airlock-bot 0.2.18 → 0.2.19

package/dist/allowlist/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,qBAAa,eAAe;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IAEvD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,IAAI;IAIjD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ;CAWtD"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,qBAAa,eAAe;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IAEvD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,IAAI;IAIjD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ;CAkBtD"}

package/dist/allowlist/engine.js

@@ -1,4 +1,4 @@
-import { matches } from './pattern.js';
+import { bestSpecificity } from './pattern.js';
 export class AllowlistEngine {
     agents;
     constructor(agents) {
@@ -11,14 +11,20 @@ export class AllowlistEngine {
         const agent = this.agents[agentId];
         if (!agent)
             return 'deny';
-        // deny > ask > allow > default-deny
-        if (agent.deny.some((p) => matches(p, toolName)))
+        // Pure specificity: most specific matching pattern wins across all tiers.
+        // Ties break deny > ask > allow (more restrictive wins).
+        const denySpec = bestSpecificity(agent.deny, toolName);
+        const askSpec = bestSpecificity(agent.ask, toolName);
+        const allowSpec = bestSpecificity(agent.allow, toolName);
+        const best = Math.max(denySpec, askSpec, allowSpec);
+        if (best < 0)
+            return 'deny'; // no match, fail-closed
+        // Tiebreaker order: deny > ask > allow
+        if (denySpec === best)
             return 'deny';
-        if (agent.ask.some((p) => matches(p, toolName)))
+        if (askSpec === best)
             return 'ask';
-        if (agent.allow.some((p) => matches(p, toolName)))
-            return 'allow';
-        return 'deny'; // fail-closed
+        return 'allow';
     }
 }
 //# sourceMappingURL=engine.js.map

package/dist/allowlist/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAKvC,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;IAAG,CAAC;IAE3D,MAAM,CAAC,MAAmC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,OAAe,EAAE,QAAgB;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,oCAAoC;QACpC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QAChE,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QAElE,OAAO,MAAM,CAAC,CAAC,cAAc;IAC/B,CAAC;CACF"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAK/C,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;IAAG,CAAC;IAE3D,MAAM,CAAC,MAAmC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,OAAe,EAAE,QAAgB;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,wBAAwB;QAErD,uCAAuC;QACvC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACrC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/allowlist/pattern.d.ts

@@ -5,6 +5,20 @@
  *   - Wildcard suffix: "github/*" matches "github/create_pr" but NOT "github2/foo"
  */
 export declare function matches(pattern: string, toolName: string): boolean;
+/**
+ * Return the specificity of a pattern match, or -1 if no match.
+ * Higher values = more specific. Used to resolve conflicts between
+ * ask and allow tiers — the most specific matching pattern wins.
+ *
+ *   Exact match:  pattern.length + 1  (always beats wildcards of same length)
+ *   Wildcard:     length of the non-wildcard prefix
+ *   No match:     -1
+ */
+export declare function specificity(pattern: string, toolName: string): number;
+/**
+ * Find the highest specificity among all matching patterns, or -1 if none match.
+ */
+export declare function bestSpecificity(patterns: string[], toolName: string): number;
 /**
  * Match a command string against a pattern.
  * Supports glob-style prefix matching with '*'.

package/dist/allowlist/pattern.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pattern.d.ts","sourceRoot":"","sources":["../../src/allowlist/pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAelE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAMxE"}
+{"version":3,"file":"pattern.d.ts","sourceRoot":"","sources":["../../src/allowlist/pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAkBrE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO5E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAMxE"}

package/dist/allowlist/pattern.js

@@ -5,18 +5,46 @@
  *   - Wildcard suffix: "github/*" matches "github/create_pr" but NOT "github2/foo"
  */
 export function matches(pattern, toolName) {
+    return specificity(pattern, toolName) >= 0;
+}
+/**
+ * Return the specificity of a pattern match, or -1 if no match.
+ * Higher values = more specific. Used to resolve conflicts between
+ * ask and allow tiers — the most specific matching pattern wins.
+ *
+ *   Exact match:  pattern.length + 1  (always beats wildcards of same length)
+ *   Wildcard:     length of the non-wildcard prefix
+ *   No match:     -1
+ */
+export function specificity(pattern, toolName) {
     if (pattern === toolName)
-        return true;
+        return pattern.length + 1;
     if (pattern.endsWith('/*')) {
         const prefix = pattern.slice(0, -1); // "github/"
-        return toolName.startsWith(prefix) && !toolName.slice(prefix.length).includes('/');
+        if (toolName.startsWith(prefix) && !toolName.slice(prefix.length).includes('/')) {
+            return prefix.length;
+        }
+        return -1;
     }
     if (pattern.endsWith('*')) {
-        // e.g. "git*" — simple prefix match, but must stay within same namespace
         const prefix = pattern.slice(0, -1);
-        return toolName.startsWith(prefix);
+        if (toolName.startsWith(prefix))
+            return prefix.length;
+        return -1;
     }
-    return false;
+    return -1;
+}
+/**
+ * Find the highest specificity among all matching patterns, or -1 if none match.
+ */
+export function bestSpecificity(patterns, toolName) {
+    let best = -1;
+    for (const p of patterns) {
+        const s = specificity(p, toolName);
+        if (s > best)
+            best = s;
+    }
+    return best;
 }
 /**
  * Match a command string against a pattern.

package/dist/allowlist/pattern.js.map

@@ -1 +1 @@
-{"version":3,"file":"pattern.js","sourceRoot":"","sources":["../../src/allowlist/pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,QAAgB;IACvD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;QACjD,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,yEAAyE;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAe;IAC7D,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"pattern.js","sourceRoot":"","sources":["../../src/allowlist/pattern.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,QAAgB;IACvD,OAAO,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAAgB;IAC3D,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;QACjD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACtD,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IAClE,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI;YAAE,IAAI,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAe;IAC7D,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AASjD,qBAAa,OAAO;IAWN,OAAO,CAAC,MAAM;IAV1B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,GAAG,CAAmB;IAC9B,OAAO,CAAC,SAAS,CAAc;gBAEX,MAAM,EAAE,MAAM;IAE5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8E5B,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAkBtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9C,6DAA6D;IAC7D,gBAAgB,IAAI,IAAI;IAIlB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B,+DAA+D;IAC/D,SAAS,IAAI,IAAI;CAGlB"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AASjD,qBAAa,OAAO;IAWN,OAAO,CAAC,MAAM;IAV1B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,GAAG,CAAmB;IAC9B,OAAO,CAAC,SAAS,CAAc;gBAEX,MAAM,EAAE,MAAM;IAE5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqF5B,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAkBtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9C,6DAA6D;IAC7D,gBAAgB,IAAI,IAAI;IAIlB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B,+DAA+D;IAC/D,SAAS,IAAI,IAAI;CAGlB"}

package/dist/gateway.js

@@ -7,6 +7,7 @@ import { HitlBatcher } from './hitl/batcher.js';
 import { AuditLogger } from './audit/logger.js';
 import { hitlApiPlugin } from './hitl/api.js';
 import { auditApiPlugin } from './audit/api.js';
+import { hookApiPlugin } from './hook/api.js';
 import { sseServerPlugin } from './transport/sse-server.js';
 import { createHitlProvider } from './hitl/provider-factory.js';
 import { getMcpConfigs } from './config/schema.js';
@@ -70,6 +71,13 @@ export class Gateway {
         const secret = this.config.server.api_secret;
         await this.app.register(hitlApiPlugin, { engine: this.hitlEngine, secret });
         await this.app.register(auditApiPlugin, { auditLogger: this.auditLogger, secret });
+        await this.app.register(hookApiPlugin, {
+            allowlist: this.allowlist,
+            hitlEngine: this.hitlEngine,
+            hitlBatcher: this.hitlBatcher,
+            auditLogger: this.auditLogger,
+            secret,
+        });
         await this.app.register(sseServerPlugin, {
             getDeps: (agentId) => this.buildAgentDeps(agentId),
             secret,

package/dist/gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAI5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;AAEnC,MAAM,OAAO,OAAO;IAWE;IAVZ,IAAI,CAAc;IAClB,QAAQ,CAAgB;IACxB,SAAS,CAAmB;IAC5B,UAAU,CAAc;IACxB,WAAW,CAAe;IAC1B,YAAY,CAAgB;IAC5B,WAAW,CAAe;IAC1B,GAAG,CAAmB;IACtB,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAEtC,KAAK,CAAC,KAAK;QACT,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAErC,eAAe;QACf,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;QAErC,qFAAqF;QACrF,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAE1E,MAAM,iBAAiB,GAAgB;YACrC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;YAChD,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;SAC3D,CAAC;QAEF,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAE1F,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAC9B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CACjC,CAAC;QAEF,0BAA0B;QAC1B,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACnD,KAAK,IAAI,CAAC,YAAY;iBACnB,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAEvC,8DAA8D;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAE7B,yDAAyD;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAE9B,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ;iBACV,OAAO,EAAE;iBACT,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QAEH,cAAc;QACd,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAE7C,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE;YACvC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAC1D,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACxD,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,OAAO;YACL,OAAO;YACP,WAAW;YACX,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,WAAW;YAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACzF,CAAC;IAED,6DAA6D;IAC7D,gBAAgB;QACd,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,+DAA+D;IAC/D,SAAS;QACP,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAI5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;AAEnC,MAAM,OAAO,OAAO;IAWE;IAVZ,IAAI,CAAc;IAClB,QAAQ,CAAgB;IACxB,SAAS,CAAmB;IAC5B,UAAU,CAAc;IACxB,WAAW,CAAe;IAC1B,YAAY,CAAgB;IAC5B,WAAW,CAAe;IAC1B,GAAG,CAAmB;IACtB,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAEtC,KAAK,CAAC,KAAK;QACT,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAErC,eAAe;QACf,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;QAErC,qFAAqF;QACrF,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAE1E,MAAM,iBAAiB,GAAgB;YACrC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;YAChD,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;SAC3D,CAAC;QAEF,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAE1F,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAC9B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CACjC,CAAC;QAEF,0BAA0B;QAC1B,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACnD,KAAK,IAAI,CAAC,YAAY;iBACnB,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAEvC,8DAA8D;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAE7B,yDAAyD;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAE9B,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ;iBACV,OAAO,EAAE;iBACT,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QAEH,cAAc;QACd,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAE7C,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE;YACvC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAC1D,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACxD,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,OAAO;YACL,OAAO;YACP,WAAW;YACX,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,WAAW;YAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACzF,CAAC;IAED,6DAA6D;IAC7D,gBAAgB;QACd,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,+DAA+D;IAC/D,SAAS;QACP,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/hook/api.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyInstance } from 'fastify';
+import type { AllowlistEngine } from '../allowlist/engine.js';
+import type { HitlEngine } from '../hitl/engine.js';
+import type { HitlBatcher } from '../hitl/batcher.js';
+import type { AuditLogger } from '../audit/logger.js';
+export interface HookApiOpts {
+    allowlist: AllowlistEngine;
+    hitlEngine: HitlEngine;
+    hitlBatcher: HitlBatcher;
+    auditLogger: AuditLogger;
+    secret?: string;
+}
+export declare function hookApiPlugin(app: FastifyInstance, opts: HookApiOpts): Promise<void>;
+//# sourceMappingURL=api.d.ts.map

package/dist/hook/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/hook/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAatD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,wBAAsB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA2E1F"}

package/dist/hook/api.js

@@ -0,0 +1,74 @@
+import { timingSafeEqual } from 'crypto';
+import { normalizeTool } from './normalizer.js';
+import { childLogger } from '../util/logger.js';
+const log = childLogger('hook-api');
+function constantTimeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+// eslint-disable-next-line @typescript-eslint/require-await
+export async function hookApiPlugin(app, opts) {
+    const { allowlist, hitlEngine, hitlBatcher, auditLogger, secret } = opts;
+    app.addHook('preHandler', async (request, reply) => {
+        if (!secret)
+            return;
+        const auth = request.headers.authorization ?? '';
+        if (!constantTimeEqual(auth, `Bearer ${secret}`)) {
+            return reply.status(401).send({ error: 'Unauthorized' });
+        }
+    });
+    app.post('/hook', async (request, reply) => {
+        const body = request.body;
+        if (!body?.client || !body?.tool) {
+            return reply.status(400).send({ error: 'Missing required fields: client, tool' });
+        }
+        const { client, agent, tool, input = {}, session_id } = body;
+        // Explicit agent takes precedence, otherwise fall back to client name
+        const agentId = agent ?? client;
+        const normalized = normalizeTool(client, tool, input);
+        log.info({ client, agent: agentId, tool, normalized: normalized.name, session_id }, 'Hook evaluation request');
+        const decision = allowlist.evaluate(agentId, normalized.name);
+        // Log to audit
+        auditLogger.log({
+            agent_id: agentId,
+            tool: normalized.name,
+            args: JSON.stringify(input),
+            result: `hook_${decision}`,
+        });
+        if (decision === 'allow') {
+            return reply.send({ decision: 'allow', tool: normalized.name });
+        }
+        if (decision === 'deny') {
+            return reply.send({
+                decision: 'deny',
+                tool: normalized.name,
+                reason: 'Tool not allowed by policy',
+            });
+        }
+        // decision === 'ask' — create HITL ticket and long-poll
+        const ticket = hitlEngine.create({
+            agentId,
+            tool: normalized.name,
+            args: input,
+        });
+        hitlBatcher.add({
+            id: ticket.id,
+            code: ticket.code,
+            agentId,
+            tool: normalized.name,
+            args: input,
+            timeoutMs: hitlEngine.timeoutMs,
+        });
+        log.info({ ticket: ticket.id, code: ticket.code }, 'Hook waiting for HITL approval');
+        const result = await ticket.result;
+        if (result === 'approved') {
+            return reply.send({ decision: 'allow', tool: normalized.name });
+        }
+        const reason = result === 'timeout' ? 'Approval timed out' : 'Denied by operator';
+        return reply.send({ decision: 'deny', tool: normalized.name, reason });
+    });
+}
+//# sourceMappingURL=api.js.map

package/dist/hook/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/hook/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAMzC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;AAEpC,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAkBD,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB,EAAE,IAAiB;IACzE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEzE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAmC,CAAC;QAEzD,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAE7D,sEAAsE;QACtE,MAAM,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC;QAChC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAEtD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAE/G,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAE9D,eAAe;QACf,WAAW,CAAC,GAAG,CAAC;YACd,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,QAAQ,QAAQ,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,MAAM,EAAE,4BAA4B;aACrC,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YAC/B,OAAO;YACP,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,WAAW,CAAC,GAAG,CAAC;YACd,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;YACP,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAErF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAEnC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/hook/normalizer.d.ts

@@ -0,0 +1,26 @@
+export interface NormalizedTool {
+    /** Airlock tool name, e.g. "bash/git", "file/edit", "bash/_complex" */
+    name: string;
+    /** Extracted executable for bash commands, e.g. "git", "npm" */
+    executable?: string;
+}
+/**
+ * Check if a command string is "simple" — a single command with no
+ * shell metacharacters that could chain or inject additional commands.
+ */
+export declare function isSimpleCommand(command: string): boolean;
+/**
+ * Extract the executable name from a simple command string.
+ * Handles path-prefixed commands (e.g. /usr/bin/git → git)
+ * and leading env vars (e.g. FOO=bar git status → git).
+ */
+export declare function extractExecutable(command: string): string | null;
+/**
+ * Normalize an external tool name into Airlock's namespaced format.
+ *
+ * For bash/shell tools, inspects the command to produce fine-grained
+ * names like "bash/git", "bash/npm", or "bash/_complex" for commands
+ * with shell metacharacters.
+ */
+export declare function normalizeTool(client: string, tool: string, input: Record<string, unknown>): NormalizedTool;
+//# sourceMappingURL=normalizer.d.ts.map

package/dist/hook/normalizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizer.d.ts","sourceRoot":"","sources":["../../src/hook/normalizer.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA2BD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBhE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,cAAc,CA+BhB"}

package/dist/hook/normalizer.js

@@ -0,0 +1,84 @@
+import path from 'path';
+/** Shell metacharacters that indicate a non-simple command */
+const COMPLEX_COMMAND_RE = /[;|&`$(){}><]/;
+/**
+ * Tool name mappings per client.
+ * Maps external tool names → Airlock namespace/tool format.
+ * Unknown tools pass through as-is.
+ */
+const CLIENT_TOOL_MAPS = {
+    'claude-code': {
+        Bash: 'bash',
+        Edit: 'file/edit',
+        Read: 'file/read',
+        Write: 'file/write',
+        Glob: 'file/glob',
+        Grep: 'file/grep',
+        WebFetch: 'http/fetch',
+        WebSearch: 'http/search',
+        Agent: 'agent/spawn',
+        TodoRead: 'todo/read',
+        TodoWrite: 'todo/write',
+        NotebookEdit: 'notebook/edit',
+    },
+};
+/**
+ * Check if a command string is "simple" — a single command with no
+ * shell metacharacters that could chain or inject additional commands.
+ */
+export function isSimpleCommand(command) {
+    return !COMPLEX_COMMAND_RE.test(command);
+}
+/**
+ * Extract the executable name from a simple command string.
+ * Handles path-prefixed commands (e.g. /usr/bin/git → git)
+ * and leading env vars (e.g. FOO=bar git status → git).
+ */
+export function extractExecutable(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return null;
+    const tokens = trimmed.split(/\s+/);
+    // Skip leading env var assignments (KEY=VALUE)
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) {
+        i++;
+    }
+    const exe = tokens[i];
+    if (!exe)
+        return null;
+    return path.basename(exe);
+}
+/**
+ * Normalize an external tool name into Airlock's namespaced format.
+ *
+ * For bash/shell tools, inspects the command to produce fine-grained
+ * names like "bash/git", "bash/npm", or "bash/_complex" for commands
+ * with shell metacharacters.
+ */
+export function normalizeTool(client, tool, input) {
+    const mapping = CLIENT_TOOL_MAPS[client] ?? {};
+    const mapped = mapping[tool];
+    // No mapping → pass through as-is (e.g. mcp__server__tool)
+    if (mapped === undefined) {
+        return { name: tool };
+    }
+    // Non-bash tools → return the mapped name directly
+    if (mapped !== 'bash') {
+        return { name: mapped };
+    }
+    // Bash tool — inspect the command for granular matching
+    const command = typeof input.command === 'string' ? input.command : '';
+    if (!command.trim()) {
+        return { name: 'bash/_empty' };
+    }
+    if (!isSimpleCommand(command)) {
+        return { name: 'bash/_complex', executable: undefined };
+    }
+    const exe = extractExecutable(command);
+    if (!exe) {
+        return { name: 'bash/_complex' };
+    }
+    return { name: `bash/${exe}`, executable: exe };
+}
+//# sourceMappingURL=normalizer.js.map

package/dist/hook/normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizer.js","sourceRoot":"","sources":["../../src/hook/normalizer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AASxB,8DAA8D;AAC9D,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C;;;;GAIG;AACH,MAAM,gBAAgB,GAA2C;IAC/D,aAAa,EAAE;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,YAAY;QACtB,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,eAAe;KAC9B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEpC,+CAA+C;IAC/C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC,EAAE,CAAC;IACN,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,IAAY,EACZ,KAA8B;IAE9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7B,2DAA2D;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,mDAAmD;IACnD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "airlock-bot",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "Permissions-aware MCP gateway with human-in-the-loop approval for AI agents",
   "license": "MIT",
   "type": "module",