permdock 0.4.0 → 0.6.0

package/dist/chat/index.js

@@ -0,0 +1,224 @@
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { n as loadPrincipalByIdentity } from "../principal-source-pHneukrx.js";
+import { f as nowMillis } from "../time-DkWjdL98.js";
+import { c as withApp, t as getPermDock } from "../permdock-BrAscV28.js";
+import { c as isApprovalError } from "../types-DqzsnlSA.js";
+import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-CBYVMjwh.js";
+import { t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
+//#region src/chat/subject.ts
+function nonEmpty(value) {
+	return typeof value === "string" && value !== "";
+}
+function isChatAuthor(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const provider = Reflect.get(value, "provider");
+	const userId = Reflect.get(value, "userId");
+	const workspace = Reflect.get(value, "workspace");
+	return nonEmpty(provider) && nonEmpty(userId) && (workspace === void 0 || nonEmpty(workspace));
+}
+/** The principal linked to `author`, or `null` for an unlinked or malformed author. Never throws. */
+function principalFromChat(author, principals) {
+	if (!isChatAuthor(author)) return Promise.resolve(null);
+	return loadPrincipalByIdentity(principals, compact({
+		kind: "chat",
+		provider: author.provider,
+		value: author.userId,
+		workspace: author.workspace
+	}));
+}
+/**
+* The subject a chat author acts as: the principal its identity link
+* names, or anonymous when there is no link. Never throws.
+*/
+async function subjectFromChat(author, options) {
+	return {
+		principal: await principalFromChat(author, options.principals),
+		context: {}
+	};
+}
+//#endregion
+//#region src/chat/create.ts
+const ADAPTER = "chat";
+function denied(reason, permission) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason,
+			detail: { permission: permission.key }
+		}],
+		alternatives: []
+	});
+}
+function idOf(row) {
+	if (row === null || typeof row !== "object") return;
+	const id = Reflect.get(row, "id");
+	return typeof id === "string" || typeof id === "number" ? String(id) : void 0;
+}
+function isLive(request, now) {
+	return request.status !== "expired" && Date.parse(request.expiresAt) > now;
+}
+async function findRequest(store, id) {
+	if (store.getById !== void 0) return store.getById(id);
+	let cursor;
+	do {
+		const page = await store.list(compact({ cursor }));
+		const found = page.items.find((request) => request.id === id);
+		if (found !== void 0) return found;
+		cursor = page.next;
+	} while (cursor !== void 0);
+	return null;
+}
+/**
+* Creates the chat PermDock. Every command and action is decided as the
+* principal the author's chat identity links to, loaded live; an unlinked
+* author is anonymous and denied.
+*/
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
+	const { store: approvals, ...permdockOptions } = options;
+	const instanceFor = (subject) => getPermDock(policy, subject, permdockOptions);
+	const getPermDock$1 = async (author) => instanceFor(await subjectFromChat(author, { principals: options.principals }));
+	const parked = async (operation, decision, permdock, row) => {
+		if (approvals === void 0) return null;
+		const resource = compact({
+			type: operation.permission.resource,
+			id: idOf(row)
+		});
+		const current = await approvals.get(decision.token);
+		if (current !== null && isLive(current, nowMillis())) {
+			if (current.status === "pending") return approvalPrompt(current, { operation });
+			return resumeDecision({
+				decision,
+				permission: operation.permission,
+				subject: permdock.subject,
+				store: approvals,
+				resource,
+				adapter: ADAPTER,
+				token: decision.token
+			});
+		}
+		const request = await requestApproval(approvals, decision, {
+			permission: operation.permission,
+			resource,
+			subject: permdock.subject,
+			adapter: ADAPTER
+		});
+		return approvalPrompt(request, { operation });
+	};
+	const protect = (operation, handler) => {
+		const { permission } = operation;
+		return async (author, input) => {
+			const permdock = await getPermDock$1(author);
+			let row;
+			if (operation.data !== void 0) {
+				try {
+					row = await operation.data(input);
+				} catch {
+					return {
+						outcome: "denied",
+						decision: denied("closure-error", permission)
+					};
+				}
+				if (permission.kind === "instance" && (row === null || row === void 0)) return {
+					outcome: "denied",
+					decision: denied("validation", permission)
+				};
+			}
+			let decision = permdock.decide(permission, row, {
+				adapter: ADAPTER,
+				call: "adapter",
+				operation: {
+					name: operation.name,
+					meta: operation.meta
+				}
+			});
+			if (decision.outcome === "approval-required") {
+				const resolved = await parked(operation, decision, permdock, row);
+				if (resolved === null || "v" in resolved) return {
+					outcome: "approval-required",
+					decision,
+					prompt: resolved
+				};
+				decision = resolved;
+			}
+			switch (decision.outcome) {
+				case "granted": break;
+				case "denied": return {
+					outcome: "denied",
+					decision
+				};
+				case "approval-required": return {
+					outcome: "approval-required",
+					decision,
+					prompt: null
+				};
+				default: return decision;
+			}
+			if (!isChatAuthor(author)) return {
+				outcome: "denied",
+				decision: denied("validation", permission)
+			};
+			return {
+				outcome: "granted",
+				value: await handler({
+					author,
+					input,
+					row,
+					permdock,
+					decision
+				})
+			};
+		};
+	};
+	const resolveAction = async (author, action) => {
+		const status = action.status;
+		if (status !== "approved" && status !== "rejected" || typeof action.approval !== "string" || action.approval === "") return {
+			ok: false,
+			cause: "invalid-action"
+		};
+		const subject = await subjectFromChat(author, { principals: options.principals });
+		if (subject.principal === null) return {
+			ok: false,
+			cause: "approver-unauthenticated"
+		};
+		if (approvals === void 0) return {
+			ok: false,
+			cause: "approval-not-found"
+		};
+		try {
+			const request = await findRequest(approvals, action.approval);
+			if (request === null) return {
+				ok: false,
+				cause: "approval-not-found"
+			};
+			const resolved = await resolveApproval(approvals, request.token, compact({
+				status,
+				by: subject,
+				note: action.note
+			}), compact({
+				relations: permdockOptions.relations,
+				requireDistinctApprover: true,
+				permdockFor: (approver) => instanceFor(approver)
+			}));
+			return {
+				ok: true,
+				id: resolved.id,
+				status: resolved.status
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				cause: isApprovalError(error) ? error.code : "approval-not-found"
+			};
+		}
+	};
+	return Object.freeze({
+		getPermDock: getPermDock$1,
+		protect,
+		resolveAction
+	});
+}
+//#endregion
+export { createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat-sdk/index.d.ts

@@ -0,0 +1,87 @@
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-B30OMUOJ.js";
+import { n as ChatTransport } from "../types-BtHtcKMr.js";
+import { ActionEvent, Author, CardElement } from "chat";
+//#region src/chat-sdk/author.d.ts
+type ChatSdkAuthorOptions = {
+  /** The platform workspace the bot is installed in, matched against identity links. */
+  readonly workspace?: string;
+};
+/**
+ * The `ChatAuthor` of a Chat SDK message or action, named by its adapter
+ * (`adapter.name`, such as `slack`). `null` for a bot, this bot, the
+ * platform itself or an empty id. Reads only `userId`: the email and display
+ * name never identify anyone.
+ */
+export declare function chatSdkAuthor(user: Pick<Author, "userId" | "isBot" | "isMe" | "isSystem">, adapter: {
+  readonly name: string;
+} | string, options?: ChatSdkAuthorOptions): ChatAuthor | null;
+//#endregion
+//#region src/chat-sdk/card.d.ts
+/** The `actionId` of the card's approve button; its `value` is the request id. */
+export declare const APPROVE_ACTION = "permdock:approve";
+/** The `actionId` of the card's reject button; its `value` is the request id. */
+export declare const REJECT_ACTION = "permdock:reject";
+type ApprovalCardOptions = {
+  /** The app's approval page: a base URL the request id is appended to, or a function of the prompt. Must be https. */
+  readonly approvalUrl: ApprovalUrl;
+  /** `false` leaves out the approve and reject buttons, so the page is the only place to decide. Defaults to `true`. */
+  readonly buttons?: boolean;
+};
+/**
+ * A Chat SDK card for an approval prompt: the detail, who asked, the
+ * permission and the expiry, a link to the approval page, and approve and
+ * reject buttons that carry the request id, never its token. A click is
+ * applied by `approvalActions` as the verified clicking user. Throws a
+ * `TypeError` for an approval page that is not https.
+ */
+export declare function approvalCard(prompt: ApprovalPrompt, options: ApprovalCardOptions): CardElement;
+//#endregion
+//#region src/chat-sdk/actions.d.ts
+type ApprovalActionsOptions = ChatSdkAuthorOptions & {
+  /**
+   * Receives every verdict instead of the default replies: the outcome posted
+   * to the thread, a refusal shown only to the clicking user.
+   */
+  readonly onResult?: (result: ChatActionResult, event: ActionEvent) => void | Promise<void>;
+};
+type ApprovalActions = {
+  /** The action ids to register: `chat.onAction(actions.actionIds, actions.onAction)`. */
+  readonly actionIds: readonly [typeof APPROVE_ACTION, typeof REJECT_ACTION];
+  readonly onAction: (event: ActionEvent) => Promise<void>;
+};
+/**
+ * Applies the approve and reject buttons of `approvalCard`. The clicking
+ * user, as the Chat SDK adapter verified them, is resolved through
+ * `ChatPermDock.resolveAction`; the button value names the request by id.
+ * A click from an unlinked user, the requester or a bot records nothing.
+ */
+export declare function approvalActions(permdock: ChatPermDock, options?: ApprovalActionsOptions): ApprovalActions;
+//#endregion
+//#region src/chat-sdk/transport.d.ts
+/** The part of a Chat SDK `Chat` the transport calls; a `new Chat(...)` fits. */
+type ChatSdkClient = {
+  openDM(user: string): Promise<{
+    post(message: string | CardElement): Promise<{
+      readonly id: string;
+    }>;
+  }>;
+};
+type ChatSdkTransportOptions = {
+  /** The adapter name recipients are on (`slack`, `teams`, …); a target for another provider is rejected. */
+  readonly provider: string;
+  /** The workspace the bot is installed in; a target for another workspace is rejected. */
+  readonly workspace?: string;
+  /** Keys this transport remembers to skip a repeat post. Defaults to 1000. */
+  readonly remember?: number;
+};
+/**
+ * The chat channel of `permdock/delivery` over the Chat SDK: opens a direct
+ * message with the target's platform user id and posts the text, or the
+ * approval card when the message carries an approval prompt. The Chat SDK
+ * takes no idempotency key, so the transport skips a key it already sent,
+ * per instance and in memory only.
+ */
+export declare function chatSdkTransport(chat: ChatSdkClient, options: ChatSdkTransportOptions): ChatTransport;
+//#endregion
+export type { ApprovalActions, ApprovalActionsOptions, ApprovalCardOptions, ChatSdkAuthorOptions, ChatSdkClient, ChatSdkTransportOptions };

package/dist/chat-sdk/index.js

@@ -0,0 +1,197 @@
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as approvalUrlFor } from "../approval-prompt-Dg5LeAcT.js";
+import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { Actions, Button, Card, CardText, Field, Fields, LinkButton } from "chat";
+//#region src/chat-sdk/author.ts
+/**
+* The `ChatAuthor` of a Chat SDK message or action, named by its adapter
+* (`adapter.name`, such as `slack`). `null` for a bot, this bot, the
+* platform itself or an empty id. Reads only `userId`: the email and display
+* name never identify anyone.
+*/
+function chatSdkAuthor(user, adapter, options = {}) {
+	const provider = typeof adapter === "string" ? adapter : adapter.name;
+	if (typeof provider !== "string" || provider === "" || typeof user.userId !== "string" || user.userId === "" || user.isBot === true || user.isMe || user.isSystem === true) return null;
+	return compact({
+		provider,
+		userId: user.userId,
+		workspace: options.workspace === void 0 || options.workspace === "" ? void 0 : options.workspace
+	});
+}
+//#endregion
+//#region src/chat-sdk/card.ts
+/** The `actionId` of the card's approve button; its `value` is the request id. */
+const APPROVE_ACTION = "permdock:approve";
+/** The `actionId` of the card's reject button; its `value` is the request id. */
+const REJECT_ACTION = "permdock:reject";
+function oneLine(value) {
+	return value.replaceAll(/\s+/gu, " ").trim();
+}
+/**
+* A Chat SDK card for an approval prompt: the detail, who asked, the
+* permission and the expiry, a link to the approval page, and approve and
+* reject buttons that carry the request id, never its token. A click is
+* applied by `approvalActions` as the verified clicking user. Throws a
+* `TypeError` for an approval page that is not https.
+*/
+function approvalCard(prompt, options) {
+	const url = approvalUrlFor(prompt, options.approvalUrl);
+	const requester = prompt.requester.principal?.id ?? "an anonymous caller";
+	const actor = prompt.requester.actor;
+	const fields = [
+		Field({
+			label: "Requested by",
+			value: actor === void 0 ? requester : `${requester} through ${actor.kind} ${actor.id}`
+		}),
+		Field({
+			label: "Permission",
+			value: prompt.permission
+		}),
+		Field({
+			label: "Resource",
+			value: prompt.resource.id === void 0 ? prompt.resource.type : `${prompt.resource.type} ${prompt.resource.id}`
+		}),
+		...prompt.operation?.risk === void 0 ? [] : [Field({
+			label: "Risk",
+			value: prompt.operation.risk
+		})],
+		Field({
+			label: "Expires",
+			value: prompt.expiresAt
+		})
+	];
+	const review = LinkButton({
+		url,
+		label: "Review"
+	});
+	const children = [
+		CardText(oneLine(prompt.detail)),
+		Fields(fields),
+		Actions(options.buttons === false ? [review] : [
+			Button({
+				id: APPROVE_ACTION,
+				label: "Approve",
+				style: "primary",
+				value: prompt.id
+			}),
+			Button({
+				id: REJECT_ACTION,
+				label: "Reject",
+				style: "danger",
+				value: prompt.id
+			}),
+			review
+		])
+	];
+	return Card({
+		title: `Approval needed: ${oneLine(prompt.operation?.title ?? prompt.detail)}`,
+		children
+	});
+}
+//#endregion
+//#region src/chat-sdk/actions.ts
+async function reply(result, event) {
+	const { thread } = event;
+	if (thread === null) return;
+	if (result.ok) {
+		const verdict = result.status === "approved" ? "Approved" : "Rejected";
+		await thread.post(`${verdict} by ${event.user.userName}.`);
+		return;
+	}
+	await thread.postEphemeral(event.user, `The approval was not recorded: ${result.cause}.`, { fallbackToDM: false });
+}
+/**
+* Applies the approve and reject buttons of `approvalCard`. The clicking
+* user, as the Chat SDK adapter verified them, is resolved through
+* `ChatPermDock.resolveAction`; the button value names the request by id.
+* A click from an unlinked user, the requester or a bot records nothing.
+*/
+function approvalActions(permdock, options = {}) {
+	const onAction = async (event) => {
+		if (event.actionId !== "permdock:approve" && event.actionId !== "permdock:reject") return;
+		const author = chatSdkAuthor(event.user, event.adapter, options);
+		const result = await permdock.resolveAction(author, {
+			approval: event.value ?? "",
+			status: event.actionId === "permdock:approve" ? "approved" : "rejected"
+		});
+		await (options.onResult ?? reply)(result, event);
+	};
+	return Object.freeze({
+		actionIds: [APPROVE_ACTION, REJECT_ACTION],
+		onAction
+	});
+}
+//#endregion
+//#region src/chat-sdk/transport.ts
+const DEFAULT_REMEMBER = 1e3;
+function failed(cause, retryable, reason) {
+	return reason === void 0 ? {
+		status: "failed",
+		cause,
+		retryable
+	} : {
+		status: "failed",
+		cause,
+		retryable,
+		reason
+	};
+}
+/** Maps a Chat SDK throw by its `ChatError` code; anything else is retryable. */
+function chatSdkFailure(error) {
+	switch (typeof error === "object" && error !== null ? Reflect.get(error, "code") : void 0) {
+		case "RATE_LIMITED": return failed("rate-limited", true);
+		case "NOT_IMPLEMENTED": return failed("rejected", false, "the adapter cannot open a direct message");
+		default: return failed("unavailable", true);
+	}
+}
+/**
+* The chat channel of `permdock/delivery` over the Chat SDK: opens a direct
+* message with the target's platform user id and posts the text, or the
+* approval card when the message carries an approval prompt. The Chat SDK
+* takes no idempotency key, so the transport skips a key it already sent,
+* per instance and in memory only.
+*/
+function chatSdkTransport(chat, options) {
+	const remember = options.remember ?? DEFAULT_REMEMBER;
+	const sent = /* @__PURE__ */ new Map();
+	const record = (key, result) => {
+		sent.set(key, result);
+		if (sent.size > remember) {
+			const oldest = sent.keys().next();
+			if (oldest.done !== true) sent.delete(oldest.value);
+		}
+	};
+	const deliver = async (target, message, deliveryOptions) => {
+		if (!isDeliveryTarget(target, "chat")) return failed("invalid-recipient", false);
+		if (target.provider !== void 0 && target.provider !== options.provider || target.workspace !== void 0 && options.workspace !== void 0 && target.workspace !== options.workspace) return failed("rejected", false, "the target is on another platform or workspace");
+		const previous = sent.get(deliveryOptions.idempotencyKey);
+		if (previous !== void 0) return previous;
+		let body;
+		try {
+			body = message.approval === void 0 ? message.text : approvalCard(message.approval.prompt, { approvalUrl: message.approval.url });
+		} catch {
+			return {
+				status: "failed",
+				cause: "invalid-message",
+				retryable: false
+			};
+		}
+		try {
+			const result = {
+				status: "sent",
+				providerId: (await (await chat.openDM(target.address)).post(body)).id
+			};
+			record(deliveryOptions.idempotencyKey, result);
+			return result;
+		} catch (error) {
+			return chatSdkFailure(error);
+		}
+	};
+	return Object.freeze({
+		channel: "chat",
+		name: "chat-sdk",
+		deliver
+	});
+}
+//#endregion
+export { APPROVE_ACTION, REJECT_ACTION, approvalActions, approvalCard, chatSdkAuthor, chatSdkTransport };

package/dist/claims-map-7oQ3ue4X.js

@@ -0,0 +1,13 @@
+import { o as readPath } from "./paths-DXSHAMIa.js";
+//#region src/core/claims-map.ts
+/** The value at `path`; a function that throws reads as absent, so a bad mapping fails closed. */
+function readClaim(claims, path) {
+	if (typeof path === "string") return readPath(claims, path);
+	try {
+		return path(claims);
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { readClaim as t };

package/dist/claims-map-Ca-QX8C6.d.ts

@@ -0,0 +1,32 @@
+//#region src/core/claims-map.d.ts
+/** Where a value lives in verified claims: a dotted path (`app_metadata.roles`), or a function over the claims. */
+type ClaimPath = string | ((claims: Readonly<Record<string, unknown>>) => unknown);
+/**
+ * How one provider's verified claims map to a principal. Every subject
+ * provider takes it as `claims`; each field it leaves out keeps that
+ * provider's default. Mapping only: core never verifies a token, and a claim
+ * becomes a principal field only after the provider verified the token.
+ */
+type ClaimsMap = {
+  readonly id?: ClaimPath;
+  readonly roles?: ClaimPath;
+  readonly groups?: ClaimPath;
+  readonly entitlements?: ClaimPath;
+  readonly plans?: ClaimPath;
+  /** The active tenant. */
+  readonly tenant?: ClaimPath;
+  /** `[{ scope, id, within?, roles }]` carried in the token. */
+  readonly memberships?: ClaimPath;
+  /** `'user'`, `'service'` or `'workload'`, or the path that holds one. */
+  readonly kind?: string;
+  readonly assurance?: string | {
+    readonly acr?: string;
+    readonly amr?: string;
+    readonly authTime?: string;
+    /** OpenID Connect for Identity Assurance; default `verified_claims`. */
+    readonly verified?: string;
+  };
+  readonly session?: ClaimPath;
+};
+//#endregion
+export { ClaimsMap as t };

package/dist/claude-agent/index.d.ts

@@ -1,7 +1,6 @@
-import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock, wr as Delegation } from "../policy-types-sp9P1iIV.js";
-import { f as ApprovalStore } from "../types-Br9IXUBG.js";
-import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
-import { t as ToolMap } from "../types-DvupZE0w.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {
@@ -19,15 +18,9 @@ type ClaudeAgentContext = {
   readonly sessionId?: string;
   readonly agentId?: string;
 };
-type ClaudeAgentPermDockOptions<TUser = unknown> = InstanceOptions & {
-  readonly subject: (context: ClaudeAgentContext) => TUser | Promise<TUser>;
-  readonly actor?: (context: ClaudeAgentContext) => unknown;
-  readonly delegation?: (context: ClaudeAgentContext) => Delegation | undefined | Promise<Delegation | undefined>;
-  readonly tenant?: string | ((context: ClaudeAgentContext) => string | undefined | Promise<string | undefined>);
-  readonly tools: ToolMap;
+type ClaudeAgentPermDockOptions<TUser = unknown> = AgentAdapterOptions<ClaudeAgentContext, TUser> & {
   /** MCP server sources whose `mcp__*` tools may be decided; default `['sdk']`. */
   readonly mcpSources?: readonly string[];
-  readonly store?: ApprovalStore;
 };
 type PermissionResult = {
   readonly behavior: "allow";
@@ -58,15 +51,15 @@ type PermissionRequestHookOutput = {
     readonly decision: PermissionResult;
   };
 } | Record<string, never>;
-type ClaudeAgentPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+type ClaudeAgentPermDock<V extends PolicyVocabulary = PolicyVocabulary> = AgentPermDock<ClaudeAgentContext, V> & {
   /** A `CanUseTool`: pass it as the query's `canUseTool` option. */
   readonly canUseTool: (toolName: string, input: Record<string, unknown>, options?: CanUseToolOptions) => Promise<PermissionResult>;
   /** A `HookCallback` for the `PermissionRequest` event. */
   readonly permissionRequestHook: (input: PermissionRequestHookInput, toolUseID?: string, options?: {
     readonly signal?: AbortSignal;
   }) => Promise<PermissionRequestHookOutput>;
-  readonly permdock: (context: ClaudeAgentContext) => Promise<PermDock<V>>;
+  readonly getPermDock: (context: ClaudeAgentContext) => Promise<PermDock<V>>;
 };
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ClaudeAgentPermDockOptions<TUser>): ClaudeAgentPermDock<V>;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: ClaudeAgentPermDockOptions<TUser>): ClaudeAgentPermDock<V>;
 //#endregion
 export type { CanUseToolOptions, ClaudeAgentContext, ClaudeAgentPermDock, ClaudeAgentPermDockOptions, ClaudeMcpServer, PermissionRequestHookInput, PermissionRequestHookOutput, PermissionResult };

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
-import { n as createAgentKernel } from "../kernel-CB3LrIJM.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
+import { t as agentRuntime } from "../create-CGm28gyI.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {
@@ -27,50 +27,47 @@ function toResult(verdict, input) {
 		message: `${verdict.summary} Approval ${verdict.token} is pending; retry the call once it is approved.`
 	};
 }
-function createPermDock(policy, options) {
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
 	const sources = options.mcpSources ?? ["sdk"];
-	const kernel = createAgentKernel(policy, {
-		...compact({
-			actor: options.actor,
-			delegation: options.delegation,
-			tenant: options.tenant,
-			store: options.store
-		}),
-		...instanceOptions(options),
-		subject: options.subject,
-		tools: options.tools,
-		adapter: "claude-agent"
-	});
+	const { agent, kernel } = agentRuntime(policy, options, "claude-agent");
+	/** `null`: an unmapped tool under `unmapped: 'allow'`, which PermDock does not decide. */
 	const decide = async (context, input) => {
 		const untrusted = untrustedServer(context, sources);
 		if (untrusted !== void 0) return {
 			behavior: "deny",
 			message: untrusted
 		};
+		if (options.unmapped === "allow" && !Object.hasOwn(options.operations, context.toolName)) return null;
 		return toResult(await kernel.decideTool(context.toolName, input, context), input);
 	};
-	const canUseTool = (toolName, input, sdkOptions = {}) => decide(compact({
+	const canUseTool = async (toolName, input, sdkOptions = {}) => await decide(compact({
 		toolName,
 		mcpServer: sdkOptions.mcpServer,
 		agentId: sdkOptions.agentID
-	}), input);
+	}), input) ?? {
+		behavior: "allow",
+		updatedInput: input
+	};
 	const permissionRequestHook = async (input) => {
 		if (input.hook_event_name !== "PermissionRequest" || typeof input.tool_name !== "string") return {};
+		const decision = await decide(compact({
+			toolName: input.tool_name,
+			mcpServer: input.mcp_server,
+			sessionId: input.session_id,
+			agentId: input.agent_id
+		}), input.tool_input);
+		if (decision === null) return {};
 		return { hookSpecificOutput: {
 			hookEventName: "PermissionRequest",
-			decision: await decide(compact({
-				toolName: input.tool_name,
-				mcpServer: input.mcp_server,
-				sessionId: input.session_id,
-				agentId: input.agent_id
-			}), input.tool_input)
+			decision
 		} };
 	};
-	return {
+	return Object.freeze({
+		...agent,
 		canUseTool,
-		permissionRequestHook,
-		permdock: (context) => kernel.instance(context)
-	};
+		permissionRequestHook
+	});
 }
 //#endregion
 export { createPermDock };