@lobu/cli 6.1.1 → 7.1.0

package/dist/commands/token.js

@@ -1,4 +1,5 @@
 import chalk from "chalk";
+import postgres from "postgres";
 import { getToken, resolveContext } from "../internal/index.js";
 import { resolveApiClient } from "../internal/api-client.js";
 export async function tokenCommand(options) {
@@ -22,7 +23,7 @@ export async function tokenCreateCommand(options) {
         context: options.context,
         org: options.org,
     });
-    const name = options.name?.trim() || defaultTokenName();
+    const name = options.name?.trim() || `lobu-cli-${new Date().toISOString().slice(0, 10)}`;
     const scope = options.scope?.trim() || "mcp:read mcp:write";
     const response = await client.post(`/api/${encodeURIComponent(orgSlug)}/tokens`, {
         name,
@@ -49,7 +50,57 @@ export async function tokenCreateCommand(options) {
     console.log(chalk.yellow("\n  Save this token now; it will not be shown again:"));
     console.log(`  ${response.token.token}\n`);
 }
-function defaultTokenName() {
-    return `lobu-cli-${new Date().toISOString().slice(0, 10)}`;
+/**
+ * Revoke a token by its `jti`. Inserts a row into `public.revoked_tokens`
+ * (created on demand) — the gateway's RevokedTokenStore checks this on every
+ * worker-token / settings-cookie verification, so the token is dead within
+ * one cache TTL (≤60s).
+ */
+export async function tokenRevokeCommand(jti, options) {
+    jti = jti.trim();
+    if (!jti) {
+        console.error(chalk.red("\n  Missing <jti>.\n"));
+        process.exitCode = 1;
+        return;
+    }
+    const databaseUrl = process.env.DATABASE_URL?.trim();
+    if (!databaseUrl) {
+        console.error(chalk.red("\n  DATABASE_URL is not set. Run this from the same environment as the gateway.\n"));
+        process.exitCode = 1;
+        return;
+    }
+    let expiresAt;
+    if (options.expiresAt) {
+        expiresAt = new Date(options.expiresAt);
+        if (Number.isNaN(expiresAt.getTime())) {
+            console.error(chalk.red("\n  --expires-at must be a valid ISO date.\n"));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    else {
+        expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000);
+    }
+    const sql = postgres(databaseUrl, { max: 1 });
+    try {
+        await sql.unsafe(`
+      CREATE TABLE IF NOT EXISTS public.revoked_tokens (
+        jti text PRIMARY KEY,
+        expires_at timestamptz NOT NULL
+      )
+    `);
+        await sql `
+      INSERT INTO public.revoked_tokens (jti, expires_at)
+      VALUES (${jti}, ${expiresAt})
+      ON CONFLICT (jti) DO UPDATE SET expires_at = GREATEST(public.revoked_tokens.expires_at, EXCLUDED.expires_at)
+    `;
+    }
+    finally {
+        await sql.end({ timeout: 5 });
+    }
+    console.log(chalk.cyan("\n  Token revoked"));
+    console.log(chalk.dim(`  jti:     ${jti}`));
+    console.log(chalk.dim(`  expires: ${expiresAt.toISOString()}`));
+    console.log(chalk.dim("  Effective within ~60s (gateway revocation cache TTL).\n"));
 }
 //# sourceMappingURL=token.js.map

package/dist/commands/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/commands/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAuB7D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAGlC;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC;QAC9D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,gBAAgB,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC;IAE5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAC5C;QACE,IAAI;QACJ,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;KACR,CACF,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,WAAW,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,cAAc,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CACxG,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CACrE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/commands/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAuB7D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAGlC;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,gBAAgB,CAAC;QAC9D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC;IAE5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAC5C;QACE,IAAI;QACJ,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;KACR,CACF,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,WAAW,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,cAAc,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CACxG,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CACrE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,OAA+B;IAE/B,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACjB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,mFAAmF,CACpF,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,SAAe,CAAC;IACpB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;KAKhB,CAAC,CAAC;QACH,MAAM,GAAG,CAAA;;gBAEG,GAAG,KAAK,SAAS;;KAE5B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,CACvE,CAAC;AACJ,CAAC"}

package/dist/commands/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAGA,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA4CnE"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAGA,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnE"}

package/dist/commands/validate.js

@@ -14,28 +14,19 @@ export async function validateCommand(cwd) {
     }
     const { config } = result;
     const warnings = [];
-    const errors = [];
     for (const [agentId, agentEntry] of Object.entries(config.agents)) {
         if (agentEntry.providers.length === 0) {
             warnings.push(`[agents.${agentId}] No providers configured. Agent will need provider keys at runtime.`);
         }
     }
+    const agentCount = Object.keys(config.agents).length;
     console.log();
-    if (errors.length === 0) {
-        const agentCount = Object.keys(config.agents).length;
-        console.log(chalk.green(`  lobu.toml is valid`));
-        console.log(chalk.dim(`  ${agentCount} agent(s) configured`));
-    }
-    else {
-        console.log(chalk.red(`  Validation failed`));
-    }
-    for (const err of errors) {
-        console.log(chalk.red(`  ${err}`));
-    }
+    console.log(chalk.green(`  lobu.toml is valid`));
+    console.log(chalk.dim(`  ${agentCount} agent(s) configured`));
     for (const warn of warnings) {
         console.log(chalk.yellow(`  ${warn}`));
     }
     console.log();
-    return errors.length === 0;
+    return true;
 }
 //# sourceMappingURL=validate.js.map

package/dist/commands/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CACX,WAAW,OAAO,sEAAsE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,UAAU,sBAAsB,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CACX,WAAW,OAAO,sEAAsE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,UAAU,sBAAsB,CAAC,CAAC,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/config/loader.js

@@ -24,14 +24,14 @@ export async function loadConfig(cwd) {
     }
     catch (err) {
         return {
-            error: `Invalid TOML syntax in ${CONFIG_FILENAME}`,
+            error: `Invalid TOML syntax in ${configPath}`,
             details: [err instanceof Error ? err.message : String(err)],
         };
     }
     const result = lobuConfigSchema.safeParse(parsed);
     if (!result.success) {
         const details = result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`);
-        return { error: `Invalid ${CONFIG_FILENAME}`, details };
+        return { error: `Invalid ${configPath}`, details };
     }
     return { config: result.data, path: configPath };
 }

package/dist/config/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAuB,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAY3C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,MAAM,eAAe,aAAa,GAAG,EAAE;YAC9C,OAAO,EAAE,CAAC,gCAAgC,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAA4B,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,0BAA0B,eAAe,EAAE;YAClD,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CACvD,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,WAAW,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,MAA8B;IAE9B,OAAO,OAAO,IAAI,MAAM,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAuB,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAY3C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,MAAM,eAAe,aAAa,GAAG,EAAE;YAC9C,OAAO,EAAE,CAAC,gCAAgC,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAA4B,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,0BAA0B,UAAU,EAAE;YAC7C,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CACvD,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,MAA8B;IAE9B,OAAO,OAAO,IAAI,MAAM,CAAC;AAC3B,CAAC"}

package/dist/connectors/README.md

@@ -465,7 +465,7 @@ Browser connectors use `patchright` (an npm alias for Playwright). The SDK also
 
 Connector code runs in a worker subprocess with a restricted environment. Key things to know:
 
-- **Minimal env vars**: Only `PATH`, `HOME`, `TMPDIR`, `TZ`, `NODE_ENV`, and `NODE_PATH` are available. No access to the host's env vars.
+- **Minimal env vars**: Only `PATH`, `HOME`, `TMPDIR`, `TZ`, `NODE_ENV`, `NODE_PATH`, and `PLAYWRIGHT_BROWSERS_PATH` are available. No access to the host's env vars.
 - **Secrets via ctx**: API keys and tokens flow through `ctx.credentials` and `ctx.config`, not environment variables. The `env_keys` auth method stores secrets on auth profiles, and the platform injects them into `ctx.config` at sync time.
 - **No filesystem persistence**: Don't write to disk expecting it to survive between syncs. Use `checkpoint` for state.
 
@@ -506,7 +506,7 @@ Connectors can also be installed manually via `client.connections.installConnect
 2. If `compiled_code` is NULL (bundled connectors), it compiles from `connectors/{source_path}` on disk via esbuild
 3. The compiled code is sent to the worker, written to a temp file (`.connector-child-{pid}.mjs`), and loaded via dynamic `import()`
 4. Each sync/action runs in an **isolated child process** with a 10-minute timeout and 512MB memory limit
-5. The child process has a restricted environment — only `PATH`, `HOME`, `TMPDIR`, `TZ`, `NODE_ENV`, and `PLAYWRIGHT_BROWSERS_PATH` are available as env vars
+5. The child process has a restricted environment — only `PATH`, `HOME`, `TMPDIR`, `TZ`, `NODE_ENV`, `NODE_PATH`, and `PLAYWRIGHT_BROWSERS_PATH` are available as env vars
 6. Secrets flow through `ctx.credentials` and `ctx.config`, not environment variables
 
 This means edits to `.ts` files in `connectors/` take effect on the next sync without reinstalling.
@@ -520,7 +520,6 @@ This means edits to `.ts` files in `connectors/` take effect on the next sync wi
 | `github` | oauth/env_keys | issues, PRs, comments, discussions | create/close/reopen issues, PRs |
 | `glassdoor` | none | reviews | - |
 | `gmaps` | env_keys | reviews | - |
-| `google_photos` | browser (CDP) | photos | - |
 | `google_play` | none | reviews | - |
 | `hackernews` | none | stories, comments | - |
 | `ios_appstore` | none | reviews | - |

package/dist/connectors/apple_health.ts

@@ -0,0 +1,138 @@
+/**
+ * Apple Health Connector (V1 runtime) — Lobu device app.
+ *
+ * Runs on a device bridge with HealthKit access. On iOS this reads the phone's
+ * Health store directly; on supported macOS installs HealthKit exposes the
+ * per-user store synced from iPhone and Apple Watch via iCloud Health. The
+ * Lobu device bridge holds the HealthKit entitlement, requests read permission
+ * once via a system sheet, and queries:
+ *
+ * - `daily_summaries`: daily totals for steps, distance, active energy,
+ *   exercise minutes, and resting heart rate.
+ * - `workouts`: individual workout sessions (type, duration, energy, distance).
+ *
+ * The connector DEFINITION (feeds, event kinds, options) is the source of truth
+ * for what data ends up in Lobu and how it's shaped. The EXECUTION lives in the
+ * Lobu device app, which polls /api/workers/* as a user-scoped worker
+ * advertising the `healthkit` capability and streams events back through the
+ * standard worker protocol — same `runs` lifecycle as every other connector.
+ *
+ * The TS sync()/execute() here are safety stubs: if a server-side worker
+ * somehow bypassed the capability gate (`required_capability='healthkit'`),
+ * the run would throw immediately instead of silently producing no events.
+ */
+
+import {
+  type ActionResult,
+  type ConnectorDefinition,
+  ConnectorRuntime,
+  type SyncContext,
+  type SyncResult,
+} from '@lobu/connector-sdk';
+
+const BRIDGE_ONLY_MESSAGE =
+  'apple.health runs only on a worker advertising capability "healthkit" (Lobu with Apple Health permission). ' +
+  'This run was claimed by a worker without that capability — check connector_definitions.required_capability and the poll-time capability filter.';
+
+export default class AppleHealthConnector extends ConnectorRuntime {
+  readonly definition: ConnectorDefinition = {
+    key: 'apple.health',
+    name: 'Apple Health',
+    description:
+      'Sync Apple Health daily activity summaries and workouts from Lobu on your device. ' +
+      'macOS reads HealthKit data synced from the user\'s iPhone (and Apple Watch) via iCloud Health.',
+    version: '0.1.0',
+    faviconDomain: 'apple.com',
+    requiredCapability: 'healthkit',
+    runtime: {
+      platforms: ['ios', 'macos'],
+      scopes: ['steps', 'distance', 'active-calories', 'exercise-minutes', 'workouts', 'resting-heart-rate'],
+    },
+    authSchema: {
+      methods: [{ type: 'none' }],
+    },
+    feeds: {
+      daily_summaries: {
+        key: 'daily_summaries',
+        name: 'Daily summaries',
+        description:
+          'Daily Apple Health activity summaries: steps, distance, active energy, ' +
+          'exercise minutes, and resting heart rate.',
+        configSchema: {
+          type: 'object',
+          properties: {
+            backfill_days: {
+              type: 'integer',
+              minimum: 1,
+              maximum: 3650,
+              default: 30,
+              description: 'How many days the bridge backfills on a fresh sync (incremental syncs only re-query changed days).',
+            },
+          },
+        },
+        eventKinds: {
+          health_daily_summary: {
+            description: 'A daily summary of Apple Health activity data.',
+            metadataSchema: {
+              type: 'object',
+              required: ['source', 'origin_id', 'date'],
+              properties: {
+                source: { type: 'string', const: 'apple_health' },
+                origin_id: { type: 'string' },
+                date: { type: 'string', format: 'date' },
+                steps: { type: 'number' },
+                distance_m: { type: 'number' },
+                active_energy_kcal: { type: 'number' },
+                exercise_minutes: { type: 'number' },
+                resting_heart_rate_bpm: { type: ['number', 'null'] },
+              },
+            },
+          },
+        },
+      },
+      workouts: {
+        key: 'workouts',
+        name: 'Workouts',
+        description: 'Workout sessions recorded in Apple Health.',
+        configSchema: {
+          type: 'object',
+          properties: {
+            backfill_days: {
+              type: 'integer',
+              minimum: 1,
+              maximum: 3650,
+              default: 30,
+              description: 'How many days the bridge backfills on a fresh sync.',
+            },
+          },
+        },
+        eventKinds: {
+          health_workout: {
+            description: 'A workout recorded in Apple Health.',
+            metadataSchema: {
+              type: 'object',
+              required: ['source', 'origin_id', 'workout_type'],
+              properties: {
+                source: { type: 'string', const: 'apple_health' },
+                origin_id: { type: 'string' },
+                workout_type: { type: 'string' },
+                started_at: { type: 'string' },
+                duration_s: { type: 'number' },
+                active_energy_kcal: { type: ['number', 'null'] },
+                distance_m: { type: ['number', 'null'] },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+
+  async sync(_ctx: SyncContext): Promise<SyncResult> {
+    throw new Error(BRIDGE_ONLY_MESSAGE);
+  }
+
+  async execute(): Promise<ActionResult> {
+    throw new Error(BRIDGE_ONLY_MESSAGE);
+  }
+}

package/dist/connectors/apple_photos.ts

@@ -0,0 +1,178 @@
+/**
+ * Apple Photos Connector (V1 runtime) — Lobu Mac app.
+ *
+ * Runs on a Mac advertising the `photos` capability. The bridge holds the
+ * `NSPhotoLibraryUsageDescription` Info.plist string and prompts the user via
+ * TCC the first time a job is claimed. Once granted, PhotoKit exposes the
+ * user's local Photos library — which is mirrored from iCloud Photos when
+ * that's enabled — including the rich metadata Google's Photos Library API
+ * does NOT expose: location (lat/lng), people (Apple's on-device face
+ * recognition), albums, captions, keywords, and Vision OCR text.
+ *
+ * One feed in v1:
+ *
+ * - `library`: every PHAsset in the user's library, with stable origin ids
+ *   derived from the asset's localIdentifier. Re-runs upsert by origin id.
+ *
+ * v1 ingests metadata + remote references (asset_local_id, asset_cloud_id,
+ * source_url for the photos.apple.com deep link). The actual image bytes
+ * are NOT embedded in events; future connector actions (`fetch_thumbnail`,
+ * `fetch_original`) will let an agent pull bytes on demand via the Mac
+ * worker.
+ *
+ * The connector DEFINITION here is the source of truth for shape; EXECUTION
+ * lives in the Mac app's PhotosSyncService, which polls /api/workers/* with
+ * `photos: true` and streams events back through the standard worker
+ * protocol — same `runs` lifecycle as every other device-bound connector.
+ *
+ * The TS sync()/execute() are safety stubs: if a server-side worker somehow
+ * bypassed the capability gate (`required_capability='photos'`), the run
+ * throws immediately instead of silently producing zero events.
+ */
+
+import {
+  type ActionResult,
+  type ConnectorDefinition,
+  ConnectorRuntime,
+  type SyncContext,
+  type SyncResult,
+} from '@lobu/connector-sdk';
+
+const BRIDGE_ONLY_MESSAGE =
+  'apple.photos runs only on a worker advertising capability "photos" (Lobu Mac app with Photos permission). ' +
+  'This run was claimed by a worker without that capability — check connector_definitions.required_capability and the poll-time capability filter.';
+
+export default class ApplePhotosConnector extends ConnectorRuntime {
+  readonly definition: ConnectorDefinition = {
+    key: 'apple.photos',
+    name: 'Apple Photos',
+    description:
+      'Sync your Photos library (local or iCloud-mirrored) from the Lobu Mac app. ' +
+      'Includes location, people, albums, captions, keywords, and Vision OCR text — ' +
+      'data Google Photos\' API does not expose.',
+    version: '0.1.0',
+    faviconDomain: 'apple.com',
+    requiredCapability: 'photos',
+    runtime: {
+      platforms: ['macos'],
+      scopes: ['date', 'location', 'people', 'albums', 'captions', 'keywords', 'ocr'],
+    },
+    authSchema: {
+      methods: [{ type: 'none' }],
+    },
+    feeds: {
+      library: {
+        key: 'library',
+        name: 'Library',
+        description:
+          'Every photo in your library. Each event carries the photo\'s metadata ' +
+          '(date taken, location, people, albums, captions, OCR text) plus stable ' +
+          'asset identifiers so agents can fetch the image bytes on demand.',
+        configSchema: {
+          type: 'object',
+          properties: {
+            backfill_days: {
+              type: 'integer',
+              minimum: 1,
+              maximum: 36500,
+              default: 3650,
+              description:
+                'How many days back the bridge backfills on a fresh sync. Default 10 years; ' +
+                'incremental runs only re-query the modification window since last_sync_at.',
+            },
+            include_screenshots: {
+              type: 'boolean',
+              default: true,
+              description: 'Include screenshots (PHAssetMediaSubtype.photoScreenshot).',
+            },
+            include_videos: {
+              type: 'boolean',
+              default: false,
+              description: 'Include video assets in addition to photos.',
+            },
+          },
+        },
+        eventKinds: {
+          photo: {
+            description:
+              'A single photo (or video, if enabled) from the user\'s Apple Photos library. ' +
+              'v1 (this PR) populates: asset_local_id, media_type, media_subtypes, ' +
+              'date_taken, date_modified, width, height, duration_s, latitude/longitude/altitude_m, ' +
+              'albums, is_favorite, is_hidden — everything PhotoKit\'s public API exposes. ' +
+              'v2 will add: asset_cloud_id, place_name (reverse geocoding), people, ' +
+              'keywords, caption, ocr_text — all of which require direct reads against ' +
+              'the Photos.sqlite bundle (FDA + schema-pinned, osxphotos-style). ' +
+              'Schema allows nulls so v1 events validate cleanly.',
+            metadataSchema: {
+              type: 'object',
+              required: ['source', 'origin_id', 'asset_local_id'],
+              properties: {
+                source: { type: 'string', const: 'apple_photos' },
+                origin_id: { type: 'string' },
+                asset_local_id: {
+                  type: 'string',
+                  description: 'PHAsset.localIdentifier — stable per-device handle.',
+                },
+                asset_cloud_id: {
+                  type: ['string', 'null'],
+                  description: 'iCloud asset id when synced via iCloud Photos.',
+                },
+                media_type: {
+                  type: 'string',
+                  enum: ['image', 'video', 'audio', 'unknown'],
+                },
+                media_subtypes: {
+                  type: 'array',
+                  items: { type: 'string' },
+                  description:
+                    'PHAssetMediaSubtype flags: live, hdr, screenshot, panorama, portrait, etc.',
+                },
+                date_taken: { type: ['string', 'null'], format: 'date-time' },
+                date_modified: { type: ['string', 'null'], format: 'date-time' },
+                width: { type: ['integer', 'null'] },
+                height: { type: ['integer', 'null'] },
+                duration_s: {
+                  type: ['number', 'null'],
+                  description: 'Duration in seconds — videos and Live Photos only.',
+                },
+                latitude: { type: ['number', 'null'] },
+                longitude: { type: ['number', 'null'] },
+                altitude_m: { type: ['number', 'null'] },
+                place_name: {
+                  type: ['string', 'null'],
+                  description:
+                    'Reverse-geocoded human-readable place from CLGeocoder when available offline.',
+                },
+                people: {
+                  type: 'array',
+                  items: { type: 'string' },
+                  description: 'Named-person tags from Apple\'s on-device face recognition.',
+                },
+                albums: {
+                  type: 'array',
+                  items: { type: 'string' },
+                  description: 'User album names this asset belongs to.',
+                },
+                keywords: {
+                  type: 'array',
+                  items: { type: 'string' },
+                },
+                caption: { type: ['string', 'null'] },
+                is_favorite: { type: 'boolean' },
+                is_hidden: { type: 'boolean' },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+
+  async sync(_ctx: SyncContext): Promise<SyncResult> {
+    throw new Error(BRIDGE_ONLY_MESSAGE);
+  }
+
+  async execute(): Promise<ActionResult> {
+    throw new Error(BRIDGE_ONLY_MESSAGE);
+  }
+}

package/dist/connectors/apple_screen_time.ts

@@ -0,0 +1,82 @@
+/**
+ * Apple Screen Time Connector (V1 runtime) — Lobu for Mac only.
+ *
+ * Runs on Lobu for Mac, which reads `~/Library/Application Support/
+ * Knowledge/knowledgeC.db` (the on-device Knowledge store backing Apple's
+ * Settings → Screen Time UI). With Full Disk Access granted, the Mac can
+ * pull per-app foreground time by day for both Mac usage and (if the user
+ * enables Screen Time iCloud sync) iOS usage.
+ *
+ * iOS does NOT advertise the `screentime` capability — Apple's
+ * FamilyControls + DeviceActivityReport design prevents per-app data from
+ * leaving the device on iOS. The Mac path is the workable one.
+ */
+
+import {
+  type ActionResult,
+  type ConnectorDefinition,
+  ConnectorRuntime,
+  type SyncContext,
+  type SyncResult,
+} from '@lobu/connector-sdk';
+
+const BRIDGE_ONLY =
+  'Apple Screen Time runs only on a worker advertising capability "screentime" (Lobu for Mac with Full Disk Access).';
+
+export default class AppleScreenTimeConnector extends ConnectorRuntime {
+  readonly definition: ConnectorDefinition = {
+    key: 'apple.screen_time',
+    name: 'Apple Screen Time',
+    description:
+      'Daily per-app usage totals from Lobu for Mac, sourced from the Apple Knowledge store. Captures both Mac usage and (if Screen Time iCloud sync is on) the user\'s iOS device usage.',
+    version: '0.1.0',
+    faviconDomain: 'apple.com',
+    requiredCapability: 'screentime',
+    runtime: { platforms: ['macos'] },
+    authSchema: { methods: [{ type: 'none' }] },
+    feeds: {
+      daily_app_usage: {
+        key: 'daily_app_usage',
+        name: 'Daily app usage',
+        description:
+          'Per-day total foreground time for each application (identified by bundle id).',
+        configSchema: {
+          type: 'object',
+          properties: {
+            backfill_days: {
+              type: 'integer',
+              minimum: 1,
+              maximum: 90,
+              default: 14,
+              description: 'How many days the bridge should backfill on each sync.',
+            },
+          },
+        },
+        eventKinds: {
+          screen_time_daily_app: {
+            description: 'Total time the user spent in one application on a given day.',
+            metadataSchema: {
+              type: 'object',
+              required: ['source', 'origin_id', 'date', 'bundle_id', 'seconds'],
+              properties: {
+                source: { type: 'string', const: 'apple_screen_time' },
+                origin_id: { type: 'string' },
+                date: { type: 'string', format: 'date' },
+                bundle_id: { type: 'string' },
+                seconds: { type: 'number', minimum: 0 },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+
+  async sync(_ctx: SyncContext): Promise<SyncResult> {
+    throw new Error(BRIDGE_ONLY);
+  }
+
+  async execute(): Promise<ActionResult> {
+    throw new Error(BRIDGE_ONLY);
+  }
+}