agentlock-shared 0.1.0 → 0.2.0

package/dist/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAuFA,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAYvD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMrF;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAsGA,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAcvD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMrF;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB"}

package/dist/redact.js

@@ -56,7 +56,15 @@ const SECRET_SUBSTRINGS = [
     'connection_string',
     'database_url',
     'access_key',
-    'session_id',
+    'auth_token',
+    'refresh_key',
+    'session_secret',
+    'webhook_secret',
+    'jwt',
+    'oauth',
+    'ssn',
+    'credit_card',
+    'routing_number',
 ];
 const REDACTED = '[REDACTED]';
 // Value-based patterns to detect secrets regardless of field name
@@ -75,6 +83,13 @@ const SECRET_VALUE_PATTERNS = [
     /^sk-ant-[a-zA-Z0-9_-]{20,}$/, // Anthropic API keys
     /^SG\.[a-zA-Z0-9_-]{20,}$/, // SendGrid API keys
     /^SK[a-f0-9]{32}$/, // Twilio API keys
+    /-----BEGIN\s+(RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/, // PEM private keys
+    /^DefaultEndpointsProtocol=/, // Azure connection strings
+    /^[A-Za-z0-9+\/]{43,}={0,2}$/, // Base64-encoded symmetric keys (32+ bytes)
+    /^[A-Za-z0-9_-]{43,}={0,2}$/, // URL-safe base64 encoded keys
+    /^whsec_[a-zA-Z0-9]{20,}$/, // Stripe webhook secrets
+    /^npm_[a-zA-Z0-9]{20,}$/, // npm tokens
+    /^vercel_[a-zA-Z0-9]{20,}$/, // Vercel tokens
 ];
 function isSecretField(key) {
     const lower = key.toLowerCase();
@@ -86,8 +101,10 @@ function isSecretValue(value) {
     return SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value));
 }
 function redact(obj, depth = 0) {
-    if (depth > 10)
-        return obj;
+    // SECURITY: At max depth, redact entirely rather than passing data through.
+    // Prevents secrets in deeply nested objects from bypassing redaction.
+    if (depth > 20)
+        return REDACTED;
     if (obj === null || obj === undefined)
         return obj;
     if (typeof obj === 'string')
@@ -105,7 +122,7 @@ function redact(obj, depth = 0) {
 function redactHeaders(headers) {
     const result = {};
     for (const [key, value] of Object.entries(headers)) {
-        result[key] = isSecretField(key) ? REDACTED : value;
+        result[key] = (isSecretField(key) || isSecretValue(value)) ? REDACTED : value;
     }
     return result;
 }

package/dist/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":";;AAuFA,wBAYC;AAED,sCAMC;AAED,sDAIC;AAjHD,sDAAsD;AACtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,eAAe;IACf,SAAS;IACT,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,cAAc;IACd,eAAe;IACf,eAAe;IACf,WAAW;IACX,cAAc;IACd,aAAa;IACb,QAAQ;IACR,eAAe;IACf,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IACd,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,2BAA2B;CAC5B,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG;IACxB,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAC;AAEF,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,kEAAkE;AAClE,MAAM,qBAAqB,GAAG;IAC5B,2CAA2C,EAAG,cAAc;IAC5D,0BAA0B,EAAuB,yBAAyB;IAC1E,uBAAuB,EAA0B,cAAc;IAC/D,gCAAgC,EAAiB,2BAA2B;IAC5E,uBAAuB,EAA0B,sBAAsB;IACvE,oBAAoB,EAA6B,qBAAqB;IACtE,4CAA4C,EAAI,oBAAoB;IACpE,gCAAgC,EAAgB,eAAe;IAC/D,iCAAiC,EAAe,gBAAgB;IAChE,yBAAyB,EAAwB,kBAAkB;IACnE,uBAAuB,EAA0B,kBAAkB;IACnE,6BAA6B,EAAoB,qBAAqB;IACtE,0BAA0B,EAAuB,oBAAoB;IACrE,kBAAkB,EAA+B,kBAAkB;CACpE,CAAC;AAEF,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,MAAM,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAC5C,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,aAAa,CAAC,OAA+B;IAC3D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,qBAAqB,CACnC,OAAgC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAA4B,CAAC;AACpD,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":";;AAsGA,wBAcC;AAED,sCAMC;AAED,sDAIC;AAlID,sDAAsD;AACtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,eAAe;IACf,SAAS;IACT,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,cAAc;IACd,eAAe;IACf,eAAe;IACf,WAAW;IACX,cAAc;IACd,aAAa;IACb,QAAQ;IACR,eAAe;IACf,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IACd,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,2BAA2B;CAC5B,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG;IACxB,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,KAAK;IACL,OAAO;IACP,KAAK;IACL,aAAa;IACb,gBAAgB;CACjB,CAAC;AAEF,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,kEAAkE;AAClE,MAAM,qBAAqB,GAAG;IAC5B,2CAA2C,EAAG,cAAc;IAC5D,0BAA0B,EAAuB,yBAAyB;IAC1E,uBAAuB,EAA0B,cAAc;IAC/D,gCAAgC,EAAiB,2BAA2B;IAC5E,uBAAuB,EAA0B,sBAAsB;IACvE,oBAAoB,EAA6B,qBAAqB;IACtE,4CAA4C,EAAI,oBAAoB;IACpE,gCAAgC,EAAgB,eAAe;IAC/D,iCAAiC,EAAe,gBAAgB;IAChE,yBAAyB,EAAwB,kBAAkB;IACnE,uBAAuB,EAA0B,kBAAkB;IACnE,6BAA6B,EAAoB,qBAAqB;IACtE,0BAA0B,EAAuB,oBAAoB;IACrE,kBAAkB,EAA+B,kBAAkB;IACnE,wDAAwD,EAAG,mBAAmB;IAC9E,4BAA4B,EAAwB,2BAA2B;IAC/E,6BAA6B,EAAsB,4CAA4C;IAC/F,4BAA4B,EAAuB,+BAA+B;IAClF,0BAA0B,EAA0B,yBAAyB;IAC7E,wBAAwB,EAA4B,aAAa;IACjE,2BAA2B,EAAyB,gBAAgB;CACrE,CAAC;AAEF,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,MAAM,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAC5C,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,aAAa,CAAC,OAA+B;IAC3D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,qBAAqB,CACnC,OAAgC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAA4B,CAAC;AACpD,CAAC"}

package/dist/schemas.d.ts

@@ -1,4 +1,10 @@
 import { z } from 'zod';
+/**
+ * Reusable Zod schema for webhook URLs.
+ * Enforces: max length 2048, valid URL syntax, HTTPS-only,
+ * and rejects private/internal hostnames at parse time.
+ */
+export declare const WebhookUrlSchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
 export declare const AgentActionRequestSchema: z.ZodObject<{
     action_type: z.ZodEnum<["read", "write", "financial", "admin"]>;
     tool: z.ZodString;
@@ -6,14 +12,14 @@ export declare const AgentActionRequestSchema: z.ZodObject<{
     idempotency_key: z.ZodOptional<z.ZodString>;
     cost_estimate: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    action_type: "admin" | "read" | "write" | "financial";
     tool: string;
+    action_type: "admin" | "read" | "write" | "financial";
     payload: Record<string, unknown>;
     idempotency_key?: string | undefined;
     cost_estimate?: number | undefined;
 }, {
-    action_type: "admin" | "read" | "write" | "financial";
     tool: string;
+    action_type: "admin" | "read" | "write" | "financial";
     payload: Record<string, unknown>;
     idempotency_key?: string | undefined;
     cost_estimate?: number | undefined;
@@ -36,36 +42,53 @@ export declare const RegisterAgentSchema: z.ZodObject<{
 }>;
 export declare const PolicyRulesSchema: z.ZodObject<{
     defaultMode: z.ZodEnum<["allow", "require_approval", "block"]>;
-    rules: z.ZodArray<z.ZodObject<{
+    rules: z.ZodArray<z.ZodEffects<z.ZodObject<{
         action_type: z.ZodOptional<z.ZodEnum<["read", "write", "financial", "admin"]>>;
         tool: z.ZodOptional<z.ZodString>;
         domain: z.ZodOptional<z.ZodString>;
         decision: z.ZodEnum<["ALLOW", "REQUIRE_APPROVAL", "BLOCK"]>;
         require_two_approvals: z.ZodOptional<z.ZodBoolean>;
+        allowed_approvers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
-        action_type?: "admin" | "read" | "write" | "financial" | undefined;
         tool?: string | undefined;
+        action_type?: "admin" | "read" | "write" | "financial" | undefined;
         domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
+        allowed_approvers?: string[] | undefined;
     }, {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+        tool?: string | undefined;
         action_type?: "admin" | "read" | "write" | "financial" | undefined;
+        domain?: string | undefined;
+        require_two_approvals?: boolean | undefined;
+        allowed_approvers?: string[] | undefined;
+    }>, {
+        decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
         tool?: string | undefined;
+        action_type?: "admin" | "read" | "write" | "financial" | undefined;
         domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
+        allowed_approvers?: string[] | undefined;
+    }, {
+        decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+        tool?: string | undefined;
+        action_type?: "admin" | "read" | "write" | "financial" | undefined;
+        domain?: string | undefined;
+        require_two_approvals?: boolean | undefined;
+        allowed_approvers?: string[] | undefined;
     }>, "many">;
     http: z.ZodOptional<z.ZodObject<{
         allowedDomains: z.ZodArray<z.ZodString, "many">;
-        allowedMethods: z.ZodArray<z.ZodString, "many">;
+        allowedMethods: z.ZodArray<z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]>, "many">;
         blockList: z.ZodArray<z.ZodString, "many">;
     }, "strip", z.ZodTypeAny, {
         allowedDomains: string[];
-        allowedMethods: string[];
+        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
         blockList: string[];
     }, {
         allowedDomains: string[];
-        allowedMethods: string[];
+        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
         blockList: string[];
     }>>;
     limits: z.ZodOptional<z.ZodObject<{
@@ -82,14 +105,15 @@ export declare const PolicyRulesSchema: z.ZodObject<{
     defaultMode: "allow" | "require_approval" | "block";
     rules: {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
-        action_type?: "admin" | "read" | "write" | "financial" | undefined;
         tool?: string | undefined;
+        action_type?: "admin" | "read" | "write" | "financial" | undefined;
         domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
+        allowed_approvers?: string[] | undefined;
     }[];
     http?: {
         allowedDomains: string[];
-        allowedMethods: string[];
+        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
         blockList: string[];
     } | undefined;
     limits?: {
@@ -100,14 +124,15 @@ export declare const PolicyRulesSchema: z.ZodObject<{
     defaultMode: "allow" | "require_approval" | "block";
     rules: {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
-        action_type?: "admin" | "read" | "write" | "financial" | undefined;
         tool?: string | undefined;
+        action_type?: "admin" | "read" | "write" | "financial" | undefined;
         domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
+        allowed_approvers?: string[] | undefined;
     }[];
     http?: {
         allowedDomains: string[];
-        allowedMethods: string[];
+        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
         blockList: string[];
     } | undefined;
     limits?: {
@@ -118,11 +143,47 @@ export declare const PolicyRulesSchema: z.ZodObject<{
 export declare const ApproveRequestSchema: z.ZodObject<{
     action: z.ZodEnum<["approve", "deny"]>;
     reason: z.ZodOptional<z.ZodString>;
+    reply_message: z.ZodOptional<z.ZodString>;
+    /** Server-side biometric challenge token (mobile clients only) */
+    biometric_challenge: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     action: "approve" | "deny";
     reason?: string | undefined;
+    reply_message?: string | undefined;
+    biometric_challenge?: string | undefined;
 }, {
     action: "approve" | "deny";
     reason?: string | undefined;
+    reply_message?: string | undefined;
+    biometric_challenge?: string | undefined;
+}>;
+export declare const SendMessageSchema: z.ZodObject<{
+    content: z.ZodString;
+    thread_id: z.ZodOptional<z.ZodString>;
+    expires_at: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnknown>, Record<string, unknown>, Record<string, unknown>>>;
+}, "strip", z.ZodTypeAny, {
+    content: string;
+    thread_id?: string | undefined;
+    expires_at?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
+}, {
+    content: string;
+    thread_id?: string | undefined;
+    expires_at?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
+}>;
+export declare const AgentSendMessageSchema: z.ZodObject<{
+    content: z.ZodString;
+    thread_id: z.ZodString;
+    metadata: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnknown>, Record<string, unknown>, Record<string, unknown>>>;
+}, "strip", z.ZodTypeAny, {
+    content: string;
+    thread_id: string;
+    metadata?: Record<string, unknown> | undefined;
+}, {
+    content: string;
+    thread_id: string;
+    metadata?: Record<string, unknown> | undefined;
 }>;
 //# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;EASnC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwB5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;EAG/B,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,yEA8B1B,CAAC;AAEJ,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;EASnC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAIH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;IAI/B,kEAAkE;;;;;;;;;;;;EAElE,CAAC;AAKH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAQ5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;EAOjC,CAAC"}

package/dist/schemas.js

@@ -1,15 +1,49 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ApproveRequestSchema = exports.PolicyRulesSchema = exports.RegisterAgentSchema = exports.AgentActionRequestSchema = void 0;
+exports.AgentSendMessageSchema = exports.SendMessageSchema = exports.ApproveRequestSchema = exports.PolicyRulesSchema = exports.RegisterAgentSchema = exports.AgentActionRequestSchema = exports.WebhookUrlSchema = void 0;
 const zod_1 = require("zod");
 /** Max payload size: 64KB when serialized */
 const MAX_PAYLOAD_SIZE = 65_536;
+/** Maximum length for webhook URLs (standard URL length limit) */
+const MAX_WEBHOOK_URL_LENGTH = 2048;
+/**
+ * Reusable Zod schema for webhook URLs.
+ * Enforces: max length 2048, valid URL syntax, HTTPS-only,
+ * and rejects private/internal hostnames at parse time.
+ */
+exports.WebhookUrlSchema = zod_1.z
+    .string()
+    .max(MAX_WEBHOOK_URL_LENGTH, `Webhook URL exceeds maximum length (${MAX_WEBHOOK_URL_LENGTH} characters)`)
+    .refine((val) => {
+    try {
+        const parsed = new URL(val);
+        return parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}, { message: 'Webhook URL must be a valid HTTPS URL' })
+    .refine((val) => {
+    try {
+        const parsed = new URL(val);
+        const hostname = parsed.hostname;
+        const privatePatterns = [
+            /^127\./, /^10\./, /^172\.(1[6-9]|2\d|3[01])\./,
+            /^192\.168\./, /^169\.254\./, /^0\./,
+            /^localhost$/i, /\.local$/i, /\.internal$/i,
+        ];
+        return !privatePatterns.some((p) => p.test(hostname));
+    }
+    catch {
+        return false;
+    }
+}, { message: 'Webhook URL cannot target private or internal addresses' });
 exports.AgentActionRequestSchema = zod_1.z.object({
     action_type: zod_1.z.enum(['read', 'write', 'financial', 'admin']),
     tool: zod_1.z.string().min(1).max(100).regex(/^[a-zA-Z0-9._\-:]+$/, 'Tool name must be alphanumeric with dots, dashes, underscores, or colons'),
     payload: zod_1.z.record(zod_1.z.unknown()).refine((val) => JSON.stringify(val).length <= MAX_PAYLOAD_SIZE, { message: `Payload exceeds maximum size of ${MAX_PAYLOAD_SIZE} bytes` }),
     idempotency_key: zod_1.z.string().max(128).optional(),
-    cost_estimate: zod_1.z.number().optional(),
+    cost_estimate: zod_1.z.number().nonnegative().optional(),
 });
 exports.RegisterAgentSchema = zod_1.z.object({
     name: zod_1.z.string().min(1).max(100),
@@ -17,31 +51,49 @@ exports.RegisterAgentSchema = zod_1.z.object({
     public_key: zod_1.z.string().min(40),
     allowed_tools: zod_1.z.array(zod_1.z.string()).default([]),
 });
+const DOMAIN_RE = /^(\*\.)?([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)*[a-zA-Z]{2,}$/;
 exports.PolicyRulesSchema = zod_1.z.object({
     defaultMode: zod_1.z.enum(['allow', 'require_approval', 'block']),
     rules: zod_1.z.array(zod_1.z.object({
         action_type: zod_1.z.enum(['read', 'write', 'financial', 'admin']).optional(),
-        tool: zod_1.z.string().optional(),
-        domain: zod_1.z.string().optional(),
+        tool: zod_1.z.string().max(100).regex(/^[a-zA-Z0-9._\-:]+$/, 'Tool name must be alphanumeric with dots, dashes, underscores, or colons').optional(),
+        domain: zod_1.z.string().regex(DOMAIN_RE, 'Invalid domain format').optional(),
         decision: zod_1.z.enum(['ALLOW', 'REQUIRE_APPROVAL', 'BLOCK']),
         require_two_approvals: zod_1.z.boolean().optional(),
-    })),
+        allowed_approvers: zod_1.z.array(zod_1.z.string().uuid()).optional(),
+    }).refine(r => r.action_type || r.tool, { message: 'Rule must specify action_type or tool' })).max(100),
     http: zod_1.z
         .object({
-        allowedDomains: zod_1.z.array(zod_1.z.string()),
-        allowedMethods: zod_1.z.array(zod_1.z.string()),
-        blockList: zod_1.z.array(zod_1.z.string()),
+        allowedDomains: zod_1.z.array(zod_1.z.string().min(1).max(253).regex(DOMAIN_RE, 'Invalid domain format')),
+        allowedMethods: zod_1.z.array(zod_1.z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'])),
+        blockList: zod_1.z.array(zod_1.z.string().min(1).max(253).regex(DOMAIN_RE, 'Invalid domain format')),
     })
         .optional(),
     limits: zod_1.z
         .object({
-        maxCostPerAction: zod_1.z.number().optional(),
-        maxActionsPerHour: zod_1.z.number().optional(),
+        maxCostPerAction: zod_1.z.number().nonnegative().optional(),
+        maxActionsPerHour: zod_1.z.number().nonnegative().optional(),
     })
         .optional(),
 });
 exports.ApproveRequestSchema = zod_1.z.object({
     action: zod_1.z.enum(['approve', 'deny']),
     reason: zod_1.z.string().max(1000).optional(),
+    reply_message: zod_1.z.string().max(2000).optional(),
+    /** Server-side biometric challenge token (mobile clients only) */
+    biometric_challenge: zod_1.z.string().uuid().optional(),
+});
+/** Max metadata size: 8KB when serialized (prevents storage exhaustion) */
+const MAX_METADATA_SIZE = 8_192;
+exports.SendMessageSchema = zod_1.z.object({
+    content: zod_1.z.string().min(1).max(4096),
+    thread_id: zod_1.z.string().uuid().optional(),
+    expires_at: zod_1.z.string().datetime().optional(),
+    metadata: zod_1.z.record(zod_1.z.unknown()).refine((val) => JSON.stringify(val).length <= MAX_METADATA_SIZE, { message: `Metadata exceeds maximum size of ${MAX_METADATA_SIZE} bytes` }).optional(),
+});
+exports.AgentSendMessageSchema = zod_1.z.object({
+    content: zod_1.z.string().min(1).max(4096),
+    thread_id: zod_1.z.string().uuid(),
+    metadata: zod_1.z.record(zod_1.z.unknown()).refine((val) => JSON.stringify(val).length <= MAX_METADATA_SIZE, { message: `Metadata exceeds maximum size of ${MAX_METADATA_SIZE} bytes` }).optional(),
 });
 //# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEnB,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,0EAA0E,CAAC;IACzI,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACnC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,gBAAgB,EACvD,EAAE,OAAO,EAAE,mCAAmC,gBAAgB,QAAQ,EAAE,CACzE;IACD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnF,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC3D,KAAK,EAAE,OAAC,CAAC,KAAK,CACZ,OAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACxD,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC,CACH;IACD,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;QACnC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;QACnC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,sBAAsB,EAAE,uCAAuC,sBAAsB,cAAc,CAAC;KACxG,MAAM,CACL,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,uCAAuC,EAAE,CACrD;KACA,MAAM,CACL,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,eAAe,GAAG;YACtB,QAAQ,EAAE,OAAO,EAAE,4BAA4B;YAC/C,aAAa,EAAE,aAAa,EAAE,MAAM;YACpC,cAAc,EAAE,WAAW,EAAE,cAAc;SAC5C,CAAC;QACF,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,yDAAyD,EAAE,CACvE,CAAC;AAES,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,0EAA0E,CAAC;IACzI,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACnC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,gBAAgB,EACvD,EAAE,OAAO,EAAE,mCAAmC,gBAAgB,QAAQ,EAAE,CACzE;IACD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnF,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAExE,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC3D,KAAK,EAAE,OAAC,CAAC,KAAK,CACZ,OAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,0EAA0E,CAAC,CAAC,QAAQ,EAAE;QAC7I,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC,QAAQ,EAAE;QACvE,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACxD,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC7C,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC9F,CAAC,GAAG,CAAC,GAAG,CAAC;IACV,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC7F,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;KACzF,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACrD,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC9C,kEAAkE;IAClE,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEnB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EACxD,EAAE,OAAO,EAAE,oCAAoC,iBAAiB,QAAQ,EAAE,CAC3E,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAEU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EACxD,EAAE,OAAO,EAAE,oCAAoC,iBAAiB,QAAQ,EAAE,CAC3E,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC"}

package/dist/types.d.ts

@@ -77,6 +77,7 @@ export interface PolicyRule {
     domain?: string;
     decision: PolicyDecision;
     require_two_approvals?: boolean;
+    allowed_approvers?: string[];
 }
 export interface PolicyEvaluationResult {
     decision: PolicyDecision;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAC7D,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,uBAAuB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AACnH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACxF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;AACpE,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;IACpD,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE;QACL,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,UAAU,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,SAAS,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,EAAE,OAAO,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEnE,MAAM,MAAM,WAAW,GACnB,cAAc,GACd,eAAe,GACf,cAAc,GACd,0BAA0B,GAC1B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,UAAU,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAC7D,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,uBAAuB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AACnH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACxF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;AACpE,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;IACpD,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE;QACL,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,UAAU,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,SAAS,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,EAAE,OAAO,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEnE,MAAM,MAAM,WAAW,GACnB,cAAc,GACd,eAAe,GACf,cAAc,GACd,0BAA0B,GAC1B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,UAAU,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentlock-shared",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {

package/src/__tests__/crypto.test.ts

@@ -0,0 +1,169 @@
+import { describe, it, expect } from 'vitest';
+import nacl from 'tweetnacl';
+import { encodeBase64 } from 'tweetnacl-util';
+import {
+  encrypt,
+  decrypt,
+  envelopeEncrypt,
+  envelopeDecrypt,
+  generateKey,
+  encryptCredential,
+  decryptCredential,
+} from '../crypto.js';
+
+// Deterministic test key (not from env -- tests must not depend on MASTER_KEY)
+const testMasterKey = nacl.randomBytes(32);
+
+describe('encrypt / decrypt (low-level)', () => {
+  it('round-trips a string', () => {
+    const data = 'hello world';
+    const encrypted = encrypt(data, testMasterKey);
+    expect(encrypted).not.toBe(data);
+    expect(decrypt(encrypted, testMasterKey)).toBe(data);
+  });
+
+  it('produces different ciphertext each call (random nonce)', () => {
+    const data = 'deterministic?';
+    const a = encrypt(data, testMasterKey);
+    const b = encrypt(data, testMasterKey);
+    expect(a).not.toBe(b);
+  });
+
+  it('rejects wrong key', () => {
+    const data = 'secret';
+    const encrypted = encrypt(data, testMasterKey);
+    const wrongKey = nacl.randomBytes(32);
+    expect(() => decrypt(encrypted, wrongKey)).toThrow('Decryption failed');
+  });
+
+  it('handles empty string', () => {
+    const encrypted = encrypt('', testMasterKey);
+    expect(decrypt(encrypted, testMasterKey)).toBe('');
+  });
+
+  it('handles unicode', () => {
+    const data = 'Hello unicode world';
+    const encrypted = encrypt(data, testMasterKey);
+    expect(decrypt(encrypted, testMasterKey)).toBe(data);
+  });
+});
+
+describe('envelopeEncrypt / envelopeDecrypt', () => {
+  it('round-trips a string', () => {
+    const data = 'envelope test data';
+    const encrypted = envelopeEncrypt(data, testMasterKey);
+    expect(encrypted).toMatch(/^env1:/);
+    expect(envelopeDecrypt(encrypted, testMasterKey)).toBe(data);
+  });
+
+  it('produces different ciphertext each call (fresh DEK + nonce)', () => {
+    const data = 'same data';
+    const a = envelopeEncrypt(data, testMasterKey);
+    const b = envelopeEncrypt(data, testMasterKey);
+    expect(a).not.toBe(b);
+  });
+
+  it('rejects wrong master key', () => {
+    const data = 'secret';
+    const encrypted = envelopeEncrypt(data, testMasterKey);
+    const wrongKey = nacl.randomBytes(32);
+    expect(() => envelopeDecrypt(encrypted, wrongKey)).toThrow();
+  });
+
+  it('handles empty string', () => {
+    const encrypted = envelopeEncrypt('', testMasterKey);
+    expect(envelopeDecrypt(encrypted, testMasterKey)).toBe('');
+  });
+
+  it('handles large data', () => {
+    const data = 'x'.repeat(100_000);
+    const encrypted = envelopeEncrypt(data, testMasterKey);
+    expect(envelopeDecrypt(encrypted, testMasterKey)).toBe(data);
+  });
+
+  it('handles JSON data', () => {
+    const obj = { tool: 'http', payload: { url: 'https://example.com' }, nested: [1, 2, 3] };
+    const data = JSON.stringify(obj);
+    const encrypted = envelopeEncrypt(data, testMasterKey);
+    const decrypted = JSON.parse(envelopeDecrypt(encrypted, testMasterKey));
+    expect(decrypted).toEqual(obj);
+  });
+
+  it('envelopeDecrypt rejects non-envelope data', () => {
+    const legacy = encrypt('legacy data', testMasterKey);
+    expect(() => envelopeDecrypt(legacy, testMasterKey)).toThrow('missing env1: prefix');
+  });
+
+  it('rejects malformed envelope (no separator)', () => {
+    expect(() => envelopeDecrypt('env1:nodatahere', testMasterKey)).toThrow('missing DEK/payload separator');
+  });
+
+  it('rejects malformed envelope (empty parts)', () => {
+    // env1:: has withoutPrefix=":" where lastIndexOf(':') returns 0,
+    // caught by the separatorIndex <= 0 check
+    expect(() => envelopeDecrypt('env1::', testMasterKey)).toThrow('missing DEK/payload separator');
+    // env1:abc: has empty payload after separator
+    expect(() => envelopeDecrypt('env1:abc:', testMasterKey)).toThrow('empty DEK or payload');
+  });
+});
+
+describe('decrypt() backward compatibility', () => {
+  it('transparently decrypts envelope-encrypted data', () => {
+    const data = 'new envelope data';
+    const encrypted = envelopeEncrypt(data, testMasterKey);
+    // decrypt() should auto-detect the env1: prefix and handle it
+    expect(decrypt(encrypted, testMasterKey)).toBe(data);
+  });
+
+  it('still decrypts legacy direct-encrypted data', () => {
+    const data = 'legacy direct data';
+    const encrypted = encrypt(data, testMasterKey);
+    // Legacy data should still work with decrypt()
+    expect(decrypt(encrypted, testMasterKey)).toBe(data);
+  });
+
+  it('handles mixed legacy and envelope data in sequence', () => {
+    const legacyData = 'old format';
+    const envelopeData = 'new format';
+
+    const legacyEncrypted = encrypt(legacyData, testMasterKey);
+    const envelopeEncrypted = envelopeEncrypt(envelopeData, testMasterKey);
+
+    // Both should decrypt through the same decrypt() function
+    expect(decrypt(legacyEncrypted, testMasterKey)).toBe(legacyData);
+    expect(decrypt(envelopeEncrypted, testMasterKey)).toBe(envelopeData);
+  });
+});
+
+describe('encryptCredential / decryptCredential (existing DEK pattern)', () => {
+  it('still works correctly after envelope changes', () => {
+    const payload = { api_key: 'sk-test-12345', name: 'test-cred' };
+    const { encryptedDEK, encryptedPayload } = encryptCredential(payload, testMasterKey);
+    const decrypted = decryptCredential(encryptedDEK, encryptedPayload, testMasterKey);
+    expect(decrypted).toEqual(payload);
+  });
+});
+
+describe('envelope format structure', () => {
+  it('has exactly the env1:wrappedDEK:payload format', () => {
+    const encrypted = envelopeEncrypt('test', testMasterKey);
+    const parts = encrypted.split(':');
+    // Should be: "env1", wrappedDEK (base64), payload (base64)
+    expect(parts[0]).toBe('env1');
+    expect(parts.length).toBe(3);
+    // Both parts after prefix should be valid base64
+    expect(parts[1].length).toBeGreaterThan(0);
+    expect(parts[2].length).toBeGreaterThan(0);
+  });
+
+  it('base64 parts do not contain colons', () => {
+    // Run multiple times to catch edge cases with different random nonces
+    for (let i = 0; i < 20; i++) {
+      const encrypted = envelopeEncrypt(`test data ${i}`, testMasterKey);
+      const withoutPrefix = encrypted.slice(5); // remove "env1:"
+      const colonCount = (withoutPrefix.match(/:/g) || []).length;
+      // Exactly one colon separating wrappedDEK and payload
+      expect(colonCount).toBe(1);
+    }
+  });
+});