@adtl/gateway 0.5.1 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (102) hide show
  1. package/README.md +152 -9
  2. package/dist/approvals.d.ts +22 -6
  3. package/dist/approvals.d.ts.map +1 -1
  4. package/dist/approvals.js +56 -26
  5. package/dist/approvals.js.map +1 -1
  6. package/dist/audit.d.ts +8 -0
  7. package/dist/audit.d.ts.map +1 -1
  8. package/dist/audit.js.map +1 -1
  9. package/dist/auditCli.d.ts +2 -0
  10. package/dist/auditCli.d.ts.map +1 -1
  11. package/dist/auditCli.js +13 -10
  12. package/dist/auditCli.js.map +1 -1
  13. package/dist/cedar.d.ts +27 -0
  14. package/dist/cedar.d.ts.map +1 -0
  15. package/dist/cedar.js +134 -0
  16. package/dist/cedar.js.map +1 -0
  17. package/dist/cli.js +17 -1
  18. package/dist/cli.js.map +1 -1
  19. package/dist/config.d.ts +330 -21
  20. package/dist/config.d.ts.map +1 -1
  21. package/dist/config.js +74 -1
  22. package/dist/config.js.map +1 -1
  23. package/dist/elicitation.d.ts +25 -0
  24. package/dist/elicitation.d.ts.map +1 -0
  25. package/dist/elicitation.js +46 -0
  26. package/dist/elicitation.js.map +1 -0
  27. package/dist/gateway.d.ts +30 -5
  28. package/dist/gateway.d.ts.map +1 -1
  29. package/dist/gateway.js +96 -14
  30. package/dist/gateway.js.map +1 -1
  31. package/dist/hooks/claudeCode.d.ts +4 -0
  32. package/dist/hooks/claudeCode.d.ts.map +1 -1
  33. package/dist/hooks/claudeCode.js +8 -1
  34. package/dist/hooks/claudeCode.js.map +1 -1
  35. package/dist/hooks/run.d.ts.map +1 -1
  36. package/dist/hooks/run.js +6 -3
  37. package/dist/hooks/run.js.map +1 -1
  38. package/dist/index.d.ts +6 -0
  39. package/dist/index.d.ts.map +1 -1
  40. package/dist/index.js +6 -0
  41. package/dist/index.js.map +1 -1
  42. package/dist/init/presets.d.ts.map +1 -1
  43. package/dist/init/presets.js +54 -0
  44. package/dist/init/presets.js.map +1 -1
  45. package/dist/invoker.d.ts +21 -1
  46. package/dist/invoker.d.ts.map +1 -1
  47. package/dist/invoker.js +19 -2
  48. package/dist/invoker.js.map +1 -1
  49. package/dist/ledgerCli.d.ts +1 -1
  50. package/dist/ledgerCli.d.ts.map +1 -1
  51. package/dist/ledgerCli.js +9 -3
  52. package/dist/ledgerCli.js.map +1 -1
  53. package/dist/ntfy.d.ts +3 -1
  54. package/dist/ntfy.d.ts.map +1 -1
  55. package/dist/ntfy.js +2 -1
  56. package/dist/ntfy.js.map +1 -1
  57. package/dist/playgroundCli.d.ts +8 -0
  58. package/dist/playgroundCli.d.ts.map +1 -0
  59. package/dist/playgroundCli.js +57 -0
  60. package/dist/playgroundCli.js.map +1 -0
  61. package/dist/receipt.d.ts +62 -0
  62. package/dist/receipt.d.ts.map +1 -0
  63. package/dist/receipt.js +117 -0
  64. package/dist/receipt.js.map +1 -0
  65. package/dist/receiptCli.d.ts +8 -0
  66. package/dist/receiptCli.d.ts.map +1 -0
  67. package/dist/receiptCli.js +87 -0
  68. package/dist/receiptCli.js.map +1 -0
  69. package/dist/roles.d.ts +9 -0
  70. package/dist/roles.d.ts.map +1 -0
  71. package/dist/roles.js +41 -0
  72. package/dist/roles.js.map +1 -0
  73. package/dist/startup.d.ts +14 -0
  74. package/dist/startup.d.ts.map +1 -1
  75. package/dist/startup.js +92 -7
  76. package/dist/startup.js.map +1 -1
  77. package/package.json +16 -4
  78. package/playground/fake-github.mjs +98 -0
  79. package/playground/fake-memory.mjs +130 -0
  80. package/playground/index.html +411 -0
  81. package/playground/playground.yaml +40 -0
  82. package/playground/server.mjs +290 -0
  83. package/src/approvals.ts +63 -26
  84. package/src/audit.ts +5 -0
  85. package/src/auditCli.ts +11 -8
  86. package/src/cedar.ts +140 -0
  87. package/src/cli.ts +16 -1
  88. package/src/config.ts +80 -1
  89. package/src/elicitation.ts +69 -0
  90. package/src/gateway.ts +108 -17
  91. package/src/hooks/claudeCode.ts +13 -2
  92. package/src/hooks/run.ts +6 -3
  93. package/src/index.ts +6 -0
  94. package/src/init/presets.ts +54 -0
  95. package/src/invoker.ts +39 -2
  96. package/src/ledgerCli.ts +9 -3
  97. package/src/ntfy.ts +4 -1
  98. package/src/playgroundCli.ts +60 -0
  99. package/src/receipt.ts +148 -0
  100. package/src/receiptCli.ts +85 -0
  101. package/src/roles.ts +55 -0
  102. package/src/startup.ts +88 -6
package/dist/config.d.ts CHANGED
@@ -12,15 +12,22 @@
12
12
  * docs:
13
13
  * url: https://example.com/mcp
14
14
  * headers: { Authorization: "Bearer ${DOCS_TOKEN}" }
15
+ * principal: { id: "${USER}" } # optional: who runs this gateway (default: anonymous)
16
+ * roles: # optional: who may use which tools (deny by default)
17
+ * maintainers: { members: [alice], tools: ["github.*"] }
18
+ * readers: { members: ["*"], tools: ["github.read_*", "github.get_*"] }
19
+ * cedar: { policies: ./adtl.cedar } # optional: attribute-based rules (see cedar.ts)
15
20
  * approvals: # optional: make "ask" really ask
16
21
  * timeoutSeconds: 50
17
22
  * ntfy: { topic: "${ADTL_NTFY_TOPIC}" }
23
+ * approvers: # optional: each approver's own channel (policy rule `approvers:`)
24
+ * alice: { ntfy: { topic: "${ALICE_NTFY_TOPIC}" } }
18
25
  * email:
19
26
  * smtp: { host: smtp.example.com, port: 465, user: "${SMTP_USER}", pass: "${SMTP_PASS}" }
20
27
  * from: adtl@example.com
21
28
  * to: you@example.com
22
29
  *
23
- * `${VAR}` in command, args, env, cwd, url, headers and approval settings is
30
+ * `${VAR}` in command, args, env, cwd, url, headers, approval settings and principal.id is
24
31
  * replaced from the gateway's environment. A missing variable is a config error,
25
32
  * unless a default is given: `${VAR:-default}`.
26
33
  */
@@ -108,14 +115,14 @@ export declare const EmailConfigSchema: z.ZodObject<{
108
115
  }, "strict", z.ZodTypeAny, {
109
116
  host: string;
110
117
  port: number;
111
- secure?: boolean | undefined;
112
118
  user?: string | undefined;
119
+ secure?: boolean | undefined;
113
120
  pass?: string | undefined;
114
121
  }, {
115
122
  host: string;
123
+ user?: string | undefined;
116
124
  port?: number | undefined;
117
125
  secure?: boolean | undefined;
118
- user?: string | undefined;
119
126
  pass?: string | undefined;
120
127
  }>;
121
128
  from: z.ZodString;
@@ -126,8 +133,8 @@ export declare const EmailConfigSchema: z.ZodObject<{
126
133
  smtp: {
127
134
  host: string;
128
135
  port: number;
129
- secure?: boolean | undefined;
130
136
  user?: string | undefined;
137
+ secure?: boolean | undefined;
131
138
  pass?: string | undefined;
132
139
  };
133
140
  from: string;
@@ -135,9 +142,9 @@ export declare const EmailConfigSchema: z.ZodObject<{
135
142
  }, {
136
143
  smtp: {
137
144
  host: string;
145
+ user?: string | undefined;
138
146
  port?: number | undefined;
139
147
  secure?: boolean | undefined;
140
- user?: string | undefined;
141
148
  pass?: string | undefined;
142
149
  };
143
150
  from: string;
@@ -179,14 +186,14 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
179
186
  }, "strict", z.ZodTypeAny, {
180
187
  host: string;
181
188
  port: number;
182
- secure?: boolean | undefined;
183
189
  user?: string | undefined;
190
+ secure?: boolean | undefined;
184
191
  pass?: string | undefined;
185
192
  }, {
186
193
  host: string;
194
+ user?: string | undefined;
187
195
  port?: number | undefined;
188
196
  secure?: boolean | undefined;
189
- user?: string | undefined;
190
197
  pass?: string | undefined;
191
198
  }>;
192
199
  from: z.ZodString;
@@ -197,8 +204,8 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
197
204
  smtp: {
198
205
  host: string;
199
206
  port: number;
200
- secure?: boolean | undefined;
201
207
  user?: string | undefined;
208
+ secure?: boolean | undefined;
202
209
  pass?: string | undefined;
203
210
  };
204
211
  from: string;
@@ -206,24 +213,76 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
206
213
  }, {
207
214
  smtp: {
208
215
  host: string;
216
+ user?: string | undefined;
209
217
  port?: number | undefined;
210
218
  secure?: boolean | undefined;
211
- user?: string | undefined;
212
219
  pass?: string | undefined;
213
220
  };
214
221
  from: string;
215
222
  to: string | [string, ...string[]];
216
223
  on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
217
224
  }>>;
225
+ /**
226
+ * Also ask in the MCP client (elicitation), when it supports it. Off by
227
+ * default: a client that accepts elicitations by itself would approve calls.
228
+ */
229
+ elicitation: z.ZodDefault<z.ZodBoolean>;
230
+ /**
231
+ * Each approver's own channel, by principal id. Policy rules with
232
+ * `approvers: [role]` ask only these people, so the answer names who approved.
233
+ */
234
+ approvers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
235
+ ntfy: z.ZodObject<{
236
+ server: z.ZodDefault<z.ZodString>;
237
+ /** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
238
+ topic: z.ZodString;
239
+ /** Topic answers are posted to. Default: `<topic>-reply`. */
240
+ replyTopic: z.ZodOptional<z.ZodString>;
241
+ token: z.ZodOptional<z.ZodString>;
242
+ }, "strict", z.ZodTypeAny, {
243
+ server: string;
244
+ topic: string;
245
+ replyTopic?: string | undefined;
246
+ token?: string | undefined;
247
+ }, {
248
+ topic: string;
249
+ server?: string | undefined;
250
+ replyTopic?: string | undefined;
251
+ token?: string | undefined;
252
+ }>;
253
+ }, "strict", z.ZodTypeAny, {
254
+ ntfy: {
255
+ server: string;
256
+ topic: string;
257
+ replyTopic?: string | undefined;
258
+ token?: string | undefined;
259
+ };
260
+ }, {
261
+ ntfy: {
262
+ topic: string;
263
+ server?: string | undefined;
264
+ replyTopic?: string | undefined;
265
+ token?: string | undefined;
266
+ };
267
+ }>>>;
218
268
  }, "strict", z.ZodTypeAny, {
219
269
  timeoutSeconds: number;
270
+ elicitation: boolean;
271
+ approvers?: Record<string, {
272
+ ntfy: {
273
+ server: string;
274
+ topic: string;
275
+ replyTopic?: string | undefined;
276
+ token?: string | undefined;
277
+ };
278
+ }> | undefined;
220
279
  email?: {
221
280
  on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
222
281
  smtp: {
223
282
  host: string;
224
283
  port: number;
225
- secure?: boolean | undefined;
226
284
  user?: string | undefined;
285
+ secure?: boolean | undefined;
227
286
  pass?: string | undefined;
228
287
  };
229
288
  from: string;
@@ -236,12 +295,20 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
236
295
  token?: string | undefined;
237
296
  } | undefined;
238
297
  }, {
298
+ approvers?: Record<string, {
299
+ ntfy: {
300
+ topic: string;
301
+ server?: string | undefined;
302
+ replyTopic?: string | undefined;
303
+ token?: string | undefined;
304
+ };
305
+ }> | undefined;
239
306
  email?: {
240
307
  smtp: {
241
308
  host: string;
309
+ user?: string | undefined;
242
310
  port?: number | undefined;
243
311
  secure?: boolean | undefined;
244
- user?: string | undefined;
245
312
  pass?: string | undefined;
246
313
  };
247
314
  from: string;
@@ -255,8 +322,69 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
255
322
  replyTopic?: string | undefined;
256
323
  token?: string | undefined;
257
324
  } | undefined;
325
+ elicitation?: boolean | undefined;
258
326
  }>;
259
327
  export type ApprovalsConfig = z.infer<typeof ApprovalsConfigSchema>;
328
+ export declare const PrincipalConfigSchema: z.ZodObject<{
329
+ type: z.ZodDefault<z.ZodEnum<["user", "service"]>>;
330
+ id: z.ZodString;
331
+ claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
332
+ }, "strict", z.ZodTypeAny, {
333
+ id: string;
334
+ type: "user" | "service";
335
+ claims?: Record<string, unknown> | undefined;
336
+ }, {
337
+ id: string;
338
+ type?: "user" | "service" | undefined;
339
+ claims?: Record<string, unknown> | undefined;
340
+ }>;
341
+ export type PrincipalConfig = z.infer<typeof PrincipalConfigSchema>;
342
+ export declare const RoleSchema: z.ZodEffects<z.ZodObject<{
343
+ /** Principal ids; "*" means everyone, including an anonymous caller. */
344
+ members: z.ZodArray<z.ZodString, "atleastone">;
345
+ tools: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
346
+ prompts: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
347
+ /** Resource URI patterns, e.g. "github://acme/*". */
348
+ resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
349
+ }, "strict", z.ZodTypeAny, {
350
+ members: [string, ...string[]];
351
+ tools: string[];
352
+ prompts: string[];
353
+ resources: string[];
354
+ }, {
355
+ members: [string, ...string[]];
356
+ tools?: string[] | undefined;
357
+ prompts?: string[] | undefined;
358
+ resources?: string[] | undefined;
359
+ }>, {
360
+ members: [string, ...string[]];
361
+ tools: string[];
362
+ prompts: string[];
363
+ resources: string[];
364
+ }, {
365
+ members: [string, ...string[]];
366
+ tools?: string[] | undefined;
367
+ prompts?: string[] | undefined;
368
+ resources?: string[] | undefined;
369
+ }>;
370
+ export type RoleConfig = z.infer<typeof RoleSchema>;
371
+ export declare const CedarConfigSchema: z.ZodObject<{
372
+ /** Cedar policy file. Relative paths are resolved against the config file's directory. */
373
+ policies: z.ZodString;
374
+ /** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
375
+ entities: z.ZodOptional<z.ZodString>;
376
+ /** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
377
+ timeZone: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
378
+ }, "strict", z.ZodTypeAny, {
379
+ policies: string;
380
+ entities?: string | undefined;
381
+ timeZone?: string | undefined;
382
+ }, {
383
+ policies: string;
384
+ entities?: string | undefined;
385
+ timeZone?: string | undefined;
386
+ }>;
387
+ export type CedarConfig = z.infer<typeof CedarConfigSchema>;
260
388
  export declare const GatewayConfigSchema: z.ZodObject<{
261
389
  upstreams: z.ZodEffects<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
262
390
  command: z.ZodString;
@@ -375,14 +503,14 @@ export declare const GatewayConfigSchema: z.ZodObject<{
375
503
  }, "strict", z.ZodTypeAny, {
376
504
  host: string;
377
505
  port: number;
378
- secure?: boolean | undefined;
379
506
  user?: string | undefined;
507
+ secure?: boolean | undefined;
380
508
  pass?: string | undefined;
381
509
  }, {
382
510
  host: string;
511
+ user?: string | undefined;
383
512
  port?: number | undefined;
384
513
  secure?: boolean | undefined;
385
- user?: string | undefined;
386
514
  pass?: string | undefined;
387
515
  }>;
388
516
  from: z.ZodString;
@@ -393,8 +521,8 @@ export declare const GatewayConfigSchema: z.ZodObject<{
393
521
  smtp: {
394
522
  host: string;
395
523
  port: number;
396
- secure?: boolean | undefined;
397
524
  user?: string | undefined;
525
+ secure?: boolean | undefined;
398
526
  pass?: string | undefined;
399
527
  };
400
528
  from: string;
@@ -402,24 +530,76 @@ export declare const GatewayConfigSchema: z.ZodObject<{
402
530
  }, {
403
531
  smtp: {
404
532
  host: string;
533
+ user?: string | undefined;
405
534
  port?: number | undefined;
406
535
  secure?: boolean | undefined;
407
- user?: string | undefined;
408
536
  pass?: string | undefined;
409
537
  };
410
538
  from: string;
411
539
  to: string | [string, ...string[]];
412
540
  on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
413
541
  }>>;
542
+ /**
543
+ * Also ask in the MCP client (elicitation), when it supports it. Off by
544
+ * default: a client that accepts elicitations by itself would approve calls.
545
+ */
546
+ elicitation: z.ZodDefault<z.ZodBoolean>;
547
+ /**
548
+ * Each approver's own channel, by principal id. Policy rules with
549
+ * `approvers: [role]` ask only these people, so the answer names who approved.
550
+ */
551
+ approvers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
552
+ ntfy: z.ZodObject<{
553
+ server: z.ZodDefault<z.ZodString>;
554
+ /** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
555
+ topic: z.ZodString;
556
+ /** Topic answers are posted to. Default: `<topic>-reply`. */
557
+ replyTopic: z.ZodOptional<z.ZodString>;
558
+ token: z.ZodOptional<z.ZodString>;
559
+ }, "strict", z.ZodTypeAny, {
560
+ server: string;
561
+ topic: string;
562
+ replyTopic?: string | undefined;
563
+ token?: string | undefined;
564
+ }, {
565
+ topic: string;
566
+ server?: string | undefined;
567
+ replyTopic?: string | undefined;
568
+ token?: string | undefined;
569
+ }>;
570
+ }, "strict", z.ZodTypeAny, {
571
+ ntfy: {
572
+ server: string;
573
+ topic: string;
574
+ replyTopic?: string | undefined;
575
+ token?: string | undefined;
576
+ };
577
+ }, {
578
+ ntfy: {
579
+ topic: string;
580
+ server?: string | undefined;
581
+ replyTopic?: string | undefined;
582
+ token?: string | undefined;
583
+ };
584
+ }>>>;
414
585
  }, "strict", z.ZodTypeAny, {
415
586
  timeoutSeconds: number;
587
+ elicitation: boolean;
588
+ approvers?: Record<string, {
589
+ ntfy: {
590
+ server: string;
591
+ topic: string;
592
+ replyTopic?: string | undefined;
593
+ token?: string | undefined;
594
+ };
595
+ }> | undefined;
416
596
  email?: {
417
597
  on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
418
598
  smtp: {
419
599
  host: string;
420
600
  port: number;
421
- secure?: boolean | undefined;
422
601
  user?: string | undefined;
602
+ secure?: boolean | undefined;
423
603
  pass?: string | undefined;
424
604
  };
425
605
  from: string;
@@ -432,12 +612,20 @@ export declare const GatewayConfigSchema: z.ZodObject<{
432
612
  token?: string | undefined;
433
613
  } | undefined;
434
614
  }, {
615
+ approvers?: Record<string, {
616
+ ntfy: {
617
+ topic: string;
618
+ server?: string | undefined;
619
+ replyTopic?: string | undefined;
620
+ token?: string | undefined;
621
+ };
622
+ }> | undefined;
435
623
  email?: {
436
624
  smtp: {
437
625
  host: string;
626
+ user?: string | undefined;
438
627
  port?: number | undefined;
439
628
  secure?: boolean | undefined;
440
- user?: string | undefined;
441
629
  pass?: string | undefined;
442
630
  };
443
631
  from: string;
@@ -451,10 +639,82 @@ export declare const GatewayConfigSchema: z.ZodObject<{
451
639
  replyTopic?: string | undefined;
452
640
  token?: string | undefined;
453
641
  } | undefined;
642
+ elicitation?: boolean | undefined;
454
643
  }>>;
455
644
  /** Timeout for each interceptor invocation, in milliseconds. */
456
645
  interceptorTimeoutMs: z.ZodDefault<z.ZodNumber>;
646
+ /** Who runs this gateway. Passed to the authorizer and the interceptors. Default: anonymous. */
647
+ principal: z.ZodOptional<z.ZodObject<{
648
+ type: z.ZodDefault<z.ZodEnum<["user", "service"]>>;
649
+ id: z.ZodString;
650
+ claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
651
+ }, "strict", z.ZodTypeAny, {
652
+ id: string;
653
+ type: "user" | "service";
654
+ claims?: Record<string, unknown> | undefined;
655
+ }, {
656
+ id: string;
657
+ type?: "user" | "service" | undefined;
658
+ claims?: Record<string, unknown> | undefined;
659
+ }>>;
660
+ /** Role-based authorization: when present, a call no role grants is denied. */
661
+ roles: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
662
+ /** Principal ids; "*" means everyone, including an anonymous caller. */
663
+ members: z.ZodArray<z.ZodString, "atleastone">;
664
+ tools: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
665
+ prompts: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
666
+ /** Resource URI patterns, e.g. "github://acme/*". */
667
+ resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
668
+ }, "strict", z.ZodTypeAny, {
669
+ members: [string, ...string[]];
670
+ tools: string[];
671
+ prompts: string[];
672
+ resources: string[];
673
+ }, {
674
+ members: [string, ...string[]];
675
+ tools?: string[] | undefined;
676
+ prompts?: string[] | undefined;
677
+ resources?: string[] | undefined;
678
+ }>, {
679
+ members: [string, ...string[]];
680
+ tools: string[];
681
+ prompts: string[];
682
+ resources: string[];
683
+ }, {
684
+ members: [string, ...string[]];
685
+ tools?: string[] | undefined;
686
+ prompts?: string[] | undefined;
687
+ resources?: string[] | undefined;
688
+ }>>, Record<string, {
689
+ members: [string, ...string[]];
690
+ tools: string[];
691
+ prompts: string[];
692
+ resources: string[];
693
+ }>, Record<string, {
694
+ members: [string, ...string[]];
695
+ tools?: string[] | undefined;
696
+ prompts?: string[] | undefined;
697
+ resources?: string[] | undefined;
698
+ }>>>;
699
+ /** Cedar authorization. With roles as well, both must allow. */
700
+ cedar: z.ZodOptional<z.ZodObject<{
701
+ /** Cedar policy file. Relative paths are resolved against the config file's directory. */
702
+ policies: z.ZodString;
703
+ /** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
704
+ entities: z.ZodOptional<z.ZodString>;
705
+ /** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
706
+ timeZone: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
707
+ }, "strict", z.ZodTypeAny, {
708
+ policies: string;
709
+ entities?: string | undefined;
710
+ timeZone?: string | undefined;
711
+ }, {
712
+ policies: string;
713
+ entities?: string | undefined;
714
+ timeZone?: string | undefined;
715
+ }>>;
457
716
  }, "strict", z.ZodTypeAny, {
717
+ mode: "active" | "audit";
458
718
  upstreams: Record<string, {
459
719
  command: string;
460
720
  args: string[];
@@ -464,7 +724,6 @@ export declare const GatewayConfigSchema: z.ZodObject<{
464
724
  url: string;
465
725
  headers: Record<string, string>;
466
726
  }>;
467
- mode: "audit" | "active";
468
727
  interceptorTimeoutMs: number;
469
728
  audit?: string | undefined;
470
729
  interceptors?: {
@@ -473,15 +732,29 @@ export declare const GatewayConfigSchema: z.ZodObject<{
473
732
  env: Record<string, string>;
474
733
  cwd?: string | undefined;
475
734
  } | undefined;
735
+ principal?: {
736
+ id: string;
737
+ type: "user" | "service";
738
+ claims?: Record<string, unknown> | undefined;
739
+ } | undefined;
476
740
  approvals?: {
477
741
  timeoutSeconds: number;
742
+ elicitation: boolean;
743
+ approvers?: Record<string, {
744
+ ntfy: {
745
+ server: string;
746
+ topic: string;
747
+ replyTopic?: string | undefined;
748
+ token?: string | undefined;
749
+ };
750
+ }> | undefined;
478
751
  email?: {
479
752
  on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
480
753
  smtp: {
481
754
  host: string;
482
755
  port: number;
483
- secure?: boolean | undefined;
484
756
  user?: string | undefined;
757
+ secure?: boolean | undefined;
485
758
  pass?: string | undefined;
486
759
  };
487
760
  from: string;
@@ -494,6 +767,17 @@ export declare const GatewayConfigSchema: z.ZodObject<{
494
767
  token?: string | undefined;
495
768
  } | undefined;
496
769
  } | undefined;
770
+ roles?: Record<string, {
771
+ members: [string, ...string[]];
772
+ tools: string[];
773
+ prompts: string[];
774
+ resources: string[];
775
+ }> | undefined;
776
+ cedar?: {
777
+ policies: string;
778
+ entities?: string | undefined;
779
+ timeZone?: string | undefined;
780
+ } | undefined;
497
781
  }, {
498
782
  upstreams: Record<string, {
499
783
  command: string;
@@ -504,6 +788,7 @@ export declare const GatewayConfigSchema: z.ZodObject<{
504
788
  url: string;
505
789
  headers?: Record<string, string> | undefined;
506
790
  }>;
791
+ mode?: "active" | "audit" | undefined;
507
792
  audit?: string | undefined;
508
793
  interceptors?: {
509
794
  command: string;
@@ -511,14 +796,26 @@ export declare const GatewayConfigSchema: z.ZodObject<{
511
796
  env?: Record<string, string> | undefined;
512
797
  cwd?: string | undefined;
513
798
  } | undefined;
514
- mode?: "audit" | "active" | undefined;
799
+ principal?: {
800
+ id: string;
801
+ type?: "user" | "service" | undefined;
802
+ claims?: Record<string, unknown> | undefined;
803
+ } | undefined;
515
804
  approvals?: {
805
+ approvers?: Record<string, {
806
+ ntfy: {
807
+ topic: string;
808
+ server?: string | undefined;
809
+ replyTopic?: string | undefined;
810
+ token?: string | undefined;
811
+ };
812
+ }> | undefined;
516
813
  email?: {
517
814
  smtp: {
518
815
  host: string;
816
+ user?: string | undefined;
519
817
  port?: number | undefined;
520
818
  secure?: boolean | undefined;
521
- user?: string | undefined;
522
819
  pass?: string | undefined;
523
820
  };
524
821
  from: string;
@@ -532,8 +829,20 @@ export declare const GatewayConfigSchema: z.ZodObject<{
532
829
  replyTopic?: string | undefined;
533
830
  token?: string | undefined;
534
831
  } | undefined;
832
+ elicitation?: boolean | undefined;
535
833
  } | undefined;
536
834
  interceptorTimeoutMs?: number | undefined;
835
+ roles?: Record<string, {
836
+ members: [string, ...string[]];
837
+ tools?: string[] | undefined;
838
+ prompts?: string[] | undefined;
839
+ resources?: string[] | undefined;
840
+ }> | undefined;
841
+ cedar?: {
842
+ policies: string;
843
+ entities?: string | undefined;
844
+ timeZone?: string | undefined;
845
+ } | undefined;
537
846
  }>;
538
847
  export type GatewayConfig = z.infer<typeof GatewayConfigSchema>;
539
848
  export declare const TOOL_SEPARATOR = "__";
@@ -1 +1 @@
1
- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAOrB,CAAC;AAEZ,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;IAAqD,CAAC;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,gBAAgB;;IAGzB,+FAA+F;;IAE/F,6DAA6D;;;;;;;;;;;;;EAItD,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;QAMtB,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUtE,CAAC;AAEZ,eAAO,MAAM,qBAAqB;IAE9B;;;OAGG;;;;QA/BH,+FAA+F;;QAE/F,6DAA6D;;;;;;;;;;;;;;;;;;YAYzD,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBtE,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQ5B,8GAA8G;;;;;;;;;;;;;;;;;IAE9G,kGAAkG;;IAElG;;;OAGG;;IAEH,uFAAuF;;QA5BvF;;;WAGG;;;;YA/BH,+FAA+F;;YAE/F,6DAA6D;;;;;;;;;;;;;;;;;;gBAYzD,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4C7E,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGzD,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAIrD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQtF;AAMD,wBAAgB,cAAc,CAAC,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAY9F;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAQ3F;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,YAAY,CAE7D"}
1
+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAOrB,CAAC;AAEZ,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;IAAqD,CAAC;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,gBAAgB;;IAGzB,+FAA+F;;IAE/F,6DAA6D;;;;;;;;;;;;;EAItD,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;QAMtB,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUtE,CAAC;AAEZ,eAAO,MAAM,qBAAqB;IAE9B;;;OAGG;;;;QA/BH,+FAA+F;;QAE/F,6DAA6D;;;;;;;;;;;;;;;;;;YAYzD,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAqB7E;;;OAGG;;IAEH;;;OAGG;;;;YA3CH,+FAA+F;;YAE/F,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CtD,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;EAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,UAAU;IAEnB,wEAAwE;;;;IAIxE,qDAAqD;;;;;;;;;;;;;;;;;;;;;;EAMrD,CAAC;AACL,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,iBAAiB;IAE1B,0FAA0F;;IAE1F,4EAA4E;;IAE5E,uFAAuF;;;;;;;;;;EAchF,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQ5B,8GAA8G;;;;;;;;;;;;;;;;;IAE9G,kGAAkG;;IAElG;;;OAGG;;IAEH,uFAAuF;;QA3FvF;;;WAGG;;;;YA/BH,+FAA+F;;YAE/F,6DAA6D;;;;;;;;;;;;;;;;;;gBAYzD,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAqB7E;;;WAGG;;QAEH;;;WAGG;;;;gBA3CH,+FAA+F;;gBAE/F,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuH7D,gEAAgE;;IAEhE,gGAAgG;;;;;;;;;;;;;;IAEhG,+EAA+E;;QA3D/E,wEAAwE;;;;QAIxE,qDAAqD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4DrD,gEAAgE;;QAjDhE,0FAA0F;;QAE1F,4EAA4E;;QAE5E,uFAAuF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDhF,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAIrD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQtF;AAMD,wBAAgB,cAAc,CAAC,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAY9F;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAQ3F;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,YAAY,CAE7D"}