permdock 0.6.0 → 0.8.0

package/README.md

@@ -151,9 +151,7 @@ The same hook names exist in React Native, Vue, Svelte and Solid. Read [building
 import { createPermDock } from "permdock/next";
 
 export const { getPermDock, requirePermission, permdockHandler } =
-  createPermDock(policy, {
-    subject: async () => getUser(await cookies()),
-  });
+  createPermDock(policy, { subject: async () => getUser(await cookies()) });
 
 // in a page or Server Action
 await requirePermission(permissions.post.update, post); // forbidden() / unauthorized() on a denial
@@ -306,6 +304,7 @@ React Router loaders call `getSnapshot(request)` from `permdock/server` and send
 - Fail-closed: an unknown, invalid or thrown check denies, and `can()` never throws.
 - Deny overrides allow, an unknown reference is a type error, and evaluation is prototype-safe with no eval.
 - `service_role` is never emitted, a model-supplied subject is never trusted, and an agent with no delegation is denied.
+- The generated Supabase token hook and the functions it calls for `supabase.hook.claims` and `supabase.hook.before` are revoked from `public`, `anon` and `authenticated`, so no client reads another user's claims.
 - No one approves their own request by default, a delegate is held to the same rule as the person they cover, there is never a default tenant, and data is validated against the resource schema unless the caller marks a row it loaded `trusted: true`.
 - A user or service API key expires unless the tenant sets `allowNoExpiry`. A feed key (`pdfeed_`) does not expire; rotation replaces the secret and keeps the id, and the key is bound to one resource.
 - Authentication stays upstream: PermDock consumes verified sessions, JWKS-verified JWTs (`permdock/jwt`, with `jose` as an optional peer), provider claims and MCP `authInfo`. Core never verifies a token. User-editable fields never become claims: `subjectFromBetterAuth` copies `additionalFields` only through a `schema`. Read [authentication](https://permdock.com/docs/concepts/authentication).

package/dist/{2020-C9VN-x8c.js → 2020-CJbO8Bvz.js}

@@ -1,6 +1,4 @@
-//#region \0rolldown/runtime.js
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
-//#endregion
+import { t as __commonJSMin } from "./rolldown-runtime-C3I60J0A.js";
 //#region ../../node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/a2a/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, Yn as AuthorizationDetail, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { m as ApprovalStore } from "../types-BdtSDbBO.js";
-import { a as ProblemDetails } from "../errors-DH5QEGXh.js";
-import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
+import { $n as AuthorizationDetail, T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { m as ApprovalStore } from "../types-B_tiYvk8.js";
+import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
+import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
 //#region src/a2a/types.d.ts
 type A2aAuth = {
   readonly clientId?: string;
@@ -159,8 +159,8 @@ type A2aPermDock = {
   readonly extendedAgentCard: (auth: A2aAuth) => Promise<A2aAgentCard>;
   readonly protectSkill: (selector: (task: unknown) => string) => (task: unknown, auth: A2aAuth) => Promise<A2aTaskOutcome>;
   /**
-   * Appends an A2A 1.0 signature. `sign` returns a compact JWS over the
-   * RFC 8785 canonical card it is given; the payload is detached.
+   * Appends an A2A 1.0 signature. `sign` returns a compact JWS over the RFC
+   * 8785 canonical card it is given; the payload is detached.
    */
   readonly sign: (card: A2aAgentCard, sign: (payload: string) => Promise<string>) => Promise<A2aAgentCard>;
 };

package/dist/a2a/index.js

@@ -1,14 +1,14 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { t as canonicalJson } from "../canonical-json-BC8_nMTw.js";
-import { t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
+import { t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { a as hasScope, c as withApp, i as challengeScope, o as scopesReaching } from "../permdock-BrAscV28.js";
-import { f as wwwAuthenticate, r as bearerChallenge } from "../problem-CTviyH5L.js";
-import { r as instanceOptions } from "../build-instance-Bu_eDqYw.js";
-import { n as createAgentKernel } from "../kernel-D0NVb1cK.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-L-_I_3zP.js";
+import { p as wwwAuthenticate, r as bearerChallenge } from "../problem-BVLHFK33.js";
+import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
+import { n as createAgentKernel } from "../kernel-C-fYydV2.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {

package/dist/action-result-CL-QCITA.d.ts

@@ -0,0 +1,19 @@
+import { a as ProblemDetails } from "./errors-zi_4T-rx.js";
+//#region src/core/action-result.d.ts
+/** What a `protectAction` action resolves to; both members cross to the client. */
+type ActionResult<T> = {
+  readonly ok: true;
+  readonly value: T;
+} | {
+  readonly ok: false;
+  readonly problem: ProblemDetails;
+};
+/**
+ * The server action: `approval` is the token of a granted approval request,
+ * which resumes an `approval-required` decision.
+ */
+type ProtectedAction<T> = (input: unknown, options?: {
+  readonly approval?: string;
+}) => Promise<ActionResult<T>>;
+//#endregion
+export { ProtectedAction as n, ActionResult as t };

package/dist/{adapter-context-CRhqyzCk.js → adapter-context-CIQpQxbE.js}

@@ -1,6 +1,9 @@
 import { n as isActor } from "./subject-BGoM5o8B.js";
 //#region src/core/adapter-context.ts
-/** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
+/**
+* Resolves an adapter `tenant` option against its framework context; a throw is
+* no tenant.
+*/
 async function tenantScope(option, context) {
 	if (option === void 0 || typeof option === "string") return { tenant: option };
 	try {
@@ -9,7 +12,10 @@ async function tenantScope(option, context) {
 		return { tenant: void 0 };
 	}
 }
-/** Resolves an adapter `actor` option; anything but an `Actor`, or a throw, is no actor. */
+/**
+* Resolves an adapter `actor` option; anything but an `Actor`, or a throw, is
+* no actor.
+*/
 async function actorFrom(option, context) {
 	if (option === void 0) return;
 	try {

package/dist/{adoption-scan-DCYe60Pi.js → adoption-scan-BLs67P1l.js}

@@ -1,5 +1,5 @@
-import { r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
+import { r as listSourceFiles } from "./files-BSjrtIHw.js";
+import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts
@@ -35,9 +35,9 @@ const LEGACY_PATTERNS = [
 	}
 ];
 /**
-* Lines that look like an authorization check written without PermDock:
-* the work left before a permission can be enforced. It reads source text
-* only and runs nothing; a finding is a place to look, not a verdict.
+* Lines that look like an authorization check written without PermDock: the
+* work left before a permission can be enforced. It reads source text only and
+* runs nothing; a finding is a place to look, not a verdict.
 */
 function scanLegacy(options) {
 	const custom = (options.patterns ?? []).map((source) => ({

package/dist/agent/index.d.ts

@@ -1,3 +1,3 @@
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CiFQNuMV.js";
-import { a as createPermDock, c as ModelMap, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-CBMmFie-.js";
-export { type AgentAdapterOptions, type AgentPermDock, type AgentPermDockOptions, type DecideToolOptions, type DeniedText, type DeniedTextEvent, type GatewayOptions, type ModelMap, type OperationVerdict, type ToolBinding, type ToolMap, createPermDock };
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
+import { a as createPermDock, c as ModelMap, d as StepUp, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-BSNrVuxh.js";
+export { type AgentAdapterOptions, type AgentPermDock, type AgentPermDockOptions, type DecideToolOptions, type DeniedText, type DeniedTextEvent, type GatewayOptions, type ModelMap, type OperationVerdict, type StepUp, type ToolBinding, type ToolMap, createPermDock };

package/dist/agent/index.js

@@ -1 +1 @@
-export { n as createPermDock } from "../create-CGm28gyI.js";
+export { n as createPermDock } from "../create-Cq4Uox0f.js";

package/dist/ai-sdk/index.d.ts

@@ -1,15 +1,28 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CiFQNuMV.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
+import { d as StepUp, o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {
   readonly runtimeContext?: unknown;
   readonly permdockApproval?: string;
   readonly [key: string]: unknown;
 };
-type AiSdkPermDockOptions<TUser = unknown> = AgentAdapterOptions<AiSdkContext, TUser>;
-/** What an AI SDK tool approval function may return; `undefined` is `not-applicable`. */
+type AiSdkPermDockOptions<TUser = unknown> = AgentAdapterOptions<AiSdkContext, TUser> & {
+  /**
+   * Turns a denial the user can lift into `user-approval`: a missing step-up
+   * authentication, or a role the user is eligible to activate. The re-check
+   * decides again and runs the tool only when granted. `at` is the page the
+   * user signs in again at; `acr_values` and `max_age` are added.
+   */
+  readonly stepUp?: {
+    readonly at?: string;
+  };
+};
+/**
+ * What an AI SDK tool approval function may return; `undefined` is
+ * `not-applicable`.
+ */
 type ToolApprovalResult = ToolApprovalStatus | undefined | "not-applicable" | "denied" | "user-approval" | {
   readonly type: "not-applicable";
 } | {
@@ -31,6 +44,14 @@ type ToolApprovalStatus = "approved" | {
   readonly type: "user-approval";
   readonly reason: string;
   readonly token: string;
+} | {
+  readonly type: "user-approval";
+  readonly reason: string;
+  /**
+   * What the user does before approving; there is no approval request in
+   * the store.
+   */
+  readonly stepUp: StepUp;
 };
 /** Structural `GenericToolApprovalFunction` options from `ai`. */
 type ToolApprovalCall = {
@@ -78,13 +99,13 @@ type AiSdkPermDock<V extends PolicyVocabulary = PolicyVocabulary> = AgentPermDoc
    */
   readonly composeToolApproval: (app: AppToolApproval) => (call: ToolApprovalCall) => Promise<ToolApprovalResult>;
   /**
-   * Hides tools the subject in `context` can never use, before the model
-   * sees them. With `models`, a call to a model the subject is not granted
-   * throws `PermDockDeniedError` before the provider is called.
+   * Hides tools the subject in `context` can never use, before the model sees
+   * them. With `models`, a call to a model the subject is not granted throws
+   * `PermDockDeniedError` before the provider is called.
    */
   readonly capabilityMiddleware: (context: AiSdkContext) => LanguageModelMiddleware;
   readonly needsApproval: (permission: Permission) => (input: unknown, options?: NeedsApprovalOptions) => Promise<boolean>;
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: AiSdkPermDockOptions<TUser>): AiSdkPermDock<V>;
 //#endregion
-export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, DeniedText, DeniedTextEvent, LanguageModelMiddleware, NeedsApprovalOptions, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };
+export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, DeniedText, DeniedTextEvent, LanguageModelMiddleware, NeedsApprovalOptions, StepUp, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };

package/dist/ai-sdk/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
-import { t as approvalTokenOf } from "../kernel-D0NVb1cK.js";
-import { t as agentRuntime } from "../create-CGm28gyI.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { r as stepUpText, t as approvalTokenOf } from "../kernel-C-fYydV2.js";
+import { t as agentRuntime } from "../create-Cq4Uox0f.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",
@@ -30,8 +30,8 @@ function toolContextOf(options) {
 }
 /**
 * Whether `messages` already carry an approval request for `toolCallId`: the
-* SDK is re-checking a call a user approved, and treats any answer other
-* than `denied` as approval.
+* SDK is re-checking a call a user approved, and treats any answer other than
+* `denied` as approval.
 */
 function isRecheck(messages, toolCallId) {
 	if (!Array.isArray(messages) || typeof toolCallId !== "string") return false;
@@ -77,7 +77,8 @@ function modelDenied(decision, modelId, permission, permdock) {
 }
 function createPermDock(policy, given) {
 	const options = withApp(policy, given);
-	const { agent, kernel } = agentRuntime(policy, options, "ai-sdk");
+	const stepUp = options.stepUp;
+	const { agent, kernel } = agentRuntime(policy, options, "ai-sdk", { stepUp: stepUp !== void 0 });
 	const byPermission = /* @__PURE__ */ new Map();
 	for (const [name, binding] of Object.entries(options.operations)) byPermission.set(binding.permission.key, name);
 	const passes = (toolName) => options.unmapped === "allow" && !Object.hasOwn(options.operations, toolName);
@@ -87,11 +88,16 @@ function createPermDock(policy, given) {
 		const context = contextOf(call);
 		const verdict = await decide(call.toolCall.toolName, call.toolCall.input, context);
 		if (verdict.outcome === "granted") return "approved";
-		if (verdict.outcome === "denied") return {
+		const recheck = isRecheck(call.messages, call.toolCall.toolCallId);
+		if (verdict.outcome === "denied") return verdict.stepUp !== void 0 && verdict.permission !== void 0 && !recheck ? {
+			type: "user-approval",
+			reason: stepUpText(verdict.stepUp, verdict.permission, stepUp?.at),
+			stepUp: verdict.stepUp
+		} : {
 			type: "denied",
 			reason: verdict.reason
 		};
-		if (isRecheck(call.messages, call.toolCall.toolCallId)) return {
+		if (recheck) return {
 			type: "denied",
 			reason: `${verdict.summary} No approval is recorded for this call.`
 		};
@@ -117,7 +123,7 @@ function createPermDock(policy, given) {
 				}, modelId, Object.hasOwn(options.models, modelId) ? options.models[modelId] : void 0, await kernel.instance(context));
 			}
 			if (params.tools === void 0) return params;
-			const allowed = await kernel.allowedToolNames(context);
+			const allowed = await kernel.allowedToolNames(context, { eligible: stepUp !== void 0 });
 			const keeps = (name) => typeof name === "string" && (allowed.has(name) || passes(name));
 			const tools = params.tools.filter((tool) => keeps(tool.name));
 			const choice = params.toolChoice;
@@ -140,8 +146,12 @@ function createPermDock(policy, given) {
 		}, permission, await kernel.instance(context));
 		const verdict = await decide(toolName, input, context);
 		if (verdict.outcome === "granted") return false;
-		if (verdict.outcome === "denied") throw deniedError(verdict, permission, await kernel.instance(context));
-		if (isRecheck(needsOptions.messages, needsOptions.toolCallId)) throw new PermDockApprovalRequiredError({
+		const recheck = isRecheck(needsOptions.messages, needsOptions.toolCallId);
+		if (verdict.outcome === "denied") {
+			if (verdict.stepUp !== void 0 && !recheck) return true;
+			throw deniedError(verdict, permission, await kernel.instance(context));
+		}
+		if (recheck) throw new PermDockApprovalRequiredError({
 			decision: verdict.decision,
 			permission: permission.key,
 			scope: permission.scope,

package/dist/{app-data-MuyzVqX8.js → app-data-UNNm07jV.js}

@@ -1,8 +1,11 @@
-import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { i as validateSync } from "./thenable-yD7SabqG.js";
+import { t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { i as validateSync } from "./thenable-BNSM1U2R.js";
 //#region src/core/app-data.ts
 const MAX_META_DEPTH = 8;
-/** Throws unless `value` is plain, prototype-safe JSON at most eight levels deep. */
+/**
+* Throws unless `value` is plain, prototype-safe JSON at most eight levels
+* deep.
+*/
 function assertMetaValue(value, label, depth = 0) {
 	if (depth > MAX_META_DEPTH) throw new Error(`PermDock: ${label} nests deeper than ${MAX_META_DEPTH}`);
 	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return;
@@ -33,8 +36,8 @@ function runSchema(schema, value) {
 	};
 }
 /**
-* Checks code-declared app data: plain JSON, then the schema when one is
-* given. Throws on failure, because a bad definition is an author error.
+* Checks code-declared app data: plain JSON, then the schema when one is given.
+* Throws on failure, because a bad definition is an author error.
 */
 function parseAppData(schema, value, label) {
 	assertAppData(value, label);
@@ -46,8 +49,8 @@ function parseAppData(schema, value, label) {
 }
 /**
 * Checks app data read from a source (a membership, a stored custom role).
-* Never throws: `undefined` means the value is dropped, and the caller
-* reports it.
+* Never throws: `undefined` means the value is dropped, and the caller reports
+* it.
 */
 function readAppData(schema, value) {
 	try {

package/dist/{approval-header-CJACtHkv.js → approval-header-8QV6MU4H.js}

@@ -6,15 +6,18 @@
 const SF_TOKEN = /^[A-Za-z*][!#$%&'*+\-.^_`|~0-9A-Za-z:/]*$/u;
 /**
 * The token a `PermDock-Approval` field value carries, or `undefined` for
-* anything but a single sf-token Item without parameters. Leading and
-* trailing spaces are discarded as RFC 9651 section 4.2 parses them.
+* anything but a single sf-token Item without parameters. Leading and trailing
+* spaces are discarded as RFC 9651 section 4.2 parses them.
 */
 function parseApprovalHeader(value) {
 	if (value === null) return;
 	const item = value.replaceAll(/^ +| +$/gu, "");
 	return SF_TOKEN.test(item) ? item : void 0;
 }
-/** The `PermDock-Approval` field value for `token`; a `TypeError` for a token that is not an sf-token. */
+/**
+* The `PermDock-Approval` field value for `token`; a `TypeError` for a token
+* that is not an sf-token.
+*/
 function approvalHeaderValue(token) {
 	if (!SF_TOKEN.test(token)) throw new TypeError("PermDock: a PermDock-Approval token must be an RFC 9651 sf-token");
 	return token;

package/dist/{approval-prompt-Dg5LeAcT.js → approval-prompt-B8hQY69x.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 //#region src/delivery/approval-prompt.ts
 /**
-* The prompt for a pending request. Throws a `TypeError` for a request that
-* is not pending: a resolved or expired request has nothing to approve.
+* The prompt for a pending request. Throws a `TypeError` for a request that is
+* not pending: a resolved or expired request has nothing to approve.
 */
 function approvalPrompt(request, options = {}) {
 	if (request.status !== "pending") throw new TypeError(`PermDock: approvalPrompt needs a pending request, got ${request.status}`);
@@ -39,9 +39,8 @@ function approvalPrompt(request, options = {}) {
 	}));
 }
 /**
-* The approval page URL for `prompt`. A string or `URL` is a base the
-* encoded request id is appended to. Throws a `TypeError` for a URL that is
-* not https.
+* The approval page URL for `prompt`. A string or `URL` is a base the encoded
+* request id is appended to. Throws a `TypeError` for a URL that is not https.
 */
 function approvalUrlFor(prompt, approvalUrl) {
 	let url;

package/dist/{approval-prompt-DvSSPQJX.d.ts → approval-prompt-PYagyQUj.d.ts}

@@ -1,10 +1,10 @@
-import { s as OperationMeta, t as Operation } from "./operations-X0VM7F3m.js";
-import { u as ApprovalRequest } from "./types-BdtSDbBO.js";
+import { s as OperationMeta, t as Operation } from "./operations-Ci_rT6Uo.js";
+import { u as ApprovalRequest } from "./types-B_tiYvk8.js";
 //#region src/delivery/approval-prompt.d.ts
 /**
- * What an email or chat prompt shows an approver, wire format v1. It carries
- * no approval token and no roles: a prompt links to the app's approval page,
- * where the signed-in approver decides. A link never approves.
+ * What an email or chat prompt shows an approver, wire format v1. It carries no
+ * approval token and no roles: a prompt links to the app's approval page, where
+ * the signed-in approver decides. A link never approves.
  */
 type ApprovalPrompt = {
   readonly v: 1;
@@ -38,19 +38,21 @@ type ApprovalPrompt = {
     readonly effects?: OperationMeta["effects"];
   };
 };
-/** The approval page for a prompt: a base URL the request id is appended to, or a function of the prompt. */
+/**
+ * The approval page for a prompt: a base URL the request id is appended to, or
+ * a function of the prompt.
+ */
 type ApprovalUrl = string | URL | ((prompt: ApprovalPrompt) => string | URL);
 /**
- * The prompt for a pending request. Throws a `TypeError` for a request that
- * is not pending: a resolved or expired request has nothing to approve.
+ * The prompt for a pending request. Throws a `TypeError` for a request that is
+ * not pending: a resolved or expired request has nothing to approve.
  */
 declare function approvalPrompt(request: ApprovalRequest, options?: {
   readonly operation?: Pick<Operation, "name" | "meta">;
 }): ApprovalPrompt;
 /**
- * The approval page URL for `prompt`. A string or `URL` is a base the
- * encoded request id is appended to. Throws a `TypeError` for a URL that is
- * not https.
+ * The approval page URL for `prompt`. A string or `URL` is a base the encoded
+ * request id is appended to. Throws a `TypeError` for a URL that is not https.
  */
 declare function approvalUrlFor(prompt: ApprovalPrompt, approvalUrl: ApprovalUrl): string;
 //#endregion

package/dist/approvals/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-BdtSDbBO.js";
-import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-BWXBMaKK.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-C_IiEs64.js";
-import { $ as AccessReviewVerdict, A as APPROVAL_REQUEST_SCHEMA, B as matchDelegation, C as ApproverRelationsOptions, D as SignApprovalOptions, E as ApprovalSignatureEntry, F as IdempotencyStore, G as pageAccessReviewItems, H as parseApprovalDelegation, I as IdempotentResponse, J as StartAccessReviewInput, K as AccessReviewHolder, L as memoryIdempotencyStore, M as ApprovalView, N as ApprovalsHandlerOptions, O as approvalSignatureClaims, P as approvalsHandler, Q as isAccessReviewError, R as ApprovalDelegationMatch, S as vouchApproval, T as ApprovalSignatureClaims, U as MemoryAccessReviewStore, V as memoryApprovalDelegationSource, W as memoryAccessReviewStore, X as AccessReviewError, Y as startAccessReview, Z as AccessReviewErrorCode, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, et as accessReviewerEligible, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, j as parseApprovalRequest, k as signApproval, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, nt as AccessReviewsHandlerOptions, o as ApprovalCursorPosition, p as consumeApproval, q as AccessReviewOptions, r as assertApprover, rt as accessReviewsHandler, s as approvalPageSize, t as MemoryApprovalStore, tt as decideAccessReviewItem, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as MatchDelegationOptions } from "../index-C-6Letxg.js";
-export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyStore, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };
+import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-B_tiYvk8.js";
+import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-CHwoRRpB.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-B2mlGuhW.js";
+import { $ as AccessReviewHolder, A as SignApprovalOptions, B as IdempotentResponse, C as ApproverRelationsOptions, D as approvalView, E as approvalEntityTag, F as ApprovalsHandlerOptions, G as ApprovalDelegationMatch, H as idempotencyRecordKey, I as approvalsHandler, J as memoryApprovalDelegationSource, K as MatchDelegationOptions, L as IdempotencyRecord, M as signApproval, N as APPROVAL_REQUEST_SCHEMA, O as ApprovalSignatureClaims, P as parseApprovalRequest, Q as pageAccessReviewItems, R as IdempotencyStore, S as vouchApproval, T as ApprovalView, U as matchesIdempotencyRecord, V as idempotencyRecord, W as memoryIdempotencyStore, X as MemoryAccessReviewStore, Y as parseApprovalDelegation, Z as memoryAccessReviewStore, _ as resolveApproval, a as approverPermissions, at as isAccessReviewError, b as storedApprovalToken, c as decodeApprovalCursor, ct as decideAccessReviewItem, d as pageApprovals, et as AccessReviewOptions, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, it as AccessReviewErrorCode, j as approvalSignatureClaims, k as ApprovalSignatureEntry, l as encodeApprovalCursor, lt as AccessReviewsHandlerOptions, m as inspectApproval, n as applyApprovalVerdict, nt as startAccessReview, o as ApprovalCursorPosition, ot as AccessReviewVerdict, p as consumeApproval, q as matchDelegation, r as assertApprover, rt as AccessReviewError, s as approvalPageSize, st as accessReviewerEligible, t as MemoryApprovalStore, tt as StartAccessReviewInput, u as listAllApprovals, ut as accessReviewsHandler, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as IdempotentCall } from "../index-_9UiQIkt.js";
+export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyRecord, type IdempotencyStore, type IdempotentCall, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalEntityTag, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalView, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, idempotencyRecord, idempotencyRecordKey, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, matchesIdempotencyRecord, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/approvals/index.js

@@ -1,8 +1,8 @@
-import { a as escalationOpenAt, c as isApprovalError, i as approverRelationKey, n as DEFAULT_APPROVAL_TTL, r as approvalQuorum, s as ApprovalError, t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { a as approvalPageSize, c as listAllApprovals, i as memoryApprovalStore, l as pageApprovals, n as assertApprover, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "../store-BDutJkDL.js";
-import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-CBYVMjwh.js";
+import { a as escalationOpenAt, c as isApprovalError, i as approverRelationKey, n as DEFAULT_APPROVAL_TTL, r as approvalQuorum, s as ApprovalError, t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
+import { c as decodeApprovalCursor, d as pageApprovals, i as memoryApprovalStore, l as encodeApprovalCursor, n as assertApprover, s as approvalPageSize, t as applyApprovalVerdict, u as listAllApprovals } from "../store-RNFvaJJv.js";
+import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-DJicaG6f.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "../errors-BDUwg2qC.js";
-import { a as matchDelegation, c as memoryAccessReviewStore, d as accessReviewsHandler, f as accessReviewerEligible, i as memoryIdempotencyStore, l as pageAccessReviewItems, n as approvalSignatureClaims, o as memoryApprovalDelegationSource, p as decideAccessReviewItem, r as signApproval, s as parseApprovalDelegation, t as approvalsHandler, u as startAccessReview } from "../approvals-p1PGoVjb.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
-import { t as parseApprovalRequest } from "../parse-request-D_tUXG6M.js";
-export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, AccessReviewError, ApprovalError, DEFAULT_APPROVAL_TTL, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };
+import { _ as accessReviewerEligible, a as idempotencyRecordKey, c as approvalEntityTag, d as memoryApprovalDelegationSource, f as parseApprovalDelegation, g as accessReviewsHandler, h as startAccessReview, i as idempotencyRecord, l as approvalView, m as pageAccessReviewItems, n as approvalSignatureClaims, o as matchesIdempotencyRecord, p as memoryAccessReviewStore, r as signApproval, s as memoryIdempotencyStore, t as approvalsHandler, u as matchDelegation, v as decideAccessReviewItem } from "../approvals-DnIBTuXE.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
+import { t as parseApprovalRequest } from "../parse-request-CwCZpyjV.js";
+export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, AccessReviewError, ApprovalError, DEFAULT_APPROVAL_TTL, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalEntityTag, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalView, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, idempotencyRecord, idempotencyRecordKey, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, matchesIdempotencyRecord, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };