@adtl/gateway 0.0.0-stage → 0.1.1

package/dist/invoker.js

@@ -0,0 +1,121 @@
+import { DECISION_INFO_KEY, INVOKE_METHOD, LIST_METHOD, } from "@adtl/interceptors";
+import { z } from "zod";
+const AnyResult = z.object({}).passthrough();
+/** Untyped request: interceptor methods are extension methods the SDK does not type. */
+function request(client, method, params, timeout) {
+    const r = client.request;
+    return r.call(client, { method, params }, AnyResult, { timeout });
+}
+function priority(def, phase) {
+    const p = def.priorityHint;
+    if (p === undefined)
+        return 0;
+    if (typeof p === "number")
+        return p;
+    return p[phase] ?? 0;
+}
+function hooks(def, event, phase) {
+    return def.hooks.some((h) => h.phase === phase && (h.events.includes(event) || h.events.includes("*")));
+}
+export class InterceptorInvoker {
+    interceptors;
+    timeoutMs;
+    modeOverride;
+    constructor(interceptors, timeoutMs = 5000, 
+    /** Overrides the mode every interceptor declares. */
+    modeOverride) {
+        this.interceptors = interceptors;
+        this.timeoutMs = timeoutMs;
+        this.modeOverride = modeOverride;
+    }
+    /** Discover the interceptors an interceptor server offers. */
+    static async discover(client) {
+        const res = await request(client, LIST_METHOD, {}, 10_000);
+        const defs = (res.interceptors ?? []);
+        return defs.map((definition) => ({ client, definition }));
+    }
+    get definitions() {
+        return this.interceptors.map((i) => i.definition);
+    }
+    async runRequest(opts) {
+        const out = { payload: opts.payload, results: [], warnings: [] };
+        if (!(await this.mutate("request", opts, out)))
+            return out;
+        await this.validate("request", opts, out);
+        return out;
+    }
+    async runResponse(opts) {
+        const out = { payload: opts.payload, results: [], warnings: [] };
+        if (!(await this.validate("response", opts, out)))
+            return out;
+        await this.mutate("response", opts, out);
+        return out;
+    }
+    isAudit(i) {
+        return (this.modeOverride ?? i.definition.mode) === "audit";
+    }
+    select(type, event, phase) {
+        return this.interceptors.filter((i) => i.definition.type === type && hooks(i.definition, event, phase));
+    }
+    async invoke(i, phase, opts, payload) {
+        const res = await request(i.client, INVOKE_METHOD, { name: i.definition.name, event: opts.event, phase, payload, config: opts.config, timeoutMs: this.timeoutMs, context: opts.context }, this.timeoutMs);
+        return res;
+    }
+    /** Handle an interceptor failure. Returns false if the chain must stop. */
+    failed(i, err, out) {
+        const msg = `${i.definition.name} failed: ${err instanceof Error ? err.message : String(err)}`;
+        if (this.isAudit(i) || i.definition.failOpen === true) {
+            out.warnings.push(msg);
+            return true;
+        }
+        out.blocked = { interceptor: i.definition.name, decision: "block", reason: msg };
+        return false;
+    }
+    /** Sequential mutations, atomic: on failure the original payload is kept. */
+    async mutate(phase, opts, out) {
+        const chain = this.select("mutation", opts.event, phase).sort((a, b) => priority(a.definition, phase) - priority(b.definition, phase) || a.definition.name.localeCompare(b.definition.name));
+        let payload = out.payload;
+        for (const i of chain) {
+            let r;
+            try {
+                r = (await this.invoke(i, phase, opts, payload));
+            }
+            catch (err) {
+                if (!this.failed(i, err, out))
+                    return false;
+                continue;
+            }
+            out.results.push(r);
+            if (!this.isAudit(i) && r.modified)
+                payload = r.payload;
+        }
+        out.payload = payload;
+        return true;
+    }
+    /** Parallel validations. Only severity "error" blocks. */
+    async validate(phase, opts, out) {
+        const chain = this.select("validation", opts.event, phase);
+        const settled = await Promise.allSettled(chain.map((i) => this.invoke(i, phase, opts, out.payload)));
+        let ok = true;
+        settled.forEach((s, idx) => {
+            const i = chain[idx];
+            if (s.status === "rejected") {
+                if (!this.failed(i, s.reason, out))
+                    ok = false;
+                return;
+            }
+            const r = s.value;
+            out.results.push(r);
+            if (r.valid || r.severity !== "error" || this.isAudit(i))
+                return;
+            if (!out.blocked) {
+                const decision = r.info?.[DECISION_INFO_KEY] ?? "block";
+                const reason = r.messages?.map((m) => m.message).join("; ") || `${i.definition.name} rejected the call`;
+                out.blocked = { interceptor: i.definition.name, decision, reason };
+            }
+            ok = false;
+        });
+        return ok;
+    }
+}
+//# sourceMappingURL=invoker.js.map

package/dist/invoker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoker.js","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,WAAW,GAOZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAI7C,wFAAwF;AACxF,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe,EAAE,OAAe;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,OAAsF,CAAC;IACxG,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACpE,CAAC;AA8BD,SAAS,QAAQ,CAAC,GAA0B,EAAE,KAAY;IACxD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,KAAK,CAAC,GAA0B,EAAE,KAAa,EAAE,KAAY;IACpE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,OAAO,kBAAkB;IAEV;IACA;IAER;IAJX,YACmB,YAAgC,EAChC,YAAY,IAAI;IACjC,qDAAqD;IAC5C,YAA8B;QAHtB,iBAAY,GAAZ,YAAY,CAAoB;QAChC,cAAS,GAAT,SAAS,CAAO;QAExB,iBAAY,GAAZ,YAAY,CAAkB;IACtC,CAAC;IAEJ,8DAA8D;IAC9D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAc;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA4B,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAmB;QAClC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAmB;QACnC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,CAAmB;QACjC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC;IAC9D,CAAC;IAEO,MAAM,CAAC,IAAmC,EAAE,KAAa,EAAE,KAAY;QAC7E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,CAAmB,EAAE,KAAY,EAAE,IAAmB,EAAE,OAAgB;QAC3F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,CAAC,CAAC,MAAM,EACR,aAAa,EACb,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EACrI,IAAI,CAAC,SAAS,CACf,CAAC;QACF,OAAO,GAAmC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IACnE,MAAM,CAAC,CAAmB,EAAE,GAAY,EAAE,GAAiB;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAC9H,CAAC;QACF,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAmB,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1D,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAClD,KAAK,CAAC,QAAQ,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;YACtB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,EAAE,GAAG,KAAK,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAyB,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO;YACjE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAI,CAAC,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAA0B,IAAI,OAAO,CAAC;gBAClF,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC;gBACxG,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrE,CAAC;YACD,EAAE,GAAG,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/startup.d.ts

@@ -0,0 +1,23 @@
+import type { AdtlConfig } from "@adtl/labels";
+import { type GatewayConfig } from "./config.js";
+import { AdtlGateway, type GatewayLogger } from "./gateway.js";
+export declare class GatewayConfigError extends Error {
+    constructor(message: string);
+}
+export interface LoadedConfig {
+    path: string;
+    labels: AdtlConfig;
+    gateway: GatewayConfig;
+}
+export declare function loadGatewayConfig(path: string): Promise<LoadedConfig>;
+/** Path of the bundled adtl-interceptors CLI. */
+export declare function bundledInterceptorsCli(): string;
+export interface StartedGateway {
+    gateway: AdtlGateway;
+    close(): Promise<void>;
+}
+export declare function startGateway(loaded: LoadedConfig, opts?: {
+    env?: NodeJS.ProcessEnv;
+    logger?: GatewayLogger;
+}): Promise<StartedGateway>;
+//# sourceMappingURL=startup.d.ts.map

package/dist/startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAIL,KAAK,aAAa,EAGnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAmB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2B3E;AAED,iDAAiD;AACjD,wBAAgB,sBAAsB,IAAI,MAAM,CAI/C;AAsBD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAO,GAC7D,OAAO,CAAC,cAAc,CAAC,CAyDzB"}

package/dist/startup.js

@@ -0,0 +1,136 @@
+/**
+ * Build a running gateway from an adtl.yaml file: start the interceptor
+ * server, connect every upstream, and check that ADTL's interceptors are there.
+ */
+import { readFile } from "node:fs/promises";
+import { dirname, isAbsolute, resolve } from "node:path";
+import { createRequire } from "node:module";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { INTERCEPTORS_EXTENSION, LABEL_INTERCEPTOR, POLICY_INTERCEPTOR, parseConfigText } from "@adtl/interceptors";
+import { parse as parseYaml } from "yaml";
+import { ZodError } from "zod";
+import { JsonlAuditLog } from "./audit.js";
+import { GatewayConfigSchema, expandUpstream, isHttpUpstream, } from "./config.js";
+import { AdtlGateway, GATEWAY_VERSION } from "./gateway.js";
+import { InterceptorInvoker } from "./invoker.js";
+export class GatewayConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GatewayConfigError";
+    }
+}
+export async function loadGatewayConfig(path) {
+    const abs = resolve(path);
+    let text;
+    try {
+        text = await readFile(abs, "utf8");
+    }
+    catch (err) {
+        throw new GatewayConfigError(`Cannot read config file ${abs}: ${err.message}`);
+    }
+    let labels;
+    try {
+        labels = parseConfigText(text, abs);
+    }
+    catch (err) {
+        throw new GatewayConfigError(err.message);
+    }
+    const raw = (parseYaml(text) ?? {});
+    if (raw.gateway === undefined) {
+        throw new GatewayConfigError(`${abs}: missing "gateway:" section (at least one upstream under gateway.upstreams)`);
+    }
+    try {
+        return { path: abs, labels, gateway: GatewayConfigSchema.parse(raw.gateway) };
+    }
+    catch (err) {
+        if (err instanceof ZodError) {
+            const problems = err.issues.map((i) => `  - gateway.${i.path.join(".")}: ${i.message}`).join("\n");
+            throw new GatewayConfigError(`${abs}: invalid gateway config\n${problems}`);
+        }
+        throw err;
+    }
+}
+/** Path of the bundled adtl-interceptors CLI. */
+export function bundledInterceptorsCli() {
+    // Resolve via package.json: works in plain Node and under tools that lack import.meta.resolve.
+    const pkg = createRequire(import.meta.url).resolve("@adtl/interceptors/package.json");
+    return resolve(dirname(pkg), "dist", "cli.js");
+}
+function stdioTransport(u, baseDir) {
+    return new StdioClientTransport({
+        command: u.command,
+        args: u.args,
+        // The SDK passes only `env` when given, which would drop PATH; start from its safe defaults.
+        env: { ...getDefaultEnvironment(), ...u.env },
+        ...(u.cwd !== undefined ? { cwd: isAbsolute(u.cwd) ? u.cwd : resolve(baseDir, u.cwd) } : {}),
+        stderr: "inherit",
+    });
+}
+async function connect(id, u, baseDir) {
+    const client = new Client({ name: `adtl-gateway→${id}`, version: GATEWAY_VERSION });
+    const transport = isHttpUpstream(u)
+        ? new StreamableHTTPClientTransport(new URL(u.url), { requestInit: { headers: u.headers } })
+        : stdioTransport(u, baseDir);
+    await client.connect(transport);
+    return client;
+}
+export async function startGateway(loaded, opts = {}) {
+    const env = opts.env ?? process.env;
+    const baseDir = dirname(loaded.path);
+    const log = opts.logger ?? { info: (m) => console.error(`[adtl-gateway] ${m}`), warn: (m) => console.error(`[adtl-gateway] warning: ${m}`) };
+    const clients = [];
+    const closeAll = () => Promise.allSettled(clients.map((c) => c.close())).then(() => undefined);
+    try {
+        // 1. Interceptor server (out of process, per the Interceptors WG).
+        const icfg = loaded.gateway.interceptors
+            ? expandUpstream("interceptors", loaded.gateway.interceptors, env)
+            : { command: process.execPath, args: [bundledInterceptorsCli(), "--config", loaded.path], env: {} };
+        const interceptors = await connect("interceptors", icfg, baseDir);
+        clients.push(interceptors);
+        if (!interceptors.getServerCapabilities()?.extensions?.[INTERCEPTORS_EXTENSION]) {
+            throw new GatewayConfigError(`The interceptor server does not declare the ${INTERCEPTORS_EXTENSION} extension`);
+        }
+        const bound = await InterceptorInvoker.discover(interceptors);
+        const names = bound.map((b) => b.definition.name);
+        for (const required of [POLICY_INTERCEPTOR, LABEL_INTERCEPTOR]) {
+            if (!names.includes(required)) {
+                throw new GatewayConfigError(`The interceptor server does not offer ${required}; refusing to start without it`);
+            }
+        }
+        const audit = loaded.gateway.mode === "audit";
+        const invoker = new InterceptorInvoker(bound, loaded.gateway.interceptorTimeoutMs, audit ? "audit" : undefined);
+        log.info(`interceptors: ${names.join(", ")}`);
+        if (audit)
+            log.warn("audit mode: calls are logged but never stopped or changed");
+        // 2. Upstream servers. One failing upstream does not stop the others.
+        const upstreams = new Map();
+        const ids = Object.keys(loaded.gateway.upstreams);
+        const settled = await Promise.allSettled(ids.map((id) => connect(id, expandUpstream(id, loaded.gateway.upstreams[id], env), baseDir)));
+        settled.forEach((s, i) => {
+            const id = ids[i];
+            if (s.status === "fulfilled") {
+                clients.push(s.value);
+                upstreams.set(id, s.value);
+                if (!loaded.labels.servers[id]) {
+                    log.warn(`upstream "${id}" has no entry under servers: in the label config; its results get the default label`);
+                }
+            }
+            else {
+                log.warn(`could not connect to upstream "${id}": ${s.reason.message}`);
+            }
+        });
+        if (upstreams.size === 0)
+            throw new GatewayConfigError("No upstream server could be connected");
+        log.info(`upstreams: ${[...upstreams.keys()].join(", ")}`);
+        const auditLog = loaded.gateway.audit ? new JsonlAuditLog(resolve(baseDir, loaded.gateway.audit)) : undefined;
+        const gateway = new AdtlGateway({ upstreams, invoker, ...(auditLog ? { audit: auditLog } : {}), logger: log });
+        return { gateway, close: closeAll };
+    }
+    catch (err) {
+        await closeAll();
+        throw err;
+    }
+}
+//# sourceMappingURL=startup.js.map

package/dist/startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.js","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEpH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,cAAc,GAIf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAsB,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAQD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC7D,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,GAAG,GAAG,8EAA8E,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnG,MAAM,IAAI,kBAAkB,CAAC,GAAG,GAAG,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,sBAAsB;IACpC,+FAA+F;IAC/F,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,CAAgB,EAAE,OAAe;IACvD,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,6FAA6F;QAC7F,GAAG,EAAE,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,EAAU,EAAE,CAAW,EAAE,OAAe;IAC7D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5F,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,OAA4D,EAAE;IAE9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7J,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE/F,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,IAAI,GAAkB,MAAM,CAAC,OAAO,CAAC,YAAY;YACrD,CAAC,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;YAClE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACtG,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAkB,CAAC,+CAA+C,sBAAsB,YAAY,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,QAAQ,gCAAgC,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChH,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAEjF,sEAAsE;QACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAE,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAC9F,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACtB,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC/B,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,sFAAsF,CAAC,CAAC;gBAClH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,MAAO,CAAC,CAAC,MAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;QAChG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,61 @@
 {
   "name": "@adtl/gateway",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Experimental: MCP gateway that labels every tool result and blocks risky tool calls using ADTL trust labels",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "mcp-gateway",
+    "mcp-proxy",
+    "ai-agents",
+    "ai-security",
+    "prompt-injection",
+    "trust-labels"
+  ],
+  "author": "Murthy G",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "adtl-gateway": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "test": "vitest run"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/probita-ai/adtl.git",
+    "directory": "packages/gateway"
+  },
+  "homepage": "https://github.com/probita-ai/adtl/tree/main/packages/gateway#readme",
+  "bugs": {
+    "url": "https://github.com/probita-ai/adtl/issues"
+  },
+  "dependencies": {
+    "@adtl/interceptors": "0.1.1",
+    "@adtl/labels": "0.1.1",
+    "@modelcontextprotocol/sdk": "1.31.0",
+    "yaml": "2.9.1",
+    "zod": "3.25.76"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/audit.ts

@@ -0,0 +1,50 @@
+/**
+ * Append-only JSONL audit log. One line per tool call.
+ *
+ * Arguments and results are never written; the call is identified by its
+ * hash, so the log can be shared without leaking the data it describes.
+ */
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+
+export interface AuditEntry {
+  ts: string;
+  sessionId: string;
+  event: "tools/call";
+  server: string;
+  tool: string;
+  /** Final outcome of the call. */
+  outcome: "forwarded" | "blocked" | "upstream_error";
+  /** The policy's decision. In audit mode a call can be forwarded with decision "ask" or "block". */
+  decision?: string;
+  /** Present when the gateway ran in audit mode: nothing was stopped or changed. */
+  mode?: "audit";
+  reason?: string;
+  matched?: unknown;
+  callHash?: unknown;
+  label?: unknown;
+  sessionLabel?: unknown;
+  warnings?: string[];
+  durationMs: number;
+}
+
+export interface AuditSink {
+  write(entry: AuditEntry): void;
+}
+
+export class JsonlAuditLog implements AuditSink {
+  constructor(readonly path: string) {
+    mkdirSync(dirname(path), { recursive: true });
+  }
+
+  write(entry: AuditEntry): void {
+    appendFileSync(this.path, `${JSON.stringify(entry)}\n`, "utf8");
+  }
+}
+
+export class MemoryAuditLog implements AuditSink {
+  readonly entries: AuditEntry[] = [];
+  write(entry: AuditEntry): void {
+    this.entries.push(entry);
+  }
+}

package/src/cli.ts

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/**
+ * adtl-gateway: an MCP server for your agent that proxies to your real MCP
+ * servers through ADTL's interceptors.
+ *
+ *   adtl-gateway --config adtl.yaml [--audit]
+ *
+ * Point your MCP client (e.g. Claude Code's .mcp.json) at this command.
+ * Logs go to stderr; stdout carries MCP JSON-RPC only.
+ */
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { EnvExpansionError } from "./config.js";
+import { GATEWAY_VERSION } from "./gateway.js";
+import { GatewayConfigError, loadGatewayConfig, startGateway } from "./startup.js";
+
+const USAGE = `Usage: adtl-gateway --config <adtl.yaml> [--audit]
+
+Runs an MCP server over stdio that forwards tool calls to the upstream
+servers in the config, checking and labeling each call with ADTL.
+
+Options:
+  -c, --config <path>  ADTL config file with a gateway: section. Required.
+      --audit          Log what would be stopped, but stop nothing
+                       (same as gateway.mode: audit).
+  -v, --version        Print the version and exit.
+  -h, --help           Show this help.`;
+
+interface Args {
+  config?: string;
+  audit?: boolean;
+  help?: boolean;
+  version?: boolean;
+}
+
+function parseArgs(argv: string[]): Args {
+  const out: Args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h" || a === "--help") out.help = true;
+    else if (a === "-v" || a === "--version") out.version = true;
+    else if (a === "-c" || a === "--config") out.config = argv[++i];
+    else if (a?.startsWith("--config=")) out.config = a.slice("--config=".length);
+    else if (a === "--audit") out.audit = true;
+    else throw new GatewayConfigError(`Unknown argument: ${a}\n\n${USAGE}`);
+  }
+  return out;
+}
+
+async function main(): Promise<void> {
+  const args = parseArgs(process.argv.slice(2));
+  // --help and --version print to stdout and exit; MCP is never served in these modes.
+  if (args.help) return void console.log(USAGE);
+  if (args.version) return void console.log(GATEWAY_VERSION);
+  if (!args.config) throw new GatewayConfigError(`Missing --config\n\n${USAGE}`);
+
+  const loaded = await loadGatewayConfig(args.config);
+  if (args.audit) loaded.gateway.mode = "audit";
+  const started = await startGateway(loaded);
+  const server = started.gateway.createServer();
+
+  let closing = false;
+  const shutdown = async () => {
+    if (closing) return;
+    closing = true;
+    await server.close().catch(() => undefined);
+    await started.close();
+    process.exit(0);
+  };
+  server.onclose = () => void shutdown();
+  // The agent closing our stdin means the session is over; don't wait for a signal.
+  process.stdin.on("end", () => void shutdown());
+  process.stdin.on("close", () => void shutdown());
+  process.on("SIGINT", () => void shutdown());
+  process.on("SIGTERM", () => void shutdown());
+
+  await server.connect(new StdioServerTransport());
+  console.error(`[adtl-gateway] ${GATEWAY_VERSION} ready (session ${started.gateway.sessionId})`);
+}
+
+main().catch((err: unknown) => {
+  const known = err instanceof GatewayConfigError || err instanceof EnvExpansionError;
+  console.error(known ? `[adtl-gateway] ${(err as Error).message}` : err);
+  process.exit(1);
+});

package/src/config.ts

@@ -0,0 +1,106 @@
+/**
+ * The `gateway:` section of adtl.yaml.
+ *
+ *   gateway:
+ *     audit: ./adtl-audit.jsonl          # optional JSONL audit log
+ *     mode: audit                        # optional: log what would be stopped, stop nothing
+ *     upstreams:
+ *       github:                          # id must match `servers.github` in the label config
+ *         command: npx
+ *         args: ["-y", "@modelcontextprotocol/server-github"]
+ *         env: { GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_TOKEN}" }
+ *       docs:
+ *         url: https://example.com/mcp
+ *         headers: { Authorization: "Bearer ${DOCS_TOKEN}" }
+ *
+ * `${VAR}` in command, args, env, cwd, url and headers is replaced from the
+ * gateway's environment. A missing variable is a config error.
+ */
+import { z } from "zod";
+
+const UPSTREAM_ID = /^[A-Za-z0-9-]+$/;
+
+export const StdioUpstreamSchema = z
+  .object({
+    command: z.string().min(1),
+    args: z.array(z.string()).default([]),
+    env: z.record(z.string()).default({}),
+    cwd: z.string().optional(),
+  })
+  .strict();
+
+export const HttpUpstreamSchema = z
+  .object({
+    url: z.string().min(1),
+    headers: z.record(z.string()).default({}),
+  })
+  .strict();
+
+export const UpstreamSchema = z.union([StdioUpstreamSchema, HttpUpstreamSchema]);
+export type StdioUpstream = z.infer<typeof StdioUpstreamSchema>;
+export type HttpUpstream = z.infer<typeof HttpUpstreamSchema>;
+export type Upstream = z.infer<typeof UpstreamSchema>;
+
+export const GatewayConfigSchema = z
+  .object({
+    upstreams: z
+      .record(UpstreamSchema)
+      .refine((u) => Object.keys(u).length > 0, "At least one upstream server is required")
+      .refine((u) => Object.keys(u).every((id) => UPSTREAM_ID.test(id)), {
+        message: "Upstream ids may only contain letters, digits and '-' (they prefix tool names as <id>__<tool>)",
+      }),
+    /** How to start the interceptor server. Default: the bundled adtl-interceptors with this same config file. */
+    interceptors: StdioUpstreamSchema.optional(),
+    /** Path of a JSONL audit log. Relative paths are resolved against the config file's directory. */
+    audit: z.string().min(1).optional(),
+    /**
+     * `active` (default) enforces the policy. `audit` stops and changes nothing, and
+     * logs what would have been stopped: for trying a policy out safely.
+     */
+    mode: z.enum(["active", "audit"]).default("active"),
+    /** Timeout for each interceptor invocation, in milliseconds. */
+    interceptorTimeoutMs: z.number().int().positive().default(5000),
+  })
+  .strict();
+export type GatewayConfig = z.infer<typeof GatewayConfigSchema>;
+
+export const TOOL_SEPARATOR = "__";
+
+export class EnvExpansionError extends Error {
+  constructor(readonly variable: string, where: string) {
+    super(`Environment variable ${variable} is not set (used in ${where})`);
+    this.name = "EnvExpansionError";
+  }
+}
+
+/** Replace `${VAR}` with values from `env`. `$${VAR}` keeps a literal `${VAR}`. */
+export function expandEnv(value: string, env: NodeJS.ProcessEnv, where: string): string {
+  return value.replace(/(\$?)\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (match, escape: string, name: string) => {
+    if (escape) return match.slice(1);
+    const v = env[name];
+    if (v === undefined) throw new EnvExpansionError(name, where);
+    return v;
+  });
+}
+
+function expandRecord(rec: Record<string, string>, env: NodeJS.ProcessEnv, where: string): Record<string, string> {
+  return Object.fromEntries(Object.entries(rec).map(([k, v]) => [k, expandEnv(v, env, `${where}.${k}`)]));
+}
+
+export function expandUpstream<T extends Upstream>(id: string, u: T, env: NodeJS.ProcessEnv): T {
+  const where = `gateway.upstreams.${id}`;
+  if ("url" in u) {
+    return { ...u, url: expandEnv(u.url, env, `${where}.url`), headers: expandRecord(u.headers, env, `${where}.headers`) };
+  }
+  return {
+    ...u,
+    command: expandEnv(u.command, env, `${where}.command`),
+    args: u.args.map((a, i) => expandEnv(a, env, `${where}.args[${i}]`)),
+    env: expandRecord(u.env, env, `${where}.env`),
+    ...(u.cwd !== undefined ? { cwd: expandEnv(u.cwd, env, `${where}.cwd`) } : {}),
+  };
+}
+
+export function isHttpUpstream(u: Upstream): u is HttpUpstream {
+  return "url" in u;
+}