@getaegis/cli 0.8.1 → 0.9.1

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAoBzC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,kEAAkE;IAElE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,MAAM,CAAC,cAAc,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sEAAsE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,8CAA8C;SACvD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,kEAAkE;IAElE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9D,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mFAAmF;SAC5F,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4CAA4C;SACrD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG,EAAE;iBACd,OAAO,CAAC,mDAAmD,CAAC;iBAC5D,GAAG,EAA6B,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAC1E,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACtD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,0EAA0E;iBACnF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,2BAA2B,OAAO,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAE3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,iFAAiF;iBAC1F,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,iFAAiF;gBACjF,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;iBAC/D,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAE/D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACrD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChF,OAAO,QAAQ,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,wBAAwB;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,4BAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACvG,CAAC,CAAC;YACL,CAAC;YAED,gBAAgB;YAChB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM,WAAW;aACtG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBAC5C,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU;oBAChB,CAAC,CAAC,yDAAyD;oBAC3D,CAAC,CAAC,4BAA4B,OAAO,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAEnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,MAAM,KAAK,GAAG,SAAS,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAoBzC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,kEAAkE;IAElE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,MAAM,CAAC,cAAc,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sEAAsE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,8CAA8C;SACvD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,kEAAkE;IAElE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,SAAS,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACvC,MAAM,EAAE,aAAa;gBACnB,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,iBAAiB;gBACrE,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,mBAAmB;SAC1E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sCAAsC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAElE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9D,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mFAAmF;SAC5F,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4CAA4C;SACrD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG,EAAE;iBACd,OAAO,CAAC,mDAAmD,CAAC;iBAC5D,GAAG,EAA6B,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAC1E,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACtD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,0EAA0E;iBACnF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,2BAA2B,OAAO,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAE3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,iFAAiF;iBAC1F,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,iFAAiF;gBACjF,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;iBAC/D,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAE/D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACrD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChF,OAAO,QAAQ,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,wBAAwB;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,4BAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACvG,CAAC,CAAC;YACL,CAAC;YAED,gBAAgB;YAChB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM,WAAW;aACtG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBAC5C,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU;oBAChB,CAAC,CAAC,yDAAyD;oBAC3D,CAAC,CAAC,4BAA4B,OAAO,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAEnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,MAAM,KAAK,GAAG,SAAS,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/gate/gate.d.ts

@@ -24,9 +24,9 @@ export interface GateOptions {
     tls?: TlsOptions;
     /** Maximum time (ms) to wait for in-flight requests during shutdown (default: 10000) */
     shutdownTimeoutMs?: number;
-    /** Agent registry — required when requireAgentAuth is true */
+    /** Agent registry — required when agent auth is enabled (default) */
     agentRegistry?: AgentRegistry;
-    /** When true, every request must include a valid X-Aegis-Agent token */
+    /** When true (default), every request must include a valid X-Aegis-Agent token. Use --no-agent-auth to disable. */
     requireAgentAuth?: boolean;
     /** Directory containing YAML policy files — enables policy evaluation */
     policyDir?: string;
@@ -38,6 +38,12 @@ export interface GateOptions {
     webhooks?: WebhookManager;
     /** Callback fired after every audit entry is logged — used by dashboard for live feed */
     onAuditEntry?: (entry: AuditBroadcast) => void;
+    /** Maximum request body size in bytes (default: 1 MB). Bodies exceeding this return 413. */
+    maxBodySize?: number;
+    /** Request timeout in milliseconds (default: 30s). Covers both inbound and outbound. */
+    requestTimeout?: number;
+    /** Maximum concurrent in-flight requests per agent (default: 50). */
+    maxConnectionsPerAgent?: number;
     /** Testing: redirect outbound requests to a local server */
     _testUpstream?: {
         protocol: 'http' | 'https';
@@ -93,6 +99,17 @@ export declare class Gate {
     private metrics?;
     private webhooks?;
     private onAuditEntry?;
+    private maxBodySize;
+    private requestTimeout;
+    private maxConnectionsPerAgent;
+    /** Tracks in-flight request count per agent (keyed by agent ID). */
+    private agentConnections;
+    /** Tracks upstream service failures for circuit breaker (keyed by service name). */
+    private circuitBreaker;
+    /** Dedicated HTTP agent for outbound proxy requests (connection pooling with keep-alive). */
+    private httpAgent;
+    /** Dedicated HTTPS agent for outbound proxy requests (connection pooling with keep-alive + TLS session reuse). */
+    private httpsAgent;
     constructor(options: GateOptions);
     /**
      * Start the Gate proxy server.
@@ -151,6 +168,11 @@ export declare class Gate {
      */
     get inFlightRequests(): number;
     private handleRequest;
+    /**
+     * Record an upstream failure for circuit breaker logic.
+     * After 5 consecutive failures, the circuit opens for 30 seconds.
+     */
+    private recordCircuitFailure;
     /**
      * Inject the credential into outbound request headers based on auth type.
      * For `query` auth, the secret is appended as a URL query parameter instead.

package/dist/gate/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAS,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAa1D;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAM5E;AAED,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,4DAA4D;IAC5D,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACnC,qFAAqF;IACrF,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,yFAAyF;IACzF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IAC/C,4DAA4D;IAC5D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E,kEAAkE;IAClE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,IAAI;IACf,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,YAAY,CAAC,CAAiE;IACtF,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,gBAAgB,CAAU;IAClC,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAe;IACrC,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAiB;IAClC,OAAO,CAAC,YAAY,CAAC,CAAkC;gBAE3C,OAAO,EAAE,WAAW;IA+BhC;;OAEG;IACH;;OAEG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,SAAS,GAAG,SAAS,CAE7C;IAED;;OAEG;IACH,OAAO,CAAC,YAAY;IAcpB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAMtB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAkB1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgFtB;;OAEG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;OASG;IACH,IAAI,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IA6D5D;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,MAAM,CAE7B;YAEa,aAAa;IAkxB3B;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA8BxB;;OAEG;IACH,OAAO,CAAC,YAAY;IA6BpB;;OAEG;IACH,OAAO,CAAC,YAAY;CA0BrB"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAS,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAa1D;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAM5E;AAED,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,4DAA4D;IAC5D,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mHAAmH;IACnH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACnC,qFAAqF;IACrF,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,yFAAyF;IACzF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IAC/C,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E,kEAAkE;IAClE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,IAAI;IACf,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,YAAY,CAAC,CAAiE;IACtF,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,gBAAgB,CAAU;IAClC,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAe;IACrC,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAiB;IAClC,OAAO,CAAC,YAAY,CAAC,CAAkC;IACvD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,sBAAsB,CAAS;IACvC,oEAAoE;IACpE,OAAO,CAAC,gBAAgB,CAA6B;IACrD,oFAAoF;IACpF,OAAO,CAAC,cAAc,CAA8D;IACpF,6FAA6F;IAC7F,OAAO,CAAC,SAAS,CAAa;IAC9B,kHAAkH;IAClH,OAAO,CAAC,UAAU,CAAc;gBAEpB,OAAO,EAAE,WAAW;IAkDhC;;OAEG;IACH;;OAEG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,SAAS,GAAG,SAAS,CAE7C;IAED;;OAEG;IACH,OAAO,CAAC,YAAY;IAcpB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAMtB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAkB1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyFtB;;OAEG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;OASG;IACH,IAAI,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAkE5D;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,MAAM,CAE7B;YAEa,aAAa;IAq+B3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAiB5B;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA8BxB;;OAEG;IACH,OAAO,CAAC,YAAY;IA6BpB;;OAEG;IACH,OAAO,CAAC,YAAY;CA0BrB"}

package/dist/gate/gate.js

@@ -57,6 +57,17 @@ export class Gate {
     metrics;
     webhooks;
     onAuditEntry;
+    maxBodySize;
+    requestTimeout;
+    maxConnectionsPerAgent;
+    /** Tracks in-flight request count per agent (keyed by agent ID). */
+    agentConnections = new Map();
+    /** Tracks upstream service failures for circuit breaker (keyed by service name). */
+    circuitBreaker = new Map();
+    /** Dedicated HTTP agent for outbound proxy requests (connection pooling with keep-alive). */
+    httpAgent;
+    /** Dedicated HTTPS agent for outbound proxy requests (connection pooling with keep-alive + TLS session reuse). */
+    httpsAgent;
     constructor(options) {
         this.vault = options.vault;
         this.ledger = options.ledger;
@@ -71,12 +82,30 @@ export class Gate {
         this.bodyInspector = new BodyInspector();
         this.shutdownTimeoutMs = options.shutdownTimeoutMs ?? 10_000;
         this.agentRegistry = options.agentRegistry;
-        this.requireAgentAuth = options.requireAgentAuth ?? false;
+        this.requireAgentAuth = options.requireAgentAuth ?? true;
         this.policyMode = options.policyMode ?? 'enforce';
         this.policyDir = options.policyDir;
         this.metrics = options.metrics;
         this.webhooks = options.webhooks;
         this.onAuditEntry = options.onAuditEntry;
+        this.maxBodySize = options.maxBodySize ?? 1_048_576; // 1 MB
+        this.requestTimeout = options.requestTimeout ?? 30_000; // 30 seconds
+        this.maxConnectionsPerAgent = options.maxConnectionsPerAgent ?? 50;
+        // Dedicated connection pool agents for outbound proxy requests.
+        // keepAlive: true  — reuse TCP connections across requests (avoids TCP+TLS handshake per request)
+        // maxSockets: 256  — cap concurrent sockets per upstream host (prevents socket exhaustion)
+        // maxFreeSockets: 64 — keep up to 64 idle sockets per host in the pool
+        // scheduling: 'lifo' — reuse most-recent socket first (reduces stale connection risk)
+        // timeout: 60s — idle socket timeout (close sockets unused for 60s)
+        const poolOptions = {
+            keepAlive: true,
+            maxSockets: 256,
+            maxFreeSockets: 64,
+            scheduling: 'lifo',
+            timeout: 60_000,
+        };
+        this.httpAgent = new http.Agent(poolOptions);
+        this.httpsAgent = new https.Agent(poolOptions);
         // Load policies from disk or test injection
         if (options._testPolicies) {
             this.policyMap = options._testPolicies;
@@ -207,6 +236,13 @@ export class Gate {
                 if (addr && typeof addr === 'object') {
                     this.port = addr.port;
                 }
+                // Set server-level idle timeout to defend against slowloris attacks.
+                // Only covers idle socket time — outbound proxy has its own `timeout` option.
+                // Provide a custom callback so the default auto-destroy doesn't kill sockets
+                // that are legitimately waiting for upstream responses.
+                this.server?.setTimeout(this.requestTimeout, (socket) => {
+                    socket.destroy();
+                });
                 const protocol = this.tlsOptions ? 'https' : 'http';
                 this.logger.info({ protocol, port: this.port }, `Aegis Gate listening on ${protocol}://localhost:${this.port}`);
                 this.logger.info({ port: this.port }, 'Agent requests → localhost:{port}/{service}/path → credential injected → forwarded');
@@ -243,11 +279,16 @@ export class Gate {
         }
         return new Promise((resolve) => {
             if (!this.server) {
+                this.httpAgent.destroy();
+                this.httpsAgent.destroy();
                 resolve({ drained: true, activeAtClose: 0 });
                 return;
             }
             const finish = (drained) => {
                 const activeAtClose = this.activeRequests;
+                // Destroy connection pool agents — close all keep-alive sockets
+                this.httpAgent.destroy();
+                this.httpsAgent.destroy();
                 if (!drained) {
                     // Force-destroy remaining connections so server.close() can complete
                     this.server?.closeAllConnections();
@@ -313,8 +354,36 @@ export class Gate {
         const requestId = generateRequestId();
         const reqLog = this.logger.child({ requestId });
         try {
-            const reqUrl = new URL(req.url ?? '/', `http://localhost:${this.port}`);
-            const pathParts = reqUrl.pathname.split('/').filter(Boolean);
+            // Parse path segments from the RAW URL (not via new URL()) to prevent
+            // percent-encoded path traversal. new URL() normalises %2e%2e → .. and
+            // resolves /../, which would let an agent escape service routing and
+            // reach internal /_aegis/* endpoints via /service/%2e%2e/_aegis/health.
+            const rawUrl = req.url ?? '/';
+            const qIdx = rawUrl.indexOf('?');
+            const rawPath = qIdx >= 0 ? rawUrl.slice(0, qIdx) : rawUrl;
+            const rawQuery = qIdx >= 0 ? rawUrl.slice(qIdx) : '';
+            const pathParts = rawPath.split('/').filter(Boolean);
+            // Explicit path traversal guard: reject any segment that decodes to
+            // ".." or "." — belt-and-suspenders defense on top of raw parsing.
+            // The service lookup would naturally reject these, but blocking here
+            // produces a clear 400 and audit trail entry for traversal attempts.
+            const hasTraversal = pathParts.some((seg) => {
+                if (seg === '..' || seg === '.')
+                    return true;
+                try {
+                    const decoded = decodeURIComponent(seg);
+                    return decoded === '..' || decoded === '.';
+                }
+                catch {
+                    return false;
+                }
+            });
+            if (hasTraversal) {
+                reqLog.warn({ path: rawPath }, 'Blocked: path traversal attempt');
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(`${JSON.stringify({ error: 'Path traversal detected' })}\n`);
+                return;
+            }
             // Health check
             if (pathParts[0] === '_aegis' && pathParts[1] === 'health') {
                 res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -367,7 +436,7 @@ export class Gate {
                     res.writeHead(401, { 'Content-Type': 'application/json' });
                     res.end(`${JSON.stringify({
                         error: 'Agent authentication required',
-                        hint: 'Include X-Aegis-Agent header with your agent token',
+                        hint: "Include X-Aegis-Agent header with your agent token. Run 'aegis agent add --name my-agent' to create one.",
                     })}\n`);
                     return;
                 }
@@ -409,6 +478,40 @@ export class Gate {
                     }
                 }
             }
+            // ─── Per-Agent Connection Limits ─────────────────────────────────
+            // Prevent a single agent from exhausting all available connections
+            // by tracking in-flight requests per agent.
+            if (authenticatedAgent) {
+                const agentId = authenticatedAgent.id;
+                const currentConnections = this.agentConnections.get(agentId) ?? 0;
+                if (currentConnections >= this.maxConnectionsPerAgent) {
+                    reqLog.warn({
+                        agent: authenticatedAgent.name,
+                        current: currentConnections,
+                        max: this.maxConnectionsPerAgent,
+                    }, 'Blocked: per-agent connection limit exceeded');
+                    this.metrics?.recordBlocked(pathParts[0] ?? 'unknown', 'agent_connection_limit', authenticatedAgent.name);
+                    res.writeHead(429, { 'Content-Type': 'application/json' });
+                    res.end(`${JSON.stringify({
+                        error: 'Too many concurrent requests for this agent',
+                        agent: authenticatedAgent.name,
+                        limit: this.maxConnectionsPerAgent,
+                        hint: 'Wait for in-flight requests to complete or increase gate.max_connections_per_agent',
+                    })}\n`);
+                    return;
+                }
+                this.agentConnections.set(agentId, currentConnections + 1);
+                // Decrement on response close
+                res.on('close', () => {
+                    const count = this.agentConnections.get(agentId) ?? 1;
+                    if (count <= 1) {
+                        this.agentConnections.delete(agentId);
+                    }
+                    else {
+                        this.agentConnections.set(agentId, count - 1);
+                    }
+                });
+            }
             // Route format: /{service}/rest/of/the/path
             const serviceName = pathParts[0];
             if (!serviceName) {
@@ -776,7 +879,7 @@ export class Gate {
             const agentRequestedHost = req.headers['x-target-host'] ?? undefined;
             const targetDomain = agentRequestedHost ?? credential.domains[0];
             const remainingPath = `/${pathParts.slice(1).join('/')}`;
-            const query = reqUrl.search ?? '';
+            const query = rawQuery;
             // Domain guard: verify target domain is in the credential's allowlist
             // This is the core security boundary — blocks agents from exfiltrating
             // credentials to domains not explicitly approved.
@@ -827,12 +930,46 @@ export class Gate {
             reqLog.debug({ service: serviceName, method: req.method, targetDomain, path: remainingPath }, 'Proxying request');
             // Start request duration timer for Prometheus histogram
             const stopTimer = this.metrics?.startRequestTimer(serviceName);
-            // Buffer the request body for inspection before forwarding
+            // Buffer the request body for inspection before forwarding.
+            // Enforce max body size to prevent memory exhaustion.
             const bodyChunks = [];
+            let bodySize = 0;
+            let bodySizeExceeded = false;
             req.on('data', (chunk) => {
-                bodyChunks.push(chunk);
+                bodySize += chunk.length;
+                if (bodySize > this.maxBodySize) {
+                    bodySizeExceeded = true;
+                    // Stop buffering — we'll reject in the 'end' handler.
+                    // Don't destroy the stream (that kills the socket before we can respond).
+                }
+                else {
+                    bodyChunks.push(chunk);
+                }
             });
             req.on('end', () => {
+                // Reject oversized bodies
+                if (bodySizeExceeded) {
+                    reqLog.warn({ service: serviceName, bodySize, maxBodySize: this.maxBodySize }, 'Blocked: request body too large');
+                    this.auditBlocked({
+                        service: serviceName,
+                        targetDomain,
+                        method: req.method ?? 'GET',
+                        path: remainingPath,
+                        reason: 'Body too large',
+                    });
+                    this.metrics?.recordBlocked(serviceName, 'body_too_large', authenticatedAgent?.name);
+                    res.writeHead(413, { 'Content-Type': 'application/json' });
+                    res.end(`${JSON.stringify({
+                        error: 'Request body too large',
+                        received: bodySize,
+                        limit: this.maxBodySize,
+                        hint: 'Reduce body size or increase gate.max_body_size in aegis.config.yaml',
+                    })}\n`);
+                    return;
+                }
+                // Clear the server-level idle timeout — the body is fully received,
+                // so slowloris is no longer a risk. The outbound proxy timeout handles upstream delays.
+                req.socket?.setTimeout(0);
                 const bodyBuffer = Buffer.concat(bodyChunks);
                 const bodyString = bodyBuffer.toString('utf-8');
                 // Body inspection: scan for credential-like patterns in the request body
@@ -873,67 +1010,141 @@ export class Gate {
                         reqLog.warn({ credential: credential.name, matches: inspection.matches }, 'Body inspection: credential-like patterns detected (warn mode)');
                     }
                 }
-                // Forward the request
+                // ─── Circuit Breaker Check ────────────────────────────────────
+                // If the upstream service has been failing repeatedly, short-circuit
+                // with 503 instead of adding more load to a struggling service.
+                const circuitState = this.circuitBreaker.get(serviceName);
+                if (circuitState && circuitState.openUntil > Date.now()) {
+                    reqLog.warn({ service: serviceName, failures: circuitState.failures }, 'Blocked: circuit breaker open');
+                    if (!res.headersSent) {
+                        const retryAfterSeconds = Math.ceil((circuitState.openUntil - Date.now()) / 1000);
+                        res.writeHead(503, {
+                            'Content-Type': 'application/json',
+                            'Retry-After': String(retryAfterSeconds),
+                        });
+                        res.end(`${JSON.stringify({
+                            error: 'Service temporarily unavailable (circuit breaker open)',
+                            service: serviceName,
+                            retryAfter: retryAfterSeconds,
+                            hint: 'The upstream service has been failing repeatedly. Requests will resume automatically.',
+                        })}\n`);
+                    }
+                    return;
+                }
+                // Forward the request with timeout and retry for transient failures
                 const upstream = this.testUpstream;
                 const transport = upstream?.protocol === 'http' ? http : https;
-                const proxyReq = transport.request({
-                    hostname: upstream?.hostname ?? targetDomain,
-                    port: upstream?.port ?? 443,
-                    path: injectedPath ?? `${remainingPath}${query}`,
-                    method: req.method,
-                    headers: outboundHeaders,
-                }, (proxyRes) => {
-                    // Strip any credential info from response headers
-                    const safeHeaders = { ...proxyRes.headers };
-                    delete safeHeaders['set-cookie']; // Prevent session hijack via agent
-                    this.auditAllowed({
-                        credentialId: credential.id,
-                        credentialName: credential.name,
-                        service: serviceName,
-                        targetDomain,
-                        method: req.method ?? 'GET',
-                        path: remainingPath,
-                        responseCode: proxyRes.statusCode,
-                        agentName: authenticatedAgent?.name,
-                        agentTokenPrefix: authenticatedAgent?.tokenPrefix,
-                    });
-                    reqLog.info({
-                        service: serviceName,
+                const agent = upstream?.protocol === 'http' ? this.httpAgent : this.httpsAgent;
+                const maxRetries = 2; // original + 2 retries = 3 total attempts
+                const attemptProxy = (attempt) => {
+                    const proxyReq = transport.request({
+                        hostname: upstream?.hostname ?? targetDomain,
+                        port: upstream?.port ?? 443,
+                        path: injectedPath ?? `${remainingPath}${query}`,
                         method: req.method,
-                        path: remainingPath,
-                        status: proxyRes.statusCode,
-                    }, 'Request proxied');
-                    stopTimer?.();
-                    this.metrics?.recordRequest(serviceName, req.method ?? 'GET', proxyRes.statusCode ?? 500, authenticatedAgent?.name);
-                    res.writeHead(proxyRes.statusCode ?? 500, safeHeaders);
-                    proxyRes.pipe(res);
-                });
-                proxyReq.on('error', (err) => {
-                    reqLog.error({ service: serviceName, err: err.message }, 'Proxy error');
-                    if (!this.shuttingDown) {
-                        try {
-                            this.auditBlocked({
-                                service: serviceName,
-                                targetDomain,
-                                method: req.method ?? 'GET',
-                                path: remainingPath,
-                                reason: `Proxy error: ${err.message}`,
-                            });
+                        headers: outboundHeaders,
+                        timeout: this.requestTimeout,
+                        agent,
+                    }, (proxyRes) => {
+                        const statusCode = proxyRes.statusCode ?? 500;
+                        // Retry on transient upstream failures (502, 503, 504) if retries remain
+                        // Only retry idempotent methods (GET, HEAD, OPTIONS) — never retry state-changing methods
+                        const isRetryable = (statusCode === 502 || statusCode === 503 || statusCode === 504) &&
+                            attempt < maxRetries &&
+                            READ_METHODS.has(req.method?.toUpperCase() ?? 'GET');
+                        if (isRetryable) {
+                            reqLog.info({ service: serviceName, status: statusCode, attempt: attempt + 1 }, 'Retrying transient upstream failure');
+                            // Consume the response body before retrying
+                            proxyRes.resume();
+                            // Exponential backoff: 500ms, 1000ms
+                            const backoff = 500 * (attempt + 1);
+                            setTimeout(() => attemptProxy(attempt + 1), backoff);
+                            return;
                         }
-                        catch {
-                            // Ledger may be unavailable during shutdown cleanup
+                        // Record circuit breaker state on upstream failures
+                        if (statusCode >= 500) {
+                            this.recordCircuitFailure(serviceName);
                         }
+                        else {
+                            // Success — reset circuit breaker for this service
+                            this.circuitBreaker.delete(serviceName);
+                        }
+                        // Strip any credential info from response headers
+                        const safeHeaders = { ...proxyRes.headers };
+                        delete safeHeaders['set-cookie']; // Prevent session hijack via agent
+                        this.auditAllowed({
+                            credentialId: credential.id,
+                            credentialName: credential.name,
+                            service: serviceName,
+                            targetDomain,
+                            method: req.method ?? 'GET',
+                            path: remainingPath,
+                            responseCode: statusCode,
+                            agentName: authenticatedAgent?.name,
+                            agentTokenPrefix: authenticatedAgent?.tokenPrefix,
+                        });
+                        reqLog.info({
+                            service: serviceName,
+                            method: req.method,
+                            path: remainingPath,
+                            status: statusCode,
+                        }, 'Request proxied');
+                        stopTimer?.();
+                        this.metrics?.recordRequest(serviceName, req.method ?? 'GET', statusCode, authenticatedAgent?.name);
+                        res.writeHead(statusCode, safeHeaders);
+                        proxyRes.pipe(res);
+                    });
+                    // Outbound request timeout — fires if upstream takes too long
+                    proxyReq.on('timeout', () => {
+                        proxyReq.destroy(new Error('upstream request timed out'));
+                    });
+                    proxyReq.on('error', (err) => {
+                        // Retry on ECONNRESET / socket hang up when using a reused (keep-alive) socket.
+                        // The server may have closed the idle connection before our request arrived.
+                        const isStaleSocket = (err.message.includes('ECONNRESET') || err.message.includes('socket hang up')) &&
+                            proxyReq.reusedSocket;
+                        if (isStaleSocket && attempt < maxRetries) {
+                            reqLog.info({ service: serviceName, attempt: attempt + 1 }, 'Retrying after stale socket error on reused connection');
+                            attemptProxy(attempt + 1);
+                            return;
+                        }
+                        reqLog.error({ service: serviceName, err: err.message }, 'Proxy error');
+                        // Record the failure for circuit breaker
+                        this.recordCircuitFailure(serviceName);
+                        if (!this.shuttingDown) {
+                            try {
+                                this.auditBlocked({
+                                    service: serviceName,
+                                    targetDomain,
+                                    method: req.method ?? 'GET',
+                                    path: remainingPath,
+                                    reason: `Proxy error: ${err.message}`,
+                                });
+                            }
+                            catch {
+                                // Ledger may be unavailable during shutdown cleanup
+                            }
+                        }
+                        if (!res.headersSent) {
+                            const isTimeout = err.message.includes('timed out');
+                            const statusCode = isTimeout ? 504 : 502;
+                            const errorMessage = isTimeout
+                                ? 'Upstream request timed out'
+                                : 'Failed to reach upstream service';
+                            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+                            res.end(`${JSON.stringify({
+                                error: errorMessage,
+                                service: serviceName,
+                            })}\n`);
+                        }
+                    });
+                    // Write the buffered body and end
+                    if (bodyBuffer.length > 0) {
+                        proxyReq.write(bodyBuffer);
                     }
-                    if (!res.headersSent) {
-                        res.writeHead(502, { 'Content-Type': 'application/json' });
-                        res.end(`${JSON.stringify({ error: 'Failed to reach upstream service' })}\n`);
-                    }
-                });
-                // Write the buffered body and end
-                if (bodyBuffer.length > 0) {
-                    proxyReq.write(bodyBuffer);
-                }
-                proxyReq.end();
+                    proxyReq.end();
+                };
+                attemptProxy(0);
             });
         }
         catch (err) {
@@ -942,6 +1153,22 @@ export class Gate {
             res.end(`${JSON.stringify({ error: 'Internal Aegis Gate error' })}\n`);
         }
     }
+    /**
+     * Record an upstream failure for circuit breaker logic.
+     * After 5 consecutive failures, the circuit opens for 30 seconds.
+     */
+    recordCircuitFailure(service) {
+        const state = this.circuitBreaker.get(service) ?? { failures: 0, openUntil: 0 };
+        state.failures++;
+        // Open the circuit after 5 consecutive failures (30s cooldown)
+        const FAILURE_THRESHOLD = 5;
+        const COOLDOWN_MS = 30_000;
+        if (state.failures >= FAILURE_THRESHOLD) {
+            state.openUntil = Date.now() + COOLDOWN_MS;
+            this.logger.warn({ service, failures: state.failures, cooldownMs: COOLDOWN_MS }, 'Circuit breaker opened — service failures exceeded threshold');
+        }
+        this.circuitBreaker.set(service, state);
+    }
     /**
      * Inject the credential into outbound request headers based on auth type.
      * For `query` auth, the secret is appended as a URL query parameter instead.