@byokit/openclaw 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.0 (2026-09-29)
+
+- First release on npm (docs/runtime-kits.md §10). `examples/openclaw-kit` (O12) is the whole flow from a phone
+  browser: pair, sign in with ChatGPT by device code, a streamed run, a tool that asks first, Allow and Deny. Its
+  e2e runs in CI from the packed packages against the fake Gateway; `LIVE.md` is the real-engine check.
+- `.` and `./device` export the kit's sentences (`words`, `stateWords`, `toAccountView`, `WordKey`, `AccountView`),
+  and `./device` the types a device screen needs (`Approval`, `Decision`, `KitState`, `Route`, `RunEnd`, `RunEvent`,
+  `SignInView`).
+- FIX: `oc.signin.view`'s `ready` (and so `openclawDevice(link).signIn.view(p).ready`) is the member's sign-in to that
+  provider, not the engine being up. Before, a phone's `phaseOf` said `done` while the device code was still showing,
+  and a member who was never signed in looked signed in.
+- FIX: `signIn.view(p)` drops a finished sign-in once its account is gone (signed out over the link, on the computer,
+  or by the engine), so it no longer shows that old sign-in as done.
+- Depends on @byokit/link 0.3.2.
+- Depends on @byokit/relay 0.2.1.
+
+- FIX: the account an app picks for a run is now the one the engine calls and bills. `RunSpec.model`
+  (`'provider/model'`, also `oc.run`'s `model` and `openclawDevice(link).run(message, { model })`) goes to the engine as
+  that run's own provider and model, with no fallback to another provider or model. A provider the member isn't
+  signed in to ends the run `signed-out` before the engine is called. A malformed reference, or one carrying an
+  `@profile` sign-in pin, is refused. Leaving it out sends the same request as before. The choice is per provider:
+  with two sign-ins for one provider the engine may still switch between them, so a single sign-in can't be picked.
+
+- Typed device pass-through (G4, docs/runtime-kits.md 7.2): `openclawDevice(link).call<M>(method, params)` returns
+  `GatewayResult<M>` from the generated table (params now required, as on the kit), `events()` yields
+  `OpenClawLinkEvent` frames, and `./device` re-exports the table types. The device gains `sessions()` (`oc.sessions`,
+  *view*) and `signOut(p)` (`oc.signout`).
+- FIX: `GatewayParams` for every anyOf/oneOf method now carries each branch's full property set from the pin's `protocol.schema.json` (re-emitted into `src/generated/params.ts` by `npm run gen:openclaw`), so `kit.call('cron.run', { id, mode: 'force' })` compiles; branch requirements the old types dropped (`cron.scratch.set` content, `cron.update` patch) and oneOf exclusions (`sessions.dispatch`, `exec.approvals.node.set`, `audit.run.inspect`, spelled as `prop?: never`) are enforced the way the gateway validates them.
+- SECURITY: the operator install policy blocks any skill request whose kind contains `depend` (e.g. `skill-dependency-install`) even under an own root; previously only `installSpec` installer fields were checked.
+- FIX: the trusted-skill version check uses `request.origin.version` when present and falls back to the `SKILL.md` frontmatter version, so reviewed bundled skills without a frontmatter version match their trusted entry.
+- SECURITY: the bridge aborts the `AbortSignal` handed to `host.call` when that call's plugin socket closes or errors before the reply is written, so an aborted run no longer leaves the sandboxed command running; the listener is removed after a normal reply.
+- SECURITY: the bridge plugin's `before_tool_call` relays every tool call to `ToolHost.gate`, engine builtins (`web_fetch`, `web_search`, memory and skill tools) included; before, anything outside `tools` ran ungated. The gate gets a fourth argument `{ builtin }`, an allowed builtin gets no permit or ticket, an unregistered session key is denied unless `allowOnce` matches, and a kit with no host blocks every tool. `KitOptions.gateBuiltins: false` restores gating only the app's tools. `prepare` now rewrites a stale `plugin/index.js`, so existing state dirs pick the gate up. A tool name the engine would rename before the hook (not `/^[a-z][a-z0-9_]*$/`, or `bash`/`cron`) is refused at construction, so an app tool never reaches the gate marked builtin.
+- FIX: the packed `dist/words.d.ts` keeps `with { type: 'json' }` on its `./words.json` import, so a strict NodeNext consumer with `skipLibCheck: false` no longer fails with TS1543.
+- FIX: `gatewayTransport` reads the Crewhouse legacy `device.json` shape (`deviceId`, `publicKeyPem`, `privateKeyPem`) as well as the kit's (`privateKey`, `publicKey`); an existing file is only read, never rewritten, and a file holding neither shape fails naming the file.
+- FIX: `OpenClawKit.call()` before `start()` returns a rejected promise (`gateway not ready`) instead of throwing synchronously.
+- The bridge no longer keys behavior on the plugin id: `KitOptions.bridge` (`socketName`, `paramPrefix`,
+  validated, defaulting to `bridge.sock` / `__byokit`) replaces the `crewhouse` special-cases, and
+  `startModelStub` takes a configurable `idPattern` and routing marker instead of a fixed prompt grammar
+  (docs/runtime-kits.md §§5.5/5.9; adopting apps pass their own values explicitly).
+
+- `./testing`: the fake Gateway (`fakeGateway`), the contract suite (`openclawContract`, also run against the real
+  pinned engine) and the scripted model (`startModelStub`/`useModelStub`), ported from Crewhouse's test stubs with the
+  script grammar unchanged (docs/runtime-kits.md §5.11).

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,174 @@
+<h1 align="center">@byokit/openclaw</h1>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@byokit/openclaw"><img alt="npm" src="https://img.shields.io/npm/v/@byokit/openclaw?style=flat" /></a>
+  <a href="https://github.com/umeranjum17/byokit/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/umeranjum17/byokit/ci.yml?style=flat&branch=main" /></a>
+  <a href="LICENSE"><img alt="Apache 2.0" src="https://img.shields.io/badge/license-Apache--2.0-666?style=flat" /></a>
+</p>
+
+<p align="center"><strong>The OpenClaw runtime kit: one object that runs the pinned engine for your app.</strong><br/>
+It drives the pinned OpenClaw engine (<code>openclaw@2026.8.1</code>, protocol 4) through one kit object. The
+aggregator's full operator surface stays available as typed pass-through calls (<code>call</code> for every operator
+method, <code>callDynamic</code> for the rest), with plain-words helpers for members, sign-in, runs, approvals and
+config. For apps built on OpenClaw, where the engine holds the subscriptions.</p>
+
+## Install
+
+```sh
+npm install @byokit/openclaw
+```
+
+[![npm](https://img.shields.io/npm/v/@byokit/openclaw?style=flat&label=)](https://www.npmjs.com/package/@byokit/openclaw) · [Latest release](https://github.com/umeranjum17/byokit/releases?q=openclaw-v) · [All releases](https://github.com/umeranjum17/byokit/releases)
+
+Node 22.18 or later. The kit brings the engine with it: the first `start()` installs the pinned `openclaw@2026.8.1`
+under your `stateDir` (a few minutes, needs the network once), and later starts run from there. For a whole app, a
+phone page that pairs, signs in with ChatGPT, runs and answers approvals, see
+[`examples/openclaw-kit`](../../examples/openclaw-kit).
+
+## Quickstart
+
+Start the engine, add a member, sign them in with a subscription, run a message (typechecked; running it installs
+the pinned engine and needs a real ChatGPT sign-in, so it is not run here):
+
+```ts
+import { OpenClawKit } from '@byokit/openclaw';
+
+const kit = new OpenClawKit({ stateDir: './openclaw-state' });
+await kit.start(); // installs the pinned engine under stateDir, spawns it, connects
+
+await kit.ensureMember('ana');
+const signIn = kit.signIn('ana', { authChoice: 'openai-device-code', via: 'code' }, (view) => console.log(view));
+await signIn.done;
+
+const end = await kit.run(
+  { member: 'ana', sessionKey: 'agent:ana:main', message: 'Say hello.' },
+  (e) => { if (e.type === 'text') console.log(e.text); },
+);
+console.log(end);
+await kit.stop();
+```
+
+To choose which of a member's accounts a run uses, pass `model: 'provider/model'` in the run spec (for example
+`'openai/gpt-5.1'`, where `provider` is an id `kit.providers(member)` lists). That provider is the one called and billed for this run only, with no fallback to another
+provider or model. If the member isn't signed in to it, the run ends `{ ok: false, kind: 'signed-out' }` and the
+engine is never called. Leave `model` out to keep the engine's own choice. A specific sign-in (`@profile`) can't be
+picked per run: the pinned engine may still switch to another sign-in for the same provider.
+
+The same kit runs offline against the fake Gateway from `@byokit/openclaw/testing` (no engine, no network, no
+account), and lists the sign-in routes it offers:
+
+```ts
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { OpenClawKit } from '@byokit/openclaw';
+import { fakeGateway } from '@byokit/openclaw/testing';
+
+const stateDir = mkdtempSync(join(tmpdir(), 'openclaw-readme-'));
+const kit = new OpenClawKit({ stateDir, spawnEngine: false, transport: fakeGateway().factory });
+try {
+  await kit.start();
+  console.log('state:', kit.state.phase, '| protocol:', kit.hello?.protocol);
+  await kit.ensureMember('ana');
+  const end = await kit.run(
+    { member: 'ana', sessionKey: 'agent:ana:main', message: 'Say hello.' },
+    (e) => console.log('event:', JSON.stringify(e)),
+  );
+  console.log('end:', JSON.stringify(end));
+  for (const r of kit.routes().filter((r) => r.offer))
+    console.log(`route: ${r.choice.padEnd(26)} ${r.billing.padEnd(12)} ${r.via}`);
+} finally {
+  await kit.stop();
+  rmSync(stateDir, { recursive: true, force: true });
+}
+```
+
+Its output, run from this repo with Node:
+
+```text
+state: ready | protocol: 4
+event: {"type":"text","text":"fake: Say hello."}
+event: {"type":"text","text":"fake: Say hello."}
+end: {"ok":true,"text":"fake: Say hello."}
+route: openai                     subscription browser
+route: openai-device-code         subscription code
+route: xai-oauth                  subscription code
+route: github-copilot             subscription code
+route: github-copilot-enterprise  subscription code
+route: minimax-global-oauth       subscription code
+route: minimax-cn-oauth           subscription code
+```
+
+Every offered route is a subscription sign-in. Each `Route` carries `billing` (`subscription`, `api` or `local`), so
+an app labels any other route it shows; API-billed routes are not offered by default.
+
+## API at a glance
+
+Entries:
+
+- `.` is the host side: `OpenClawKit`, engine supervision, config invariants, approvals (Node).
+- `./device` is the portable client for phones and browsers (no Node imports).
+- `./link` is the host-side `@byokit/link` adapter: member-checked ops, sealed approval push (Node).
+- `./testing` holds `fakeGateway`, the `openclawContract` suite and the scripted model stub.
+
+| Export | What it does |
+| --- | --- |
+| `OpenClawKit` (`.`) | Prepares, starts, supervises and stops the engine. `call` / `callDynamic` pass through to the Gateway, `onEvent` listens. Helpers: `ensureMember`, `routes`, `providers`, `signedIn`, `signIn`, `signOut`, `migrateRetainedLogin`, `confirmRetainedLogin`, `run`, `steer`, `abort`, `approvals`, `onApproval`, `decide`, `allowOnce`, `disallowOnce`, `patchConfig`, `memoryLimited`, `doctorContext` |
+| `ENGINE_VERSION`, `PROTOCOL_VERSION`, `OPERATOR_SCOPES` (`.`) | The pinned engine version, its protocol and the operator scopes the kit connects with |
+| `KitOptions`, `RunSpec`, `RunEvent`, `RunEnd`, `Route`, `Approval`, `Decision`, `ToolSpec`, `ToolHost`, `KitState`, ... (`.`) | Public types (docs/runtime-kits.md §5.2) |
+| `openclawDevice(link)` (`./device`) | Portable client: state, routes, sign-in, runs, steer, abort, approvals, events, sealed notices, pass-through `call` |
+| `LinkRefused`, `openNotice` (`./device`) | The host's own refusal as an error; opens a sealed approval notice |
+| `words`, `stateWords`, `toAccountView` (`.`, `./device`) | The kit's sentences, so a phone shows the words the computer does; `toAccountView` feeds `@byokit/ui-core`'s `phaseOf` |
+| `openclawLink(kit, o)` (`./link`) | `handle` / `stream` / `allow` for a `@byokit/link` `Host`, checked per member, plus `onAction` for relay push actions |
+| `serve(o)` (`./link`) | Binds the link host per reach and returns its URLs |
+| `fakeGateway`, `openclawContract`, `startModelStub`, `useModelStub` (`./testing`) | In-memory Gateway, the contract suite and the scripted model for tests |
+
+## Phones and browsers
+
+The host side serves member-checked ops over `@byokit/link`; the phone or browser uses the portable client:
+
+```ts
+import { Host, keyPair, type DeviceLink } from '@byokit/link';
+import { OpenClawKit } from '@byokit/openclaw';
+import { openclawLink, serve } from '@byokit/openclaw/link';
+import { openclawDevice } from '@byokit/openclaw/device';
+
+// On the computer (Node): member-checked ops over @byokit/link, served per reach.
+declare const kit: OpenClawKit;
+declare const ask: (question: string) => Promise<boolean>; // your own prompt
+const api = openclawLink(kit, { memberOf: (grant) => (grant.meta as { member?: string } | undefined)?.member });
+const host = await Host.open({
+  keys: keyPair(),
+  name: 'My computer',
+  confirm: ({ name, words }) => ask(`Pair ${name}? Check it shows “${words}”.`),
+  ...api,
+});
+const served = await serve({ host, port: 8787, via: 'lan' });
+console.log(served.urls);
+
+// On the phone or in the browser: the portable client over a paired DeviceLink.
+declare const link: DeviceLink;
+const oc = openclawDevice(link);
+for await (const e of oc.run('Say hello.')) console.log(e);
+```
+
+## Isolation and billing
+
+The kit writes only under the `stateDir` the app passes. It spawns the engine with an explicit isolated environment
+(never `process.env`), reads no environment variables except `PATH` to find `npm`, and never bills an API behind the
+person's back (memory search is never a paid provider).
+
+## Status
+
+Pinned to OpenClaw `2026.8.1` (protocol 4); `ENGINE_VERSION` and `PROTOCOL_VERSION` carry the pin. Signatures are
+frozen (docs/runtime-kits.md §5).
+
+## Links
+
+- [byokit](../../README.md), the repo root
+- [docs/runtime-kits.md](../../docs/runtime-kits.md), the binding spec for this kit (§5)
+- [CHANGELOG.md](CHANGELOG.md)
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](../../NOTICE).

package/dist/approvals.d.ts

@@ -0,0 +1,29 @@
+import type { Bridge } from './bridge.ts';
+import type { Approval, Decision, GatewayTransport, Member } from './types.ts';
+export declare class Approvals {
+    private readonly request;
+    private readonly bridge;
+    private readonly approvals;
+    private readonly listeners;
+    constructor(o: {
+        request: GatewayTransport['request'];
+        bridge: Pick<Bridge, 'resolveAsk'>;
+    });
+    handleEvent(e: {
+        event: string;
+        payload?: unknown;
+    }): void;
+    add(a: Approval): void;
+    remove(id: string): void;
+    list(member?: Member): Approval[];
+    on(fn: (a: Approval, change: 'added' | 'resolved') => void): () => void;
+    /**
+     * Drop native approvals and replay the engine's current lists (N9): after a reconnect the engine may have
+     * resolved entries this kit still shows. Gate asks live in the bridge and are untouched. Rows are only
+     * trusted with a string id; anything else is skipped, never invented.
+     */
+    resync(): Promise<void>;
+    decide(id: string, d: Decision): Promise<void>;
+    private answersFor;
+    private emit;
+}

package/dist/approvals.js

@@ -0,0 +1,200 @@
+// Native approvals: exec.approval.*, plugin.approval.* and question.* surfaced through the same Approval shape (5.9, O5).
+import { randomBytes } from 'node:crypto';
+import { MEMBER_ID } from "./members.js";
+const strip = (a) => {
+    const { native, ...approval } = a;
+    void native;
+    return approval;
+};
+const REQUESTED = {
+    'exec.approval.requested': 'exec',
+    'plugin.approval.requested': 'plugin',
+    'question.requested': 'question',
+};
+const RESOLVED = new Set(['exec.approval.resolved', 'plugin.approval.resolved', 'question.resolved']);
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const asString = (v) => (typeof v === 'string' && v.length > 0 ? v : undefined);
+const memberOfKey = (key) => {
+    const m = /^agent:([a-z][a-z0-9-]{0,31}):/.exec(key);
+    return m?.[1];
+};
+/**
+ * Member attribution: the request detail's agent first, else the `agent:<member>:` session key (5.9). The real
+ * engine nests exec/plugin details under `request` (question events stay flat); unattributed approvals carry ''
+ * so they can never match a member id (B2).
+ */
+function attribute(payload) {
+    const detail = isRecord(payload.request) ? payload.request : payload;
+    const agent = asString(detail.agentId);
+    const key = asString(detail.sessionKey);
+    const fromKey = key ? memberOfKey(key) : undefined;
+    const member = agent ?? fromKey ?? asString(detail.member) ?? '';
+    return { member, ...(key ? { sessionKey: key } : {}) };
+}
+/** Exec policy modes (`off|on-miss|always`) ride in `request.ask`; they are not something a person said (B8). */
+const POLICY_MODES = new Set(['off', 'on-miss', 'always']);
+const askText = (detail) => {
+    const ask = asString(detail.ask);
+    return ask && !POLICY_MODES.has(ask) ? ask : undefined;
+};
+function summaryOf(source, payload) {
+    const detail = isRecord(payload.request) ? payload.request : payload;
+    if (source === 'exec')
+        return asString(detail.command) ? `run ${detail.command}` : (askText(detail) ?? 'approve an action');
+    if (source === 'plugin')
+        return asString(detail.title) ?? askText(detail) ?? 'approve an action';
+    const questions = detail.questions;
+    if (Array.isArray(questions)) {
+        const first = questions.map((q) => (isRecord(q) ? asString(q.question) ?? asString(q.header) : undefined)).find(Boolean);
+        if (first)
+            return first;
+    }
+    return 'answer a question';
+}
+function expiresOf(payload, fallbackMs) {
+    const at = typeof payload.expiresAtMs === 'number' ? payload.expiresAtMs : Date.now() + fallbackMs;
+    return at;
+}
+export class Approvals {
+    request;
+    bridge;
+    approvals = new Map();
+    listeners = new Set();
+    constructor(o) {
+        this.request = o.request;
+        this.bridge = o.bridge;
+    }
+    handleEvent(e) {
+        const payload = isRecord(e.payload) ? e.payload : {};
+        const source = REQUESTED[e.event];
+        if (source) {
+            const id = asString(payload.id) ?? randomBytes(12).toString('base64url');
+            if (this.approvals.has(id))
+                return;
+            const { member, sessionKey } = attribute(payload);
+            const detail = isRecord(payload.request) ? payload.request : payload;
+            const now = Date.now();
+            const approval = {
+                id,
+                source,
+                member,
+                ...(sessionKey ? { sessionKey } : {}),
+                ...(asString(detail.tool) ?? asString(detail.toolName) ? { tool: (asString(detail.tool) ?? asString(detail.toolName)) } : {}),
+                summary: summaryOf(source, payload),
+                ...('questions' in detail ? { input: detail.questions } : {}),
+                at: typeof payload.createdAtMs === 'number' ? payload.createdAtMs : now,
+                expires: expiresOf(payload, 180_000),
+                native: { source, id },
+            };
+            this.approvals.set(id, approval);
+            this.emit(approval, 'added');
+            return;
+        }
+        if (RESOLVED.has(e.event)) {
+            const id = asString(payload.id);
+            if (id)
+                this.remove(id);
+        }
+        return;
+    }
+    add(a) {
+        if (this.approvals.has(a.id))
+            return;
+        this.approvals.set(a.id, a);
+        this.emit(a, 'added');
+    }
+    remove(id) {
+        const a = this.approvals.get(id);
+        if (!a)
+            return;
+        this.approvals.delete(id);
+        this.emit(strip(a), 'resolved');
+    }
+    list(member) {
+        const all = [...this.approvals.values()].map(strip);
+        if (member === undefined)
+            return all;
+        if (!MEMBER_ID.test(member))
+            return [];
+        return all.filter((a) => a.member === member);
+    }
+    on(fn) {
+        this.listeners.add(fn);
+        return () => {
+            this.listeners.delete(fn);
+        };
+    }
+    /**
+     * Drop native approvals and replay the engine's current lists (N9): after a reconnect the engine may have
+     * resolved entries this kit still shows. Gate asks live in the bridge and are untouched. Rows are only
+     * trusted with a string id; anything else is skipped, never invented.
+     */
+    async resync() {
+        for (const [id, a] of this.approvals) {
+            if (!a.native)
+                continue;
+            this.approvals.delete(id);
+            this.emit(strip(a), 'resolved');
+        }
+        const lists = {
+            'exec.approval.list': 'exec.approval.requested',
+            'plugin.approval.list': 'plugin.approval.requested',
+        };
+        for (const [method, event] of Object.entries(lists)) {
+            let answer;
+            try {
+                answer = await this.request(method, {});
+            }
+            catch {
+                continue;
+            }
+            const rows = Array.isArray(answer)
+                ? answer
+                : isRecord(answer)
+                    ? (['approvals', 'items', 'records', 'entries'].map((k) => answer[k]).find(Array.isArray) ?? [])
+                    : [];
+            for (const row of rows) {
+                if (!isRecord(row) || typeof row.id !== 'string')
+                    continue;
+                this.handleEvent({ event, payload: row });
+            }
+        }
+    }
+    async decide(id, d) {
+        const a = this.approvals.get(id);
+        if (!a)
+            throw new Error(`unknown approval: ${id}`);
+        if (a.source === 'gate') {
+            if (!this.bridge.resolveAsk(id, d))
+                throw new Error(`unknown approval: ${id}`);
+            return;
+        }
+        const native = a.native;
+        if (!native)
+            throw new Error(`unknown approval: ${id}`);
+        if (native.source === 'exec' || native.source === 'plugin') {
+            const method = native.source === 'exec' ? 'exec.approval.resolve' : 'plugin.approval.resolve';
+            await this.request(method, { id: native.id, decision: d.allow ? 'allow-once' : 'deny' });
+            return;
+        }
+        if (d.allow) {
+            await this.request('question.resolve', { id: native.id, answers: this.answersFor(a, d.answer) });
+        }
+        else {
+            await this.request('question.resolve', { id: native.id, cancel: true });
+        }
+    }
+    answersFor(a, answer) {
+        if (isRecord(answer) && 'answers' in answer)
+            return answer;
+        const questions = Array.isArray(a.input) ? a.input : [];
+        const ids = questions.filter(isRecord).map((q) => asString(q.questionId)).filter(Boolean);
+        if (ids.length === 1 && Array.isArray(answer))
+            return { answers: { [ids[0]]: answer } };
+        throw new Error('a question approval needs answers for its questions');
+    }
+    emit(a, change) {
+        for (const fn of this.listeners)
+            fn(a, change);
+    }
+}