UDFS_DECISION_BY),
-        decisionRole: firstLiteral(predicates, UDFS_DECISION_ROLE),
-        onBehalfOf: firstIri(predicates, UDFS_ON_BEHALF_OF),
-        reason: firstLiteral(predicates, UDFS_REASON),
-        policyVersion: firstLiteral(predicates, UDFS_POLICY_VERSION),
+        assignedTo: firstIri(predicates, ApprovalVocab.assignedTo),
+        decisionBy: firstIri(predicates, ApprovalVocab.decisionBy),
+        decisionRole: firstLiteral(predicates, ApprovalVocab.decisionRole),
+        onBehalfOf: firstIri(predicates, ApprovalVocab.onBehalfOf),
+        reason: firstLiteral(predicates, ApprovalVocab.reason),
+        policyVersion: firstLiteral(predicates, ApprovalVocab.policyVersion),
         createdAt,
-        resolvedAt: firstLiteral(predicates, UDFS_RESOLVED_AT),
+        resolvedAt: firstLiteral(predicates, ApprovalVocab.resolvedAt),
     };
 }
 function auditRowFromPredicates(url, predicates) {
-    const action = firstLiteral(predicates, UDFS_ACTION);
-    const actor = firstIri(predicates, UDFS_ACTOR);
-    const actorRole = firstLiteral(predicates, UDFS_ACTOR_ROLE);
-    const createdAt = firstLiteral(predicates, DCT_CREATED);
+    const action = firstLiteral(predicates, AuditVocab.action);
+    const actor = firstIri(predicates, AuditVocab.actor);
+    const actorRole = firstLiteral(predicates, AuditVocab.actorRole);
+    const createdAt = firstLiteral(predicates, AuditVocab.createdAt);
     if (!action || !actor || !actorRole || !createdAt) {
         return null;
     }
@@ -515,22 +526,23 @@ function auditRowFromPredicates(url, predicates) {
         action,
         actor,
         actorRole,
-        onBehalfOf: firstIri(predicates, UDFS_ON_BEHALF_OF),
-        session: firstIri(predicates, UDFS_SESSION),
-        toolCallId: firstLiteral(predicates, UDFS_TOOL_CALL_ID),
-        approval: firstIri(predicates, 'https://undefineds.co/ns#approval'),
-        context: firstLiteral(predicates, UDFS_CONTEXT),
-        policyVersion: firstLiteral(predicates, UDFS_POLICY_VERSION),
+        onBehalfOf: firstIri(predicates, AuditVocab.onBehalfOf),
+        session: firstIri(predicates, AuditVocab.session),
+        entry: firstIri(predicates, AuditVocab.entry),
+        toolCallId: firstLiteral(predicates, AuditVocab.toolCallId),
+        toolName: firstLiteral(predicates, AuditVocab.toolName),
+        approval: firstIri(predicates, AuditVocab.approval),
+        policyVersion: firstLiteral(predicates, AuditVocab.policyVersion),
         createdAt,
     };
 }
 function grantRowFromPredicates(url, predicates) {
-    const target = firstIri(predicates, ODRL_TARGET);
-    const action = firstIri(predicates, ODRL_ACTION);
-    const effect = firstLiteral(predicates, UDFS_EFFECT);
-    const decisionBy = firstIri(predicates, UDFS_DECISION_BY);
-    const decisionRole = firstLiteral(predicates, UDFS_DECISION_ROLE);
-    const createdAt = firstLiteral(predicates, DCT_CREATED);
+    const target = firstIri(predicates, GrantVocab.target);
+    const action = firstIri(predicates, GrantVocab.action);
+    const effect = firstLiteral(predicates, GrantVocab.effect);
+    const decisionBy = firstIri(predicates, GrantVocab.decisionBy);
+    const decisionRole = firstLiteral(predicates, GrantVocab.decisionRole);
+    const createdAt = firstLiteral(predicates, GrantVocab.createdAt);
     if (!target || !action || !effect || !decisionBy || !decisionRole || !createdAt) {
         return null;
     }
@@ -539,12 +551,12 @@ function grantRowFromPredicates(url, predicates) {
         target,
         action,
         effect,
-        riskCeiling: firstLiteral(predicates, UDFS_RISK_CEILING),
+        riskCeiling: firstLiteral(predicates, GrantVocab.riskCeiling),
         decisionBy,
         decisionRole,
-        onBehalfOf: firstIri(predicates, UDFS_ON_BEHALF_OF),
+        onBehalfOf: firstIri(predicates, GrantVocab.onBehalfOf),
         createdAt,
-        revokedAt: firstLiteral(predicates, UDFS_REVOKED_AT),
+        revokedAt: firstLiteral(predicates, GrantVocab.revokedAt),
     };
 }
 export async function createRemoteWatchApproval(options) {
@@ -564,7 +576,7 @@ export async function createRemoteWatchApproval(options) {
             risk: buildRisk(options.request),
             ...(options.request.kind === 'command-approval' && options.request.command ? { command: options.request.command } : {}),
             ...(options.request.kind === 'command-approval' && options.request.cwd ? { cwd: options.request.cwd } : {}),
-            context: buildRequestAuditContext(options.record, options.request),
+            entry: sessionUri,
         }),
         runtime: activeRuntime,
     });
@@ -586,14 +598,7 @@ export async function createRemoteApproval(options) {
         const assignedTo = subject.assignedTo ?? webId;
         const onBehalfOf = subject.onBehalfOf ?? webId;
         const policyVersion = subject.policyVersion ?? REMOTE_APPROVAL_POLICY_VERSION;
-        const requestContext = request.context ?? {
-            kind: request.kind,
-            message: request.message,
-            sessionId: extractSessionId(sessionUri),
-            toolName: request.toolName,
-            ...(request.command ? { command: request.command } : {}),
-            ...(request.cwd ? { cwd: request.cwd } : {}),
-        };
+        const requestEntry = request.entry ?? approvalUri;
         await store.insertApproval({
             id: approvalId,
             session: sessionUri,
@@ -607,27 +612,30 @@ export async function createRemoteApproval(options) {
             policyVersion,
             createdAt: now,
         });
-        await store.insertAudit({
+        const requestAudit = {
             id: crypto.randomUUID(),
             action: 'approval_requested',
             actor: subject.actorUri,
             actorRole: 'secretary',
             onBehalfOf,
             session: sessionUri,
+            entry: requestEntry,
             toolCallId: request.toolCallId,
+            toolName: request.toolName,
             approval: approvalUri,
-            context: JSON.stringify(requestContext),
             policyVersion,
             createdAt: now,
-        });
-        await store.insertInboxNotification({
+        };
+        await warnOnly(activeRuntime, () => store.insertAudit(requestAudit));
+        await warnOnly(activeRuntime, () => store.insertInboxNotification({
             id: crypto.randomUUID(),
             actor: subject.actorUri,
             object: approvalUri,
             createdAt: now,
-        }).catch(() => undefined);
+        }));
         return normalizeApprovalSummary({
             id: approvalId,
+            approvalUri,
             session: sessionUri,
             toolCallId: request.toolCallId,
             toolName: request.toolName,
@@ -638,19 +646,7 @@ export async function createRemoteApproval(options) {
             assignedTo,
             policyVersion,
             createdAt: now,
-        }, [{
-                id: crypto.randomUUID(),
-                action: 'approval_requested',
-                actor: subject.actorUri,
-                actorRole: 'secretary',
-                onBehalfOf,
-                session: sessionUri,
-                toolCallId: request.toolCallId,
-                approval: approvalUri,
-                context: JSON.stringify(requestContext),
-                policyVersion,
-                createdAt: now,
-            }]);
+        });
     });
 }
 export async function waitForRemoteWatchApproval(options) {
@@ -660,10 +656,13 @@ export async function waitForRemoteWatchApproval(options) {
             if (options.signal?.aborted) {
                 throw createAbortError();
             }
-            const approvals = await store.listApprovals();
-            const row = approvals.find((entry) => entry.id === options.approvalId);
+            const row = await readRemoteApprovalRow(store, {
+                approvalId: options.approvalId,
+                approvalUri: options.approvalUri,
+            });
             if (!row) {
-                throw new Error(`Remote approval disappeared before resolution: ${options.approvalId}`);
+                await activeRuntime.sleep(options.pollMs ?? DEFAULT_REMOTE_APPROVAL_POLL_MS);
+                continue;
             }
             const decision = decisionFromApprovalRow(row);
             if (decision) {
@@ -696,6 +695,7 @@ export async function requestRemoteWatchApproval(options) {
     });
     return waitForRemoteWatchApproval({
         approvalId: summary.id,
+        approvalUri: summary.approvalUri,
         pollMs: options.pollMs,
         signal: options.signal,
         runtime: activeRuntime,
@@ -728,6 +728,7 @@ export async function requestRemoteApproval(options) {
     });
     return waitForRemoteWatchApproval({
         approvalId: summary.id,
+        approvalUri: summary.approvalUri,
         pollMs: options.pollMs,
         signal: options.signal,
         runtime: activeRuntime,
@@ -737,12 +738,9 @@ export async function listRemoteWatchApprovals(options = {}) {
     const activeRuntime = options.runtime ?? await createDefaultRuntime();
     const requestedStatus = options.status ?? 'pending';
     return withRemoteApprovalStore(activeRuntime, async ({ store, webId }) => {
-        const [approvals, audits] = await Promise.all([
-            store.listApprovals(),
-            store.listAudits(),
-        ]);
+        const approvals = await store.listApprovals();
         return approvals
-            .map((row) => normalizeApprovalSummary(row, audits))
+            .map((row) => normalizeApprovalSummary(row))
             .filter((summary) => !summary.assignedTo || summary.assignedTo === webId)
             .filter((summary) => requestedStatus === 'all' || summary.status === requestedStatus)
             .sort((left, right) => right.createdAt.localeCompare(left.createdAt));
@@ -751,14 +749,15 @@ export async function listRemoteWatchApprovals(options = {}) {
 export async function resolveRemoteWatchApproval(options) {
     const activeRuntime = options.runtime ?? await createDefaultRuntime();
     return withRemoteApprovalStore(activeRuntime, async ({ store, webId }) => {
-        const approvals = await store.listApprovals();
-        const row = approvals.find((entry) => entry.id === options.approvalId);
+        const row = await readRemoteApprovalRow(store, {
+            approvalId: options.approvalId,
+            approvalUri: options.approvalUri,
+        });
         if (!row) {
             throw new Error(`Remote approval not found: ${options.approvalId}`);
         }
         if (row.status !== 'pending') {
-            const audits = await store.listAudits();
-            return normalizeApprovalSummary(row, audits);
+            return normalizeApprovalSummary(row);
         }
         const now = activeRuntime.now();
         const approvalCreatedAt = new Date(toIsoString(row.createdAt, now.toISOString()));
@@ -774,22 +773,20 @@ export async function resolveRemoteWatchApproval(options) {
             reason: encodeDecisionReason(options.decision, options.note),
             resolvedAt: now,
         });
-        await store.insertAudit({
+        await warnOnly(activeRuntime, () => store.insertAudit({
             id: crypto.randomUUID(),
             action: nextStatus === 'approved' ? 'approval_approved' : 'approval_rejected',
             actor: webId,
             actorRole: 'human',
             onBehalfOf: webId,
             session: row.session,
+            entry: approvalUri,
             toolCallId: row.toolCallId,
+            toolName: row.toolName,
             approval: approvalUri,
-            context: JSON.stringify({
-                decision: options.decision,
-                ...(options.note?.trim() ? { note: options.note.trim() } : {}),
-            }),
             policyVersion: REMOTE_APPROVAL_POLICY_VERSION,
             createdAt: now,
-        });
+        }));
         if (options.decision === 'accept_for_session') {
             const grantId = crypto.randomUUID();
             await store.insertGrant({
@@ -803,19 +800,19 @@ export async function resolveRemoteWatchApproval(options) {
                 onBehalfOf: webId,
                 createdAt: now,
             });
-            await store.insertInboxNotification({
+            await warnOnly(activeRuntime, () => store.insertInboxNotification({
                 id: crypto.randomUUID(),
                 actor: webId,
                 object: buildGrantUri(row.session, grantId),
                 createdAt: now,
-            }).catch(() => undefined);
+            }));
         }
-        await store.insertInboxNotification({
+        await warnOnly(activeRuntime, () => store.insertInboxNotification({
             id: crypto.randomUUID(),
             actor: webId,
             object: approvalUri,
             createdAt: now,
-        }).catch(() => undefined);
+        }));
         const nextRow = {
             ...row,
             status: nextStatus,
@@ -825,15 +822,25 @@ export async function resolveRemoteWatchApproval(options) {
             reason: encodeDecisionReason(options.decision, options.note),
             resolvedAt: now,
         };
-        const audits = await store.listAudits();
-        return normalizeApprovalSummary(nextRow, audits);
+        return normalizeApprovalSummary(nextRow);
     });
 }
+async function readRemoteApprovalRow(store, options) {
+    if (store.findApproval) {
+        const row = await store.findApproval(options.approvalId, {
+            resourceUri: options.approvalUri,
+        });
+        if (row || options.approvalUri) {
+            return row;
+        }
+    }
+    const approvals = await store.listApprovals();
+    return approvals.find((entry) => entry.id === options.approvalId) ?? null;
+}
 export const __podApprovalInternal = {
     createAbortError,
     createDefaultRuntime,
     buildActionUri,
-    buildRequestAuditContext,
     buildRisk,
     buildToolName,
     createNativeRemoteApprovalStore,
@@ -841,9 +848,9 @@ export const __podApprovalInternal = {
     decisionFromApprovalRow,
     encodeDecisionReason,
     formatSummaryHeadline,
+    readRemoteApprovalRow,
     isRemoteApprovalAbortError,
     normalizeApprovalSummary,
     parseDecisionReason,
-    parseRequestAuditContext,
 };
 //# sourceMappingURL=pod-approval.js.map