airlock-bot 0.2.36 → 0.2.38

package/README.md

@@ -184,7 +184,7 @@ apis:
 Interactively assign allow/ask/deny to tools discovered from your live MCP servers:
 
 ```bash
-npm run configure-agent -- --config ./airlock.yaml --agent claude-code
+airlock configure-agent --config ./airlock.yaml --agent claude-code
 ```
 
 Navigate with `j/k`, set permissions with `a`/`s`/`d` (per tool or bulk per provider), then `Enter` to edit config directly, copy to clipboard, or print YAML.
@@ -263,7 +263,6 @@ agents:
     extends: [readonly]
     exec:
       allow: ['git status', 'git diff*', 'npm test']
-      deny: ['*']
 
 approvals:
   provider:
@@ -415,7 +414,7 @@ See [`examples/sandbox-presets.yaml`](examples/sandbox-presets.yaml) for a fulle
 | --------------- | ------------- | ------------------------------------------------------------------------------------------------- |
 | TUI             | `tui`         | Terminal UI on stderr — `[a]pprove` / `[d]eny` with `j/k` navigation via `/dev/tty`               |
 | macOS dialog    | `macos`       | Native approve/deny popup via `osascript` — best for local dev on Mac                             |
-| Dashboard       | `dashboard`   | Localhost web UI (default port 4112) with live SSE updates                                        |
+| Dashboard       | `dashboard`   | Browser UI with live SSE updates; runs in-process or as a standalone admin dashboard              |
 | Telegram bot    | `telegram`    | Long-polls for replies; reply `approve ABC123` or `deny ABC123`                                   |
 | Slack webhook   | `slack`       | Incoming webhook, fire-and-forget; pair with slash commands for approvals                         |
 | Generic webhook | `webhook`     | POSTs `{requests, text}` JSON; configurable headers                                               |
@@ -424,17 +423,39 @@ See [`examples/sandbox-presets.yaml`](examples/sandbox-presets.yaml) for a fulle
 
 ## API
 
-When running in gateway mode, Airlock exposes a management API:
+When running in gateway mode, Airlock can expose a separate management API
+listener for operator/control-plane routes. It is disabled by default and binds
+to `127.0.0.1:4113` when enabled:
+
+```yaml
+server:
+  api_secret: ${AIRLOCK_API_SECRET}
+  management_api:
+    enabled: true
+    api_secret: ${MANAGEMENT_API_SECRET}
+```
 
 ```
 GET  /health                   — MCP health, pending HITL count, uptime
 GET  /hitl/pending             — list pending approval requests
-POST /hitl/approve/:id         — approve a request
-POST /hitl/deny/:id            — deny a request (body: {"reason": "..."})
+POST /hitl/approve/:id         — approve a request by canonical approval ID
+POST /hitl/deny/:id            — deny by canonical approval ID (body: {"reason": "..."})
 GET  /audit?agent=&tool=&since=&limit=  — query audit log
+GET  /events                   — dashboard approval event stream
+POST /approve?code=ABC123      — approve via manual-entry approval code
+POST /deny?code=ABC123         — deny via manual-entry approval code
+GET  /admin/tools              — dashboard tool catalog
 ```
 
-All management endpoints require `Authorization: Bearer <api_secret>` when `server.api_secret` is set.
+All management endpoints require `Authorization: Bearer <management_api.api_secret>`.
+If `management_api.api_secret` is unset, Airlock temporarily falls back to
+`server.api_secret` and emits a deprecation warning so existing deployments keep
+working while operators split the control-plane secret from the data-plane
+fallback.
+The management listener must use a different port than the agent MCP
+data-plane listener (`server.port`, default `4111`). Binding the management API
+beyond loopback requires the explicit `management_api.insecure_remote_bind: true`
+opt-in and trusted network controls.
 
 ## Testing
 
@@ -471,15 +492,21 @@ Airlock can also run as a containerized gateway:
 
 ```bash
 docker build -t airlock-bot .
+mkdir -p airlock-config
+cp examples/docker-gateway.yaml airlock-config/airlock.yaml
 docker run --rm \
   --env-file .env \
   -v "$PWD/airlock-config:/config" \
   -v airlock-data:/data \
   -p 127.0.0.1:4111:4111 \
+  -p 127.0.0.1:4113:4113 \
   -p 127.0.0.1:4112:4112 \
   airlock-bot
 ```
 
+The dashboard edits `/config/airlock.yaml` and writes `/config/airlock.bak`, so
+mount a config directory when dashboard editing is enabled.
+
 See [`examples/docker-compose.yaml`](examples/docker-compose.yaml) and
 [`docs/guides/docker-deploy.md`](docs/guides/docker-deploy.md) for a VPS or
 reverse-proxy deployment. The compose example uses split mode: the gateway mounts

package/dist/activity/stream.d.ts

@@ -0,0 +1,29 @@
+export type AirlockActivityKind = 'notification' | 'log';
+export type AirlockActivitySeverity = 'info' | 'success' | 'warning' | 'error';
+export interface AirlockActivityEvent {
+    id: string;
+    kind: AirlockActivityKind;
+    agentId: string;
+    title: string;
+    body: string;
+    severity: AirlockActivitySeverity;
+    createdAt: string;
+}
+type ActivityListener = (event: AirlockActivityEvent) => void;
+export declare class ActivityStream {
+    private maxEvents;
+    private events;
+    private listeners;
+    constructor(maxEvents?: number);
+    emit(params: {
+        kind: AirlockActivityKind;
+        agentId: string;
+        title: string;
+        body: string;
+        severity?: AirlockActivitySeverity;
+    }): AirlockActivityEvent;
+    recent(): AirlockActivityEvent[];
+    subscribe(listener: ActivityListener): () => void;
+}
+export {};
+//# sourceMappingURL=stream.d.ts.map

package/dist/activity/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/activity/stream.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,KAAK,CAAC;AACzD,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAE/E,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,uBAAuB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,KAAK,gBAAgB,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAE9D,qBAAa,cAAc;IAIb,OAAO,CAAC,SAAS;IAH7B,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,SAAS,CAA+B;gBAE5B,SAAS,SAAM;IAEnC,IAAI,CAAC,MAAM,EAAE;QACX,IAAI,EAAE,mBAAmB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,uBAAuB,CAAC;KACpC,GAAG,oBAAoB;IAqBxB,MAAM,IAAI,oBAAoB,EAAE;IAIhC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,IAAI;CAIlD"}

package/dist/activity/stream.js

@@ -0,0 +1,36 @@
+import { generateId } from '../util/id.js';
+export class ActivityStream {
+    maxEvents;
+    events = [];
+    listeners = new Set();
+    constructor(maxEvents = 200) {
+        this.maxEvents = maxEvents;
+    }
+    emit(params) {
+        const event = {
+            id: generateId(),
+            kind: params.kind,
+            agentId: params.agentId,
+            title: params.title,
+            body: params.body,
+            severity: params.severity ?? 'info',
+            createdAt: new Date().toISOString(),
+        };
+        this.events.unshift(event);
+        if (this.events.length > this.maxEvents) {
+            this.events = this.events.slice(0, this.maxEvents);
+        }
+        for (const listener of this.listeners) {
+            listener(event);
+        }
+        return event;
+    }
+    recent() {
+        return [...this.events];
+    }
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+}
+//# sourceMappingURL=stream.js.map

package/dist/activity/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../src/activity/stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAiB3C,MAAM,OAAO,cAAc;IAIL;IAHZ,MAAM,GAA2B,EAAE,CAAC;IACpC,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEhD,YAAoB,YAAY,GAAG;QAAf,cAAS,GAAT,SAAS,CAAM;IAAG,CAAC;IAEvC,IAAI,CAAC,MAMJ;QACC,MAAM,KAAK,GAAyB;YAClC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,QAA0B;QAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/airlock/context.d.ts

@@ -0,0 +1,12 @@
+export declare const AIRLOCK_CONTEXT_KEY = "_airlock";
+export declare const AIRLOCK_REASON_MAX_LENGTH = 500;
+export interface AirlockCallContext {
+    reason?: string;
+    note?: string;
+}
+export declare function extractAirlockContext(args: Record<string, unknown>): {
+    args: Record<string, unknown>;
+    context?: AirlockCallContext;
+};
+export declare function requireAirlockReason(context: AirlockCallContext | undefined): string | undefined;
+//# sourceMappingURL=context.d.ts.map

package/dist/airlock/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/airlock/context.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAC9C,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACpE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,CAoBA;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGhG"}

package/dist/airlock/context.js

@@ -0,0 +1,32 @@
+export const AIRLOCK_CONTEXT_KEY = '_airlock';
+export const AIRLOCK_REASON_MAX_LENGTH = 500;
+export function extractAirlockContext(args) {
+    const raw = args[AIRLOCK_CONTEXT_KEY];
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+        return { args };
+    }
+    const source = raw;
+    const context = {};
+    if (typeof source.reason === 'string') {
+        context.reason = clampHumanText(source.reason);
+    }
+    if (typeof source.note === 'string') {
+        context.note = clampHumanText(source.note);
+    }
+    const { [AIRLOCK_CONTEXT_KEY]: _ignored, ...cleanArgs } = args;
+    return {
+        args: cleanArgs,
+        ...(context.reason || context.note ? { context } : {}),
+    };
+}
+export function requireAirlockReason(context) {
+    const reason = context?.reason?.trim();
+    return reason ? reason : undefined;
+}
+function clampHumanText(value) {
+    const trimmed = value.trim();
+    return trimmed.length > AIRLOCK_REASON_MAX_LENGTH
+        ? trimmed.slice(0, AIRLOCK_REASON_MAX_LENGTH)
+        : trimmed;
+}
+//# sourceMappingURL=context.js.map

package/dist/airlock/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/airlock/context.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAO7C,MAAM,UAAU,qBAAqB,CAAC,IAA6B;IAIjE,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAuC;IAC1E,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,yBAAyB;QAC/C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC;AACd,CAAC"}

package/dist/airlock/tools.d.ts

@@ -0,0 +1,7 @@
+export declare const AIRLOCK_PROVIDER_ID = "airlock";
+export declare const AIRLOCK_ASK_USER_TOOL = "airlock/ask_user";
+export declare const AIRLOCK_NOTIFY_USER_TOOL = "airlock/notify_user";
+export declare const AIRLOCK_LOG_TOOL = "airlock/log";
+export declare const AIRLOCK_NON_ASK_TOOLS: readonly ["airlock/ask_user", "airlock/notify_user", "airlock/log"];
+export declare function isAirlockNonAskTool(toolName: string): boolean;
+//# sourceMappingURL=tools.d.ts.map

package/dist/airlock/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/airlock/tools.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AACxD,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C,eAAO,MAAM,qBAAqB,qEAIxB,CAAC;AAEX,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/airlock/tools.js

@@ -0,0 +1,13 @@
+export const AIRLOCK_PROVIDER_ID = 'airlock';
+export const AIRLOCK_ASK_USER_TOOL = 'airlock/ask_user';
+export const AIRLOCK_NOTIFY_USER_TOOL = 'airlock/notify_user';
+export const AIRLOCK_LOG_TOOL = 'airlock/log';
+export const AIRLOCK_NON_ASK_TOOLS = [
+    AIRLOCK_ASK_USER_TOOL,
+    AIRLOCK_NOTIFY_USER_TOOL,
+    AIRLOCK_LOG_TOOL,
+];
+export function isAirlockNonAskTool(toolName) {
+    return AIRLOCK_NON_ASK_TOOLS.includes(toolName);
+}
+//# sourceMappingURL=tools.js.map

package/dist/airlock/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/airlock/tools.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,qBAAqB;IACrB,wBAAwB;IACxB,gBAAgB;CACR,CAAC;AAEX,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC"}

package/dist/allowlist/engine.d.ts

@@ -1,9 +1,21 @@
 import type { AgentConfig } from '../config/schema.js';
 export type Decision = 'allow' | 'ask' | 'deny';
+export type DetailedDecision = Decision | 'default-deny';
+export interface AllowlistMatch {
+    pattern: string;
+    specificity: number;
+    source: 'deny' | 'remember_allow' | 'ask' | 'allow';
+}
+export interface AllowlistEvaluation {
+    decision: DetailedDecision;
+    match?: AllowlistMatch;
+    candidates: AllowlistMatch[];
+}
 export declare class AllowlistEngine {
     private agents;
     constructor(agents: Record<string, AgentConfig>);
     reload(agents: Record<string, AgentConfig>): void;
     evaluate(agentId: string, toolName: string): Decision;
+    evaluateDetailed(agentId: string, toolName: string): AllowlistEvaluation;
 }
 //# sourceMappingURL=engine.d.ts.map

package/dist/allowlist/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,qBAAa,eAAe;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IAEvD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,IAAI;IAIjD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ;CA2BtD"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,cAAc,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,KAAK,GAAG,OAAO,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IAEvD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,IAAI;IAIjD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ;IAKrD,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB;CA8CzE"}

package/dist/allowlist/engine.js

@@ -1,4 +1,4 @@
-import { bestSpecificity } from './pattern.js';
+import { bestSpecificity, specificity } from './pattern.js';
 export class AllowlistEngine {
     agents;
     constructor(agents) {
@@ -8,30 +8,55 @@ export class AllowlistEngine {
         this.agents = agents;
     }
     evaluate(agentId, toolName) {
+        const result = this.evaluateDetailed(agentId, toolName);
+        return result.decision === 'default-deny' ? 'deny' : result.decision;
+    }
+    evaluateDetailed(agentId, toolName) {
         const agent = this.agents[agentId];
         if (!agent)
-            return 'deny';
+            return { decision: 'default-deny', candidates: [] };
         // Pure specificity: most specific matching pattern wins across all tiers.
         // Ties break deny > remembered allow > ask > allow. Remembered allow is an
         // operator-approved exception that can override an exact ask rule, either
         // permanently or until it expires.
-        const denySpec = bestSpecificity(agent.deny, toolName);
-        const rememberedAllowSpec = bestSpecificity((agent.remember_allow ?? [])
+        const rememberedAllow = (agent.remember_allow ?? [])
             .filter((rule) => !rule.expires_at || Date.parse(rule.expires_at) > Date.now())
-            .map((rule) => rule.tool), toolName);
+            .map((rule) => rule.tool);
+        const candidates = [
+            ...matchingPatterns(agent.deny, toolName, 'deny'),
+            ...matchingPatterns(rememberedAllow, toolName, 'remember_allow'),
+            ...matchingPatterns(agent.ask, toolName, 'ask'),
+            ...matchingPatterns(agent.allow, toolName, 'allow'),
+        ];
+        const denySpec = bestSpecificity(agent.deny, toolName);
+        const rememberedAllowSpec = bestSpecificity(rememberedAllow, toolName);
         const askSpec = bestSpecificity(agent.ask, toolName);
         const allowSpec = bestSpecificity(agent.allow, toolName);
         const best = Math.max(denySpec, rememberedAllowSpec, askSpec, allowSpec);
-        if (best < 0)
-            return 'deny'; // no match, fail-closed
-        // Tiebreaker order: deny > remembered allow > ask > allow
-        if (denySpec === best)
-            return 'deny';
-        if (rememberedAllowSpec === best)
-            return 'allow';
-        if (askSpec === best)
-            return 'ask';
-        return 'allow';
+        if (best < 0) {
+            return { decision: 'default-deny', candidates };
+        }
+        const winningSource = denySpec === best
+            ? 'deny'
+            : rememberedAllowSpec === best
+                ? 'remember_allow'
+                : askSpec === best
+                    ? 'ask'
+                    : 'allow';
+        const match = candidates
+            .filter((candidate) => candidate.source === winningSource && candidate.specificity === best)
+            .sort((a, b) => b.pattern.length - a.pattern.length)[0];
+        return {
+            decision: winningSource === 'remember_allow' ? 'allow' : winningSource,
+            match,
+            candidates,
+        };
     }
 }
+function matchingPatterns(patterns, toolName, source) {
+    return patterns
+        .map((pattern) => ({ pattern, specificity: specificity(pattern, toolName), source }))
+        .filter((match) => match.specificity >= 0 &&
+        (source === 'deny' || source === 'remember_allow' || source === 'ask' || source === 'allow'));
+}
 //# sourceMappingURL=engine.js.map

package/dist/allowlist/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAK/C,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;IAAG,CAAC;IAE3D,MAAM,CAAC,MAAmC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,OAAe,EAAE,QAAgB;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,eAAe,CACzC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;aACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;aAC9E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,QAAQ,CACT,CAAC;QACF,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzE,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,wBAAwB;QAErD,0DAA0D;QAC1D,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACrC,IAAI,mBAAmB,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/allowlist/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAkB5D,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;IAAG,CAAC;IAE3D,MAAM,CAAC,MAAmC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,OAAe,EAAE,QAAgB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACvE,CAAC;IAED,gBAAgB,CAAC,OAAe,EAAE,QAAgB;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAEhE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;aACjD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;aAC9E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG;YACjB,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;YACjD,GAAG,gBAAgB,CAAC,eAAe,EAAE,QAAQ,EAAE,gBAAgB,CAAC;YAChE,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC;YAC/C,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;SACpD,CAAC;QAEF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,aAAa,GACjB,QAAQ,KAAK,IAAI;YACf,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,mBAAmB,KAAK,IAAI;gBAC5B,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,OAAO,KAAK,IAAI;oBAChB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,OAAO,CAAC;QAClB,MAAM,KAAK,GAAG,UAAU;aACrB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,aAAa,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC;aAC3F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,OAAO;YACL,QAAQ,EAAE,aAAa,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;YACtE,KAAK;YACL,UAAU;SACX,CAAC;IACJ,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,QAAkB,EAClB,QAAgB,EAChB,MAAgC;IAEhC,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;SACpF,MAAM,CACL,CAAC,KAAK,EAA2B,EAAE,CACjC,KAAK,CAAC,WAAW,IAAI,CAAC;QACtB,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,CAAC,CAC/F,CAAC;AACN,CAAC"}

package/dist/audit/api.d.ts

@@ -1,9 +1,11 @@
 import type { FastifyInstance } from 'fastify';
 import type { AuditLogger } from './logger.js';
+import { type RequestSecurityOptions } from '../security/request.js';
 export declare function auditApiPlugin(app: FastifyInstance, opts: {
     auditLogger: AuditLogger;
     secret?: string;
     authRequired?: boolean;
     allowedOrigins?: string[];
+    getRequestSecurity?: () => RequestSecurityOptions;
 }): Promise<void>;
 //# sourceMappingURL=api.d.ts.map

package/dist/audit/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/audit/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,wBAAsB,cAAc,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IACJ,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GACA,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/audit/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAwB,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAG3F,wBAAsB,cAAc,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IACJ,WAAW,EAAE,WAAW,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,sBAAsB,CAAC;CACnD,GACD,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/audit/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/audit/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,IAKC;IAED,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAE7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA+B,CAAC;QAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC;YAChC,KAAK;YACL,IAAI;YACJ,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG;SACzC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/audit/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAA+B,MAAM,wBAAwB,CAAC;AAE3F,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,IAME;IAEF,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAE7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA+B,CAAC;QAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC;YAChC,KAAK;YACL,IAAI;YACJ,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG;SACzC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/audit/db.d.ts

@@ -20,6 +20,16 @@ export interface HitlQueueEntry {
     created_at: string;
     resolved_at?: string;
 }
+export interface MobileDeviceEntry {
+    id: string;
+    name: string;
+    platform: 'ios';
+    push_token: string;
+    auth_token_hash: string;
+    created_at: string;
+    updated_at: string;
+    revoked_at?: string;
+}
 export declare class AuditDb {
     private db;
     private stmts;
@@ -38,6 +48,12 @@ export declare class AuditDb {
     getHitlByCode(code: string): HitlQueueEntry | undefined;
     getHitlById(id: string): HitlQueueEntry | undefined;
     getPendingHitl(): HitlQueueEntry[];
+    getHitlHistory(limit?: number): HitlQueueEntry[];
+    upsertMobileDevice(entry: Omit<MobileDeviceEntry, 'revoked_at'>): void;
+    updateMobileDevicePushToken(id: string, pushToken: string): void;
+    getMobileDeviceByAuthTokenHash(authTokenHash: string): MobileDeviceEntry | undefined;
+    getActiveMobileDevices(): MobileDeviceEntry[];
+    revokeMobileDevice(id: string): void;
     cleanup(retentionDays: number): void;
     close(): void;
 }

package/dist/audit/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/audit/db.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,OAAO;IAClB,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,KAAK,CASX;gBAEU,MAAM,EAAE,MAAM;IAM1B,OAAO,CAAC,IAAI;IAiCZ,OAAO,CAAC,iBAAiB;IAyBzB,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,IAAI;IAShD,UAAU,CAAC,OAAO,EAAE;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,UAAU,EAAE;IA0BhB,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAIvC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IASrF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIvD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAInD,cAAc,IAAI,cAAc,EAAE;IAIlC,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI;IAMpC,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/audit/db.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,OAAO;IAClB,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,KAAK,CAeX;gBAEU,MAAM,EAAE,MAAM;IAM1B,OAAO,CAAC,IAAI;IA6CZ,OAAO,CAAC,iBAAiB;IA+DzB,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,IAAI;IAShD,UAAU,CAAC,OAAO,EAAE;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,UAAU,EAAE;IA0BhB,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAIvC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IASrF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIvD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAInD,cAAc,IAAI,cAAc,EAAE;IAIlC,cAAc,CAAC,KAAK,SAAK,GAAG,cAAc,EAAE;IAK5C,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG,IAAI;IAItE,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAQhE,8BAA8B,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAMpF,sBAAsB,IAAI,iBAAiB,EAAE;IAI7C,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIpC,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI;IAMpC,KAAK,IAAI,IAAI;CAGd"}

package/dist/audit/db.js

@@ -37,6 +37,18 @@ export class AuditDb {
       );
       CREATE INDEX IF NOT EXISTS idx_hitl_status ON hitl_queue(status);
       CREATE INDEX IF NOT EXISTS idx_hitl_code   ON hitl_queue(code);
+
+      CREATE TABLE IF NOT EXISTS mobile_devices (
+        id              TEXT PRIMARY KEY,
+        name            TEXT NOT NULL,
+        platform        TEXT NOT NULL,
+        push_token      TEXT NOT NULL,
+        auth_token_hash TEXT NOT NULL UNIQUE,
+        created_at      TEXT NOT NULL,
+        updated_at      TEXT NOT NULL,
+        revoked_at      TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_mobile_devices_revoked ON mobile_devices(revoked_at);
     `);
     }
     prepareStatements() {
@@ -55,6 +67,44 @@ export class AuditDb {
             getHitlByCode: this.db.prepare('SELECT * FROM hitl_queue WHERE code = ?'),
             getHitlById: this.db.prepare('SELECT * FROM hitl_queue WHERE id = ?'),
             getPendingHitl: this.db.prepare("SELECT * FROM hitl_queue WHERE status = 'pending' ORDER BY created_at ASC"),
+            getHitlHistory: this.db.prepare(`
+        SELECT * FROM hitl_queue
+        WHERE status != 'pending'
+        ORDER BY COALESCE(resolved_at, created_at) DESC
+        LIMIT ?
+      `),
+            insertMobileDevice: this.db.prepare(`
+        INSERT INTO mobile_devices (
+          id, name, platform, push_token, auth_token_hash, created_at, updated_at, revoked_at
+        )
+        VALUES (
+          @id, @name, @platform, @push_token, @auth_token_hash, @created_at, @updated_at, NULL
+        )
+        ON CONFLICT(auth_token_hash) DO UPDATE SET
+          name = excluded.name,
+          push_token = excluded.push_token,
+          updated_at = excluded.updated_at,
+          revoked_at = NULL
+      `),
+            updateMobileDevicePushToken: this.db.prepare(`
+        UPDATE mobile_devices
+        SET push_token = @push_token, updated_at = @updated_at
+        WHERE id = @id AND revoked_at IS NULL
+      `),
+            getMobileDeviceByAuthTokenHash: this.db.prepare(`
+        SELECT * FROM mobile_devices
+        WHERE auth_token_hash = ? AND revoked_at IS NULL
+      `),
+            getActiveMobileDevices: this.db.prepare(`
+        SELECT * FROM mobile_devices
+        WHERE revoked_at IS NULL
+        ORDER BY created_at ASC
+      `),
+            revokeMobileDevice: this.db.prepare(`
+        UPDATE mobile_devices
+        SET revoked_at = @revoked_at, updated_at = @revoked_at
+        WHERE id = @id AND revoked_at IS NULL
+      `),
             cleanupAudit: this.db.prepare('DELETE FROM audit_log WHERE ts < ?'),
             cleanupHitl: this.db.prepare("DELETE FROM hitl_queue WHERE status != 'pending' AND resolved_at < ?"),
         };
@@ -109,6 +159,29 @@ export class AuditDb {
     getPendingHitl() {
         return this.stmts.getPendingHitl.all();
     }
+    getHitlHistory(limit = 50) {
+        const boundedLimit = Math.max(1, Math.min(limit, 500));
+        return this.stmts.getHitlHistory.all(boundedLimit);
+    }
+    upsertMobileDevice(entry) {
+        this.stmts.insertMobileDevice.run(entry);
+    }
+    updateMobileDevicePushToken(id, pushToken) {
+        this.stmts.updateMobileDevicePushToken.run({
+            id,
+            push_token: pushToken,
+            updated_at: new Date().toISOString(),
+        });
+    }
+    getMobileDeviceByAuthTokenHash(authTokenHash) {
+        return this.stmts.getMobileDeviceByAuthTokenHash.get(authTokenHash);
+    }
+    getActiveMobileDevices() {
+        return this.stmts.getActiveMobileDevices.all();
+    }
+    revokeMobileDevice(id) {
+        this.stmts.revokeMobileDevice.run({ id, revoked_at: new Date().toISOString() });
+    }
     cleanup(retentionDays) {
         const cutoff = new Date(Date.now() - retentionDays * 86400_000).toISOString();
         this.stmts.cleanupAudit.run(cutoff);

package/dist/audit/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/audit/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AA0BtC,MAAM,OAAO,OAAO;IACV,EAAE,CAAoB;IACtB,KAAK,CASX;IAEF,YAAY,MAAc;QACxB,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6BZ,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,KAAK,GAAG;YACX,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;OAG5B,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;OAG3B,CAAC;YACF,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAEjC,CAAC;YACF,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;YACzE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC;YACrE,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC7B,2EAA2E,CAC5E;YACD,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC;YACnE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,sEAAsE,CACvE;SACF,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAA6B;QACvC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,GAAG,KAAK;SACT,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,OAKV;QACC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAChC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAErB,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CAAC,2BAA2B,KAAK,gCAAgC,CAAC;aACzE,GAAG,CAAC,MAAM,CAAiB,CAAC;IACjC,CAAC;IAED,UAAU,CAAC,KAAqB;QAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,gBAAgB,CAAC,EAAU,EAAE,MAAgC,EAAE,MAAe;QAC5E,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAC9B,EAAE;YACF,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAA+B,CAAC;IAC1E,CAAC;IAED,WAAW,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAA+B,CAAC;IACtE,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,EAAsB,CAAC;IAC7D,CAAC;IAED,OAAO,CAAC,aAAqB;QAC3B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/audit/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAqCtC,MAAM,OAAO,OAAO;IACV,EAAE,CAAoB;IACtB,KAAK,CAeX;IAEF,YAAY,MAAc;QACxB,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAyCZ,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,KAAK,GAAG;YACX,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;OAG5B,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;OAG3B,CAAC;YACF,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAEjC,CAAC;YACF,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;YACzE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC;YACrE,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC7B,2EAA2E,CAC5E;YACD,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;OAK/B,CAAC;YACF,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;OAYnC,CAAC;YACF,2BAA2B,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;OAI5C,CAAC;YACF,8BAA8B,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;OAG/C,CAAC;YACF,sBAAsB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;OAIvC,CAAC;YACF,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;OAInC,CAAC;YACF,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC;YACnE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,sEAAsE,CACvE;SACF,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAA6B;QACvC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,GAAG,KAAK;SACT,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,OAKV;QACC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAChC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAErB,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CAAC,2BAA2B,KAAK,gCAAgC,CAAC;aACzE,GAAG,CAAC,MAAM,CAAiB,CAAC;IACjC,CAAC;IAED,UAAU,CAAC,KAAqB;QAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,gBAAgB,CAAC,EAAU,EAAE,MAAgC,EAAE,MAAe;QAC5E,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAC9B,EAAE;YACF,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAA+B,CAAC;IAC1E,CAAC;IAED,WAAW,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAA+B,CAAC;IACtE,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,EAAsB,CAAC;IAC7D,CAAC;IAED,cAAc,CAAC,KAAK,GAAG,EAAE;QACvB,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAqB,CAAC;IACzE,CAAC;IAED,kBAAkB,CAAC,KAA4C;QAC7D,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,2BAA2B,CAAC,EAAU,EAAE,SAAiB;QACvD,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,GAAG,CAAC;YACzC,EAAE;YACF,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B,CAAC,aAAqB;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,GAAG,CAAC,aAAa,CAErD,CAAC;IAChB,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAyB,CAAC;IACxE,CAAC;IAED,kBAAkB,CAAC,EAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,aAAqB;QAC3B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/audit/logger.d.ts

@@ -1,4 +1,4 @@
-import type { AuditEntry, HitlQueueEntry } from './db.js';
+import type { AuditEntry, HitlQueueEntry, MobileDeviceEntry } from './db.js';
 import type { AuditConfig } from '../config/schema.js';
 export declare class AuditLogger {
     private db;
@@ -7,6 +7,7 @@ export declare class AuditLogger {
     private cleanupTimer?;
     constructor(config: AuditConfig);
     log(entry: Omit<AuditEntry, 'id' | 'ts'>): void;
+    redactArgs(args: Record<string, unknown>): Record<string, unknown>;
     recent(n: number): AuditEntry[];
     query(filters: {
         agent?: string;
@@ -19,6 +20,12 @@ export declare class AuditLogger {
     getHitlByCode(code: string): HitlQueueEntry | undefined;
     getHitlById(id: string): HitlQueueEntry | undefined;
     getPendingHitl(): HitlQueueEntry[];
+    getHitlHistory(limit?: number): HitlQueueEntry[];
+    upsertMobileDevice(entry: Omit<MobileDeviceEntry, 'revoked_at'>): void;
+    updateMobileDevicePushToken(id: string, pushToken: string): void;
+    getMobileDeviceByAuthTokenHash(authTokenHash: string): MobileDeviceEntry | undefined;
+    getActiveMobileDevices(): MobileDeviceEntry[];
+    revokeMobileDevice(id: string): void;
     startDailyCleanup(): void;
     stop(): void;
 }

package/dist/audit/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,qBAAa,WAAW;IACtB,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,MAAM,EAAE,WAAW;IAM/B,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI;IAY/C,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE;IAI/B,KAAK,CAAC,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,EAAE;IAK/F,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAGvC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAGrF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAGvD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAGnD,cAAc,IAAI,cAAc,EAAE;IAIlC,iBAAiB,IAAI,IAAI;IAOzB,IAAI,IAAI,IAAI;CAIb"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,qBAAa,WAAW;IACtB,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,MAAM,EAAE,WAAW;IAM/B,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI;IAY/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIlE,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE;IAI/B,KAAK,CAAC,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,EAAE;IAK/F,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAGvC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAGrF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAGvD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAGnD,cAAc,IAAI,cAAc,EAAE;IAGlC,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE;IAGhD,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG,IAAI;IAGtE,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAGhE,8BAA8B,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAGpF,sBAAsB,IAAI,iBAAiB,EAAE;IAG7C,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIpC,iBAAiB,IAAI,IAAI;IAOzB,IAAI,IAAI,IAAI;CAIb"}

package/dist/audit/logger.js

@@ -22,6 +22,9 @@ export class AuditLogger {
         }
         this.db.insertAudit({ ...entry, args, ts: new Date().toISOString() });
     }
+    redactArgs(args) {
+        return redactFields(args, this.redactPatterns);
+    }
     recent(n) {
         return this.db.queryAudit({ limit: n });
     }
@@ -44,6 +47,24 @@ export class AuditLogger {
     getPendingHitl() {
         return this.db.getPendingHitl();
     }
+    getHitlHistory(limit) {
+        return this.db.getHitlHistory(limit);
+    }
+    upsertMobileDevice(entry) {
+        this.db.upsertMobileDevice(entry);
+    }
+    updateMobileDevicePushToken(id, pushToken) {
+        this.db.updateMobileDevicePushToken(id, pushToken);
+    }
+    getMobileDeviceByAuthTokenHash(authTokenHash) {
+        return this.db.getMobileDeviceByAuthTokenHash(authTokenHash);
+    }
+    getActiveMobileDevices() {
+        return this.db.getActiveMobileDevices();
+    }
+    revokeMobileDevice(id) {
+        this.db.revokeMobileDevice(id);
+    }
     startDailyCleanup() {
         this.cleanupTimer = setInterval(() => {
             this.db.cleanup(this.retentionDays);