permdock 0.3.1 → 0.5.0

package/dist/ai-sdk/index.d.ts

@@ -1,28 +1,14 @@
-import { C as Policy, Nr as Principal, kr as Delegation } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { t as ToolMap } from "../types-Bvc4oWT6.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D8jDHgsl.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BDS7wc3y.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {
   readonly runtimeContext?: unknown;
   readonly permdockApproval?: string;
   readonly [key: string]: unknown;
 };
-type AiSdkPermDockOptions<TUser = unknown> = InstanceOptions & {
-  readonly subject: (context: AiSdkContext) => TUser | Promise<TUser>;
-  readonly actor?: (context: AiSdkContext) => unknown;
-  readonly delegation?: (context: AiSdkContext) => Delegation | undefined | Promise<Delegation | undefined>;
-  readonly tenant?: string | ((context: AiSdkContext) => string | undefined | Promise<string | undefined>);
-  readonly tools: ToolMap;
-  readonly store?: ApprovalStore;
-  /**
-   * Tools the `tools` map does not bind to a permission. `'deny'` (default):
-   * the middleware hides them and `toolApproval` denies them. `'allow'`: they
-   * pass through both, to the application's own `toolApproval`.
-   */
-  readonly unmapped?: "deny" | "allow";
-};
+type AiSdkPermDockOptions<TUser = unknown> = AgentAdapterOptions<AiSdkContext, TUser>;
 /** What an AI SDK tool approval function may return; `undefined` is `not-applicable`. */
 type ToolApprovalResult = ToolApprovalStatus | undefined | "not-applicable" | "denied" | "user-approval" | {
   readonly type: "not-applicable";
@@ -68,14 +54,19 @@ type CallParams = {
   }[];
   readonly toolChoice?: unknown;
 };
+/** The part of `LanguageModelV4` the model gate reads. */
+type CallModel = {
+  readonly modelId?: unknown;
+};
 /** Structural `LanguageModelMiddleware` (specification `v4`) from `ai`. */
 type LanguageModelMiddleware = {
   readonly specificationVersion: "v4";
   readonly transformParams: <TParams extends CallParams>(options: {
     readonly params: TParams;
+    readonly model?: CallModel;
   }) => Promise<TParams>;
 };
-type AiSdkPermDock = {
+type AiSdkPermDock<V extends PolicyVocabulary = PolicyVocabulary> = AgentPermDock<AiSdkContext, V> & {
   readonly toolApproval: (call: ToolApprovalCall) => Promise<ToolApprovalStatus>;
   /**
    * PermDock's `toolApproval` followed by the application's own: `app` is
@@ -86,10 +77,14 @@ type AiSdkPermDock = {
    * come first.
    */
   readonly composeToolApproval: (app: AppToolApproval) => (call: ToolApprovalCall) => Promise<ToolApprovalResult>;
-  /** Hides tools the subject in `context` can never use, before the model sees them. */
+  /**
+   * Hides tools the subject in `context` can never use, before the model
+   * sees them. With `models`, a call to a model the subject is not granted
+   * throws `PermDockDeniedError` before the provider is called.
+   */
   readonly capabilityMiddleware: (context: AiSdkContext) => LanguageModelMiddleware;
   readonly needsApproval: (permission: Permission) => (input: unknown, options?: NeedsApprovalOptions) => Promise<boolean>;
 };
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: AiSdkPermDockOptions<TUser>): AiSdkPermDock;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: AiSdkPermDockOptions<TUser>): AiSdkPermDock<V>;
 //#endregion
-export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, LanguageModelMiddleware, NeedsApprovalOptions, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };
+export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, DeniedText, DeniedTextEvent, LanguageModelMiddleware, NeedsApprovalOptions, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };

package/dist/ai-sdk/index.js

@@ -1,7 +1,8 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-_RRHmnMY.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
+import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { t as approvalTokenOf } from "../kernel-5JatXyND.js";
+import { t as agentRuntime } from "../create-C3b4B5eF.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",
@@ -61,22 +62,25 @@ function deniedError(verdict, permission, permdock) {
 		message: verdict.reason
 	});
 }
-function createPermDock(policy, options) {
-	const kernel = createAgentKernel(policy, {
-		...compact({
-			actor: options.actor,
-			delegation: options.delegation,
-			tenant: options.tenant,
-			store: options.store
-		}),
-		...instanceOptions(options),
-		subject: options.subject,
-		tools: options.tools,
-		adapter: "ai-sdk"
+function modelDenied(decision, modelId, permission, permdock) {
+	return new PermDockDeniedError({
+		decision,
+		permission: permission?.key ?? "model",
+		scope: permission?.scope ?? "model",
+		resource: {
+			type: permission?.resource ?? "model",
+			id: modelId
+		},
+		subject: permdock.subject,
+		message: `Denied: model ${modelId} is not granted.`
 	});
+}
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
+	const { agent, kernel } = agentRuntime(policy, options, "ai-sdk");
 	const byPermission = /* @__PURE__ */ new Map();
-	for (const [name, binding] of Object.entries(options.tools)) byPermission.set(binding.permission.key, name);
-	const passes = (toolName) => options.unmapped === "allow" && !Object.hasOwn(options.tools, toolName);
+	for (const [name, binding] of Object.entries(options.operations)) byPermission.set(binding.permission.key, name);
+	const passes = (toolName) => options.unmapped === "allow" && !Object.hasOwn(options.operations, toolName);
 	const decide = (toolName, args, context) => kernel.decideTool(toolName, args, context, compact({ resumeToken: approvalTokenOf(context) }));
 	const toolApproval = async (call) => {
 		if (passes(call.toolCall.toolName)) return "approved";
@@ -99,7 +103,19 @@ function createPermDock(policy, options) {
 	};
 	const capabilityMiddleware = (context) => ({
 		specificationVersion: "v4",
-		transformParams: async ({ params }) => {
+		transformParams: async ({ params, model }) => {
+			if (options.models !== void 0) {
+				const modelId = typeof model?.modelId === "string" ? model.modelId : "unknown";
+				const decision = await agent.decideModel(modelId, context);
+				if (decision.outcome !== "granted") throw modelDenied(decision.outcome === "denied" ? decision : {
+					outcome: "denied",
+					denials: [{
+						role: null,
+						reason: "approval"
+					}],
+					alternatives: []
+				}, modelId, Object.hasOwn(options.models, modelId) ? options.models[modelId] : void 0, await kernel.instance(context));
+			}
 			if (params.tools === void 0) return params;
 			const allowed = await kernel.allowedToolNames(context);
 			const keeps = (name) => typeof name === "string" && (allowed.has(name) || passes(name));
@@ -143,12 +159,13 @@ function createPermDock(policy, options) {
 			reason: "The tool approval answer was not valid."
 		};
 	};
-	return {
+	return Object.freeze({
+		...agent,
 		toolApproval,
 		composeToolApproval,
 		capabilityMiddleware,
 		needsApproval
-	};
+	});
 }
 //#endregion
 export { createPermDock };

package/dist/app-data-MuyzVqX8.js

@@ -0,0 +1,60 @@
+import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { i as validateSync } from "./thenable-yD7SabqG.js";
+//#region src/core/app-data.ts
+const MAX_META_DEPTH = 8;
+/** Throws unless `value` is plain, prototype-safe JSON at most eight levels deep. */
+function assertMetaValue(value, label, depth = 0) {
+	if (depth > MAX_META_DEPTH) throw new Error(`PermDock: ${label} nests deeper than ${MAX_META_DEPTH}`);
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return;
+	if (Array.isArray(value)) {
+		for (const item of value) assertMetaValue(item, label, depth + 1);
+		return;
+	}
+	if (typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+		for (const key of Object.keys(value)) {
+			assertSafeKey(key, "meta.x key");
+			assertMetaValue(Reflect.get(value, key), label, depth + 1);
+		}
+		return;
+	}
+	throw new Error(`PermDock: ${label} must be plain JSON`);
+}
+/** Throws unless `value` is a plain JSON object (an `x` field). */
+function assertAppData(value, label) {
+	assertMetaValue(value, label, 0);
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`PermDock: ${label} must be a JSON object`);
+}
+function runSchema(schema, value) {
+	const result = validateSync(schema, value);
+	if (result.ok) return result;
+	return {
+		ok: false,
+		message: result.issues === void 0 ? "schema must validate synchronously" : result.issues.map((issue) => issue.message).join("; ")
+	};
+}
+/**
+* Checks code-declared app data: plain JSON, then the schema when one is
+* given. Throws on failure, because a bad definition is an author error.
+*/
+function parseAppData(schema, value, label) {
+	assertAppData(value, label);
+	if (schema === void 0) return value;
+	const result = runSchema(schema, value);
+	if (!result.ok) throw new Error(`PermDock: ${label} is invalid: ${result.message}`);
+	assertAppData(result.value, label);
+	return result.value;
+}
+/**
+* Checks app data read from a source (a membership, a stored custom role).
+* Never throws: `undefined` means the value is dropped, and the caller
+* reports it.
+*/
+function readAppData(schema, value) {
+	try {
+		return parseAppData(schema, value, "x");
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { readAppData as i, assertMetaValue as n, parseAppData as r, assertAppData as t };

package/dist/approval-header-CJACtHkv.js

@@ -0,0 +1,23 @@
+//#region src/core/approval-header.ts
+/**
+* RFC 9651 section 3.3.4 sf-token: `( ALPHA / "*" ) *( tchar / ":" / "/" )`.
+* The `PermDock-Approval` field is an Item holding one, with no parameters.
+*/
+const SF_TOKEN = /^[A-Za-z*][!#$%&'*+\-.^_`|~0-9A-Za-z:/]*$/u;
+/**
+* The token a `PermDock-Approval` field value carries, or `undefined` for
+* anything but a single sf-token Item without parameters. Leading and
+* trailing spaces are discarded as RFC 9651 section 4.2 parses them.
+*/
+function parseApprovalHeader(value) {
+	if (value === null) return;
+	const item = value.replaceAll(/^ +| +$/gu, "");
+	return SF_TOKEN.test(item) ? item : void 0;
+}
+/** The `PermDock-Approval` field value for `token`; a `TypeError` for a token that is not an sf-token. */
+function approvalHeaderValue(token) {
+	if (!SF_TOKEN.test(token)) throw new TypeError("PermDock: a PermDock-Approval token must be an RFC 9651 sf-token");
+	return token;
+}
+//#endregion
+export { parseApprovalHeader as n, approvalHeaderValue as t };

package/dist/approval-prompt-Dg5LeAcT.js

@@ -0,0 +1,62 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+//#region src/delivery/approval-prompt.ts
+/**
+* The prompt for a pending request. Throws a `TypeError` for a request that
+* is not pending: a resolved or expired request has nothing to approve.
+*/
+function approvalPrompt(request, options = {}) {
+	if (request.status !== "pending") throw new TypeError(`PermDock: approvalPrompt needs a pending request, got ${request.status}`);
+	const principal = request.subject.principal;
+	const actor = request.subject.actor;
+	const operation = options.operation;
+	return freezeDeep(compact({
+		v: 1,
+		id: request.id,
+		permission: request.permission,
+		scope: request.scope,
+		resource: compact({
+			type: request.resource.type,
+			id: request.resource.id
+		}),
+		requester: compact({
+			principal: principal === null ? null : { id: principal.id },
+			actor: actor === void 0 ? void 0 : {
+				id: actor.id,
+				kind: actor.kind
+			}
+		}),
+		tenant: principal?.tenant,
+		detail: request.detail,
+		createdAt: request.createdAt,
+		expiresAt: request.expiresAt,
+		operation: operation === void 0 ? void 0 : compact({
+			name: operation.name,
+			title: operation.meta.title,
+			risk: operation.meta.risk,
+			effects: operation.meta.effects
+		})
+	}));
+}
+/**
+* The approval page URL for `prompt`. A string or `URL` is a base the
+* encoded request id is appended to. Throws a `TypeError` for a URL that is
+* not https.
+*/
+function approvalUrlFor(prompt, approvalUrl) {
+	let url;
+	try {
+		if (typeof approvalUrl === "function") url = new URL(approvalUrl(prompt));
+		else {
+			const base = new URL(approvalUrl);
+			base.pathname = `${base.pathname.replace(/\/+$/u, "")}/${encodeURIComponent(prompt.id)}`;
+			url = base;
+		}
+	} catch {
+		throw new TypeError("PermDock: approvalUrl is not a URL");
+	}
+	if (url.protocol !== "https:") throw new TypeError("PermDock: approvalUrl must be https");
+	return url.href;
+}
+//#endregion
+export { approvalUrlFor as n, approvalPrompt as t };

package/dist/approval-prompt-Djo_PyZc.d.ts

@@ -0,0 +1,57 @@
+import { s as OperationMeta, t as Operation } from "./operations-CxybZErY.js";
+import { u as ApprovalRequest } from "./types-CCpc2Dcv.js";
+//#region src/delivery/approval-prompt.d.ts
+/**
+ * What an email or chat prompt shows an approver, wire format v1. It carries
+ * no approval token and no roles: a prompt links to the app's approval page,
+ * where the signed-in approver decides. A link never approves.
+ */
+type ApprovalPrompt = {
+  readonly v: 1;
+  /** The approval request id. */
+  readonly id: string;
+  readonly permission: string;
+  readonly scope: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly requester: {
+    readonly principal: {
+      readonly id: string;
+    } | null;
+    readonly actor?: {
+      readonly id: string;
+      readonly kind: string;
+    };
+  };
+  readonly tenant?: string;
+  readonly detail: string;
+  /** RFC 3339. */
+  readonly createdAt: string;
+  /** RFC 3339. */
+  readonly expiresAt: string;
+  readonly operation?: {
+    readonly name: string;
+    readonly title?: string;
+    readonly risk?: OperationMeta["risk"];
+    readonly effects?: OperationMeta["effects"];
+  };
+};
+/** The approval page for a prompt: a base URL the request id is appended to, or a function of the prompt. */
+type ApprovalUrl = string | URL | ((prompt: ApprovalPrompt) => string | URL);
+/**
+ * The prompt for a pending request. Throws a `TypeError` for a request that
+ * is not pending: a resolved or expired request has nothing to approve.
+ */
+declare function approvalPrompt(request: ApprovalRequest, options?: {
+  readonly operation?: Pick<Operation, "name" | "meta">;
+}): ApprovalPrompt;
+/**
+ * The approval page URL for `prompt`. A string or `URL` is a base the
+ * encoded request id is appended to. Throws a `TypeError` for a URL that is
+ * not https.
+ */
+declare function approvalUrlFor(prompt: ApprovalPrompt, approvalUrl: ApprovalUrl): string;
+//#endregion
+export { approvalUrlFor as i, ApprovalUrl as n, approvalPrompt as r, ApprovalPrompt as t };

package/dist/approvals/index.d.ts

@@ -1,3 +1,5 @@
-import { _ as approverRelationKey, a as ApprovalListFilter, c as ApprovalRequest, d as ApprovalStatus, f as ApprovalStore, g as approvalQuorum, h as DEFAULT_APPROVAL_TTL_MS, i as ApprovalInspectResult, l as ApprovalResumeFailure, m as ApprovalVerdict, n as ApprovalApprovers, o as ApprovalListQuery, p as ApprovalSubjectSummary, r as ApprovalCancelMeta, s as ApprovalPage, t as APPROVAL_HEADER, u as ApprovalSignature, v as escalationOpenAt } from "../types-aqOHTHcp.js";
-import { C as ApproverRelationsOptions, D as ApprovalError, E as approvalsHandler, O as ApprovalErrorCode, S as vouchApproval, T as ApprovalsHandlerOptions, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, k as isApprovalError, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, o as ApprovalCursorPosition, p as consumeApproval, r as assertApprover, s as approvalPageSize, t as MemoryApprovalStore, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summariseSubject, y as resumeFromHeader } from "../index-C7Tw7MaW.js";
-export { APPROVAL_HEADER, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailure, type ApprovalSignature, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL_MS, type MemoryApprovalStore, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isApprovalError, listAllApprovals, memoryApprovalStore, pageApprovals, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, storedApprovalToken, summariseSubject, vouchApproval };
+import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-CCpc2Dcv.js";
+import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-BWXBMaKK.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-_sHy8BQf.js";
+import { $ as AccessReviewVerdict, A as APPROVAL_REQUEST_SCHEMA, B as matchDelegation, C as ApproverRelationsOptions, D as SignApprovalOptions, E as ApprovalSignatureEntry, F as IdempotencyStore, G as pageAccessReviewItems, H as parseApprovalDelegation, I as IdempotentResponse, J as StartAccessReviewInput, K as AccessReviewHolder, L as memoryIdempotencyStore, M as ApprovalView, N as ApprovalsHandlerOptions, O as approvalSignatureClaims, P as approvalsHandler, Q as isAccessReviewError, R as ApprovalDelegationMatch, S as vouchApproval, T as ApprovalSignatureClaims, U as MemoryAccessReviewStore, V as memoryApprovalDelegationSource, W as memoryAccessReviewStore, X as AccessReviewError, Y as startAccessReview, Z as AccessReviewErrorCode, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, et as accessReviewerEligible, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, j as parseApprovalRequest, k as signApproval, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, nt as AccessReviewsHandlerOptions, o as ApprovalCursorPosition, p as consumeApproval, q as AccessReviewOptions, r as assertApprover, rt as accessReviewsHandler, s as approvalPageSize, t as MemoryApprovalStore, tt as decideAccessReviewItem, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as MatchDelegationOptions } from "../index-CxGUswIC.js";
+export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyStore, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/approvals/index.js

@@ -1,5 +1,8 @@
-import { n as isApprovalError, t as ApprovalError } from "../errors-DRnGZHzF.js";
-import { a as decodeApprovalCursor, c as pageApprovals, d as approvalQuorum, f as approverRelationKey, i as approvalPageSize, l as APPROVAL_HEADER, n as assertApprover, o as encodeApprovalCursor, p as escalationOpenAt, r as memoryApprovalStore, s as listAllApprovals, t as applyApprovalVerdict, u as DEFAULT_APPROVAL_TTL_MS } from "../store-DMAWwAJV.js";
-import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summariseSubject } from "../helpers-H_KARDVC.js";
-import { t as approvalsHandler } from "../approvals-DbYAuNkG.js";
-export { APPROVAL_HEADER, ApprovalError, DEFAULT_APPROVAL_TTL_MS, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isApprovalError, listAllApprovals, memoryApprovalStore, pageApprovals, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, storedApprovalToken, summariseSubject, vouchApproval };
+import { a as escalationOpenAt, c as isApprovalError, i as approverRelationKey, n as DEFAULT_APPROVAL_TTL, r as approvalQuorum, s as ApprovalError, t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
+import { a as approvalPageSize, c as listAllApprovals, i as memoryApprovalStore, l as pageApprovals, n as assertApprover, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "../store-4u_hxjWa.js";
+import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-DTcZOzhF.js";
+import { n as isAccessReviewError, t as AccessReviewError } from "../errors-BDUwg2qC.js";
+import { a as matchDelegation, c as memoryAccessReviewStore, d as accessReviewsHandler, f as accessReviewerEligible, i as memoryIdempotencyStore, l as pageAccessReviewItems, n as approvalSignatureClaims, o as memoryApprovalDelegationSource, p as decideAccessReviewItem, r as signApproval, s as parseApprovalDelegation, t as approvalsHandler, u as startAccessReview } from "../approvals-DJ6Yd5z1.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
+import { t as parseApprovalRequest } from "../parse-request-D_tUXG6M.js";
+export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, AccessReviewError, ApprovalError, DEFAULT_APPROVAL_TTL, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };