permdock 0.7.0 → 0.8.0

package/README.md

@@ -151,9 +151,7 @@ The same hook names exist in React Native, Vue, Svelte and Solid. Read [building
 import { createPermDock } from "permdock/next";
 
 export const { getPermDock, requirePermission, permdockHandler } =
-  createPermDock(policy, {
-    subject: async () => getUser(await cookies()),
-  });
+  createPermDock(policy, { subject: async () => getUser(await cookies()) });
 
 // in a page or Server Action
 await requirePermission(permissions.post.update, post); // forbidden() / unauthorized() on a denial

package/dist/a2a/index.d.ts

@@ -1,8 +1,8 @@
-import { $n as AuthorizationDetail, T as Policy, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { m as ApprovalStore } from "../types-DC44-hqb.js";
-import { a as ProblemDetails } from "../errors-B_Qg9D3e.js";
-import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
+import { $n as AuthorizationDetail, T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { m as ApprovalStore } from "../types-B_tiYvk8.js";
+import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
+import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
 //#region src/a2a/types.d.ts
 type A2aAuth = {
   readonly clientId?: string;
@@ -159,8 +159,8 @@ type A2aPermDock = {
   readonly extendedAgentCard: (auth: A2aAuth) => Promise<A2aAgentCard>;
   readonly protectSkill: (selector: (task: unknown) => string) => (task: unknown, auth: A2aAuth) => Promise<A2aTaskOutcome>;
   /**
-   * Appends an A2A 1.0 signature. `sign` returns a compact JWS over the
-   * RFC 8785 canonical card it is given; the payload is detached.
+   * Appends an A2A 1.0 signature. `sign` returns a compact JWS over the RFC
+   * 8785 canonical card it is given; the payload is detached.
    */
   readonly sign: (card: A2aAgentCard, sign: (payload: string) => Promise<string>) => Promise<A2aAgentCard>;
 };

package/dist/a2a/index.js

@@ -1,14 +1,14 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
-import { t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
+import { t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BfWEeMqk.js";
-import { f as wwwAuthenticate, r as bearerChallenge } from "../problem-CTviyH5L.js";
-import { r as instanceOptions } from "../build-instance-DxE7czo9.js";
-import { n as createAgentKernel } from "../kernel-DVExUwkp.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-L-_I_3zP.js";
+import { p as wwwAuthenticate, r as bearerChallenge } from "../problem-BVLHFK33.js";
+import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
+import { n as createAgentKernel } from "../kernel-C-fYydV2.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {

package/dist/action-result-CL-QCITA.d.ts

@@ -0,0 +1,19 @@
+import { a as ProblemDetails } from "./errors-zi_4T-rx.js";
+//#region src/core/action-result.d.ts
+/** What a `protectAction` action resolves to; both members cross to the client. */
+type ActionResult<T> = {
+  readonly ok: true;
+  readonly value: T;
+} | {
+  readonly ok: false;
+  readonly problem: ProblemDetails;
+};
+/**
+ * The server action: `approval` is the token of a granted approval request,
+ * which resumes an `approval-required` decision.
+ */
+type ProtectedAction<T> = (input: unknown, options?: {
+  readonly approval?: string;
+}) => Promise<ActionResult<T>>;
+//#endregion
+export { ProtectedAction as n, ActionResult as t };

package/dist/{adapter-context-CRhqyzCk.js → adapter-context-CIQpQxbE.js}

@@ -1,6 +1,9 @@
 import { n as isActor } from "./subject-BGoM5o8B.js";
 //#region src/core/adapter-context.ts
-/** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
+/**
+* Resolves an adapter `tenant` option against its framework context; a throw is
+* no tenant.
+*/
 async function tenantScope(option, context) {
 	if (option === void 0 || typeof option === "string") return { tenant: option };
 	try {
@@ -9,7 +12,10 @@ async function tenantScope(option, context) {
 		return { tenant: void 0 };
 	}
 }
-/** Resolves an adapter `actor` option; anything but an `Actor`, or a throw, is no actor. */
+/**
+* Resolves an adapter `actor` option; anything but an `Actor`, or a throw, is
+* no actor.
+*/
 async function actorFrom(option, context) {
 	if (option === void 0) return;
 	try {

package/dist/{adoption-scan-D-feE7BE.js → adoption-scan-BLs67P1l.js}

@@ -1,5 +1,5 @@
-import { r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
+import { r as listSourceFiles } from "./files-BSjrtIHw.js";
+import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts
@@ -35,9 +35,9 @@ const LEGACY_PATTERNS = [
 	}
 ];
 /**
-* Lines that look like an authorization check written without PermDock:
-* the work left before a permission can be enforced. It reads source text
-* only and runs nothing; a finding is a place to look, not a verdict.
+* Lines that look like an authorization check written without PermDock: the
+* work left before a permission can be enforced. It reads source text only and
+* runs nothing; a finding is a place to look, not a verdict.
 */
 function scanLegacy(options) {
 	const custom = (options.patterns ?? []).map((source) => ({

package/dist/agent/index.d.ts

@@ -1,3 +1,3 @@
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D4qkEtFz.js";
-import { a as createPermDock, c as ModelMap, d as StepUp, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-UTnUVETj.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
+import { a as createPermDock, c as ModelMap, d as StepUp, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-BSNrVuxh.js";
 export { type AgentAdapterOptions, type AgentPermDock, type AgentPermDockOptions, type DecideToolOptions, type DeniedText, type DeniedTextEvent, type GatewayOptions, type ModelMap, type OperationVerdict, type StepUp, type ToolBinding, type ToolMap, createPermDock };

package/dist/agent/index.js

@@ -1 +1 @@
-export { n as createPermDock } from "../create-Cb86Z8Im.js";
+export { n as createPermDock } from "../create-Cq4Uox0f.js";

package/dist/ai-sdk/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D4qkEtFz.js";
-import { d as StepUp, o as AgentAdapterOptions, t as AgentPermDock } from "../create-UTnUVETj.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
+import { d as StepUp, o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {
   readonly runtimeContext?: unknown;
@@ -10,16 +10,19 @@ type AiSdkContext = {
 };
 type AiSdkPermDockOptions<TUser = unknown> = AgentAdapterOptions<AiSdkContext, TUser> & {
   /**
-   * Turns a denial the user can lift into `user-approval`: a missing
-   * step-up authentication, or a role the user is eligible to activate.
-   * The re-check decides again and runs the tool only when granted. `at` is
-   * the page the user signs in again at; `acr_values` and `max_age` are added.
+   * Turns a denial the user can lift into `user-approval`: a missing step-up
+   * authentication, or a role the user is eligible to activate. The re-check
+   * decides again and runs the tool only when granted. `at` is the page the
+   * user signs in again at; `acr_values` and `max_age` are added.
    */
   readonly stepUp?: {
     readonly at?: string;
   };
 };
-/** What an AI SDK tool approval function may return; `undefined` is `not-applicable`. */
+/**
+ * What an AI SDK tool approval function may return; `undefined` is
+ * `not-applicable`.
+ */
 type ToolApprovalResult = ToolApprovalStatus | undefined | "not-applicable" | "denied" | "user-approval" | {
   readonly type: "not-applicable";
 } | {
@@ -44,7 +47,10 @@ type ToolApprovalStatus = "approved" | {
 } | {
   readonly type: "user-approval";
   readonly reason: string;
-  /** What the user does before approving; there is no approval request in the store. */
+  /**
+   * What the user does before approving; there is no approval request in
+   * the store.
+   */
   readonly stepUp: StepUp;
 };
 /** Structural `GenericToolApprovalFunction` options from `ai`. */
@@ -93,9 +99,9 @@ type AiSdkPermDock<V extends PolicyVocabulary = PolicyVocabulary> = AgentPermDoc
    */
   readonly composeToolApproval: (app: AppToolApproval) => (call: ToolApprovalCall) => Promise<ToolApprovalResult>;
   /**
-   * Hides tools the subject in `context` can never use, before the model
-   * sees them. With `models`, a call to a model the subject is not granted
-   * throws `PermDockDeniedError` before the provider is called.
+   * Hides tools the subject in `context` can never use, before the model sees
+   * them. With `models`, a call to a model the subject is not granted throws
+   * `PermDockDeniedError` before the provider is called.
    */
   readonly capabilityMiddleware: (context: AiSdkContext) => LanguageModelMiddleware;
   readonly needsApproval: (permission: Permission) => (input: unknown, options?: NeedsApprovalOptions) => Promise<boolean>;

package/dist/ai-sdk/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { l as withApp } from "../permdock-BfWEeMqk.js";
-import { r as stepUpText, t as approvalTokenOf } from "../kernel-DVExUwkp.js";
-import { t as agentRuntime } from "../create-Cb86Z8Im.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { r as stepUpText, t as approvalTokenOf } from "../kernel-C-fYydV2.js";
+import { t as agentRuntime } from "../create-Cq4Uox0f.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",
@@ -30,8 +30,8 @@ function toolContextOf(options) {
 }
 /**
 * Whether `messages` already carry an approval request for `toolCallId`: the
-* SDK is re-checking a call a user approved, and treats any answer other
-* than `denied` as approval.
+* SDK is re-checking a call a user approved, and treats any answer other than
+* `denied` as approval.
 */
 function isRecheck(messages, toolCallId) {
 	if (!Array.isArray(messages) || typeof toolCallId !== "string") return false;

package/dist/{app-data-MuyzVqX8.js → app-data-UNNm07jV.js}

@@ -1,8 +1,11 @@
-import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { i as validateSync } from "./thenable-yD7SabqG.js";
+import { t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { i as validateSync } from "./thenable-BNSM1U2R.js";
 //#region src/core/app-data.ts
 const MAX_META_DEPTH = 8;
-/** Throws unless `value` is plain, prototype-safe JSON at most eight levels deep. */
+/**
+* Throws unless `value` is plain, prototype-safe JSON at most eight levels
+* deep.
+*/
 function assertMetaValue(value, label, depth = 0) {
 	if (depth > MAX_META_DEPTH) throw new Error(`PermDock: ${label} nests deeper than ${MAX_META_DEPTH}`);
 	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return;
@@ -33,8 +36,8 @@ function runSchema(schema, value) {
 	};
 }
 /**
-* Checks code-declared app data: plain JSON, then the schema when one is
-* given. Throws on failure, because a bad definition is an author error.
+* Checks code-declared app data: plain JSON, then the schema when one is given.
+* Throws on failure, because a bad definition is an author error.
 */
 function parseAppData(schema, value, label) {
 	assertAppData(value, label);
@@ -46,8 +49,8 @@ function parseAppData(schema, value, label) {
 }
 /**
 * Checks app data read from a source (a membership, a stored custom role).
-* Never throws: `undefined` means the value is dropped, and the caller
-* reports it.
+* Never throws: `undefined` means the value is dropped, and the caller reports
+* it.
 */
 function readAppData(schema, value) {
 	try {

package/dist/{approval-header-CJACtHkv.js → approval-header-8QV6MU4H.js}

@@ -6,15 +6,18 @@
 const SF_TOKEN = /^[A-Za-z*][!#$%&'*+\-.^_`|~0-9A-Za-z:/]*$/u;
 /**
 * The token a `PermDock-Approval` field value carries, or `undefined` for
-* anything but a single sf-token Item without parameters. Leading and
-* trailing spaces are discarded as RFC 9651 section 4.2 parses them.
+* anything but a single sf-token Item without parameters. Leading and trailing
+* spaces are discarded as RFC 9651 section 4.2 parses them.
 */
 function parseApprovalHeader(value) {
 	if (value === null) return;
 	const item = value.replaceAll(/^ +| +$/gu, "");
 	return SF_TOKEN.test(item) ? item : void 0;
 }
-/** The `PermDock-Approval` field value for `token`; a `TypeError` for a token that is not an sf-token. */
+/**
+* The `PermDock-Approval` field value for `token`; a `TypeError` for a token
+* that is not an sf-token.
+*/
 function approvalHeaderValue(token) {
 	if (!SF_TOKEN.test(token)) throw new TypeError("PermDock: a PermDock-Approval token must be an RFC 9651 sf-token");
 	return token;

package/dist/{approval-prompt-Dg5LeAcT.js → approval-prompt-B8hQY69x.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 //#region src/delivery/approval-prompt.ts
 /**
-* The prompt for a pending request. Throws a `TypeError` for a request that
-* is not pending: a resolved or expired request has nothing to approve.
+* The prompt for a pending request. Throws a `TypeError` for a request that is
+* not pending: a resolved or expired request has nothing to approve.
 */
 function approvalPrompt(request, options = {}) {
 	if (request.status !== "pending") throw new TypeError(`PermDock: approvalPrompt needs a pending request, got ${request.status}`);
@@ -39,9 +39,8 @@ function approvalPrompt(request, options = {}) {
 	}));
 }
 /**
-* The approval page URL for `prompt`. A string or `URL` is a base the
-* encoded request id is appended to. Throws a `TypeError` for a URL that is
-* not https.
+* The approval page URL for `prompt`. A string or `URL` is a base the encoded
+* request id is appended to. Throws a `TypeError` for a URL that is not https.
 */
 function approvalUrlFor(prompt, approvalUrl) {
 	let url;

package/dist/{approval-prompt-K0faOLFp.d.ts → approval-prompt-PYagyQUj.d.ts}

@@ -1,10 +1,10 @@
-import { s as OperationMeta, t as Operation } from "./operations-BNLes61x.js";
-import { u as ApprovalRequest } from "./types-DC44-hqb.js";
+import { s as OperationMeta, t as Operation } from "./operations-Ci_rT6Uo.js";
+import { u as ApprovalRequest } from "./types-B_tiYvk8.js";
 //#region src/delivery/approval-prompt.d.ts
 /**
- * What an email or chat prompt shows an approver, wire format v1. It carries
- * no approval token and no roles: a prompt links to the app's approval page,
- * where the signed-in approver decides. A link never approves.
+ * What an email or chat prompt shows an approver, wire format v1. It carries no
+ * approval token and no roles: a prompt links to the app's approval page, where
+ * the signed-in approver decides. A link never approves.
  */
 type ApprovalPrompt = {
   readonly v: 1;
@@ -38,19 +38,21 @@ type ApprovalPrompt = {
     readonly effects?: OperationMeta["effects"];
   };
 };
-/** The approval page for a prompt: a base URL the request id is appended to, or a function of the prompt. */
+/**
+ * The approval page for a prompt: a base URL the request id is appended to, or
+ * a function of the prompt.
+ */
 type ApprovalUrl = string | URL | ((prompt: ApprovalPrompt) => string | URL);
 /**
- * The prompt for a pending request. Throws a `TypeError` for a request that
- * is not pending: a resolved or expired request has nothing to approve.
+ * The prompt for a pending request. Throws a `TypeError` for a request that is
+ * not pending: a resolved or expired request has nothing to approve.
  */
 declare function approvalPrompt(request: ApprovalRequest, options?: {
   readonly operation?: Pick<Operation, "name" | "meta">;
 }): ApprovalPrompt;
 /**
- * The approval page URL for `prompt`. A string or `URL` is a base the
- * encoded request id is appended to. Throws a `TypeError` for a URL that is
- * not https.
+ * The approval page URL for `prompt`. A string or `URL` is a base the encoded
+ * request id is appended to. Throws a `TypeError` for a URL that is not https.
  */
 declare function approvalUrlFor(prompt: ApprovalPrompt, approvalUrl: ApprovalUrl): string;
 //#endregion

package/dist/approvals/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-DC44-hqb.js";
-import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-BWXBMaKK.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-CfiKC5aN.js";
-import { $ as AccessReviewHolder, A as SignApprovalOptions, B as IdempotentResponse, C as ApproverRelationsOptions, D as approvalView, E as approvalEntityTag, F as ApprovalsHandlerOptions, G as ApprovalDelegationMatch, H as idempotencyRecordKey, I as approvalsHandler, J as memoryApprovalDelegationSource, K as MatchDelegationOptions, L as IdempotencyRecord, M as signApproval, N as APPROVAL_REQUEST_SCHEMA, O as ApprovalSignatureClaims, P as parseApprovalRequest, Q as pageAccessReviewItems, R as IdempotencyStore, S as vouchApproval, T as ApprovalView, U as matchesIdempotencyRecord, V as idempotencyRecord, W as memoryIdempotencyStore, X as MemoryAccessReviewStore, Y as parseApprovalDelegation, Z as memoryAccessReviewStore, _ as resolveApproval, a as approverPermissions, at as isAccessReviewError, b as storedApprovalToken, c as decodeApprovalCursor, ct as decideAccessReviewItem, d as pageApprovals, et as AccessReviewOptions, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, it as AccessReviewErrorCode, j as approvalSignatureClaims, k as ApprovalSignatureEntry, l as encodeApprovalCursor, lt as AccessReviewsHandlerOptions, m as inspectApproval, n as applyApprovalVerdict, nt as startAccessReview, o as ApprovalCursorPosition, ot as AccessReviewVerdict, p as consumeApproval, q as matchDelegation, r as assertApprover, rt as AccessReviewError, s as approvalPageSize, st as accessReviewerEligible, t as MemoryApprovalStore, tt as StartAccessReviewInput, u as listAllApprovals, ut as accessReviewsHandler, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as IdempotentCall } from "../index-BE8y3moU.js";
+import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-B_tiYvk8.js";
+import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-CHwoRRpB.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-B2mlGuhW.js";
+import { $ as AccessReviewHolder, A as SignApprovalOptions, B as IdempotentResponse, C as ApproverRelationsOptions, D as approvalView, E as approvalEntityTag, F as ApprovalsHandlerOptions, G as ApprovalDelegationMatch, H as idempotencyRecordKey, I as approvalsHandler, J as memoryApprovalDelegationSource, K as MatchDelegationOptions, L as IdempotencyRecord, M as signApproval, N as APPROVAL_REQUEST_SCHEMA, O as ApprovalSignatureClaims, P as parseApprovalRequest, Q as pageAccessReviewItems, R as IdempotencyStore, S as vouchApproval, T as ApprovalView, U as matchesIdempotencyRecord, V as idempotencyRecord, W as memoryIdempotencyStore, X as MemoryAccessReviewStore, Y as parseApprovalDelegation, Z as memoryAccessReviewStore, _ as resolveApproval, a as approverPermissions, at as isAccessReviewError, b as storedApprovalToken, c as decodeApprovalCursor, ct as decideAccessReviewItem, d as pageApprovals, et as AccessReviewOptions, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, it as AccessReviewErrorCode, j as approvalSignatureClaims, k as ApprovalSignatureEntry, l as encodeApprovalCursor, lt as AccessReviewsHandlerOptions, m as inspectApproval, n as applyApprovalVerdict, nt as startAccessReview, o as ApprovalCursorPosition, ot as AccessReviewVerdict, p as consumeApproval, q as matchDelegation, r as assertApprover, rt as AccessReviewError, s as approvalPageSize, st as accessReviewerEligible, t as MemoryApprovalStore, tt as StartAccessReviewInput, u as listAllApprovals, ut as accessReviewsHandler, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as IdempotentCall } from "../index-_9UiQIkt.js";
 export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyRecord, type IdempotencyStore, type IdempotentCall, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalEntityTag, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalView, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, idempotencyRecord, idempotencyRecordKey, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, matchesIdempotencyRecord, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/approvals/index.js

@@ -1,8 +1,8 @@
-import { a as escalationOpenAt, c as isApprovalError, i as approverRelationKey, n as DEFAULT_APPROVAL_TTL, r as approvalQuorum, s as ApprovalError, t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { c as decodeApprovalCursor, d as pageApprovals, i as memoryApprovalStore, l as encodeApprovalCursor, n as assertApprover, s as approvalPageSize, t as applyApprovalVerdict, u as listAllApprovals } from "../store-DSP9oGvh.js";
-import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-DY3vXuGs.js";
+import { a as escalationOpenAt, c as isApprovalError, i as approverRelationKey, n as DEFAULT_APPROVAL_TTL, r as approvalQuorum, s as ApprovalError, t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
+import { c as decodeApprovalCursor, d as pageApprovals, i as memoryApprovalStore, l as encodeApprovalCursor, n as assertApprover, s as approvalPageSize, t as applyApprovalVerdict, u as listAllApprovals } from "../store-RNFvaJJv.js";
+import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-DJicaG6f.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "../errors-BDUwg2qC.js";
-import { _ as accessReviewerEligible, a as idempotencyRecordKey, c as approvalEntityTag, d as memoryApprovalDelegationSource, f as parseApprovalDelegation, g as accessReviewsHandler, h as startAccessReview, i as idempotencyRecord, l as approvalView, m as pageAccessReviewItems, n as approvalSignatureClaims, o as matchesIdempotencyRecord, p as memoryAccessReviewStore, r as signApproval, s as memoryIdempotencyStore, t as approvalsHandler, u as matchDelegation, v as decideAccessReviewItem } from "../approvals-CMRfsbBh.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
-import { t as parseApprovalRequest } from "../parse-request-D_tUXG6M.js";
+import { _ as accessReviewerEligible, a as idempotencyRecordKey, c as approvalEntityTag, d as memoryApprovalDelegationSource, f as parseApprovalDelegation, g as accessReviewsHandler, h as startAccessReview, i as idempotencyRecord, l as approvalView, m as pageAccessReviewItems, n as approvalSignatureClaims, o as matchesIdempotencyRecord, p as memoryAccessReviewStore, r as signApproval, s as memoryIdempotencyStore, t as approvalsHandler, u as matchDelegation, v as decideAccessReviewItem } from "../approvals-DnIBTuXE.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
+import { t as parseApprovalRequest } from "../parse-request-CwCZpyjV.js";
 export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, AccessReviewError, ApprovalError, DEFAULT_APPROVAL_TTL, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalEntityTag, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalView, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, idempotencyRecord, idempotencyRecordKey, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, matchesIdempotencyRecord, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/{approvals-CMRfsbBh.js → approvals-DnIBTuXE.js}

@@ -1,23 +1,26 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { a as problemType, o as statusProblem } from "./problem-details-cn5X30gZ.js";
-import { a as isId } from "./expiry-D4_YKRKD.js";
-import { d as isoNow, f as nowMillis, g as secondsOf, i as dateAt } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { a as problemType, o as statusProblem } from "./problem-details-CLDgX1KV.js";
+import { a as isId } from "./expiry-6XByK0dm.js";
+import { d as isoNow, f as nowMillis, g as secondsOf, i as dateAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { c as rootMembershipId } from "./scopes-BHsc-wp-.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { c as isApprovalError, s as ApprovalError } from "./types-DqzsnlSA.js";
-import { a as belongsToTenant, c as decodeApprovalCursor, n as assertApprover, o as membershipTenants, r as matchesApprovers, s as approvalPageSize, u as listAllApprovals } from "./store-DSP9oGvh.js";
-import { n as readBodyText } from "./body-text-QcXok_SI.js";
-import { r as hasCredentials } from "./http-BBoKefeS.js";
-import { a as methodNotAllowed, c as problemResponse, d as validationProblem, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
-import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-DY3vXuGs.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { c as rootMembershipId } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { c as isApprovalError, s as ApprovalError } from "./types-CcUXciSj.js";
+import { a as belongsToTenant, c as decodeApprovalCursor, n as assertApprover, o as membershipTenants, r as matchesApprovers, s as approvalPageSize, u as listAllApprovals } from "./store-RNFvaJJv.js";
+import { n as readBodyText } from "./body-text-DQhcmqdY.js";
+import { r as hasCredentials } from "./http-DKLXrFGk.js";
+import { d as unauthenticatedProblem, f as validationProblem, l as problemResponse, o as methodNotAllowed } from "./problem-BVLHFK33.js";
+import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-DJicaG6f.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "./errors-BDUwg2qC.js";
-import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
+import { t as bodyTooLarge } from "./body-CJQwYVa8.js";
 //#region src/approvals/access-reviews/decide.ts
-/** Whether `by` is named as a reviewer. A link, a feed or a contact is never a reviewer. */
+/**
+* Whether `by` is named as a reviewer. A link, a feed or a contact is never a
+* reviewer.
+*/
 function accessReviewerEligible(review, by, permissions = [], now) {
 	const principal = by.principal;
 	if (principal === null || principal.kind === "link" || principal.kind === "feed" || principal.kind === "contact") return false;
@@ -27,8 +30,8 @@ function accessReviewerEligible(review, by, permissions = [], now) {
 	});
 }
 /**
-* The decision to persist, or throws. A reviewer cannot decide a holding
-* of their own principal. `holder()` matches only through `permissions`.
+* The decision to persist, or throws. A reviewer cannot decide a holding of
+* their own principal. `holder()` matches only through `permissions`.
 */
 function decideAccessReviewItem(review, item, verdict, at) {
 	const now = dateAt(at);
@@ -57,7 +60,10 @@ function json$1(status, body) {
 		headers: { "content-type": "application/json" }
 	});
 }
-/** The route a path names, the methods it allows, or `undefined` for an unknown path. */
+/**
+* The route a path names, the methods it allows, or `undefined` for an unknown
+* path.
+*/
 function parseRoute$1(url, method) {
 	const parts = url.pathname.replace(/\/+$/u, "").split("/").filter(Boolean);
 	const last = parts.at(-1);
@@ -132,8 +138,8 @@ function mapError$1(error, credentials) {
 }
 /**
 * HTTP for one access-review store: `GET` a review and its items, `POST`
-* `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is
-* not a reviewer and did not open the review gets 404.
+* `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is not
+* a reviewer and did not open the review gets 404.
 */
 function accessReviewsHandler(store, options) {
 	return async (request) => {
@@ -275,9 +281,9 @@ function itemsFrom(reviewId, holders, keys) {
 	return items;
 }
 /**
-* Opens a review of who holds `permissions` in the caller's active tenant.
-* The caller must be signed in. PermDock stores the population and does not
-* revoke anything: the application changes the source, then `markApplied`.
+* Opens a review of who holds `permissions` in the caller's active tenant. The
+* caller must be signed in. PermDock stores the population and does not revoke
+* anything: the application changes the source, then `markApplied`.
 */
 async function startAccessReview(permdock, input, options) {
 	const principal = permdock.subject.principal;
@@ -415,9 +421,9 @@ function stringList(value) {
 	return [...new Set(value)];
 }
 /**
-* A frozen copy of a delegation with only the known fields, or `undefined`
-* when a known field has the wrong type, `until` is not after `from`, or
-* the delegate and the delegator are the same principal.
+* A frozen copy of a delegation with only the known fields, or `undefined` when
+* a known field has the wrong type, `until` is not after `from`, or the
+* delegate and the delegator are the same principal.
 */
 function parseApprovalDelegation(input) {
 	const value = ownRecord(input);
@@ -475,8 +481,8 @@ function covers(entry, request, delegate, tenant, at) {
 	return entry.resources === void 0 || entry.resources.includes(request.resource.type);
 }
 /**
-* The first active delegation under which `delegate` may approve `request`,
-* or `undefined`. The delegator is resolved by `subjectFor` and checked with
+* The first active delegation under which `delegate` may approve `request`, or
+* `undefined`. The delegator is resolved by `subjectFor` and checked with
 * `assertApprover`, so relation and permission approvers use the delegator's
 * facts. A throw, a missing option or a delegator the source does not name
 * matches nobody. The delegator's own delegations are never read.
@@ -529,17 +535,23 @@ function approvalView(request) {
 }
 /**
 * A strong RFC 9110 entity tag: the quoted `sha-256:` digest of
-* `approvalView(request)` as RFC 8785 JSON. A field outside
-* `ApprovalRequest` changes the tag, so hash the stored request as is.
+* `approvalView(request)` as RFC 8785 JSON. A field outside `ApprovalRequest`
+* changes the tag, so hash the stored request as is.
 */
 function approvalEntityTag(request) {
 	return `"${sha256Digest(canonicalJson(approvalView(request)))}"`;
 }
 //#endregion
 //#region src/approvals/idempotency.ts
-/** How long `approvalsHandler` keeps a response for a repeated `Idempotency-Key`. */
+/**
+* How long `approvalsHandler` keeps a response for a repeated
+* `Idempotency-Key`.
+*/
 const IDEMPOTENCY_TTL_MS = 864e5;
-/** The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never cross approvers. */
+/**
+* The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never
+* cross approvers.
+*/
 function idempotencyRecordKey(principalId, key) {
 	return `${principalId}\n${key}`;
 }
@@ -547,9 +559,9 @@ function fingerprintOf(call) {
 	return `${call.action} ${call.id} ${sha256Digest(call.body)}`;
 }
 /**
-* The record `approvalsHandler` stores after `call` answered `response`:
-* the status, headers and body text, the call's fingerprint, and an expiry
-* 24 hours after `now` (epoch milliseconds, default the clock).
+* The record `approvalsHandler` stores after `call` answered `response`: the
+* status, headers and body text, the call's fingerprint, and an expiry 24 hours
+* after `now` (epoch milliseconds, default the clock).
 */
 async function idempotencyRecord(input) {
 	return {
@@ -563,7 +575,10 @@ async function idempotencyRecord(input) {
 		expiresAt: (input.now ?? nowMillis()) + IDEMPOTENCY_TTL_MS
 	};
 }
-/** Whether a stored response came from the same call: a reused key with another call is refused with `422`. */
+/**
+* Whether a stored response came from the same call: a reused key with another
+* call is refused with `422`.
+*/
 function matchesIdempotencyRecord(response, call) {
 	return response.fingerprint === fingerprintOf(call);
 }
@@ -671,8 +686,8 @@ function decodeSegment(segment) {
 	}
 }
 /**
-* The route the path names and the methods it allows. The handler mounts at
-* any prefix, so a path reads from its last segments; a path naming none is
+* The route the path names and the methods it allows. The handler mounts at any
+* prefix, so a path reads from its last segments; a path naming none is
 * `undefined` (`404`).
 */
 function parseRoute(url) {
@@ -744,7 +759,10 @@ async function factsFor(request, subject, options) {
 		permissions: await heldPermissions(request, subject, options.permdockFor)
 	};
 }
-/** The caller as themselves, or the first delegation that makes them an approver. */
+/**
+* The caller as themselves, or the first delegation that makes them an
+* approver.
+*/
 async function actingApprover(request, subject, requireDistinct, options) {
 	const facts = await factsFor(request, subject, options);
 	try {
@@ -792,7 +810,10 @@ function canView(request, subject, requireDistinct, options) {
 	if (request.resolvedBy === principal.id || (request.approvals ?? []).some((item) => item.by === principal.id)) return Promise.resolve(true);
 	return mayResolve(request, subject, requireDistinct, options);
 }
-/** The requester and who answered: the signed approval carries the resume token, so only they read it. */
+/**
+* The requester and who answered: the signed approval carries the resume token,
+* so only they read it.
+*/
 function party(request, principalId) {
 	return request.subject.principal?.id === principalId || request.resolvedBy === principalId || (request.approvals ?? []).some((item) => item.by === principalId);
 }
@@ -833,7 +854,10 @@ function inboxScope(url, subject) {
 }
 const MAX_BODY_BYTES = 16384;
 const MAX_NOTE_LENGTH = 2e3;
-/** An unreadable body is no note; an oversized body or note is refused, never truncated. */
+/**
+* An unreadable body is no note; an oversized body or note is refused, never
+* truncated.
+*/
 async function readNote(request) {
 	if (!(request.headers.get("content-type") ?? "").includes("application/json")) return { text: "" };
 	const read = await readBodyText(request, MAX_BODY_BYTES);