@dotsetlabs/tollgate 0.1.0

package/dist/approval/terminal.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Terminal-based approval handler for Tollgate
+ *
+ * Prompts users in the terminal for approval of tool calls,
+ * with support for session-based duration options.
+ */
+import type { ApprovalHandler, ApprovalRequest, ApprovalResponse } from './types.js';
+/**
+ * Terminal approval handler that prompts users via stdin/stdout.
+ *
+ * Supports session-based approvals where users can approve for a duration:
+ * - `y` or `yes` - Approve once (no session grant)
+ * - `5` - Approve and grant for 5 minutes
+ * - `15` - Approve and grant for 15 minutes
+ * - `s` or `session` - Approve for the entire session
+ * - `n` or `no` - Deny
+ * - `d` - Show details (future feature)
+ *
+ * @example
+ * ```typescript
+ * const handler = new TerminalApprovalHandler(60000);
+ * const response = await handler.prompt(request);
+ *
+ * if (response.result === 'approved') {
+ *   if (response.sessionGrant) {
+ *     // User approved with a session duration
+ *     console.log(`Granted for ${response.sessionGrant.duration}`);
+ *   }
+ * }
+ * ```
+ */
+export declare class TerminalApprovalHandler implements ApprovalHandler {
+    private rl;
+    private timeoutMs;
+    constructor(timeoutMs?: number);
+    prompt(request: ApprovalRequest): Promise<ApprovalResponse>;
+    /**
+     * Prints the approval prompt to stderr (stdout is used by MCP).
+     */
+    private printPrompt;
+    /**
+     * Formats risk level with appropriate color.
+     */
+    private formatRisk;
+    /**
+     * Waits for user input with timeout.
+     */
+    private waitForInput;
+    /**
+     * Parses user input into an approval result with optional session grant.
+     */
+    private parseInput;
+    /**
+     * Checks if a duration is in the allowed list.
+     */
+    private isValidDuration;
+    close(): void;
+}
+//# sourceMappingURL=terminal.d.ts.map

package/dist/approval/terminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../src/approval/terminal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAGjB,MAAM,YAAY,CAAC;AAapB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,OAAO,CAAC,EAAE,CAAmC;IAC7C,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,GAAE,MAAoC;IAIrD,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBjE;;OAEG;IACH,OAAO,CAAC,WAAW;IAgDnB;;OAEG;IACH,OAAO,CAAC,UAAU;IAiBlB;;OAEG;YACW,YAAY;IA2C1B;;OAEG;IACH,OAAO,CAAC,UAAU;IAsFlB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB,KAAK,IAAI,IAAI;CAId"}

package/dist/approval/terminal.js

@@ -0,0 +1,238 @@
+/**
+ * Terminal-based approval handler for Tollgate
+ *
+ * Prompts users in the terminal for approval of tool calls,
+ * with support for session-based duration options.
+ */
+import * as readline from 'node:readline';
+import * as fs from 'node:fs';
+import chalk from 'chalk';
+import { DEFAULT_SESSION_CONFIG } from '../session/types.js';
+import { approvalLogger as logger } from '../utils/logger.js';
+import { DEFAULT_APPROVAL_TIMEOUT_MS } from '../constants.js';
+/**
+ * Terminal approval handler that prompts users via stdin/stdout.
+ *
+ * Supports session-based approvals where users can approve for a duration:
+ * - `y` or `yes` - Approve once (no session grant)
+ * - `5` - Approve and grant for 5 minutes
+ * - `15` - Approve and grant for 15 minutes
+ * - `s` or `session` - Approve for the entire session
+ * - `n` or `no` - Deny
+ * - `d` - Show details (future feature)
+ *
+ * @example
+ * ```typescript
+ * const handler = new TerminalApprovalHandler(60000);
+ * const response = await handler.prompt(request);
+ *
+ * if (response.result === 'approved') {
+ *   if (response.sessionGrant) {
+ *     // User approved with a session duration
+ *     console.log(`Granted for ${response.sessionGrant.duration}`);
+ *   }
+ * }
+ * ```
+ */
+export class TerminalApprovalHandler {
+    rl = null;
+    timeoutMs;
+    constructor(timeoutMs = DEFAULT_APPROVAL_TIMEOUT_MS) {
+        this.timeoutMs = timeoutMs;
+    }
+    async prompt(request) {
+        const startTime = Date.now();
+        const sessionConfig = request.sessionConfig ?? DEFAULT_SESSION_CONFIG;
+        const allowRemember = sessionConfig.allowRemember ?? true;
+        this.printPrompt(request, allowRemember);
+        const inputResult = await this.waitForInput(allowRemember, sessionConfig);
+        return {
+            result: inputResult.result,
+            respondedAt: new Date(),
+            durationMs: Date.now() - startTime,
+            sessionGrant: inputResult.sessionGrant,
+        };
+    }
+    /**
+     * Prints the approval prompt to stderr (stdout is used by MCP).
+     */
+    printPrompt(request, allowRemember) {
+        const { context, decision } = request;
+        console.error('');
+        console.error(chalk.yellow.bold('━'.repeat(60)));
+        console.error(chalk.yellow.bold('  TOLLGATE: Agent requesting action'));
+        console.error(chalk.yellow.bold('━'.repeat(60)));
+        console.error('');
+        console.error(`  ${chalk.dim('Server:')}  ${chalk.cyan(context.server)}`);
+        console.error(`  ${chalk.dim('Tool:')}    ${chalk.cyan(context.tool)}`);
+        console.error(`  ${chalk.dim('Rule:')}    ${chalk.dim(decision.matchedRule ?? 'default')}`);
+        // Show analysis info if available
+        if (decision.analysis) {
+            console.error(`  ${chalk.dim('Risk:')}    ${this.formatRisk(decision.analysis.risk)}`);
+        }
+        console.error('');
+        if (decision.message) {
+            console.error(`  ${chalk.white(decision.message)}`);
+            console.error('');
+        }
+        const argsStr = JSON.stringify(context.args, null, 2);
+        if (argsStr !== '{}') {
+            console.error(`  ${chalk.dim('Arguments:')}`);
+            for (const line of argsStr.split('\n')) {
+                console.error(`    ${chalk.dim(line)}`);
+            }
+            console.error('');
+        }
+        console.error(chalk.yellow.bold('━'.repeat(60)));
+        // Show options based on whether session grants are allowed
+        if (allowRemember) {
+            console.error(`  Allow? ${chalk.dim('[y]es once')} / ${chalk.green('[5]min')} / ${chalk.green('[15]min')} / ${chalk.green('[s]ession')} / ${chalk.red('[N]o')}`);
+        }
+        else {
+            console.error(`  Allow this action? ${chalk.dim('[y]es / [N]o / [d]etails')}`);
+        }
+        console.error('');
+    }
+    /**
+     * Formats risk level with appropriate color.
+     */
+    formatRisk(risk) {
+        switch (risk) {
+            case 'safe':
+                return chalk.green(risk);
+            case 'read':
+                return chalk.blue(risk);
+            case 'write':
+                return chalk.yellow(risk);
+            case 'destructive':
+                return chalk.red(risk);
+            case 'dangerous':
+                return chalk.bgRed.white(` ${risk} `);
+            default:
+                return risk;
+        }
+    }
+    /**
+     * Waits for user input with timeout.
+     */
+    async waitForInput(allowRemember, sessionConfig) {
+        return new Promise((resolve) => {
+            // Create interface on /dev/tty to read from terminal even when stdin is piped
+            let input;
+            let output;
+            try {
+                // Try to open /dev/tty for direct terminal access
+                input = fs.createReadStream('/dev/tty');
+                output = fs.createWriteStream('/dev/tty');
+            }
+            catch {
+                // Fallback to stderr for prompts (stdin might be used by MCP)
+                input = process.stdin;
+                output = process.stderr;
+            }
+            this.rl = readline.createInterface({
+                input,
+                output,
+                terminal: true,
+            });
+            const timeout = setTimeout(() => {
+                logger.warn('Approval request timed out', { timeoutMs: this.timeoutMs });
+                process.stderr.write(chalk.red('\n  Timeout - action denied\n'));
+                this.rl?.close();
+                resolve({ result: 'timeout' });
+            }, this.timeoutMs);
+            this.rl.question('  > ', (answer) => {
+                clearTimeout(timeout);
+                this.rl?.close();
+                const normalized = answer.trim().toLowerCase();
+                const result = this.parseInput(normalized, allowRemember, sessionConfig);
+                resolve(result);
+            });
+        });
+    }
+    /**
+     * Parses user input into an approval result with optional session grant.
+     */
+    parseInput(input, allowRemember, sessionConfig) {
+        // Deny responses
+        if (input === 'n' || input === 'no' || input === '') {
+            console.error(chalk.red('  Denied'));
+            return { result: 'denied' };
+        }
+        // Details (not yet implemented)
+        if (input === 'd' || input === 'details') {
+            console.error(chalk.yellow('  Details requested - feature coming soon'));
+            console.error(chalk.red('  Denied'));
+            return { result: 'denied' };
+        }
+        // Simple approval (no session)
+        if (input === 'y' || input === 'yes') {
+            console.error(chalk.green('  Approved (once)'));
+            return { result: 'approved' };
+        }
+        // Session-based approvals (only if allowed)
+        if (allowRemember) {
+            const defaultScope = sessionConfig.defaultScope ?? 'tool';
+            const allowedDurations = sessionConfig.allowedDurations ?? ['once', '5min', '15min', 'session'];
+            // 5-minute grant
+            if ((input === '5' || input === '5min') && allowedDurations.includes('5min')) {
+                console.error(chalk.green('  Approved for 5 minutes'));
+                return {
+                    result: 'approved',
+                    sessionGrant: { scope: defaultScope, duration: '5min' },
+                };
+            }
+            // 15-minute grant
+            if ((input === '15' || input === '15min') && allowedDurations.includes('15min')) {
+                console.error(chalk.green('  Approved for 15 minutes'));
+                return {
+                    result: 'approved',
+                    sessionGrant: { scope: defaultScope, duration: '15min' },
+                };
+            }
+            // 30-minute grant
+            if ((input === '30' || input === '30min') && allowedDurations.includes('30min')) {
+                console.error(chalk.green('  Approved for 30 minutes'));
+                return {
+                    result: 'approved',
+                    sessionGrant: { scope: defaultScope, duration: '30min' },
+                };
+            }
+            // Session lifetime grant
+            if ((input === 's' || input === 'session') && allowedDurations.includes('session')) {
+                console.error(chalk.green('  Approved for session'));
+                return {
+                    result: 'approved',
+                    sessionGrant: { scope: defaultScope, duration: 'session' },
+                };
+            }
+            // Advanced: scope:duration format (e.g., "server:15min", "tool:session")
+            const advancedMatch = input.match(/^(exact|tool|server):(\d+min|session)$/);
+            if (advancedMatch) {
+                const scope = advancedMatch[1];
+                const duration = advancedMatch[2];
+                if (this.isValidDuration(duration, allowedDurations)) {
+                    console.error(chalk.green(`  Approved for ${duration} (scope: ${scope})`));
+                    return {
+                        result: 'approved',
+                        sessionGrant: { scope, duration },
+                    };
+                }
+            }
+        }
+        // Unrecognized input - treat as deny
+        console.error(chalk.red(`  Unrecognized input "${input}" - denied`));
+        return { result: 'denied' };
+    }
+    /**
+     * Checks if a duration is in the allowed list.
+     */
+    isValidDuration(duration, allowed) {
+        return allowed.includes(duration);
+    }
+    close() {
+        this.rl?.close();
+        this.rl = null;
+    }
+}
+//# sourceMappingURL=terminal.js.map

package/dist/approval/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../src/approval/terminal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,OAAO,CAAC;AAQ1B,OAAO,EAAE,sBAAsB,EAAkD,MAAM,qBAAqB,CAAC;AAC7G,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAU9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,uBAAuB;IAC1B,EAAE,GAA8B,IAAI,CAAC;IACrC,SAAS,CAAS;IAE1B,YAAY,YAAoB,2BAA2B;QACzD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC;QACtE,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,IAAI,IAAI,CAAC;QAE1D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAEzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAE1E,OAAO;YACL,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,YAAY,EAAE,WAAW,CAAC,YAAY;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAwB,EAAE,aAAsB;QAClE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAEtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAE5F,kCAAkC;QAClC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAElB,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjD,2DAA2D;QAC3D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CACX,YAAY,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAClJ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CACX,wBAAwB,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,IAAY;QAC7B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,MAAM;gBACT,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,MAAM;gBACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,KAAK,OAAO;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,KAAK,aAAa;gBAChB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,KAAK,WAAW;gBACd,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YACxC;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CACxB,aAAsB,EACtB,aAAkC;QAElC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,8EAA8E;YAC9E,IAAI,KAA4B,CAAC;YACjC,IAAI,MAA6B,CAAC;YAElC,IAAI,CAAC;gBACH,kDAAkD;gBAClD,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBACxC,MAAM,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBACtB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC;YAED,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;gBACjC,KAAK;gBACL,MAAM;gBACN,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBACjE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACjC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;gBAClC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;gBAEjB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;gBACzE,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,KAAa,EACb,aAAsB,EACtB,aAAkC;QAElC,iBAAiB;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QAED,gCAAgC;QAChC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QAED,+BAA+B;QAC/B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QAED,4CAA4C;QAC5C,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,aAAa,CAAC,YAAY,IAAI,MAAM,CAAC;YAC1D,MAAM,gBAAgB,GAAG,aAAa,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAEhG,iBAAiB;YACjB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;gBACvD,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE;iBACxD,CAAC;YACJ,CAAC;YAED,kBAAkB;YAClB,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;gBACxD,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE;iBACzD,CAAC;YACJ,CAAC;YAED,kBAAkB;YAClB,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;gBACxD,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE;iBACzD,CAAC;YACJ,CAAC;YAED,yBAAyB;YACzB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBACrD,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE;iBAC3D,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAgC,CAAC;gBAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAoB,CAAC;gBAErD,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;oBACrD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,QAAQ,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC3E,OAAO;wBACL,MAAM,EAAE,UAAU;wBAClB,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;qBAClC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,KAAK,YAAY,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,QAAyB,EACzB,OAA0B;QAE1B,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;CACF"}

package/dist/approval/types.d.ts

@@ -0,0 +1,66 @@
+import type { ToolCallContext, PolicyDecision } from '../policy/types.js';
+import type { SessionScope, SessionDuration, SessionPolicyConfig } from '../session/types.js';
+export type ApprovalResult = 'approved' | 'denied' | 'timeout';
+/**
+ * Request for user approval of a tool call.
+ */
+export interface ApprovalRequest {
+    /** Unique identifier for this approval request */
+    id: string;
+    /** Context of the tool call being approved */
+    context: ToolCallContext;
+    /** Policy decision that triggered this approval */
+    decision: PolicyDecision;
+    /** When the request was created */
+    timestamp: Date;
+    /**
+     * Session configuration from policy.
+     * Controls what duration options are shown to the user.
+     */
+    sessionConfig?: SessionPolicyConfig;
+}
+/**
+ * Session grant information returned when user approves with a duration.
+ */
+export interface SessionGrantInfo {
+    /** Scope of the grant */
+    scope: SessionScope;
+    /** Duration of the grant */
+    duration: SessionDuration;
+    /** Pattern for 'pattern' scope */
+    pattern?: string;
+}
+/**
+ * Response from an approval handler.
+ */
+export interface ApprovalResponse {
+    /** The user's decision */
+    result: ApprovalResult;
+    /** When the user responded */
+    respondedAt: Date;
+    /** Time spent waiting for approval (ms) */
+    durationMs: number;
+    /**
+     * Session grant info if user approved with a duration.
+     * Undefined means single approval only (no session grant).
+     */
+    sessionGrant?: SessionGrantInfo;
+}
+/**
+ * Interface for approval handlers.
+ * Implementations can use terminal, webhook, or other approval methods.
+ */
+export interface ApprovalHandler {
+    /**
+     * Prompts the user for approval.
+     *
+     * @param request - The approval request
+     * @returns Promise resolving to the user's response
+     */
+    prompt(request: ApprovalRequest): Promise<ApprovalResponse>;
+    /**
+     * Closes any open resources (readline interfaces, etc).
+     */
+    close(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/approval/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/approval/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9F,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IAEX,8CAA8C;IAC9C,OAAO,EAAE,eAAe,CAAC;IAEzB,mDAAmD;IACnD,QAAQ,EAAE,cAAc,CAAC;IAEzB,mCAAmC;IACnC,SAAS,EAAE,IAAI,CAAC;IAEhB;;;OAGG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,KAAK,EAAE,YAAY,CAAC;IAEpB,4BAA4B;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAE1B,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,MAAM,EAAE,cAAc,CAAC;IAEvB,8BAA8B;IAC9B,WAAW,EAAE,IAAI,CAAC;IAElB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE5D;;OAEG;IACH,KAAK,IAAI,IAAI,CAAC;CACf"}

package/dist/approval/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/approval/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/approval/types.ts"],"names":[],"mappings":""}

package/dist/audit/exporter.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Audit Export Module for Tollgate
+ *
+ * Exports audit records in various formats for compliance reporting,
+ * log aggregation, and SIEM integration.
+ *
+ * Supported formats:
+ * - JSON Lines (JSONL) - for log aggregation (Splunk, ELK, etc.)
+ * - CSV - for spreadsheet analysis
+ * - CEF (Common Event Format) - for SIEM systems
+ *
+ * @example
+ * ```typescript
+ * import { AuditExporter } from './exporter.js';
+ *
+ * const exporter = new AuditExporter(logger);
+ *
+ * // Export as JSON Lines
+ * const jsonl = exporter.exportJsonLines({ since: new Date('2024-01-01') });
+ *
+ * // Export as CSV
+ * const csv = exporter.exportCsv({ useRedacted: true });
+ *
+ * // Export as CEF for SIEM
+ * const cef = exporter.exportCef({ server: 'postgres' });
+ * ```
+ */
+import type { AuditLogger } from './logger.js';
+import type { RiskLevel } from './schema.js';
+/**
+ * Options for exporting audit records.
+ */
+export interface ExportOptions {
+    /** Only include records since this date */
+    since?: Date;
+    /** Only include records until this date */
+    until?: Date;
+    /** Filter by server name */
+    server?: string;
+    /** Filter by risk level */
+    riskLevel?: RiskLevel;
+    /** Maximum number of records to export (default: all) */
+    limit?: number;
+    /** Use PII-redacted args in export (default: true for compliance) */
+    useRedacted?: boolean;
+    /** Include session grants in export */
+    includeSessionGrants?: boolean;
+}
+/**
+ * Audit exporter for generating compliance reports.
+ */
+export declare class AuditExporter {
+    private logger;
+    constructor(logger: AuditLogger);
+    /**
+     * Exports audit records as JSON Lines (JSONL).
+     *
+     * Each line is a complete JSON object, suitable for log aggregation systems.
+     *
+     * @param options - Export options
+     * @returns JSONL string with one record per line
+     */
+    exportJsonLines(options?: ExportOptions): string;
+    /**
+     * Exports audit records as CSV.
+     *
+     * @param options - Export options
+     * @returns CSV string with headers
+     */
+    exportCsv(options?: ExportOptions): string;
+    /**
+     * Exports audit records in CEF (Common Event Format).
+     *
+     * CEF is widely supported by SIEM systems like Splunk, ArcSight, and QRadar.
+     *
+     * Format: CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension
+     *
+     * @param options - Export options
+     * @returns CEF formatted string with one event per line
+     */
+    exportCef(options?: ExportOptions): string;
+    /**
+     * Gets records based on export options.
+     */
+    private getRecords;
+    /**
+     * Formats an audit record for JSON export.
+     */
+    private formatRecordForExport;
+    /**
+     * Formats a session grant for JSON export.
+     */
+    private formatGrantForExport;
+    /**
+     * Formats a CEF event from an audit record.
+     *
+     * CEF format: CEF:0|Vendor|Product|Version|SignatureID|Name|Severity|Extension
+     */
+    private formatCefEvent;
+    /**
+     * Gets the CEF signature ID for a record.
+     */
+    private getCefSignatureId;
+    /**
+     * Gets the CEF severity for a record.
+     */
+    private getCefSeverity;
+    /**
+     * Gets CEF extension fields for a record.
+     */
+    private getCefExtensions;
+    /**
+     * Escapes a value for CSV format.
+     */
+    private escapeCsv;
+    /**
+     * Escapes a CEF header field (pipe and backslash).
+     */
+    private escapeCef;
+    /**
+     * Escapes a CEF extension value (equals and newlines).
+     */
+    private escapeCefValue;
+}
+/**
+ * Export format types.
+ */
+export type ExportFormat = 'json' | 'jsonl' | 'csv' | 'cef';
+/**
+ * Creates an exporter and exports records in the specified format.
+ *
+ * @param logger - The audit logger to export from
+ * @param format - The export format
+ * @param options - Export options
+ * @returns Formatted export string
+ */
+export declare function exportAuditRecords(logger: AuditLogger, format: ExportFormat, options?: ExportOptions): string;
+//# sourceMappingURL=exporter.d.ts.map

package/dist/audit/exporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exporter.d.ts","sourceRoot":"","sources":["../../src/audit/exporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAmC,SAAS,EAAE,MAAM,aAAa,CAAC;AAE9E;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,2CAA2C;IAC3C,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uCAAuC;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAiBD;;GAEG;AACH,qBAAa,aAAa;IACZ,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC;;;;;;;OAOG;IACH,eAAe,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM;IAsBpD;;;;;OAKG;IACH,SAAS,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM;IA0D9C;;;;;;;;;OASG;IACH,SAAS,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM;IAa9C;;OAEG;IACH,OAAO,CAAC,UAAU;IAWlB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAsC7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAmB5B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAuBtB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAQtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAiDxB;;OAEG;IACH,OAAO,CAAC,SAAS;IAOjB;;OAEG;IACH,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,cAAc;CAOvB;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAE5D;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,aAAkB,GAC1B,MAAM,CA4BR"}