@getaegis/cli 0.8.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (242) hide show
  1. package/README.md +43 -14
  2. package/dist/agent/agent.d.ts +98 -0
  3. package/dist/agent/agent.d.ts.map +1 -0
  4. package/dist/agent/agent.js +212 -0
  5. package/dist/agent/agent.js.map +1 -0
  6. package/dist/agent/index.d.ts +3 -0
  7. package/dist/agent/index.d.ts.map +1 -0
  8. package/dist/agent/index.js +2 -0
  9. package/dist/agent/index.js.map +1 -0
  10. package/dist/cli/auth.d.ts +19 -0
  11. package/dist/cli/auth.d.ts.map +1 -0
  12. package/dist/cli/auth.js +44 -0
  13. package/dist/cli/auth.js.map +1 -0
  14. package/dist/cli/commands/agent.d.ts +6 -0
  15. package/dist/cli/commands/agent.d.ts.map +1 -0
  16. package/dist/cli/commands/agent.js +241 -0
  17. package/dist/cli/commands/agent.js.map +1 -0
  18. package/dist/cli/commands/config.d.ts +6 -0
  19. package/dist/cli/commands/config.d.ts.map +1 -0
  20. package/dist/cli/commands/config.js +125 -0
  21. package/dist/cli/commands/config.js.map +1 -0
  22. package/dist/cli/commands/dashboard.d.ts +6 -0
  23. package/dist/cli/commands/dashboard.d.ts.map +1 -0
  24. package/dist/cli/commands/dashboard.js +195 -0
  25. package/dist/cli/commands/dashboard.js.map +1 -0
  26. package/dist/cli/commands/db.d.ts +6 -0
  27. package/dist/cli/commands/db.d.ts.map +1 -0
  28. package/dist/cli/commands/db.js +139 -0
  29. package/dist/cli/commands/db.js.map +1 -0
  30. package/dist/cli/commands/doctor.d.ts +6 -0
  31. package/dist/cli/commands/doctor.d.ts.map +1 -0
  32. package/dist/cli/commands/doctor.js +39 -0
  33. package/dist/cli/commands/doctor.js.map +1 -0
  34. package/dist/cli/commands/gate.d.ts +6 -0
  35. package/dist/cli/commands/gate.d.ts.map +1 -0
  36. package/dist/cli/commands/gate.js +202 -0
  37. package/dist/cli/commands/gate.js.map +1 -0
  38. package/dist/cli/commands/init.d.ts +6 -0
  39. package/dist/cli/commands/init.d.ts.map +1 -0
  40. package/dist/cli/commands/init.js +175 -0
  41. package/dist/cli/commands/init.js.map +1 -0
  42. package/dist/cli/commands/key.d.ts +6 -0
  43. package/dist/cli/commands/key.d.ts.map +1 -0
  44. package/dist/cli/commands/key.js +49 -0
  45. package/dist/cli/commands/key.js.map +1 -0
  46. package/dist/cli/commands/ledger.d.ts +6 -0
  47. package/dist/cli/commands/ledger.d.ts.map +1 -0
  48. package/dist/cli/commands/ledger.js +140 -0
  49. package/dist/cli/commands/ledger.js.map +1 -0
  50. package/dist/cli/commands/mcp.d.ts +6 -0
  51. package/dist/cli/commands/mcp.d.ts.map +1 -0
  52. package/dist/cli/commands/mcp.js +224 -0
  53. package/dist/cli/commands/mcp.js.map +1 -0
  54. package/dist/cli/commands/policy.d.ts +6 -0
  55. package/dist/cli/commands/policy.d.ts.map +1 -0
  56. package/dist/cli/commands/policy.js +126 -0
  57. package/dist/cli/commands/policy.js.map +1 -0
  58. package/dist/cli/commands/user.d.ts +6 -0
  59. package/dist/cli/commands/user.d.ts.map +1 -0
  60. package/dist/cli/commands/user.js +150 -0
  61. package/dist/cli/commands/user.js.map +1 -0
  62. package/dist/cli/commands/vault-manager.d.ts +6 -0
  63. package/dist/cli/commands/vault-manager.d.ts.map +1 -0
  64. package/dist/cli/commands/vault-manager.js +240 -0
  65. package/dist/cli/commands/vault-manager.js.map +1 -0
  66. package/dist/cli/commands/vault.d.ts +6 -0
  67. package/dist/cli/commands/vault.d.ts.map +1 -0
  68. package/dist/cli/commands/vault.js +265 -0
  69. package/dist/cli/commands/vault.js.map +1 -0
  70. package/dist/cli/commands/webhook.d.ts +6 -0
  71. package/dist/cli/commands/webhook.d.ts.map +1 -0
  72. package/dist/cli/commands/webhook.js +151 -0
  73. package/dist/cli/commands/webhook.js.map +1 -0
  74. package/dist/cli/helpers.d.ts +12 -0
  75. package/dist/cli/helpers.d.ts.map +1 -0
  76. package/dist/cli/helpers.js +61 -0
  77. package/dist/cli/helpers.js.map +1 -0
  78. package/dist/cli/index.d.ts +19 -0
  79. package/dist/cli/index.d.ts.map +1 -0
  80. package/dist/cli/index.js +19 -0
  81. package/dist/cli/index.js.map +1 -0
  82. package/dist/cli/validation.d.ts +37 -0
  83. package/dist/cli/validation.d.ts.map +1 -0
  84. package/dist/cli/validation.js +104 -0
  85. package/dist/cli/validation.js.map +1 -0
  86. package/dist/cli.d.ts +3 -0
  87. package/dist/cli.d.ts.map +1 -0
  88. package/dist/cli.js +37 -0
  89. package/dist/cli.js.map +1 -0
  90. package/dist/config.d.ts +120 -0
  91. package/dist/config.d.ts.map +1 -0
  92. package/dist/config.js +401 -0
  93. package/dist/config.js.map +1 -0
  94. package/dist/dashboard/dashboard-server.d.ts +95 -0
  95. package/dist/dashboard/dashboard-server.d.ts.map +1 -0
  96. package/dist/dashboard/dashboard-server.js +329 -0
  97. package/dist/dashboard/dashboard-server.js.map +1 -0
  98. package/dist/dashboard/index.d.ts +3 -0
  99. package/dist/dashboard/index.d.ts.map +1 -0
  100. package/dist/dashboard/index.js +2 -0
  101. package/dist/dashboard/index.js.map +1 -0
  102. package/dist/dashboard/public/assets/index-Cah0_BKk.js +148 -0
  103. package/dist/dashboard/public/assets/index-CpMruPNh.css +1 -0
  104. package/dist/dashboard/public/favicon.svg +6 -0
  105. package/dist/dashboard/public/index.html +14 -0
  106. package/dist/db.d.ts +27 -0
  107. package/dist/db.d.ts.map +1 -0
  108. package/dist/db.js +209 -0
  109. package/dist/db.js.map +1 -0
  110. package/dist/doctor.d.ts +37 -0
  111. package/dist/doctor.d.ts.map +1 -0
  112. package/dist/doctor.js +216 -0
  113. package/dist/doctor.js.map +1 -0
  114. package/dist/gate/body-inspector.d.ts +31 -0
  115. package/dist/gate/body-inspector.d.ts.map +1 -0
  116. package/dist/gate/body-inspector.js +193 -0
  117. package/dist/gate/body-inspector.js.map +1 -0
  118. package/dist/gate/gate.d.ts +190 -0
  119. package/dist/gate/gate.d.ts.map +1 -0
  120. package/dist/gate/gate.js +1243 -0
  121. package/dist/gate/gate.js.map +1 -0
  122. package/dist/gate/index.d.ts +7 -0
  123. package/dist/gate/index.d.ts.map +1 -0
  124. package/dist/gate/index.js +4 -0
  125. package/dist/gate/index.js.map +1 -0
  126. package/dist/gate/rate-limiter.d.ts +59 -0
  127. package/dist/gate/rate-limiter.d.ts.map +1 -0
  128. package/dist/gate/rate-limiter.js +120 -0
  129. package/dist/gate/rate-limiter.js.map +1 -0
  130. package/dist/index.d.ts +28 -0
  131. package/dist/index.d.ts.map +1 -0
  132. package/dist/index.js +17 -0
  133. package/dist/index.js.map +1 -0
  134. package/dist/key-storage/credential-manager-windows.d.ts +19 -0
  135. package/dist/key-storage/credential-manager-windows.d.ts.map +1 -0
  136. package/dist/key-storage/credential-manager-windows.js +87 -0
  137. package/dist/key-storage/credential-manager-windows.js.map +1 -0
  138. package/dist/key-storage/file-fallback.d.ts +21 -0
  139. package/dist/key-storage/file-fallback.d.ts.map +1 -0
  140. package/dist/key-storage/file-fallback.js +62 -0
  141. package/dist/key-storage/file-fallback.js.map +1 -0
  142. package/dist/key-storage/index.d.ts +6 -0
  143. package/dist/key-storage/index.d.ts.map +1 -0
  144. package/dist/key-storage/index.js +6 -0
  145. package/dist/key-storage/index.js.map +1 -0
  146. package/dist/key-storage/key-storage.d.ts +41 -0
  147. package/dist/key-storage/key-storage.d.ts.map +1 -0
  148. package/dist/key-storage/key-storage.js +70 -0
  149. package/dist/key-storage/key-storage.js.map +1 -0
  150. package/dist/key-storage/keychain-macos.d.ts +19 -0
  151. package/dist/key-storage/keychain-macos.d.ts.map +1 -0
  152. package/dist/key-storage/keychain-macos.js +51 -0
  153. package/dist/key-storage/keychain-macos.js.map +1 -0
  154. package/dist/key-storage/secret-service-linux.d.ts +19 -0
  155. package/dist/key-storage/secret-service-linux.d.ts.map +1 -0
  156. package/dist/key-storage/secret-service-linux.js +55 -0
  157. package/dist/key-storage/secret-service-linux.js.map +1 -0
  158. package/dist/ledger/index.d.ts +3 -0
  159. package/dist/ledger/index.d.ts.map +1 -0
  160. package/dist/ledger/index.js +2 -0
  161. package/dist/ledger/index.js.map +1 -0
  162. package/dist/ledger/ledger.d.ts +98 -0
  163. package/dist/ledger/ledger.d.ts.map +1 -0
  164. package/dist/ledger/ledger.js +145 -0
  165. package/dist/ledger/ledger.js.map +1 -0
  166. package/dist/logger/index.d.ts +3 -0
  167. package/dist/logger/index.d.ts.map +1 -0
  168. package/dist/logger/index.js +2 -0
  169. package/dist/logger/index.js.map +1 -0
  170. package/dist/logger/logger.d.ts +58 -0
  171. package/dist/logger/logger.d.ts.map +1 -0
  172. package/dist/logger/logger.js +201 -0
  173. package/dist/logger/logger.js.map +1 -0
  174. package/dist/mcp/index.d.ts +3 -0
  175. package/dist/mcp/index.d.ts.map +1 -0
  176. package/dist/mcp/index.js +2 -0
  177. package/dist/mcp/index.js.map +1 -0
  178. package/dist/mcp/mcp-server.d.ts +130 -0
  179. package/dist/mcp/mcp-server.d.ts.map +1 -0
  180. package/dist/mcp/mcp-server.js +775 -0
  181. package/dist/mcp/mcp-server.js.map +1 -0
  182. package/dist/metrics/index.d.ts +3 -0
  183. package/dist/metrics/index.d.ts.map +1 -0
  184. package/dist/metrics/index.js +2 -0
  185. package/dist/metrics/index.js.map +1 -0
  186. package/dist/metrics/metrics.d.ts +88 -0
  187. package/dist/metrics/metrics.d.ts.map +1 -0
  188. package/dist/metrics/metrics.js +179 -0
  189. package/dist/metrics/metrics.js.map +1 -0
  190. package/dist/policy/index.d.ts +3 -0
  191. package/dist/policy/index.d.ts.map +1 -0
  192. package/dist/policy/index.js +2 -0
  193. package/dist/policy/index.js.map +1 -0
  194. package/dist/policy/policy.d.ts +119 -0
  195. package/dist/policy/policy.d.ts.map +1 -0
  196. package/dist/policy/policy.js +426 -0
  197. package/dist/policy/policy.js.map +1 -0
  198. package/dist/user/index.d.ts +3 -0
  199. package/dist/user/index.d.ts.map +1 -0
  200. package/dist/user/index.js +2 -0
  201. package/dist/user/index.js.map +1 -0
  202. package/dist/user/user.d.ts +102 -0
  203. package/dist/user/user.d.ts.map +1 -0
  204. package/dist/user/user.js +216 -0
  205. package/dist/user/user.js.map +1 -0
  206. package/dist/vault/crypto.d.ts +28 -0
  207. package/dist/vault/crypto.d.ts.map +1 -0
  208. package/dist/vault/crypto.js +44 -0
  209. package/dist/vault/crypto.js.map +1 -0
  210. package/dist/vault/index.d.ts +10 -0
  211. package/dist/vault/index.d.ts.map +1 -0
  212. package/dist/vault/index.js +6 -0
  213. package/dist/vault/index.js.map +1 -0
  214. package/dist/vault/seal.d.ts +68 -0
  215. package/dist/vault/seal.d.ts.map +1 -0
  216. package/dist/vault/seal.js +110 -0
  217. package/dist/vault/seal.js.map +1 -0
  218. package/dist/vault/shamir.d.ts +33 -0
  219. package/dist/vault/shamir.d.ts.map +1 -0
  220. package/dist/vault/shamir.js +174 -0
  221. package/dist/vault/shamir.js.map +1 -0
  222. package/dist/vault/vault-manager.d.ts +62 -0
  223. package/dist/vault/vault-manager.d.ts.map +1 -0
  224. package/dist/vault/vault-manager.js +151 -0
  225. package/dist/vault/vault-manager.js.map +1 -0
  226. package/dist/vault/vault.d.ts +104 -0
  227. package/dist/vault/vault.d.ts.map +1 -0
  228. package/dist/vault/vault.js +259 -0
  229. package/dist/vault/vault.js.map +1 -0
  230. package/dist/version.d.ts +3 -0
  231. package/dist/version.d.ts.map +1 -0
  232. package/dist/version.js +18 -0
  233. package/dist/version.js.map +1 -0
  234. package/dist/webhook/index.d.ts +3 -0
  235. package/dist/webhook/index.d.ts.map +1 -0
  236. package/dist/webhook/index.js +2 -0
  237. package/dist/webhook/index.js.map +1 -0
  238. package/dist/webhook/webhook.d.ts +114 -0
  239. package/dist/webhook/webhook.d.ts.map +1 -0
  240. package/dist/webhook/webhook.js +269 -0
  241. package/dist/webhook/webhook.js.map +1 -0
  242. package/package.json +12 -6
package/dist/config.js ADDED
@@ -0,0 +1,401 @@
1
+ import * as fs from 'node:fs';
2
+ import * as path from 'node:path';
3
+ import { fileURLToPath } from 'node:url';
4
+ import { parse as parseYaml } from 'yaml';
5
+ import { getKeyStorage } from './key-storage/index.js';
6
+ // ─── Defaults ─────────────────────────────────────────────────────
7
+ const DEFAULTS = {
8
+ port: 3100,
9
+ masterKey: '',
10
+ salt: 'aegis-vault-v1',
11
+ dataDir: path.join(process.cwd(), '.aegis'),
12
+ logLevel: 'info',
13
+ logFormat: 'json',
14
+ vaultName: 'default',
15
+ requireAgentAuth: true,
16
+ policyMode: 'enforce',
17
+ metricsEnabled: true,
18
+ dashboard: { enabled: false, port: 3200 },
19
+ mcp: { transport: 'stdio', port: 3200 },
20
+ webhooks: [],
21
+ maxBodySize: 1_048_576, // 1 MB
22
+ requestTimeout: 30_000, // 30 seconds
23
+ maxConnectionsPerAgent: 50,
24
+ };
25
+ // ─── Config File Discovery ────────────────────────────────────────
26
+ /** Search order for config file, relative to CWD. */
27
+ const CONFIG_FILE_NAMES = ['aegis.config.yaml', 'aegis.config.yml'];
28
+ /**
29
+ * Find the config file path, checking CWD first, then the CLI script's directory.
30
+ * The script directory fallback ensures MCP servers spawned by Claude Desktop /
31
+ * Cursor (which set cwd=/) can still find the config file next to the CLI.
32
+ * Returns absolute path or null if not found.
33
+ */
34
+ export function findConfigFile(cwd) {
35
+ const searchDir = cwd ?? process.cwd();
36
+ // Search the given (or current) directory
37
+ for (const name of CONFIG_FILE_NAMES) {
38
+ const filePath = path.join(searchDir, name);
39
+ if (fs.existsSync(filePath))
40
+ return filePath;
41
+ }
42
+ // Fallback: search relative to the CLI script's directory — but only when
43
+ // no explicit cwd was provided (so tests that pass a temp dir aren't polluted).
44
+ if (cwd === undefined) {
45
+ const scriptDir = path.dirname(fileURLToPath(import.meta.url));
46
+ const projectDir = path.resolve(scriptDir, '..');
47
+ if (projectDir !== searchDir) {
48
+ for (const name of CONFIG_FILE_NAMES) {
49
+ const filePath = path.join(projectDir, name);
50
+ if (fs.existsSync(filePath))
51
+ return filePath;
52
+ }
53
+ }
54
+ }
55
+ return null;
56
+ }
57
+ /**
58
+ * Parse a YAML config file. Returns the parsed object.
59
+ * Throws on invalid YAML or file read errors.
60
+ */
61
+ export function parseConfigFile(filePath) {
62
+ const content = fs.readFileSync(filePath, 'utf-8');
63
+ const parsed = parseYaml(content);
64
+ if (parsed === null || parsed === undefined)
65
+ return {};
66
+ if (typeof parsed !== 'object' || Array.isArray(parsed)) {
67
+ throw new Error(`Config file must be a YAML mapping, got ${typeof parsed}.`);
68
+ }
69
+ return parsed;
70
+ }
71
+ const VALID_LOG_LEVELS = ['debug', 'info', 'warn', 'error'];
72
+ const VALID_LOG_FORMATS = ['json', 'pretty'];
73
+ const VALID_POLICY_MODES = ['enforce', 'dry-run', 'off'];
74
+ const VALID_MCP_TRANSPORTS = ['stdio', 'streamable-http'];
75
+ const VALID_WEBHOOK_EVENTS = [
76
+ 'blocked_request',
77
+ 'credential_expiry',
78
+ 'rate_limit_exceeded',
79
+ 'agent_auth_failure',
80
+ 'body_inspection',
81
+ ];
82
+ /**
83
+ * Validate a parsed config file. Returns an array of errors (empty = valid).
84
+ */
85
+ export function validateConfigFile(config) {
86
+ const errors = [];
87
+ if (config.gate !== undefined) {
88
+ if (config.gate.port !== undefined) {
89
+ if (typeof config.gate.port !== 'number' ||
90
+ config.gate.port < 1 ||
91
+ config.gate.port > 65535) {
92
+ errors.push({ path: 'gate.port', message: 'Must be a number between 1 and 65535.' });
93
+ }
94
+ }
95
+ if (config.gate.tls !== undefined) {
96
+ if (typeof config.gate.tls !== 'object' || config.gate.tls === null) {
97
+ errors.push({ path: 'gate.tls', message: 'Must be an object with cert and key paths.' });
98
+ }
99
+ else {
100
+ if (!config.gate.tls.cert) {
101
+ errors.push({ path: 'gate.tls.cert', message: 'TLS certificate path is required.' });
102
+ }
103
+ if (!config.gate.tls.key) {
104
+ errors.push({ path: 'gate.tls.key', message: 'TLS private key path is required.' });
105
+ }
106
+ }
107
+ }
108
+ if (config.gate.require_agent_auth !== undefined &&
109
+ typeof config.gate.require_agent_auth !== 'boolean') {
110
+ errors.push({ path: 'gate.require_agent_auth', message: 'Must be true or false.' });
111
+ }
112
+ if (config.gate.policy_mode !== undefined &&
113
+ !VALID_POLICY_MODES.includes(config.gate.policy_mode)) {
114
+ errors.push({
115
+ path: 'gate.policy_mode',
116
+ message: `Must be one of: ${VALID_POLICY_MODES.join(', ')}.`,
117
+ });
118
+ }
119
+ if (config.gate.policies_dir !== undefined && typeof config.gate.policies_dir !== 'string') {
120
+ errors.push({ path: 'gate.policies_dir', message: 'Must be a string path.' });
121
+ }
122
+ if (config.gate.max_body_size !== undefined) {
123
+ if (typeof config.gate.max_body_size !== 'number' || config.gate.max_body_size < 1) {
124
+ errors.push({ path: 'gate.max_body_size', message: 'Must be a positive number (bytes).' });
125
+ }
126
+ }
127
+ if (config.gate.request_timeout !== undefined) {
128
+ if (typeof config.gate.request_timeout !== 'number' || config.gate.request_timeout < 1000) {
129
+ errors.push({
130
+ path: 'gate.request_timeout',
131
+ message: 'Must be a number >= 1000 (milliseconds).',
132
+ });
133
+ }
134
+ }
135
+ if (config.gate.max_connections_per_agent !== undefined) {
136
+ if (typeof config.gate.max_connections_per_agent !== 'number' ||
137
+ config.gate.max_connections_per_agent < 1) {
138
+ errors.push({
139
+ path: 'gate.max_connections_per_agent',
140
+ message: 'Must be a positive number.',
141
+ });
142
+ }
143
+ }
144
+ }
145
+ if (config.vault !== undefined) {
146
+ if (config.vault.name !== undefined && typeof config.vault.name !== 'string') {
147
+ errors.push({ path: 'vault.name', message: 'Must be a string.' });
148
+ }
149
+ if (config.vault.data_dir !== undefined && typeof config.vault.data_dir !== 'string') {
150
+ errors.push({ path: 'vault.data_dir', message: 'Must be a string path.' });
151
+ }
152
+ }
153
+ if (config.observability !== undefined) {
154
+ if (config.observability.log_level !== undefined &&
155
+ !VALID_LOG_LEVELS.includes(config.observability.log_level)) {
156
+ errors.push({
157
+ path: 'observability.log_level',
158
+ message: `Must be one of: ${VALID_LOG_LEVELS.join(', ')}.`,
159
+ });
160
+ }
161
+ if (config.observability.log_format !== undefined &&
162
+ !VALID_LOG_FORMATS.includes(config.observability.log_format)) {
163
+ errors.push({
164
+ path: 'observability.log_format',
165
+ message: `Must be one of: ${VALID_LOG_FORMATS.join(', ')}.`,
166
+ });
167
+ }
168
+ if (config.observability.metrics !== undefined &&
169
+ typeof config.observability.metrics !== 'boolean') {
170
+ errors.push({ path: 'observability.metrics', message: 'Must be true or false.' });
171
+ }
172
+ if (config.observability.dashboard !== undefined) {
173
+ if (typeof config.observability.dashboard !== 'object' ||
174
+ config.observability.dashboard === null) {
175
+ errors.push({
176
+ path: 'observability.dashboard',
177
+ message: 'Must be an object with enabled and port.',
178
+ });
179
+ }
180
+ else {
181
+ if (config.observability.dashboard.enabled !== undefined &&
182
+ typeof config.observability.dashboard.enabled !== 'boolean') {
183
+ errors.push({
184
+ path: 'observability.dashboard.enabled',
185
+ message: 'Must be true or false.',
186
+ });
187
+ }
188
+ if (config.observability.dashboard.port !== undefined) {
189
+ if (typeof config.observability.dashboard.port !== 'number' ||
190
+ config.observability.dashboard.port < 1 ||
191
+ config.observability.dashboard.port > 65535) {
192
+ errors.push({
193
+ path: 'observability.dashboard.port',
194
+ message: 'Must be a number between 1 and 65535.',
195
+ });
196
+ }
197
+ }
198
+ }
199
+ }
200
+ }
201
+ if (config.mcp !== undefined) {
202
+ if (config.mcp.transport !== undefined &&
203
+ !VALID_MCP_TRANSPORTS.includes(config.mcp.transport)) {
204
+ errors.push({
205
+ path: 'mcp.transport',
206
+ message: `Must be one of: ${VALID_MCP_TRANSPORTS.join(', ')}.`,
207
+ });
208
+ }
209
+ if (config.mcp.port !== undefined) {
210
+ if (typeof config.mcp.port !== 'number' || config.mcp.port < 1 || config.mcp.port > 65535) {
211
+ errors.push({ path: 'mcp.port', message: 'Must be a number between 1 and 65535.' });
212
+ }
213
+ }
214
+ }
215
+ if (config.webhooks !== undefined) {
216
+ if (!Array.isArray(config.webhooks)) {
217
+ errors.push({ path: 'webhooks', message: 'Must be an array.' });
218
+ }
219
+ else {
220
+ for (let i = 0; i < config.webhooks.length; i++) {
221
+ const wh = config.webhooks[i];
222
+ if (!wh.url || typeof wh.url !== 'string') {
223
+ errors.push({
224
+ path: `webhooks[${i}].url`,
225
+ message: 'URL is required and must be a string.',
226
+ });
227
+ }
228
+ else {
229
+ try {
230
+ new URL(wh.url);
231
+ }
232
+ catch {
233
+ errors.push({ path: `webhooks[${i}].url`, message: 'Must be a valid URL.' });
234
+ }
235
+ }
236
+ if (wh.events !== undefined) {
237
+ if (!Array.isArray(wh.events)) {
238
+ errors.push({
239
+ path: `webhooks[${i}].events`,
240
+ message: 'Must be an array of event types.',
241
+ });
242
+ }
243
+ else {
244
+ for (const evt of wh.events) {
245
+ if (!VALID_WEBHOOK_EVENTS.includes(evt)) {
246
+ errors.push({
247
+ path: `webhooks[${i}].events`,
248
+ message: `Unknown event "${evt}". Valid: ${VALID_WEBHOOK_EVENTS.join(', ')}.`,
249
+ });
250
+ }
251
+ }
252
+ }
253
+ }
254
+ }
255
+ }
256
+ }
257
+ return errors;
258
+ }
259
+ // ─── Config Resolution ────────────────────────────────────────────
260
+ function loadEnv(filePath) {
261
+ const env = {};
262
+ if (!fs.existsSync(filePath))
263
+ return env;
264
+ const content = fs.readFileSync(filePath, 'utf-8');
265
+ for (const line of content.split('\n')) {
266
+ const trimmed = line.trim();
267
+ if (!trimmed || trimmed.startsWith('#'))
268
+ continue;
269
+ const eqIndex = trimmed.indexOf('=');
270
+ if (eqIndex === -1)
271
+ continue;
272
+ const key = trimmed.slice(0, eqIndex).trim();
273
+ const value = trimmed.slice(eqIndex + 1).trim();
274
+ env[key] = value;
275
+ }
276
+ return env;
277
+ }
278
+ /**
279
+ * Load and resolve the full Aegis configuration.
280
+ *
281
+ * Resolution order (highest priority wins):
282
+ * 1. Environment variables (AEGIS_*)
283
+ * 2. Config file (aegis.config.yaml)
284
+ * 3. Built-in defaults
285
+ *
286
+ * The .env file is loaded into the environment variable layer.
287
+ * The master key has special handling: env → unseal key file → empty.
288
+ */
289
+ export function getConfig() {
290
+ // Layer 2: Config file (resolve first so we know baseDir for .env)
291
+ const configFilePath = findConfigFile();
292
+ // Base directory for resolving relative paths:
293
+ // If a config file was found, use its directory (so MCP servers spawned
294
+ // from any cwd still resolve .aegis/ correctly). Otherwise use process.cwd().
295
+ const baseDir = configFilePath ? path.dirname(path.resolve(configFilePath)) : process.cwd();
296
+ // Layer 1: .env (loaded into env layer, searched relative to baseDir)
297
+ const dotenv = loadEnv(path.join(baseDir, '.env'));
298
+ const getEnv = (key) => process.env[key] ?? dotenv[key];
299
+ let fileConfig = {};
300
+ if (configFilePath) {
301
+ fileConfig = parseConfigFile(configFilePath);
302
+ }
303
+ // Resolve data directory (env → config file → default)
304
+ const rawDataDir = getEnv('AEGIS_DATA_DIR') ?? fileConfig.vault?.data_dir ?? DEFAULTS.dataDir;
305
+ const dataDir = path.isAbsolute(rawDataDir) ? rawDataDir : path.resolve(baseDir, rawDataDir);
306
+ // Ensure data directory exists
307
+ if (!fs.existsSync(dataDir)) {
308
+ fs.mkdirSync(dataDir, { recursive: true });
309
+ }
310
+ // Master key resolution: env → config file → OS keychain → unseal key file → empty
311
+ let masterKey = getEnv('AEGIS_MASTER_KEY') ?? fileConfig.vault?.master_key ?? '';
312
+ if (!masterKey) {
313
+ try {
314
+ const keyStorage = getKeyStorage(dataDir);
315
+ masterKey = keyStorage.getKey() ?? '';
316
+ }
317
+ catch {
318
+ // Key storage not available — continue without key
319
+ }
320
+ }
321
+ // Validate master key format: must be 64 hex chars (256-bit key)
322
+ if (masterKey && !/^[0-9a-f]{64}$/i.test(masterKey)) {
323
+ // Warn but don't reject — legacy keys or test keys may differ
324
+ if (typeof process !== 'undefined' && process.stderr) {
325
+ process.stderr.write('⚠ Master key format warning: expected 64 hex characters (256-bit key).\n' +
326
+ ' Decryption may fail if the key is invalid.\n');
327
+ }
328
+ }
329
+ // Resolve port: env → config file → default
330
+ const port = (getEnv('AEGIS_PORT') ? Number.parseInt(getEnv('AEGIS_PORT'), 10) : undefined) ??
331
+ fileConfig.gate?.port ??
332
+ DEFAULTS.port;
333
+ // Resolve log level: env → config file → default
334
+ const logLevel = (getEnv('AEGIS_LOG_LEVEL') ??
335
+ fileConfig.observability?.log_level ??
336
+ DEFAULTS.logLevel);
337
+ // Resolve log format: env → config file → default
338
+ const logFormat = (getEnv('AEGIS_LOG_FORMAT') ??
339
+ fileConfig.observability?.log_format ??
340
+ DEFAULTS.logFormat);
341
+ // Resolve vault name: env → config file → default
342
+ const vaultName = getEnv('AEGIS_VAULT') ?? fileConfig.vault?.name ?? DEFAULTS.vaultName;
343
+ // Resolve salt (env only — salt is stored in vault registry, not config file)
344
+ const salt = getEnv('AEGIS_SALT') ?? DEFAULTS.salt;
345
+ // Resolve TLS: config file
346
+ const tls = fileConfig.gate?.tls;
347
+ // Resolve agent auth: env → config file → default (on by default since v0.8.2)
348
+ const envAgentAuth = getEnv('AEGIS_REQUIRE_AGENT_AUTH');
349
+ const requireAgentAuth = envAgentAuth !== undefined
350
+ ? envAgentAuth === 'true'
351
+ : (fileConfig.gate?.require_agent_auth ?? DEFAULTS.requireAgentAuth);
352
+ // Resolve policy mode: env → config file → default
353
+ const policyMode = (getEnv('AEGIS_POLICY_MODE') ??
354
+ fileConfig.gate?.policy_mode ??
355
+ DEFAULTS.policyMode);
356
+ // Resolve policies dir: env → config file
357
+ const policiesDir = getEnv('AEGIS_POLICIES_DIR') ?? fileConfig.gate?.policies_dir;
358
+ // Resolve metrics: env → config file → default
359
+ const metricsEnabled = getEnv('AEGIS_METRICS') !== undefined
360
+ ? getEnv('AEGIS_METRICS') === 'true'
361
+ : (fileConfig.observability?.metrics ?? DEFAULTS.metricsEnabled);
362
+ // Resolve dashboard: config file → defaults
363
+ const dashboard = {
364
+ enabled: fileConfig.observability?.dashboard?.enabled ?? DEFAULTS.dashboard.enabled,
365
+ port: fileConfig.observability?.dashboard?.port ?? DEFAULTS.dashboard.port,
366
+ };
367
+ // Resolve MCP: config file → defaults
368
+ const mcp = {
369
+ transport: (fileConfig.mcp?.transport ??
370
+ DEFAULTS.mcp.transport),
371
+ port: fileConfig.mcp?.port ?? DEFAULTS.mcp.port,
372
+ };
373
+ // Webhooks from config file
374
+ const webhooks = fileConfig.webhooks ?? DEFAULTS.webhooks;
375
+ // Resolve Gate hardening: config file → defaults
376
+ const maxBodySize = fileConfig.gate?.max_body_size ?? DEFAULTS.maxBodySize;
377
+ const requestTimeout = fileConfig.gate?.request_timeout ?? DEFAULTS.requestTimeout;
378
+ const maxConnectionsPerAgent = fileConfig.gate?.max_connections_per_agent ?? DEFAULTS.maxConnectionsPerAgent;
379
+ return {
380
+ port,
381
+ masterKey,
382
+ salt,
383
+ dataDir,
384
+ logLevel,
385
+ logFormat,
386
+ vaultName,
387
+ tls,
388
+ requireAgentAuth,
389
+ policyMode,
390
+ policiesDir,
391
+ metricsEnabled,
392
+ dashboard,
393
+ mcp,
394
+ webhooks,
395
+ maxBodySize,
396
+ requestTimeout,
397
+ maxConnectionsPerAgent,
398
+ configFilePath: configFilePath ?? undefined,
399
+ };
400
+ }
401
+ //# sourceMappingURL=config.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAyFvD,qEAAqE;AAErE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,EAAE;IACb,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC;IAC3C,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,SAAS;IACpB,gBAAgB,EAAE,IAAI;IACtB,UAAU,EAAE,SAAS;IACrB,cAAc,EAAE,IAAI;IACpB,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;IACzC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;IACvC,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,SAAS,EAAE,OAAO;IAC/B,cAAc,EAAE,MAAM,EAAE,aAAa;IACrC,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AAErE,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEvC,0CAA0C;IAC1C,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAC7C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,OAAO,QAAQ,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,MAAM,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC;AASD,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5D,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,kBAAkB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACzD,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC1D,MAAM,oBAAoB,GAAG;IAC3B,iBAAiB;IACjB,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,IACE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;gBACpC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,EACxB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;YAC3F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS,EACnD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YACrC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EACrD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC3F,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBACnF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,0CAA0C;iBACpD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;YACxD,IACE,OAAO,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,QAAQ;gBACzD,MAAM,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,EACzC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EAAE,4BAA4B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,IACE,MAAM,CAAC,aAAa,CAAC,SAAS,KAAK,SAAS;YAC5C,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAC1D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,mBAAmB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,IACE,MAAM,CAAC,aAAa,CAAC,UAAU,KAAK,SAAS;YAC7C,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAC5D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,mBAAmB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,IACE,MAAM,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS;YAC1C,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS,EACjD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjD,IACE,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,KAAK,QAAQ;gBAClD,MAAM,CAAC,aAAa,CAAC,SAAS,KAAK,IAAI,EACvC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,0CAA0C;iBACpD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IACE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS;oBACpD,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,EAC3D,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,iCAAiC;wBACvC,OAAO,EAAE,wBAAwB;qBAClC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACtD,IACE,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;wBACvD,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;wBACvC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,EAC3C,CAAC;wBACD,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,8BAA8B;4BACpC,OAAO,EAAE,uCAAuC;yBACjD,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,IACE,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;YAClC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EACpD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,mBAAmB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC/D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,YAAY,CAAC,OAAO;wBAC1B,OAAO,EAAE,uCAAuC;qBACjD,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;oBAClB,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBAC/E,CAAC;gBACH,CAAC;gBACD,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,YAAY,CAAC,UAAU;4BAC7B,OAAO,EAAE,kCAAkC;yBAC5C,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;4BAC5B,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gCACxC,MAAM,CAAC,IAAI,CAAC;oCACV,IAAI,EAAE,YAAY,CAAC,UAAU;oCAC7B,OAAO,EAAE,kBAAkB,GAAG,aAAa,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iCAC9E,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qEAAqE;AAErE,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,mEAAmE;IACnE,MAAM,cAAc,GAAG,cAAc,EAAE,CAAC;IAExC,+CAA+C;IAC/C,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAE5F,sEAAsE;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IACpF,IAAI,UAAU,GAAoB,EAAE,CAAC;IACrC,IAAI,cAAc,EAAE,CAAC;QACnB,UAAU,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE7F,+BAA+B;IAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,mFAAmF;IACnF,IAAI,SAAS,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;IACjF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC1C,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,IAAI,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,8DAA8D;QAC9D,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2EAA2E;gBACzE,iDAAiD,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GACR,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,UAAU,CAAC,IAAI,EAAE,IAAI;QACrB,QAAQ,CAAC,IAAI,CAAC;IAEhB,iDAAiD;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACzC,UAAU,CAAC,aAAa,EAAE,SAAS;QACnC,QAAQ,CAAC,QAAQ,CAA4B,CAAC;IAEhD,kDAAkD;IAClD,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC3C,UAAU,CAAC,aAAa,EAAE,UAAU;QACpC,QAAQ,CAAC,SAAS,CAA6B,CAAC;IAElD,kDAAkD;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,CAAC,SAAS,CAAC;IAExF,8EAA8E;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;IAEnD,2BAA2B;IAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;IAEjC,+EAA+E;IAC/E,MAAM,YAAY,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACxD,MAAM,gBAAgB,GACpB,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,YAAY,KAAK,MAAM;QACzB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAEzE,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC7C,UAAU,CAAC,IAAI,EAAE,WAAW;QAC5B,QAAQ,CAAC,UAAU,CAA8B,CAAC;IAEpD,0CAA0C;IAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC;IAElF,+CAA+C;IAC/C,MAAM,cAAc,GAClB,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS;QACnC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,MAAM;QACpC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;IAErE,4CAA4C;IAC5C,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,UAAU,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO;QACnF,IAAI,EAAE,UAAU,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI;KAC3E,CAAC;IAEF,sCAAsC;IACtC,MAAM,GAAG,GAAG;QACV,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS;YACnC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAoC;QAC5D,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI;KAChD,CAAC;IAEF,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IAE1D,iDAAiD;IACjD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,IAAI,QAAQ,CAAC,WAAW,CAAC;IAC3E,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,eAAe,IAAI,QAAQ,CAAC,cAAc,CAAC;IACnF,MAAM,sBAAsB,GAC1B,UAAU,CAAC,IAAI,EAAE,yBAAyB,IAAI,QAAQ,CAAC,sBAAsB,CAAC;IAEhF,OAAO;QACL,IAAI;QACJ,SAAS;QACT,IAAI;QACJ,OAAO;QACP,QAAQ;QACR,SAAS;QACT,SAAS;QACT,GAAG;QACH,gBAAgB;QAChB,UAAU;QACV,WAAW;QACX,cAAc;QACd,SAAS;QACT,GAAG;QACH,QAAQ;QACR,WAAW;QACX,cAAc;QACd,sBAAsB;QACtB,cAAc,EAAE,cAAc,IAAI,SAAS;KAC5C,CAAC;AACJ,CAAC"}
@@ -0,0 +1,95 @@
1
+ import type { AgentRegistry } from '../agent/index.js';
2
+ import type { Ledger } from '../ledger/index.js';
3
+ import type { UserRegistry } from '../user/index.js';
4
+ import type { Vault } from '../vault/index.js';
5
+ export interface DashboardServerOptions {
6
+ /** Port to serve the dashboard on (default: 3200) */
7
+ port: number;
8
+ /** Vault instance for listing credentials */
9
+ vault: Vault;
10
+ /** Ledger for audit log queries and stats */
11
+ ledger: Ledger;
12
+ /** Agent registry for listing agents and grants */
13
+ agentRegistry: AgentRegistry;
14
+ /** User registry for listing RBAC users (optional — RBAC may not be active) */
15
+ userRegistry?: UserRegistry;
16
+ /** Whether Gate is currently running */
17
+ gateRunning: boolean;
18
+ /** Gate port (if running) */
19
+ gatePort: number | null;
20
+ /** Log level */
21
+ logLevel?: 'debug' | 'info' | 'warn' | 'error';
22
+ /** Path to built dashboard static files (default: dist/dashboard) */
23
+ staticDir?: string;
24
+ /** Server start time (for uptime calculation) */
25
+ startTime?: number;
26
+ }
27
+ /**
28
+ * Dashboard HTTP server — serves the React dashboard and exposes
29
+ * REST API endpoints for credentials, agents, audit log, and stats.
30
+ *
31
+ * Also provides a WebSocket endpoint (/ws) for live audit feed
32
+ * using the `ws` library for reliable frame handling and heartbeats.
33
+ */
34
+ export declare class DashboardServer {
35
+ private server;
36
+ private wss;
37
+ private port;
38
+ private vault;
39
+ private ledger;
40
+ private agentRegistry;
41
+ private userRegistry;
42
+ private gateRunning;
43
+ private gatePort;
44
+ private logger;
45
+ private staticDir;
46
+ private startTime;
47
+ constructor(options: DashboardServerOptions);
48
+ /**
49
+ * Update the Gate running status (for health endpoint).
50
+ */
51
+ setGateStatus(running: boolean, port: number | null): void;
52
+ /**
53
+ * Broadcast an audit entry to all connected WebSocket clients.
54
+ * Called from Gate after each request is logged.
55
+ */
56
+ broadcast(entry: {
57
+ id?: number;
58
+ timestamp: string;
59
+ credentialId?: string | null;
60
+ credentialName?: string | null;
61
+ service: string;
62
+ targetDomain: string;
63
+ method: string;
64
+ path: string;
65
+ status: 'allowed' | 'blocked' | 'system';
66
+ blockedReason?: string | null;
67
+ responseCode?: number | null;
68
+ agentName?: string | null;
69
+ agentTokenPrefix?: string | null;
70
+ channel?: 'gate' | 'mcp';
71
+ }): void;
72
+ /**
73
+ * Start the dashboard server.
74
+ */
75
+ start(): Promise<void>;
76
+ /**
77
+ * The port the dashboard server is listening on.
78
+ */
79
+ get listeningPort(): number;
80
+ /**
81
+ * Stop the dashboard server.
82
+ */
83
+ stop(): Promise<void>;
84
+ private handleRequest;
85
+ private handleApiRequest;
86
+ private handleHealth;
87
+ private handleStats;
88
+ private handleCredentials;
89
+ private handleAgents;
90
+ private handleRequests;
91
+ private handleUsers;
92
+ private serveStatic;
93
+ private json;
94
+ }
95
+ //# sourceMappingURL=dashboard-server.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"dashboard-server.d.ts","sourceRoot":"","sources":["../../src/dashboard/dashboard-server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAK/C,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,EAAE,KAAK,CAAC;IACb,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,aAAa,EAAE,aAAa,CAAC;IAC7B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,wCAAwC;IACxC,WAAW,EAAE,OAAO,CAAC;IACrB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoBD;;;;;;GAMG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,sBAAsB;IAkC3C;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK1D;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;QACzC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;KAC1B,GAAG,IAAI;IAYR;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA2CtB;;OAEG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;OAEG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0BrB,OAAO,CAAC,aAAa;IA0BrB,OAAO,CAAC,gBAAgB;IAgCxB,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,cAAc;IAwBtB,OAAO,CAAC,WAAW;IAWnB,OAAO,CAAC,WAAW;IA6CnB,OAAO,CAAC,IAAI;CAQb"}