@oratis/lisa 0.11.1 → 0.14.0

package/dist/providers/types.d.ts

@@ -23,6 +23,9 @@ export interface ProviderRunOpts {
     maxTokens?: number;
     thinking?: boolean;
     compaction?: boolean;
+    /** Thinking-depth / token-spend lever (Anthropic `output_config.effort`).
+     *  Omitted ⇒ API default ("high"). Subagents use "low" for cheap work. */
+    effort?: "low" | "medium" | "high" | "xhigh" | "max";
     handlers?: ProviderStreamHandlers;
     signal?: AbortSignal;
 }

package/dist/providers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;8EAC0E;IAC1E,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IACrD,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzD"}

package/dist/subagent.d.ts

@@ -9,6 +9,8 @@ export interface SubagentOptions {
     model?: string;
     log?: (msg: string) => void;
     thinking?: boolean;
+    /** Thinking-depth lever; defaults to "low" — subagents are cheap parallel work. */
+    effort?: "low" | "medium" | "high" | "xhigh" | "max";
     /** Cumulative (input+output) token ceiling; stops the run early when reached. */
     budgetTokens?: number;
     /** Injectable provider (tests); defaults to providerForModel(model). */

package/dist/subagent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subagent.d.ts","sourceRoot":"","sources":["../src/subagent.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA8BhF"}
+{"version":3,"file":"subagent.d.ts","sourceRoot":"","sources":["../src/subagent.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IACrD,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA+BhF"}

package/dist/subagent.js

@@ -18,6 +18,7 @@ export async function runSubagent(opts) {
         userMessage: opts.prompt,
         model,
         thinking: opts.thinking ?? false,
+        effort: opts.effort ?? "low",
         onEvent: (event) => {
             if (event.type === "tool_call_start")
                 toolCallCount++;

package/dist/subagent.js.map

@@ -1 +1 @@
-{"version":3,"file":"subagent.js","sourceRoot":"","sources":["../src/subagent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA4B3D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;QAC5B,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SAC5B;QACD,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAAE,aAAa,EAAE,CAAC;QACxD,CAAC;QACD,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,SAAS;QACtB,aAAa;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"subagent.js","sourceRoot":"","sources":["../src/subagent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA8B3D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;QAC5B,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SAC5B;QACD,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAAE,aAAa,EAAE,CAAC;QACxD,CAAC;QACD,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,SAAS;QACtB,aAAa;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC"}

package/dist/web/cloudAuth.d.ts

@@ -0,0 +1,57 @@
+/** A single JSON Web Key from Apple's JWKS (the RSA fields we use). */
+export interface AppleJWK {
+    kty: string;
+    kid: string;
+    use?: string;
+    alg?: string;
+    n: string;
+    e: string;
+}
+/** The verified subset of an Apple identity token we act on. */
+export interface AppleIdentity {
+    /** Stable, team-scoped user id (`sub`). The account key if/when we go multi-tenant. */
+    sub: string;
+    /** Present only when the user shared it (first sign-in, or always for real email). */
+    email?: string;
+    /** Whether Apple marked the email verified ("true"/"false" string in the JWT). */
+    emailVerified?: boolean;
+}
+export interface VerifyAppleOptions {
+    /** Expected `aud` — the app's bundle id (e.g. `ai.meetlisa.main`). */
+    audience: string;
+    /** Returns Apple's current signing keys. Injected so tests run offline. */
+    fetchKeys: () => Promise<AppleJWK[]>;
+    /** Clock seam for tests (ms since epoch). Defaults to Date.now(). */
+    now?: () => number;
+    /** Leeway for clock skew, seconds (default 60). */
+    clockToleranceSec?: number;
+}
+export declare class AppleAuthError extends Error {
+    constructor(message: string);
+}
+/**
+ * Verify an Apple identity-token JWT. Throws `AppleAuthError` on any failure
+ * (bad signature, wrong issuer/audience, expired). Returns the identity on success.
+ */
+export declare function verifyAppleIdentityToken(idToken: string, opts: VerifyAppleOptions): Promise<AppleIdentity>;
+/** Fetch Apple's signing keys, cached for an hour. The default `fetchKeys`. */
+export declare function fetchAppleKeys(now?: () => number): Promise<AppleJWK[]>;
+export interface AppleSignInConfig {
+    /** Whether the endpoint is live. Off unless `LISA_CLOUD_APPLE_SIGNIN` is truthy. */
+    enabled: boolean;
+    /** Expected token audience — the app bundle id. */
+    audience: string;
+    /** Optional allowlist of Apple `sub`s; empty = any verified Apple ID may sign in. */
+    allowedSubs: string[];
+}
+/**
+ * Read the Sign in with Apple config from the environment. Default-OFF: with
+ * `LISA_CLOUD_APPLE_SIGNIN` unset the endpoint reports disabled and never hands
+ * back the session token. `LISA_CLOUD_APPLE_AUD` overrides the expected bundle id
+ * (default `ai.meetlisa.main`); `LISA_CLOUD_APPLE_SUBS` is a comma-separated
+ * allowlist (set it to the reviewer's `sub` to restrict the shared demo).
+ */
+export declare function appleSignInConfig(env?: NodeJS.ProcessEnv): AppleSignInConfig;
+/** True when `sub` is permitted by the (possibly empty) allowlist. */
+export declare function subAllowed(sub: string, cfg: AppleSignInConfig): boolean;
+//# sourceMappingURL=cloudAuth.d.ts.map

package/dist/web/cloudAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudAuth.d.ts","sourceRoot":"","sources":["../../src/web/cloudAuth.ts"],"names":[],"mappings":"AAuBA,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAiBD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,aAAa,CAAC,CAiDxB;AAMD,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,GAAG,GAAE,MAAM,MAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAStF;AAID,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAQD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,iBAAiB,CASzF;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAEvE"}

package/dist/web/cloudAuth.js

@@ -0,0 +1,139 @@
+/**
+ * Sign in with Apple — identity-token verification for the hosted LISA Cloud
+ * edition (docs/PLAN_CLOUD_v1.0.md §"Auth + account lifecycle", milestone M4 of
+ * docs/PLAN_IOS_ONBOARDING_v1.0.md).
+ *
+ * The iOS app runs the native Sign in with Apple flow and POSTs the resulting
+ * **identity token** (a JWT signed by Apple) to `POST /api/auth/apple`. We verify
+ * it here against Apple's published public keys and, on success, hand back the
+ * cloud session token so the phone can authenticate like any other client.
+ *
+ * Scope is deliberately single-tenant (matches the deployed M0/C2 demo: one
+ * shared soul behind one `LISA_WEB_TOKEN`). Verifying Apple's signature lets a
+ * reviewer — or any operator-approved Apple ID — sign in instead of pasting the
+ * token, which is the App Store reviewability unlock. Per-`uid` isolation +
+ * Firebase + account deletion stay deferred C3 work; this module does NOT mint
+ * per-user state.
+ *
+ * No external dependencies: Apple uses RS256, which Node verifies natively from
+ * a JWK via `node:crypto`. The verifier is pure (JWKS fetch + clock injected) so
+ * it unit-tests offline — see cloudAuth.test.ts.
+ */
+import crypto from "node:crypto";
+export class AppleAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AppleAuthError";
+    }
+}
+const APPLE_ISSUER = "https://appleid.apple.com";
+const APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
+function b64urlToBuffer(s) {
+    return Buffer.from(s, "base64url");
+}
+function decodeJson(segment) {
+    try {
+        return JSON.parse(b64urlToBuffer(segment).toString("utf8"));
+    }
+    catch {
+        throw new AppleAuthError("malformed token segment");
+    }
+}
+/**
+ * Verify an Apple identity-token JWT. Throws `AppleAuthError` on any failure
+ * (bad signature, wrong issuer/audience, expired). Returns the identity on success.
+ */
+export async function verifyAppleIdentityToken(idToken, opts) {
+    const now = opts.now ?? Date.now;
+    const tolerance = opts.clockToleranceSec ?? 60;
+    const parts = idToken.split(".");
+    if (parts.length !== 3)
+        throw new AppleAuthError("not a JWT");
+    const headerB64 = parts[0];
+    const payloadB64 = parts[1];
+    const sigB64 = parts[2];
+    const header = decodeJson(headerB64);
+    if (header.alg !== "RS256")
+        throw new AppleAuthError(`unexpected alg ${String(header.alg)}`);
+    const kid = typeof header.kid === "string" ? header.kid : null;
+    if (!kid)
+        throw new AppleAuthError("missing key id");
+    const keys = await opts.fetchKeys();
+    const jwk = keys.find((k) => k.kid === kid && k.kty === "RSA");
+    if (!jwk)
+        throw new AppleAuthError("no matching Apple signing key");
+    // RS256 = RSASSA-PKCS1-v1_5 over SHA-256. Node imports the JWK directly.
+    const pubKey = crypto.createPublicKey({ key: jwk, format: "jwk" });
+    const signingInput = Buffer.from(`${headerB64}.${payloadB64}`, "utf8");
+    const ok = crypto.verify("RSA-SHA256", signingInput, pubKey, b64urlToBuffer(sigB64));
+    if (!ok)
+        throw new AppleAuthError("bad signature");
+    const claims = decodeJson(payloadB64);
+    if (claims.iss !== APPLE_ISSUER)
+        throw new AppleAuthError("wrong issuer");
+    // `aud` may be a string or array.
+    const aud = claims.aud;
+    const audOk = Array.isArray(aud) ? aud.includes(opts.audience) : aud === opts.audience;
+    if (!audOk)
+        throw new AppleAuthError("wrong audience");
+    const nowSec = Math.floor(now() / 1000);
+    const exp = typeof claims.exp === "number" ? claims.exp : 0;
+    if (exp + tolerance < nowSec)
+        throw new AppleAuthError("token expired");
+    const iat = typeof claims.iat === "number" ? claims.iat : 0;
+    if (iat - tolerance > nowSec)
+        throw new AppleAuthError("token not yet valid");
+    const sub = typeof claims.sub === "string" ? claims.sub : "";
+    if (!sub)
+        throw new AppleAuthError("missing subject");
+    const email = typeof claims.email === "string" ? claims.email : undefined;
+    const emailVerified = claims.email_verified === true || claims.email_verified === "true" ? true
+        : claims.email_verified === false || claims.email_verified === "false" ? false
+            : undefined;
+    return { sub, email, emailVerified };
+}
+// ── Apple JWKS fetch (cached) ───────────────────────────────────────────────
+let keyCache = null;
+const KEY_TTL_MS = 60 * 60 * 1000; // Apple rotates infrequently; an hour is safe.
+/** Fetch Apple's signing keys, cached for an hour. The default `fetchKeys`. */
+export async function fetchAppleKeys(now = Date.now) {
+    if (keyCache && now() - keyCache.at < KEY_TTL_MS)
+        return keyCache.keys;
+    const res = await fetch(APPLE_KEYS_URL);
+    if (!res.ok)
+        throw new AppleAuthError(`Apple JWKS fetch failed (${res.status})`);
+    const body = (await res.json());
+    const keys = Array.isArray(body.keys) ? body.keys : [];
+    if (keys.length === 0)
+        throw new AppleAuthError("Apple JWKS empty");
+    keyCache = { keys, at: now() };
+    return keys;
+}
+function truthy(v) {
+    if (!v)
+        return false;
+    const s = v.trim().toLowerCase();
+    return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+/**
+ * Read the Sign in with Apple config from the environment. Default-OFF: with
+ * `LISA_CLOUD_APPLE_SIGNIN` unset the endpoint reports disabled and never hands
+ * back the session token. `LISA_CLOUD_APPLE_AUD` overrides the expected bundle id
+ * (default `ai.meetlisa.main`); `LISA_CLOUD_APPLE_SUBS` is a comma-separated
+ * allowlist (set it to the reviewer's `sub` to restrict the shared demo).
+ */
+export function appleSignInConfig(env = process.env) {
+    return {
+        enabled: truthy(env.LISA_CLOUD_APPLE_SIGNIN),
+        audience: env.LISA_CLOUD_APPLE_AUD?.trim() || "ai.meetlisa.main",
+        allowedSubs: (env.LISA_CLOUD_APPLE_SUBS ?? "")
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean),
+    };
+}
+/** True when `sub` is permitted by the (possibly empty) allowlist. */
+export function subAllowed(sub, cfg) {
+    return cfg.allowedSubs.length === 0 || cfg.allowedSubs.includes(sub);
+}
+//# sourceMappingURL=cloudAuth.js.map

package/dist/web/cloudAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudAuth.js","sourceRoot":"","sources":["../../src/web/cloudAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAiCjC,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAE7D,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,yBAAyB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAE/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IAElC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,cAAc,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAErD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,+BAA+B,CAAC,CAAC;IAEpE,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAmC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY;QAAE,MAAM,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;IAE1E,kCAAkC;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC;IACvF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,GAAG,SAAS,GAAG,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,GAAG,SAAS,GAAG,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,qBAAqB,CAAC,CAAC;IAE9E,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,aAAa,GACjB,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI;QACzE,CAAC,CAAC,MAAM,CAAC,cAAc,KAAK,KAAK,IAAI,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;YAC9E,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACvC,CAAC;AAED,+EAA+E;AAC/E,IAAI,QAAQ,GAA4C,IAAI,CAAC;AAC7D,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,+CAA+C;AAElF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAoB,IAAI,CAAC,GAAG;IAC/D,IAAI,QAAQ,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,GAAG,UAAU;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,4BAA4B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,kBAAkB,CAAC,CAAC;IACpE,QAAQ,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,SAAS,MAAM,CAAC,CAAqB;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC5C,QAAQ,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,kBAAkB;QAChE,WAAW,EAAE,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;aAC3C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,GAAsB;IAC5D,OAAO,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/web/island.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"island.d.ts","sourceRoot":"","sources":["../../src/web/island.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,eAAO,MAAM,WAAW,QAs6CvB,CAAC"}
+{"version":3,"file":"island.d.ts","sourceRoot":"","sources":["../../src/web/island.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,eAAO,MAAM,WAAW,QAu6CvB,CAAC"}

package/dist/web/island.js

@@ -32,6 +32,7 @@ export const ISLAND_HTML = `<!doctype html>
     --accent-warm: #ffd066;
     --accent-dream: #b487ff;
     --accent-claude: #ff8c42;
+    --accent-proactive: #3ddc97;
     --border: rgba(255, 255, 255, 0.08);
     /* 1px top inner highlight that reads as a glass bevel */
     --hairline: rgba(255, 255, 255, 0.12);

package/dist/web/island.js.map

@@ -1 +1 @@
-{"version":3,"file":"island.js","sourceRoot":"","sources":["../../src/web/island.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExG,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0jBvB,iBAAiB;IACjB,mBAAmB;IACnB,WAAW;IACX,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAy2BjB,CAAC"}
+{"version":3,"file":"island.js","sourceRoot":"","sources":["../../src/web/island.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExG,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2jBvB,iBAAiB;IACjB,mBAAmB;IACnB,WAAW;IACX,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAy2BjB,CAAC"}