@adtl/gateway 0.7.0 → 0.8.1

package/dist/invoker.js

@@ -1,38 +1,116 @@
 import { DECISION_INFO_KEY, INVOKE_METHOD, LIST_METHOD, } from "@adtl/interceptors";
 import { z } from "zod";
 const AnyResult = z.object({}).passthrough();
-/** Untyped request: interceptor methods are extension methods the SDK does not type. */
+/**
+ * Untyped request: interceptor methods are extension methods the SDK does not type.
+ * The timeout is enforced here too, so a client that ignores it can't hang a phase.
+ */
 function request(client, method, params, timeout) {
     const r = client.request;
-    return r.call(client, { method, params }, AnyResult, { timeout });
+    const controller = new AbortController();
+    let timer;
+    const expired = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error(`timed out after ${timeout} ms`));
+        }, timeout);
+    });
+    return Promise.race([r.call(client, { method, params }, AnyResult, { timeout, signal: controller.signal }), expired]).finally(() => clearTimeout(timer));
 }
-function priority(def, phase) {
-    const p = def.priorityHint;
+/** SEP-2624 `resolvePriority`: the override's hint, else the interceptor's. */
+export function resolvePriority(def, overrides, phase) {
+    const p = overrides?.priorityHint ?? def.priorityHint;
     if (p === undefined)
         return 0;
     if (typeof p === "number")
         return p;
     return p[phase] ?? 0;
 }
-function hooks(def, event, phase) {
-    return def.hooks.some((h) => h.phase === phase && (h.events.includes(event) || h.events.includes("*")));
+function matches(hooks, event, phase) {
+    return hooks.some((h) => h.phase === phase && (h.events.includes(event) || h.events.includes("*")));
+}
+/**
+ * Problems with `overrides` for these interceptors: an unknown name, or hooks
+ * that widen what the interceptor declares (which SEP-2624 says to reject).
+ */
+export function checkOverrides(defs, overrides) {
+    const problems = [];
+    for (const [name, o] of Object.entries(overrides)) {
+        const def = defs.find((d) => d.name === name);
+        if (!def) {
+            problems.push(`${name}: no such interceptor (offered: ${defs.map((d) => d.name).join(", ")})`);
+            continue;
+        }
+        for (const h of o.hooks ?? []) {
+            for (const event of h.events) {
+                const declared = def.hooks.some((d) => d.phase === h.phase && (d.events.includes("*") || (event !== "*" && d.events.includes(event))));
+                if (!declared)
+                    problems.push(`${name}: hooks may only narrow the declared hooks, and ${event} (${h.phase}) is not declared`);
+            }
+        }
+    }
+    return problems;
+}
+/** Interceptors of a type this invoker doesn't run (e.g. the proposed `sink`). They are never invoked. */
+export function unsupportedInterceptors(bound) {
+    return bound
+        .filter((b) => b.definition.type !== "validation" && b.definition.type !== "mutation")
+        .map((b) => `${b.definition.name} (${String(b.definition.type)})`);
+}
+/** Interceptor names offered by more than one server: each must be invoked on its own server, so names must be unique. */
+export function duplicateInterceptors(bound) {
+    const servers = new Map();
+    for (const b of bound)
+        servers.set(b.definition.name, [...(servers.get(b.definition.name) ?? []), b.server ?? "?"]);
+    return [...servers].filter(([, s]) => s.length > 1).map(([name, s]) => `${name} (offered by ${s.join(", ")})`);
+}
+/**
+ * Mutators that would run after `name` on a phase both hook, so they see (and
+ * could change or drop) what it wrote. Used to warn when another server's
+ * mutator runs after adtl.label.
+ */
+export function mutatorsAfter(bound, name, overrides = {}) {
+    const target = bound.find((b) => b.definition.name === name);
+    if (!target)
+        return [];
+    const hooksOf = (b) => overrides[b.definition.name]?.hooks ?? b.definition.hooks;
+    const shares = (b, phase) => hooksOf(b).some((h) => h.phase === phase && hooksOf(target).some((t) => t.phase === phase && (h.events.includes("*") || t.events.includes("*") || h.events.some((e) => t.events.includes(e)))));
+    const after = [];
+    for (const b of bound) {
+        if (b === target || b.definition.type !== "mutation")
+            continue;
+        const late = ["request", "response"].some((phase) => {
+            if (!shares(b, phase))
+                return false;
+            const p = resolvePriority(b.definition, overrides[b.definition.name], phase);
+            const t = resolvePriority(target.definition, overrides[name], phase);
+            return p > t || (p === t && b.definition.name.localeCompare(name) > 0);
+        });
+        if (late)
+            after.push(b.definition.name);
+    }
+    return after;
 }
 export class InterceptorInvoker {
     interceptors;
     timeoutMs;
     modeOverride;
+    overrides;
     constructor(interceptors, timeoutMs = 5000, 
     /** Overrides the mode every interceptor declares. */
-    modeOverride) {
+    modeOverride, 
+    /** Per-interceptor overrides, by name. Check them with `checkOverrides` first. */
+    overrides = {}) {
         this.interceptors = interceptors;
         this.timeoutMs = timeoutMs;
         this.modeOverride = modeOverride;
+        this.overrides = overrides;
     }
     /** Discover the interceptors an interceptor server offers. */
-    static async discover(client) {
+    static async discover(client, opts = {}) {
         const res = await request(client, LIST_METHOD, {}, 10_000);
         const defs = (res.interceptors ?? []);
-        return defs.map((definition) => ({ client, definition }));
+        return defs.map((definition) => ({ client, definition, ...opts }));
     }
     get definitions() {
         return this.interceptors.map((i) => i.definition);
@@ -51,33 +129,56 @@ export class InterceptorInvoker {
         await this.mutate("response", opts, out);
         return out;
     }
+    override(i) {
+        return this.overrides[i.definition.name];
+    }
+    mode(i) {
+        return this.modeOverride ?? this.override(i)?.mode ?? i.definition.mode ?? "active";
+    }
     isAudit(i) {
-        return (this.modeOverride ?? i.definition.mode) === "audit";
+        return this.mode(i) === "audit";
     }
-    /** Record that `i` runs in `phase`, with its resolved policy. The gateway has no failOpen overrides. */
+    failOpen(i) {
+        return (this.override(i)?.failOpen ?? i.definition.failOpen) === true;
+    }
+    timeout(i) {
+        return this.override(i)?.timeoutMs ?? this.timeoutMs;
+    }
+    /** Record that `i` runs in `phase`, with its resolved policy. */
     run(i, phase, out) {
+        const o = this.override(i);
         const r = {
             name: i.definition.name,
             phase,
-            mode: this.modeOverride ?? i.definition.mode ?? "active",
-            modeFrom: this.modeOverride ? "override" : "default",
-            failOpen: i.definition.failOpen === true,
-            failOpenFrom: "default",
+            mode: this.mode(i),
+            modeFrom: this.modeOverride || o?.mode ? "override" : "default",
+            failOpen: this.failOpen(i),
+            failOpenFrom: o?.failOpen !== undefined ? "override" : "default",
+            timeoutMs: this.timeout(i),
         };
         out.ran.push(r);
         return r;
     }
     select(type, event, phase) {
-        return this.interceptors.filter((i) => i.definition.type === type && hooks(i.definition, event, phase));
+        return this.interceptors.filter((i) => i.definition.type === type && matches(this.override(i)?.hooks ?? i.definition.hooks, event, phase));
     }
     async invoke(i, phase, opts, payload) {
-        const res = await request(i.client, INVOKE_METHOD, { name: i.definition.name, event: opts.event, phase, payload, config: opts.config, timeoutMs: this.timeoutMs, context: opts.context }, this.timeoutMs);
+        const timeoutMs = this.timeout(i);
+        const res = await request(i.client, INVOKE_METHOD, {
+            name: i.definition.name,
+            event: opts.event,
+            phase,
+            payload,
+            ...(i.sendConfig === false ? {} : { config: opts.config }),
+            timeoutMs,
+            context: opts.context,
+        }, timeoutMs);
         return res;
     }
     /** Handle an interceptor failure. Returns false if the phase must stop. */
     failed(i, err, out) {
         const msg = `${i.definition.name} failed: ${err instanceof Error ? err.message : String(err)}`;
-        if (this.isAudit(i) || i.definition.failOpen === true) {
+        if (this.isAudit(i) || this.failOpen(i)) {
             out.warnings.push(msg);
             return true;
         }
@@ -86,7 +187,8 @@ export class InterceptorInvoker {
     }
     /** Sequential mutations, atomic: on failure the original payload is kept. */
     async mutate(phase, opts, out) {
-        const selected = this.select("mutation", opts.event, phase).sort((a, b) => priority(a.definition, phase) - priority(b.definition, phase) || a.definition.name.localeCompare(b.definition.name));
+        const selected = this.select("mutation", opts.event, phase).sort((a, b) => resolvePriority(a.definition, this.override(a), phase) - resolvePriority(b.definition, this.override(b), phase) ||
+            a.definition.name.localeCompare(b.definition.name));
         let payload = out.payload;
         for (const i of selected) {
             const ran = this.run(i, phase, out);

package/dist/invoker.js.map

@@ -1 +1 @@
-{"version":3,"file":"invoker.js","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,WAAW,GAQZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAI7C,wFAAwF;AACxF,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe,EAAE,OAAe;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,OAAsF,CAAC;IACxG,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACpE,CAAC;AAmDD,SAAS,QAAQ,CAAC,GAA0B,EAAE,KAAY;IACxD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,KAAK,CAAC,GAA0B,EAAE,KAAa,EAAE,KAAY;IACpE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,OAAO,kBAAkB;IAEV;IACA;IAER;IAJX,YACmB,YAAgC,EAChC,YAAY,IAAI;IACjC,qDAAqD;IAC5C,YAA8B;QAHtB,iBAAY,GAAZ,YAAY,CAAoB;QAChC,cAAS,GAAT,SAAS,CAAO;QAExB,iBAAY,GAAZ,YAAY,CAAkB;IACtC,CAAC;IAEJ,8DAA8D;IAC9D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAc;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA4B,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAmB;QAClC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAmB;QACnC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,CAAmB;QACjC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC;IAC9D,CAAC;IAED,wGAAwG;IAChG,GAAG,CAAC,CAAmB,EAAE,KAAY,EAAE,GAAiB;QAC9D,MAAM,CAAC,GAAmB;YACxB,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI;YACvB,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,QAAQ;YACxD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACpD,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI;YACxC,YAAY,EAAE,SAAS;SACxB,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,MAAM,CAAC,IAAmC,EAAE,KAAa,EAAE,KAAY;QAC7E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,CAAmB,EAAE,KAAY,EAAE,IAAmB,EAAE,OAAgB;QAC3F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,CAAC,CAAC,MAAM,EACR,aAAa,EACb,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EACrI,IAAI,CAAC,SAAS,CACf,CAAC;QACF,OAAO,GAAmC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IACnE,MAAM,CAAC,CAAmB,EAAE,GAAY,EAAE,GAAiB;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAC9D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAC9H,CAAC;QACF,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,CAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAmB,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1D,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAClD,KAAK,CAAC,QAAQ,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAE,CAAC;YACzB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,EAAE,GAAG,KAAK,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAyB,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO;YACjE,qFAAqF;YACrF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACnD,2DAA2D;gBAC3D,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAA0B,IAAI,OAAO,CAAC,CAAC;gBAC7G,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC;gBACxG,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACzC,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClI,CAAC;YACH,CAAC;YACD,EAAE,GAAG,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}
+{"version":3,"file":"invoker.js","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,WAAW,GASZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAI7C;;;GAGG;AACH,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe,EAAE,OAAe;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,OAAsF,CAAC;IACxG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,OAAO,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CACjI,YAAY,CAAC,KAAK,CAAC,CACpB,CAAC;AACJ,CAAC;AAuED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,GAA0B,EAAE,SAA2C,EAAE,KAAY;IACnH,MAAM,CAAC,GAAG,SAAS,EAAE,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC;IACtD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB,EAAE,KAAa,EAAE,KAAY;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAA6B,EAAE,SAA+C;IAC3G,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,mCAAmC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/F,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvI,IAAI,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,mDAAmD,KAAK,KAAK,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC;SACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC;IACpH,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB,EAAE,IAAY,EAAE,YAAkD,EAAE;IACzH,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;IACnG,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,KAAY,EAAE,EAAE,CACnD,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClM,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QAC/D,MAAM,IAAI,GAAI,CAAC,SAAS,EAAE,UAAU,CAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7D,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,kBAAkB;IAEV;IACA;IAER;IAEQ;IANnB,YACmB,YAAgC,EAChC,YAAY,IAAI;IACjC,qDAAqD;IAC5C,YAA8B;IACvC,kFAAkF;IACjE,YAAkD,EAAE;QALpD,iBAAY,GAAZ,YAAY,CAAoB;QAChC,cAAS,GAAT,SAAS,CAAO;QAExB,iBAAY,GAAZ,YAAY,CAAkB;QAEtB,cAAS,GAAT,SAAS,CAA2C;IACpE,CAAC;IAEJ,8DAA8D;IAC9D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAkD,EAAE;QACxF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA4B,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAmB;QAClC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAmB;QACnC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,CAAmB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEO,IAAI,CAAC,CAAmB;QAC9B,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtF,CAAC;IAEO,OAAO,CAAC,CAAmB;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;IAClC,CAAC;IAEO,QAAQ,CAAC,CAAmB;QAClC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IACxE,CAAC;IAEO,OAAO,CAAC,CAAmB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,iEAAiE;IACzD,GAAG,CAAC,CAAmB,EAAE,KAAY,EAAE,GAAiB;QAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAmB;YACxB,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI;YACvB,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC/D,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1B,YAAY,EAAE,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAChE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;SAC3B,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,MAAM,CAAC,IAAmC,EAAE,KAAa,EAAE,KAAY;QAC7E,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAC1G,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,CAAmB,EAAE,KAAY,EAAE,IAAmB,EAAE,OAAgB;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,CAAC,CAAC,MAAM,EACR,aAAa,EACb;YACE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK;YACL,OAAO;YACP,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1D,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,EACD,SAAS,CACV,CAAC;QACF,OAAO,GAAmC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IACnE,MAAM,CAAC,CAAmB,EAAE,GAAY,EAAE,GAAiB;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAC9D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;YAC/G,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACrD,CAAC;QACF,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,CAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAmB,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1D,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAClD,KAAK,CAAC,QAAQ,CAAC,KAAY,EAAE,IAAmB,EAAE,GAAiB;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAE,CAAC;YACzB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,EAAE,GAAG,KAAK,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAyB,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO;YACjE,qFAAqF;YACrF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACnD,2DAA2D;gBAC3D,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAA0B,IAAI,OAAO,CAAC,CAAC;gBAC7G,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC;gBACxG,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACzC,GAAG,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClI,CAAC;YACH,CAAC;YACD,EAAE,GAAG,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/openfga.d.ts

@@ -0,0 +1,13 @@
+import type { AuthorizationDecision, AuthorizationRequest, Authorizer } from "./authorizer.js";
+import type { OpenFgaConfig } from "./config.js";
+export declare class OpenFgaAuthorizer implements Authorizer {
+    private readonly cfg;
+    private readonly fetchFn;
+    readonly name = "openfga";
+    constructor(cfg: OpenFgaConfig, fetchFn?: typeof fetch);
+    private user;
+    /** The object of this call, or a reason it can't be built. "listing" means: decide when called. */
+    private object;
+    check(req: AuthorizationRequest): Promise<AuthorizationDecision>;
+}
+//# sourceMappingURL=openfga.d.ts.map

package/dist/openfga.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga.d.ts","sourceRoot":"","sources":["../src/openfga.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYjD,qBAAa,iBAAkB,YAAW,UAAU;IAIhD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,QAAQ,CAAC,IAAI,aAAa;gBAGP,GAAG,EAAE,aAAa,EAClB,OAAO,GAAE,OAAO,KAAa;IAGhD,OAAO,CAAC,IAAI;IAMZ,mGAAmG;IACnG,OAAO,CAAC,MAAM;IAqBR,KAAK,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAuBvE"}

package/dist/openfga.js

@@ -0,0 +1,101 @@
+/**
+ * Relationship-based authorization with OpenFGA (`gateway.openfga`):
+ *
+ *   openfga:
+ *     url: http://localhost:8080
+ *     storeId: "${FGA_STORE_ID}"
+ *     modelId: "${FGA_MODEL_ID}"     # optional: pin an authorization model
+ *     token: "${FGA_TOKEN}"          # optional: bearer token
+ *     relation: can_use              # optional: the default relation
+ *     timeoutMs: 2000                # optional
+ *     tools:                         # optional: per-resource rules, from the call's arguments
+ *       github.add_issue_comment: { relation: can_comment, object: "repo:{owner}/{repo}" }
+ *
+ * Every call becomes one OpenFGA check:
+ *
+ *   user      user:<id>, service:<id>, or user:anonymous without an id
+ *   relation  the tool's rule, else `relation`
+ *   object    the tool's rule, else tool:<server>.<tool>, prompt:<server>.<name> or resource:<uri>
+ *
+ * Ids are percent-encoded, because OpenFGA ids can't hold `:`, `#`, `@` or
+ * spaces; ids too long for OpenFGA are replaced by their SHA-256. A rule's
+ * `{argument}` must be a string or number, or the call is denied. Tool lists
+ * have no arguments, so tools whose object needs them stay listed and are
+ * checked when called. An unreachable server or an error denies the call.
+ *
+ * Works with Auth0 FGA too, by pointing `url` at its API and passing a token.
+ */
+import { createHash } from "node:crypto";
+/** OpenFGA's limit on the id part of an object or user. */
+const MAX_ID = 254;
+function fgaId(value) {
+    const id = encodeURIComponent(value);
+    return id.length <= MAX_ID ? id : `sha256-${createHash("sha256").update(value).digest("hex")}`;
+}
+const PLACEHOLDER = /\{([A-Za-z0-9_.-]+)\}/g;
+export class OpenFgaAuthorizer {
+    cfg;
+    fetchFn;
+    name = "openfga";
+    constructor(cfg, fetchFn = fetch) {
+        this.cfg = cfg;
+        this.fetchFn = fetchFn;
+    }
+    user(req) {
+        const p = req.principal;
+        if (p.type === "anonymous" || !p.id)
+            return "user:anonymous";
+        return `${p.type === "service" ? "service" : "user"}:${fgaId(p.id)}`;
+    }
+    /** The object of this call, or a reason it can't be built. "listing" means: decide when called. */
+    object(req, template) {
+        if (template !== undefined) {
+            if (req.arguments === undefined && template.search(PLACEHOLDER) !== -1)
+                return "listing";
+            const colon = template.indexOf(":");
+            const type = template.slice(0, colon + 1);
+            let missing;
+            const id = template.slice(colon + 1).replace(PLACEHOLDER, (_, name) => {
+                const v = req.arguments?.[name];
+                if (typeof v !== "string" && typeof v !== "number") {
+                    missing ??= name;
+                    return "";
+                }
+                return String(v);
+            });
+            return missing !== undefined ? { missing } : { object: `${type}${fgaId(id)}` };
+        }
+        if (req.tool !== undefined)
+            return { object: `tool:${fgaId(`${req.server}.${req.tool}`)}` };
+        if (req.prompt !== undefined)
+            return { object: `prompt:${fgaId(`${req.server}.${req.prompt}`)}` };
+        return { object: `resource:${fgaId(req.resource ?? "")}` };
+    }
+    async check(req) {
+        const rule = req.tool !== undefined ? this.cfg.tools[`${req.server}.${req.tool}`] : undefined;
+        const target = this.object(req, rule?.object);
+        if (target === "listing")
+            return { allow: true };
+        const what = req.tool ?? req.prompt ?? req.resource;
+        if ("missing" in target)
+            return { allow: false, reason: `openfga: ${what} has no usable argument "${target.missing}"` };
+        const user = this.user(req);
+        const relation = rule?.relation ?? this.cfg.relation;
+        const res = await this.fetchFn(`${this.cfg.url.replace(/\/+$/, "")}/stores/${encodeURIComponent(this.cfg.storeId)}/check`, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...(this.cfg.token ? { authorization: `Bearer ${this.cfg.token}` } : {}) },
+            body: JSON.stringify({
+                tuple_key: { user, relation, object: target.object },
+                ...(this.cfg.modelId ? { authorization_model_id: this.cfg.modelId } : {}),
+            }),
+            signal: AbortSignal.timeout(this.cfg.timeoutMs),
+        });
+        if (!res.ok)
+            throw new Error(`OpenFGA answered ${res.status}`);
+        const body = (await res.json());
+        if (body.allowed === true)
+            return { allow: true };
+        return { allow: false, reason: `OpenFGA: ${user} has no ${relation} on ${target.object}` };
+    }
+}
+//# sourceMappingURL=openfga.js.map

package/dist/openfga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../src/openfga.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,2DAA2D;AAC3D,MAAM,MAAM,GAAG,GAAG,CAAC;AAEnB,SAAS,KAAK,CAAC,KAAa;IAC1B,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJV,IAAI,GAAG,SAAS,CAAC;IAE1B,YACmB,GAAkB,EAClB,UAAwB,KAAK;QAD7B,QAAG,GAAH,GAAG,CAAe;QAClB,YAAO,GAAP,OAAO,CAAsB;IAC7C,CAAC;IAEI,IAAI,CAAC,GAAyB;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,gBAAgB,CAAC;QAC7D,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,mGAAmG;IAC3F,MAAM,CAAC,GAAyB,EAAE,QAAiB;QACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1C,IAAI,OAA2B,CAAC;YAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;gBAC5E,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACnD,OAAO,KAAK,IAAI,CAAC;oBACjB,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClG,OAAO,EAAE,MAAM,EAAE,YAAY,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAyB;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC;QACpD,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,IAAI,4BAA4B,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC;QAExH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE;YACzH,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACzH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBACpD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,QAAQ,OAAO,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7F,CAAC;CACF"}

package/dist/startup.d.ts

@@ -32,16 +32,25 @@ export declare function gatewayPrincipal(cfg: GatewayConfig, env: NodeJS.Process
  * The configured authorizers, in the order they are asked: roles, then cedar.
  * Cedar files are read and parsed here, so a bad policy fails startup.
  */
-export declare function gatewayAuthorizers(cfg: GatewayConfig, baseDir: string): Promise<Authorizer[]>;
+export declare function gatewayAuthorizers(cfg: GatewayConfig, baseDir: string, env?: NodeJS.ProcessEnv): Promise<Authorizer[]>;
 /**
  * Under Claude Code, which passes `CLAUDE_CODE_SESSION_ID` to stdio MCP
  * servers, the gateway uses that id and keeps session labels in files, so the
  * Claude Code hooks (`adtl-gateway hook`) add to the same session label.
+ *
+ * `ADTL_SESSION_ID` does the same for any agent framework, and wins over
+ * Claude Code's: a sub-agent's gateway started with its parent's session id
+ * starts from the parent's label, and what it reads taints the parent too.
  */
 export declare function sharedSession(env: NodeJS.ProcessEnv): {
     sessionId: string;
     dir: string;
 } | undefined;
+/** `ADTL_AGENT_ID` (and `ADTL_AGENT_TYPE`): which agent this gateway serves, for the audit log. */
+export declare function gatewayAgent(env: NodeJS.ProcessEnv): {
+    id: string;
+    type?: string;
+} | undefined;
 export interface StartedGateway {
     gateway: AdtlGateway;
     close(): Promise<void>;

package/dist/startup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAGpF,OAAO,EAAE,cAAc,EAAiB,MAAM,gBAAgB,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAML,KAAK,aAAa,EAElB,KAAK,QAAQ,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAmB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAKhF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAS3E;AAED,8GAA8G;AAC9G,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAqB/E;AAED,iDAAiD;AACjD,wBAAgB,sBAAsB,IAAI,MAAM,CAI/C;AAaD,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/F;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAwB1H;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAqB3F;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,GAAG,SAAS,CAMlG;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAWnG;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAGpG;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAO,GAC7D,OAAO,CAAC,cAAc,CAAC,CA2FzB"}
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAGpF,OAAO,EAAE,cAAc,EAAiB,MAAM,gBAAgB,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAML,KAAK,aAAa,EAElB,KAAK,QAAQ,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAmB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAOhF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAS3E;AAED,8GAA8G;AAC9G,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAqB/E;AAED,iDAAiD;AACjD,wBAAgB,sBAAsB,IAAI,MAAM,CAI/C;AAaD,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/F;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAyB1H;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAqB3F;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,GAAG,SAAS,CAMlG;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAwBzI;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAGpG;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAI9F;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAO,GAC7D,OAAO,CAAC,cAAc,CAAC,CAoIzB"}

package/dist/startup.js

@@ -18,7 +18,9 @@ import { CedarAuthorizer } from "./cedar.js";
 import { GatewayConfigSchema, expandApprovals, expandEnv, expandUpstream, isHttpUpstream, } from "./config.js";
 import { EmailNotifier } from "./email.js";
 import { AdtlGateway, GATEWAY_VERSION } from "./gateway.js";
-import { InterceptorInvoker } from "./invoker.js";
+import { InterceptorInvoker, checkOverrides, duplicateInterceptors, mutatorsAfter, unsupportedInterceptors } from "./invoker.js";
+import { OpenFgaAuthorizer } from "./openfga.js";
+import { loadTotpVerifier } from "./totp.js";
 import { NtfyNotifier } from "./ntfy.js";
 import { RoleAuthorizer } from "./roles.js";
 export class GatewayConfigError extends Error {
@@ -103,13 +105,14 @@ export function createApprovals(cfg, env, log) {
         notifiers.push(new EmailNotifier({ smtp: a.email.smtp, from: a.email.from, to: [a.email.to].flat(), on: a.email.on }));
     }
     const approverChannels = new Map(Object.entries(a.approvers ?? {}).map(([id, c]) => [id, [new NtfyNotifier({ ...c.ntfy, name: `ntfy:${id}` })]]));
-    if (notifiers.length === 0 && approverChannels.size === 0 && !a.elicitation)
+    if (notifiers.length === 0 && approverChannels.size === 0 && !a.elicitation && !a.totp)
         return undefined;
-    if (!notifiers.some((n) => n.listen) && approverChannels.size === 0 && !a.elicitation) {
+    if (!notifiers.some((n) => n.listen) && approverChannels.size === 0 && !a.elicitation && !a.totp) {
         log.warn('no approval channel can carry answers (configure gateway.approvals.ntfy); "ask" still blocks');
     }
     const approvers = approverChannels.size ? `; approvers: ${[...approverChannels.keys()].join(", ")}` : "";
-    const shared = [...notifiers.map((n) => n.name), ...(a.elicitation ? ["elicitation (if the client supports it)"] : [])];
+    const inClient = a.totp ? ["authenticator code (if the client supports elicitation)"] : a.elicitation ? ["elicitation (if the client supports it)"] : [];
+    const shared = [...notifiers.map((n) => n.name), ...inClient];
     log.info(`approvals: ${shared.join(", ") || "none shared"}${approvers} (timeout ${a.timeoutSeconds}s)`);
     return new ApprovalBroker({ notifiers, approverChannels, timeoutMs: a.timeoutSeconds * 1000, log });
 }
@@ -158,7 +161,7 @@ export function gatewayPrincipal(cfg, env) {
  * The configured authorizers, in the order they are asked: roles, then cedar.
  * Cedar files are read and parsed here, so a bad policy fails startup.
  */
-export async function gatewayAuthorizers(cfg, baseDir) {
+export async function gatewayAuthorizers(cfg, baseDir, env = process.env) {
     const out = [];
     if (cfg.roles)
         out.push(new RoleAuthorizer(cfg.roles));
@@ -170,23 +173,44 @@ export async function gatewayAuthorizers(cfg, baseDir) {
             throw new GatewayConfigError(err.message);
         }
     }
+    if (cfg.openfga) {
+        const f = cfg.openfga;
+        const expand = (v, key) => expandEnv(v, env, `gateway.openfga.${key}`);
+        out.push(new OpenFgaAuthorizer({
+            ...f,
+            url: expand(f.url, "url"),
+            storeId: expand(f.storeId, "storeId"),
+            ...(f.modelId !== undefined ? { modelId: expand(f.modelId, "modelId") } : {}),
+            ...(f.token !== undefined ? { token: expand(f.token, "token") } : {}),
+        }));
+    }
     return out;
 }
 /**
  * Under Claude Code, which passes `CLAUDE_CODE_SESSION_ID` to stdio MCP
  * servers, the gateway uses that id and keeps session labels in files, so the
  * Claude Code hooks (`adtl-gateway hook`) add to the same session label.
+ *
+ * `ADTL_SESSION_ID` does the same for any agent framework, and wins over
+ * Claude Code's: a sub-agent's gateway started with its parent's session id
+ * starts from the parent's label, and what it reads taints the parent too.
  */
 export function sharedSession(env) {
-    const sessionId = env.CLAUDE_CODE_SESSION_ID?.trim();
+    const sessionId = env.ADTL_SESSION_ID?.trim() || env.CLAUDE_CODE_SESSION_ID?.trim();
     return sessionId ? { sessionId, dir: defaultSessionsDir(env) } : undefined;
 }
+/** `ADTL_AGENT_ID` (and `ADTL_AGENT_TYPE`): which agent this gateway serves, for the audit log. */
+export function gatewayAgent(env) {
+    const id = env.ADTL_AGENT_ID?.trim();
+    const type = env.ADTL_AGENT_TYPE?.trim();
+    return id ? { id, ...(type ? { type } : {}) } : undefined;
+}
 export async function startGateway(loaded, opts = {}) {
     const env = opts.env ?? process.env;
     // Config problems that need no process: fail before starting any.
     const approverMembers = approverRoles(loaded.labels, loaded.gateway);
     const baseDir = dirname(loaded.path);
-    const authorizers = await gatewayAuthorizers(loaded.gateway, baseDir);
+    const authorizers = await gatewayAuthorizers(loaded.gateway, baseDir, env);
     const log = opts.logger ?? { info: (m) => console.error(`[adtl-gateway] ${m}`), warn: (m) => console.error(`[adtl-gateway] warning: ${m}`) };
     const clients = [];
     const closeAll = () => Promise.allSettled(clients.map((c) => c.close())).then(() => undefined);
@@ -211,15 +235,54 @@ export async function startGateway(loaded, opts = {}) {
         if (!interceptors.getServerCapabilities()?.extensions?.[INTERCEPTORS_EXTENSION]) {
             throw new GatewayConfigError(`The interceptor server does not declare the ${INTERCEPTORS_EXTENSION} extension`);
         }
-        const bound = await InterceptorInvoker.discover(interceptors);
-        const names = bound.map((b) => b.definition.name);
+        const own = await InterceptorInvoker.discover(interceptors, { server: "interceptors" });
+        const ownNames = own.map((b) => b.definition.name);
         for (const required of [POLICY_INTERCEPTOR, LABEL_INTERCEPTOR]) {
-            if (!names.includes(required)) {
+            if (!ownNames.includes(required)) {
                 throw new GatewayConfigError(`The interceptor server does not offer ${required}; refusing to start without it`);
             }
         }
+        // More interceptor servers (SEP-2624: interceptors may come from N servers, each invoked where it was advertised).
+        // A server that can't be reached stops startup: the owner asked for its interceptors.
+        const bound = [...own];
+        for (const [id, server] of Object.entries(loaded.gateway.interceptorServers)) {
+            const where = `gateway.interceptorServers.${id}`;
+            let client;
+            try {
+                client = await connectUpstream(`interceptors:${id}`, expandUpstream(id, server, env), baseDir);
+            }
+            catch (err) {
+                throw new GatewayConfigError(`${where}: could not connect: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            clients.push(client);
+            if (!client.getServerCapabilities()?.extensions?.[INTERCEPTORS_EXTENSION]) {
+                throw new GatewayConfigError(`${where} does not declare the ${INTERCEPTORS_EXTENSION} extension`);
+            }
+            bound.push(...(await InterceptorInvoker.discover(client, { server: id, sendConfig: false })));
+        }
+        const duplicates = duplicateInterceptors(bound);
+        if (duplicates.length)
+            throw new GatewayConfigError(`Interceptor names must be unique across servers: ${duplicates.join("; ")}`);
+        const names = bound.map((b) => b.definition.name);
+        const overrides = loaded.gateway.interceptorOverrides;
+        const problems = checkOverrides(bound.map((b) => b.definition), overrides);
+        if (problems.length)
+            throw new GatewayConfigError(`gateway.interceptorOverrides: ${problems.join("; ")}`);
+        const unsupported = unsupportedInterceptors(bound);
+        if (unsupported.length)
+            log.warn(`not running interceptors of an unknown type: ${unsupported.join(", ")}`);
+        const late = mutatorsAfter(bound, LABEL_INTERCEPTOR, overrides);
+        if (late.length) {
+            log.warn(`${late.join(", ")} run after ${LABEL_INTERCEPTOR} and could change or drop its label; give them a lower priorityHint`);
+        }
+        for (const name of [POLICY_INTERCEPTOR, LABEL_INTERCEPTOR]) {
+            const o = overrides[name];
+            if (o?.mode === "audit" || o?.failOpen === true || o?.hooks) {
+                log.warn(`gateway.interceptorOverrides relaxes ${name} (${Object.keys(o).join(", ")}): calls it would stop may get through`);
+            }
+        }
         const audit = loaded.gateway.mode === "audit";
-        const invoker = new InterceptorInvoker(bound, loaded.gateway.interceptorTimeoutMs, audit ? "audit" : undefined);
+        const invoker = new InterceptorInvoker(bound, loaded.gateway.interceptorTimeoutMs, audit ? "audit" : undefined, overrides);
         log.info(`interceptors: ${names.join(", ")}`);
         if (shared)
             log.info(`sharing session labels with Claude Code hooks (${shared.dir})`);
@@ -257,8 +320,16 @@ export async function startGateway(loaded, opts = {}) {
         for (const a of authorizers)
             if (a.name !== "roles")
                 log.info(`authorizer: ${a.name}`);
+        const totp = loaded.gateway.approvals?.totp ? loadTotpVerifier(env) : undefined;
+        if (loaded.gateway.approvals?.totp && !totp)
+            throw new GatewayConfigError("gateway.approvals.totp is on, but no secret is set up: run adtl-gateway totp setup");
+        const agent = gatewayAgent(env);
+        if (agent)
+            log.info(`agent: ${agent.id}${agent.type ? ` (${agent.type})` : ""}`);
         const gateway = new AdtlGateway({
             ...(shared ? { sessionId: shared.sessionId } : {}),
+            ...(agent ? { agent } : {}),
+            ...(totp ? { totp } : {}),
             upstreams,
             invoker,
             ...(auditLog ? { audit: auditLog } : {}),