feat(eve): authorize approval responders by repository permission

[benpankow]

🔗 Linked issue

Related to vercel/eve#1559.

📚 Description

Adds opt-in responder authorization for Eve write-tool approvals. createGithubTools({ authorizeApprovalResponse }) accepts one policy for all write tools or a per-tool policy map; omitting it preserves existing approval behavior.

import {
  createGithubTools,
  githubRepositoryApprover,
} from '@github-tools/sdk/eve'
import { connectGithubApproverAuth } from '@github-tools/sdk/connect'

const approverAuth = connectGithubApproverAuth('github')

export default createGithubTools({
  // Opt in for every write-tool approval.
  authorizeApprovalResponse: githubRepositoryApprover({
    auth: approverAuth,
    minimumPermission: 'write', // default
  }),
})

import {
  createGithubTools,
  githubRepositoryApprover,
} from '@github-tools/sdk/eve'
import { connectGithubApproverAuth } from '@github-tools/sdk/connect'

export default createGithubTools({
  authorizeApprovalResponse: {
    mergePullRequest: githubRepositoryApprover({
      auth: connectGithubApproverAuth('github'),
      minimumPermission: 'maintain',
    }),
    createIssue: githubRepositoryApprover({
      auth: connectGithubApproverAuth('github'),
      minimumPermission: 'triage',
    }),
  },
})

githubRepositoryApprover() verifies the responder with a user-scoped Vercel Connect credential, then checks their repository permission with the agent token. Request-policy overrides continue to control when approval is requested and cannot remove responder authorization.

🧪 Validation

• pnpm --filter @github-tools/sdk build
• pnpm --filter @github-tools/sdk lint
• pnpm --filter @github-tools/sdk typecheck
• pnpm --filter @github-tools/sdk test — 59 tests passed
• Root pnpm build completed SDK and docs builds; the chat Nuxt build ran out of Node heap (exit 137)

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[vercel]

@benpankow is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thank you for following the naming conventions! 🙏

[benpankow]

Superseded by #88, which uses the upstream repository branch and includes the review fixes.