@adtl/gateway 0.5.1 → 0.7.0

package/dist/config.js

@@ -12,15 +12,22 @@
  *       docs:
  *         url: https://example.com/mcp
  *         headers: { Authorization: "Bearer ${DOCS_TOKEN}" }
+ *     principal: { id: "${USER}" }       # optional: who runs this gateway (default: anonymous)
+ *     roles:                             # optional: who may use which tools (deny by default)
+ *       maintainers: { members: [alice], tools: ["github.*"] }
+ *       readers:     { members: ["*"],   tools: ["github.read_*", "github.get_*"] }
+ *     cedar: { policies: ./adtl.cedar }  # optional: attribute-based rules (see cedar.ts)
  *     approvals:                         # optional: make "ask" really ask
  *       timeoutSeconds: 50
  *       ntfy: { topic: "${ADTL_NTFY_TOPIC}" }
+ *       approvers:                       # optional: each approver's own channel (policy rule `approvers:`)
+ *         alice: { ntfy: { topic: "${ALICE_NTFY_TOPIC}" } }
  *       email:
  *         smtp: { host: smtp.example.com, port: 465, user: "${SMTP_USER}", pass: "${SMTP_PASS}" }
  *         from: adtl@example.com
  *         to: you@example.com
  *
- * `${VAR}` in command, args, env, cwd, url, headers and approval settings is
+ * `${VAR}` in command, args, env, cwd, url, headers, approval settings and principal.id is
  * replaced from the gateway's environment. A missing variable is a config error,
  * unless a default is given: `${VAR:-default}`.
  */
@@ -78,6 +85,63 @@ export const ApprovalsConfigSchema = z
     timeoutSeconds: z.number().int().positive().max(3600).default(50),
     ntfy: NtfyConfigSchema.optional(),
     email: EmailConfigSchema.optional(),
+    /**
+     * Also ask in the MCP client (elicitation), when it supports it. Off by
+     * default: a client that accepts elicitations by itself would approve calls.
+     */
+    elicitation: z.boolean().default(false),
+    /**
+     * Each approver's own channel, by principal id. Policy rules with
+     * `approvers: [role]` ask only these people, so the answer names who approved.
+     */
+    approvers: z.record(z.object({ ntfy: NtfyConfigSchema }).strict()).optional(),
+})
+    .strict();
+/** `server.tool` (or `server.prompt`), with `*` wildcards, as in policy rules. */
+const QualifiedPattern = z
+    .string()
+    .min(1)
+    .refine((p) => /^[^.]+\..+$/.test(p), { message: 'Use "server.name" with optional * wildcards, e.g. "github.read_*" or "github.*"' });
+export const PrincipalConfigSchema = z
+    .object({
+    type: z.enum(["user", "service"]).default("user"),
+    id: z.string().min(1),
+    claims: z.record(z.unknown()).optional(),
+})
+    .strict();
+export const RoleSchema = z
+    .object({
+    /** Principal ids; "*" means everyone, including an anonymous caller. */
+    members: z.array(z.string().min(1)).nonempty("A role needs at least one member (\"*\" for everyone)"),
+    tools: z.array(QualifiedPattern).default([]),
+    prompts: z.array(QualifiedPattern).default([]),
+    /** Resource URI patterns, e.g. "github://acme/*". */
+    resources: z.array(z.string().min(1)).default([]),
+})
+    .strict()
+    .refine((r) => r.tools.length + r.prompts.length + r.resources.length > 0, {
+    message: "A role must grant at least one of tools, prompts or resources",
+});
+export const CedarConfigSchema = z
+    .object({
+    /** Cedar policy file. Relative paths are resolved against the config file's directory. */
+    policies: z.string().min(1),
+    /** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
+    entities: z.string().min(1).optional(),
+    /** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
+    timeZone: z
+        .string()
+        .min(1)
+        .refine((tz) => {
+        try {
+            new Intl.DateTimeFormat("en-US", { timeZone: tz });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }, "Unknown time zone")
+        .optional(),
 })
     .strict();
 export const GatewayConfigSchema = z
@@ -101,6 +165,15 @@ export const GatewayConfigSchema = z
     approvals: ApprovalsConfigSchema.optional(),
     /** Timeout for each interceptor invocation, in milliseconds. */
     interceptorTimeoutMs: z.number().int().positive().default(5000),
+    /** Who runs this gateway. Passed to the authorizer and the interceptors. Default: anonymous. */
+    principal: PrincipalConfigSchema.optional(),
+    /** Role-based authorization: when present, a call no role grants is denied. */
+    roles: z
+        .record(RoleSchema)
+        .refine((r) => Object.keys(r).length > 0, "roles: needs at least one role (remove it to allow everyone)")
+        .optional(),
+    /** Cedar authorization. With roles as well, both must allow. */
+    cedar: CedarConfigSchema.optional(),
 })
     .strict();
 export const TOOL_SEPARATOR = "__";

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAKjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpD,+FAA+F;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,6DAA6D;IAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9C,yEAAyE;QACzE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,MAAM,EAAE;IACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;CAC7E,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC;SACT,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,0CAA0C,CAAC;SACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE;QACjE,OAAO,EAAE,gGAAgG;KAC1G,CAAC;IACJ,8GAA8G;IAC9G,YAAY,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC5C,kGAAkG;IAClG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACnD,uFAAuF;IACvF,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,gEAAgE;IAChE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChE,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,QAAgB,EAAE,KAAa;QAClD,KAAK,CAAC,wBAAwB,QAAQ,wBAAwB,KAAK,GAAG,CAAC,CAAC;QADrD,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAsB,EAAE,KAAa;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,oDAAoD,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,QAAiB,EAAE,EAAE;QACpI,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAA2B,EAAE,GAAsB,EAAE,KAAa;IACtF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,cAAc,CAAqB,EAAU,EAAE,CAAI,EAAE,GAAsB;IACzF,MAAM,KAAK,GAAG,qBAAqB,EAAE,EAAE,CAAC;IACxC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,OAAO;QACL,GAAG,CAAC;QACJ,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC;QACpE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,CAAkB,EAAE,GAAsB;IACxE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,KAAa,EAAW,EAAE;QAClD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5H,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAoB,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAW;IACxC,OAAO,KAAK,IAAI,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAKjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpD,+FAA+F;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,6DAA6D;IAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9C,yEAAyE;QACzE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,MAAM,EAAE;IACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;CAC7E,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACnC;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9E,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,iFAAiF,EAAE,CAAC,CAAC;AAExI,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACrG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,qDAAqD;IACrD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;IACzE,OAAO,EAAE,+DAA+D;CACzE,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,uFAAuF;IACvF,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACb,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,EAAE,mBAAmB,CAAC;SACtB,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC;SACT,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,0CAA0C,CAAC;SACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE;QACjE,OAAO,EAAE,gGAAgG;KAC1G,CAAC;IACJ,8GAA8G;IAC9G,YAAY,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC5C,kGAAkG;IAClG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACnD,uFAAuF;IACvF,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,gEAAgE;IAChE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/D,gGAAgG;IAChG,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,+EAA+E;IAC/E,KAAK,EAAE,CAAC;SACL,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,8DAA8D,CAAC;SACxG,QAAQ,EAAE;IACb,gEAAgE;IAChE,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,QAAgB,EAAE,KAAa;QAClD,KAAK,CAAC,wBAAwB,QAAQ,wBAAwB,KAAK,GAAG,CAAC,CAAC;QADrD,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAsB,EAAE,KAAa;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,oDAAoD,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,QAAiB,EAAE,EAAE;QACpI,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAA2B,EAAE,GAAsB,EAAE,KAAa;IACtF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,cAAc,CAAqB,EAAU,EAAE,CAAI,EAAE,GAAsB;IACzF,MAAM,KAAK,GAAG,qBAAqB,EAAE,EAAE,CAAC;IACxC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,OAAO;QACL,GAAG,CAAC;QACJ,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC;QACpE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,CAAkB,EAAE,GAAsB;IACxE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,KAAa,EAAW,EAAE;QAClD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5H,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAoB,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAW;IACxC,OAAO,KAAK,IAAI,CAAC,CAAC;AACpB,CAAC"}

package/dist/elicitation.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Approvals inside the MCP client, through `elicitation/create`: the person
+ * using the client (for example Claude Code) sees the request and answers
+ * Allow or Deny there, no phone needed.
+ *
+ * The answer is turned into the same signed token a push button would send,
+ * so it answers only the one pending call it was asked about. Declining or
+ * dismissing the prompt counts as Deny. The gateway uses this channel only
+ * when `gateway.approvals.elicitation` is on and the client declares the
+ * elicitation capability, and never for rules with named approvers: the
+ * client can't say who answered.
+ */
+import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { AnswerFn, ApprovalEvent, ApprovalRequest, Notifier } from "./approvals.js";
+/** True if the connected client can answer elicitation requests. */
+export declare function supportsElicitation(server: Server): boolean;
+export declare class ElicitationChannel implements Notifier {
+    private readonly server;
+    readonly name = "elicitation";
+    private readonly listening;
+    constructor(server: Server);
+    listen(request: ApprovalRequest, answer: AnswerFn, signal: AbortSignal): Promise<void>;
+    notify(event: ApprovalEvent): Promise<void>;
+}
+//# sourceMappingURL=elicitation.d.ts.map

package/dist/elicitation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicitation.d.ts","sourceRoot":"","sources":["../src/elicitation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAExE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAOzF,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3D;AAOD,qBAAa,kBAAmB,YAAW,QAAQ;IAIrC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;gBAE7B,MAAM,EAAE,MAAM;IAErC,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtF,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAyBlD"}

package/dist/elicitation.js

@@ -0,0 +1,46 @@
+import { ElicitResultSchema } from "@modelcontextprotocol/sdk/types.js";
+/** True if the connected client can answer elicitation requests. */
+export function supportsElicitation(server) {
+    return server.getClientCapabilities()?.elicitation !== undefined;
+}
+function message(request) {
+    const rule = request.matched.join(", ") || "default";
+    return `ADTL: allow ${request.server}.${request.tool}?\n\n${request.reason}\n\nRule: ${rule}. Allow runs this one call; Deny or no answer stops it.`;
+}
+export class ElicitationChannel {
+    server;
+    name = "elicitation";
+    listening = new Map();
+    constructor(server) {
+        this.server = server;
+    }
+    async listen(request, answer, signal) {
+        this.listening.set(request.id, { answer, signal });
+        await new Promise((resolve) => signal.addEventListener("abort", () => resolve(), { once: true }));
+        this.listening.delete(request.id);
+    }
+    async notify(event) {
+        if (event.kind !== "pending")
+            return; // the client sees the call's result; no other notices
+        const l = this.listening.get(event.request.id);
+        if (!l)
+            throw new Error("not listening for this request");
+        // A plain request, not Server.elicitInput(): clients that declare only `elicitation: {}` support forms too.
+        const result = await this.server.request({
+            method: "elicitation/create",
+            params: {
+                message: message(event.request),
+                requestedSchema: {
+                    type: "object",
+                    properties: {
+                        decision: { type: "string", title: "Decision", enum: ["allow", "deny"], description: "allow runs this one call; deny stops it" },
+                    },
+                    required: ["decision"],
+                },
+            },
+        }, ElicitResultSchema, { signal: l.signal, timeout: Math.max(1, event.request.expiresAt.getTime() - Date.now()) });
+        const allow = result.action === "accept" && result.content?.decision === "allow";
+        l.answer(allow ? event.tokens.allow : event.tokens.deny);
+    }
+}
+//# sourceMappingURL=elicitation.js.map

package/dist/elicitation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicitation.js","sourceRoot":"","sources":["../src/elicitation.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAQxE,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW,KAAK,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,OAAwB;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACrD,OAAO,eAAe,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,QAAQ,OAAO,CAAC,MAAM,aAAa,IAAI,yDAAyD,CAAC;AACvJ,CAAC;AAED,MAAM,OAAO,kBAAkB;IAIA;IAHpB,IAAI,GAAG,aAAa,CAAC;IACb,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE1D,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,MAAgB,EAAE,MAAmB;QAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,sDAAsD;QAC5F,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC1D,4GAA4G;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACtC;YACE,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE;gBACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC/B,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE;qBACjI;oBACD,QAAQ,EAAE,CAAC,UAAU,CAAC;iBACvB;aACF;SACF,EACD,kBAAkB,EAClB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAC3F,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;QACjF,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/gateway.d.ts

@@ -5,7 +5,7 @@ import type { ApprovalBroker } from "./approvals.js";
 import type { AuditSink } from "./audit.js";
 import { type Authorizer, type Principal } from "./authorizer.js";
 import type { InterceptorInvoker } from "./invoker.js";
-export declare const GATEWAY_VERSION = "0.5.1";
+export declare const GATEWAY_VERSION = "0.7.0";
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export declare const GATEWAY_DECISION_KEY = "adtl/gateway";
 export interface GatewayLogger {
@@ -21,11 +21,20 @@ export interface AdtlGatewayOptions {
     logger?: GatewayLogger;
     /** Asks humans about "ask" decisions and sends notices. */
     approvals?: ApprovalBroker;
-    /** Decides whether the caller may use a tool, resource or prompt at all, before the policy. */
-    authorizer?: Authorizer;
+    /** Decides whether the caller may use a tool, resource or prompt at all, before the policy. Several must all allow. */
+    authorizer?: Authorizer | Authorizer[];
     /** The caller, passed to the authorizer and the interceptors. Default: anonymous. */
     principal?: Principal;
+    /** Members of each role that policy rules name as `approvers:`. */
+    approverRoles?: Map<string, string[]>;
+    /** Also ask for approval in the MCP client, when it supports elicitation. */
+    elicitApprovals?: boolean;
 }
+/**
+ * Who may answer an "ask" whose rules name approver roles: someone in one of
+ * the roles of every list. Sorted, for stable notifications and tests.
+ */
+export declare function eligibleApprovers(lists: string[][], roles: Map<string, string[]>): string[];
 export interface CallOptions {
     /** Report progress to the client while a call waits for approval. */
     progress?: (progress: number, message: string) => Promise<void>;
@@ -37,20 +46,36 @@ export declare class AdtlGateway {
     private readonly audit;
     private readonly log;
     private readonly approvals;
-    private readonly authorizer;
+    private readonly authorizers;
     private readonly principal;
+    private readonly approverRoles;
+    private readonly elicitApprovals;
+    /** The server the agent is connected to, for elicitation. */
+    private server;
     private routes;
     private promptRoutes;
     /** Resource URI → the upstreams that list it. */
     private resourceRoutes;
     private templateRoutes;
     constructor(opts: AdtlGatewayOptions);
-    /** Ask the authorizer, if any. Returns the denial; in audit mode the caller logs it and carries on. */
+    /** Ask each authorizer in turn. Returns the first denial; in audit mode the caller logs it and carries on. */
     private authorize;
     /** The downstream MCP server the agent connects to. */
     createServer(): Server;
     /** Every upstream's items from one list method, following cursors. Upstreams that fail are skipped with a warning. */
     private listAll;
+    /** tools/list as the caller sees it: without the tools the authorizer would deny. */
+    visibleTools(): Promise<Tool[]>;
+    /** prompts/list as the caller sees it. */
+    visiblePrompts(): Promise<Prompt[]>;
+    /** resources/list as the caller sees it. A URI several upstreams offer is listed as before (reading it is refused). */
+    visibleResources(): Promise<Resource[]>;
+    /**
+     * Leave out items the authorizer would deny, asked without arguments. Not in
+     * audit mode, which changes nothing. Hiding only saves the agent a denied
+     * call: routes are kept, and a call to a hidden item is still authorized.
+     */
+    private hideDenied;
     listTools(): Promise<Tool[]>;
     listPrompts(): Promise<Prompt[]>;
     listResources(): Promise<Resource[]>;

package/dist/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAUL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EAErB,KAAK,IAAI,EACV,MAAM,oCAAoC,CAAC;AAG5C,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAwC,KAAK,UAAU,EAAe,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAErH,OAAO,KAAK,EAAyB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAuBnD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAOD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,+FAA+F;IAC/F,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,qFAAqF;IACrF,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAmCD,qBAAa,WAAW;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,YAAY,CAAkC;IACtD,iDAAiD;IACjD,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,cAAc,CAAuB;gBAEjC,IAAI,EAAE,kBAAkB;IAWpC,uGAAuG;YACzF,SAAS;IAIvB,uDAAuD;IACvD,YAAY,IAAI,MAAM;IAuCtB,sHAAsH;YACxG,OAAO;IAsBf,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAe5B,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAehC,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAkBpC,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAiB1D,wFAAwF;YAC1E,gBAAgB;IAkBxB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQtD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAiBtF;;;;;OAKG;YACW,cAAc;IAyEtB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAoJ5G,gFAAgF;YAClE,eAAe;CAY9B"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAUL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EAErB,KAAK,IAAI,EACV,MAAM,oCAAoC,CAAC;AAG5C,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,gBAAgB,CAAC;AAErE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAwC,KAAK,UAAU,EAAe,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAErH,OAAO,KAAK,EAAW,kBAAkB,EAAgC,MAAM,cAAc,CAAC;AAE9F,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAuBnD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAOD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,uHAAuH;IACvH,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,CAAC;IACvC,qFAAqF;IACrF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mEAAmE;IACnE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,6EAA6E;IAC7E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAI3F;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAmCD,qBAAa,WAAW;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAe;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,6DAA6D;IAC7D,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,YAAY,CAAkC;IACtD,iDAAiD;IACjD,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,cAAc,CAAuB;gBAEjC,IAAI,EAAE,kBAAkB;IAapC,8GAA8G;YAChG,SAAS;IAQvB,uDAAuD;IACvD,YAAY,IAAI,MAAM;IAwCtB,sHAAsH;YACxG,OAAO;IAsBrB,qFAAqF;IAC/E,YAAY,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAQrC,0CAA0C;IACpC,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAQzC,uHAAuH;IACjH,gBAAgB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAQ7C;;;;OAIG;YACW,UAAU;IAWlB,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAe5B,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAehC,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAkBpC,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAiB1D,wFAAwF;YAC1E,gBAAgB;IAkBxB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQtD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAiBtF;;;;;OAKG;YACW,cAAc;IA6EtB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAoK5G,gFAAgF;YAClE,eAAe;CAY9B"}

package/dist/gateway.js

@@ -21,8 +21,10 @@
  * unanswered or undeliverable calls are stopped. Without an approval channel,
  * "ask" blocks.
  *
- * An optional Authorizer decides first whether the caller may use the tool,
- * resource or prompt at all; a denial stops the call before the policy runs.
+ * Optional Authorizers decide first whether the caller may use the tool,
+ * resource or prompt at all; any denial stops the call before the policy runs.
+ * The lists the agent sees leave out what an authorizer would deny, so the
+ * agent doesn't try it; hiding is a convenience, and every call is still checked.
  *
  * In audit mode (the invoker runs every interceptor with `mode: "audit"`)
  * nothing is stopped or changed: calls the policy would stop are forwarded,
@@ -33,15 +35,25 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { UriTemplate } from "@modelcontextprotocol/sdk/shared/uriTemplate.js";
 import { CallToolRequestSchema, ErrorCode, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { callBindingHash } from "@adtl/labels";
+import { ElicitationChannel, supportsElicitation } from "./elicitation.js";
 import { authorize } from "./authorizer.js";
 import { TOOL_SEPARATOR } from "./config.js";
-export const GATEWAY_VERSION = "0.5.1";
+export const GATEWAY_VERSION = "0.7.0";
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export const GATEWAY_DECISION_KEY = "adtl/gateway";
 const stderrLogger = {
     info: (m) => console.error(`[adtl-gateway] ${m}`),
     warn: (m) => console.error(`[adtl-gateway] warning: ${m}`),
 };
+/**
+ * Who may answer an "ask" whose rules name approver roles: someone in one of
+ * the roles of every list. Sorted, for stable notifications and tests.
+ */
+export function eligibleApprovers(lists, roles) {
+    const sets = lists.map((list) => new Set(list.flatMap((role) => roles.get(role) ?? [])));
+    const [first, ...rest] = sets;
+    return [...(first ?? [])].filter((id) => id !== "*" && rest.every((s) => s.has(id))).sort();
+}
 /** How often a waiting call reports progress, so clients that reset their timeout on progress keep waiting. */
 const PROGRESS_INTERVAL_MS = 10_000;
 function textError(text, meta) {
@@ -75,8 +87,12 @@ export class AdtlGateway {
     audit;
     log;
     approvals;
-    authorizer;
+    authorizers;
     principal;
+    approverRoles;
+    elicitApprovals;
+    /** The server the agent is connected to, for elicitation. */
+    server;
     routes = new Map();
     promptRoutes = new Map();
     /** Resource URI → the upstreams that list it. */
@@ -89,12 +105,19 @@ export class AdtlGateway {
         this.audit = opts.audit;
         this.log = opts.logger ?? stderrLogger;
         this.approvals = opts.approvals;
-        this.authorizer = opts.authorizer;
+        this.authorizers = opts.authorizer === undefined ? [] : [opts.authorizer].flat();
         this.principal = opts.principal ?? { type: "anonymous" };
+        this.approverRoles = opts.approverRoles ?? new Map();
+        this.elicitApprovals = opts.elicitApprovals === true;
     }
-    /** Ask the authorizer, if any. Returns the denial; in audit mode the caller logs it and carries on. */
+    /** Ask each authorizer in turn. Returns the first denial; in audit mode the caller logs it and carries on. */
     async authorize(request) {
-        return this.authorizer ? authorize(this.authorizer, { principal: this.principal, ...request }) : undefined;
+        for (const a of this.authorizers) {
+            const denied = await authorize(a, { principal: this.principal, ...request });
+            if (denied)
+                return denied;
+        }
+        return undefined;
     }
     /** The downstream MCP server the agent connects to. */
     createServer() {
@@ -110,7 +133,7 @@ export class AdtlGateway {
             instructions: "Tools from several MCP servers, named <server>__<tool>. ADTL checks each call against trust labels; " +
                 "if a call is stopped, the result explains why.",
         });
-        server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: await this.listTools() }));
+        server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: await this.visibleTools() }));
         server.setRequestHandler(CallToolRequestSchema, async (req, extra) => {
             const progressToken = req.params._meta?.progressToken;
             const progress = progressToken === undefined
@@ -119,16 +142,17 @@ export class AdtlGateway {
             return this.callTool(req.params.name, req.params.arguments ?? {}, progress ? { progress } : {});
         });
         if (capabilities.resources) {
-            server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await this.listResources() }));
+            server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await this.visibleResources() }));
             server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
                 resourceTemplates: await this.listResourceTemplates(),
             }));
             server.setRequestHandler(ReadResourceRequestSchema, async (req) => this.readResource(req.params.uri));
         }
         if (capabilities.prompts) {
-            server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await this.listPrompts() }));
+            server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await this.visiblePrompts() }));
             server.setRequestHandler(GetPromptRequestSchema, async (req) => this.getPrompt(req.params.name, req.params.arguments));
         }
+        this.server = server;
         return server;
     }
     /** Every upstream's items from one list method, following cursors. Upstreams that fail are skipped with a warning. */
@@ -152,6 +176,44 @@ export class AdtlGateway {
         }
         return out;
     }
+    /** tools/list as the caller sees it: without the tools the authorizer would deny. */
+    async visibleTools() {
+        const tools = await this.listTools();
+        return this.hideDenied(tools, (t) => {
+            const r = this.routes.get(t.name);
+            return { event: "tools/call", server: r.upstream, tool: r.tool };
+        });
+    }
+    /** prompts/list as the caller sees it. */
+    async visiblePrompts() {
+        const prompts = await this.listPrompts();
+        return this.hideDenied(prompts, (p) => {
+            const r = this.promptRoutes.get(p.name);
+            return { event: "prompts/get", server: r.upstream, prompt: r.prompt };
+        });
+    }
+    /** resources/list as the caller sees it. A URI several upstreams offer is listed as before (reading it is refused). */
+    async visibleResources() {
+        const resources = await this.listResources();
+        return this.hideDenied(resources, (r) => {
+            const ups = this.resourceRoutes.get(r.uri);
+            return ups?.size === 1 ? { event: "resources/read", server: [...ups][0], resource: r.uri } : undefined;
+        });
+    }
+    /**
+     * Leave out items the authorizer would deny, asked without arguments. Not in
+     * audit mode, which changes nothing. Hiding only saves the agent a denied
+     * call: routes are kept, and a call to a hidden item is still authorized.
+     */
+    async hideDenied(items, request) {
+        if (!this.authorizers.length || this.invoker.modeOverride === "audit")
+            return items;
+        const shown = await Promise.all(items.map(async (item) => {
+            const r = request(item);
+            return r === undefined || (await this.authorize(r)) === undefined;
+        }));
+        return items.filter((_, i) => shown[i]);
+    }
     async listTools() {
         const all = await this.listAll("tools/list", "tools", async (c, cursor) => {
             const p = await c.listTools(cursor ? { cursor } : {});
@@ -266,6 +328,7 @@ export class AdtlGateway {
         const config = { server: upstream };
         const audit = this.invoker.modeOverride === "audit" ? { mode: "audit" } : {};
         let denied;
+        const ran = [];
         const finish = (entry) => this.audit?.write({
             ts: context.timestamp,
             sessionId: this.sessionId,
@@ -274,6 +337,7 @@ export class AdtlGateway {
             ...target,
             ...(denied ? { denied } : {}),
             ...entry,
+            ...(ran.length ? { interceptors: [...ran] } : {}),
             durationMs: Math.round(performance.now() - started),
         });
         const what = "resource" in target ? `resource ${target.resource}` : `prompt ${upstream}${TOOL_SEPARATOR}${target.prompt}`;
@@ -291,6 +355,7 @@ export class AdtlGateway {
         if (denied)
             this.log.info(`audit: would deny ${what}: ${denied.reason}`);
         const req = await this.invoker.runRequest({ event, payload: { method: event, params }, config, context });
+        ran.push(...req.ran);
         if (req.blocked) {
             finish({ outcome: "blocked", decision: req.blocked.decision, reason: req.blocked.reason, warnings: req.warnings });
             this.log.info(`${req.blocked.decision} ${what}: ${req.blocked.reason}`);
@@ -306,6 +371,7 @@ export class AdtlGateway {
             throw err;
         }
         const res = await this.invoker.runResponse({ event, payload: { method: event, params: forwarded, result }, config, context });
+        ran.push(...res.ran);
         const warnings = [...req.warnings, ...res.warnings];
         if (res.blocked) {
             // Fail closed: unlabeled content must not reach the agent.
@@ -340,7 +406,15 @@ export class AdtlGateway {
         };
         const base = { sessionId: this.sessionId, event: "tools/call", server: route.upstream, tool: route.tool };
         let denied;
-        const finish = (entry) => this.audit?.write({ ts: context.timestamp, ...base, ...(denied ? { denied } : {}), ...entry, durationMs: Math.round(performance.now() - started) });
+        const ran = [];
+        const finish = (entry) => this.audit?.write({
+            ts: context.timestamp,
+            ...base,
+            ...(denied ? { denied } : {}),
+            ...entry,
+            ...(ran.length ? { interceptors: [...ran] } : {}),
+            durationMs: Math.round(performance.now() - started),
+        });
         // 0. Authorization: may this caller use this tool at all? A denial wins over any policy decision.
         denied = await this.authorize({ event: "tools/call", server: route.upstream, tool: route.tool, arguments: args });
         if (denied && this.invoker.modeOverride !== "audit") {
@@ -358,6 +432,7 @@ export class AdtlGateway {
         // 1. Request phase: adtl.policy decides whether the call may run.
         const requestPayload = { method: "tools/call", params: { name: route.tool, arguments: args } };
         let req = await this.invoker.runRequest({ event: "tools/call", payload: requestPayload, config, context });
+        ran.push(...req.ran);
         const policy = infoOf(req, "adtl.policy");
         let approval;
         if (req.blocked) {
@@ -367,8 +442,12 @@ export class AdtlGateway {
             const stopped = { decision: b.decision, reason: b.reason, matched: policy.matched, callHash: policy.callHash, sessionLabel: policy.sessionLabel };
             const matched = Array.isArray(policy.matched) ? policy.matched : [];
             const hash = b.confirmation?.callHash ?? policy.callHash;
-            if (b.decision === "ask" && this.approvals?.canApprove && typeof hash === "string") {
-                this.log.info(`ask ${name}: waiting for approval (${b.reason})`);
+            const lists = Array.isArray(policy.approvers) ? policy.approvers : undefined;
+            const approvers = lists ? eligibleApprovers(lists, this.approverRoles) : undefined;
+            // The client's own prompt, if enabled and supported; never for named approvers (it can't say who answered).
+            const elicit = this.elicitApprovals && !approvers && this.server && supportsElicitation(this.server) ? [new ElicitationChannel(this.server)] : [];
+            if (b.decision === "ask" && this.approvals && (this.approvals.canApprove || elicit.length > 0) && typeof hash === "string") {
+                this.log.info(`ask ${name}: waiting for approval${approvers ? ` from ${approvers.join(", ") || "nobody"}` : ""} (${b.reason})`);
                 approval = await this.waitForApproval(opts, () => this.approvals.request({
                     sessionId: this.sessionId,
                     server: route.upstream,
@@ -377,7 +456,8 @@ export class AdtlGateway {
                     reason: b.reason,
                     matched,
                     ...(policy.sessionLabel !== undefined ? { sessionLabel: policy.sessionLabel } : {}),
-                }));
+                    ...(approvers ? { approvers } : {}),
+                }, elicit));
                 this.log.info(`ask ${name}: ${approval.outcome}`);
                 if (approval.outcome !== "approved") {
                     finish({ outcome: "blocked", ...stopped, approval, warnings: req.warnings });
@@ -395,6 +475,7 @@ export class AdtlGateway {
                             ...(approval.approver ? { principal: { type: "user", id: approval.approver } } : {}),
                         }];
                     req = await this.invoker.runRequest({ event: "tools/call", payload: requestPayload, config, context: { ...context, confirmations } });
+                    ran.push(...req.ran);
                     const sent = callBindingHash({ event: "tools/call", phase: "request", target: route.upstream, payload: req.payload });
                     const recheck = req.blocked?.reason ?? (sent !== c.callHash ? "the call changed after it was approved" : undefined);
                     if (recheck !== undefined) {
@@ -438,6 +519,7 @@ export class AdtlGateway {
             config,
             context,
         });
+        ran.push(...res.ran);
         if (res.blocked) {
             // Fail closed: an unlabeled result must not reach the agent.
             finish({ outcome: "blocked", decision: res.blocked.decision, reason: res.blocked.reason, callHash: policy.callHash, warnings: [...req.warnings, ...res.warnings] });