@agentwares/agentguard 0.1.0

package/dist/index.js

@@ -0,0 +1,4595 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/timing_safe_equal.js
+var require_timing_safe_equal = __commonJS({
+  "../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/timing_safe_equal.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.timingSafeEqual = void 0;
+    function assert(expr, msg = "") {
+      if (!expr) {
+        throw new Error(msg);
+      }
+    }
+    function timingSafeEqual(a, b) {
+      if (a.byteLength !== b.byteLength) {
+        return false;
+      }
+      if (!(a instanceof DataView)) {
+        a = new DataView(ArrayBuffer.isView(a) ? a.buffer : a);
+      }
+      if (!(b instanceof DataView)) {
+        b = new DataView(ArrayBuffer.isView(b) ? b.buffer : b);
+      }
+      assert(a instanceof DataView);
+      assert(b instanceof DataView);
+      const length = a.byteLength;
+      let out = 0;
+      let i = -1;
+      while (++i < length) {
+        out |= a.getUint8(i) ^ b.getUint8(i);
+      }
+      return out === 0;
+    }
+    exports.timingSafeEqual = timingSafeEqual;
+  }
+});
+
+// ../../node_modules/.pnpm/@stablelib+base64@1.0.1/node_modules/@stablelib/base64/lib/base64.js
+var require_base64 = __commonJS({
+  "../../node_modules/.pnpm/@stablelib+base64@1.0.1/node_modules/@stablelib/base64/lib/base64.js"(exports) {
+    "use strict";
+    var __extends = exports && exports.__extends || /* @__PURE__ */ (function() {
+      var extendStatics = function(d, b) {
+        extendStatics = Object.setPrototypeOf || { __proto__: [] } instanceof Array && function(d2, b2) {
+          d2.__proto__ = b2;
+        } || function(d2, b2) {
+          for (var p in b2) if (b2.hasOwnProperty(p)) d2[p] = b2[p];
+        };
+        return extendStatics(d, b);
+      };
+      return function(d, b) {
+        extendStatics(d, b);
+        function __() {
+          this.constructor = d;
+        }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    var INVALID_BYTE = 256;
+    var Coder = (
+      /** @class */
+      (function() {
+        function Coder2(_paddingCharacter) {
+          if (_paddingCharacter === void 0) {
+            _paddingCharacter = "=";
+          }
+          this._paddingCharacter = _paddingCharacter;
+        }
+        Coder2.prototype.encodedLength = function(length) {
+          if (!this._paddingCharacter) {
+            return (length * 8 + 5) / 6 | 0;
+          }
+          return (length + 2) / 3 * 4 | 0;
+        };
+        Coder2.prototype.encode = function(data) {
+          var out = "";
+          var i = 0;
+          for (; i < data.length - 2; i += 3) {
+            var c = data[i] << 16 | data[i + 1] << 8 | data[i + 2];
+            out += this._encodeByte(c >>> 3 * 6 & 63);
+            out += this._encodeByte(c >>> 2 * 6 & 63);
+            out += this._encodeByte(c >>> 1 * 6 & 63);
+            out += this._encodeByte(c >>> 0 * 6 & 63);
+          }
+          var left = data.length - i;
+          if (left > 0) {
+            var c = data[i] << 16 | (left === 2 ? data[i + 1] << 8 : 0);
+            out += this._encodeByte(c >>> 3 * 6 & 63);
+            out += this._encodeByte(c >>> 2 * 6 & 63);
+            if (left === 2) {
+              out += this._encodeByte(c >>> 1 * 6 & 63);
+            } else {
+              out += this._paddingCharacter || "";
+            }
+            out += this._paddingCharacter || "";
+          }
+          return out;
+        };
+        Coder2.prototype.maxDecodedLength = function(length) {
+          if (!this._paddingCharacter) {
+            return (length * 6 + 7) / 8 | 0;
+          }
+          return length / 4 * 3 | 0;
+        };
+        Coder2.prototype.decodedLength = function(s) {
+          return this.maxDecodedLength(s.length - this._getPaddingLength(s));
+        };
+        Coder2.prototype.decode = function(s) {
+          if (s.length === 0) {
+            return new Uint8Array(0);
+          }
+          var paddingLength = this._getPaddingLength(s);
+          var length = s.length - paddingLength;
+          var out = new Uint8Array(this.maxDecodedLength(length));
+          var op = 0;
+          var i = 0;
+          var haveBad = 0;
+          var v0 = 0, v1 = 0, v2 = 0, v3 = 0;
+          for (; i < length - 4; i += 4) {
+            v0 = this._decodeChar(s.charCodeAt(i + 0));
+            v1 = this._decodeChar(s.charCodeAt(i + 1));
+            v2 = this._decodeChar(s.charCodeAt(i + 2));
+            v3 = this._decodeChar(s.charCodeAt(i + 3));
+            out[op++] = v0 << 2 | v1 >>> 4;
+            out[op++] = v1 << 4 | v2 >>> 2;
+            out[op++] = v2 << 6 | v3;
+            haveBad |= v0 & INVALID_BYTE;
+            haveBad |= v1 & INVALID_BYTE;
+            haveBad |= v2 & INVALID_BYTE;
+            haveBad |= v3 & INVALID_BYTE;
+          }
+          if (i < length - 1) {
+            v0 = this._decodeChar(s.charCodeAt(i));
+            v1 = this._decodeChar(s.charCodeAt(i + 1));
+            out[op++] = v0 << 2 | v1 >>> 4;
+            haveBad |= v0 & INVALID_BYTE;
+            haveBad |= v1 & INVALID_BYTE;
+          }
+          if (i < length - 2) {
+            v2 = this._decodeChar(s.charCodeAt(i + 2));
+            out[op++] = v1 << 4 | v2 >>> 2;
+            haveBad |= v2 & INVALID_BYTE;
+          }
+          if (i < length - 3) {
+            v3 = this._decodeChar(s.charCodeAt(i + 3));
+            out[op++] = v2 << 6 | v3;
+            haveBad |= v3 & INVALID_BYTE;
+          }
+          if (haveBad !== 0) {
+            throw new Error("Base64Coder: incorrect characters for decoding");
+          }
+          return out;
+        };
+        Coder2.prototype._encodeByte = function(b) {
+          var result = b;
+          result += 65;
+          result += 25 - b >>> 8 & 0 - 65 - 26 + 97;
+          result += 51 - b >>> 8 & 26 - 97 - 52 + 48;
+          result += 61 - b >>> 8 & 52 - 48 - 62 + 43;
+          result += 62 - b >>> 8 & 62 - 43 - 63 + 47;
+          return String.fromCharCode(result);
+        };
+        Coder2.prototype._decodeChar = function(c) {
+          var result = INVALID_BYTE;
+          result += (42 - c & c - 44) >>> 8 & -INVALID_BYTE + c - 43 + 62;
+          result += (46 - c & c - 48) >>> 8 & -INVALID_BYTE + c - 47 + 63;
+          result += (47 - c & c - 58) >>> 8 & -INVALID_BYTE + c - 48 + 52;
+          result += (64 - c & c - 91) >>> 8 & -INVALID_BYTE + c - 65 + 0;
+          result += (96 - c & c - 123) >>> 8 & -INVALID_BYTE + c - 97 + 26;
+          return result;
+        };
+        Coder2.prototype._getPaddingLength = function(s) {
+          var paddingLength = 0;
+          if (this._paddingCharacter) {
+            for (var i = s.length - 1; i >= 0; i--) {
+              if (s[i] !== this._paddingCharacter) {
+                break;
+              }
+              paddingLength++;
+            }
+            if (s.length < 4 || paddingLength > 2) {
+              throw new Error("Base64Coder: incorrect padding");
+            }
+          }
+          return paddingLength;
+        };
+        return Coder2;
+      })()
+    );
+    exports.Coder = Coder;
+    var stdCoder = new Coder();
+    function encode(data) {
+      return stdCoder.encode(data);
+    }
+    exports.encode = encode;
+    function decode(s) {
+      return stdCoder.decode(s);
+    }
+    exports.decode = decode;
+    var URLSafeCoder = (
+      /** @class */
+      (function(_super) {
+        __extends(URLSafeCoder2, _super);
+        function URLSafeCoder2() {
+          return _super !== null && _super.apply(this, arguments) || this;
+        }
+        URLSafeCoder2.prototype._encodeByte = function(b) {
+          var result = b;
+          result += 65;
+          result += 25 - b >>> 8 & 0 - 65 - 26 + 97;
+          result += 51 - b >>> 8 & 26 - 97 - 52 + 48;
+          result += 61 - b >>> 8 & 52 - 48 - 62 + 45;
+          result += 62 - b >>> 8 & 62 - 45 - 63 + 95;
+          return String.fromCharCode(result);
+        };
+        URLSafeCoder2.prototype._decodeChar = function(c) {
+          var result = INVALID_BYTE;
+          result += (44 - c & c - 46) >>> 8 & -INVALID_BYTE + c - 45 + 62;
+          result += (94 - c & c - 96) >>> 8 & -INVALID_BYTE + c - 95 + 63;
+          result += (47 - c & c - 58) >>> 8 & -INVALID_BYTE + c - 48 + 52;
+          result += (64 - c & c - 91) >>> 8 & -INVALID_BYTE + c - 65 + 0;
+          result += (96 - c & c - 123) >>> 8 & -INVALID_BYTE + c - 97 + 26;
+          return result;
+        };
+        return URLSafeCoder2;
+      })(Coder)
+    );
+    exports.URLSafeCoder = URLSafeCoder;
+    var urlSafeCoder = new URLSafeCoder();
+    function encodeURLSafe(data) {
+      return urlSafeCoder.encode(data);
+    }
+    exports.encodeURLSafe = encodeURLSafe;
+    function decodeURLSafe(s) {
+      return urlSafeCoder.decode(s);
+    }
+    exports.decodeURLSafe = decodeURLSafe;
+    exports.encodedLength = function(length) {
+      return stdCoder.encodedLength(length);
+    };
+    exports.maxDecodedLength = function(length) {
+      return stdCoder.maxDecodedLength(length);
+    };
+    exports.decodedLength = function(s) {
+      return stdCoder.decodedLength(s);
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/fast-sha256@1.3.0/node_modules/fast-sha256/sha256.js
+var require_sha256 = __commonJS({
+  "../../node_modules/.pnpm/fast-sha256@1.3.0/node_modules/fast-sha256/sha256.js"(exports, module) {
+    "use strict";
+    (function(root, factory) {
+      var exports2 = {};
+      factory(exports2);
+      var sha256 = exports2["default"];
+      for (var k in exports2) {
+        sha256[k] = exports2[k];
+      }
+      if (typeof module === "object" && typeof module.exports === "object") {
+        module.exports = sha256;
+      } else if (typeof define === "function" && define.amd) {
+        define(function() {
+          return sha256;
+        });
+      } else {
+        root.sha256 = sha256;
+      }
+    })(exports, function(exports2) {
+      "use strict";
+      exports2.__esModule = true;
+      exports2.digestLength = 32;
+      exports2.blockSize = 64;
+      var K = new Uint32Array([
+        1116352408,
+        1899447441,
+        3049323471,
+        3921009573,
+        961987163,
+        1508970993,
+        2453635748,
+        2870763221,
+        3624381080,
+        310598401,
+        607225278,
+        1426881987,
+        1925078388,
+        2162078206,
+        2614888103,
+        3248222580,
+        3835390401,
+        4022224774,
+        264347078,
+        604807628,
+        770255983,
+        1249150122,
+        1555081692,
+        1996064986,
+        2554220882,
+        2821834349,
+        2952996808,
+        3210313671,
+        3336571891,
+        3584528711,
+        113926993,
+        338241895,
+        666307205,
+        773529912,
+        1294757372,
+        1396182291,
+        1695183700,
+        1986661051,
+        2177026350,
+        2456956037,
+        2730485921,
+        2820302411,
+        3259730800,
+        3345764771,
+        3516065817,
+        3600352804,
+        4094571909,
+        275423344,
+        430227734,
+        506948616,
+        659060556,
+        883997877,
+        958139571,
+        1322822218,
+        1537002063,
+        1747873779,
+        1955562222,
+        2024104815,
+        2227730452,
+        2361852424,
+        2428436474,
+        2756734187,
+        3204031479,
+        3329325298
+      ]);
+      function hashBlocks(w, v, p, pos, len) {
+        var a, b, c, d, e, f, g, h, u, i, j, t1, t2;
+        while (len >= 64) {
+          a = v[0];
+          b = v[1];
+          c = v[2];
+          d = v[3];
+          e = v[4];
+          f = v[5];
+          g = v[6];
+          h = v[7];
+          for (i = 0; i < 16; i++) {
+            j = pos + i * 4;
+            w[i] = (p[j] & 255) << 24 | (p[j + 1] & 255) << 16 | (p[j + 2] & 255) << 8 | p[j + 3] & 255;
+          }
+          for (i = 16; i < 64; i++) {
+            u = w[i - 2];
+            t1 = (u >>> 17 | u << 32 - 17) ^ (u >>> 19 | u << 32 - 19) ^ u >>> 10;
+            u = w[i - 15];
+            t2 = (u >>> 7 | u << 32 - 7) ^ (u >>> 18 | u << 32 - 18) ^ u >>> 3;
+            w[i] = (t1 + w[i - 7] | 0) + (t2 + w[i - 16] | 0);
+          }
+          for (i = 0; i < 64; i++) {
+            t1 = (((e >>> 6 | e << 32 - 6) ^ (e >>> 11 | e << 32 - 11) ^ (e >>> 25 | e << 32 - 25)) + (e & f ^ ~e & g) | 0) + (h + (K[i] + w[i] | 0) | 0) | 0;
+            t2 = ((a >>> 2 | a << 32 - 2) ^ (a >>> 13 | a << 32 - 13) ^ (a >>> 22 | a << 32 - 22)) + (a & b ^ a & c ^ b & c) | 0;
+            h = g;
+            g = f;
+            f = e;
+            e = d + t1 | 0;
+            d = c;
+            c = b;
+            b = a;
+            a = t1 + t2 | 0;
+          }
+          v[0] += a;
+          v[1] += b;
+          v[2] += c;
+          v[3] += d;
+          v[4] += e;
+          v[5] += f;
+          v[6] += g;
+          v[7] += h;
+          pos += 64;
+          len -= 64;
+        }
+        return pos;
+      }
+      var Hash = (
+        /** @class */
+        (function() {
+          function Hash2() {
+            this.digestLength = exports2.digestLength;
+            this.blockSize = exports2.blockSize;
+            this.state = new Int32Array(8);
+            this.temp = new Int32Array(64);
+            this.buffer = new Uint8Array(128);
+            this.bufferLength = 0;
+            this.bytesHashed = 0;
+            this.finished = false;
+            this.reset();
+          }
+          Hash2.prototype.reset = function() {
+            this.state[0] = 1779033703;
+            this.state[1] = 3144134277;
+            this.state[2] = 1013904242;
+            this.state[3] = 2773480762;
+            this.state[4] = 1359893119;
+            this.state[5] = 2600822924;
+            this.state[6] = 528734635;
+            this.state[7] = 1541459225;
+            this.bufferLength = 0;
+            this.bytesHashed = 0;
+            this.finished = false;
+            return this;
+          };
+          Hash2.prototype.clean = function() {
+            for (var i = 0; i < this.buffer.length; i++) {
+              this.buffer[i] = 0;
+            }
+            for (var i = 0; i < this.temp.length; i++) {
+              this.temp[i] = 0;
+            }
+            this.reset();
+          };
+          Hash2.prototype.update = function(data, dataLength) {
+            if (dataLength === void 0) {
+              dataLength = data.length;
+            }
+            if (this.finished) {
+              throw new Error("SHA256: can't update because hash was finished.");
+            }
+            var dataPos = 0;
+            this.bytesHashed += dataLength;
+            if (this.bufferLength > 0) {
+              while (this.bufferLength < 64 && dataLength > 0) {
+                this.buffer[this.bufferLength++] = data[dataPos++];
+                dataLength--;
+              }
+              if (this.bufferLength === 64) {
+                hashBlocks(this.temp, this.state, this.buffer, 0, 64);
+                this.bufferLength = 0;
+              }
+            }
+            if (dataLength >= 64) {
+              dataPos = hashBlocks(this.temp, this.state, data, dataPos, dataLength);
+              dataLength %= 64;
+            }
+            while (dataLength > 0) {
+              this.buffer[this.bufferLength++] = data[dataPos++];
+              dataLength--;
+            }
+            return this;
+          };
+          Hash2.prototype.finish = function(out) {
+            if (!this.finished) {
+              var bytesHashed = this.bytesHashed;
+              var left = this.bufferLength;
+              var bitLenHi = bytesHashed / 536870912 | 0;
+              var bitLenLo = bytesHashed << 3;
+              var padLength = bytesHashed % 64 < 56 ? 64 : 128;
+              this.buffer[left] = 128;
+              for (var i = left + 1; i < padLength - 8; i++) {
+                this.buffer[i] = 0;
+              }
+              this.buffer[padLength - 8] = bitLenHi >>> 24 & 255;
+              this.buffer[padLength - 7] = bitLenHi >>> 16 & 255;
+              this.buffer[padLength - 6] = bitLenHi >>> 8 & 255;
+              this.buffer[padLength - 5] = bitLenHi >>> 0 & 255;
+              this.buffer[padLength - 4] = bitLenLo >>> 24 & 255;
+              this.buffer[padLength - 3] = bitLenLo >>> 16 & 255;
+              this.buffer[padLength - 2] = bitLenLo >>> 8 & 255;
+              this.buffer[padLength - 1] = bitLenLo >>> 0 & 255;
+              hashBlocks(this.temp, this.state, this.buffer, 0, padLength);
+              this.finished = true;
+            }
+            for (var i = 0; i < 8; i++) {
+              out[i * 4 + 0] = this.state[i] >>> 24 & 255;
+              out[i * 4 + 1] = this.state[i] >>> 16 & 255;
+              out[i * 4 + 2] = this.state[i] >>> 8 & 255;
+              out[i * 4 + 3] = this.state[i] >>> 0 & 255;
+            }
+            return this;
+          };
+          Hash2.prototype.digest = function() {
+            var out = new Uint8Array(this.digestLength);
+            this.finish(out);
+            return out;
+          };
+          Hash2.prototype._saveState = function(out) {
+            for (var i = 0; i < this.state.length; i++) {
+              out[i] = this.state[i];
+            }
+          };
+          Hash2.prototype._restoreState = function(from, bytesHashed) {
+            for (var i = 0; i < this.state.length; i++) {
+              this.state[i] = from[i];
+            }
+            this.bytesHashed = bytesHashed;
+            this.finished = false;
+            this.bufferLength = 0;
+          };
+          return Hash2;
+        })()
+      );
+      exports2.Hash = Hash;
+      var HMAC = (
+        /** @class */
+        (function() {
+          function HMAC2(key) {
+            this.inner = new Hash();
+            this.outer = new Hash();
+            this.blockSize = this.inner.blockSize;
+            this.digestLength = this.inner.digestLength;
+            var pad = new Uint8Array(this.blockSize);
+            if (key.length > this.blockSize) {
+              new Hash().update(key).finish(pad).clean();
+            } else {
+              for (var i = 0; i < key.length; i++) {
+                pad[i] = key[i];
+              }
+            }
+            for (var i = 0; i < pad.length; i++) {
+              pad[i] ^= 54;
+            }
+            this.inner.update(pad);
+            for (var i = 0; i < pad.length; i++) {
+              pad[i] ^= 54 ^ 92;
+            }
+            this.outer.update(pad);
+            this.istate = new Uint32Array(8);
+            this.ostate = new Uint32Array(8);
+            this.inner._saveState(this.istate);
+            this.outer._saveState(this.ostate);
+            for (var i = 0; i < pad.length; i++) {
+              pad[i] = 0;
+            }
+          }
+          HMAC2.prototype.reset = function() {
+            this.inner._restoreState(this.istate, this.inner.blockSize);
+            this.outer._restoreState(this.ostate, this.outer.blockSize);
+            return this;
+          };
+          HMAC2.prototype.clean = function() {
+            for (var i = 0; i < this.istate.length; i++) {
+              this.ostate[i] = this.istate[i] = 0;
+            }
+            this.inner.clean();
+            this.outer.clean();
+          };
+          HMAC2.prototype.update = function(data) {
+            this.inner.update(data);
+            return this;
+          };
+          HMAC2.prototype.finish = function(out) {
+            if (this.outer.finished) {
+              this.outer.finish(out);
+            } else {
+              this.inner.finish(out);
+              this.outer.update(out, this.digestLength).finish(out);
+            }
+            return this;
+          };
+          HMAC2.prototype.digest = function() {
+            var out = new Uint8Array(this.digestLength);
+            this.finish(out);
+            return out;
+          };
+          return HMAC2;
+        })()
+      );
+      exports2.HMAC = HMAC;
+      function hash(data) {
+        var h = new Hash().update(data);
+        var digest = h.digest();
+        h.clean();
+        return digest;
+      }
+      exports2.hash = hash;
+      exports2["default"] = hash;
+      function hmac(key, data) {
+        var h = new HMAC(key).update(data);
+        var digest = h.digest();
+        h.clean();
+        return digest;
+      }
+      exports2.hmac = hmac;
+      function fillBuffer(buffer, hmac2, info, counter2) {
+        var num = counter2[0];
+        if (num === 0) {
+          throw new Error("hkdf: cannot expand more");
+        }
+        hmac2.reset();
+        if (num > 1) {
+          hmac2.update(buffer);
+        }
+        if (info) {
+          hmac2.update(info);
+        }
+        hmac2.update(counter2);
+        hmac2.finish(buffer);
+        counter2[0]++;
+      }
+      var hkdfSalt = new Uint8Array(exports2.digestLength);
+      function hkdf(key, salt, info, length) {
+        if (salt === void 0) {
+          salt = hkdfSalt;
+        }
+        if (length === void 0) {
+          length = 32;
+        }
+        var counter2 = new Uint8Array([1]);
+        var okm = hmac(salt, key);
+        var hmac_ = new HMAC(okm);
+        var buffer = new Uint8Array(hmac_.digestLength);
+        var bufpos = buffer.length;
+        var out = new Uint8Array(length);
+        for (var i = 0; i < length; i++) {
+          if (bufpos === buffer.length) {
+            fillBuffer(buffer, hmac_, info, counter2);
+            bufpos = 0;
+          }
+          out[i] = buffer[bufpos++];
+        }
+        hmac_.clean();
+        buffer.fill(0);
+        counter2.fill(0);
+        return out;
+      }
+      exports2.hkdf = hkdf;
+      function pbkdf2(password, salt, iterations, dkLen) {
+        var prf = new HMAC(password);
+        var len = prf.digestLength;
+        var ctr = new Uint8Array(4);
+        var t = new Uint8Array(len);
+        var u = new Uint8Array(len);
+        var dk = new Uint8Array(dkLen);
+        for (var i = 0; i * len < dkLen; i++) {
+          var c = i + 1;
+          ctr[0] = c >>> 24 & 255;
+          ctr[1] = c >>> 16 & 255;
+          ctr[2] = c >>> 8 & 255;
+          ctr[3] = c >>> 0 & 255;
+          prf.reset();
+          prf.update(salt);
+          prf.update(ctr);
+          prf.finish(u);
+          for (var j = 0; j < len; j++) {
+            t[j] = u[j];
+          }
+          for (var j = 2; j <= iterations; j++) {
+            prf.reset();
+            prf.update(u).finish(u);
+            for (var k = 0; k < len; k++) {
+              t[k] ^= u[k];
+            }
+          }
+          for (var j = 0; j < len && i * len + j < dkLen; j++) {
+            dk[i * len + j] = t[j];
+          }
+        }
+        for (var i = 0; i < len; i++) {
+          t[i] = u[i] = 0;
+        }
+        for (var i = 0; i < 4; i++) {
+          ctr[i] = 0;
+        }
+        prf.clean();
+        return dk;
+      }
+      exports2.pbkdf2 = pbkdf2;
+    });
+  }
+});
+
+// ../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/index.js
+var require_dist = __commonJS({
+  "../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.Webhook = exports.WebhookVerificationError = void 0;
+    var timing_safe_equal_1 = require_timing_safe_equal();
+    var base64 = require_base64();
+    var sha256 = require_sha256();
+    var WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60;
+    var ExtendableError = class _ExtendableError extends Error {
+      constructor(message) {
+        super(message);
+        Object.setPrototypeOf(this, _ExtendableError.prototype);
+        this.name = "ExtendableError";
+        this.stack = new Error(message).stack;
+      }
+    };
+    var WebhookVerificationError = class _WebhookVerificationError extends ExtendableError {
+      constructor(message) {
+        super(message);
+        Object.setPrototypeOf(this, _WebhookVerificationError.prototype);
+        this.name = "WebhookVerificationError";
+      }
+    };
+    exports.WebhookVerificationError = WebhookVerificationError;
+    var Webhook2 = class _Webhook {
+      constructor(secret, options) {
+        if (!secret) {
+          throw new Error("Secret can't be empty.");
+        }
+        if ((options === null || options === void 0 ? void 0 : options.format) === "raw") {
+          if (secret instanceof Uint8Array) {
+            this.key = secret;
+          } else {
+            this.key = Uint8Array.from(secret, (c) => c.charCodeAt(0));
+          }
+        } else {
+          if (typeof secret !== "string") {
+            throw new Error("Expected secret to be of type string");
+          }
+          if (secret.startsWith(_Webhook.prefix)) {
+            secret = secret.substring(_Webhook.prefix.length);
+          }
+          this.key = base64.decode(secret);
+        }
+      }
+      verify(payload, headers_) {
+        const headers = {};
+        for (const key of Object.keys(headers_)) {
+          headers[key.toLowerCase()] = headers_[key];
+        }
+        const msgId = headers["webhook-id"];
+        const msgSignature = headers["webhook-signature"];
+        const msgTimestamp = headers["webhook-timestamp"];
+        if (!msgSignature || !msgId || !msgTimestamp) {
+          throw new WebhookVerificationError("Missing required headers");
+        }
+        const timestamp = this.verifyTimestamp(msgTimestamp);
+        const computedSignature = this.sign(msgId, timestamp, payload);
+        const expectedSignature = computedSignature.split(",")[1];
+        const passedSignatures = msgSignature.split(" ");
+        const encoder2 = new globalThis.TextEncoder();
+        for (const versionedSignature of passedSignatures) {
+          const [version3, signature] = versionedSignature.split(",");
+          if (version3 !== "v1") {
+            continue;
+          }
+          if ((0, timing_safe_equal_1.timingSafeEqual)(encoder2.encode(signature), encoder2.encode(expectedSignature))) {
+            return JSON.parse(payload.toString());
+          }
+        }
+        throw new WebhookVerificationError("No matching signature found");
+      }
+      sign(msgId, timestamp, payload) {
+        if (typeof payload === "string") {
+        } else if (payload.constructor.name === "Buffer") {
+          payload = payload.toString();
+        } else {
+          throw new Error("Expected payload to be of type string or Buffer.");
+        }
+        const encoder2 = new TextEncoder();
+        const timestampNumber = Math.floor(timestamp.getTime() / 1e3);
+        const toSign = encoder2.encode(`${msgId}.${timestampNumber}.${payload}`);
+        const expectedSignature = base64.encode(sha256.hmac(this.key, toSign));
+        return `v1,${expectedSignature}`;
+      }
+      verifyTimestamp(timestampHeader) {
+        const now = Math.floor(Date.now() / 1e3);
+        const timestamp = parseInt(timestampHeader, 10);
+        if (isNaN(timestamp)) {
+          throw new WebhookVerificationError("Invalid Signature Headers");
+        }
+        if (now - timestamp > WEBHOOK_TOLERANCE_IN_SECONDS) {
+          throw new WebhookVerificationError("Message timestamp too old");
+        }
+        if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) {
+          throw new WebhookVerificationError("Message timestamp too new");
+        }
+        return new Date(timestamp * 1e3);
+      }
+    };
+    exports.Webhook = Webhook2;
+    Webhook2.prefix = "whsec_";
+  }
+});
+
+// src/proxy/runtime.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import {
+  getDefaultEnvironment,
+  StdioClientTransport
+} from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import {
+  CreateMessageRequestSchema,
+  ElicitRequestSchema,
+  LoggingMessageNotificationSchema,
+  PromptListChangedNotificationSchema,
+  ResourceListChangedNotificationSchema,
+  ResourceUpdatedNotificationSchema,
+  ToolListChangedNotificationSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import {
+  GuardError,
+  classifyTool,
+  upstreamHeaders
+} from "@agentwares/agentguard-core";
+var ProxyRuntime = class {
+  loaded;
+  guard;
+  agent;
+  defaultRunId;
+  sessions = /* @__PURE__ */ new Set();
+  connections = /* @__PURE__ */ new Map();
+  exposed = [];
+  resourceOwner = /* @__PURE__ */ new Map();
+  templateOwner = /* @__PURE__ */ new Map();
+  promptOwner = /* @__PURE__ */ new Map();
+  log;
+  connectTimeoutMs;
+  testClients;
+  /** stop relaying upstream stderr once we are tearing down — shutdown noise is not the user's problem */
+  closing = false;
+  constructor(opts) {
+    this.loaded = opts.loaded;
+    this.guard = opts.guard;
+    this.agent = opts.agent;
+    this.defaultRunId = opts.defaultRunId;
+    this.log = opts.log ?? ((line) => process.stderr.write(`[agentguard] ${line}
+`));
+    this.connectTimeoutMs = opts.connectTimeoutMs ?? 15e3;
+    this.testClients = opts.clients ?? {};
+  }
+  get policy() {
+    return this.loaded.policy;
+  }
+  async start() {
+    await Promise.all(this.policy.upstreams.map((u) => this.connect(u)));
+    for (const [name, client] of Object.entries(this.testClients)) {
+      if (this.connections.has(name)) continue;
+      const upstream = {
+        name,
+        command: "in-memory",
+        args: [],
+        env: {},
+        headers: {},
+        prefix: false,
+        timeout_ms: 6e4
+      };
+      const conn = {
+        upstream,
+        client,
+        tools: [],
+        capabilities: client.getServerCapabilities(),
+        connected: true
+      };
+      this.connections.set(name, conn);
+      this.wire(conn);
+      await this.refreshTools(name);
+    }
+    this.rebuildExposed();
+    const status = this.upstreamStatus();
+    this.log(
+      `connected ${status.filter((s) => s.connected).length}/${status.length} upstreams, ${this.exposed.length} tools, mode ${this.policy.mode}`
+    );
+  }
+  async connect(upstream) {
+    const client = new Client(
+      { name: "agentguard", version: "0.1.0" },
+      { capabilities: { sampling: {}, elicitation: {} } }
+    );
+    const conn = {
+      upstream,
+      client,
+      tools: [],
+      capabilities: void 0,
+      connected: false
+    };
+    this.connections.set(upstream.name, conn);
+    try {
+      const transport = upstream.url ? new StreamableHTTPClientTransport(new URL(upstream.url), {
+        requestInit: { headers: upstreamHeaders(upstream) }
+      }) : new StdioClientTransport({
+        command: upstream.command,
+        args: upstream.args,
+        env: { ...getDefaultEnvironment(), ...upstream.env },
+        cwd: upstream.cwd,
+        stderr: "pipe"
+      });
+      if (transport instanceof StdioClientTransport) {
+        transport.stderr?.on("data", (chunk) => {
+          if (this.closing) return;
+          for (const line of chunk.toString("utf8").split("\n"))
+            if (line.trim()) this.log(`${upstream.name}: ${line}`);
+        });
+      }
+      await withTimeout(
+        client.connect(transport),
+        this.connectTimeoutMs,
+        `connect to upstream "${upstream.name}"`
+      );
+      conn.capabilities = client.getServerCapabilities();
+      conn.connected = true;
+      this.wire(conn);
+      await this.refreshTools(upstream.name);
+    } catch (err) {
+      conn.connected = false;
+      conn.error = err instanceof Error ? err.message : String(err);
+      this.log(`upstream "${upstream.name}" unavailable: ${conn.error}`);
+    }
+  }
+  wire(conn) {
+    const { client, upstream } = conn;
+    client.onclose = () => {
+      conn.connected = false;
+      conn.error = "connection closed";
+      if (!this.closing) this.log(`upstream "${upstream.name}" closed`);
+    };
+    client.setNotificationHandler(LoggingMessageNotificationSchema, async (n) => {
+      await this.broadcast(upstream.name, n.method, n.params);
+    });
+    client.setNotificationHandler(ResourceUpdatedNotificationSchema, async (n) => {
+      await this.broadcast(upstream.name, n.method, n.params);
+    });
+    client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {
+      this.resourceOwner.clear();
+      await this.broadcast(upstream.name, "notifications/resources/list_changed", void 0);
+    });
+    client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
+      this.promptOwner.clear();
+      await this.broadcast(upstream.name, "notifications/prompts/list_changed", void 0);
+    });
+    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
+      await this.refreshTools(upstream.name);
+      this.rebuildExposed();
+      for (const s of this.sessions) s.server.server.sendToolListChanged().catch(() => void 0);
+    });
+    try {
+      client.setRequestHandler(CreateMessageRequestSchema, async (req) => {
+        const session = this.pickSession(upstream.name);
+        if (!session) throw new Error("no downstream client is connected to relay sampling to");
+        const related = session.inflight.get(upstream.name)?.at(-1);
+        return session.server.server.createMessage(req.params, { relatedRequestId: related });
+      });
+      client.setRequestHandler(ElicitRequestSchema, async (req) => {
+        const session = this.pickSession(upstream.name);
+        if (!session) throw new Error("no downstream client is connected to relay elicitation to");
+        const related = session.inflight.get(upstream.name)?.at(-1);
+        return session.server.server.elicitInput(req.params, { relatedRequestId: related });
+      });
+    } catch {
+    }
+  }
+  pickSession(upstream) {
+    let best;
+    for (const s of this.sessions) {
+      if ((s.inflight.get(upstream)?.length ?? 0) > 0) return s;
+      if (!best || s.lastActive > best.lastActive) best = s;
+    }
+    return best;
+  }
+  async broadcast(upstream, method, params) {
+    for (const s of this.sessions) {
+      const related = s.inflight.get(upstream)?.at(-1);
+      try {
+        await s.server.server.notification(
+          { method, params },
+          related !== void 0 ? { relatedRequestId: related } : void 0
+        );
+      } catch {
+      }
+    }
+  }
+  async refreshTools(name) {
+    const conn = this.connections.get(name);
+    if (!conn?.connected) return;
+    if (conn.capabilities && !conn.capabilities.tools) {
+      conn.tools = [];
+      return;
+    }
+    try {
+      const tools = [];
+      let cursor;
+      do {
+        const page = await conn.client.listTools(cursor ? { cursor } : void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        tools.push(...page.tools);
+        cursor = page.nextCursor;
+      } while (cursor);
+      conn.tools = tools;
+    } catch (err) {
+      this.log(
+        `tools/list failed for "${name}": ${err instanceof Error ? err.message : String(err)}`
+      );
+      conn.tools = [];
+    }
+  }
+  rebuildExposed() {
+    const taken = /* @__PURE__ */ new Set();
+    const out = [];
+    const order = [...this.policy.upstreams.map((u) => u.name), ...Object.keys(this.testClients)];
+    for (const name of order) {
+      const conn = this.connections.get(name);
+      if (!conn) continue;
+      const prefix = conn.upstream.prefix === true ? name : typeof conn.upstream.prefix === "string" ? conn.upstream.prefix : void 0;
+      for (const tool of conn.tools) {
+        let exposedName = prefix ? `${prefix}__${tool.name}` : tool.name;
+        if (taken.has(exposedName)) exposedName = `${name}__${tool.name}`;
+        if (taken.has(exposedName)) {
+          this.log(`skipping duplicate tool ${exposedName} from ${name}`);
+          continue;
+        }
+        taken.add(exposedName);
+        out.push({
+          name: exposedName,
+          upstream: name,
+          original: tool.name,
+          tool,
+          classification: classifyTool(
+            {
+              name: exposedName,
+              description: tool.description,
+              annotations: tool.annotations,
+              inputSchema: tool.inputSchema,
+              outputSchema: tool.outputSchema
+            },
+            this.policy
+          )
+        });
+      }
+    }
+    this.exposed = out;
+  }
+  listTools(agent) {
+    if (agent?.upstreams) return this.exposed.filter((t) => agent.upstreams.includes(t.upstream));
+    return this.exposed;
+  }
+  findTool(name) {
+    return this.exposed.find((t) => t.name === name);
+  }
+  upstreamStatus() {
+    return [...this.connections.values()].map((c) => ({
+      name: c.upstream.name,
+      connected: c.connected,
+      tools: c.tools.length,
+      transport: c.upstream.url ? "http" : "stdio",
+      error: c.error
+    }));
+  }
+  attach(session) {
+    this.sessions.add(session);
+  }
+  detach(session) {
+    this.sessions.delete(session);
+  }
+  /** Run a tool call through the policy engine and, if allowed, the upstream. */
+  async callTool(name, args, ctx) {
+    const tool = this.findTool(name);
+    const agent = ctx.agent === void 0 ? this.agent : ctx.agent;
+    if (!tool) {
+      const result2 = await this.guard.run(
+        { tool: { name }, args, runId: ctx.runId, agent, sessionId: ctx.sessionId },
+        async () => {
+          throw new GuardError({
+            code: "UNKNOWN_TOOL",
+            cause: `no upstream exposes a tool named "${name}"`,
+            fix: "call tools/list and use one of the listed names",
+            retryable: false
+          });
+        }
+      );
+      return { result: result2 };
+    }
+    const conn = this.connections.get(tool.upstream);
+    const track = () => {
+      if (!ctx.session || ctx.requestId === void 0) return () => void 0;
+      const list = ctx.session.inflight.get(tool.upstream) ?? [];
+      list.push(ctx.requestId);
+      ctx.session.inflight.set(tool.upstream, list);
+      return () => {
+        const l = ctx.session.inflight.get(tool.upstream) ?? [];
+        const i = l.indexOf(ctx.requestId);
+        if (i >= 0) l.splice(i, 1);
+      };
+    };
+    const result = await this.guard.run(
+      {
+        tool: {
+          name: tool.name,
+          description: tool.tool.description,
+          annotations: tool.tool.annotations,
+          inputSchema: tool.tool.inputSchema,
+          outputSchema: tool.tool.outputSchema
+        },
+        args,
+        runId: ctx.runId,
+        agent,
+        sessionId: ctx.sessionId,
+        upstream: tool.upstream
+      },
+      async (finalArgs) => {
+        if (!conn?.connected) {
+          throw new GuardError({
+            code: "UPSTREAM_ERROR",
+            cause: `upstream "${tool.upstream}" is not connected${conn?.error ? ` (${conn.error})` : ""}`,
+            fix: "check the upstream command/url in agentguard.yaml and restart the proxy",
+            retryable: true
+          });
+        }
+        const untrack = track();
+        try {
+          return await conn.client.callTool(
+            { name: tool.original, arguments: finalArgs ?? {} },
+            void 0,
+            {
+              timeout: conn.upstream.timeout_ms,
+              resetTimeoutOnProgress: true,
+              onprogress: ctx.onprogress
+            }
+          );
+        } finally {
+          untrack();
+        }
+      }
+    );
+    return { result, tool };
+  }
+  connectedWith(capability) {
+    return [...this.connections.values()].filter(
+      (c) => c.connected && (c.capabilities?.[capability] || c.capabilities === void 0)
+    );
+  }
+  async listResources() {
+    const resources = [];
+    for (const conn of this.connectedWith("resources")) {
+      try {
+        const page = await conn.client.listResources(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const r of page.resources) {
+          this.resourceOwner.set(r.uri, conn.upstream.name);
+          resources.push(r);
+        }
+      } catch {
+      }
+    }
+    return { resources };
+  }
+  async listResourceTemplates() {
+    const resourceTemplates = [];
+    for (const conn of this.connectedWith("resources")) {
+      try {
+        const page = await conn.client.listResourceTemplates(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const t of page.resourceTemplates) {
+          this.templateOwner.set(t.uriTemplate, conn.upstream.name);
+          resourceTemplates.push(t);
+        }
+      } catch {
+      }
+    }
+    return { resourceTemplates };
+  }
+  ownerForUri(uri) {
+    const owner = this.resourceOwner.get(uri);
+    if (owner && this.connections.get(owner)?.connected) return [this.connections.get(owner)];
+    for (const [template, name] of this.templateOwner) {
+      if (templateMatches(template, uri) && this.connections.get(name)?.connected)
+        return [this.connections.get(name)];
+    }
+    return this.connectedWith("resources");
+  }
+  async readResource(uri) {
+    let lastError;
+    for (const conn of this.ownerForUri(uri)) {
+      try {
+        const result = await conn.client.readResource(
+          { uri },
+          { timeout: conn.upstream.timeout_ms }
+        );
+        this.resourceOwner.set(uri, conn.upstream.name);
+        return result;
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error(`no upstream serves resource ${uri}`);
+  }
+  async subscribe(uri, on) {
+    for (const conn of this.ownerForUri(uri)) {
+      try {
+        if (on) await conn.client.subscribeResource({ uri });
+        else await conn.client.unsubscribeResource({ uri });
+        return;
+      } catch {
+      }
+    }
+  }
+  async listPrompts() {
+    const prompts = [];
+    const taken = /* @__PURE__ */ new Set();
+    this.promptOwner.clear();
+    for (const conn of this.connectedWith("prompts")) {
+      try {
+        const page = await conn.client.listPrompts(void 0, {
+          timeout: conn.upstream.timeout_ms
+        });
+        for (const p of page.prompts) {
+          const name = taken.has(p.name) ? `${conn.upstream.name}__${p.name}` : p.name;
+          taken.add(name);
+          this.promptOwner.set(name, { upstream: conn.upstream.name, original: p.name });
+          prompts.push({ ...p, name });
+        }
+      } catch {
+      }
+    }
+    return { prompts };
+  }
+  async getPrompt(name, args) {
+    if (this.promptOwner.size === 0) await this.listPrompts();
+    const owner = this.promptOwner.get(name);
+    const conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("prompts");
+    let lastError;
+    for (const conn of conns) {
+      try {
+        return await conn.client.getPrompt(
+          { name: owner?.original ?? name, arguments: args },
+          { timeout: conn.upstream.timeout_ms }
+        );
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error(`no upstream serves prompt ${name}`);
+  }
+  async complete(params) {
+    let conns;
+    if (params.ref.type === "ref/prompt") {
+      if (this.promptOwner.size === 0) await this.listPrompts();
+      const owner = this.promptOwner.get(params.ref.name);
+      conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("completions");
+      if (owner) params = { ...params, ref: { ...params.ref, name: owner.original } };
+    } else {
+      if (this.templateOwner.size === 0) await this.listResourceTemplates();
+      conns = this.ownerForUri(params.ref.uri);
+    }
+    let lastError;
+    for (const conn of conns) {
+      try {
+        return await conn.client.complete(params, { timeout: conn.upstream.timeout_ms });
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw lastError ?? new Error("no upstream supports completions");
+  }
+  async setLevel(level) {
+    await Promise.all(
+      this.connectedWith("logging").map(
+        (c) => c.client.setLoggingLevel(level).catch(() => void 0)
+      )
+    );
+  }
+  async close() {
+    this.closing = true;
+    for (const conn of this.connections.values()) {
+      try {
+        await conn.client.close();
+      } catch {
+      }
+    }
+    this.connections.clear();
+  }
+};
+function templateMatches(template, uri) {
+  const re = new RegExp(
+    "^" + template.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{[^}]+\\\}/g, "[^/]+") + "$"
+  );
+  return re.test(uri);
+}
+async function withTimeout(promise, ms, what) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+// src/proxy/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  CallToolRequestSchema,
+  CompleteRequestSchema,
+  GetPromptRequestSchema,
+  ListPromptsRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema,
+  SetLevelRequestSchema,
+  SubscribeRequestSchema,
+  UnsubscribeRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import {
+  keyFromHeaders,
+  resolveAgent
+} from "@agentwares/agentguard-core";
+var PROXY_VERSION = "0.1.0";
+function headerValue(extra, name) {
+  const raw = extra.requestInfo?.headers?.[name] ?? extra.requestInfo?.headers?.[name.toLowerCase()];
+  if (Array.isArray(raw)) return raw[0];
+  return typeof raw === "string" ? raw : void 0;
+}
+function headersOf(extra) {
+  const out = {};
+  for (const [k, v] of Object.entries(extra.requestInfo?.headers ?? {}))
+    out[k.toLowerCase()] = Array.isArray(v) ? v[0] : v;
+  return out;
+}
+function runIdFor(extra, meta, fallback) {
+  const header = headerValue(extra, "x-run-id");
+  if (header && header.trim()) return header.trim().slice(0, 128);
+  const fromMeta = meta?.runId ?? meta?.["agentguard/runId"] ?? meta?.run_id;
+  if (typeof fromMeta === "string" && fromMeta.trim()) return fromMeta.trim().slice(0, 128);
+  if (extra.sessionId) return `sess_${extra.sessionId.slice(0, 12)}`;
+  return fallback;
+}
+function toCallToolResult(result, tool) {
+  const meta = {
+    agentguard: {
+      class: result.decision.classification.class,
+      verb: result.decision.classification.verb,
+      mode: result.decision.mode,
+      outcome: result.outcome,
+      dryRun: result.faked,
+      seq: result.entry.seq,
+      run_id: result.entry.run_id
+    }
+  };
+  const hasOutputSchema = Boolean(tool?.tool.outputSchema);
+  if (result.error) {
+    const upstream2 = result.value;
+    if (upstream2 && upstream2.content) {
+      return { ...upstream2, isError: true, _meta: { ...upstream2._meta ?? {}, ...meta } };
+    }
+    const body = result.error;
+    return {
+      isError: true,
+      content: [{ type: "text", text: JSON.stringify(body) }],
+      ...hasOutputSchema ? {} : { structuredContent: body },
+      _meta: { ...meta, httpStatus: httpStatusFor(body.code) }
+    };
+  }
+  if (result.faked) {
+    const value = result.value;
+    const isObject = value !== null && typeof value === "object" && !Array.isArray(value);
+    return {
+      content: [
+        { type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }
+      ],
+      ...isObject ? { structuredContent: value } : {},
+      _meta: meta
+    };
+  }
+  const upstream = result.value;
+  return { ...upstream, _meta: { ...upstream._meta ?? {}, ...meta } };
+}
+function httpStatusFor(code) {
+  switch (code) {
+    case "KILLED":
+    case "TOOL_DENIED":
+    case "APPROVAL_DENIED":
+      return 403;
+    case "APPROVAL_REQUIRED":
+      return 202;
+    case "CAP_EXCEEDED":
+    case "LOOP_DETECTED":
+      return 429;
+    case "UNKNOWN_TOOL":
+      return 404;
+    case "UPSTREAM_ERROR":
+      return 502;
+    default:
+      return 500;
+  }
+}
+function annotateTool(t, mode) {
+  return {
+    ...t.tool,
+    name: t.name,
+    _meta: {
+      ...t.tool._meta ?? {},
+      agentguard: {
+        upstream: t.upstream,
+        class: t.classification.class,
+        verb: t.classification.verb,
+        mode
+      }
+    }
+  };
+}
+function killedError(state) {
+  return Object.assign(
+    new Error(`agentguard kill switch is on (${state.source ?? "?"}: ${state.reason ?? ""})`),
+    { code: -32e3 }
+  );
+}
+function createDownstreamServer(runtime, opts = {}) {
+  const server = new McpServer(
+    { name: "agentguard", version: PROXY_VERSION, title: "agentguard policy proxy" },
+    {
+      capabilities: {
+        tools: { listChanged: true },
+        resources: { subscribe: true, listChanged: true },
+        prompts: { listChanged: true },
+        logging: {},
+        completions: {}
+      },
+      instructions: `Tool calls pass through agentguard (${runtime.policy.mode} mode). Errors carry { code, cause, fix, retryable }; follow "fix". CAP_EXCEEDED, LOOP_DETECTED and KILLED are not retryable: stop and report to the user. APPROVAL_REQUIRED: relay the approval command to the user, then retry the identical call once.`
+    }
+  );
+  const session = {
+    id: crypto.randomUUID(),
+    server,
+    lastActive: Date.now(),
+    inflight: /* @__PURE__ */ new Map()
+  };
+  runtime.attach(session);
+  const previousOnClose = server.server.onclose;
+  server.server.onclose = () => {
+    previousOnClose?.();
+    runtime.detach(session);
+  };
+  const touch = () => {
+    session.lastActive = Date.now();
+  };
+  const agentFor = async (extra) => {
+    const key = keyFromHeaders(headersOf(extra));
+    if (!key) return { agent: void 0 };
+    const resolved = await resolveAgent(runtime.policy, { key });
+    if (resolved.error) {
+      return {
+        agent: null,
+        error: {
+          code: "TOOL_DENIED",
+          cause: "the agent key in Authorization / X-Agentguard-Key is not in agentguard.yaml",
+          fix: "use a key created with `agentguard key create <agent>`, or omit the key to use the global policy",
+          retryable: false
+        }
+      };
+    }
+    return { agent: resolved.agent };
+  };
+  const low = server.server;
+  low.setRequestHandler(ListToolsRequestSchema, async (_req, extra) => {
+    touch();
+    const { agent } = await agentFor(extra);
+    const scope = agent === void 0 ? runtime.agent : agent;
+    return {
+      tools: runtime.listTools(scope).map((t) => annotateTool(t, scope?.mode ?? runtime.policy.mode))
+    };
+  });
+  low.setRequestHandler(CallToolRequestSchema, async (req, extra) => {
+    touch();
+    const { agent, error } = await agentFor(extra);
+    const runId = runIdFor(extra, req.params._meta, opts.defaultRunId ?? runtime.defaultRunId);
+    if (error) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: JSON.stringify(error) }],
+        structuredContent: error,
+        _meta: { httpStatus: 401 }
+      };
+    }
+    const progressToken = req.params._meta?.progressToken;
+    const { result, tool } = await runtime.callTool(req.params.name, req.params.arguments ?? {}, {
+      runId,
+      agent,
+      sessionId: extra.sessionId ?? session.id,
+      session,
+      requestId: extra.requestId,
+      onprogress: progressToken === void 0 ? void 0 : (p) => {
+        void extra.sendNotification({
+          method: "notifications/progress",
+          params: { progressToken, ...p }
+        });
+      }
+    });
+    return toCallToolResult(result, tool);
+  });
+  const guardRead = async () => {
+    const state = await runtime.guard.killState();
+    if (state.killed) throw killedError(state);
+  };
+  low.setRequestHandler(ListResourcesRequestSchema, async () => {
+    touch();
+    return runtime.listResources();
+  });
+  low.setRequestHandler(ListResourceTemplatesRequestSchema, async () => {
+    touch();
+    return runtime.listResourceTemplates();
+  });
+  low.setRequestHandler(ReadResourceRequestSchema, async (req) => {
+    touch();
+    await guardRead();
+    return runtime.readResource(req.params.uri);
+  });
+  low.setRequestHandler(SubscribeRequestSchema, async (req) => {
+    await runtime.subscribe(req.params.uri, true);
+    return {};
+  });
+  low.setRequestHandler(UnsubscribeRequestSchema, async (req) => {
+    await runtime.subscribe(req.params.uri, false);
+    return {};
+  });
+  low.setRequestHandler(ListPromptsRequestSchema, async () => {
+    touch();
+    return runtime.listPrompts();
+  });
+  low.setRequestHandler(GetPromptRequestSchema, async (req) => {
+    touch();
+    await guardRead();
+    return runtime.getPrompt(req.params.name, req.params.arguments);
+  });
+  low.setRequestHandler(CompleteRequestSchema, async (req) => {
+    touch();
+    return runtime.complete(req.params);
+  });
+  low.setRequestHandler(SetLevelRequestSchema, async (req) => {
+    await runtime.setLevel(req.params.level);
+    return {};
+  });
+  return server;
+}
+
+// ../../packages/mcp-kit/dist/chunk-AO7AV7MI.js
+import { completable } from "@modelcontextprotocol/sdk/server/completable.js";
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  CreateMessageResultSchema,
+  ElicitResultSchema,
+  SubscribeRequestSchema as SubscribeRequestSchema2,
+  UnsubscribeRequestSchema as UnsubscribeRequestSchema2
+} from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
+
+// ../../packages/x402/dist/index.js
+var X402_HEADER = "X-Payment-Requirements";
+var X402_REQUIRED_HEADER = "PAYMENT-REQUIRED";
+function toAmount(priceUsd) {
+  if (!Number.isFinite(priceUsd) || priceUsd < 0)
+    throw new Error("priceUsd must be a non-negative number");
+  return priceUsd.toFixed(6).replace(/0+$/, "").replace(/\.$/, ".0");
+}
+function buildPaymentRequired(opts) {
+  const amountUsd = toAmount(opts.priceUsd);
+  const accepts = [
+    {
+      rail: "x402",
+      amountUsd,
+      resource: opts.resource,
+      description: opts.description,
+      network: "eip155:8453",
+      asset: "USDC",
+      payTo: opts.payTo,
+      maxTimeoutSeconds: 300
+    },
+    {
+      rail: "mpp",
+      amountUsd,
+      resource: opts.resource,
+      description: opts.description,
+      currency: "usd",
+      payTo: opts.payTo,
+      maxTimeoutSeconds: 300
+    }
+  ];
+  const live = opts.live === true;
+  const body = {
+    code: "PAYMENT_REQUIRED",
+    cause: live ? `This call costs $${amountUsd}. No valid payment or credit was presented.` : `This call costs $${amountUsd}. Pay-per-call (x402 / Stripe MPP) is coming soon; use an API key with prepaid credits.`,
+    fix: live ? "Retry with a PAYMENT header satisfying one of `accepts`, or send an API key with credit balance." : `Create an API key${opts.signupUrl ? ` at ${opts.signupUrl}` : ""} and retry with Authorization: Bearer <key>. Try the free sample mode first.`,
+    retryable: true,
+    priceUsd: opts.priceUsd,
+    accepts,
+    comingSoon: !live,
+    alternatives: ["api_key_credits", "sample_mode"]
+  };
+  const encoded = JSON.stringify({ x402Version: 2, accepts, resource: opts.resource });
+  const headers = {
+    "Content-Type": "application/json",
+    "WWW-Authenticate": `Payment realm="agentwares", methods="x402 mpp", price="${amountUsd} USD"`,
+    [X402_HEADER]: encoded,
+    [X402_REQUIRED_HEADER]: btoa(encoded),
+    "Cache-Control": "no-store"
+  };
+  return { status: 402, headers, body };
+}
+var StubVerifier = class {
+  async verify(request, requirement) {
+    const hasHeader = request.headers.has("PAYMENT") || request.headers.has("X-PAYMENT");
+    return {
+      ok: false,
+      rail: requirement.rail,
+      reason: hasHeader ? "payments are not live yet (phase 2: wallet). Use an API key with credits." : "no payment header present"
+    };
+  }
+};
+
+// ../../packages/mcp-kit/dist/chunk-AO7AV7MI.js
+import { z as z2 } from "zod";
+import { z as z3 } from "zod";
+import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  CallToolRequestSchema as CallToolRequestSchema2,
+  ErrorCode,
+  ListToolsRequestSchema as ListToolsRequestSchema2,
+  McpError
+} from "@modelcontextprotocol/sdk/types.js";
+import { z as z4 } from "zod";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+var ERROR_CODES = [
+  "INVALID_INPUT",
+  "NOT_FOUND",
+  "UNAUTHORIZED",
+  "PAYMENT_REQUIRED",
+  "RATE_LIMITED",
+  "UPSTREAM_ERROR",
+  "INTERNAL"
+];
+var DEFAULT_RETRYABLE = {
+  INVALID_INPUT: false,
+  NOT_FOUND: false,
+  UNAUTHORIZED: false,
+  PAYMENT_REQUIRED: true,
+  RATE_LIMITED: true,
+  UPSTREAM_ERROR: true,
+  INTERNAL: false
+};
+var DEFAULT_HTTP_STATUS = {
+  INVALID_INPUT: 400,
+  NOT_FOUND: 404,
+  UNAUTHORIZED: 401,
+  PAYMENT_REQUIRED: 402,
+  RATE_LIMITED: 429,
+  UPSTREAM_ERROR: 502,
+  INTERNAL: 500
+};
+var INTERNAL_FIX = "retry; if it persists, report the request id";
+function isStandardCode(code) {
+  return ERROR_CODES.includes(code);
+}
+var McpToolError = class extends Error {
+  code;
+  cause;
+  fix;
+  retryable;
+  details;
+  httpStatus;
+  extra;
+  constructor(init) {
+    super(`${init.code}: ${init.cause}`);
+    this.name = "McpToolError";
+    this.code = init.code;
+    this.cause = init.cause;
+    this.fix = init.fix;
+    this.retryable = init.retryable ?? (isStandardCode(init.code) ? DEFAULT_RETRYABLE[init.code] : false);
+    this.details = init.details;
+    this.httpStatus = init.httpStatus ?? (isStandardCode(init.code) ? DEFAULT_HTTP_STATUS[init.code] : 500);
+    this.extra = init.extra;
+  }
+  /** The body agents see: `{ code, cause, fix, retryable, details?, ...extra }`. */
+  toJSON() {
+    const body = {
+      ...this.extra,
+      code: this.code,
+      cause: this.cause,
+      fix: this.fix,
+      retryable: this.retryable
+    };
+    if (this.details !== void 0) body.details = this.details;
+    return body;
+  }
+};
+function toolError(codeOrInit, cause, fix, extra) {
+  if (typeof codeOrInit === "object") return new McpToolError(codeOrInit);
+  return new McpToolError({ code: codeOrInit, cause: cause ?? "", fix: fix ?? "", ...extra });
+}
+function describeUnknown(err) {
+  if (err instanceof Error) return err.message || err.name;
+  if (typeof err === "string") return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+function normalizeError(err) {
+  if (err instanceof McpToolError) return err;
+  return new McpToolError({
+    code: "INTERNAL",
+    cause: describeUnknown(err),
+    fix: INTERNAL_FIX,
+    retryable: false
+  });
+}
+function errorResult(err, opts = {}) {
+  const error = normalizeError(err);
+  const body = error.toJSON();
+  const meta = { httpStatus: error.httpStatus };
+  if (opts.requestId !== void 0) meta.requestId = opts.requestId;
+  Object.assign(meta, opts.meta);
+  return {
+    isError: true,
+    content: [{ type: "text", text: JSON.stringify(body) }],
+    structuredContent: body,
+    _meta: meta
+  };
+}
+var TOOL_NAME_PATTERN = /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/;
+var MIN_NAMESPACE_LENGTH = 3;
+var MIN_DESCRIPTION_LENGTH = 20;
+function isValidToolName(name) {
+  if (!TOOL_NAME_PATTERN.test(name)) return false;
+  const namespace = name.split("_")[0] ?? "";
+  return namespace.length >= MIN_NAMESPACE_LENGTH;
+}
+function assertToolName(name) {
+  if (!isValidToolName(name)) {
+    throw new Error(
+      `tool name must be namespaced: <namespace>_<verb>_<object>, got ${JSON.stringify(name)}`
+    );
+  }
+}
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function isCallToolResult(value) {
+  if (!isPlainObject(value) || !Array.isArray(value.content)) return false;
+  return value.content.every(
+    (block) => isPlainObject(block) && typeof block.type === "string"
+  );
+}
+function toCallToolResult2(value) {
+  if (isCallToolResult(value)) return value;
+  const text = typeof value === "string" ? value : JSON.stringify(value ?? null, null, 2);
+  const result = { content: [{ type: "text", text }] };
+  if (isPlainObject(value)) result.structuredContent = value;
+  return result;
+}
+function issuePath(issue) {
+  return issue.path.map(String).join(".") || "(root)";
+}
+function invalidInputError(issues) {
+  const fields = [...new Set(issues.map(issuePath))];
+  const summary = issues.map((issue) => `${issuePath(issue)}: ${issue.message}`).join("; ");
+  return toolError({
+    code: "INVALID_INPUT",
+    cause: `invalid input for ${fields.join(", ")} \u2014 ${summary}`,
+    fix: `fix ${fields.join(", ")} to match the tool's inputSchema (see details.issues), then retry`,
+    retryable: false,
+    details: {
+      fields,
+      issues: issues.map((issue) => ({
+        path: issue.path.map(String),
+        code: issue.code,
+        message: issue.message
+      }))
+    }
+  });
+}
+function defineTool(opts) {
+  assertToolName(opts.name);
+  if (typeof opts.description !== "string" || opts.description.trim().length < MIN_DESCRIPTION_LENGTH) {
+    throw new Error(
+      `tool ${opts.name}: description must be at least ${MIN_DESCRIPTION_LENGTH} characters \u2014 say what it does, when to use it and what it returns`
+    );
+  }
+  const { name, title, description, input, output, annotations } = opts;
+  const handler = opts.handler.bind(opts);
+  const tool = {
+    name,
+    title,
+    description,
+    input,
+    output,
+    annotations,
+    handler,
+    async invoke(rawInput, ctx) {
+      const fail = (err) => {
+        const result = errorResult(err, { requestId: ctx.requestId });
+        if (output) delete result.structuredContent;
+        return result;
+      };
+      const parsed = input.safeParse(rawInput ?? {});
+      if (!parsed.success) return fail(invalidInputError(parsed.error.issues));
+      try {
+        const value = await handler(parsed.data, ctx);
+        if (output && !isCallToolResult(value)) {
+          const checked = output.safeParse(value);
+          if (!checked.success) {
+            throw toolError({
+              code: "INTERNAL",
+              cause: `tool ${name} returned a value that does not match its output schema \u2014 ${checked.error.issues.map((issue) => `${issuePath(issue)}: ${issue.message}`).join("; ")}`,
+              fix: "this is a bug in the tool, not in your call; report it with the request id",
+              retryable: false,
+              details: { issues: checked.error.issues }
+            });
+          }
+          return toCallToolResult2(checked.data);
+        }
+        return toCallToolResult2(value);
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  };
+  return tool;
+}
+var PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==";
+var WAV_BASE64 = "UklGRiQAAABXQVZFZm10IBAAAAABAAEARKwAAIhYAQACABAAZGF0YQAAAAA=";
+var STATIC_TEXT_URI = "test://static-text";
+var STATIC_TEXT = "This is a static text resource for testing.";
+var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+function embeddedResource() {
+  return {
+    type: "resource",
+    resource: { uri: STATIC_TEXT_URI, mimeType: "text/plain", text: STATIC_TEXT }
+  };
+}
+function requireExtra(ctx) {
+  if (!ctx.extra) {
+    throw toolError("INTERNAL", "no client connection in this context", "call this tool over MCP");
+  }
+  return ctx.extra;
+}
+async function elicit(ctx, message, requestedSchema) {
+  const result = await requireExtra(ctx).sendRequest(
+    { method: "elicitation/create", params: { message, requestedSchema } },
+    ElicitResultSchema
+  );
+  return `Elicitation completed: action=${result.action}, content=${JSON.stringify(result.content ?? {})}`;
+}
+var conformanceTools = [
+  defineTool({
+    name: "test_simple_text",
+    description: "Conformance fixture: returns a fixed simple text response.",
+    input: z.object({}),
+    handler: () => "This is a simple text response for testing."
+  }),
+  defineTool({
+    name: "test_error_handling",
+    description: "Conformance fixture: always returns an error result (isError: true).",
+    input: z.object({}),
+    handler: () => {
+      throw toolError({
+        code: "UPSTREAM_ERROR",
+        cause: "This tool intentionally returns an error for testing",
+        fix: "nothing to fix; this fixture always fails",
+        retryable: false
+      });
+    }
+  }),
+  defineTool({
+    name: "test_image_content",
+    description: "Conformance fixture: returns a 1x1 PNG image content block.",
+    input: z.object({}),
+    handler: () => ({ content: [{ type: "image", data: PNG_BASE64, mimeType: "image/png" }] })
+  }),
+  defineTool({
+    name: "test_audio_content",
+    description: "Conformance fixture: returns an empty WAV audio content block.",
+    input: z.object({}),
+    handler: () => ({ content: [{ type: "audio", data: WAV_BASE64, mimeType: "audio/wav" }] })
+  }),
+  defineTool({
+    name: "test_embedded_resource",
+    description: "Conformance fixture: returns an embedded text resource content block.",
+    input: z.object({}),
+    handler: () => ({ content: [embeddedResource()] })
+  }),
+  defineTool({
+    name: "test_multiple_content_types",
+    description: "Conformance fixture: returns text, image and resource content blocks together.",
+    input: z.object({}),
+    handler: () => ({
+      content: [
+        { type: "text", text: "Mixed content response" },
+        { type: "image", data: PNG_BASE64, mimeType: "image/png" },
+        embeddedResource()
+      ]
+    })
+  }),
+  defineTool({
+    name: "test_tool_with_logging",
+    description: "Conformance fixture: emits three info log notifications while running.",
+    input: z.object({}),
+    handler: async (_input, ctx) => {
+      await ctx.log?.("info", "Tool execution started");
+      await sleep(50);
+      await ctx.log?.("info", "Tool processing data");
+      await sleep(50);
+      await ctx.log?.("info", "Tool execution completed");
+      return "Tool execution completed with logging";
+    }
+  }),
+  defineTool({
+    name: "test_tool_with_progress",
+    description: "Conformance fixture: reports progress 0/100, 50/100, 100/100 while running.",
+    input: z.object({}),
+    handler: async (_input, ctx) => {
+      await ctx.progress?.(0, 100, "starting");
+      await sleep(50);
+      await ctx.progress?.(50, 100, "halfway");
+      await sleep(50);
+      await ctx.progress?.(100, 100, "done");
+      return "Tool execution completed with progress";
+    }
+  }),
+  defineTool({
+    name: "test_sampling",
+    description: "Conformance fixture: asks the client to sample a completion and returns it.",
+    input: z.object({ prompt: z.string().describe("Prompt to send to the client's model") }),
+    handler: async ({ prompt }, ctx) => {
+      const result = await requireExtra(ctx).sendRequest(
+        {
+          method: "sampling/createMessage",
+          params: {
+            messages: [{ role: "user", content: { type: "text", text: prompt } }],
+            maxTokens: 100
+          }
+        },
+        CreateMessageResultSchema
+      );
+      const content = Array.isArray(result.content) ? result.content[0] : result.content;
+      const text = content && content.type === "text" ? content.text : JSON.stringify(content);
+      return `Sampling completed (${result.model}): ${text}`;
+    }
+  }),
+  defineTool({
+    name: "test_elicitation",
+    description: "Conformance fixture: asks the client for user input and reports the outcome.",
+    input: z.object({ message: z.string().describe("Message shown to the user") }),
+    handler: ({ message }, ctx) => elicit(ctx, message, {
+      type: "object",
+      properties: {
+        name: { type: "string", title: "Name", description: "Your name" },
+        email: { type: "string", title: "Email", format: "email" }
+      },
+      required: ["name"]
+    })
+  }),
+  defineTool({
+    name: "test_elicitation_sep1034_defaults",
+    description: "Conformance fixture: elicitation schema with defaults for every primitive type.",
+    input: z.object({}),
+    handler: (_input, ctx) => elicit(ctx, "Please confirm your details", {
+      type: "object",
+      properties: {
+        name: { type: "string", title: "Name", default: "John Doe" },
+        age: { type: "integer", title: "Age", default: 30 },
+        score: { type: "number", title: "Score", default: 95.5 },
+        status: {
+          type: "string",
+          title: "Status",
+          enum: ["active", "inactive", "pending"],
+          default: "active"
+        },
+        verified: { type: "boolean", title: "Verified", default: true }
+      }
+    })
+  }),
+  defineTool({
+    name: "test_elicitation_sep1330_enums",
+    description: "Conformance fixture: elicitation schema with titled, untitled and multi-select enums.",
+    input: z.object({}),
+    handler: (_input, ctx) => elicit(ctx, "Pick some options", {
+      type: "object",
+      properties: {
+        untitledSingle: {
+          type: "string",
+          title: "Untitled single",
+          enum: ["red", "green", "blue"]
+        },
+        titledSingle: {
+          type: "string",
+          title: "Titled single",
+          oneOf: [
+            { const: "red", title: "Red" },
+            { const: "green", title: "Green" },
+            { const: "blue", title: "Blue" }
+          ]
+        },
+        legacyEnum: {
+          type: "string",
+          title: "Legacy titled",
+          enum: ["red", "green", "blue"],
+          enumNames: ["Red", "Green", "Blue"]
+        },
+        untitledMulti: {
+          type: "array",
+          title: "Untitled multi",
+          items: { type: "string", enum: ["red", "green", "blue"] }
+        },
+        titledMulti: {
+          type: "array",
+          title: "Titled multi",
+          items: {
+            anyOf: [
+              { const: "red", title: "Red" },
+              { const: "green", title: "Green" },
+              { const: "blue", title: "Blue" }
+            ]
+          }
+        }
+      }
+    })
+  }),
+  defineTool({
+    name: "json_schema_2020_12_tool",
+    description: "Conformance fixture: input schema with a $defs reference to an address object.",
+    input: z.object({
+      name: z.string(),
+      address: z.object({ street: z.string(), city: z.string() }).meta({ id: "address" })
+    }),
+    handler: (input) => input
+  })
+];
+function paymentRequiredError(body, reason) {
+  const { code, cause, fix, retryable, ...rest } = body;
+  return toolError({
+    code,
+    cause,
+    fix,
+    retryable,
+    httpStatus: 402,
+    details: reason !== void 0 ? { reason } : void 0,
+    extra: rest
+  });
+}
+function formatUsd(priceUsd) {
+  return priceUsd.toFixed(6).replace(/0+$/, "").replace(/\.$/, ".00").replace(/\.(\d)$/, ".$10");
+}
+function withPayment(tool, opts) {
+  if (!Number.isFinite(opts.priceUsd) || opts.priceUsd < 0) {
+    throw new Error(`withPayment(${tool.name}): priceUsd must be a non-negative number`);
+  }
+  const sampleField = opts.sampleField ?? "sample";
+  if (sampleField in tool.input.shape) {
+    throw new Error(
+      `withPayment(${tool.name}): input already has a field named ${JSON.stringify(sampleField)}; pass sampleField to rename it`
+    );
+  }
+  const verifier = opts.verifier ?? new StubVerifier();
+  const input = tool.input.extend({
+    [sampleField]: z2.boolean().default(false).describe(
+      "Set true to return an example response at no charge (sample mode). Default false."
+    )
+  });
+  const description = `${tool.description.trim()} Paid: $${formatUsd(opts.priceUsd)} per call; without credit you get a PAYMENT_REQUIRED result. Set ${sampleField}=true for a free example response.`;
+  return defineTool({
+    name: tool.name,
+    title: tool.title,
+    description,
+    input,
+    output: tool.output,
+    annotations: tool.annotations,
+    async handler(raw, ctx) {
+      const record = { ...raw };
+      const sample = record[sampleField] === true;
+      delete record[sampleField];
+      if (sample) return tool.handler(record, { ...ctx, sample: true });
+      let reason;
+      if (opts.authorize) {
+        const auth = await opts.authorize(ctx);
+        if (auth.ok) return tool.handler(record, { ...ctx, userId: auth.userId });
+        reason = auth.reason;
+      }
+      const required = buildPaymentRequired({
+        resource: tool.name,
+        priceUsd: opts.priceUsd,
+        live: opts.live,
+        description: opts.description,
+        payTo: opts.payTo,
+        signupUrl: opts.signupUrl
+      });
+      const requirement = required.body.accepts[0];
+      if (requirement) {
+        const verified = await verifier.verify(
+          new Request(`https://mcp.local/${tool.name}`, { headers: ctx.headers }),
+          requirement
+        );
+        if (verified.ok) return tool.handler(record, ctx);
+        reason = reason ?? verified.reason;
+      }
+      throw paymentRequiredError(required.body, reason);
+    }
+  });
+}
+var exampleEcho = defineTool({
+  name: "example_echo",
+  title: "Echo",
+  description: "Echo a message back unchanged. Use it to check the connection and to see the result shape mcp-kit tools return (JSON text plus structuredContent).",
+  input: z3.object({ message: z3.string().describe("Text to echo back") }),
+  output: z3.object({ message: z3.string() }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
+  handler: ({ message }) => ({ message })
+});
+var exampleAdd = defineTool({
+  name: "example_add",
+  title: "Add",
+  description: "Add two numbers and return their sum as { sum }. Demonstrates typed input and output schemas; send non-numbers to see an INVALID_INPUT error result.",
+  input: z3.object({
+    a: z3.number().describe("First addend"),
+    b: z3.number().describe("Second addend")
+  }),
+  output: z3.object({ sum: z3.number() }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
+  handler: ({ a, b }) => ({ sum: a + b })
+});
+var examplePaidLookup = withPayment(
+  defineTool({
+    name: "example_paid_lookup",
+    title: "Paid lookup",
+    description: "Look up a record by query and return { query, result, sample } (fake data). Demonstrates a paid tool: without an entitlement the call returns a PAYMENT_REQUIRED result with x402 and MPP payment options.",
+    input: z3.object({ query: z3.string().min(1).describe("What to look up") }),
+    output: z3.object({ query: z3.string(), result: z3.string(), sample: z3.boolean() }),
+    annotations: { readOnlyHint: true, idempotentHint: true },
+    handler: ({ query }, ctx) => ({
+      query,
+      result: ctx.sample ? `SAMPLE: example record for "${query}"` : `record for "${query}"`,
+      sample: ctx.sample === true
+    })
+  }),
+  { priceUsd: 0.05, description: "One record lookup" }
+);
+function isZodObject(schema) {
+  return schema instanceof z4.ZodObject;
+}
+function contextFromExtra(extra) {
+  const headers = new Headers();
+  const raw = extra.requestInfo?.headers;
+  if (raw) {
+    for (const [key, value] of Object.entries(raw)) {
+      if (Array.isArray(value)) for (const item of value) headers.append(key, item);
+      else if (typeof value === "string") headers.append(key, value);
+    }
+  }
+  const progressToken = extra._meta?.progressToken;
+  return {
+    headers,
+    requestId: String(extra.requestId),
+    signal: extra.signal,
+    sessionId: extra.sessionId,
+    meta: extra._meta,
+    extra,
+    log: async (level, data) => {
+      await extra.sendNotification({ method: "notifications/message", params: { level, data } });
+    },
+    progress: async (progress, total, message) => {
+      if (progressToken === void 0) return;
+      await extra.sendNotification({
+        method: "notifications/progress",
+        params: { progressToken, progress, total, message }
+      });
+    }
+  };
+}
+function createMcpServer(opts) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const tool of opts.tools) {
+    if (byName.has(tool.name)) throw new Error(`duplicate tool name: ${tool.name}`);
+    byName.set(tool.name, tool);
+  }
+  const server = new McpServer2(
+    { name: opts.name, version: opts.version, title: opts.title, websiteUrl: opts.websiteUrl },
+    { instructions: opts.instructions, capabilities: { logging: {}, ...opts.capabilities } }
+  );
+  const registered = /* @__PURE__ */ new Map();
+  for (const tool of byName.values()) {
+    const config = {
+      title: tool.title,
+      description: tool.description,
+      inputSchema: tool.input,
+      annotations: tool.annotations
+    };
+    if (isZodObject(tool.output)) config.outputSchema = tool.output;
+    registered.set(
+      tool.name,
+      server.registerTool(tool.name, config, () => {
+        throw new Error("unreachable: mcp-kit dispatches tools/call itself");
+      })
+    );
+  }
+  if (byName.size > 0) {
+    server.server.setRequestHandler(ListToolsRequestSchema2, async () => {
+      const enabled = [...byName.values()].filter(
+        (tool) => registered.get(tool.name)?.enabled !== false
+      );
+      return {
+        tools: listToolManifest(enabled).map((entry) => ({
+          ...entry,
+          inputSchema: entry.inputSchema,
+          outputSchema: entry.outputSchema
+        }))
+      };
+    });
+    server.server.setRequestHandler(CallToolRequestSchema2, async (request, extra) => {
+      const name = request.params.name;
+      const tool = byName.get(name);
+      const entry = registered.get(name);
+      if (!tool || !entry) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} not found`);
+      if (!entry.enabled) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} disabled`);
+      return tool.invoke(request.params.arguments ?? {}, contextFromExtra(extra));
+    });
+  }
+  return server;
+}
+function toJsonSchema(schema, io = "input") {
+  const json2 = z4.toJSONSchema(schema, { io, target: "draft-2020-12" });
+  if (isZodObject(schema) && schema._zod.def.catchall === void 0 && json2.additionalProperties === void 0) {
+    json2.additionalProperties = false;
+  }
+  return json2;
+}
+function listToolManifest(tools) {
+  return tools.map((tool) => {
+    const entry = {
+      name: tool.name,
+      description: tool.description,
+      inputSchema: toJsonSchema(tool.input, "input")
+    };
+    if (tool.title !== void 0) entry.title = tool.title;
+    if (isZodObject(tool.output)) entry.outputSchema = toJsonSchema(tool.output, "output");
+    if (tool.annotations !== void 0) entry.annotations = tool.annotations;
+    return entry;
+  });
+}
+var DEFAULT_CORS = {
+  origin: "*",
+  methods: "GET, POST, DELETE, OPTIONS",
+  headers: "Content-Type, Accept, Authorization, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, PAYMENT, X-PAYMENT",
+  exposeHeaders: "Mcp-Session-Id, Mcp-Protocol-Version, WWW-Authenticate, X-Payment-Requirements, PAYMENT-REQUIRED",
+  maxAge: 86400
+};
+var DEFAULT_SESSION_TTL_MS = 30 * 6e4;
+function corsHeaders(cors) {
+  if (!cors) return {};
+  const c = { ...DEFAULT_CORS, ...typeof cors === "object" ? cors : {} };
+  return {
+    "Access-Control-Allow-Origin": c.origin,
+    "Access-Control-Allow-Methods": c.methods,
+    "Access-Control-Allow-Headers": c.headers,
+    "Access-Control-Expose-Headers": c.exposeHeaders,
+    "Access-Control-Max-Age": String(c.maxAge)
+  };
+}
+function jsonResponse(body, status, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers }
+  });
+}
+function methodNotAllowed(method, allow, cors) {
+  return jsonResponse(
+    {
+      code: "METHOD_NOT_ALLOWED",
+      cause: `${method} is not supported here without a session`,
+      fix: "send JSON-RPC over POST with `Accept: application/json, text/event-stream` (start with `initialize`)",
+      retryable: false
+    },
+    405,
+    { Allow: allow, ...cors }
+  );
+}
+function splitOptions(opts, transport) {
+  if (typeof opts === "function") return { factory: opts, transport };
+  const {
+    cors,
+    jsonResponse: jsonResponse2,
+    sessions,
+    allowedHosts,
+    allowedOrigins,
+    enableDnsRebindingProtection,
+    ...server
+  } = opts;
+  return {
+    factory: () => createMcpServer(server),
+    transport: {
+      cors,
+      jsonResponse: jsonResponse2,
+      sessions,
+      allowedHosts,
+      allowedOrigins,
+      enableDnsRebindingProtection,
+      ...transport
+    }
+  };
+}
+function withCors(response, cors) {
+  const keys = Object.keys(cors);
+  if (keys.length === 0) return response;
+  const headers = new Headers(response.headers);
+  for (const key of keys) headers.set(key, cors[key] ?? "");
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function errorResponse(err, cors) {
+  const error = normalizeError(err);
+  return jsonResponse(error.toJSON(), error.httpStatus, cors);
+}
+function createStatelessHandler({ factory, cors, transportBase }) {
+  return async (request) => {
+    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
+    const server = factory();
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      ...transportBase,
+      sessionIdGenerator: void 0
+    });
+    let closed = false;
+    const cleanup = async () => {
+      if (closed) return;
+      closed = true;
+      try {
+        await server.close();
+      } catch {
+      }
+    };
+    try {
+      await server.connect(transport);
+      const response = withCors(await transport.handleRequest(request), cors);
+      if (!response.body) {
+        await cleanup();
+        return response;
+      }
+      request.signal?.addEventListener("abort", () => void cleanup(), { once: true });
+      const body = response.body.pipeThrough(
+        new TransformStream({ flush: () => cleanup() })
+      );
+      return new Response(body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch (err) {
+      await cleanup();
+      return errorResponse(err, cors);
+    }
+  };
+}
+function createStatefulHandler({ factory, cors, transportBase }, options) {
+  const ttlMs = options.ttlMs ?? DEFAULT_SESSION_TTL_MS;
+  const sessions = /* @__PURE__ */ new Map();
+  const drop = (id) => {
+    const session = sessions.get(id);
+    if (!session) return;
+    sessions.delete(id);
+    session.server.close().catch(() => void 0);
+  };
+  const sweep = () => {
+    const now = Date.now();
+    for (const [id, session] of sessions) if (now - session.lastSeen > ttlMs) drop(id);
+  };
+  return async (request) => {
+    const sessionId = request.headers.get("mcp-session-id");
+    if (sessionId) {
+      const session = sessions.get(sessionId);
+      if (!session) {
+        return jsonResponse(
+          {
+            code: "NOT_FOUND",
+            cause: "unknown or expired Mcp-Session-Id",
+            fix: "send `initialize` again without an Mcp-Session-Id header and use the id from the response",
+            retryable: true
+          },
+          404,
+          cors
+        );
+      }
+      session.lastSeen = Date.now();
+      try {
+        return withCors(await session.transport.handleRequest(request), cors);
+      } catch (err) {
+        return errorResponse(err, cors);
+      }
+    }
+    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
+    sweep();
+    const server = factory();
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      ...transportBase,
+      sessionIdGenerator: () => crypto.randomUUID(),
+      onsessioninitialized: (id) => {
+        sessions.set(id, { server, transport, lastSeen: Date.now() });
+      },
+      onsessionclosed: (id) => {
+        sessions.delete(id);
+      }
+    });
+    try {
+      await server.connect(transport);
+      const previousOnClose = transport.onclose;
+      transport.onclose = () => {
+        previousOnClose?.();
+        if (transport.sessionId) sessions.delete(transport.sessionId);
+      };
+      const response = withCors(await transport.handleRequest(request), cors);
+      if (!transport.sessionId) server.close().catch(() => void 0);
+      return response;
+    } catch (err) {
+      server.close().catch(() => void 0);
+      return errorResponse(err, cors);
+    }
+  };
+}
+function createHttpHandler(opts, transportOptions = {}) {
+  const { factory, transport: t } = splitOptions(opts, transportOptions);
+  const cors = corsHeaders(t.cors);
+  const sessions = t.sessions ? typeof t.sessions === "object" ? t.sessions : {} : void 0;
+  const context = {
+    factory,
+    cors,
+    transportBase: {
+      enableJsonResponse: t.jsonResponse ?? sessions === void 0,
+      allowedHosts: t.allowedHosts,
+      allowedOrigins: t.allowedOrigins,
+      enableDnsRebindingProtection: t.enableDnsRebindingProtection
+    }
+  };
+  const handler = sessions ? createStatefulHandler(context, sessions) : createStatelessHandler(context);
+  const allow = sessions ? "GET, POST, DELETE, OPTIONS" : "POST, OPTIONS";
+  return async (request) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: { Allow: allow, ...cors } });
+    }
+    return handler(request);
+  };
+}
+function localhostHosts(port) {
+  const hosts = ["localhost", "127.0.0.1", "[::1]"];
+  return [...hosts, ...hosts.map((h) => `${h}:${port}`)];
+}
+function handleHealth(info) {
+  const tools = typeof info.tools === "number" ? info.tools : info.tools.length;
+  return jsonResponse({ ok: true, name: info.name, version: info.version, tools }, 200);
+}
+async function serveNodeHttp(opts) {
+  const http = await import("http");
+  const host = opts.host ?? "127.0.0.1";
+  const path2 = opts.path ?? "/mcp";
+  const server = http.createServer((req, res) => {
+    void (async () => {
+      const url = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+      let response;
+      if (url.pathname === path2) {
+        const controller = new AbortController();
+        res.on("close", () => {
+          if (!res.writableFinished) controller.abort();
+        });
+        const headers = new Headers();
+        for (const [key, value] of Object.entries(req.headers)) {
+          if (Array.isArray(value)) for (const item of value) headers.append(key, item);
+          else if (typeof value === "string") headers.set(key, value);
+        }
+        const method = req.method ?? "GET";
+        let body;
+        if (method !== "GET" && method !== "HEAD") {
+          const chunks = [];
+          for await (const chunk of req) chunks.push(chunk);
+          body = new Uint8Array(Buffer.concat(chunks));
+        }
+        response = await opts.handler(
+          new Request(url, { method, headers, body, signal: controller.signal })
+        );
+      } else if (url.pathname === "/health" && opts.health) {
+        response = opts.health();
+      } else {
+        response = new Response(
+          JSON.stringify({
+            code: "NOT_FOUND",
+            cause: `no route for ${url.pathname}`,
+            fix: `POST JSON-RPC to ${path2}`,
+            retryable: false
+          }),
+          { status: 404, headers: { "Content-Type": "application/json" } }
+        );
+      }
+      const outHeaders = {};
+      response.headers.forEach((value, key) => {
+        outHeaders[key] = value;
+      });
+      res.writeHead(response.status, outHeaders);
+      if (!response.body) {
+        res.end();
+        return;
+      }
+      const reader = response.body.getReader();
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          res.write(value);
+        }
+      } catch {
+      }
+      res.end();
+    })().catch((err) => {
+      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          code: "INTERNAL",
+          cause: err instanceof Error ? err.message : String(err),
+          fix: "retry; if it persists, report the request id",
+          retryable: false
+        })
+      );
+    });
+  });
+  await new Promise((resolve5, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port ?? 8765, host, () => resolve5());
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : opts.port ?? 8765;
+  return {
+    port,
+    url: `http://${host}:${port}${path2}`,
+    close: () => new Promise((resolve5, reject) => {
+      server.closeAllConnections();
+      server.close((err) => err ? reject(err) : resolve5());
+    })
+  };
+}
+
+// ../../packages/mcp-kit/dist/index.js
+import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
+async function serveStdio(serverOrOpts) {
+  const server = serverOrOpts instanceof McpServer3 ? serverOrOpts : createMcpServer(serverOrOpts);
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  await new Promise((resolve5) => {
+    const previous = transport.onclose;
+    transport.onclose = () => {
+      previous?.();
+      resolve5();
+    };
+  });
+}
+
+// src/proxy/http.ts
+import { writeFileSync, unlinkSync, existsSync, mkdirSync } from "fs";
+import { createServer } from "http";
+import { join } from "path";
+import { FileKillSwitch } from "@agentwares/agentguard-core/node";
+function registrationPath(stateDir) {
+  return join(stateDir, "http.json");
+}
+function json(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+  res.end(JSON.stringify(body));
+}
+function html(res, status, body) {
+  res.writeHead(status, {
+    "Content-Type": "text/html; charset=utf-8",
+    "Cache-Control": "no-store"
+  });
+  res.end(
+    `<!doctype html><meta name="viewport" content="width=device-width"><body style="font:16px system-ui;padding:2rem;max-width:40rem">${body}</body>`
+  );
+}
+async function readBody(req) {
+  if (req.method === "GET" || req.method === "HEAD") return void 0;
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  return new Uint8Array(Buffer.concat(chunks));
+}
+function isLoopback(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+}
+async function startHttpProxy(opts) {
+  const { runtime } = opts;
+  const host = opts.host ?? "127.0.0.1";
+  const path2 = opts.path ?? "/mcp";
+  const token = opts.token ?? crypto.randomUUID().replace(/-/g, "");
+  const kill = new FileKillSwitch(runtime.loaded.killPath);
+  const holder = {};
+  const server = createServer((req, res) => {
+    void (async () => {
+      const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+      const authorized = () => {
+        const q = url2.searchParams.get("token");
+        const h = req.headers.authorization?.replace(/^Bearer\s+/i, "");
+        return q === token || h === token;
+      };
+      if (url2.pathname === path2 && holder.mcp) {
+        const headers = new Headers();
+        for (const [k, v] of Object.entries(req.headers)) {
+          if (Array.isArray(v)) for (const item of v) headers.append(k, item);
+          else if (typeof v === "string") headers.set(k, v);
+        }
+        const controller = new AbortController();
+        res.on("close", () => {
+          if (!res.writableFinished) controller.abort();
+        });
+        const response = await holder.mcp(
+          new Request(url2, {
+            method: req.method ?? "GET",
+            headers,
+            body: await readBody(req),
+            signal: controller.signal
+          })
+        );
+        const out = {};
+        response.headers.forEach((v, k) => {
+          out[k] = v;
+        });
+        res.writeHead(response.status, out);
+        if (!response.body) return res.end();
+        const reader = response.body.getReader();
+        try {
+          for (; ; ) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            res.write(value);
+          }
+        } catch {
+        }
+        return res.end();
+      }
+      if (url2.pathname === "/health") {
+        const killed = await runtime.guard.killState();
+        return json(res, 200, {
+          ok: true,
+          name: "agentguard",
+          version: PROXY_VERSION,
+          mode: runtime.policy.mode,
+          killed: killed.killed,
+          upstreams: runtime.upstreamStatus(),
+          tools: runtime.listTools().length,
+          mcp: `${url2.origin}${path2}`
+        });
+      }
+      if (url2.pathname === "/status") {
+        if (!authorized()) return json(res, 401, unauthorized());
+        const runId = url2.searchParams.get("run") ?? runtime.defaultRunId;
+        return json(res, 200, { runId, ...await runtime.guard.status(runId) });
+      }
+      if (url2.pathname === "/kill" && req.method === "POST") {
+        if (!authorized()) return json(res, 401, unauthorized());
+        const body = await readBody(req);
+        let reason = "killed via HTTP";
+        try {
+          const parsed = JSON.parse(Buffer.from(body ?? []).toString("utf8") || "{}");
+          if (parsed.reason) reason = String(parsed.reason).slice(0, 200);
+        } catch {
+        }
+        kill.kill(reason);
+        await runtime.guard.halt(reason);
+        return json(res, 200, { killed: true, reason });
+      }
+      if (url2.pathname === "/resume" && req.method === "POST") {
+        if (!authorized()) return json(res, 401, unauthorized());
+        kill.resume();
+        await runtime.guard.resume();
+        return json(res, 200, { killed: false });
+      }
+      const decision = /^\/(approve|deny)\/([A-Za-z0-9_-]+)$/.exec(url2.pathname);
+      if (decision) {
+        if (!authorized()) return json(res, 401, unauthorized());
+        const [, action, id] = decision;
+        const record = await runtime.guard.decide(
+          id,
+          action === "approve" ? "approved" : "denied",
+          "http"
+        );
+        if (!record)
+          return json(res, 404, {
+            code: "NOT_FOUND",
+            cause: `no approval ${id}`,
+            fix: "list pending approvals with `agentguard approvals`",
+            retryable: false
+          });
+        if (req.headers.accept?.includes("text/html")) {
+          return html(
+            res,
+            200,
+            `<h1>${record.status === "approved" ? "Approved" : record.status === "denied" ? "Denied" : record.status}</h1><p><code>${record.tool}</code> \u2014 approval <code>${record.id}</code>.</p><p>The agent may now retry the call once.</p>`
+          );
+        }
+        return json(res, 200, record);
+      }
+      if (url2.pathname === "/approvals") {
+        if (!authorized()) return json(res, 401, unauthorized());
+        return json(res, 200, {
+          approvals: await runtime.guard.approvals.list(
+            url2.searchParams.get("all") ? void 0 : "pending"
+          )
+        });
+      }
+      return json(res, 404, {
+        code: "NOT_FOUND",
+        cause: `no route for ${url2.pathname}`,
+        fix: `POST JSON-RPC to ${path2}; GET /health`,
+        retryable: false
+      });
+    })().catch((err) => {
+      if (!res.headersSent)
+        json(res, 500, {
+          code: "INTERNAL",
+          cause: err instanceof Error ? err.message : String(err),
+          fix: "retry; if it persists, report the request",
+          retryable: false
+        });
+      else res.end();
+    });
+  });
+  await new Promise((resolve5, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port ?? 8788, host, () => resolve5());
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : opts.port ?? 8788;
+  holder.mcp = createHttpHandler(() => createDownstreamServer(runtime), {
+    sessions: true,
+    jsonResponse: false,
+    cors: true,
+    allowedHosts: isLoopback(host) ? localhostHosts(port) : void 0,
+    enableDnsRebindingProtection: isLoopback(host)
+  });
+  const baseUrl = `http://${host}:${port}`;
+  const url = `${baseUrl}${path2}`;
+  const regFile = registrationPath(runtime.loaded.stateDir);
+  if (opts.registerFile !== false) {
+    mkdirSync(runtime.loaded.stateDir, { recursive: true });
+    const reg = {
+      url,
+      baseUrl,
+      token,
+      pid: process.pid,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    writeFileSync(regFile, JSON.stringify(reg, null, 2));
+  }
+  return {
+    url,
+    port,
+    token,
+    close: () => new Promise((resolve5, reject) => {
+      if (opts.registerFile !== false && existsSync(regFile)) {
+        try {
+          unlinkSync(regFile);
+        } catch {
+        }
+      }
+      server.closeAllConnections();
+      server.close((err) => err ? reject(err) : resolve5());
+    })
+  };
+}
+function unauthorized() {
+  return {
+    code: "UNAUTHORIZED",
+    cause: "missing or wrong control token",
+    fix: "pass ?token=<token> or Authorization: Bearer <token> from <state>/http.json",
+    retryable: false
+  };
+}
+
+// src/context.ts
+import { existsSync as existsSync2 } from "fs";
+import { resolve } from "path";
+import { Guard } from "@agentwares/agentguard-core";
+import {
+  FileApprovalStore,
+  FileAuditSink,
+  FileKillSwitch as FileKillSwitch2,
+  FileStateStore,
+  loadPolicyFile
+} from "@agentwares/agentguard-core/node";
+import { existsSync as exists, readFileSync } from "fs";
+
+// ../../node_modules/.pnpm/postal-mime@2.7.5/node_modules/postal-mime/src/decode-strings.js
+var textEncoder = new TextEncoder();
+var base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var base64Lookup = new Uint8Array(256);
+for (let i = 0; i < base64Chars.length; i++) {
+  base64Lookup[base64Chars.charCodeAt(i)] = i;
+}
+var charsetAliases = /* @__PURE__ */ new Map([
+  ["iso-8859-8-i", "iso-8859-8"],
+  ["iso-8859-8-e", "iso-8859-8"]
+]);
+function getDecoder(charset) {
+  charset = (charset || "utf8").trim().toLowerCase();
+  charset = charsetAliases.get(charset) || charset;
+  let decoder;
+  try {
+    decoder = new TextDecoder(charset);
+  } catch (err) {
+    decoder = new TextDecoder("windows-1252");
+  }
+  return decoder;
+}
+
+// ../../node_modules/.pnpm/postal-mime@2.7.5/node_modules/postal-mime/src/mime-node.js
+var defaultDecoder = getDecoder();
+
+// ../../node_modules/.pnpm/postal-mime@2.7.5/node_modules/postal-mime/src/postal-mime.js
+var MAX_HEADERS_SIZE = 2 * 1024 * 1024;
+
+// ../../node_modules/.pnpm/resend@6.25.0/node_modules/resend/dist/index.mjs
+var import_standardwebhooks = __toESM(require_dist(), 1);
+var version = "6.25.0";
+var defaultUserAgent = `resend-node:${version}`;
+
+// ../../packages/notify/dist/index.js
+var palette = {
+  bg: "#f4f5f7",
+  card: "#ffffff",
+  text: "#111827",
+  muted: "#6b7280",
+  border: "#e5e7eb",
+  link: "#2563eb",
+  codeBg: "#f3f4f6",
+  red: "#b91c1c",
+  redBg: "#fef2f2",
+  green: "#15803d",
+  greenBg: "#f0fdf4",
+  amber: "#b45309",
+  amberBg: "#fffbeb",
+  gray: "#374151",
+  grayBg: "#f3f4f6"
+};
+var fontStack = "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif";
+var baseText = `font-family:${fontStack};font-size:15px;line-height:1.55;color:${palette.text};`;
+var USER_AGENT = "agentwares-notify/0.1";
+function errorMessage(e) {
+  if (e instanceof Error) return e.message;
+  return typeof e === "string" ? e : "unknown error";
+}
+async function readBody2(res) {
+  try {
+    return (await res.text()).slice(0, 500);
+  } catch {
+    return "";
+  }
+}
+function defaultFetch() {
+  return typeof fetch === "function" ? (input, init) => fetch(input, init) : void 0;
+}
+async function postJson(url, body, headers, fetchImpl) {
+  if (!fetchImpl) return { error: "fetch is not available" };
+  try {
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT, ...headers },
+      body: typeof body === "string" ? body : JSON.stringify(body)
+    });
+    return { res, text: await readBody2(res) };
+  } catch (e) {
+    return { error: errorMessage(e) };
+  }
+}
+async function sendSlack(webhookUrl, message, opts = {}) {
+  const r = await postJson(webhookUrl, message, {}, opts.fetch ?? defaultFetch());
+  if ("error" in r) return { ok: false, error: r.error };
+  return r.res.ok ? { ok: true, status: r.res.status } : { ok: false, status: r.res.status, error: r.text || r.res.statusText || "slack error" };
+}
+var SIGNATURE_HEADER = "X-Agentwares-Signature";
+var encoder = new TextEncoder();
+function toHex(bytes) {
+  return Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hmacSha256Hex(secret, body) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return toHex(await crypto.subtle.sign("HMAC", key, encoder.encode(body)));
+}
+async function sendWebhook(url, payload, opts = {}) {
+  const body = JSON.stringify(payload);
+  const headers = { ...opts.headers ?? {} };
+  if (opts.secret) headers[SIGNATURE_HEADER] = `sha256=${await hmacSha256Hex(opts.secret, body)}`;
+  const r = await postJson(url, body, headers, opts.fetch ?? defaultFetch());
+  if ("error" in r) return { ok: false, error: r.error };
+  return r.res.ok ? { ok: true, status: r.res.status } : { ok: false, status: r.res.status, error: r.text || r.res.statusText || "webhook error" };
+}
+
+// src/notify.ts
+function approvalSlackMessage(event, url) {
+  const a = event.approval;
+  const argsText = JSON.stringify(a.args ?? {}, null, 2).slice(0, 1500);
+  const text = `[agentguard] approval needed: ${a.tool} (run ${a.run_id}) \u2014 run \`agentguard approve ${a.id}\`${url ? ` or open ${url}` : ""}`;
+  const blocks = [
+    { type: "header", text: { type: "plain_text", text: `Approval needed: ${a.tool}` } },
+    {
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `*run* \`${a.run_id}\`${a.agent ? ` \xB7 *agent* \`${a.agent}\`` : ""}${a.upstream ? ` \xB7 *upstream* \`${a.upstream}\`` : ""}
+\`\`\`${argsText}\`\`\``
+      }
+    },
+    {
+      type: "context",
+      elements: [
+        {
+          type: "mrkdwn",
+          text: `Approve: \`agentguard approve ${a.id}\` \xB7 Deny: \`agentguard deny ${a.id}\` \xB7 expires ${a.expires_at}`
+        }
+      ]
+    }
+  ];
+  if (url) {
+    blocks.push({
+      type: "actions",
+      elements: [
+        { type: "button", text: { type: "plain_text", text: "Approve" }, style: "primary", url },
+        {
+          type: "button",
+          text: { type: "plain_text", text: "Deny" },
+          style: "danger",
+          url: url.replace("/approve/", "/deny/")
+        }
+      ]
+    });
+  }
+  return { text, blocks };
+}
+function haltSlackMessage(event) {
+  const cause = event.error?.cause ?? "";
+  const text = `[agentguard] ${event.type}: ${event.tool} (run ${event.runId}) \u2014 ${cause}`;
+  return {
+    text,
+    blocks: [
+      {
+        type: "section",
+        text: {
+          type: "mrkdwn",
+          text: `*${event.type}* on \`${event.tool}\` (run \`${event.runId}\`)
+${cause}`
+        }
+      },
+      {
+        type: "context",
+        elements: [
+          {
+            type: "mrkdwn",
+            text: `\`agentguard report --run ${event.runId}\` for the full picture${event.type === "KILLED" ? "" : " \xB7 `agentguard kill` to stop everything"}`
+          }
+        ]
+      }
+    ]
+  };
+}
+function createAlerter(opts) {
+  const { policy } = opts;
+  const log = opts.log ?? (() => void 0);
+  const channel = { fetch: opts.fetch };
+  return async (event) => {
+    if (event.type === "APPROVAL_DECIDED") return;
+    if (!policy.alerts.on.includes(event.type)) return;
+    const slack = event.type === "APPROVAL_REQUIRED" ? policy.approval.notify.slack || policy.alerts.slack : policy.alerts.slack;
+    const webhook = event.type === "APPROVAL_REQUIRED" ? policy.approval.notify.webhook || policy.alerts.webhook : policy.alerts.webhook;
+    const url = event.approval ? opts.approvalUrl?.(event.approval) : void 0;
+    const message = event.type === "APPROVAL_REQUIRED" && event.approval ? approvalSlackMessage(event, url) : haltSlackMessage(event);
+    const jobs = [];
+    if (slack) {
+      jobs.push(
+        sendSlack(slack, message, channel).then((r) => {
+          if (!r.ok) log(`slack alert failed: ${r.error ?? r.status}`);
+        })
+      );
+    }
+    if (webhook) {
+      jobs.push(
+        sendWebhook(
+          webhook,
+          {
+            event: event.type,
+            product: "agentguard",
+            subject: message.text,
+            summary: event.error?.cause ?? "",
+            occurredAt: event.at,
+            data: {
+              runId: event.runId,
+              tool: event.tool,
+              error: event.error,
+              approval: event.approval,
+              approveUrl: url
+            }
+          },
+          channel
+        ).then((r) => {
+          if (!r.ok) log(`webhook alert failed: ${r.error ?? r.status}`);
+        })
+      );
+    }
+    await Promise.all(jobs);
+  };
+}
+
+// src/args.ts
+var VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "config",
+  "client",
+  "mode",
+  "port",
+  "host",
+  "agent",
+  "run-id",
+  "run",
+  "base",
+  "head",
+  "paths",
+  "format",
+  "by",
+  "note",
+  "allow",
+  "deny",
+  "writes",
+  "spend",
+  "tool-calls",
+  "deletes",
+  "emails",
+  "reason",
+  "url",
+  "timeout",
+  "out",
+  "upstream"
+]);
+function parseArgs(argv) {
+  const out = { command: void 0, positionals: [], flags: {} };
+  const push = (key, value) => {
+    const existing = out.flags[key];
+    if (existing === void 0) out.flags[key] = value;
+    else if (Array.isArray(existing)) existing.push(String(value));
+    else out.flags[key] = [String(existing), String(value)];
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--") {
+      out.positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (arg.startsWith("--")) {
+      const body = arg.slice(2);
+      const eq = body.indexOf("=");
+      if (eq >= 0) {
+        push(body.slice(0, eq), body.slice(eq + 1));
+        continue;
+      }
+      if (body.startsWith("no-")) {
+        push(body.slice(3), false);
+        continue;
+      }
+      const next = argv[i + 1];
+      if (VALUE_FLAGS.has(body) && next !== void 0 && !next.startsWith("--")) {
+        push(body, next);
+        i += 1;
+      } else push(body, true);
+      continue;
+    }
+    if (arg.startsWith("-") && arg.length === 2) {
+      const short = {
+        c: "config",
+        y: "yes",
+        h: "help",
+        v: "version",
+        j: "json",
+        a: "all"
+      };
+      const key = short[arg[1]] ?? arg[1];
+      const next = argv[i + 1];
+      if (VALUE_FLAGS.has(key) && next !== void 0 && !next.startsWith("-")) {
+        push(key, next);
+        i += 1;
+      } else push(key, true);
+      continue;
+    }
+    if (out.command === void 0) out.command = arg;
+    else out.positionals.push(arg);
+  }
+  return out;
+}
+function flagString(args, name) {
+  const v = args.flags[name];
+  if (Array.isArray(v)) return v[v.length - 1];
+  return typeof v === "string" ? v : void 0;
+}
+function flagList(args, name) {
+  const v = args.flags[name];
+  if (Array.isArray(v)) return v.flatMap((s) => s.split(","));
+  return typeof v === "string" ? v.split(",") : [];
+}
+function flagBool(args, name) {
+  const v = args.flags[name];
+  if (typeof v === "boolean") return v;
+  if (typeof v === "string") return v !== "false" && v !== "0";
+  return void 0;
+}
+function flagNumber(args, name) {
+  const s = flagString(args, name);
+  if (s === void 0) return void 0;
+  const n = Number(s);
+  return Number.isFinite(n) ? n : void 0;
+}
+
+// src/context.ts
+import { homedir } from "os";
+var DEFAULT_POLICY_FILE = "agentguard.yaml";
+function homeFrom(io) {
+  return io.env.HOME ?? io.env.USERPROFILE ?? homedir();
+}
+function defaultIo() {
+  return {
+    out: (line) => process.stdout.write(line + "\n"),
+    err: (line) => process.stderr.write(line + "\n"),
+    cwd: process.cwd(),
+    env: process.env,
+    tty: process.stdout.isTTY === true
+  };
+}
+function policyPathFrom(args, io) {
+  return resolve(
+    io.cwd,
+    flagString(args, "config") ?? io.env.AGENTGUARD_CONFIG ?? DEFAULT_POLICY_FILE
+  );
+}
+function loadPolicyFor(args, io, opts = {}) {
+  return loadPolicyFile(policyPathFrom(args, io), {
+    env: io.env,
+    allowMissingEnv: opts.allowMissingEnv
+  });
+}
+function createFileGuard(loaded, opts = {}) {
+  const kill = new FileKillSwitch2(loaded.killPath);
+  const audit = new FileAuditSink(loaded.auditPath);
+  const approvals = new FileApprovalStore(loaded.stateDir);
+  const alerter = opts.alerts === false ? void 0 : createAlerter({ policy: loaded.policy, approvalUrl: opts.approvalUrl, log: opts.log });
+  const guard = new Guard({
+    policy: loaded.policy,
+    state: new FileStateStore(loaded.stateDir),
+    audit,
+    kill,
+    approvals,
+    env: opts.env ?? process.env,
+    approvalUrl: opts.approvalUrl,
+    onEvent: async (event) => {
+      await opts.onEvent?.(event);
+      await alerter?.(event);
+    }
+  });
+  return { guard, kill, audit, approvals, loaded };
+}
+function readRegistration(loaded) {
+  const file = registrationPath(loaded.stateDir);
+  if (!exists(file)) return void 0;
+  try {
+    const reg = JSON.parse(readFileSync(file, "utf8"));
+    return reg;
+  } catch {
+    return void 0;
+  }
+}
+function describeError(err) {
+  if (err && typeof err === "object" && "code" in err && "cause" in err) {
+    const e = err;
+    return `${e.code}: ${e.cause}${e.fix ? `
+  fix: ${e.fix}` : ""}`;
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/configs.ts
+import { copyFileSync, existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2, platform } from "os";
+import { join as join2, resolve as resolve2 } from "path";
+function candidateConfigs(cwd = process.cwd(), home = homedir2(), env = process.env) {
+  const desktop = platform() === "darwin" ? join2(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : platform() === "win32" ? join2(
+    env.APPDATA ?? join2(home, "AppData", "Roaming"),
+    "Claude",
+    "claude_desktop_config.json"
+  ) : join2(
+    env.XDG_CONFIG_HOME ?? join2(home, ".config"),
+    "Claude",
+    "claude_desktop_config.json"
+  );
+  return [
+    {
+      kind: "claude-code-project",
+      label: "Claude Code (project .mcp.json)",
+      path: join2(cwd, ".mcp.json"),
+      serversKey: "mcpServers"
+    },
+    {
+      kind: "cursor-project",
+      label: "Cursor (project)",
+      path: join2(cwd, ".cursor", "mcp.json"),
+      serversKey: "mcpServers"
+    },
+    {
+      kind: "vscode",
+      label: "VS Code (project)",
+      path: join2(cwd, ".vscode", "mcp.json"),
+      serversKey: "servers"
+    },
+    { kind: "generic", label: "mcp.json", path: join2(cwd, "mcp.json"), serversKey: "mcpServers" },
+    { kind: "claude-desktop", label: "Claude Desktop", path: desktop, serversKey: "mcpServers" },
+    {
+      kind: "cursor-user",
+      label: "Cursor (user)",
+      path: join2(home, ".cursor", "mcp.json"),
+      serversKey: "mcpServers"
+    },
+    {
+      kind: "windsurf",
+      label: "Windsurf",
+      path: join2(home, ".codeium", "windsurf", "mcp_config.json"),
+      serversKey: "mcpServers"
+    },
+    {
+      kind: "claude-code-user",
+      label: "Claude Code (user ~/.claude.json)",
+      path: join2(home, ".claude.json"),
+      serversKey: "mcpServers"
+    }
+  ];
+}
+function detectClientConfigs(cwd, home, env) {
+  return candidateConfigs(cwd, home, env).filter((c) => existsSync3(c.path));
+}
+function describeConfigPath(path2) {
+  const abs = resolve2(path2);
+  const known = candidateConfigs().find((c) => c.path === abs);
+  if (known) return known;
+  let serversKey = "mcpServers";
+  try {
+    const parsed = JSON.parse(readFileSync2(abs, "utf8"));
+    if (parsed.servers && !parsed.mcpServers) serversKey = "servers";
+  } catch {
+  }
+  return {
+    kind: abs.includes(".vscode") ? "vscode" : "generic",
+    label: abs,
+    path: abs,
+    serversKey
+  };
+}
+function readServers(file) {
+  const raw = JSON.parse(readFileSync2(file.path, "utf8"));
+  const servers = raw[file.serversKey];
+  if (!servers || typeof servers !== "object") return {};
+  return servers;
+}
+var PROXY_SERVER_NAME = "agentguard";
+function isProxyEntry(entry) {
+  return (entry.args ?? []).some((a) => a === "agentguard" || /(^|\/)agentguard(\.js)?$/.test(a)) && (entry.args ?? []).includes("proxy");
+}
+function serversToUpstreams(servers) {
+  const upstreams = [];
+  const skipped = [];
+  for (const [rawName, entry] of Object.entries(servers)) {
+    if (isProxyEntry(entry)) {
+      skipped.push({ name: rawName, reason: "already the agentguard proxy" });
+      continue;
+    }
+    const name = rawName.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/^[^a-zA-Z0-9]+/, "") || "upstream";
+    if (entry.url) {
+      upstreams.push({
+        name,
+        url: entry.url,
+        headers: entry.headers ?? {},
+        args: [],
+        env: {},
+        prefix: false,
+        timeout_ms: 6e4
+      });
+    } else if (entry.command) {
+      upstreams.push({
+        name,
+        command: entry.command,
+        args: entry.args ?? [],
+        env: entry.env ?? {},
+        cwd: entry.cwd,
+        headers: {},
+        prefix: false,
+        timeout_ms: 6e4
+      });
+    } else {
+      skipped.push({ name: rawName, reason: "no `command` or `url`" });
+    }
+  }
+  return { upstreams, skipped };
+}
+function backupPath(file) {
+  return `${file.path}.agentguard-backup`;
+}
+function proxyEntry(file, policyPath, opts = {}) {
+  const args = ["-y", "agentguard", "proxy", "--config", policyPath];
+  if (opts.agent) args.push("--agent", opts.agent);
+  const entry = { command: "npx", args };
+  if (file.serversKey === "servers") entry.type = "stdio";
+  return entry;
+}
+function rewriteClientConfig(file, policyPath, opts = {}) {
+  const raw = JSON.parse(readFileSync2(file.path, "utf8"));
+  const servers = raw[file.serversKey] ?? {};
+  const replaced = Object.keys(servers).filter((n) => !isProxyEntry(servers[n]));
+  const backup = backupPath(file);
+  if (!existsSync3(backup)) copyFileSync(file.path, backup);
+  raw[file.serversKey] = { [PROXY_SERVER_NAME]: proxyEntry(file, policyPath, opts) };
+  writeFileSync2(file.path, JSON.stringify(raw, null, 2) + "\n");
+  return { backup, replaced };
+}
+function restoreClientConfig(file) {
+  const backup = backupPath(file);
+  if (!existsSync3(backup)) return false;
+  copyFileSync(backup, file.path);
+  return true;
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync4, writeFileSync as writeFileSync3 } from "fs";
+import { relative, resolve as resolve3 } from "path";
+import YAML from "yaml";
+
+// src/commands/tools.ts
+import {
+  Guard as Guard2,
+  classifyTool as classifyTool2,
+  parsePolicy
+} from "@agentwares/agentguard-core";
+async function probeUpstreams(upstreams, opts = {}) {
+  const policy = opts.policy ?? parsePolicy({ upstreams });
+  const loaded = {
+    policy: { ...policy, upstreams },
+    path: "",
+    baseDir: process.cwd(),
+    stateDir: "",
+    auditPath: "",
+    killPath: ""
+  };
+  const guard = new Guard2({ policy: loaded.policy, env: opts.env ?? {} });
+  const runtime = new ProxyRuntime({
+    loaded,
+    guard,
+    defaultRunId: "probe",
+    log: opts.log ?? (() => void 0),
+    connectTimeoutMs: opts.timeoutMs ?? 15e3
+  });
+  try {
+    await runtime.start();
+    return {
+      tools: runtime.listTools().map((t) => ({
+        upstream: t.upstream,
+        name: t.name,
+        tool: t.tool,
+        classification: classifyTool2(
+          { name: t.name, annotations: t.tool.annotations },
+          loaded.policy
+        )
+      })),
+      upstreams: runtime.upstreamStatus()
+    };
+  } finally {
+    await runtime.close();
+  }
+}
+function formatToolTable(tools) {
+  const width = Math.min(48, Math.max(12, ...tools.map((t) => t.name.length)));
+  const lines = [
+    `${"tool".padEnd(width)}  ${"class".padEnd(8)}${"verb".padEnd(9)}${"upstream".padEnd(14)}why`
+  ];
+  for (const t of tools) {
+    const c = t.classification;
+    lines.push(
+      `${t.name.padEnd(width)}  ${c.class.padEnd(8)}${c.verb.padEnd(9)}${t.upstream.padEnd(14)}${c.source}: ${c.reason}`
+    );
+  }
+  return lines;
+}
+async function toolsCommand(args, io) {
+  const loaded = loadPolicyFor(args, io);
+  const result = await probeUpstreams(loaded.policy.upstreams, {
+    policy: loaded.policy,
+    log: io.err,
+    env: io.env
+  });
+  if (flagBool(args, "json")) {
+    io.out(
+      JSON.stringify(
+        {
+          upstreams: result.upstreams,
+          tools: result.tools.map((t) => ({
+            name: t.name,
+            upstream: t.upstream,
+            ...t.classification
+          }))
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  for (const u of result.upstreams)
+    io.err(
+      `${u.connected ? "ok  " : "down"} ${u.name}: ${u.connected ? `${u.tools} tools` : u.error}`
+    );
+  for (const line of formatToolTable(result.tools)) io.out(line);
+  const counts = result.tools.reduce(
+    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
+    {}
+  );
+  io.err(
+    `
+${result.tools.length} tools: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")} \xB7 mode ${loaded.policy.mode}`
+  );
+  return result.upstreams.every((u) => u.connected) ? 0 : 2;
+}
+
+// src/commands/init.ts
+function dump(value, indent = 0) {
+  const text = YAML.stringify(value, { indent: 2, lineWidth: 100 }).trimEnd();
+  const pad = " ".repeat(indent);
+  return text.split("\n").map((l) => pad + l).join("\n");
+}
+function flow(list) {
+  return list.length === 0 ? "[]" : `[${list.map((s) => JSON.stringify(s)).join(", ")}]`;
+}
+function renderStarterPolicy(opts) {
+  const tools = opts.tools ?? [];
+  const unknown = tools.filter((t) => t.classification.class === "unknown").map((t) => t.name);
+  const destructive = tools.filter((t) => t.classification.destructive || t.classification.verb === "delete").map((t) => t.name);
+  const spend = tools.filter((t) => t.classification.class === "spend").map((t) => t.name);
+  const date = (opts.generatedAt ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const counts = tools.reduce(
+    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
+    {}
+  );
+  const detected = tools.length === 0 ? ["#   (no upstreams probed \u2014 run `agentguard tools` after fixing the upstreams above)"] : tools.map(
+    (t) => `#   ${t.name.padEnd(36)} ${t.classification.class.padEnd(8)} ${t.classification.verb.padEnd(8)} ${t.classification.source}: ${t.classification.reason}`
+  );
+  const probeNotes = (opts.probeErrors ?? []).map((e) => `#   ! ${e}`);
+  const upstreamsYaml = opts.upstreams.length ? dump({ upstreams: opts.upstreams.map(cleanUpstream) }) : 'upstreams: []\n  # - name: crm\n  #   url: https://mcp.example.com/mcp\n  #   auth: ${CRM_TOKEN}\n  # - name: files\n  #   command: npx\n  #   args: [-y, "@modelcontextprotocol/server-filesystem", "."]';
+  return `# agentguard.yaml \u2014 generated by \`agentguard init\` on ${date}
+# Every knob is explained inline. Docs: https://github.com/agentwares/agentwares/tree/main/apps/agentguard-cli#policy
+version: 1
+
+# dry-run: reads pass through; writes and spends are FAKED (plausible success, nothing executes)
+# and recorded. Run your agent once, then \`agentguard report\` and \`agentguard diff\`.
+# Flip to \`enforce\` when the diff looks right. Caps and the loop breaker apply in both modes.
+mode: ${opts.mode ?? "dry-run"}
+
+# The servers your agent used to talk to directly. agentguard connects to them and holds their
+# credentials; your agent only talks to agentguard. Use \${ENV_VAR} for secrets.
+${upstreamsYaml}
+
+# Detected tools (${tools.length}${tools.length ? `: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}` : ""}):
+${[...detected, ...probeNotes].join("\n")}
+# readOnlyHint annotations and verb heuristics classify most tools. List anything that is wrong here;
+# these patterns win over annotations. \`*\` matches anything.
+classify:
+  read: []
+  write: ${flow(unknown)}${unknown.length ? "   # could not be classified \u2014 treated as writes; move to read: if they only read" : ""}
+  spend: ${flow(spend)}
+  unknown: write   # a tool nobody can classify counts as a write (alternatives: read | block)
+
+# Blast-radius caps. The call that would exceed a cap gets CAP_EXCEEDED with the remaining budget.
+# \`writes\` counts every write or spend; \`deletes\`/\`emails\` count the subsets matched by \`counters\`.
+caps:
+  per_run:
+    tool_calls: 400
+    writes: 50
+    deletes: 10
+    emails: 5
+    spend_usd: 25
+  per_day:
+    spend_usd: 200
+
+# Dollar amounts. Declare how to read the amount from a spend tool's arguments; results reporting
+# cost_usd / amount_usd are picked up automatically. Unknown spend tools cost \`default_usd\`.
+spend:
+  tools: {}
+  #  stripe_create_charge: { amount_arg: amount, divisor: 100, currency_arg: currency }
+  #  openai_*: { fixed_usd: 0.01 }
+  default_usd: 0
+
+# Semantic loop breaker: the same (tool, normalized arguments) ${3} times in the last 30 calls, or a
+# repeating A\u2192B\u2192A\u2192B cycle, returns LOOP_DETECTED. Timestamps, ids and whitespace are ignored.
+loop:
+  window: 30
+  max_repeats: 3
+  max_cycle_len: 4
+  max_read_repeats: 10
+
+# Always fake these, even in enforce mode. Remove entries as you gain trust.
+dry_run:
+  tools: []
+  synthesize: true
+
+# Destructive actions that need a human. The agent gets APPROVAL_REQUIRED with an id; you run
+# \`agentguard approve <id>\` (or click the link in Slack); the agent retries the identical call once.
+approval:
+  tools: ${flow(destructive)}
+  wait_s: 0          # > 0 holds the call open this long waiting for the decision
+  ttl_s: 3600
+  # notify:
+  #   slack: \${SLACK_WEBHOOK_URL}
+
+# Kill switch: \`agentguard kill\` creates this file (or POST /kill on the HTTP proxy); every call
+# returns KILLED until \`agentguard resume\`. AGENTGUARD_KILL=1 in the environment does the same.
+kill:
+  file: .agentguard/KILL
+
+# Scoped agent keys for the HTTP proxy: \`agentguard key create deployer --allow 'crm_get_*'\`.
+# Only the key's hash is stored here; the agent sends the key as a Bearer token.
+agents: []
+
+# Alerts on halts (Slack incoming webhook or any HTTPS endpoint; signed with X-Agentwares-Signature).
+# alerts:
+#   slack: \${SLACK_WEBHOOK_URL}
+#   on: [LOOP_DETECTED, CAP_EXCEEDED, KILLED, APPROVAL_REQUIRED]
+
+# Hash-chained JSONL of every call; \`agentguard verify\` proves it was not edited.
+audit:
+  path: .agentguard/audit.jsonl
+  redact: true
+  include_results: false
+`;
+}
+function cleanUpstream(u) {
+  const out = { name: u.name };
+  if (u.url) {
+    out.url = u.url;
+    if (Object.keys(u.headers).length) out.headers = u.headers;
+  } else {
+    out.command = u.command;
+    if (u.args.length) out.args = u.args;
+    if (Object.keys(u.env).length) out.env = u.env;
+    if (u.cwd) out.cwd = u.cwd;
+  }
+  return out;
+}
+async function initCommand(args, io) {
+  const policyPath = policyPathFrom(args, io);
+  const explicit = flagString(args, "client");
+  const configs = explicit ? [describeConfigPath(resolve3(io.cwd, explicit))] : detectClientConfigs(io.cwd, homeFrom(io), io.env);
+  const rel = (p) => {
+    const r = relative(io.cwd, p);
+    return r.startsWith("..") ? p : r || ".";
+  };
+  if (flagBool(args, "undo")) {
+    let restored = 0;
+    for (const c of configs) {
+      if (restoreClientConfig(c)) {
+        io.out(`restored ${rel(c.path)} from backup`);
+        restored += 1;
+      }
+    }
+    if (restored === 0)
+      io.err("nothing to undo (no *.agentguard-backup files next to your MCP configs)");
+    return 0;
+  }
+  const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + "/"));
+  const userLevel = configs.filter((c) => !projectLevel.includes(c));
+  let chosen;
+  if (explicit) chosen = configs;
+  else if (flagBool(args, "all")) chosen = configs;
+  else chosen = projectLevel.slice(0, 1);
+  if (!explicit && !flagBool(args, "all")) {
+    for (const c of userLevel)
+      io.out(
+        `found   ${c.path} (${c.label}, user-level) \u2014 not touched; pass --client ${JSON.stringify(c.path)} to route it through agentguard`
+      );
+  }
+  if (!chosen.every((c) => existsSync4(c.path))) {
+    io.err(`no MCP config at ${chosen.map((c) => c.path).join(", ")}`);
+    return 1;
+  }
+  const servers = {};
+  for (const c of chosen) {
+    const found = readServers(c);
+    io.out(
+      `found   ${rel(c.path)} (${c.label}) \u2192 ${Object.keys(found).length} server${Object.keys(found).length === 1 ? "" : "s"}: ${Object.keys(found).join(", ") || "none"}`
+    );
+    for (const [name, entry] of Object.entries(found))
+      if (!(name in servers)) servers[name] = entry;
+  }
+  if (chosen.length === 0)
+    io.out(
+      "found   no MCP config (Claude Code .mcp.json, Cursor, VS Code, Claude Desktop, Windsurf) \u2014 writing a policy with no upstreams"
+    );
+  const { upstreams, skipped } = serversToUpstreams(servers);
+  for (const s of skipped) io.err(`skipped ${s.name}: ${s.reason}`);
+  if (skipped.some((s) => s.reason.includes("already")) && upstreams.length === 0 && existsSync4(policyPath)) {
+    io.out(
+      `already initialized: ${rel(policyPath)} exists and ${chosen.map((c) => rel(c.path)).join(", ")} already points at agentguard`
+    );
+    return 0;
+  }
+  let probed = [];
+  const probeErrors = [];
+  if (flagBool(args, "probe") !== false && upstreams.length > 0) {
+    io.out(`probing ${upstreams.length} upstream${upstreams.length === 1 ? "" : "s"}\u2026`);
+    const result = await probeUpstreams(upstreams, {
+      log: () => void 0,
+      env: io.env,
+      timeoutMs: 2e4
+    });
+    probed = result.tools;
+    for (const u of result.upstreams) {
+      if (u.connected) io.out(`        ${u.name}: ${u.tools} tools`);
+      else {
+        io.err(
+          `        ${u.name}: could not connect (${u.error}) \u2014 the proxy will keep retrying at start; fix the entry in agentguard.yaml`
+        );
+        probeErrors.push(`${u.name}: ${u.error}`);
+      }
+    }
+  }
+  const mode = flagString(args, "mode") ?? "dry-run";
+  if (existsSync4(policyPath) && !flagBool(args, "force")) {
+    io.out(`kept    ${rel(policyPath)} (exists; pass --force to regenerate)`);
+  } else {
+    writeFileSync3(policyPath, renderStarterPolicy({ upstreams, tools: probed, mode, probeErrors }));
+    const counts = probed.reduce(
+      (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
+      {}
+    );
+    io.out(
+      `wrote   ${rel(policyPath)} (mode: ${mode}, ${upstreams.length} upstream${upstreams.length === 1 ? "" : "s"}${probed.length ? `, ${probed.length} tools: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}` : ""})`
+    );
+  }
+  if (flagBool(args, "rewrite") !== false) {
+    for (const c of chosen) {
+      const { backup, replaced } = rewriteClientConfig(c, policyPath, {
+        agent: flagString(args, "agent")
+      });
+      io.out(
+        `rewrote ${rel(c.path)} \u2192 ${replaced.length ? `${replaced.join(", ")} now go through` : "points at"} \`npx @agentwares/agentguard proxy\` (backup: ${rel(backup)})`
+      );
+    }
+  }
+  io.out("");
+  io.out("Next:");
+  io.out(
+    `  1. restart your MCP client so it re-reads ${chosen.map((c) => rel(c.path)).join(", ") || "its config"}`
+  );
+  io.out(
+    `  2. run your agent once \u2014 ${mode === "dry-run" ? "writes are faked; nothing executes upstream" : "enforce mode: caps, loop breaker and approvals are live"}`
+  );
+  io.out("  3. agentguard report        # what this run would have destroyed / spent");
+  io.out("     agentguard diff          # the record-by-record mutation diff");
+  if (mode === "dry-run")
+    io.out(`  4. set \`mode: enforce\` in ${rel(policyPath)} when it looks right`);
+  io.out("  undo any time: agentguard init --undo");
+  return 0;
+}
+
+// src/commands/permission-diff.ts
+import { execFileSync } from "child_process";
+import {
+  diffPermissionFile,
+  renderPermissionDiffMarkdown
+} from "@agentwares/agentguard-core";
+var DEFAULT_PERMISSION_PATHS = [
+  "agentguard.yaml",
+  "agentguard.yml",
+  ".claude/settings.json",
+  ".claude/settings.local.json",
+  ".mcp.json",
+  "mcp.json",
+  ".cursor/mcp.json",
+  ".vscode/mcp.json"
+];
+var PERMISSION_FILE = /(^|\/)(agentguard[^/]*\.ya?ml|\.claude\/settings(\.local)?\.json|[^/]*mcp[^/]*\.json|claude_desktop_config\.json)$/;
+function git(cwd, argv) {
+  try {
+    return execFileSync("git", argv, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return void 0;
+  }
+}
+function showAt(cwd, ref, path2) {
+  return git(cwd, ["show", `${ref}:${path2}`]);
+}
+function changedPermissionFiles(cwd, base, head) {
+  const out = git(cwd, ["diff", "--name-only", base, head]) ?? "";
+  return out.split("\n").map((l) => l.trim()).filter((l) => l && PERMISSION_FILE.test(l));
+}
+function resolveBase(cwd, explicit) {
+  if (explicit) return explicit;
+  for (const candidate of ["origin/main", "main", "origin/master", "master"]) {
+    if (git(cwd, ["rev-parse", "--verify", "--quiet", candidate]) !== void 0) return candidate;
+  }
+  return "HEAD~1";
+}
+function runPermissionDiff(cwd, opts) {
+  const base = resolveBase(cwd, opts.base);
+  const head = opts.head ?? "HEAD";
+  const files = [
+    .../* @__PURE__ */ new Set([
+      ...opts.paths ?? DEFAULT_PERMISSION_PATHS,
+      ...changedPermissionFiles(cwd, base, head)
+    ])
+  ];
+  const findings = [];
+  const touched = [];
+  for (const file of files) {
+    const before = showAt(cwd, base, file);
+    const after = showAt(cwd, head, file);
+    if (before === void 0 && after === void 0) continue;
+    if (before === after) continue;
+    touched.push(file);
+    findings.push(...diffPermissionFile(file, before, after));
+  }
+  return {
+    base,
+    head,
+    files: touched,
+    findings,
+    markdown: renderPermissionDiffMarkdown(findings, { title: opts.title })
+  };
+}
+async function permissionDiffCommand(args, io) {
+  const paths = flagList(args, "paths");
+  const result = runPermissionDiff(io.cwd, {
+    base: flagString(args, "base"),
+    head: flagString(args, "head"),
+    paths: paths.length ? paths : void 0
+  });
+  const format = flagString(args, "format") ?? (flagBool(args, "json") ? "json" : "markdown");
+  if (format === "json") io.out(JSON.stringify(result, null, 2));
+  else io.out(result.markdown);
+  const widen = result.findings.filter((f) => f.severity === "widen").length;
+  if (flagBool(args, "fail-on-widen") && widen > 0) return 1;
+  return 0;
+}
+
+// src/fixtures/crm-server.ts
+import { z as z5 } from "zod";
+function seedState() {
+  const contacts = /* @__PURE__ */ new Map();
+  for (const [id, name, email] of [
+    ["c_1", "Ada Lovelace", "ada@example.com"],
+    ["c_2", "Grace Hopper", "grace@example.com"],
+    ["c_3", "Linus Torvalds", "linus@example.com"]
+  ]) {
+    contacts.set(id, { id, name, email, updated_at: "2026-01-01T00:00:00.000Z" });
+  }
+  return { contacts, mutations: [], emails: [], charges: [] };
+}
+var counter = 0;
+var nextId = (prefix) => `${prefix}_${(++counter).toString(36).padStart(4, "0")}`;
+function crmTools(state) {
+  const contactSchema = z5.object({
+    id: z5.string(),
+    name: z5.string(),
+    email: z5.string(),
+    updated_at: z5.string()
+  });
+  return [
+    defineTool({
+      name: "crm_list_contacts",
+      description: "List every contact in the CRM. Read-only; returns id, name, email and updated_at.",
+      input: z5.object({ limit: z5.number().int().min(1).max(500).default(100) }),
+      output: z5.object({ contacts: z5.array(contactSchema), total: z5.number() }),
+      annotations: { readOnlyHint: true },
+      handler: ({ limit }) => ({
+        contacts: [...state.contacts.values()].slice(0, limit),
+        total: state.contacts.size
+      })
+    }),
+    defineTool({
+      name: "crm_get_contact",
+      description: "Fetch one contact by id. Read-only; NOT_FOUND when the id does not exist.",
+      input: z5.object({ id: z5.string() }),
+      output: contactSchema,
+      annotations: { readOnlyHint: true },
+      handler: ({ id }) => {
+        const c = state.contacts.get(id);
+        if (!c)
+          throw toolError(
+            "NOT_FOUND",
+            `no contact ${id}`,
+            "call crm_list_contacts and use an existing id"
+          );
+        return c;
+      }
+    }),
+    defineTool({
+      name: "crm_search",
+      description: "Search contacts by name or email substring. Returns matching contacts (no annotations on purpose).",
+      input: z5.object({ query: z5.string() }),
+      handler: ({ query }) => ({
+        contacts: [...state.contacts.values()].filter(
+          (c) => `${c.name} ${c.email}`.toLowerCase().includes(query.toLowerCase())
+        )
+      })
+    }),
+    defineTool({
+      name: "crm_create_contact",
+      description: "Create a contact. Returns the new id and created_at timestamp.",
+      input: z5.object({ name: z5.string(), email: z5.string() }),
+      output: z5.object({ id: z5.string(), created_at: z5.string() }),
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      handler: ({ name, email }) => {
+        const id = nextId("c");
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        state.contacts.set(id, { id, name, email, updated_at: now });
+        state.mutations.push({ tool: "crm_create_contact", args: { name, email } });
+        return { id, created_at: now };
+      }
+    }),
+    defineTool({
+      name: "crm_update_contact",
+      description: "Update fields on a contact. Returns the id and updated_at; NOT_FOUND for unknown ids.",
+      input: z5.object({
+        id: z5.string(),
+        fields: z5.object({ name: z5.string().optional(), email: z5.string().optional() })
+      }),
+      output: z5.object({ id: z5.string(), updated_at: z5.string() }),
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true },
+      handler: ({ id, fields }) => {
+        const c = state.contacts.get(id);
+        if (!c)
+          throw toolError(
+            "NOT_FOUND",
+            `no contact ${id}`,
+            "call crm_list_contacts and use an existing id"
+          );
+        Object.assign(c, fields, { updated_at: (/* @__PURE__ */ new Date()).toISOString() });
+        state.mutations.push({ tool: "crm_update_contact", args: { id, fields } });
+        return { id, updated_at: c.updated_at };
+      }
+    }),
+    defineTool({
+      name: "crm_delete_contact",
+      description: "Permanently delete a contact. Irreversible. Returns { deleted, id }.",
+      input: z5.object({ id: z5.string() }),
+      output: z5.object({ deleted: z5.boolean(), id: z5.string() }),
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      handler: ({ id }) => {
+        const existed = state.contacts.delete(id);
+        state.mutations.push({ tool: "crm_delete_contact", args: { id } });
+        return { deleted: existed, id };
+      }
+    }),
+    defineTool({
+      name: "crm_send_email",
+      description: "Send an email to a contact through the CRM. Returns the message id and sent_at.",
+      input: z5.object({ to: z5.string(), subject: z5.string(), body: z5.string() }),
+      output: z5.object({ message_id: z5.string(), sent_at: z5.string() }),
+      handler: ({ to, subject }) => {
+        state.emails.push({ to, subject });
+        state.mutations.push({ tool: "crm_send_email", args: { to, subject } });
+        return { message_id: nextId("msg"), sent_at: (/* @__PURE__ */ new Date()).toISOString() };
+      }
+    }),
+    defineTool({
+      name: "crm_charge_card",
+      description: "Charge a customer's card on file (amount in cents). Returns the charge id and amount_usd.",
+      input: z5.object({
+        customer_id: z5.string(),
+        amount_cents: z5.number().int().positive(),
+        currency: z5.string().default("usd")
+      }),
+      output: z5.object({ charge_id: z5.string(), amount_usd: z5.number() }),
+      handler: ({ customer_id, amount_cents }) => {
+        const amount_usd = amount_cents / 100;
+        state.charges.push({ customer_id, amount_usd });
+        state.mutations.push({ tool: "crm_charge_card", args: { customer_id, amount_usd } });
+        return { charge_id: nextId("ch"), amount_usd };
+      }
+    }),
+    defineTool({
+      name: "crm_frobnicate",
+      description: "A tool with no annotations and no recognizable verb \u2014 exists to test `unknown` handling.",
+      input: z5.object({}),
+      handler: () => {
+        state.mutations.push({ tool: "crm_frobnicate", args: {} });
+        return { frobnicated: true };
+      }
+    }),
+    defineTool({
+      name: "crm_fail",
+      description: "Always returns a structured UPSTREAM_ERROR result, for error-path tests.",
+      input: z5.object({}),
+      annotations: { readOnlyHint: true },
+      handler: () => {
+        throw toolError("UPSTREAM_ERROR", "the CRM is having a bad day", "retry in a minute", {
+          retryable: true
+        });
+      }
+    })
+  ];
+}
+function createCrmMcpServer(state = seedState()) {
+  return createMcpServer({
+    name: "fake-crm",
+    version: "0.1.0",
+    instructions: "A fake CRM for agentguard tests. Nothing here is real.",
+    tools: crmTools(state)
+  });
+}
+var isMain = process.argv[1] !== void 0 && /crm-server\.[cm]?[jt]s$/.test(process.argv[1]);
+if (isMain) {
+  const state = seedState();
+  if (process.argv.includes("--http")) {
+    const portArg = process.argv.find((a) => a.startsWith("--port="));
+    const port = portArg ? Number(portArg.slice("--port=".length)) : 0;
+    const handler = createHttpHandler(() => createCrmMcpServer(state), {
+      sessions: true,
+      jsonResponse: false,
+      allowedHosts: port ? localhostHosts(port) : void 0
+    });
+    const server = await serveNodeHttp({
+      handler,
+      port,
+      health: () => handleHealth({ name: "fake-crm", version: "0.1.0", tools: crmTools(state).length })
+    });
+    console.log(`fake-crm listening at ${server.url}`);
+  } else {
+    for (const signal of ["SIGTERM", "SIGINT"]) process.on(signal, () => process.exit(0));
+    await serveStdio(createCrmMcpServer(state));
+  }
+}
+
+// src/fixtures/demo-agent.ts
+import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport as StdioClientTransport2 } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { fileURLToPath } from "url";
+import path from "path";
+function summarize(result) {
+  const text = result.content.find((c) => c.type === "text")?.text;
+  const meta = result._meta?.agentguard;
+  if (result.isError) {
+    let code;
+    try {
+      code = JSON.parse(text ?? "{}").code;
+    } catch {
+    }
+    return { ok: false, code, text };
+  }
+  return { ok: true, dryRun: meta?.dryRun, text };
+}
+async function runDemoAgent(client, opts = {}) {
+  const steps = [];
+  const log = opts.log ?? (() => void 0);
+  const meta = opts.runId ? { runId: opts.runId } : void 0;
+  const call = async (step, tool, args) => {
+    const result = await client.callTool({
+      name: tool,
+      arguments: args,
+      _meta: meta
+    });
+    const s = { step, tool, ...summarize(result) };
+    steps.push(s);
+    log(
+      `${s.ok ? s.dryRun ? "faked " : "ok    " : `${s.code ?? "error"}`.padEnd(6)} ${step}: ${tool}`
+    );
+    return s;
+  };
+  await call("read: list contacts", "crm_list_contacts", { limit: 10 });
+  await call("read: get one", "crm_get_contact", { id: "c_1" });
+  await call("write: create", "crm_create_contact", {
+    name: "Demo Person",
+    email: "demo@example.com"
+  });
+  await call("write: update", "crm_update_contact", { id: "c_1", fields: { name: "Ada L." } });
+  await call("write: delete (destructive)", "crm_delete_contact", { id: "c_2" });
+  await call("write: send email", "crm_send_email", {
+    to: "ada@example.com",
+    subject: "Hi",
+    body: "Hello from the demo agent"
+  });
+  await call("spend: charge $12", "crm_charge_card", {
+    customer_id: "c_1",
+    amount_cents: 1200,
+    currency: "usd"
+  });
+  const loops = opts.loop ?? 5;
+  for (let i = 0; i < loops; i += 1) {
+    const s = await call(`loop ${i + 1}/${loops}: identical update`, "crm_update_contact", {
+      id: "c_3",
+      fields: { name: "Same Thing" }
+    });
+    if (s.code === "LOOP_DETECTED") break;
+  }
+  const burst = opts.burst ?? 60;
+  for (let i = 0; i < burst; i += 1) {
+    const s = await call(`burst ${i + 1}/${burst}: create`, "crm_create_contact", {
+      name: `Bulk ${i}`,
+      email: `bulk${i}@example.com`
+    });
+    if (s.code === "CAP_EXCEEDED") break;
+  }
+  return steps;
+}
+var isMain2 = process.argv[1] !== void 0 && /demo-agent\.[cm]?[jt]s$/.test(process.argv[1]);
+if (isMain2) {
+  const argv = process.argv.slice(2);
+  const arg = (name) => {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : void 0;
+  };
+  const url = arg("--url");
+  const config = arg("--config") ?? "agentguard.yaml";
+  const client = new Client2({ name: "agentguard-demo-agent", version: "0.1.0" });
+  if (url) {
+    await client.connect(
+      new StreamableHTTPClientTransport2(new URL(url), {
+        requestInit: {
+          headers: { "X-Run-Id": arg("--run-id") ?? `demo_${Date.now().toString(36)}` }
+        }
+      })
+    );
+  } else {
+    const cli = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../cli.js");
+    await client.connect(
+      new StdioClientTransport2({
+        command: process.execPath,
+        args: [cli, "proxy", "--config", config],
+        stderr: "inherit"
+      })
+    );
+  }
+  try {
+    const steps = await runDemoAgent(client, {
+      log: (l) => console.log(l),
+      runId: arg("--run-id")
+    });
+    const halts = steps.filter((s) => !s.ok).map((s) => s.code);
+    console.log(
+      `
+${steps.length} calls; halts: ${halts.join(", ") || "none"}. Now run: agentguard report`
+    );
+  } finally {
+    await client.close();
+  }
+}
+
+// src/cli.ts
+import { readFileSync as readFileSync4 } from "fs";
+
+// src/commands/control.ts
+async function pokeHttp(io, reg, path2, body) {
+  if (!reg) return;
+  try {
+    const res = await fetch(`${reg.baseUrl}${path2}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${reg.token}`, "Content-Type": "application/json" },
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (!res.ok)
+      io.err(
+        `running proxy at ${reg.baseUrl} answered ${res.status} (the file switch still applies)`
+      );
+  } catch {
+    io.err(
+      `no proxy answering at ${reg.baseUrl} (stale ${reg.pid}?) \u2014 the file switch still applies`
+    );
+  }
+}
+async function killCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const reason = args.positionals.join(" ") || flagString(args, "reason") || `agentguard kill by ${io.env.USER ?? "operator"}`;
+  kill.kill(reason);
+  await pokeHttp(io, readRegistration(loaded), "/kill", { reason });
+  io.out(
+    `KILLED: ${kill.path} written \u2014 every tool call through this policy now returns KILLED. Clear with: agentguard resume`
+  );
+  return 0;
+}
+async function resumeCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });
+  kill.resume();
+  await pokeHttp(io, readRegistration(loaded), "/resume");
+  io.out(`resumed: ${kill.path} removed`);
+  if (io.env[loaded.policy.kill.env])
+    io.err(
+      `note: ${loaded.policy.kill.env} is set in this shell's environment; proxies started from it stay killed`
+    );
+  return 0;
+}
+async function decideCommand(decision, args, io) {
+  const id = args.positionals[0];
+  if (!id) {
+    io.err(
+      `usage: agentguard ${decision === "approved" ? "approve" : "deny"} <approval-id> [--by name] [--note text]`
+    );
+    return 1;
+  }
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const record = await guard.decide(
+    id,
+    decision,
+    flagString(args, "by") ?? io.env.USER ?? "cli",
+    flagString(args, "note")
+  );
+  if (!record) {
+    io.err(`no approval ${id} \u2014 pending ones: agentguard approvals`);
+    return 1;
+  }
+  io.out(
+    `${record.status}: ${record.tool} (${record.id}, run ${record.run_id})${record.status === "approved" ? " \u2014 the agent may now retry the identical call once" : ""}`
+  );
+  return 0;
+}
+async function approvalsCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const list = await guard.approvals.list(flagBool(args, "all") ? void 0 : "pending");
+  if (flagBool(args, "json")) {
+    io.out(JSON.stringify(list, null, 2));
+    return 0;
+  }
+  if (list.length === 0) {
+    io.out(flagBool(args, "all") ? "no approvals recorded" : "no pending approvals");
+    return 0;
+  }
+  for (const r of list) {
+    io.out(
+      `${r.id}  ${r.status.padEnd(9)} ${r.tool}  run ${r.run_id}${r.agent ? ` agent ${r.agent}` : ""}  expires ${r.expires_at}`
+    );
+    io.out(`  args: ${JSON.stringify(r.args).slice(0, 300)}`);
+    if (r.status === "pending")
+      io.out(`  \u2192 agentguard approve ${r.id}   |   agentguard deny ${r.id}`);
+  }
+  return 0;
+}
+
+// src/commands/keys.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import YAML2, { isMap, isSeq, YAMLSeq } from "yaml";
+import { generateAgentKey, hashAgentKey } from "@agentwares/agentguard-core";
+async function keyCommand(args, io) {
+  const [sub, name] = args.positionals;
+  const path2 = policyPathFrom(args, io);
+  const doc = YAML2.parseDocument(readFileSync3(path2, "utf8"));
+  let agents = doc.get("agents");
+  if (!isSeq(agents)) {
+    agents = new YAMLSeq();
+    doc.set("agents", agents);
+  }
+  const seq = agents;
+  const items = seq.items.filter(isMap);
+  if (sub === "list" || sub === void 0) {
+    if (items.length === 0)
+      io.out(
+        "no agents in agentguard.yaml \u2014 create one: agentguard key create <name> --allow 'crm_get_*'"
+      );
+    for (const a of items) {
+      const allow2 = a.get("allow");
+      io.out(
+        `${String(a.get("name")).padEnd(20)} key: ${a.get("key_hash") ? "set" : "none (stdio --agent only)"}  allow: ${isSeq(allow2) ? allow2.items.map(String).join(", ") : "all"}`
+      );
+    }
+    return 0;
+  }
+  if (!name) {
+    io.err(
+      "usage: agentguard key create <agent> [--allow pattern]... [--deny pattern]... [--writes n] [--spend n] [--deletes n] [--emails n] [--tool-calls n] [--mode dry-run|enforce] [--upstream name]..."
+    );
+    return 1;
+  }
+  if (sub === "revoke") {
+    const idx = items.findIndex((a) => a.get("name") === name);
+    if (idx < 0) {
+      io.err(`no agent "${name}"`);
+      return 1;
+    }
+    seq.items.splice(seq.items.indexOf(items[idx]), 1);
+    writeFileSync4(path2, doc.toString());
+    io.out(`revoked ${name}: removed from agentguard.yaml (running proxies pick it up on restart)`);
+    return 0;
+  }
+  if (sub !== "create") {
+    io.err(`unknown subcommand "${sub}" \u2014 use create, list or revoke`);
+    return 1;
+  }
+  const key = generateAgentKey();
+  const keyHash = await hashAgentKey(key);
+  const existing = items.find((a) => a.get("name") === name);
+  const entry = { name, key_hash: keyHash };
+  const allow = flagList(args, "allow");
+  const deny = flagList(args, "deny");
+  if (allow.length) entry.allow = allow;
+  if (deny.length) entry.deny = deny;
+  const upstreams = flagList(args, "upstream");
+  if (upstreams.length) entry.upstreams = upstreams;
+  const mode = flagString(args, "mode");
+  if (mode) entry.mode = mode;
+  const perRun = {};
+  for (const [flag, counter2] of [
+    ["writes", "writes"],
+    ["spend", "spend_usd"],
+    ["deletes", "deletes"],
+    ["emails", "emails"],
+    ["tool-calls", "tool_calls"]
+  ]) {
+    const n = flagNumber(args, flag);
+    if (n !== void 0) perRun[counter2] = n;
+  }
+  if (Object.keys(perRun).length) entry.caps = { per_run: perRun };
+  if (existing) {
+    for (const [k, v] of Object.entries(entry)) existing.set(k, v);
+  } else {
+    seq.add(doc.createNode(entry));
+  }
+  writeFileSync4(path2, doc.toString());
+  io.err(
+    `${existing ? "rotated" : "created"} agent "${name}" in ${path2}${allow.length ? ` (allow: ${allow.join(", ")})` : " (allow: all tools)"}`
+  );
+  io.err(
+    "the key is shown once; give it to the agent as `Authorization: Bearer <key>` (HTTP) \u2014 over stdio use `agentguard proxy --agent " + name + "`"
+  );
+  io.out(key);
+  return 0;
+}
+
+// src/commands/proxy.ts
+import { resolveAgent as resolveAgent2 } from "@agentwares/agentguard-core";
+function newRunId(now = /* @__PURE__ */ new Date()) {
+  return `run_${now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;
+}
+async function proxyCommand(args, io) {
+  const loaded = loadPolicyFor(args, io);
+  const log = (line) => io.err(`[agentguard] ${line}`);
+  const modeOverride = flagString(args, "mode");
+  if (modeOverride === "dry-run" || modeOverride === "enforce") loaded.policy.mode = modeOverride;
+  const agentName = flagString(args, "agent");
+  let agent = void 0;
+  if (agentName) {
+    const resolved = await resolveAgent2(loaded.policy, { name: agentName });
+    if (resolved.error) {
+      io.err(
+        `unknown agent "${agentName}" \u2014 agents in agentguard.yaml: ${loaded.policy.agents.map((a) => a.name).join(", ") || "none"}`
+      );
+      return 1;
+    }
+    agent = resolved.agent;
+  }
+  const http = flagBool(args, "http") === true;
+  let approvalBase;
+  const fileGuard = createFileGuard(loaded, {
+    log,
+    env: io.env,
+    approvalUrl: (r) => approvalBase ? `${approvalBase.baseUrl}/approve/${r.id}?token=${approvalBase.token}` : void 0,
+    onEvent: (e) => {
+      if (e.type === "APPROVAL_DECIDED") return;
+      log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : ""}`);
+      if (e.type === "APPROVAL_REQUIRED" && e.approval)
+        log(`approve with: agentguard approve ${e.approval.id}`);
+    }
+  });
+  const runtime = new ProxyRuntime({
+    loaded,
+    guard: fileGuard.guard,
+    agent,
+    defaultRunId: flagString(args, "run-id") ?? newRunId(),
+    log
+  });
+  await runtime.start();
+  const killed = await fileGuard.kill.check();
+  if (killed.killed)
+    log(
+      `kill switch is ON (${killed.reason}); every call returns KILLED until \`agentguard resume\``
+    );
+  if (http) {
+    const server2 = await startHttpProxy({
+      runtime,
+      port: flagNumber(args, "port") ?? 8788,
+      host: flagString(args, "host") ?? "127.0.0.1",
+      token: io.env.AGENTGUARD_HTTP_TOKEN
+    });
+    approvalBase = { baseUrl: server2.url.replace(/\/mcp$/, ""), token: server2.token };
+    log(
+      `Streamable HTTP at ${server2.url} \xB7 GET ${approvalBase.baseUrl}/health \xB7 control token in ${loaded.stateDir}/http.json`
+    );
+    log(
+      `point your agent at ${server2.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`
+    );
+    const stop2 = async () => {
+      await server2.close();
+      await runtime.close();
+      process.exit(0);
+    };
+    process.once("SIGINT", () => void stop2());
+    process.once("SIGTERM", () => void stop2());
+    await new Promise(() => void 0);
+  }
+  const server = createDownstreamServer(runtime);
+  const stop = async () => {
+    await runtime.close();
+  };
+  process.once("SIGINT", () => void stop().then(() => process.exit(0)));
+  process.once("SIGTERM", () => void stop().then(() => process.exit(0)));
+  await serveStdio(server);
+  await stop();
+  return 0;
+}
+
+// src/commands/report.ts
+import { resolve as resolve4 } from "path";
+import {
+  buildReport,
+  latestRunId,
+  listRuns,
+  renderMutationDiff,
+  renderReportMarkdown
+} from "@agentwares/agentguard-core";
+import { readAuditFile, verifyAuditFile } from "@agentwares/agentguard-core/node";
+function pickRun(args, entries) {
+  if (flagBool(args, "all")) return void 0;
+  return flagString(args, "run") ?? latestRunId(entries);
+}
+async function reportCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const entries = readAuditFile(loaded.auditPath);
+  const runId = pickRun(args, entries);
+  const report = buildReport(entries, { runId });
+  if (flagBool(args, "json")) {
+    io.out(
+      JSON.stringify(
+        {
+          ...report,
+          mutations: report.mutations.map((m) => ({
+            seq: m.seq,
+            ts: m.ts,
+            tool: m.tool,
+            mutation: m.mutation
+          }))
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  io.out(renderReportMarkdown(report));
+  const chain = await verifyAuditFile(loaded.auditPath);
+  io.out(
+    chain.ok ? `Audit chain: ${chain.entries} entries, verified (${loaded.auditPath}).` : `Audit chain BROKEN at entry ${chain.brokenAt}: ${chain.reason}`
+  );
+  if (runId && listRuns(entries).length > 1) io.out(`Other runs: agentguard report --all`);
+  return 0;
+}
+async function diffCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const entries = readAuditFile(loaded.auditPath);
+  const runId = pickRun(args, entries);
+  io.out(renderMutationDiff(entries, { runId }).trimEnd());
+  return 0;
+}
+async function verifyCommand(args, io) {
+  let path2 = args.positionals[0];
+  if (!path2) path2 = loadPolicyFor(args, io, { allowMissingEnv: true }).auditPath;
+  path2 = resolve4(io.cwd, path2);
+  const result = await verifyAuditFile(path2);
+  if (flagBool(args, "json")) io.out(JSON.stringify({ path: path2, ...result }));
+  else if (result.ok)
+    io.out(
+      `ok: ${result.entries} entries, chain intact, head ${result.head?.slice(0, 16)}\u2026 (${path2})`
+    );
+  else io.out(`BROKEN at entry ${result.brokenAt}: ${result.reason} (${path2})`);
+  return result.ok ? 0 : 1;
+}
+async function statusCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { guard, kill } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const entries = readAuditFile(loaded.auditPath);
+  const runId = flagString(args, "run") ?? latestRunId(entries) ?? "(none yet)";
+  const status = await guard.status(runId);
+  const killed = kill.check();
+  const reg = readRegistration(loaded);
+  const pending = await guard.approvals.list("pending");
+  if (flagBool(args, "json")) {
+    io.out(
+      JSON.stringify(
+        {
+          policy: loaded.path,
+          mode: loaded.policy.mode,
+          runId,
+          ...status,
+          killed,
+          pendingApprovals: pending.length,
+          http: reg ? { url: reg.url, pid: reg.pid } : void 0
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  io.out(
+    `policy   ${loaded.path} (mode: ${loaded.policy.mode}, ${loaded.policy.upstreams.length} upstreams)`
+  );
+  io.out(
+    `kill     ${killed.killed ? `ON \u2014 ${killed.reason} (agentguard resume to clear)` : "off"}`
+  );
+  io.out(
+    `http     ${reg ? `${reg.url} (pid ${reg.pid})` : "not running (agentguard proxy --http)"}`
+  );
+  io.out(`audit    ${entries.length} entries in ${loaded.auditPath}`);
+  io.out(
+    `pending  ${pending.length} approval${pending.length === 1 ? "" : "s"}${pending.length ? ` \u2014 agentguard approvals` : ""}`
+  );
+  io.out(`run      ${runId}`);
+  const fmt = (scope) => Object.entries(status.caps[scope]).map(([k, limit]) => `${k} ${status.usage[scope][k] ?? 0}/${limit}`).join("  ") || "no caps";
+  io.out(`  per_run  ${fmt("per_run")}`);
+  io.out(`  per_day  ${fmt("per_day")}`);
+  return 0;
+}
+
+// src/cli.ts
+function version2() {
+  try {
+    return JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return "0.0.0";
+  }
+}
+var HELP = `agentguard \u2014 MCP policy proxy for agents that touch production
+
+  npx @agentwares/agentguard init                 read your MCP config, write agentguard.yaml (dry-run), route every server through the proxy
+  agentguard report [--run id|--all]  what this run did / would have destroyed / spent, where it was halted
+  agentguard diff [--run id]          record-by-record mutation diff from a dry run
+  agentguard verify [audit.jsonl]     prove the hash-chained audit log was not edited
+
+  agentguard proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]
+  agentguard tools [--json]           the tools your agent will see, with class and why
+  agentguard status [--run id]        counters vs caps, kill state, pending approvals
+
+  agentguard kill [reason]            halt every run now (file + running HTTP proxy);  agentguard resume
+  agentguard approvals [--all]        pending approvals;  agentguard approve <id> | deny <id> [--note text]
+  agentguard key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]
+  agentguard key list | revoke <agent>
+  agentguard permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]
+
+Options: --config <agentguard.yaml> (or AGENTGUARD_CONFIG), --json, --help, --version
+Docs: https://github.com/agentwares/agentwares/tree/main/apps/agentguard-cli`;
+async function main(argv, io = defaultIo()) {
+  const args = parseArgs(argv);
+  if (args.flags.version) {
+    io.out(version2());
+    return 0;
+  }
+  if (args.command === void 0 && !args.flags.help && io.tty === false) {
+    try {
+      return await proxyCommand(args, io);
+    } catch (err) {
+      io.err(describeError(err));
+      return 1;
+    }
+  }
+  if (args.flags.help || args.command === void 0 || args.command === "help") {
+    io.out(HELP);
+    return args.command === void 0 && !args.flags.help ? 1 : 0;
+  }
+  try {
+    switch (args.command) {
+      case "init":
+        return await initCommand(args, io);
+      case "proxy":
+      case "serve":
+        return await proxyCommand(args, io);
+      case "report":
+        return await reportCommand(args, io);
+      case "diff":
+        return await diffCommand(args, io);
+      case "verify":
+        return await verifyCommand(args, io);
+      case "status":
+        return await statusCommand(args, io);
+      case "tools":
+        return await toolsCommand(args, io);
+      case "kill":
+        return await killCommand(args, io);
+      case "resume":
+        return await resumeCommand(args, io);
+      case "approve":
+        return await decideCommand("approved", args, io);
+      case "deny":
+        return await decideCommand("denied", args, io);
+      case "approvals":
+        return await approvalsCommand(args, io);
+      case "key":
+      case "keys":
+        return await keyCommand(args, io);
+      case "permission-diff":
+        return await permissionDiffCommand(args, io);
+      default:
+        io.err(`unknown command "${args.command}"
+`);
+        io.err(HELP);
+        return 1;
+    }
+  } catch (err) {
+    io.err(describeError(err));
+    return 1;
+  }
+}
+var isMain3 = process.argv[1] !== void 0 && /(^|\/)(cli\.[cm]?[jt]s|agentguard)$/.test(process.argv[1]);
+if (isMain3) {
+  main(process.argv.slice(2)).then(
+    (code) => {
+      if (code !== 0) process.exitCode = code;
+    },
+    (err) => {
+      process.stderr.write(`${describeError(err)}
+`);
+      process.exitCode = 1;
+    }
+  );
+}
+export {
+  DEFAULT_PERMISSION_PATHS,
+  HELP,
+  ProxyRuntime,
+  approvalSlackMessage,
+  candidateConfigs,
+  createAlerter,
+  createCrmMcpServer,
+  createDownstreamServer,
+  createFileGuard,
+  crmTools,
+  detectClientConfigs,
+  haltSlackMessage,
+  loadPolicyFor,
+  main,
+  probeUpstreams,
+  proxyEntry,
+  readRegistration,
+  readServers,
+  registrationPath,
+  renderStarterPolicy,
+  restoreClientConfig,
+  rewriteClientConfig,
+  runDemoAgent,
+  runIdFor,
+  runPermissionDiff,
+  seedState,
+  serversToUpstreams,
+  startHttpProxy,
+  toCallToolResult
+};
+//# sourceMappingURL=index.js.map