@integsec/agentic-pentest-proxy 0.1.0

package/dist/bin/integsec-agentic-pentest-proxy.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=integsec-agentic-pentest-proxy.d.ts.map

package/dist/bin/integsec-agentic-pentest-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integsec-agentic-pentest-proxy.d.ts","sourceRoot":"","sources":["../../bin/integsec-agentic-pentest-proxy.ts"],"names":[],"mappings":""}

package/dist/bin/integsec-agentic-pentest-proxy.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+import { loadConfig } from "../src/config.js";
+import { loadManifest } from "../src/manifest.js";
+import { ScopeEnforcementProxy } from "../src/proxy.js";
+import { runStdioProxy } from "../src/transports/stdio.js";
+import { runHttpProxy } from "../src/transports/http.js";
+import { CloudWatchAuditLogger } from "../src/audit/cloudwatch.js";
+import { AzureMonitorAuditLogger } from "../src/audit/azure-monitor.js";
+import { GcpAuditLogger } from "../src/audit/gcp-logging.js";
+async function main() {
+    console.error("[integsec-agentic-pentest-proxy] Starting...");
+    const config = loadConfig();
+    const manifest = await loadManifest();
+    console.error(`[integsec-agentic-pentest-proxy] Loaded scope for engagement ${manifest.engagement_id} (${manifest.client})`);
+    console.error(`[integsec-agentic-pentest-proxy] Window: ${manifest.engagement_window.start} to ${manifest.engagement_window.end}`);
+    console.error(`[integsec-agentic-pentest-proxy] Transport: ${config.transport}`);
+    const proxy = new ScopeEnforcementProxy(manifest, config);
+    const auditLogger = proxy.getAuditLogger();
+    // Add cloud backends if configured
+    if (config.awsLogGroup) {
+        auditLogger.addBackend(new CloudWatchAuditLogger(config.awsLogGroup, config.awsRegion));
+        console.error(`[integsec-agentic-pentest-proxy] CloudWatch logging enabled: ${config.awsLogGroup}`);
+    }
+    if (config.azureLogWorkspaceId && config.azureDcrImmutableId) {
+        auditLogger.addBackend(new AzureMonitorAuditLogger(config.azureLogWorkspaceId, config.azureDcrImmutableId, config.azureDcrStreamName));
+        console.error("[integsec-agentic-pentest-proxy] Azure Monitor logging enabled");
+    }
+    if (config.gcpProject) {
+        auditLogger.addBackend(new GcpAuditLogger(config.gcpProject));
+        console.error("[integsec-agentic-pentest-proxy] GCP Cloud Logging enabled");
+    }
+    if (config.transport === "stdio") {
+        if (!config.upstreamMcpCommand) {
+            console.error("[integsec-agentic-pentest-proxy] ERROR: UPSTREAM_MCP_COMMAND is required for stdio transport");
+            process.exit(1);
+        }
+        await runStdioProxy(proxy, config.upstreamMcpCommand, config.upstreamMcpArgs);
+    }
+    else {
+        if (!config.upstreamMcpUrl) {
+            console.error("[integsec-agentic-pentest-proxy] ERROR: UPSTREAM_MCP_URL is required for HTTP transport");
+            process.exit(1);
+        }
+        await runHttpProxy(proxy, config.upstreamMcpUrl, config.proxyPort);
+    }
+}
+main().catch((err) => {
+    console.error(`[integsec-agentic-pentest-proxy] Fatal error: ${err.message}`);
+    process.exit(1);
+});
+//# sourceMappingURL=integsec-agentic-pentest-proxy.js.map

package/dist/bin/integsec-agentic-pentest-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integsec-agentic-pentest-proxy.js","sourceRoot":"","sources":["../../bin/integsec-agentic-pentest-proxy.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IAEtC,OAAO,CAAC,KAAK,CAAC,gEAAgE,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7H,OAAO,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,iBAAiB,CAAC,KAAK,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC;IACnI,OAAO,CAAC,KAAK,CAAC,+CAA+C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAEjF,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAE3C,mCAAmC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,WAAW,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,gEAAgE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7D,WAAW,CAAC,UAAU,CACpB,IAAI,uBAAuB,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAC/G,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,WAAW,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,yFAAyF,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/src/audit/azure-monitor.d.ts

@@ -0,0 +1,22 @@
+import type { AuditEntry } from "../types.js";
+import type { AuditBackend } from "./index.js";
+/**
+ * AzureMonitorAuditLogger buffers AuditEntry objects and sends them to Azure
+ * Monitor via the Logs Ingestion API on flush().
+ *
+ * Requires the optional dependencies @azure/monitor-ingestion and
+ * @azure/identity. If either SDK is not installed the logger is silently
+ * disabled.
+ */
+export declare class AzureMonitorAuditLogger implements AuditBackend {
+    private workspaceId;
+    private dcrImmutableId;
+    private streamName;
+    private buffer;
+    /** Set to false when the SDKs cannot be loaded so we never crash. */
+    private enabled;
+    constructor(workspaceId: string, dcrImmutableId: string, streamName: string);
+    log(entry: AuditEntry): Promise<void>;
+    flush(): Promise<void>;
+}
+//# sourceMappingURL=azure-monitor.d.ts.map

package/dist/src/audit/azure-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.d.ts","sourceRoot":"","sources":["../../../src/audit/azure-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;GAOG;AACH,qBAAa,uBAAwB,YAAW,YAAY;IAC1D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAoB;IAClC,qEAAqE;IACrE,OAAO,CAAC,OAAO,CAAQ;gBAEX,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAMrE,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA4C7B"}

package/dist/src/audit/azure-monitor.js

@@ -0,0 +1,62 @@
+/**
+ * AzureMonitorAuditLogger buffers AuditEntry objects and sends them to Azure
+ * Monitor via the Logs Ingestion API on flush().
+ *
+ * Requires the optional dependencies @azure/monitor-ingestion and
+ * @azure/identity. If either SDK is not installed the logger is silently
+ * disabled.
+ */
+export class AzureMonitorAuditLogger {
+    workspaceId;
+    dcrImmutableId;
+    streamName;
+    buffer = [];
+    /** Set to false when the SDKs cannot be loaded so we never crash. */
+    enabled = true;
+    constructor(workspaceId, dcrImmutableId, streamName) {
+        this.workspaceId = workspaceId;
+        this.dcrImmutableId = dcrImmutableId;
+        this.streamName = streamName;
+    }
+    async log(entry) {
+        if (!this.enabled)
+            return;
+        this.buffer.push(entry);
+    }
+    async flush() {
+        if (!this.enabled || this.buffer.length === 0)
+            return;
+        // Snapshot and clear the in-flight entries; restore on error.
+        const toSend = this.buffer.splice(0);
+        let ingestionModule;
+        let identityModule;
+        try {
+            [ingestionModule, identityModule] = await Promise.all([
+                import("@azure/monitor-ingestion"),
+                import("@azure/identity"),
+            ]);
+        }
+        catch {
+            console.warn("[AzureMonitorAuditLogger] @azure/monitor-ingestion or @azure/identity is not " +
+                "installed. Azure Monitor audit logging is disabled.");
+            this.enabled = false;
+            // Entries are already removed from the buffer — drop them gracefully.
+            return;
+        }
+        const { LogsIngestionClient } = ingestionModule;
+        const { DefaultAzureCredential } = identityModule;
+        const endpoint = `https://${this.workspaceId}.ingest.monitor.azure.com`;
+        const credential = new DefaultAzureCredential();
+        const client = new LogsIngestionClient(endpoint, credential);
+        try {
+            // The SDK types require Record<string, unknown>[] — cast via unknown.
+            await client.upload(this.dcrImmutableId, this.streamName, toSend);
+        }
+        catch (err) {
+            console.error("[AzureMonitorAuditLogger] flush() failed:", err);
+            // Put entries back at the front of the buffer for the next retry.
+            this.buffer.unshift(...toSend);
+        }
+    }
+}
+//# sourceMappingURL=azure-monitor.js.map

package/dist/src/audit/azure-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.js","sourceRoot":"","sources":["../../../src/audit/azure-monitor.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAC1B,WAAW,CAAS;IACpB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,MAAM,GAAiB,EAAE,CAAC;IAClC,qEAAqE;IAC7D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,WAAmB,EAAE,cAAsB,EAAE,UAAkB;QACzE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,eAA0D,CAAC;QAC/D,IAAI,cAAgD,CAAC;QAErD,IAAI,CAAC;YACH,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpD,MAAM,CAAC,0BAA0B,CAAC;gBAClC,MAAM,CAAC,iBAAiB,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,+EAA+E;gBAC7E,qDAAqD,CACxD,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,eAAe,CAAC;QAChD,MAAM,EAAE,sBAAsB,EAAE,GAAG,cAAc,CAAC;QAElD,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,WAAW,2BAA2B,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,sBAAsB,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE7D,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU,EACf,MAA8C,CAC/C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YAChE,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}

package/dist/src/audit/cloudwatch.d.ts

@@ -0,0 +1,20 @@
+import type { AuditEntry } from "../types.js";
+import type { AuditBackend } from "./index.js";
+/**
+ * CloudWatchAuditLogger buffers AuditEntry objects and sends them to AWS
+ * CloudWatch Logs on flush().
+ *
+ * Requires the optional dependency @aws-sdk/client-cloudwatch-logs.
+ * If the SDK is not installed the logger is silently disabled.
+ */
+export declare class CloudWatchAuditLogger implements AuditBackend {
+    private logGroup;
+    private region;
+    private buffer;
+    /** Set to false when the SDK cannot be loaded so we never crash. */
+    private enabled;
+    constructor(logGroup: string, region?: string);
+    log(entry: AuditEntry): Promise<void>;
+    flush(): Promise<void>;
+}
+//# sourceMappingURL=cloudwatch.d.ts.map

package/dist/src/audit/cloudwatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudwatch.d.ts","sourceRoot":"","sources":["../../../src/audit/cloudwatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,YAAY;IACxD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAAoB;IAClC,oEAAoE;IACpE,OAAO,CAAC,OAAO,CAAQ;gBAEX,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAKvC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAyE7B"}

package/dist/src/audit/cloudwatch.js

@@ -0,0 +1,89 @@
+/**
+ * CloudWatchAuditLogger buffers AuditEntry objects and sends them to AWS
+ * CloudWatch Logs on flush().
+ *
+ * Requires the optional dependency @aws-sdk/client-cloudwatch-logs.
+ * If the SDK is not installed the logger is silently disabled.
+ */
+export class CloudWatchAuditLogger {
+    logGroup;
+    region;
+    buffer = [];
+    /** Set to false when the SDK cannot be loaded so we never crash. */
+    enabled = true;
+    constructor(logGroup, region) {
+        this.logGroup = logGroup;
+        this.region = region;
+    }
+    async log(entry) {
+        if (!this.enabled)
+            return;
+        this.buffer.push(entry);
+    }
+    async flush() {
+        if (!this.enabled || this.buffer.length === 0)
+            return;
+        // Snapshot and clear the in-flight entries; restore on error.
+        const toSend = this.buffer.splice(0);
+        let sdk;
+        try {
+            sdk = await import("@aws-sdk/client-cloudwatch-logs");
+        }
+        catch {
+            console.warn("[CloudWatchAuditLogger] @aws-sdk/client-cloudwatch-logs is not installed. " +
+                "CloudWatch audit logging is disabled.");
+            this.enabled = false;
+            // Entries are already removed from the buffer — drop them gracefully.
+            return;
+        }
+        const { CloudWatchLogsClient, CreateLogGroupCommand, CreateLogStreamCommand, PutLogEventsCommand, } = sdk;
+        const client = new CloudWatchLogsClient(this.region ? { region: this.region } : {});
+        // Derive a log stream per engagement / date so streams stay manageable.
+        // Use the first entry's engagement_id and today's UTC date.
+        const engagementId = toSend[0]?.engagement_id ?? "unknown";
+        const date = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
+        const logStream = `${engagementId}/${date}`;
+        try {
+            // Ensure the log group exists (idempotent).
+            try {
+                await client.send(new CreateLogGroupCommand({ logGroupName: this.logGroup }));
+            }
+            catch (err) {
+                if (!isResourceAlreadyExists(err))
+                    throw err;
+            }
+            // Ensure the log stream exists (idempotent).
+            try {
+                await client.send(new CreateLogStreamCommand({
+                    logGroupName: this.logGroup,
+                    logStreamName: logStream,
+                }));
+            }
+            catch (err) {
+                if (!isResourceAlreadyExists(err))
+                    throw err;
+            }
+            // Publish the buffered entries.
+            await client.send(new PutLogEventsCommand({
+                logGroupName: this.logGroup,
+                logStreamName: logStream,
+                logEvents: toSend.map((entry) => ({
+                    timestamp: new Date(entry.timestamp).getTime(),
+                    message: JSON.stringify(entry),
+                })),
+            }));
+        }
+        catch (err) {
+            console.error("[CloudWatchAuditLogger] flush() failed:", err);
+            // Put entries back at the front of the buffer for the next retry.
+            this.buffer.unshift(...toSend);
+        }
+    }
+}
+function isResourceAlreadyExists(err) {
+    return (typeof err === "object" &&
+        err !== null &&
+        "name" in err &&
+        err.name === "ResourceAlreadyExistsException");
+}
+//# sourceMappingURL=cloudwatch.js.map

package/dist/src/audit/cloudwatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudwatch.js","sourceRoot":"","sources":["../../../src/audit/cloudwatch.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACxB,QAAQ,CAAS;IACjB,MAAM,CAAqB;IAC3B,MAAM,GAAiB,EAAE,CAAC;IAClC,oEAAoE;IAC5D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,QAAgB,EAAE,MAAe;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,GAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,4EAA4E;gBAC1E,uCAAuC,CAC1C,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EACJ,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,GAAG,GAAG,CAAC;QAER,MAAM,MAAM,GAAG,IAAI,oBAAoB,CACrC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;QAEF,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;QACjE,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,IAAI,CAAC;YACH,4CAA4C;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;YAC/C,CAAC;YAED,6CAA6C;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,sBAAsB,CAAC;oBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;oBAC3B,aAAa,EAAE,SAAS;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;YAC/C,CAAC;YAED,gCAAgC;YAChC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,aAAa,EAAE,SAAS;gBACxB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAC9C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC/B,CAAC,CAAC;aACJ,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC9D,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAAwB,CAAC,IAAI,KAAK,gCAAgC,CACpE,CAAC;AACJ,CAAC"}

package/dist/src/audit/gcp-logging.d.ts

@@ -0,0 +1,23 @@
+import type { AuditEntry } from "../types.js";
+import type { AuditBackend } from "./index.js";
+/**
+ * GcpAuditLogger buffers AuditEntry objects and writes them to Google Cloud
+ * Logging on flush().
+ *
+ * Requires the optional dependency @google-cloud/logging. If the SDK is not
+ * installed the logger is silently disabled.
+ *
+ * Severity mapping:
+ *   BLOCKED* decisions → WARNING
+ *   ALLOWED*  decisions → INFO
+ */
+export declare class GcpAuditLogger implements AuditBackend {
+    private projectId;
+    private buffer;
+    /** Set to false when the SDK cannot be loaded so we never crash. */
+    private enabled;
+    constructor(projectId?: string);
+    log(entry: AuditEntry): Promise<void>;
+    flush(): Promise<void>;
+}
+//# sourceMappingURL=gcp-logging.d.ts.map

package/dist/src/audit/gcp-logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-logging.d.ts","sourceRoot":"","sources":["../../../src/audit/gcp-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAoB;IAClC,oEAAoE;IACpE,OAAO,CAAC,OAAO,CAAQ;gBAEX,SAAS,CAAC,EAAE,MAAM;IAIxB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAqD7B"}

package/dist/src/audit/gcp-logging.js

@@ -0,0 +1,70 @@
+const LOG_NAME = "mcp-proxy-audit";
+/**
+ * GcpAuditLogger buffers AuditEntry objects and writes them to Google Cloud
+ * Logging on flush().
+ *
+ * Requires the optional dependency @google-cloud/logging. If the SDK is not
+ * installed the logger is silently disabled.
+ *
+ * Severity mapping:
+ *   BLOCKED* decisions → WARNING
+ *   ALLOWED*  decisions → INFO
+ */
+export class GcpAuditLogger {
+    projectId;
+    buffer = [];
+    /** Set to false when the SDK cannot be loaded so we never crash. */
+    enabled = true;
+    constructor(projectId) {
+        this.projectId = projectId;
+    }
+    async log(entry) {
+        if (!this.enabled)
+            return;
+        this.buffer.push(entry);
+    }
+    async flush() {
+        if (!this.enabled || this.buffer.length === 0)
+            return;
+        // Snapshot and clear the in-flight entries; restore on error.
+        const toSend = this.buffer.splice(0);
+        let sdk;
+        try {
+            sdk = await import("@google-cloud/logging");
+        }
+        catch {
+            console.warn("[GcpAuditLogger] @google-cloud/logging is not installed. " +
+                "GCP audit logging is disabled.");
+            this.enabled = false;
+            // Entries are already removed from the buffer — drop them gracefully.
+            return;
+        }
+        const { Logging } = sdk;
+        const loggingClient = this.projectId
+            ? new Logging({ projectId: this.projectId })
+            : new Logging();
+        const log = loggingClient.log(LOG_NAME);
+        try {
+            const gcpEntries = toSend.map((entry) => {
+                const severity = entry.decision.startsWith("BLOCKED") ? "WARNING" : "INFO";
+                return log.entry({
+                    severity,
+                    resource: {
+                        type: "global",
+                        labels: {
+                            engagement_id: entry.engagement_id,
+                            client: entry.client,
+                        },
+                    },
+                }, entry);
+            });
+            await log.write(gcpEntries);
+        }
+        catch (err) {
+            console.error("[GcpAuditLogger] flush() failed:", err);
+            // Put entries back at the front of the buffer for the next retry.
+            this.buffer.unshift(...toSend);
+        }
+    }
+}
+//# sourceMappingURL=gcp-logging.js.map

package/dist/src/audit/gcp-logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-logging.js","sourceRoot":"","sources":["../../../src/audit/gcp-logging.ts"],"names":[],"mappings":"AAGA,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAAqB;IAC9B,MAAM,GAAiB,EAAE,CAAC;IAClC,oEAAoE;IAC5D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,SAAkB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,GAA2C,CAAC;QAChD,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,2DAA2D;gBACzD,gCAAgC,CACnC,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAExB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS;YAClC,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAElB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBAE3E,OAAO,GAAG,CAAC,KAAK,CACd;oBACE,QAAQ;oBACR,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE;4BACN,aAAa,EAAE,KAAK,CAAC,aAAa;4BAClC,MAAM,EAAE,KAAK,CAAC,MAAM;yBACrB;qBACF;iBACF,EACD,KAAK,CACN,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}

package/dist/src/audit/index.d.ts

@@ -0,0 +1,49 @@
+import type { AuditEntry } from "../types.js";
+export type { AuditEntry };
+/**
+ * Common interface that every audit backend must implement.
+ */
+export interface AuditBackend {
+    log(entry: AuditEntry): Promise<void>;
+    flush(): Promise<void>;
+}
+/**
+ * AuditLogger is the central facade for audit logging.
+ *
+ * - Always includes a LocalAuditLogger backend (writes JSONL files).
+ * - Additional cloud backends can be registered via addBackend().
+ * - Errors from any backend are caught and logged to console.error; they
+ *   never propagate to callers.
+ * - A periodic flush timer can be started/stopped via start()/stop().
+ */
+export declare class AuditLogger {
+    private backends;
+    private flushIntervalMs;
+    private timer;
+    constructor(localPath: string, flushIntervalMs?: number);
+    /**
+     * Register an additional backend (e.g. a cloud logging sink).
+     */
+    addBackend(backend: AuditBackend): void;
+    /**
+     * Start the periodic flush timer.
+     */
+    start(): void;
+    /**
+     * Dispatch an entry to all backends.
+     * Errors from individual backends are caught and reported via console.error
+     * but never thrown.
+     */
+    log(entry: AuditEntry): Promise<void>;
+    /**
+     * Flush all backends.
+     * Each backend is flushed independently; a failure in one does NOT prevent
+     * the others from being flushed.
+     */
+    flush(): Promise<void>;
+    /**
+     * Stop the flush timer and perform one final flush.
+     */
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/src/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,KAAK,CAA+C;gBAEhD,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM;IAMvD;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIvC;;OAEG;IACH,KAAK,IAAI,IAAI;IASb;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAO5B"}

package/dist/src/audit/index.js

@@ -0,0 +1,79 @@
+import { LocalAuditLogger } from "./local.js";
+const DEFAULT_FLUSH_INTERVAL_MS = 5000;
+/**
+ * AuditLogger is the central facade for audit logging.
+ *
+ * - Always includes a LocalAuditLogger backend (writes JSONL files).
+ * - Additional cloud backends can be registered via addBackend().
+ * - Errors from any backend are caught and logged to console.error; they
+ *   never propagate to callers.
+ * - A periodic flush timer can be started/stopped via start()/stop().
+ */
+export class AuditLogger {
+    backends = [];
+    flushIntervalMs;
+    timer = null;
+    constructor(localPath, flushIntervalMs) {
+        this.flushIntervalMs = flushIntervalMs ?? DEFAULT_FLUSH_INTERVAL_MS;
+        // Local backend is always present
+        this.backends.push(new LocalAuditLogger(localPath));
+    }
+    /**
+     * Register an additional backend (e.g. a cloud logging sink).
+     */
+    addBackend(backend) {
+        this.backends.push(backend);
+    }
+    /**
+     * Start the periodic flush timer.
+     */
+    start() {
+        if (this.timer !== null) {
+            return; // already running
+        }
+        this.timer = setInterval(() => {
+            void this.flush();
+        }, this.flushIntervalMs);
+    }
+    /**
+     * Dispatch an entry to all backends.
+     * Errors from individual backends are caught and reported via console.error
+     * but never thrown.
+     */
+    async log(entry) {
+        await Promise.all(this.backends.map(async (backend) => {
+            try {
+                await backend.log(entry);
+            }
+            catch (err) {
+                console.error("[AuditLogger] Backend log() failed:", err);
+            }
+        }));
+    }
+    /**
+     * Flush all backends.
+     * Each backend is flushed independently; a failure in one does NOT prevent
+     * the others from being flushed.
+     */
+    async flush() {
+        await Promise.all(this.backends.map(async (backend) => {
+            try {
+                await backend.flush();
+            }
+            catch (err) {
+                console.error("[AuditLogger] Backend flush() failed:", err);
+            }
+        }));
+    }
+    /**
+     * Stop the flush timer and perform one final flush.
+     */
+    async stop() {
+        if (this.timer !== null) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        await this.flush();
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/src/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAY9C,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACd,QAAQ,GAAmB,EAAE,CAAC;IAC9B,eAAe,CAAS;IACxB,KAAK,GAA0C,IAAI,CAAC;IAE5D,YAAY,SAAiB,EAAE,eAAwB;QACrD,IAAI,CAAC,eAAe,GAAG,eAAe,IAAI,yBAAyB,CAAC;QACpE,kCAAkC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAqB;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,kBAAkB;QAC5B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/src/audit/local.d.ts

@@ -0,0 +1,25 @@
+import type { AuditEntry } from "../types.js";
+/**
+ * LocalAuditLogger buffers AuditEntry objects in memory, keyed by engagement_id,
+ * and writes them to JSONL files on disk when flush() is called.
+ *
+ * Each file lives at: {basePath}/{engagement_id}.jsonl
+ * Entries are appended (not overwritten) so multiple sessions accumulate.
+ */
+export declare class LocalAuditLogger {
+    private basePath;
+    /** Buffer: engagement_id -> list of serialized JSON lines */
+    private buffer;
+    constructor(basePath: string);
+    /**
+     * Buffer an entry in memory.  Does NOT write to disk.
+     */
+    log(entry: AuditEntry): Promise<void>;
+    /**
+     * Write all buffered entries to disk and clear the buffer.
+     * Creates the base directory if it does not exist.
+     * Appends to any existing file for the same engagement_id.
+     */
+    flush(): Promise<void>;
+}
+//# sourceMappingURL=local.d.ts.map

package/dist/src/audit/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../src/audit/local.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,6DAA6D;IAC7D,OAAO,CAAC,MAAM,CAAwC;gBAE1C,QAAQ,EAAE,MAAM;IAI5B;;OAEG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAsB7B"}

package/dist/src/audit/local.js

@@ -0,0 +1,51 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+/**
+ * LocalAuditLogger buffers AuditEntry objects in memory, keyed by engagement_id,
+ * and writes them to JSONL files on disk when flush() is called.
+ *
+ * Each file lives at: {basePath}/{engagement_id}.jsonl
+ * Entries are appended (not overwritten) so multiple sessions accumulate.
+ */
+export class LocalAuditLogger {
+    basePath;
+    /** Buffer: engagement_id -> list of serialized JSON lines */
+    buffer = new Map();
+    constructor(basePath) {
+        this.basePath = basePath;
+    }
+    /**
+     * Buffer an entry in memory.  Does NOT write to disk.
+     */
+    async log(entry) {
+        const id = entry.engagement_id;
+        if (!this.buffer.has(id)) {
+            this.buffer.set(id, []);
+        }
+        this.buffer.get(id).push(entry);
+    }
+    /**
+     * Write all buffered entries to disk and clear the buffer.
+     * Creates the base directory if it does not exist.
+     * Appends to any existing file for the same engagement_id.
+     */
+    async flush() {
+        if (this.buffer.size === 0) {
+            return;
+        }
+        // Ensure the base directory exists
+        fs.mkdirSync(this.basePath, { recursive: true });
+        for (const [engagementId, entries] of this.buffer.entries()) {
+            if (entries.length === 0) {
+                continue;
+            }
+            const filePath = path.join(this.basePath, `${engagementId}.jsonl`);
+            // Build the content to append: one JSON object per line, terminated with \n
+            const lines = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
+            fs.appendFileSync(filePath, lines, "utf-8");
+        }
+        // Clear buffer after successful flush
+        this.buffer.clear();
+    }
+}
+//# sourceMappingURL=local.js.map

package/dist/src/audit/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../../src/audit/local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAS;IACzB,6DAA6D;IACrD,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEtD,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,mCAAmC;QACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,YAAY,QAAQ,CAAC,CAAC;YACnE,4EAA4E;YAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACtE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/src/config.d.ts

@@ -0,0 +1,25 @@
+export interface ProxyConfig {
+    manifestPath?: string;
+    manifestJson?: string;
+    manifestSecretArn?: string;
+    manifestKeyvaultUri?: string;
+    manifestGcpSecret?: string;
+    transport: "stdio" | "sse";
+    upstreamMcpUrl?: string;
+    upstreamMcpCommand?: string;
+    upstreamMcpArgs?: string[];
+    proxyPort: number;
+    auditLogPath: string;
+    awsLogGroup?: string;
+    awsRegion?: string;
+    azureLogWorkspaceId?: string;
+    azureDcrImmutableId?: string;
+    azureDcrStreamName: string;
+    gcpProject?: string;
+    techniqueMapPath?: string;
+    dnsCacheTtl: number;
+    logLevel: string;
+    proxyVersion: string;
+}
+export declare function loadConfig(): ProxyConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,UAAU,IAAI,WAAW,CAwBxC"}