@adtl/gateway 0.5.1 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +152 -9
- package/dist/approvals.d.ts +22 -6
- package/dist/approvals.d.ts.map +1 -1
- package/dist/approvals.js +56 -26
- package/dist/approvals.js.map +1 -1
- package/dist/audit.d.ts +8 -0
- package/dist/audit.d.ts.map +1 -1
- package/dist/audit.js.map +1 -1
- package/dist/auditCli.d.ts +2 -0
- package/dist/auditCli.d.ts.map +1 -1
- package/dist/auditCli.js +13 -10
- package/dist/auditCli.js.map +1 -1
- package/dist/cedar.d.ts +27 -0
- package/dist/cedar.d.ts.map +1 -0
- package/dist/cedar.js +134 -0
- package/dist/cedar.js.map +1 -0
- package/dist/cli.js +17 -1
- package/dist/cli.js.map +1 -1
- package/dist/config.d.ts +330 -21
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +74 -1
- package/dist/config.js.map +1 -1
- package/dist/elicitation.d.ts +25 -0
- package/dist/elicitation.d.ts.map +1 -0
- package/dist/elicitation.js +46 -0
- package/dist/elicitation.js.map +1 -0
- package/dist/gateway.d.ts +30 -5
- package/dist/gateway.d.ts.map +1 -1
- package/dist/gateway.js +96 -14
- package/dist/gateway.js.map +1 -1
- package/dist/hooks/claudeCode.d.ts +4 -0
- package/dist/hooks/claudeCode.d.ts.map +1 -1
- package/dist/hooks/claudeCode.js +8 -1
- package/dist/hooks/claudeCode.js.map +1 -1
- package/dist/hooks/run.d.ts.map +1 -1
- package/dist/hooks/run.js +6 -3
- package/dist/hooks/run.js.map +1 -1
- package/dist/index.d.ts +6 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -0
- package/dist/index.js.map +1 -1
- package/dist/init/presets.d.ts.map +1 -1
- package/dist/init/presets.js +54 -0
- package/dist/init/presets.js.map +1 -1
- package/dist/invoker.d.ts +21 -1
- package/dist/invoker.d.ts.map +1 -1
- package/dist/invoker.js +19 -2
- package/dist/invoker.js.map +1 -1
- package/dist/ledgerCli.d.ts +1 -1
- package/dist/ledgerCli.d.ts.map +1 -1
- package/dist/ledgerCli.js +9 -3
- package/dist/ledgerCli.js.map +1 -1
- package/dist/ntfy.d.ts +3 -1
- package/dist/ntfy.d.ts.map +1 -1
- package/dist/ntfy.js +2 -1
- package/dist/ntfy.js.map +1 -1
- package/dist/playgroundCli.d.ts +8 -0
- package/dist/playgroundCli.d.ts.map +1 -0
- package/dist/playgroundCli.js +57 -0
- package/dist/playgroundCli.js.map +1 -0
- package/dist/receipt.d.ts +62 -0
- package/dist/receipt.d.ts.map +1 -0
- package/dist/receipt.js +117 -0
- package/dist/receipt.js.map +1 -0
- package/dist/receiptCli.d.ts +8 -0
- package/dist/receiptCli.d.ts.map +1 -0
- package/dist/receiptCli.js +87 -0
- package/dist/receiptCli.js.map +1 -0
- package/dist/roles.d.ts +9 -0
- package/dist/roles.d.ts.map +1 -0
- package/dist/roles.js +41 -0
- package/dist/roles.js.map +1 -0
- package/dist/startup.d.ts +14 -0
- package/dist/startup.d.ts.map +1 -1
- package/dist/startup.js +92 -7
- package/dist/startup.js.map +1 -1
- package/package.json +16 -4
- package/playground/fake-github.mjs +98 -0
- package/playground/fake-memory.mjs +130 -0
- package/playground/index.html +411 -0
- package/playground/playground.yaml +40 -0
- package/playground/server.mjs +290 -0
- package/src/approvals.ts +63 -26
- package/src/audit.ts +5 -0
- package/src/auditCli.ts +11 -8
- package/src/cedar.ts +140 -0
- package/src/cli.ts +16 -1
- package/src/config.ts +80 -1
- package/src/elicitation.ts +69 -0
- package/src/gateway.ts +108 -17
- package/src/hooks/claudeCode.ts +13 -2
- package/src/hooks/run.ts +6 -3
- package/src/index.ts +6 -0
- package/src/init/presets.ts +54 -0
- package/src/invoker.ts +39 -2
- package/src/ledgerCli.ts +9 -3
- package/src/ntfy.ts +4 -1
- package/src/playgroundCli.ts +60 -0
- package/src/receipt.ts +148 -0
- package/src/receiptCli.ts +85 -0
- package/src/roles.ts +55 -0
- package/src/startup.ts +88 -6
package/dist/config.d.ts
CHANGED
|
@@ -12,15 +12,22 @@
|
|
|
12
12
|
* docs:
|
|
13
13
|
* url: https://example.com/mcp
|
|
14
14
|
* headers: { Authorization: "Bearer ${DOCS_TOKEN}" }
|
|
15
|
+
* principal: { id: "${USER}" } # optional: who runs this gateway (default: anonymous)
|
|
16
|
+
* roles: # optional: who may use which tools (deny by default)
|
|
17
|
+
* maintainers: { members: [alice], tools: ["github.*"] }
|
|
18
|
+
* readers: { members: ["*"], tools: ["github.read_*", "github.get_*"] }
|
|
19
|
+
* cedar: { policies: ./adtl.cedar } # optional: attribute-based rules (see cedar.ts)
|
|
15
20
|
* approvals: # optional: make "ask" really ask
|
|
16
21
|
* timeoutSeconds: 50
|
|
17
22
|
* ntfy: { topic: "${ADTL_NTFY_TOPIC}" }
|
|
23
|
+
* approvers: # optional: each approver's own channel (policy rule `approvers:`)
|
|
24
|
+
* alice: { ntfy: { topic: "${ALICE_NTFY_TOPIC}" } }
|
|
18
25
|
* email:
|
|
19
26
|
* smtp: { host: smtp.example.com, port: 465, user: "${SMTP_USER}", pass: "${SMTP_PASS}" }
|
|
20
27
|
* from: adtl@example.com
|
|
21
28
|
* to: you@example.com
|
|
22
29
|
*
|
|
23
|
-
* `${VAR}` in command, args, env, cwd, url, headers
|
|
30
|
+
* `${VAR}` in command, args, env, cwd, url, headers, approval settings and principal.id is
|
|
24
31
|
* replaced from the gateway's environment. A missing variable is a config error,
|
|
25
32
|
* unless a default is given: `${VAR:-default}`.
|
|
26
33
|
*/
|
|
@@ -108,14 +115,14 @@ export declare const EmailConfigSchema: z.ZodObject<{
|
|
|
108
115
|
}, "strict", z.ZodTypeAny, {
|
|
109
116
|
host: string;
|
|
110
117
|
port: number;
|
|
111
|
-
secure?: boolean | undefined;
|
|
112
118
|
user?: string | undefined;
|
|
119
|
+
secure?: boolean | undefined;
|
|
113
120
|
pass?: string | undefined;
|
|
114
121
|
}, {
|
|
115
122
|
host: string;
|
|
123
|
+
user?: string | undefined;
|
|
116
124
|
port?: number | undefined;
|
|
117
125
|
secure?: boolean | undefined;
|
|
118
|
-
user?: string | undefined;
|
|
119
126
|
pass?: string | undefined;
|
|
120
127
|
}>;
|
|
121
128
|
from: z.ZodString;
|
|
@@ -126,8 +133,8 @@ export declare const EmailConfigSchema: z.ZodObject<{
|
|
|
126
133
|
smtp: {
|
|
127
134
|
host: string;
|
|
128
135
|
port: number;
|
|
129
|
-
secure?: boolean | undefined;
|
|
130
136
|
user?: string | undefined;
|
|
137
|
+
secure?: boolean | undefined;
|
|
131
138
|
pass?: string | undefined;
|
|
132
139
|
};
|
|
133
140
|
from: string;
|
|
@@ -135,9 +142,9 @@ export declare const EmailConfigSchema: z.ZodObject<{
|
|
|
135
142
|
}, {
|
|
136
143
|
smtp: {
|
|
137
144
|
host: string;
|
|
145
|
+
user?: string | undefined;
|
|
138
146
|
port?: number | undefined;
|
|
139
147
|
secure?: boolean | undefined;
|
|
140
|
-
user?: string | undefined;
|
|
141
148
|
pass?: string | undefined;
|
|
142
149
|
};
|
|
143
150
|
from: string;
|
|
@@ -179,14 +186,14 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
|
|
|
179
186
|
}, "strict", z.ZodTypeAny, {
|
|
180
187
|
host: string;
|
|
181
188
|
port: number;
|
|
182
|
-
secure?: boolean | undefined;
|
|
183
189
|
user?: string | undefined;
|
|
190
|
+
secure?: boolean | undefined;
|
|
184
191
|
pass?: string | undefined;
|
|
185
192
|
}, {
|
|
186
193
|
host: string;
|
|
194
|
+
user?: string | undefined;
|
|
187
195
|
port?: number | undefined;
|
|
188
196
|
secure?: boolean | undefined;
|
|
189
|
-
user?: string | undefined;
|
|
190
197
|
pass?: string | undefined;
|
|
191
198
|
}>;
|
|
192
199
|
from: z.ZodString;
|
|
@@ -197,8 +204,8 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
|
|
|
197
204
|
smtp: {
|
|
198
205
|
host: string;
|
|
199
206
|
port: number;
|
|
200
|
-
secure?: boolean | undefined;
|
|
201
207
|
user?: string | undefined;
|
|
208
|
+
secure?: boolean | undefined;
|
|
202
209
|
pass?: string | undefined;
|
|
203
210
|
};
|
|
204
211
|
from: string;
|
|
@@ -206,24 +213,76 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
|
|
|
206
213
|
}, {
|
|
207
214
|
smtp: {
|
|
208
215
|
host: string;
|
|
216
|
+
user?: string | undefined;
|
|
209
217
|
port?: number | undefined;
|
|
210
218
|
secure?: boolean | undefined;
|
|
211
|
-
user?: string | undefined;
|
|
212
219
|
pass?: string | undefined;
|
|
213
220
|
};
|
|
214
221
|
from: string;
|
|
215
222
|
to: string | [string, ...string[]];
|
|
216
223
|
on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
|
|
217
224
|
}>>;
|
|
225
|
+
/**
|
|
226
|
+
* Also ask in the MCP client (elicitation), when it supports it. Off by
|
|
227
|
+
* default: a client that accepts elicitations by itself would approve calls.
|
|
228
|
+
*/
|
|
229
|
+
elicitation: z.ZodDefault<z.ZodBoolean>;
|
|
230
|
+
/**
|
|
231
|
+
* Each approver's own channel, by principal id. Policy rules with
|
|
232
|
+
* `approvers: [role]` ask only these people, so the answer names who approved.
|
|
233
|
+
*/
|
|
234
|
+
approvers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
|
|
235
|
+
ntfy: z.ZodObject<{
|
|
236
|
+
server: z.ZodDefault<z.ZodString>;
|
|
237
|
+
/** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
|
|
238
|
+
topic: z.ZodString;
|
|
239
|
+
/** Topic answers are posted to. Default: `<topic>-reply`. */
|
|
240
|
+
replyTopic: z.ZodOptional<z.ZodString>;
|
|
241
|
+
token: z.ZodOptional<z.ZodString>;
|
|
242
|
+
}, "strict", z.ZodTypeAny, {
|
|
243
|
+
server: string;
|
|
244
|
+
topic: string;
|
|
245
|
+
replyTopic?: string | undefined;
|
|
246
|
+
token?: string | undefined;
|
|
247
|
+
}, {
|
|
248
|
+
topic: string;
|
|
249
|
+
server?: string | undefined;
|
|
250
|
+
replyTopic?: string | undefined;
|
|
251
|
+
token?: string | undefined;
|
|
252
|
+
}>;
|
|
253
|
+
}, "strict", z.ZodTypeAny, {
|
|
254
|
+
ntfy: {
|
|
255
|
+
server: string;
|
|
256
|
+
topic: string;
|
|
257
|
+
replyTopic?: string | undefined;
|
|
258
|
+
token?: string | undefined;
|
|
259
|
+
};
|
|
260
|
+
}, {
|
|
261
|
+
ntfy: {
|
|
262
|
+
topic: string;
|
|
263
|
+
server?: string | undefined;
|
|
264
|
+
replyTopic?: string | undefined;
|
|
265
|
+
token?: string | undefined;
|
|
266
|
+
};
|
|
267
|
+
}>>>;
|
|
218
268
|
}, "strict", z.ZodTypeAny, {
|
|
219
269
|
timeoutSeconds: number;
|
|
270
|
+
elicitation: boolean;
|
|
271
|
+
approvers?: Record<string, {
|
|
272
|
+
ntfy: {
|
|
273
|
+
server: string;
|
|
274
|
+
topic: string;
|
|
275
|
+
replyTopic?: string | undefined;
|
|
276
|
+
token?: string | undefined;
|
|
277
|
+
};
|
|
278
|
+
}> | undefined;
|
|
220
279
|
email?: {
|
|
221
280
|
on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
|
|
222
281
|
smtp: {
|
|
223
282
|
host: string;
|
|
224
283
|
port: number;
|
|
225
|
-
secure?: boolean | undefined;
|
|
226
284
|
user?: string | undefined;
|
|
285
|
+
secure?: boolean | undefined;
|
|
227
286
|
pass?: string | undefined;
|
|
228
287
|
};
|
|
229
288
|
from: string;
|
|
@@ -236,12 +295,20 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
|
|
|
236
295
|
token?: string | undefined;
|
|
237
296
|
} | undefined;
|
|
238
297
|
}, {
|
|
298
|
+
approvers?: Record<string, {
|
|
299
|
+
ntfy: {
|
|
300
|
+
topic: string;
|
|
301
|
+
server?: string | undefined;
|
|
302
|
+
replyTopic?: string | undefined;
|
|
303
|
+
token?: string | undefined;
|
|
304
|
+
};
|
|
305
|
+
}> | undefined;
|
|
239
306
|
email?: {
|
|
240
307
|
smtp: {
|
|
241
308
|
host: string;
|
|
309
|
+
user?: string | undefined;
|
|
242
310
|
port?: number | undefined;
|
|
243
311
|
secure?: boolean | undefined;
|
|
244
|
-
user?: string | undefined;
|
|
245
312
|
pass?: string | undefined;
|
|
246
313
|
};
|
|
247
314
|
from: string;
|
|
@@ -255,8 +322,69 @@ export declare const ApprovalsConfigSchema: z.ZodObject<{
|
|
|
255
322
|
replyTopic?: string | undefined;
|
|
256
323
|
token?: string | undefined;
|
|
257
324
|
} | undefined;
|
|
325
|
+
elicitation?: boolean | undefined;
|
|
258
326
|
}>;
|
|
259
327
|
export type ApprovalsConfig = z.infer<typeof ApprovalsConfigSchema>;
|
|
328
|
+
export declare const PrincipalConfigSchema: z.ZodObject<{
|
|
329
|
+
type: z.ZodDefault<z.ZodEnum<["user", "service"]>>;
|
|
330
|
+
id: z.ZodString;
|
|
331
|
+
claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
|
|
332
|
+
}, "strict", z.ZodTypeAny, {
|
|
333
|
+
id: string;
|
|
334
|
+
type: "user" | "service";
|
|
335
|
+
claims?: Record<string, unknown> | undefined;
|
|
336
|
+
}, {
|
|
337
|
+
id: string;
|
|
338
|
+
type?: "user" | "service" | undefined;
|
|
339
|
+
claims?: Record<string, unknown> | undefined;
|
|
340
|
+
}>;
|
|
341
|
+
export type PrincipalConfig = z.infer<typeof PrincipalConfigSchema>;
|
|
342
|
+
export declare const RoleSchema: z.ZodEffects<z.ZodObject<{
|
|
343
|
+
/** Principal ids; "*" means everyone, including an anonymous caller. */
|
|
344
|
+
members: z.ZodArray<z.ZodString, "atleastone">;
|
|
345
|
+
tools: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
|
|
346
|
+
prompts: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
|
|
347
|
+
/** Resource URI patterns, e.g. "github://acme/*". */
|
|
348
|
+
resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
|
|
349
|
+
}, "strict", z.ZodTypeAny, {
|
|
350
|
+
members: [string, ...string[]];
|
|
351
|
+
tools: string[];
|
|
352
|
+
prompts: string[];
|
|
353
|
+
resources: string[];
|
|
354
|
+
}, {
|
|
355
|
+
members: [string, ...string[]];
|
|
356
|
+
tools?: string[] | undefined;
|
|
357
|
+
prompts?: string[] | undefined;
|
|
358
|
+
resources?: string[] | undefined;
|
|
359
|
+
}>, {
|
|
360
|
+
members: [string, ...string[]];
|
|
361
|
+
tools: string[];
|
|
362
|
+
prompts: string[];
|
|
363
|
+
resources: string[];
|
|
364
|
+
}, {
|
|
365
|
+
members: [string, ...string[]];
|
|
366
|
+
tools?: string[] | undefined;
|
|
367
|
+
prompts?: string[] | undefined;
|
|
368
|
+
resources?: string[] | undefined;
|
|
369
|
+
}>;
|
|
370
|
+
export type RoleConfig = z.infer<typeof RoleSchema>;
|
|
371
|
+
export declare const CedarConfigSchema: z.ZodObject<{
|
|
372
|
+
/** Cedar policy file. Relative paths are resolved against the config file's directory. */
|
|
373
|
+
policies: z.ZodString;
|
|
374
|
+
/** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
|
|
375
|
+
entities: z.ZodOptional<z.ZodString>;
|
|
376
|
+
/** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
|
|
377
|
+
timeZone: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
|
|
378
|
+
}, "strict", z.ZodTypeAny, {
|
|
379
|
+
policies: string;
|
|
380
|
+
entities?: string | undefined;
|
|
381
|
+
timeZone?: string | undefined;
|
|
382
|
+
}, {
|
|
383
|
+
policies: string;
|
|
384
|
+
entities?: string | undefined;
|
|
385
|
+
timeZone?: string | undefined;
|
|
386
|
+
}>;
|
|
387
|
+
export type CedarConfig = z.infer<typeof CedarConfigSchema>;
|
|
260
388
|
export declare const GatewayConfigSchema: z.ZodObject<{
|
|
261
389
|
upstreams: z.ZodEffects<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
|
|
262
390
|
command: z.ZodString;
|
|
@@ -375,14 +503,14 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
375
503
|
}, "strict", z.ZodTypeAny, {
|
|
376
504
|
host: string;
|
|
377
505
|
port: number;
|
|
378
|
-
secure?: boolean | undefined;
|
|
379
506
|
user?: string | undefined;
|
|
507
|
+
secure?: boolean | undefined;
|
|
380
508
|
pass?: string | undefined;
|
|
381
509
|
}, {
|
|
382
510
|
host: string;
|
|
511
|
+
user?: string | undefined;
|
|
383
512
|
port?: number | undefined;
|
|
384
513
|
secure?: boolean | undefined;
|
|
385
|
-
user?: string | undefined;
|
|
386
514
|
pass?: string | undefined;
|
|
387
515
|
}>;
|
|
388
516
|
from: z.ZodString;
|
|
@@ -393,8 +521,8 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
393
521
|
smtp: {
|
|
394
522
|
host: string;
|
|
395
523
|
port: number;
|
|
396
|
-
secure?: boolean | undefined;
|
|
397
524
|
user?: string | undefined;
|
|
525
|
+
secure?: boolean | undefined;
|
|
398
526
|
pass?: string | undefined;
|
|
399
527
|
};
|
|
400
528
|
from: string;
|
|
@@ -402,24 +530,76 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
402
530
|
}, {
|
|
403
531
|
smtp: {
|
|
404
532
|
host: string;
|
|
533
|
+
user?: string | undefined;
|
|
405
534
|
port?: number | undefined;
|
|
406
535
|
secure?: boolean | undefined;
|
|
407
|
-
user?: string | undefined;
|
|
408
536
|
pass?: string | undefined;
|
|
409
537
|
};
|
|
410
538
|
from: string;
|
|
411
539
|
to: string | [string, ...string[]];
|
|
412
540
|
on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
|
|
413
541
|
}>>;
|
|
542
|
+
/**
|
|
543
|
+
* Also ask in the MCP client (elicitation), when it supports it. Off by
|
|
544
|
+
* default: a client that accepts elicitations by itself would approve calls.
|
|
545
|
+
*/
|
|
546
|
+
elicitation: z.ZodDefault<z.ZodBoolean>;
|
|
547
|
+
/**
|
|
548
|
+
* Each approver's own channel, by principal id. Policy rules with
|
|
549
|
+
* `approvers: [role]` ask only these people, so the answer names who approved.
|
|
550
|
+
*/
|
|
551
|
+
approvers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
|
|
552
|
+
ntfy: z.ZodObject<{
|
|
553
|
+
server: z.ZodDefault<z.ZodString>;
|
|
554
|
+
/** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
|
|
555
|
+
topic: z.ZodString;
|
|
556
|
+
/** Topic answers are posted to. Default: `<topic>-reply`. */
|
|
557
|
+
replyTopic: z.ZodOptional<z.ZodString>;
|
|
558
|
+
token: z.ZodOptional<z.ZodString>;
|
|
559
|
+
}, "strict", z.ZodTypeAny, {
|
|
560
|
+
server: string;
|
|
561
|
+
topic: string;
|
|
562
|
+
replyTopic?: string | undefined;
|
|
563
|
+
token?: string | undefined;
|
|
564
|
+
}, {
|
|
565
|
+
topic: string;
|
|
566
|
+
server?: string | undefined;
|
|
567
|
+
replyTopic?: string | undefined;
|
|
568
|
+
token?: string | undefined;
|
|
569
|
+
}>;
|
|
570
|
+
}, "strict", z.ZodTypeAny, {
|
|
571
|
+
ntfy: {
|
|
572
|
+
server: string;
|
|
573
|
+
topic: string;
|
|
574
|
+
replyTopic?: string | undefined;
|
|
575
|
+
token?: string | undefined;
|
|
576
|
+
};
|
|
577
|
+
}, {
|
|
578
|
+
ntfy: {
|
|
579
|
+
topic: string;
|
|
580
|
+
server?: string | undefined;
|
|
581
|
+
replyTopic?: string | undefined;
|
|
582
|
+
token?: string | undefined;
|
|
583
|
+
};
|
|
584
|
+
}>>>;
|
|
414
585
|
}, "strict", z.ZodTypeAny, {
|
|
415
586
|
timeoutSeconds: number;
|
|
587
|
+
elicitation: boolean;
|
|
588
|
+
approvers?: Record<string, {
|
|
589
|
+
ntfy: {
|
|
590
|
+
server: string;
|
|
591
|
+
topic: string;
|
|
592
|
+
replyTopic?: string | undefined;
|
|
593
|
+
token?: string | undefined;
|
|
594
|
+
};
|
|
595
|
+
}> | undefined;
|
|
416
596
|
email?: {
|
|
417
597
|
on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
|
|
418
598
|
smtp: {
|
|
419
599
|
host: string;
|
|
420
600
|
port: number;
|
|
421
|
-
secure?: boolean | undefined;
|
|
422
601
|
user?: string | undefined;
|
|
602
|
+
secure?: boolean | undefined;
|
|
423
603
|
pass?: string | undefined;
|
|
424
604
|
};
|
|
425
605
|
from: string;
|
|
@@ -432,12 +612,20 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
432
612
|
token?: string | undefined;
|
|
433
613
|
} | undefined;
|
|
434
614
|
}, {
|
|
615
|
+
approvers?: Record<string, {
|
|
616
|
+
ntfy: {
|
|
617
|
+
topic: string;
|
|
618
|
+
server?: string | undefined;
|
|
619
|
+
replyTopic?: string | undefined;
|
|
620
|
+
token?: string | undefined;
|
|
621
|
+
};
|
|
622
|
+
}> | undefined;
|
|
435
623
|
email?: {
|
|
436
624
|
smtp: {
|
|
437
625
|
host: string;
|
|
626
|
+
user?: string | undefined;
|
|
438
627
|
port?: number | undefined;
|
|
439
628
|
secure?: boolean | undefined;
|
|
440
|
-
user?: string | undefined;
|
|
441
629
|
pass?: string | undefined;
|
|
442
630
|
};
|
|
443
631
|
from: string;
|
|
@@ -451,10 +639,82 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
451
639
|
replyTopic?: string | undefined;
|
|
452
640
|
token?: string | undefined;
|
|
453
641
|
} | undefined;
|
|
642
|
+
elicitation?: boolean | undefined;
|
|
454
643
|
}>>;
|
|
455
644
|
/** Timeout for each interceptor invocation, in milliseconds. */
|
|
456
645
|
interceptorTimeoutMs: z.ZodDefault<z.ZodNumber>;
|
|
646
|
+
/** Who runs this gateway. Passed to the authorizer and the interceptors. Default: anonymous. */
|
|
647
|
+
principal: z.ZodOptional<z.ZodObject<{
|
|
648
|
+
type: z.ZodDefault<z.ZodEnum<["user", "service"]>>;
|
|
649
|
+
id: z.ZodString;
|
|
650
|
+
claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
|
|
651
|
+
}, "strict", z.ZodTypeAny, {
|
|
652
|
+
id: string;
|
|
653
|
+
type: "user" | "service";
|
|
654
|
+
claims?: Record<string, unknown> | undefined;
|
|
655
|
+
}, {
|
|
656
|
+
id: string;
|
|
657
|
+
type?: "user" | "service" | undefined;
|
|
658
|
+
claims?: Record<string, unknown> | undefined;
|
|
659
|
+
}>>;
|
|
660
|
+
/** Role-based authorization: when present, a call no role grants is denied. */
|
|
661
|
+
roles: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
|
|
662
|
+
/** Principal ids; "*" means everyone, including an anonymous caller. */
|
|
663
|
+
members: z.ZodArray<z.ZodString, "atleastone">;
|
|
664
|
+
tools: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
|
|
665
|
+
prompts: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
|
|
666
|
+
/** Resource URI patterns, e.g. "github://acme/*". */
|
|
667
|
+
resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
|
|
668
|
+
}, "strict", z.ZodTypeAny, {
|
|
669
|
+
members: [string, ...string[]];
|
|
670
|
+
tools: string[];
|
|
671
|
+
prompts: string[];
|
|
672
|
+
resources: string[];
|
|
673
|
+
}, {
|
|
674
|
+
members: [string, ...string[]];
|
|
675
|
+
tools?: string[] | undefined;
|
|
676
|
+
prompts?: string[] | undefined;
|
|
677
|
+
resources?: string[] | undefined;
|
|
678
|
+
}>, {
|
|
679
|
+
members: [string, ...string[]];
|
|
680
|
+
tools: string[];
|
|
681
|
+
prompts: string[];
|
|
682
|
+
resources: string[];
|
|
683
|
+
}, {
|
|
684
|
+
members: [string, ...string[]];
|
|
685
|
+
tools?: string[] | undefined;
|
|
686
|
+
prompts?: string[] | undefined;
|
|
687
|
+
resources?: string[] | undefined;
|
|
688
|
+
}>>, Record<string, {
|
|
689
|
+
members: [string, ...string[]];
|
|
690
|
+
tools: string[];
|
|
691
|
+
prompts: string[];
|
|
692
|
+
resources: string[];
|
|
693
|
+
}>, Record<string, {
|
|
694
|
+
members: [string, ...string[]];
|
|
695
|
+
tools?: string[] | undefined;
|
|
696
|
+
prompts?: string[] | undefined;
|
|
697
|
+
resources?: string[] | undefined;
|
|
698
|
+
}>>>;
|
|
699
|
+
/** Cedar authorization. With roles as well, both must allow. */
|
|
700
|
+
cedar: z.ZodOptional<z.ZodObject<{
|
|
701
|
+
/** Cedar policy file. Relative paths are resolved against the config file's directory. */
|
|
702
|
+
policies: z.ZodString;
|
|
703
|
+
/** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
|
|
704
|
+
entities: z.ZodOptional<z.ZodString>;
|
|
705
|
+
/** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
|
|
706
|
+
timeZone: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
|
|
707
|
+
}, "strict", z.ZodTypeAny, {
|
|
708
|
+
policies: string;
|
|
709
|
+
entities?: string | undefined;
|
|
710
|
+
timeZone?: string | undefined;
|
|
711
|
+
}, {
|
|
712
|
+
policies: string;
|
|
713
|
+
entities?: string | undefined;
|
|
714
|
+
timeZone?: string | undefined;
|
|
715
|
+
}>>;
|
|
457
716
|
}, "strict", z.ZodTypeAny, {
|
|
717
|
+
mode: "active" | "audit";
|
|
458
718
|
upstreams: Record<string, {
|
|
459
719
|
command: string;
|
|
460
720
|
args: string[];
|
|
@@ -464,7 +724,6 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
464
724
|
url: string;
|
|
465
725
|
headers: Record<string, string>;
|
|
466
726
|
}>;
|
|
467
|
-
mode: "audit" | "active";
|
|
468
727
|
interceptorTimeoutMs: number;
|
|
469
728
|
audit?: string | undefined;
|
|
470
729
|
interceptors?: {
|
|
@@ -473,15 +732,29 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
473
732
|
env: Record<string, string>;
|
|
474
733
|
cwd?: string | undefined;
|
|
475
734
|
} | undefined;
|
|
735
|
+
principal?: {
|
|
736
|
+
id: string;
|
|
737
|
+
type: "user" | "service";
|
|
738
|
+
claims?: Record<string, unknown> | undefined;
|
|
739
|
+
} | undefined;
|
|
476
740
|
approvals?: {
|
|
477
741
|
timeoutSeconds: number;
|
|
742
|
+
elicitation: boolean;
|
|
743
|
+
approvers?: Record<string, {
|
|
744
|
+
ntfy: {
|
|
745
|
+
server: string;
|
|
746
|
+
topic: string;
|
|
747
|
+
replyTopic?: string | undefined;
|
|
748
|
+
token?: string | undefined;
|
|
749
|
+
};
|
|
750
|
+
}> | undefined;
|
|
478
751
|
email?: {
|
|
479
752
|
on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
|
|
480
753
|
smtp: {
|
|
481
754
|
host: string;
|
|
482
755
|
port: number;
|
|
483
|
-
secure?: boolean | undefined;
|
|
484
756
|
user?: string | undefined;
|
|
757
|
+
secure?: boolean | undefined;
|
|
485
758
|
pass?: string | undefined;
|
|
486
759
|
};
|
|
487
760
|
from: string;
|
|
@@ -494,6 +767,17 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
494
767
|
token?: string | undefined;
|
|
495
768
|
} | undefined;
|
|
496
769
|
} | undefined;
|
|
770
|
+
roles?: Record<string, {
|
|
771
|
+
members: [string, ...string[]];
|
|
772
|
+
tools: string[];
|
|
773
|
+
prompts: string[];
|
|
774
|
+
resources: string[];
|
|
775
|
+
}> | undefined;
|
|
776
|
+
cedar?: {
|
|
777
|
+
policies: string;
|
|
778
|
+
entities?: string | undefined;
|
|
779
|
+
timeZone?: string | undefined;
|
|
780
|
+
} | undefined;
|
|
497
781
|
}, {
|
|
498
782
|
upstreams: Record<string, {
|
|
499
783
|
command: string;
|
|
@@ -504,6 +788,7 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
504
788
|
url: string;
|
|
505
789
|
headers?: Record<string, string> | undefined;
|
|
506
790
|
}>;
|
|
791
|
+
mode?: "active" | "audit" | undefined;
|
|
507
792
|
audit?: string | undefined;
|
|
508
793
|
interceptors?: {
|
|
509
794
|
command: string;
|
|
@@ -511,14 +796,26 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
511
796
|
env?: Record<string, string> | undefined;
|
|
512
797
|
cwd?: string | undefined;
|
|
513
798
|
} | undefined;
|
|
514
|
-
|
|
799
|
+
principal?: {
|
|
800
|
+
id: string;
|
|
801
|
+
type?: "user" | "service" | undefined;
|
|
802
|
+
claims?: Record<string, unknown> | undefined;
|
|
803
|
+
} | undefined;
|
|
515
804
|
approvals?: {
|
|
805
|
+
approvers?: Record<string, {
|
|
806
|
+
ntfy: {
|
|
807
|
+
topic: string;
|
|
808
|
+
server?: string | undefined;
|
|
809
|
+
replyTopic?: string | undefined;
|
|
810
|
+
token?: string | undefined;
|
|
811
|
+
};
|
|
812
|
+
}> | undefined;
|
|
516
813
|
email?: {
|
|
517
814
|
smtp: {
|
|
518
815
|
host: string;
|
|
816
|
+
user?: string | undefined;
|
|
519
817
|
port?: number | undefined;
|
|
520
818
|
secure?: boolean | undefined;
|
|
521
|
-
user?: string | undefined;
|
|
522
819
|
pass?: string | undefined;
|
|
523
820
|
};
|
|
524
821
|
from: string;
|
|
@@ -532,8 +829,20 @@ export declare const GatewayConfigSchema: z.ZodObject<{
|
|
|
532
829
|
replyTopic?: string | undefined;
|
|
533
830
|
token?: string | undefined;
|
|
534
831
|
} | undefined;
|
|
832
|
+
elicitation?: boolean | undefined;
|
|
535
833
|
} | undefined;
|
|
536
834
|
interceptorTimeoutMs?: number | undefined;
|
|
835
|
+
roles?: Record<string, {
|
|
836
|
+
members: [string, ...string[]];
|
|
837
|
+
tools?: string[] | undefined;
|
|
838
|
+
prompts?: string[] | undefined;
|
|
839
|
+
resources?: string[] | undefined;
|
|
840
|
+
}> | undefined;
|
|
841
|
+
cedar?: {
|
|
842
|
+
policies: string;
|
|
843
|
+
entities?: string | undefined;
|
|
844
|
+
timeZone?: string | undefined;
|
|
845
|
+
} | undefined;
|
|
537
846
|
}>;
|
|
538
847
|
export type GatewayConfig = z.infer<typeof GatewayConfigSchema>;
|
|
539
848
|
export declare const TOOL_SEPARATOR = "__";
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAOrB,CAAC;AAEZ,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;IAAqD,CAAC;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,gBAAgB;;IAGzB,+FAA+F;;IAE/F,6DAA6D;;;;;;;;;;;;;EAItD,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;QAMtB,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUtE,CAAC;AAEZ,eAAO,MAAM,qBAAqB;IAE9B;;;OAGG;;;;QA/BH,+FAA+F;;QAE/F,6DAA6D;;;;;;;;;;;;;;;;;;YAYzD,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAqB7E;;;OAGG;;IAEH;;;OAGG;;;;YA3CH,+FAA+F;;YAE/F,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CtD,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;EAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,UAAU;IAEnB,wEAAwE;;;;IAIxE,qDAAqD;;;;;;;;;;;;;;;;;;;;;;EAMrD,CAAC;AACL,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,iBAAiB;IAE1B,0FAA0F;;IAE1F,4EAA4E;;IAE5E,uFAAuF;;;;;;;;;;EAchF,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQ5B,8GAA8G;;;;;;;;;;;;;;;;;IAE9G,kGAAkG;;IAElG;;;OAGG;;IAEH,uFAAuF;;QA3FvF;;;WAGG;;;;YA/BH,+FAA+F;;YAE/F,6DAA6D;;;;;;;;;;;;;;;;;;gBAYzD,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAqB7E;;;WAGG;;QAEH;;;WAGG;;;;gBA3CH,+FAA+F;;gBAE/F,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuH7D,gEAAgE;;IAEhE,gGAAgG;;;;;;;;;;;;;;IAEhG,+EAA+E;;QA3D/E,wEAAwE;;;;QAIxE,qDAAqD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4DrD,gEAAgE;;QAjDhE,0FAA0F;;QAE1F,4EAA4E;;QAE5E,uFAAuF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDhF,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAIrD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQtF;AAMD,wBAAgB,cAAc,CAAC,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAY9F;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAQ3F;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,YAAY,CAE7D"}
|