airlock-bot 0.2.36 → 0.2.38

package/dist/middleware/core/schema-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validator.js","sourceRoot":"","sources":["../../../src/middleware/core/schema-validator.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,KAAK,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAGzE,2IAA2I;AAC3I,qGAAqG;AACrG,8DAA8D;AAC9D,MAAM,GAAG,GAAI,SAAiB,CAAC,OAAO,IAAI,SAAS,CAAC;AACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC3D,0IAA0I;AAE1I,MAAM,UAAU,yBAAyB;IACvC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,WAAW;YAAE,OAAO,IAAI,EAAE,CAAC;QAEtC,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,yGAAyG;YACzG,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAqB,CAAC;YAC7D,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GACV,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;iBACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC;iBACvE,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,sBAAsB,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"schema-validator.js","sourceRoot":"","sources":["../../../src/middleware/core/schema-validator.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,KAAK,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAGzE,2IAA2I;AAC3I,qGAAqG;AACrG,8DAA8D;AAC9D,MAAM,GAAG,GAAI,SAAiB,CAAC,OAAO,IAAI,SAAS,CAAC;AACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC3D,0IAA0I;AAE1I,MAAM,UAAU,yBAAyB;IACvC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,gBAAgB,GACpB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC;YAC9D,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ;YACxD,GAAG,CAAC,QAAQ,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAC1G,IAAI,CAAC,IAAI,EAAE,WAAW;YAAE,OAAO,IAAI,EAAE,CAAC;QAEtC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACxD,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,yGAAyG;YACzG,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAqB,CAAC;YAC7D,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GACV,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;iBACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC;iBACvE,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,sBAAsB,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/post/canary-token-injector.d.ts

@@ -1,5 +1,8 @@
 import type { Middleware } from '../types.js';
-export declare function canaryTokenInjectorMiddleware(): Middleware;
+export type CanaryTokenMode = 'detect' | 'escalate';
+export declare function canaryTokenInjectorMiddleware(opts?: {
+    mode?: CanaryTokenMode;
+}): Middleware;
 /** For testing */
 export declare function getActiveCanaryTokens(): Map<string, {
     agentId: string;

package/dist/middleware/post/canary-token-injector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canary-token-injector.d.ts","sourceRoot":"","sources":["../../../src/middleware/post/canary-token-injector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqB9C,wBAAgB,6BAA6B,IAAI,UAAU,CAkC1D;AAED,kBAAkB;AAClB,wBAAgB,qBAAqB,IAAI,GAAG,CAC1C,MAAM,EACN;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CACrD,CAEA;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}
+{"version":3,"file":"canary-token-injector.d.ts","sourceRoot":"","sources":["../../../src/middleware/post/canary-token-injector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAC;AAepD,wBAAgB,6BAA6B,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,eAAe,CAAA;CAAO,GAAG,UAAU,CAsC/F;AAED,kBAAkB;AAClB,wBAAgB,qBAAqB,IAAI,GAAG,CAC1C,MAAM,EACN;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CACrD,CAEA;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/dist/middleware/post/canary-token-injector.js

@@ -14,7 +14,8 @@ function pruneExpired() {
         }
     }
 }
-export function canaryTokenInjectorMiddleware() {
+export function canaryTokenInjectorMiddleware(opts = {}) {
+    const mode = opts.mode ?? 'escalate';
     return async (ctx, next) => {
         // Pre-execution: scan inbound args for leaked canary tokens
         const argsStr = JSON.stringify(ctx.args);
@@ -28,6 +29,9 @@ export function canaryTokenInjectorMiddleware() {
                     result: 'canary_leaked',
                     error: `Canary token ${token} from ${meta.tool} found in args`,
                 });
+                if (mode === 'escalate') {
+                    ctx.meta.needsApproval = true;
+                }
             }
         }
         const response = await next();

package/dist/middleware/post/canary-token-injector.js.map

@@ -1 +1 @@
-{"version":3,"file":"canary-token-injector.js","sourceRoot":"","sources":["../../../src/middleware/post/canary-token-injector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,GAAG,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAE3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAgE,CAAC;AAC7F,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,aAAa;AAE3C,SAAS,cAAc;IACrB,OAAO,UAAU,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;YACxC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,4DAA4D;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,KAAK,CACP,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAC1E,sEAAsE,CACvE,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBACvB,QAAQ,EAAE,GAAG,CAAC,OAAO;oBACrB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC9B,MAAM,EAAE,eAAe;oBACvB,KAAK,EAAE,gBAAgB,KAAK,SAAS,IAAI,CAAC,IAAI,gBAAgB;iBAC/D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAE9B,0DAA0D;QAC1D,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,IAAI,UAAU,MAAM,MAAM,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,qBAAqB;IAInC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"canary-token-injector.js","sourceRoot":"","sources":["../../../src/middleware/post/canary-token-injector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,GAAG,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAE3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAgE,CAAC;AAC7F,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,aAAa;AAG3C,SAAS,cAAc;IACrB,OAAO,UAAU,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;YACxC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAmC,EAAE;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC;IACrC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,4DAA4D;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,KAAK,CACP,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAC1E,sEAAsE,CACvE,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBACvB,QAAQ,EAAE,GAAG,CAAC,OAAO;oBACrB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC9B,MAAM,EAAE,eAAe;oBACvB,KAAK,EAAE,gBAAgB,KAAK,SAAS,IAAI,CAAC,IAAI,gBAAgB;iBAC/D,CAAC,CAAC;gBACH,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;oBACxB,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAE9B,0DAA0D;QAC1D,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,IAAI,UAAU,MAAM,MAAM,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,qBAAqB;IAInC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC"}

package/dist/middleware/post/untrusted-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"untrusted-envelope.d.ts","sourceRoot":"","sources":["../../../src/middleware/post/untrusted-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,wBAAgB,2BAA2B,IAAI,UAAU,CAcxD"}
+{"version":3,"file":"untrusted-envelope.d.ts","sourceRoot":"","sources":["../../../src/middleware/post/untrusted-envelope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO9C,wBAAgB,2BAA2B,IAAI,UAAU,CAexD"}

package/dist/middleware/post/untrusted-envelope.js

@@ -1,9 +1,15 @@
+import { randomUUID } from 'crypto';
+function makeEnvelopeTag() {
+    const boundary = randomUUID().replace(/-/g, '').slice(0, 12);
+    return `untrusted-output-${boundary}`;
+}
 export function untrustedEnvelopeMiddleware() {
     return async (ctx, next) => {
         const response = await next();
+        const envelopeTag = makeEnvelopeTag();
         const escapedTool = ctx.toolName.replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c]);
         const escapedCallId = ctx.callId.replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c]);
-        response.text = `<untrusted-output tool="${escapedTool}" call-id="${escapedCallId}">\n${response.text}\n</untrusted-output>`;
+        response.text = `<${envelopeTag} tool="${escapedTool}" call-id="${escapedCallId}">\n${response.text}\n</${envelopeTag}>`;
         return response;
     };
 }

package/dist/middleware/post/untrusted-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"untrusted-envelope.js","sourceRoot":"","sources":["../../../src/middleware/post/untrusted-envelope.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,2BAA2B;IACzC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CACtC,SAAS,EACT,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,CACvE,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CACtC,SAAS,EACT,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,CACvE,CAAC;QACF,QAAQ,CAAC,IAAI,GAAG,2BAA2B,WAAW,cAAc,aAAa,OAAO,QAAQ,CAAC,IAAI,uBAAuB,CAAC;QAC7H,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"untrusted-envelope.js","sourceRoot":"","sources":["../../../src/middleware/post/untrusted-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGpC,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,oBAAoB,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CACtC,SAAS,EACT,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,CACvE,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CACtC,SAAS,EACT,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,CACvE,CAAC;QACF,QAAQ,CAAC,IAAI,GAAG,IAAI,WAAW,UAAU,WAAW,cAAc,aAAa,OAAO,QAAQ,CAAC,IAAI,OAAO,WAAW,GAAG,CAAC;QACzH,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/mobile/api.d.ts

@@ -0,0 +1,20 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuditLogger } from '../audit/logger.js';
+import type { ApprovalStreamClient } from '../hitl/approval-stream.js';
+import type { HitlEngine } from '../hitl/engine.js';
+import type { ActivityStream } from '../activity/stream.js';
+import { type RequestSecurityOptions } from '../security/request.js';
+interface MobileApiOptions {
+    auditLogger: AuditLogger;
+    engine: HitlEngine;
+    activityStream?: ActivityStream;
+    configPath?: string;
+    secret?: string;
+    authRequired?: boolean;
+    allowedOrigins?: string[];
+    getRequestSecurity?: () => RequestSecurityOptions;
+    approvalStream?: ApprovalStreamClient;
+}
+export declare function mobileApiPlugin(app: FastifyInstance, opts: MobileApiOptions): void;
+export {};
+//# sourceMappingURL=api.d.ts.map

package/dist/mobile/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/mobile/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAwB,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAG3F,UAAU,gBAAgB;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,sBAAsB,CAAC;IAClD,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAsCD,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAuKlF"}

package/dist/mobile/api.js

@@ -0,0 +1,255 @@
+import { createHash, randomBytes } from 'crypto';
+import { rememberAllow } from '../config/mutator.js';
+import { checkRequestSecurity } from '../security/request.js';
+import { generateId } from '../util/id.js';
+export function mobileApiPlugin(app, opts) {
+    const { auditLogger, engine } = opts;
+    app.post('/mobile/devices/register', async (request, reply) => {
+        if (!checkRequestSecurity(request, reply, opts))
+            return;
+        const body = (request.body ?? {});
+        if (body.platform !== 'ios') {
+            reply.code(400);
+            return { error: 'Only ios devices are supported' };
+        }
+        if (!body.pushToken || typeof body.pushToken !== 'string') {
+            reply.code(400);
+            return { error: 'pushToken is required' };
+        }
+        const token = `airlock_mobile_${randomBytes(32).toString('base64url')}`;
+        const now = new Date().toISOString();
+        const device = {
+            id: generateId(),
+            name: body.name?.trim() || 'iPhone',
+            platform: 'ios',
+            push_token: body.pushToken,
+            auth_token_hash: hashToken(token),
+            created_at: now,
+            updated_at: now,
+        };
+        auditLogger.upsertMobileDevice(device);
+        return {
+            id: device.id,
+            name: device.name,
+            platform: device.platform,
+            token,
+        };
+    });
+    app.get('/mobile/devices', async (request, reply) => {
+        if (!checkRequestSecurity(request, reply, opts))
+            return;
+        return {
+            devices: auditLogger.getActiveMobileDevices().map((device) => ({
+                id: device.id,
+                name: device.name,
+                platform: device.platform,
+                createdAt: device.created_at,
+                updatedAt: device.updated_at,
+            })),
+        };
+    });
+    app.delete('/mobile/devices/:id', async (request, reply) => {
+        if (!checkRequestSecurity(request, reply, opts))
+            return;
+        const { id } = request.params;
+        auditLogger.revokeMobileDevice(id);
+        return { ok: true };
+    });
+    app.delete('/mobile/device', async (request, reply) => {
+        if (!checkMobileOrAdminAuth(request, reply, opts))
+            return;
+        const device = getDeviceFromRequest(request, auditLogger);
+        if (!device) {
+            reply.code(401);
+            return { error: 'Unauthorized' };
+        }
+        auditLogger.revokeMobileDevice(device.id);
+        return { ok: true };
+    });
+    app.put('/mobile/device', async (request, reply) => {
+        if (!checkMobileOrAdminAuth(request, reply, opts))
+            return;
+        const device = getDeviceFromRequest(request, auditLogger);
+        if (!device) {
+            reply.code(401);
+            return { error: 'Unauthorized' };
+        }
+        const body = (request.body ?? {});
+        if (!body.pushToken || typeof body.pushToken !== 'string') {
+            reply.code(400);
+            return { error: 'pushToken is required' };
+        }
+        auditLogger.updateMobileDevicePushToken(device.id, body.pushToken);
+        return { ok: true };
+    });
+    app.get('/mobile/approvals', async (request, reply) => {
+        if (!checkMobileOrAdminAuth(request, reply, opts))
+            return;
+        return {
+            approvals: engine.getPending().map((entry) => {
+                const createdAt = auditLogger.getHitlById(entry.id)?.created_at ?? new Date().toISOString();
+                return {
+                    ...entry,
+                    ...(entry.context?.reason ? { reason: entry.context.reason } : {}),
+                    ...(entry.context?.note ? { note: entry.context.note } : {}),
+                    createdAt,
+                    timeoutMs: engine.timeoutMs,
+                    ...(engine.timeoutMs > 0
+                        ? { expiresAt: new Date(Date.parse(createdAt) + engine.timeoutMs).toISOString() }
+                        : {}),
+                };
+            }),
+        };
+    });
+    app.get('/mobile/approvals/history', async (request, reply) => {
+        if (!checkMobileOrAdminAuth(request, reply, opts))
+            return;
+        const { limit } = request.query;
+        const parsedLimit = limit ? Number(limit) : 50;
+        return {
+            approvals: auditLogger.getHitlHistory(parsedLimit).map(toMobileApproval),
+        };
+    });
+    app.get('/mobile/activity', async (request, reply) => {
+        if (!checkMobileOrAdminAuth(request, reply, opts))
+            return;
+        return {
+            events: opts.activityStream?.recent() ?? [],
+        };
+    });
+    app.get('/mobile/approvals/stream', (request, reply) => {
+        if (!checkMobileOrAdminAuth(request, reply, opts))
+            return;
+        if (!opts.approvalStream) {
+            reply.code(503);
+            return { error: 'Approval stream is not available' };
+        }
+        opts.approvalStream.addClient(request, reply);
+    });
+    app.post('/mobile/approvals/:id/decision', async (request, reply) => {
+        if (!checkMobileOrAdminAuth(request, reply, opts))
+            return;
+        const { id } = request.params;
+        const body = (request.body ?? {});
+        const decision = body.decision;
+        if (decision !== 'approved' && decision !== 'denied') {
+            reply.code(400);
+            return { error: 'decision must be approved or denied' };
+        }
+        const row = auditLogger.getHitlById(id);
+        if (!row || row.status !== 'pending') {
+            reply.code(404);
+            return { error: 'No pending approval found' };
+        }
+        if (!engine.hasPending(id)) {
+            reply.code(409);
+            return { error: 'Pending approval is not active in the approval engine' };
+        }
+        if (decision === 'approved') {
+            const rememberResult = applyRemember(opts.configPath, row, body);
+            if (rememberResult.error) {
+                reply.code(rememberResult.status);
+                return { error: rememberResult.error };
+            }
+            engine.approve(id);
+        }
+        else {
+            engine.deny(id, body.reason ?? 'Denied from iOS');
+        }
+        return { ok: true };
+    });
+}
+function getBearerToken(request) {
+    const header = request.headers.authorization;
+    const value = typeof header === 'string'
+        ? header
+        : Array.isArray(header) && typeof header[0] === 'string'
+            ? header[0]
+            : undefined;
+    if (!value?.startsWith('Bearer '))
+        return undefined;
+    return value.slice('Bearer '.length);
+}
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+function getDeviceFromRequest(request, auditLogger) {
+    const token = getBearerToken(request);
+    if (!token)
+        return undefined;
+    return auditLogger.getMobileDeviceByAuthTokenHash(hashToken(token));
+}
+function checkMobileOrAdminAuth(request, reply, opts) {
+    if (getDeviceFromRequest(request, opts.auditLogger))
+        return true;
+    return checkRequestSecurity(request, reply, opts);
+}
+function toMobileApproval(row) {
+    const args = parseJsonObject(row.args);
+    const context = parseAirlockContext(args);
+    const cleanArgs = stripAirlockContext(args);
+    return {
+        id: row.id,
+        code: row.code,
+        agentId: row.agent_id,
+        tool: row.tool,
+        args: cleanArgs,
+        status: row.status,
+        ...(row.reason ? { reason: row.reason } : context.reason ? { reason: context.reason } : {}),
+        ...(context.note ? { note: context.note } : {}),
+        createdAt: row.created_at,
+        ...(row.resolved_at ? { resolvedAt: row.resolved_at } : {}),
+    };
+}
+function parseJsonObject(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+function parseAirlockContext(args) {
+    const raw = args._airlock;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return {};
+    const source = raw;
+    return {
+        ...(typeof source.reason === 'string' ? { reason: source.reason } : {}),
+        ...(typeof source.note === 'string' ? { note: source.note } : {}),
+    };
+}
+function stripAirlockContext(args) {
+    const { _airlock: _ignored, ...cleanArgs } = args;
+    return cleanArgs;
+}
+function applyRemember(configPath, row, body) {
+    if (!body.remember)
+        return { status: 200 };
+    if (body.remember !== 'always' && body.remember !== 'temporary') {
+        return { status: 400, error: 'Invalid remember mode' };
+    }
+    if (!configPath)
+        return { status: 400, error: 'Config mutation is not available' };
+    if (body.duration_ms !== undefined &&
+        (!Number.isFinite(body.duration_ms) || body.duration_ms <= 0)) {
+        return { status: 400, error: 'Invalid duration_ms' };
+    }
+    try {
+        rememberAllow({
+            configPath,
+            agentId: row.agent_id,
+            tool: row.tool,
+            mode: body.remember,
+            ...(body.duration_ms ? { durationMs: body.duration_ms } : {}),
+        });
+        return { status: 200 };
+    }
+    catch {
+        return { status: 500, error: 'Failed to update config' };
+    }
+}
+//# sourceMappingURL=api.js.map

package/dist/mobile/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/mobile/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAMjD,OAAO,EAAE,aAAa,EAA0B,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAA+B,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAkD3C,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,IAAsB;IAC1E,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAErC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5D,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAExD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACxD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ;YACnC,QAAQ,EAAE,KAAc;YACxB,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC;YACjC,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,CAAC;QACF,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAEvC,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;SACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QACxD,OAAO;YACL,OAAO,EAAE,WAAW,CAAC,sBAAsB,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,SAAS,EAAE,MAAM,CAAC,UAAU;aAC7B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QACxD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpD,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACnC,CAAC;QAED,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAqB,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QACD,WAAW,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpD,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAC1D,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC5F,OAAO;oBACL,GAAG,KAAK;oBACR,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,SAAS;oBACT,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC;wBACtB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE;wBACjF,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5D,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA2C,CAAC;QACtE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,SAAS,EAAE,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACzE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,KAAK,EAAE,OAAO,EAAE,KAAK,EAA+C,EAAE;QACpE,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAC1D,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE;SAC5C,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClE,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAE1D,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAiB,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC;QAC5E,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,OAAuB;IAC7C,MAAM,MAAM,GAAY,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACtD,MAAM,KAAK,GACT,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACX,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuB,EAAE,WAAwB;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,WAAW,CAAC,8BAA8B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAuB,EACvB,KAAmB,EACnB,IAAsB;IAEtB,IAAI,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAsD;IAC9E,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9E,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA6B;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,OAAO;QACL,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA6B;IACxD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CACpB,UAA8B,EAC9B,GAAwD,EACxD,IAAkB;IAElB,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IACnF,IACE,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,EAC7D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC;YACZ,UAAU;YACV,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,IAAI,CAAC,QAA6B;YACxC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/mobile/apns.d.ts

@@ -0,0 +1,68 @@
+export interface ApnsConfig {
+    teamId: string;
+    keyId: string;
+    keyPath: string;
+    bundleId: string;
+    production: boolean;
+    interruptionLevel?: 'passive' | 'active' | 'time-sensitive';
+}
+export interface ApnsApprovalPayload {
+    id: string;
+    code: string;
+    agentId: string;
+    tool: string;
+    body: string;
+    context?: ApnsApprovalContext;
+    timeoutMs: number;
+    badgeCount?: number;
+}
+export interface ApnsApprovalContext {
+    id: string;
+    code: string;
+    agentId: string;
+    tool: string;
+    reason?: string;
+    note?: string;
+    args: Array<{
+        key: string;
+        value: string;
+    }>;
+    timeoutMs: number;
+    expiresAt?: string;
+}
+export interface ApnsApprovalStatusPayload {
+    id: string;
+    code: string;
+    result: 'approved' | 'denied' | 'timeout' | 'cancelled';
+    badgeCount: number;
+}
+export interface ApnsActivityPayload {
+    id: string;
+    kind: 'notification' | 'log';
+    agentId: string;
+    title: string;
+    body: string;
+    severity: 'info' | 'success' | 'warning' | 'error';
+    createdAt: string;
+}
+export interface ApnsSendResult {
+    ok: boolean;
+    status: number;
+    reason?: string;
+}
+export declare class ApnsClient {
+    private config;
+    private privateKey;
+    private cachedJwt?;
+    constructor(config: ApnsConfig);
+    sendApproval(deviceToken: string, approval: ApnsApprovalPayload): Promise<ApnsSendResult>;
+    sendBadge(deviceToken: string, badgeCount: number): Promise<ApnsSendResult>;
+    sendApprovalStatus(deviceToken: string, status: ApnsApprovalStatusPayload): Promise<ApnsSendResult>;
+    sendActivity(deviceToken: string, activity: ApnsActivityPayload): Promise<ApnsSendResult>;
+    private sendWithSession;
+    private sendActivityWithSession;
+    private sendBadgeWithSession;
+    private sendApprovalStatusWithSession;
+    private jwt;
+}
+//# sourceMappingURL=apns.d.ts.map

package/dist/mobile/apns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apns.d.ts","sourceRoot":"","sources":["../../src/mobile/apns.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,gBAAgB,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,GAAG,KAAK,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,UAAU;IAIT,OAAO,CAAC,MAAM;IAH1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAuC;gBAErC,MAAM,EAAE,UAAU;IAIhC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAazF,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAa3E,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,cAAc,CAAC;IAapB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAa/F,OAAO,CAAC,eAAe;IAyEvB,OAAO,CAAC,uBAAuB;IAsE/B,OAAO,CAAC,oBAAoB;IAqD5B,OAAO,CAAC,6BAA6B;IA2DrC,OAAO,CAAC,GAAG;CAsBZ"}