permdock 0.3.1 → 0.5.0

package/dist/cloud/index.js

@@ -1,404 +1,297 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { T as isForbiddenKey } from "../permissions-DVoF6dMt.js";
-import { i as parsePolicyDocument } from "../hosted-DJQw46hn.js";
-import { t as CLOUD_EVENT_TYPES } from "../sink-Bd9PSyfq.js";
-import { r as isApprovalErrorCode, t as ApprovalError } from "../errors-DRnGZHzF.js";
-import { t as joseTokenVerifier } from "../verifier-BxBo6I44.js";
-import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-//#region src/cloud/create.ts
-/** Milliseconds a PermDock Cloud request may take; a slower one fails like an unreachable Cloud. */
-const CLOUD_TIMEOUT_MS = 1e4;
-function readEnv(name) {
-	const value = globalThis.process?.env?.[name];
-	return typeof value === "string" ? value : "";
-}
-function firstNonEmpty(...values) {
-	for (const value of values) if (value !== void 0 && value !== "") return value;
-	return "";
-}
-function trimSlash(value) {
-	return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function asApproval(value) {
-	if (!isRecord$1(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
-	return value;
-}
-function isCompactJws$1(value) {
-	return !value.startsWith("{") && value.split(".").length === 3;
+import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
+import { r as CLOUD_EVENT_TYPES } from "../sink-BEZSlMS_.js";
+import { i as parseCloudEventBatch, r as parseCloudEvent$1 } from "../catalog-fingerprint-CCP0-yQS.js";
+import { c as problemResponse } from "../problem-CTviyH5L.js";
+import { n as webhookVerifier } from "../standard-webhooks-DgFFD-Ga.js";
+import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
+import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { i as isCompactJws, n as cloudConnection, r as cloudEndpoints, t as cloud } from "../create-BWRSXgOF.js";
+//#region src/cloud/delivery.ts
+function failed(cause, retryable, reason) {
+	return {
+		status: "failed",
+		cause,
+		retryable,
+		reason
+	};
 }
-/** The refusal PermDock Cloud names in its body, else the one its status implies. */
-async function approvalErrorFrom(response) {
-	let body;
-	try {
-		body = await response.json();
-	} catch {
-		return approvalErrorFromStatus(response.status);
+async function fromResponse(response) {
+	const { status } = response;
+	if (status >= 200 && status < 300) {
+		let body;
+		try {
+			body = await response.json();
+		} catch {
+			body = void 0;
+		}
+		const id = isRecord(body) ? body["id"] : void 0;
+		return typeof id === "string" && id !== "" ? {
+			status: "sent",
+			providerId: id
+		} : { status: "sent" };
 	}
-	if (body === null || typeof body !== "object" || !("code" in body)) return approvalErrorFromStatus(response.status);
-	const code = body.code;
-	if (!isApprovalErrorCode(code)) return approvalErrorFromStatus(response.status);
-	const detail = "detail" in body ? body.detail : void 0;
-	return new ApprovalError(code, typeof detail === "string" && detail.length > 0 ? detail : code);
-}
-function approvalErrorFromStatus(status) {
-	if (status === 409) return new ApprovalError("approval-not-pending", "approval is not pending");
-	if (status === 410) return new ApprovalError("approval-expired", "approval has expired");
-	return new ApprovalError("approval-not-found", "approval was not found");
+	const reason = `HTTP ${String(status)}`;
+	if (status === 429) return failed("rate-limited", true, reason);
+	if (status === 408 || status === 409 || status >= 500) return failed("unavailable", true, reason);
+	if (status === 401 || status === 403) return failed("unauthorized", false, reason);
+	if (status === 400 || status === 422) return failed("invalid-message", false, reason);
+	return failed("rejected", false, reason);
 }
 /**
-* The environment URL and JWK Set URL `cloud()` uses, resolved with the same
-* fallbacks (`PERMDOCK_CLOUD_URL`; `PERMDOCK_CLOUD_ENV`, `VERCEL_ENV`, `production`).
+* A `DeliveryTransport` for `channel` that hands each checked recipient to
+* PermDock Cloud, which sends it from its hosted email, chat or webhook
+* sender and reports back through `com.permdock.delivery.*` events. The
+* router has already decided the recipient: the Cloud receives the target
+* and the permission that let it through, never a decision to make.
+* `Idempotency-Key` is the delivery's idempotency key, so a retry repeats it.
 */
-function cloudEndpoints(options = {}) {
-	const url = trimSlash(firstNonEmpty(options.url, readEnv("PERMDOCK_CLOUD_URL")));
-	if (url === "") throw new Error("PermDock: cloud() requires url and key.");
-	const environment = firstNonEmpty(options.environment, readEnv("PERMDOCK_CLOUD_ENV"), readEnv("VERCEL_ENV"), "production");
-	const issuer = `${url}/v1/environments/${encodeURIComponent(environment)}`;
+function cloudDeliveryTransport(channel, options = {}) {
+	const connection = cloudConnection(options);
 	return Object.freeze({
-		issuer,
-		jwks: `${issuer}/.well-known/jwks.json`
-	});
-}
-function cloud(options = {}) {
-	const key = firstNonEmpty(options.key, readEnv("PERMDOCK_CLOUD_KEY"));
-	if (key === "") throw new Error("PermDock: cloud() requires url and key.");
-	const { issuer: root, jwks } = cloudEndpoints(options);
-	const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
-	const flushAt = options.flushAt ?? 32;
-	const waitUntil = options.waitUntil;
-	const headers = () => {
-		const next = new Headers();
-		next.set("authorization", `Bearer ${key}`);
-		next.set("content-type", "application/json");
-		return next;
-	};
-	const request = (path, init = {}, accept) => {
-		const next = headers();
-		if (accept !== void 0) next.set("accept", accept);
-		return fetchFn(`${root}${path}`, {
-			...init,
-			headers: next,
-			signal: timeoutSignal(CLOUD_TIMEOUT_MS, init.signal)
-		});
-	};
-	const approvals = {
-		async create(record) {
-			if (!(await request("/approvals", {
-				method: "POST",
-				body: JSON.stringify(record)
-			})).ok) throw new Error("PermDock Cloud rejected the approval create");
-		},
-		async get(token) {
-			try {
-				const response = await request(`/approvals/${encodeURIComponent(token)}`);
-				if (!response.ok) return null;
-				return asApproval(await response.json());
-			} catch {
-				return null;
-			}
-		},
-		async resolve(token, verdict) {
-			const response = await request(`/approvals/${encodeURIComponent(token)}/resolve`, {
-				method: "POST",
-				body: JSON.stringify(verdict)
-			});
-			if (!response.ok) throw await approvalErrorFrom(response);
-			const parsed = asApproval(await response.json());
-			if (parsed === null) throw new ApprovalError("approval-not-found", "PermDock Cloud returned an unknown approval shape");
-			return parsed;
-		},
-		async consume(token, now) {
+		channel,
+		name: "permdock-cloud",
+		async deliver(target, message, transportOptions) {
+			if (!isDeliveryTarget(target, channel)) return {
+				status: "failed",
+				cause: "invalid-recipient",
+				retryable: false
+			};
+			let body;
 			try {
-				const response = await request(`/approvals/${encodeURIComponent(token)}/consume`, {
-					method: "POST",
-					body: JSON.stringify(compact({ now: now === void 0 ? void 0 : now.toISOString() }))
+				body = JSON.stringify({
+					channel,
+					delivery: transportOptions.delivery,
+					target: compact({
+						address: target.address,
+						principal: target.principal,
+						provider: target.provider,
+						workspace: target.workspace,
+						trusted: target.trusted,
+						permission: target.decision.matched.permission
+					}),
+					message
 				});
-				if (!response.ok) return null;
-				return asApproval(await response.json());
 			} catch {
-				return null;
+				return {
+					status: "failed",
+					cause: "invalid-message",
+					retryable: false
+				};
 			}
-		},
-		async list(query) {
-			const params = new URLSearchParams(compact({
-				status: query.status,
-				principalId: query.principalId,
-				actorId: query.actorId,
-				tenant: query.tenant,
-				session: query.session,
-				limit: query.limit === void 0 ? void 0 : String(query.limit),
-				cursor: query.cursor
-			}));
-			const suffix = params.size === 0 ? "" : `?${params.toString()}`;
 			try {
-				const response = await request(`/approvals${suffix}`);
-				if (!response.ok) return { items: [] };
-				const body = await response.json();
-				if (!isRecord$1(body) || !Array.isArray(body["items"])) return { items: [] };
-				const items = body["items"].flatMap((item) => {
-					const parsed = asApproval(item);
-					return parsed === null ? [] : [parsed];
-				});
-				return typeof body["next"] === "string" && body["next"] !== "" ? {
-					items,
-					next: body["next"]
-				} : { items };
+				return await fromResponse(await connection.request("/deliveries", {
+					method: "POST",
+					headers: { "idempotency-key": transportOptions.idempotencyKey },
+					body
+				}));
 			} catch {
-				return { items: [] };
+				return failed("unavailable", true, "request failed");
 			}
-		},
-		async cancel(filter, meta) {
-			const response = await request("/approvals/cancel", {
+		}
+	});
+}
+//#endregion
+//#region src/cloud/signer.ts
+const REGISTERED = /* @__PURE__ */ new Set([
+	"iss",
+	"aud",
+	"exp",
+	"iat",
+	"nbf",
+	"jti"
+]);
+/**
+* The Cloud's own outputs and access tokens; a client key that could mint
+* them could forge them, or forge the approver behind `PermDock-Approver`.
+*/
+const CLOUD_ISSUED = /* @__PURE__ */ new Set([
+	"vnd.permdock.policy+jwt",
+	"vnd.permdock.snapshot+jwt",
+	"vnd.permdock.evidence+jwt",
+	"at+jwt",
+	"secevent+jwt"
+]);
+function headerTyp(token) {
+	const [encoded = ""] = token.split(".");
+	try {
+		const text = atob(encoded.replaceAll("-", "+").replaceAll("_", "/"));
+		const header = JSON.parse(text);
+		return isRecord(header) ? header["typ"] : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* A `TokenSigner` backed by the environment's PermDock Cloud keys, typically
+* KMS-held, for run tickets (`vnd.permdock.run+jwt`) and every other signed
+* output an app issues. The Cloud signs only what the app sends: it sets
+* `iss` to the environment URL and adds no claim. Policy documents,
+* snapshots, evidence exports, Security Event Tokens and `at+jwt` access tokens are the Cloud's own
+* outputs, so their `typ` values are refused here. Verify what it signs with
+* `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
+*/
+function cloudSigner(options = {}) {
+	const connection = cloudConnection(options);
+	return Object.freeze({
+		async sign(payload, signOptions) {
+			if (CLOUD_ISSUED.has(signOptions.typ)) throw new Error(`PermDock: cloudSigner never signs ${signOptions.typ}; the Cloud issues its own.`);
+			const audience = signOptions.audience ?? options.audience;
+			if (audience === void 0 || audience.length === 0) throw new Error("PermDock: cloudSigner requires an audience.");
+			const claims = Object.fromEntries(Object.entries(payload).filter(([name]) => !REGISTERED.has(name)));
+			const response = await connection.request("/sign", {
 				method: "POST",
 				body: JSON.stringify(compact({
-					filter,
-					by: meta.by,
-					note: meta.note
+					typ: signOptions.typ,
+					claims,
+					aud: audience,
+					exp: signOptions.expiresAt,
+					iat: signOptions.issuedAt,
+					jti: signOptions.jti
 				}))
-			});
-			if (!response.ok) throw new Error("PermDock Cloud rejected the approval cancel");
-			const body = await response.json();
-			if (!isRecord$1(body) || typeof body["cancelled"] !== "number") throw new Error("PermDock Cloud returned an unknown cancel shape");
-			return body["cancelled"];
+			}, "application/jwt");
+			if (!response.ok) throw new Error(`PermDock Cloud refused to sign: HTTP ${String(response.status)}`);
+			const token = (await response.text()).trim();
+			if (!isCompactJws(token) || headerTyp(token) !== signOptions.typ) throw new Error(`PermDock Cloud returned a token that is not a ${signOptions.typ} JWS`);
+			return token;
 		},
-		async expire(now) {
+		async jwks() {
 			try {
-				const response = await request("/approvals/expire", {
-					method: "POST",
-					body: JSON.stringify(compact({ now: now === void 0 ? void 0 : now.toISOString() }))
-				});
-				if (!response.ok) return 0;
-				const body = await response.json();
-				if (!isRecord$1(body) || typeof body["expired"] !== "number") return 0;
-				return body["expired"];
+				const response = await connection.request("/.well-known/jwks.json", {}, "application/jwk-set+json");
+				const body = response.ok ? await response.json() : void 0;
+				return { keys: (isRecord(body) && Array.isArray(body["keys"]) ? body["keys"] : []).filter(isRecord) };
 			} catch {
-				return 0;
+				return { keys: [] };
 			}
 		}
-	};
-	const capacity = options.capacity ?? 1e4;
-	const pending = [];
-	const bound = () => {
-		if (pending.length > capacity) pending.splice(0, pending.length - capacity);
-	};
-	const flush = async () => {
-		if (pending.length === 0) return;
-		const events = pending.splice(0);
-		try {
-			if (!(await request("/decisions", {
-				method: "POST",
-				body: JSON.stringify({ events })
-			})).ok) pending.unshift(...events);
-		} catch {
-			pending.unshift(...events);
-		}
-		bound();
-	};
-	const sink = {
-		write(events) {
-			pending.push(...events);
-			bound();
-			if (pending.length >= flushAt) return flush();
-			if (waitUntil !== void 0 && pending.length > 0) waitUntil(flush());
-		},
-		flush
-	};
-	const snapshots = { async get() {
-		const response = await request("/snapshot", {}, "application/jwt");
-		if (!response.ok) throw new Error("PermDock Cloud snapshot request failed");
-		const text = (await response.text()).trim();
-		if (!isCompactJws$1(text)) throw new Error("PermDock Cloud served an unsigned snapshot");
-		return text;
-	} };
-	let document = null;
-	return freezeDeep({
-		approvals,
-		sink,
-		snapshots,
-		policies: {
-			current() {
-				return document;
-			},
-			async refresh() {
-				const verifier = options.verifier;
-				if (verifier === void 0) return;
-				let response;
-				try {
-					response = await request("/policy");
-				} catch {
-					return;
-				}
-				if (response.status === 404) {
-					document = null;
-					return;
-				}
-				if (!response.ok) return;
-				const token = (await response.text()).trim();
-				if (!isCompactJws$1(token)) return;
-				const verified = await verifier.verify(token, {
-					typ: "permdock-policy+jwt",
-					issuer: root,
-					audience: root
-				});
-				if (!verified.ok) return;
-				let next;
-				try {
-					next = parsePolicyDocument(verified.claims["policy"]);
-				} catch {
-					return;
-				}
-				document = next;
-			}
-		},
-		issuer: root,
-		jwks
 	});
 }
 //#endregion
 //#region src/cloud/webhook.ts
-const TYPES = new Set(Object.values(CLOUD_EVENT_TYPES));
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function hasUnsafeKey(value) {
-	if (Array.isArray(value)) return value.some(hasUnsafeKey);
-	if (!isRecord(value)) return false;
-	return Object.keys(value).some((key) => isForbiddenKey(key) || hasUnsafeKey(value[key]));
-}
-const FINDING_CODES = /* @__PURE__ */ new Set([
-	"permission-removed",
-	"not-hostable",
-	"grantee-removed",
-	"approval-tightened"
-]);
-function isFinding(value) {
-	return isRecord(value) && FINDING_CODES.has(value["code"]) && typeof value["permission"] === "string" && (value["grant"] === void 0 || typeof value["grant"] === "string");
-}
-function validData(type, data) {
-	switch (type) {
-		case "dev.permdock.decision": return data["type"] === "decision" && typeof data["permission"] === "string";
-		case "dev.permdock.approval": return data["type"] === "decision" && (data["phase"] === "requested" || data["phase"] === "resolved");
-		case "dev.permdock.directory": return data["type"] === "directory" && typeof data["tenant"] === "string";
-		case "dev.permdock.membership": return data["type"] === "membership" && isRecord(data["principal"]);
-		case "dev.permdock.credential": return data["type"] === "credential" && isRecord(data["credential"]) && typeof data["credential"]["id"] === "string" && (data["credential"]["kind"] === "user" || data["credential"]["kind"] === "service") && isRecord(data["principal"]) && (data["operation"] === "created" || data["operation"] === "used" || data["operation"] === "rotated" || data["operation"] === "revoked");
-		case "dev.permdock.catalog": return (data["kind"] === "publish" || data["kind"] === "drift") && typeof data["fingerprint"] === "string" && (data["previous"] === void 0 || typeof data["previous"] === "string") && (data["findings"] === void 0 || Array.isArray(data["findings"]) && data["findings"].every(isFinding));
-		case "dev.permdock.access.started":
-		case "dev.permdock.access.ended":
-		case "dev.permdock.access.revoked": return data["type"] === "access" && typeof data["tenant"] === "string" && isRecord(data["principal"]) && typeof data["principal"]["id"] === "string";
-		default: return type;
-	}
-}
 /**
-* Validates one CloudEvent against the closed type list and its data shape;
-* returns `null` for anything else, never throws.
+* Validates one CloudEvent against the closed type list, its `dataschema` and
+* its data shape; returns `null` for anything else, never throws.
 */
 function parseCloudEvent(value) {
-	if (!isRecord(value) || hasUnsafeKey(value) || value["specversion"] !== "1.0" || typeof value["type"] !== "string" || !TYPES.has(value["type"]) || typeof value["source"] !== "string" || typeof value["id"] !== "string" || typeof value["time"] !== "string" || value["subject"] !== void 0 && typeof value["subject"] !== "string" || !isRecord(value["data"]) || !validData(value["type"], value["data"])) return null;
-	return freezeDeep(JSON.parse(JSON.stringify(value)));
+	return parseCloudEvent$1(value);
 }
 function verifierFor(options) {
 	if (options.verifier !== void 0) return options.verifier;
-	if (options.jwks === void 0) return;
+	if (options.replay === void 0 || options.jwks === void 0 && options.secret === void 0) return;
 	try {
-		return joseTokenVerifier({
-			jwks: typeof options.jwks === "string" ? new URL(options.jwks) : options.jwks,
-			algorithms: ["Ed25519", "ES256"]
-		});
+		return webhookVerifier(compact({
+			jwks: options.jwks,
+			secret: options.secret,
+			replay: options.replay,
+			tolerance: options.tolerance,
+			now: options.now,
+			fetch: options.fetch
+		}));
 	} catch {
 		return;
 	}
 }
-function isCompactJws(value) {
-	return /^[\w-]+\.[\w-]+\.[\w-]+$/u.test(value);
+function eventsOf(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return null;
+	}
+	if (!Array.isArray(parsed)) {
+		const single = parseCloudEvent(parsed);
+		return single === null ? null : [single];
+	}
+	return parseCloudEventBatch(parsed);
 }
 /**
-* Verifies a PermDock Cloud webhook delivery: a compact JWS with
-* `typ: permdock-decisions+jwt` whose `events` claim holds CloudEvents.
-* There is no unsigned mode, and it never throws.
+* Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over
+* an `application/cloudevents-batch+json` body (or one
+* `application/cloudevents+json` event). There is no unsigned mode, and it
+* never throws.
 */
 async function verifyWebhook(request, options) {
-	let body;
-	try {
-		body = (await request.text()).trim();
-	} catch {
-		return {
-			ok: false,
-			reason: "unsigned"
-		};
-	}
-	if (!isCompactJws(body)) return {
-		ok: false,
-		reason: "unsigned"
-	};
 	const verifier = verifierFor(options);
 	if (verifier === void 0) return {
 		ok: false,
-		reason: "invalid-token",
-		cause: "jwks-unavailable"
+		cause: "keys-unavailable"
 	};
-	let verified;
-	try {
-		verified = await verifier.verify(body, {
-			typ: "permdock-decisions+jwt",
-			audience: options.audience
-		});
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid-token",
-			cause: "malformed"
-		};
-	}
+	const verified = await verifier.verify(request);
 	if (!verified.ok) return {
 		ok: false,
-		reason: "invalid-token",
 		cause: verified.cause
 	};
-	const jti = verified.claims["jti"];
-	const raw = verified.claims["events"];
-	if (typeof jti !== "string" || !Array.isArray(raw)) return {
+	const events = eventsOf(verified.body);
+	if (events === null) return {
 		ok: false,
-		reason: "invalid-events"
+		cause: "invalid-events"
 	};
-	const events = [];
-	for (const item of raw) {
-		const parsed = parseCloudEvent(item);
-		if (parsed === null) return {
-			ok: false,
-			reason: "invalid-events"
-		};
-		events.push(parsed);
-	}
-	if (options.replay !== void 0) {
-		const key = `permdock-webhook:${jti}`;
-		const expiresAt = typeof verified.claims.exp === "number" ? verified.claims.exp : void 0;
-		try {
-			if (options.replay.claim === void 0) {
-				if (await options.replay.seen(key)) return {
-					ok: false,
-					reason: "replayed"
-				};
-				await options.replay.remember(key, expiresAt);
-			} else if (!await options.replay.claim(key, expiresAt)) return {
-				ok: false,
-				reason: "replayed"
-			};
-		} catch {
-			return {
-				ok: false,
-				reason: "replayed"
-			};
-		}
-	}
 	return freezeDeep({
 		ok: true,
-		id: jti,
+		id: verified.id,
+		timestamp: verified.timestamp,
 		events
 	});
 }
 //#endregion
-export { cloud, cloudEndpoints, parseCloudEvent, verifyWebhook };
+//#region src/cloud/waiter.ts
+/** Polling the store is the fallback for a webhook this process never receives. */
+const FALLBACK_INTERVAL = 6e4;
+const WAKING = /* @__PURE__ */ new Set([
+	CLOUD_EVENT_TYPES.approvalResolved,
+	CLOUD_EVENT_TYPES.approvalExpired,
+	CLOUD_EVENT_TYPES.approvalCancelled
+]);
+/** The approval token of each event that ends a wait, in delivery order. */
+function approvalTokensOf(events) {
+	return events.flatMap((event) => {
+		if (!WAKING.has(event.type)) return [];
+		const { data } = event;
+		return "token" in data && typeof data.token === "string" && data.token !== "" ? [data.token] : [];
+	});
+}
+function refusal(cause) {
+	switch (cause) {
+		case "keys-unavailable": return problemResponse(statusProblem(503, "the webhook signing keys are unavailable"));
+		case "invalid-events": return problemResponse(statusProblem(400, "the body is not a PermDock CloudEvents batch"));
+		case "missing-headers":
+		case "malformed":
+		case "timestamp-out-of-range": return problemResponse(statusProblem(400, `webhook verification failed: ${cause}`));
+		case "invalid-signature": return problemResponse(statusProblem(403, `webhook verification failed: ${cause}`));
+		case "replayed": return new Response(null, { status: 204 });
+		default: return cause;
+	}
+}
+/**
+* An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the
+* route the environment's webhook connector posts to: when an approval is
+* resolved, expires or is cancelled, the parked run for its token wakes.
+* Waking never approves anything. The run decides again with the token, and
+* only the app's `decide` and its approval store can grant. Without
+* `waiter`, waits poll `store` as a fallback for a webhook another process
+* received.
+*/
+function cloudApprovalWaiter(options) {
+	const inner = options.waiter ?? pollingApprovalWaiter({
+		store: options.store,
+		interval: options.interval ?? FALLBACK_INTERVAL
+	});
+	const wake = async (token) => {
+		try {
+			await inner.wake(token);
+		} catch {}
+	};
+	return Object.freeze({
+		wait: inner.wait.bind(inner),
+		wake,
+		async webhook(request) {
+			const verified = await verifyWebhook(request, options);
+			if (!verified.ok) return refusal(verified.cause);
+			await Promise.all(approvalTokensOf(verified.events).map(wake));
+			return new Response(null, { status: 204 });
+		}
+	});
+}
+//#endregion
+export { approvalTokensOf, cloud, cloudApprovalWaiter, cloudDeliveryTransport, cloudEndpoints, cloudSigner, parseCloudEvent, verifyWebhook };