permdock 0.5.0 → 0.7.0

package/README.md

@@ -306,6 +306,7 @@ React Router loaders call `getSnapshot(request)` from `permdock/server` and send
 - Fail-closed: an unknown, invalid or thrown check denies, and `can()` never throws.
 - Deny overrides allow, an unknown reference is a type error, and evaluation is prototype-safe with no eval.
 - `service_role` is never emitted, a model-supplied subject is never trusted, and an agent with no delegation is denied.
+- The generated Supabase token hook and the functions it calls for `supabase.hook.claims` and `supabase.hook.before` are revoked from `public`, `anon` and `authenticated`, so no client reads another user's claims.
 - No one approves their own request by default, a delegate is held to the same rule as the person they cover, there is never a default tenant, and data is validated against the resource schema unless the caller marks a row it loaded `trusted: true`.
 - A user or service API key expires unless the tenant sets `allowNoExpiry`. A feed key (`pdfeed_`) does not expire; rotation replaces the secret and keeps the id, and the key is bound to one resource.
 - Authentication stays upstream: PermDock consumes verified sessions, JWKS-verified JWTs (`permdock/jwt`, with `jose` as an optional peer), provider claims and MCP `authInfo`. Core never verifies a token. User-editable fields never become claims: `subjectFromBetterAuth` copies `additionalFields` only through a `schema`. Read [authentication](https://permdock.com/docs/concepts/authentication).

package/dist/{2020-C9VN-x8c.js → 2020-CJbO8Bvz.js}

@@ -1,6 +1,4 @@
-//#region \0rolldown/runtime.js
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
-//#endregion
+import { t as __commonJSMin } from "./rolldown-runtime-C3I60J0A.js";
 //#region ../../node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/a2a/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, Yn as AuthorizationDetail, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { a as ProblemDetails } from "../errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { $n as AuthorizationDetail, T as Policy, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { m as ApprovalStore } from "../types-DC44-hqb.js";
+import { a as ProblemDetails } from "../errors-B_Qg9D3e.js";
+import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
 //#region src/a2a/types.d.ts
 type A2aAuth = {
   readonly clientId?: string;

package/dist/a2a/index.js

@@ -2,13 +2,13 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { t as canonicalJson } from "../canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
 import { t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { a as hasScope, c as withApp, i as challengeScope, o as scopesReaching } from "../permdock-B9JxkBwC.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BfWEeMqk.js";
 import { f as wwwAuthenticate, r as bearerChallenge } from "../problem-CTviyH5L.js";
-import { r as instanceOptions } from "../build-instance-BMnAudHn.js";
-import { n as createAgentKernel } from "../kernel-5JatXyND.js";
+import { r as instanceOptions } from "../build-instance-DxE7czo9.js";
+import { n as createAgentKernel } from "../kernel-DVExUwkp.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {

package/dist/{adoption-scan-B4R5fnMU.js → adoption-scan-D-feE7BE.js}

@@ -1,5 +1,5 @@
 import { r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts

package/dist/agent/index.d.ts

@@ -1,3 +1,3 @@
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D8jDHgsl.js";
-import { a as createPermDock, c as ModelMap, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-BDS7wc3y.js";
-export { type AgentAdapterOptions, type AgentPermDock, type AgentPermDockOptions, type DecideToolOptions, type DeniedText, type DeniedTextEvent, type GatewayOptions, type ModelMap, type OperationVerdict, type ToolBinding, type ToolMap, createPermDock };
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D4qkEtFz.js";
+import { a as createPermDock, c as ModelMap, d as StepUp, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-UTnUVETj.js";
+export { type AgentAdapterOptions, type AgentPermDock, type AgentPermDockOptions, type DecideToolOptions, type DeniedText, type DeniedTextEvent, type GatewayOptions, type ModelMap, type OperationVerdict, type StepUp, type ToolBinding, type ToolMap, createPermDock };

package/dist/agent/index.js

@@ -1 +1 @@
-export { n as createPermDock } from "../create-C3b4B5eF.js";
+export { n as createPermDock } from "../create-Cb86Z8Im.js";

package/dist/ai-sdk/index.d.ts

@@ -1,14 +1,24 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D8jDHgsl.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BDS7wc3y.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D4qkEtFz.js";
+import { d as StepUp, o as AgentAdapterOptions, t as AgentPermDock } from "../create-UTnUVETj.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {
   readonly runtimeContext?: unknown;
   readonly permdockApproval?: string;
   readonly [key: string]: unknown;
 };
-type AiSdkPermDockOptions<TUser = unknown> = AgentAdapterOptions<AiSdkContext, TUser>;
+type AiSdkPermDockOptions<TUser = unknown> = AgentAdapterOptions<AiSdkContext, TUser> & {
+  /**
+   * Turns a denial the user can lift into `user-approval`: a missing
+   * step-up authentication, or a role the user is eligible to activate.
+   * The re-check decides again and runs the tool only when granted. `at` is
+   * the page the user signs in again at; `acr_values` and `max_age` are added.
+   */
+  readonly stepUp?: {
+    readonly at?: string;
+  };
+};
 /** What an AI SDK tool approval function may return; `undefined` is `not-applicable`. */
 type ToolApprovalResult = ToolApprovalStatus | undefined | "not-applicable" | "denied" | "user-approval" | {
   readonly type: "not-applicable";
@@ -31,6 +41,11 @@ type ToolApprovalStatus = "approved" | {
   readonly type: "user-approval";
   readonly reason: string;
   readonly token: string;
+} | {
+  readonly type: "user-approval";
+  readonly reason: string;
+  /** What the user does before approving; there is no approval request in the store. */
+  readonly stepUp: StepUp;
 };
 /** Structural `GenericToolApprovalFunction` options from `ai`. */
 type ToolApprovalCall = {
@@ -87,4 +102,4 @@ type AiSdkPermDock<V extends PolicyVocabulary = PolicyVocabulary> = AgentPermDoc
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: AiSdkPermDockOptions<TUser>): AiSdkPermDock<V>;
 //#endregion
-export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, DeniedText, DeniedTextEvent, LanguageModelMiddleware, NeedsApprovalOptions, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };
+export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, DeniedText, DeniedTextEvent, LanguageModelMiddleware, NeedsApprovalOptions, StepUp, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };

package/dist/ai-sdk/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
-import { t as approvalTokenOf } from "../kernel-5JatXyND.js";
-import { t as agentRuntime } from "../create-C3b4B5eF.js";
+import { l as withApp } from "../permdock-BfWEeMqk.js";
+import { r as stepUpText, t as approvalTokenOf } from "../kernel-DVExUwkp.js";
+import { t as agentRuntime } from "../create-Cb86Z8Im.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",
@@ -77,7 +77,8 @@ function modelDenied(decision, modelId, permission, permdock) {
 }
 function createPermDock(policy, given) {
 	const options = withApp(policy, given);
-	const { agent, kernel } = agentRuntime(policy, options, "ai-sdk");
+	const stepUp = options.stepUp;
+	const { agent, kernel } = agentRuntime(policy, options, "ai-sdk", { stepUp: stepUp !== void 0 });
 	const byPermission = /* @__PURE__ */ new Map();
 	for (const [name, binding] of Object.entries(options.operations)) byPermission.set(binding.permission.key, name);
 	const passes = (toolName) => options.unmapped === "allow" && !Object.hasOwn(options.operations, toolName);
@@ -87,11 +88,16 @@ function createPermDock(policy, given) {
 		const context = contextOf(call);
 		const verdict = await decide(call.toolCall.toolName, call.toolCall.input, context);
 		if (verdict.outcome === "granted") return "approved";
-		if (verdict.outcome === "denied") return {
+		const recheck = isRecheck(call.messages, call.toolCall.toolCallId);
+		if (verdict.outcome === "denied") return verdict.stepUp !== void 0 && verdict.permission !== void 0 && !recheck ? {
+			type: "user-approval",
+			reason: stepUpText(verdict.stepUp, verdict.permission, stepUp?.at),
+			stepUp: verdict.stepUp
+		} : {
 			type: "denied",
 			reason: verdict.reason
 		};
-		if (isRecheck(call.messages, call.toolCall.toolCallId)) return {
+		if (recheck) return {
 			type: "denied",
 			reason: `${verdict.summary} No approval is recorded for this call.`
 		};
@@ -117,7 +123,7 @@ function createPermDock(policy, given) {
 				}, modelId, Object.hasOwn(options.models, modelId) ? options.models[modelId] : void 0, await kernel.instance(context));
 			}
 			if (params.tools === void 0) return params;
-			const allowed = await kernel.allowedToolNames(context);
+			const allowed = await kernel.allowedToolNames(context, { eligible: stepUp !== void 0 });
 			const keeps = (name) => typeof name === "string" && (allowed.has(name) || passes(name));
 			const tools = params.tools.filter((tool) => keeps(tool.name));
 			const choice = params.toolChoice;
@@ -140,8 +146,12 @@ function createPermDock(policy, given) {
 		}, permission, await kernel.instance(context));
 		const verdict = await decide(toolName, input, context);
 		if (verdict.outcome === "granted") return false;
-		if (verdict.outcome === "denied") throw deniedError(verdict, permission, await kernel.instance(context));
-		if (isRecheck(needsOptions.messages, needsOptions.toolCallId)) throw new PermDockApprovalRequiredError({
+		const recheck = isRecheck(needsOptions.messages, needsOptions.toolCallId);
+		if (verdict.outcome === "denied") {
+			if (verdict.stepUp !== void 0 && !recheck) return true;
+			throw deniedError(verdict, permission, await kernel.instance(context));
+		}
+		if (recheck) throw new PermDockApprovalRequiredError({
 			decision: verdict.decision,
 			permission: permission.key,
 			scope: permission.scope,

package/dist/{approval-prompt-Djo_PyZc.d.ts → approval-prompt-K0faOLFp.d.ts}

@@ -1,5 +1,5 @@
-import { s as OperationMeta, t as Operation } from "./operations-CxybZErY.js";
-import { u as ApprovalRequest } from "./types-CCpc2Dcv.js";
+import { s as OperationMeta, t as Operation } from "./operations-BNLes61x.js";
+import { u as ApprovalRequest } from "./types-DC44-hqb.js";
 //#region src/delivery/approval-prompt.d.ts
 /**
  * What an email or chat prompt shows an approver, wire format v1. It carries

package/dist/approvals/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-CCpc2Dcv.js";
+import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-DC44-hqb.js";
 import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-BWXBMaKK.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-_sHy8BQf.js";
-import { $ as AccessReviewVerdict, A as APPROVAL_REQUEST_SCHEMA, B as matchDelegation, C as ApproverRelationsOptions, D as SignApprovalOptions, E as ApprovalSignatureEntry, F as IdempotencyStore, G as pageAccessReviewItems, H as parseApprovalDelegation, I as IdempotentResponse, J as StartAccessReviewInput, K as AccessReviewHolder, L as memoryIdempotencyStore, M as ApprovalView, N as ApprovalsHandlerOptions, O as approvalSignatureClaims, P as approvalsHandler, Q as isAccessReviewError, R as ApprovalDelegationMatch, S as vouchApproval, T as ApprovalSignatureClaims, U as MemoryAccessReviewStore, V as memoryApprovalDelegationSource, W as memoryAccessReviewStore, X as AccessReviewError, Y as startAccessReview, Z as AccessReviewErrorCode, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, et as accessReviewerEligible, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, j as parseApprovalRequest, k as signApproval, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, nt as AccessReviewsHandlerOptions, o as ApprovalCursorPosition, p as consumeApproval, q as AccessReviewOptions, r as assertApprover, rt as accessReviewsHandler, s as approvalPageSize, t as MemoryApprovalStore, tt as decideAccessReviewItem, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as MatchDelegationOptions } from "../index-CxGUswIC.js";
-export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyStore, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-CfiKC5aN.js";
+import { $ as AccessReviewHolder, A as SignApprovalOptions, B as IdempotentResponse, C as ApproverRelationsOptions, D as approvalView, E as approvalEntityTag, F as ApprovalsHandlerOptions, G as ApprovalDelegationMatch, H as idempotencyRecordKey, I as approvalsHandler, J as memoryApprovalDelegationSource, K as MatchDelegationOptions, L as IdempotencyRecord, M as signApproval, N as APPROVAL_REQUEST_SCHEMA, O as ApprovalSignatureClaims, P as parseApprovalRequest, Q as pageAccessReviewItems, R as IdempotencyStore, S as vouchApproval, T as ApprovalView, U as matchesIdempotencyRecord, V as idempotencyRecord, W as memoryIdempotencyStore, X as MemoryAccessReviewStore, Y as parseApprovalDelegation, Z as memoryAccessReviewStore, _ as resolveApproval, a as approverPermissions, at as isAccessReviewError, b as storedApprovalToken, c as decodeApprovalCursor, ct as decideAccessReviewItem, d as pageApprovals, et as AccessReviewOptions, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, it as AccessReviewErrorCode, j as approvalSignatureClaims, k as ApprovalSignatureEntry, l as encodeApprovalCursor, lt as AccessReviewsHandlerOptions, m as inspectApproval, n as applyApprovalVerdict, nt as startAccessReview, o as ApprovalCursorPosition, ot as AccessReviewVerdict, p as consumeApproval, q as matchDelegation, r as assertApprover, rt as AccessReviewError, s as approvalPageSize, st as accessReviewerEligible, t as MemoryApprovalStore, tt as StartAccessReviewInput, u as listAllApprovals, ut as accessReviewsHandler, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as IdempotentCall } from "../index-BE8y3moU.js";
+export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyRecord, type IdempotencyStore, type IdempotentCall, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalEntityTag, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalView, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, idempotencyRecord, idempotencyRecordKey, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, matchesIdempotencyRecord, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/approvals/index.js

@@ -1,8 +1,8 @@
 import { a as escalationOpenAt, c as isApprovalError, i as approverRelationKey, n as DEFAULT_APPROVAL_TTL, r as approvalQuorum, s as ApprovalError, t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { a as approvalPageSize, c as listAllApprovals, i as memoryApprovalStore, l as pageApprovals, n as assertApprover, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "../store-4u_hxjWa.js";
-import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-DTcZOzhF.js";
+import { c as decodeApprovalCursor, d as pageApprovals, i as memoryApprovalStore, l as encodeApprovalCursor, n as assertApprover, s as approvalPageSize, t as applyApprovalVerdict, u as listAllApprovals } from "../store-DSP9oGvh.js";
+import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-DY3vXuGs.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "../errors-BDUwg2qC.js";
-import { a as matchDelegation, c as memoryAccessReviewStore, d as accessReviewsHandler, f as accessReviewerEligible, i as memoryIdempotencyStore, l as pageAccessReviewItems, n as approvalSignatureClaims, o as memoryApprovalDelegationSource, p as decideAccessReviewItem, r as signApproval, s as parseApprovalDelegation, t as approvalsHandler, u as startAccessReview } from "../approvals-DJ6Yd5z1.js";
+import { _ as accessReviewerEligible, a as idempotencyRecordKey, c as approvalEntityTag, d as memoryApprovalDelegationSource, f as parseApprovalDelegation, g as accessReviewsHandler, h as startAccessReview, i as idempotencyRecord, l as approvalView, m as pageAccessReviewItems, n as approvalSignatureClaims, o as matchesIdempotencyRecord, p as memoryAccessReviewStore, r as signApproval, s as memoryIdempotencyStore, t as approvalsHandler, u as matchDelegation, v as decideAccessReviewItem } from "../approvals-CMRfsbBh.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
 import { t as parseApprovalRequest } from "../parse-request-D_tUXG6M.js";
-export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, AccessReviewError, ApprovalError, DEFAULT_APPROVAL_TTL, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };
+export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, AccessReviewError, ApprovalError, DEFAULT_APPROVAL_TTL, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalEntityTag, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalView, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, idempotencyRecord, idempotencyRecordKey, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, matchesIdempotencyRecord, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/{approvals-DJ6Yd5z1.js → approvals-CMRfsbBh.js}

@@ -4,16 +4,16 @@ import { a as ownRecord } from "./paths-DXSHAMIa.js";
 import { a as problemType, o as statusProblem } from "./problem-details-cn5X30gZ.js";
 import { a as isId } from "./expiry-D4_YKRKD.js";
 import { d as isoNow, f as nowMillis, g as secondsOf, i as dateAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { c as rootMembershipId } from "./scopes-BHsc-wp-.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
 import { c as isApprovalError, s as ApprovalError } from "./types-DqzsnlSA.js";
-import { a as approvalPageSize, c as listAllApprovals, n as assertApprover, o as decodeApprovalCursor, r as matchesApprovers } from "./store-4u_hxjWa.js";
+import { a as belongsToTenant, c as decodeApprovalCursor, n as assertApprover, o as membershipTenants, r as matchesApprovers, s as approvalPageSize, u as listAllApprovals } from "./store-DSP9oGvh.js";
 import { n as readBodyText } from "./body-text-QcXok_SI.js";
 import { r as hasCredentials } from "./http-BBoKefeS.js";
 import { a as methodNotAllowed, c as problemResponse, d as validationProblem, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
-import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-DTcZOzhF.js";
+import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-DY3vXuGs.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "./errors-BDUwg2qC.js";
 import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
 //#region src/approvals/access-reviews/decide.ts
@@ -521,7 +521,52 @@ async function matchDelegation(request, delegate, options) {
 	}))).find((match) => match !== void 0);
 }
 //#endregion
+//#region src/approvals/entity-tag.ts
+/** The request without its resume `token`; every other field stays. */
+function approvalView(request) {
+	const { token: _token, ...view } = request;
+	return view;
+}
+/**
+* A strong RFC 9110 entity tag: the quoted `sha-256:` digest of
+* `approvalView(request)` as RFC 8785 JSON. A field outside
+* `ApprovalRequest` changes the tag, so hash the stored request as is.
+*/
+function approvalEntityTag(request) {
+	return `"${sha256Digest(canonicalJson(approvalView(request)))}"`;
+}
+//#endregion
 //#region src/approvals/idempotency.ts
+/** How long `approvalsHandler` keeps a response for a repeated `Idempotency-Key`. */
+const IDEMPOTENCY_TTL_MS = 864e5;
+/** The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never cross approvers. */
+function idempotencyRecordKey(principalId, key) {
+	return `${principalId}\n${key}`;
+}
+function fingerprintOf(call) {
+	return `${call.action} ${call.id} ${sha256Digest(call.body)}`;
+}
+/**
+* The record `approvalsHandler` stores after `call` answered `response`:
+* the status, headers and body text, the call's fingerprint, and an expiry
+* 24 hours after `now` (epoch milliseconds, default the clock).
+*/
+async function idempotencyRecord(input) {
+	return {
+		key: idempotencyRecordKey(input.principalId, input.key),
+		response: {
+			fingerprint: fingerprintOf(input.call),
+			status: input.response.status,
+			headers: [...input.response.headers.entries()],
+			body: await input.response.clone().text()
+		},
+		expiresAt: (input.now ?? nowMillis()) + IDEMPOTENCY_TTL_MS
+	};
+}
+/** Whether a stored response came from the same call: a reused key with another call is refused with `422`. */
+function matchesIdempotencyRecord(response, call) {
+	return response.fingerprint === fingerprintOf(call);
+}
 /** An in-process `IdempotencyStore`, for one instance and for tests. */
 function memoryIdempotencyStore() {
 	const entries = /* @__PURE__ */ new Map();
@@ -588,7 +633,6 @@ function signApproval(request, signer, options = {}) {
 }
 //#endregion
 //#region src/approvals/handler.ts
-const IDEMPOTENCY_TTL_MS = 864e5;
 const MAX_IDEMPOTENCY_KEY_LENGTH = 256;
 function problem(status, detail) {
 	return problemResponse(statusProblem(status, detail));
@@ -602,14 +646,6 @@ function json(status, body, headers = {}) {
 		}
 	});
 }
-function viewOf(request) {
-	const { token: _token, ...view } = request;
-	return view;
-}
-/** A strong RFC 9110 entity tag: the `sha-256:` digest of the view's RFC 8785 JSON. */
-function entityTag(request) {
-	return `"${sha256Digest(canonicalJson(viewOf(request)))}"`;
-}
 function entityTags(field) {
 	return field.split(",").map((tag) => tag.trim()).filter((tag) => tag !== "");
 }
@@ -619,7 +655,7 @@ function ifMatchFails(request, current) {
 	if (field === null) return false;
 	const tags = entityTags(field);
 	if (tags.includes("*")) return false;
-	return !tags.includes(entityTag(current));
+	return !tags.includes(approvalEntityTag(current));
 }
 /** RFC 9110 section 13.1.2: weak comparison. */
 function ifNoneMatchHolds(request, etag) {
@@ -702,20 +738,6 @@ async function resolveSubject(request, resolve) {
 		return null;
 	}
 }
-function membershipTenants(subject) {
-	const principal = subject.principal;
-	if (principal === null) return [];
-	const tenants = /* @__PURE__ */ new Set();
-	if (principal.tenant !== void 0) tenants.add(principal.tenant);
-	for (const membership of principal.memberships ?? []) {
-		const tenant = rootMembershipId(membership);
-		if (tenant !== void 0) tenants.add(tenant);
-	}
-	return [...tenants];
-}
-function belongsToTenant(subject, tenant) {
-	return membershipTenants(subject).includes(tenant);
-}
 async function factsFor(request, subject, options) {
 	return {
 		relations: await approverRelations(request, subject, options),
@@ -865,14 +887,6 @@ function idempotencyKey(request) {
 	if (key === void 0 || key === "" || key.length > MAX_IDEMPOTENCY_KEY_LENGTH || /["\\]/u.test(key)) return { refusal: validationProblem("Idempotency-Key must be a quoted string of 1 to 256 characters") };
 	return { key };
 }
-async function stored(response, fingerprint) {
-	return {
-		fingerprint,
-		status: response.status,
-		headers: [...response.headers.entries()],
-		body: await response.clone().text()
-	};
-}
 function approvalsHandler(store, options) {
 	const requireDistinct = options.requireDistinctApprover === true;
 	const idempotency = options.idempotency ?? memoryIdempotencyStore();
@@ -898,8 +912,8 @@ function approvalsHandler(store, options) {
 				permissions: acting.permissions
 			} : void 0
 		}));
-		return json(200, viewOf(resolved), {
-			ETag: entityTag(resolved),
+		return json(200, approvalView(resolved), {
+			ETag: approvalEntityTag(resolved),
 			...options.signer !== void 0 && resolved.status === "approved" ? signatureLink(url) : {}
 		});
 	};
@@ -933,7 +947,7 @@ function approvalsHandler(store, options) {
 						return (tenant === void 0 ? scoped.tenantless : tenants.has(tenant)) && await mayResolve(item, subject, requireDistinct, options);
 					}));
 					return json(200, compact({
-						items: page.items.filter((_, index) => eligible[index] === true).map(viewOf),
+						items: page.items.filter((_, index) => eligible[index] === true).map(approvalView),
 						next: page.next
 					}), nextLink(url, page.next));
 				}
@@ -943,19 +957,19 @@ function approvalsHandler(store, options) {
 						principalId: principal.id
 					});
 					return json(200, compact({
-						items: page.items.map(viewOf),
+						items: page.items.map(approvalView),
 						next: page.next
 					}), nextLink(url, page.next));
 				}
 				case "get": {
 					const current = await visible(route.id, subject);
 					if (current === null) return problem(404, "approval was not found");
-					const etag = entityTag(current);
+					const etag = approvalEntityTag(current);
 					if (ifNoneMatchHolds(request, etag)) return new Response(null, {
 						status: 304,
 						headers: { ETag: etag }
 					});
-					return json(200, viewOf(current), { ETag: etag });
+					return json(200, approvalView(current), { ETag: etag });
 				}
 				case "signature": {
 					const current = await findById(store, route.id);
@@ -973,15 +987,27 @@ function approvalsHandler(store, options) {
 					const read = await readNote(request);
 					if (read.refusal !== void 0) return read.refusal;
 					if (keyed.key === void 0) return await resolve(request, url, route, subject, read);
-					const key = `${principal.id}\n${keyed.key}`;
-					const fingerprint = `${route.kind} ${route.id} ${sha256Digest(read.text)}`;
+					const call = {
+						action: route.kind,
+						id: route.id,
+						body: read.text
+					};
+					const key = idempotencyRecordKey(principal.id, keyed.key);
 					const replay = await idempotency.get(key);
-					if (replay !== void 0) return replay.fingerprint === fingerprint ? new Response(replay.body, {
+					if (replay !== void 0) return matchesIdempotencyRecord(replay, call) ? new Response(replay.body, {
 						status: replay.status,
 						headers: replay.headers.map(([name, value]) => [name, value])
 					}) : problem(422, "Idempotency-Key was used for another request");
 					const response = await resolve(request, url, route, subject, read);
-					if (response.ok) await idempotency.set(key, await stored(response, fingerprint), nowMillis() + IDEMPOTENCY_TTL_MS);
+					if (response.ok) {
+						const record = await idempotencyRecord({
+							principalId: principal.id,
+							key: keyed.key,
+							call,
+							response
+						});
+						await idempotency.set(record.key, record.response, record.expiresAt);
+					}
 					return response;
 				}
 				default: return problem(404, `unknown approvals route ${String(route)}`);
@@ -992,4 +1018,4 @@ function approvalsHandler(store, options) {
 	};
 }
 //#endregion
-export { matchDelegation as a, memoryAccessReviewStore as c, accessReviewsHandler as d, accessReviewerEligible as f, memoryIdempotencyStore as i, pageAccessReviewItems as l, approvalSignatureClaims as n, memoryApprovalDelegationSource as o, decideAccessReviewItem as p, signApproval as r, parseApprovalDelegation as s, approvalsHandler as t, startAccessReview as u };
+export { accessReviewerEligible as _, idempotencyRecordKey as a, approvalEntityTag as c, memoryApprovalDelegationSource as d, parseApprovalDelegation as f, accessReviewsHandler as g, startAccessReview as h, idempotencyRecord as i, approvalView as l, pageAccessReviewItems as m, approvalSignatureClaims as n, matchesIdempotencyRecord as o, memoryAccessReviewStore as p, signApproval as r, memoryIdempotencyStore as s, approvalsHandler as t, matchDelegation as u, decideAccessReviewItem as v };

package/dist/{arazzo-B6lebmiQ.js → arazzo-ClrF3PVb.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, u as permissionsFlag } from "./flags-C3DktBDY.js";
+import { c as given, u as permissionsFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/arazzo.ts
 const check = defineLeaf({
 	flags: {
@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-BWhNF-k0.js")).runArazzo({
+		return (await import("./arazzo-rdeJ8n1J.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/{arazzo-BWhNF-k0.js → arazzo-rdeJ8n1J.js}

@@ -1,9 +1,9 @@
-import { p as arazzoFindings } from "./src-DLfUWFAI.js";
-import { c as missingInput } from "./errors-CWTY6uih.js";
+import { _ as arazzoFindings } from "./src-DLFrtrrC.js";
+import { c as missingInput } from "./errors-DpP_U6Bf.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
 import { t as ARAZZO_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DxroEzH1.js";
+import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/{args-IIolxxKA.js → args-CC3OwyHW.js}

@@ -1,5 +1,115 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { closest, distance } from "fastest-levenshtein";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+//#region ../../node_modules/.pnpm/fastest-levenshtein@1.0.16/node_modules/fastest-levenshtein/esm/mod.js
+const peq = /* @__PURE__ */ new Uint32Array(65536);
+const myers_32 = (a, b) => {
+	const n = a.length;
+	const m = b.length;
+	const lst = 1 << n - 1;
+	let pv = -1;
+	let mv = 0;
+	let sc = n;
+	let i = n;
+	while (i--) peq[a.charCodeAt(i)] |= 1 << i;
+	for (i = 0; i < m; i++) {
+		let eq = peq[b.charCodeAt(i)];
+		const xv = eq | mv;
+		eq |= (eq & pv) + pv ^ pv;
+		mv |= ~(eq | pv);
+		pv &= eq;
+		if (mv & lst) sc++;
+		if (pv & lst) sc--;
+		mv = mv << 1 | 1;
+		pv = pv << 1 | ~(xv | mv);
+		mv &= xv;
+	}
+	i = n;
+	while (i--) peq[a.charCodeAt(i)] = 0;
+	return sc;
+};
+const myers_x = (b, a) => {
+	const n = a.length;
+	const m = b.length;
+	const mhc = [];
+	const phc = [];
+	const hsize = Math.ceil(n / 32);
+	const vsize = Math.ceil(m / 32);
+	for (let i = 0; i < hsize; i++) {
+		phc[i] = -1;
+		mhc[i] = 0;
+	}
+	let j = 0;
+	for (; j < vsize - 1; j++) {
+		let mv = 0;
+		let pv = -1;
+		const start = j * 32;
+		const vlen = Math.min(32, m) + start;
+		for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] |= 1 << k;
+		for (let i = 0; i < n; i++) {
+			const eq = peq[a.charCodeAt(i)];
+			const pb = phc[i / 32 | 0] >>> i & 1;
+			const mb = mhc[i / 32 | 0] >>> i & 1;
+			const xv = eq | mv;
+			const xh = ((eq | mb) & pv) + pv ^ pv | eq | mb;
+			let ph = mv | ~(xh | pv);
+			let mh = pv & xh;
+			if (ph >>> 31 ^ pb) phc[i / 32 | 0] ^= 1 << i;
+			if (mh >>> 31 ^ mb) mhc[i / 32 | 0] ^= 1 << i;
+			ph = ph << 1 | pb;
+			mh = mh << 1 | mb;
+			pv = mh | ~(xv | ph);
+			mv = ph & xv;
+		}
+		for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] = 0;
+	}
+	let mv = 0;
+	let pv = -1;
+	const start = j * 32;
+	const vlen = Math.min(32, m - start) + start;
+	for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] |= 1 << k;
+	let score = m;
+	for (let i = 0; i < n; i++) {
+		const eq = peq[a.charCodeAt(i)];
+		const pb = phc[i / 32 | 0] >>> i & 1;
+		const mb = mhc[i / 32 | 0] >>> i & 1;
+		const xv = eq | mv;
+		const xh = ((eq | mb) & pv) + pv ^ pv | eq | mb;
+		let ph = mv | ~(xh | pv);
+		let mh = pv & xh;
+		score += ph >>> m - 1 & 1;
+		score -= mh >>> m - 1 & 1;
+		if (ph >>> 31 ^ pb) phc[i / 32 | 0] ^= 1 << i;
+		if (mh >>> 31 ^ mb) mhc[i / 32 | 0] ^= 1 << i;
+		ph = ph << 1 | pb;
+		mh = mh << 1 | mb;
+		pv = mh | ~(xv | ph);
+		mv = ph & xv;
+	}
+	for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] = 0;
+	return score;
+};
+const distance = (a, b) => {
+	if (a.length < b.length) {
+		const tmp = b;
+		b = a;
+		a = tmp;
+	}
+	if (b.length === 0) return a.length;
+	if (a.length <= 32) return myers_32(a, b);
+	return myers_x(a, b);
+};
+const closest = (str, arr) => {
+	let min_distance = Infinity;
+	let min_index = 0;
+	for (let i = 0; i < arr.length; i++) {
+		const dist = distance(str, arr[i]);
+		if (dist < min_distance) {
+			min_distance = dist;
+			min_index = i;
+		}
+	}
+	return arr[min_index];
+};
+//#endregion
 //#region src/cli/core/context.ts
 /** Flags every command accepts, read from anywhere before `--`. */
 const GLOBAL_FLAGS = {

package/dist/astro/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as OperationInput, t as Operation } from "../operations-BNLes61x.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
 import { APIContext, MiddlewareHandler } from "astro";
 //#region src/astro/create.d.ts
 type AstroPermDockOptions<TUser = unknown> = FetchAdapterOptions<APIContext, TUser>;