@integsec/agentic-pentest-proxy 0.3.1 → 0.3.3

package/README.md

@@ -4,7 +4,7 @@ An MCP proxy that checks tool calls against a pentest scope manifest before forw
 
 **Requires Node.js 22 or newer.** The proxy supports stdio tools, SSE upstreams such as Burp Suite, and HTTP upstreams.
 
-**Managing several tools?** The [managed gateway](docs/managed-gateway.md) adds a browser UI for tool toggles, scope drafts, and team users, one MCP URL for ChatGPT and Claude, a local Burp route, and per-scope execution profiles for local models.
+**Managing several tools?** The [managed gateway](docs/managed-gateway.md) adds a browser UI with curated MCP server presets, scope templates and technique checkboxes, JSON policy import and download, administrator approval and assignment, and a separate engagement choice for each user. It supports one hosted MCP URL for ChatGPT and Claude and a local Burp route.
 
 ## Quick start: add an MCP tool
 

package/cloudflare/src/worker.mjs

@@ -68,7 +68,7 @@ export class PentestGatewayContainer extends Container {
   }
 
   async persistMutation(request) {
-    const previous = await this.ctx.storage.get('gateway-state') ?? { version: 1, upstreams: [], scopes: [], activeScopeId: null };
+    const previous = await this.ctx.storage.get('gateway-state') ?? { version: 2, upstreams: [], scopes: [], selectedScopeByUser: {} };
     const response = await this.containerFetch(request);
     if (!response.ok) return response;
     const currentResponse = await this.containerFetch('http://localhost:9091/__internal/state', {
@@ -111,8 +111,9 @@ export class PentestGatewayContainer extends Container {
 
   async listAudit(request) {
     const check = await this.containerFetch('http://localhost:9091/api/session', { headers: request.headers });
-    await check.body?.cancel();
-    if (check.status !== 200) return text('Administrator access required', 403);
+    if (check.status !== 200) { await check.body?.cancel(); return text('Administrator access required', 403); }
+    const session = await check.json();
+    if (session.role !== 'admin') return text('Administrator access required', 403);
     const entries = await this.ctx.storage.list({ prefix: 'audit:', reverse: true, limit: 100 });
     return json({ entries: [...entries.values()] });
   }

package/cloudflare/wrangler.jsonc

@@ -4,12 +4,13 @@
   "main": "src/worker.mjs",
   "compatibility_date": "2026-11-07",
   "workers_dev": true,
+  "preview_urls": false,
   "routes": [{ "pattern": "agentic-proxy.pentestprepper.com", "custom_domain": true }],
   "observability": { "enabled": true },
   "containers": [
     {
       "class_name": "PentestGatewayContainer",
-      "image": "docker.io/integsec/agentic-pentest-mcp-proxy:0.3.1",
+      "image": "docker.io/integsec/agentic-pentest-mcp-proxy:0.3.3",
       "instance_type": "basic",
       "max_instances": 1
     }

package/dist/bin/integsec-agentic-pentest-bridge.js

@@ -12,9 +12,9 @@ const url = new URL(process.argv[2] ?? process.env.GATEWAY_URL ?? "http://127.0.
 if (!["127.0.0.1", "localhost", "[::1]"].includes(url.hostname) || url.protocol !== "http:") {
     throw new Error("The local bridge only accepts a loopback HTTP gateway URL");
 }
-const upstream = new Client({ name: "agentic-pentest-bridge", version: "0.3.1" });
+const upstream = new Client({ name: "agentic-pentest-bridge", version: "0.3.3" });
 await upstream.connect(new StreamableHTTPClientTransport(url));
-const bridge = new Server({ name: "agentic-pentest-local", version: "0.3.1" }, { capabilities: { tools: {} } });
+const bridge = new Server({ name: "agentic-pentest-local", version: "0.3.3" }, { capabilities: { tools: {} } });
 bridge.setRequestHandler(ListToolsRequestSchema, async (request) => upstream.listTools(request.params));
 bridge.setRequestHandler(CallToolRequestSchema, async (request) => upstream.callTool(request.params));
 await bridge.connect(new StdioServerTransport());

package/dist/src/config.js

@@ -50,7 +50,7 @@ export function loadConfig() {
         techniqueMapPath: process.env.TECHNIQUE_MAP_PATH,
         dnsCacheTtl: parseInt(process.env.DNS_CACHE_TTL || "60", 10),
         logLevel: process.env.LOG_LEVEL || "INFO",
-        proxyVersion: process.env.PROXY_VERSION || "0.3.1",
+        proxyVersion: process.env.PROXY_VERSION || "0.3.3",
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/src/gateway/admin.html

@@ -4,19 +4,18 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>IntegSec MCP Gateway</title>
 <style>
-  :root{font:15px system-ui,sans-serif;color:#e8f0f2;background:#0b1218}
-  *{box-sizing:border-box}body{margin:0}header{padding:22px 5vw;background:#10202b;border-bottom:1px solid #234052;display:flex;justify-content:space-between;align-items:center;gap:20px}
-  h1{font-size:21px;margin:0}h2{font-size:18px;margin:0 0 14px}h3{font-size:15px;margin:16px 0 6px}p{color:#a8bdc8;line-height:1.45}main{max-width:1200px;margin:30px auto;padding:0 20px;display:grid;grid-template-columns:1fr 1fr;gap:20px}.card{background:#14222c;border:1px solid #294454;border-radius:13px;padding:24px}.wide{grid-column:1/-1}
-  input,select,textarea,button{font:inherit}input,select,textarea{width:100%;background:#0b1720;color:#fff;border:1px solid #426073;border-radius:7px;padding:9px;margin:5px 0 12px}textarea{min-height:70px}label{display:block;color:#c1d0d8;font-weight:600;font-size:13px}button{border:0;border-radius:7px;background:#26bfa4;color:#081914;padding:9px 14px;font-weight:700;cursor:pointer;margin:4px 7px 4px 0}button.secondary{background:#304b5a;color:#e8f0f2}button.danger{background:#6d3541;color:#fff}button:disabled{opacity:.5;cursor:not-allowed}.grid{display:grid;grid-template-columns:1fr 1fr;gap:0 14px}.row{border-top:1px solid #294454;padding:12px 0;display:flex;align-items:center;justify-content:space-between;gap:12px}.muted{font-size:12px;color:#93acb9}#status{padding:8px 5vw;color:#8ee7ce;min-height:35px}#status.error{color:#ff9e9e}code{color:#a6e7db}[hidden]{display:none!important}@media(max-width:800px){main{display:block}.card{margin-bottom:20px}.grid{display:block}}
+  :root{font:15px system-ui,sans-serif;color:#e8f0f2;background:#0b1218}*{box-sizing:border-box}body{margin:0}header{padding:22px 5vw;background:#10202b;border-bottom:1px solid #234052;display:flex;justify-content:space-between;align-items:center;gap:20px}h1{font-size:21px;margin:0}h2{font-size:18px;margin:0 0 14px}h3{font-size:15px;margin:16px 0 6px}p{color:#a8bdc8;line-height:1.45}main{max-width:1200px;margin:30px auto;padding:0 20px;display:grid;grid-template-columns:1fr 1fr;gap:20px}.card{background:#14222c;border:1px solid #294454;border-radius:13px;padding:24px}.wide{grid-column:1/-1}input,select,textarea,button{font:inherit}input:not([type=checkbox]),select,textarea{width:100%;background:#0b1720;color:#fff;border:1px solid #426073;border-radius:7px;padding:9px;margin:5px 0 12px}textarea{min-height:70px}label{display:block;color:#c1d0d8;font-weight:600;font-size:13px}button{border:0;border-radius:7px;background:#26bfa4;color:#081914;padding:9px 14px;font-weight:700;cursor:pointer;margin:4px 7px 4px 0}button.secondary{background:#304b5a;color:#e8f0f2}button.danger{background:#6d3541;color:#fff}button:disabled{opacity:.5;cursor:not-allowed}.grid{display:grid;grid-template-columns:1fr 1fr;gap:0 14px}.row{border-top:1px solid #294454;padding:12px 0;display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap}.muted{font-size:12px;color:#93acb9}.choices{display:flex;flex-wrap:wrap;gap:8px 18px;margin:12px 0}.choices label{display:inline-flex;gap:7px;align-items:center;font-weight:400;font-size:14px}.choices input{width:auto;margin:0}.pill{display:inline-block;background:#234051;border-radius:20px;padding:3px 9px;font-size:12px;margin-left:8px}.actions{display:flex;flex-wrap:wrap;gap:3px}.help{background:#0d1e28;border-left:3px solid #26bfa4;padding:10px 14px;margin:12px 0}.review{white-space:pre-wrap;background:#0b1720;border:1px solid #426073;border-radius:7px;padding:14px;line-height:1.5}#status{padding:8px 5vw;color:#8ee7ce;min-height:35px}#status.error{color:#ff9e9e}code{color:#a6e7db}[hidden]{display:none!important}a{color:#8ee7ce}@media(max-width:800px){main{display:block}.card{margin-bottom:20px}.grid{display:block}}
 </style>
-<header><h1>IntegSec MCP Gateway</h1><span class="muted">Manage tools and engagement scope</span></header>
-<div id="status" role="status"></div>
+<header><h1>IntegSec MCP Gateway</h1><span id="identity" class="muted">Loading session…</span></header>
+<div id="status" role="status" aria-live="polite"></div>
 <main>
-  <section id="token-card" class="card wide" hidden><h2>Administrator access</h2><p>Enter the local gateway admin token. It stays in this browser tab only.</p><div class="grid"><label>Admin token<input id="token" type="password" autocomplete="off"></label><div><br><button id="connect">Connect</button></div></div></section>
-  <section id="users-card" class="card wide" hidden><h2>Team users</h2><p>Cloudflare Access signs users in. Only people on this list can use the gateway; administrators can also manage tools, scopes, and users. Bootstrap administrators are set in deployment configuration.</p><div id="users"></div><h3>Add a user</h3><div class="grid"><label>Email<input id="user-email" type="email" autocomplete="off" placeholder="tester@example.com"></label><label>Role<select id="user-role"><option value="tester">Tester: MCP tools</option><option value="admin">Administrator: manage gateway</option></select></label></div><button id="add-user">Add user</button></section>
-  <section class="card"><h2>MCP servers</h2><div id="upstreams"></div><h3>Add a server</h3><div class="grid"><label>Name<input id="up-name" placeholder="burp"></label><label>Transport<select id="up-transport"><option value="stdio">Local process</option><option value="http">Streamable HTTP</option><option value="sse">SSE</option></select></label></div><label>Command or URL<input id="up-target" placeholder="burp-mcp-server or https://example.com/mcp"></label><label>Arguments, one per line<textarea id="up-args" placeholder="--port\n3000"></textarea></label><button id="add-upstream">Add server</button></section>
-  <section class="card"><h2>Engagement scopes</h2><p>Save a draft, review it, then activate it. The active scope cannot be edited in place.</p><div id="scopes"></div><h3>Scope editor</h3><div class="grid"><label>Engagement ID<input id="engagement" placeholder="ENG-2026-001"></label><label>Client<input id="client" placeholder="Example Client"></label><label>Operator<input id="operator" placeholder="Test Team"></label><label>Starts (UTC)<input id="starts" type="datetime-local"></label><label>Ends (UTC)<input id="ends" type="datetime-local"></label><label>Execution profile<select id="profile"><option value="isolated">Isolated: local MCP only</option><option value="restricted">Restricted: approved hosts</option><option value="connected">Connected: network MCP allowed</option></select></label></div><p class="muted">Use one item per line in each field.</p><div class="grid"><label>IP ranges<textarea id="ips"></textarea></label><label>Domains<textarea id="domains"></textarea></label><label>URLs<textarea id="urls"></textarea></label><label>Cloud accounts<textarea id="cloud"></textarea></label><label>Excluded targets<textarea id="excluded-targets"></textarea></label><label>Authorized techniques<textarea id="techniques"></textarea></label><label>Excluded techniques<textarea id="excluded-techniques"></textarea></label><label>Allowed MCP hosts (restricted profile)<textarea id="hosts"></textarea></label></div><button id="save-scope">Save draft</button><button id="new-scope" class="secondary">Clear editor</button></section>
-  <section class="card wide"><h2>Client connection</h2><p id="connection">Connect as an administrator to see the endpoint.</p><p class="muted">Local Burp tools must run on each tester’s own gateway or local MCP connection. A public gateway cannot launch Burp on a tester’s laptop.</p></section>
+  <section id="token-card" class="card wide" hidden><h2>Local administrator access</h2><p>Enter the local gateway admin token. It stays in this browser tab only.</p><div class="grid"><label>Admin token<input id="token" type="password" autocomplete="off"></label><div><br><button id="connect">Connect</button></div></div></section>
+  <section id="my-card" class="card wide" hidden><h2>My engagement</h2><p>Choose an approved engagement assigned to you. Your choice affects only your MCP calls. No engagement means no tools.</p><div class="actions"><button id="create-engagement" hidden>Create engagement</button><button id="import-policy" class="secondary" hidden>Import scope JSON</button><input id="policy-file" type="file" accept=".json,application/json" hidden><button id="clear-selection" class="secondary" hidden>Clear selection</button></div><div id="my-engagements"></div><p id="my-selection" class="help"></p></section>
+  <section id="users-card" class="card wide admin-only" hidden><h2>Team users</h2><p>Cloudflare Access handles sign-in. People must also be on this exact-email list and assigned to an approved engagement. Administrators manage users, servers and scopes.</p><div id="users"></div><h3>Add a user</h3><div class="grid"><label>Email<input id="user-email" type="email" autocomplete="off" placeholder="tester@example.com"></label><label>Role<select id="user-role"><option value="tester">Tester</option><option value="admin">Administrator</option></select></label></div><button id="add-user">Add user</button></section>
+  <section id="upstreams-card" class="card admin-only" hidden><h2>MCP servers</h2><p>Add an MCP server, then turn it on when its connection is ready. Adding a preset does not install the upstream software. Tools that run on a tester’s laptop must be added to that tester’s local gateway.</p><div id="upstreams"></div><h3>Curated servers</h3><div id="presets"></div><h3>Add a custom server</h3><div class="grid"><label>Name<input id="up-name" placeholder="burp"></label><label>Transport<select id="up-transport"><option value="stdio">Local process</option><option value="http">Streamable HTTP</option><option value="sse">SSE</option></select></label></div><label>Command or URL<input id="up-target" placeholder="installed-command or https://tools.example.com/mcp"></label><label>Arguments, one per line<textarea id="up-args" placeholder="mcp"></textarea></label><button id="add-upstream">Add server</button></section>
+  <section id="scopes-card" class="card admin-only" hidden><h2>Engagement scopes</h2><p>Create or import a scope, save it, review and approve it, then assign users. Approved scopes are immutable; duplicate one to revise it. Every user chooses their own current engagement above.</p><div id="scopes"></div></section>
+  <section id="editor-card" class="card wide admin-only" hidden><h2>Scope editor</h2><div id="editor-help" class="help">Start with a blank form or load a template. Enter the real client and authorized targets before approval.</div><div class="actions"><button id="example-web" class="secondary">Web template</button><button id="example-internal" class="secondary">Network template</button><button id="example-cloud" class="secondary">Cloud template</button></div><div class="grid"><label>Engagement ID<input id="engagement" maxlength="64" placeholder="Engagement identifier"></label><label>Client<input id="client" maxlength="120" placeholder="Authorized client name"></label><label>Operator<input id="operator" maxlength="120" placeholder="Testing team or operator"></label><label>Starts (your local time)<input id="starts" type="datetime-local"></label><label>Ends (your local time)<input id="ends" type="datetime-local"></label><label>Execution profile<select id="profile"><option value="isolated">Isolated: local MCP only</option><option value="restricted">Restricted: approved MCP hosts</option><option value="connected">Connected: network MCP allowed</option></select></label></div><p class="muted">Use one authorized item per line. IPs require CIDR notation. Domains are hostnames. URLs must start with https:// or http://. Cloud accounts use aws:123456789012, azure:subscription-uuid, or gcp:project-id.</p><div class="grid"><label>IP ranges<textarea id="ips" placeholder="Authorized CIDR range"></textarea></label><label>Domains<textarea id="domains" placeholder="Authorized client domain"></textarea></label><label>URLs<textarea id="urls" placeholder="Authorized client URL"></textarea></label><label>Cloud accounts<textarea id="cloud" placeholder="Authorized cloud account"></textarea></label><label>Excluded targets<textarea id="excluded-targets" placeholder="Explicitly excluded target"></textarea></label><label>Allowed MCP hosts (restricted profile)<textarea id="hosts" placeholder="Approved MCP hostname"></textarea></label></div><h3>Authorized techniques</h3><p class="muted">Choose only activities the signed rules of engagement permit. Unselected categories are blocked. Unrecognized tool categories are blocked until mapped.</p><div id="techniques" class="choices"></div><h3>Explicit exclusions</h3><div id="excluded-techniques" class="choices"></div><div class="actions"><button id="save-scope">Save</button><button id="approve-current" class="secondary" hidden>Approve scope</button><button id="assign-me" class="secondary" hidden>Assign to me</button><button id="use-current" class="secondary" hidden>Use engagement</button><button id="new-scope" class="secondary">New scope</button></div><h3>Review before approval</h3><div id="scope-review" class="review"></div></section>
+  <section class="card wide"><h2>Client connection</h2><p id="connection">Sign in to see your MCP endpoint.</p><p class="muted">Local Burp tools run on each tester’s laptop through their local gateway. The hosted gateway cannot reach a tester’s laptop automatically.</p><p class="muted">Cloudflare Access supports passkeys for faster repeat sign-in when enabled for this application. Email codes remain available for enrollment and recovery.</p></section>
 </main>
 <script src="/admin.js" defer></script>
 </html>

package/dist/src/gateway/admin.js

@@ -1,109 +1,284 @@
 const $ = (id) => document.getElementById(id);
+const token = $('token');
+token.value = sessionStorage.getItem('gateway-token') || '';
+let mode = 'token';
+let role = 'admin';
+let email = null;
 let state = null;
 let editing = null;
-let mode = 'token';
+let viewingScopeId = null;
+let dirty = false;
 let bootstrapAdmins = new Set();
-const token = $('token');
-token.value = sessionStorage.getItem('gateway-token') || '';
+const techniques = [
+  ['recon', 'Reconnaissance and discovery'], ['web_app', 'Web and API testing'],
+  ['exploitation', 'Exploitation'], ['cloud_audit', 'Cloud assessment'],
+  ['dos', 'Denial of service'], ['destructive', 'Destructive actions'],
+  ['social_engineering', 'Social engineering'],
+];
+const presets = [
+  { name: 'burp', label: 'Burp Suite', transport: 'sse', url: 'http://127.0.0.1:9876', local: true, source: 'https://github.com/PortSwigger/mcp-server', note: 'Enable the official MCP extension inside the tester’s local Burp.' },
+  { name: 'semgrep', label: 'Semgrep', transport: 'stdio', command: 'semgrep', args: ['mcp'], local: true, source: 'https://github.com/semgrep/semgrep', note: 'Install and configure the official Semgrep CLI first.' },
+  { name: 'trivy', label: 'Trivy', transport: 'stdio', command: 'trivy', args: ['mcp'], local: true, source: 'https://github.com/aquasecurity/trivy-mcp', note: 'Install Trivy and its official MCP plugin first; pin and review your version.' },
+  { name: 'snyk', label: 'Snyk', transport: 'stdio', command: 'snyk', args: ['mcp', '-t', 'stdio'], local: true, source: 'https://github.com/snyk/studio-mcp', note: 'Install the Snyk CLI and authenticate locally first.' },
+  { label: 'OWASP ZAP', source: 'https://www.zaproxy.org/docs/desktop/addons/mcp-integration/mcp-options/', note: 'Reference only: its MCP security key needs authenticated upstream support.' },
+  { label: 'PortSwigger DAST', source: 'https://portswigger.net/burp/documentation/dast/user-guide/using-ai/mcp-server', note: 'Reference only: its hosted MCP endpoint requires an API key.' },
+  { label: 'Prowler Cloud', source: 'https://prowler.com/prowler-cloud', note: 'Reference only: its hosted MCP endpoint requires an API key.' },
+];
 
-function status(message, error = false) { const node = $('status'); node.textContent = message; node.classList.toggle('error', error); }
+function status(message, error = false) { $('status').textContent = message; $('status').classList.toggle('error', error); }
 async function api(path, method = 'GET', data) {
-  const response = await fetch(path, { method, credentials: 'same-origin', cache: 'no-store', headers: { ...(mode === 'token' ? { Authorization: `Bearer ${token.value}` } : {}), ...(data ? { 'Content-Type': 'application/json' } : {}) }, body: data ? JSON.stringify(data) : undefined });
-  const result = await response.json();
+  const response = await fetch(path, { method, credentials: 'same-origin', cache: 'no-store', headers: {
+    ...(mode === 'token' ? { Authorization: `Bearer ${token.value}` } : {}),
+    ...(data !== undefined ? { 'Content-Type': 'application/json' } : {}),
+  }, body: data !== undefined ? JSON.stringify(data) : undefined });
+  const result = await response.json().catch(() => ({}));
   if (!response.ok) throw new Error(result.error || `HTTP ${response.status}`);
   return result;
 }
-const lines = (id) => $(id).value.split(/\r?\n/).map(x => x.trim()).filter(Boolean);
+const lines = (id) => $(id).value.split(/\r?\n/).map((value) => value.trim()).filter(Boolean);
 const setLines = (id, values) => { $(id).value = values.join('\n'); };
 const make = (tag, value) => { const node = document.createElement(tag); node.textContent = value; return node; };
-const button = (label, action, style = 'secondary') => { const node = make('button', label); node.className = style; node.addEventListener('click', () => action().catch(e => status(e.message, true))); return node; };
+function button(label, action, style = 'secondary') {
+  const node = make('button', label); node.className = style;
+  node.addEventListener('click', () => Promise.resolve().then(action).catch((error) => status(error.message, true)));
+  return node;
+}
+function choiceList(container, name) {
+  const result = [];
+  for (const [value, label] of techniques) {
+    const option = make('label', ''); const input = document.createElement('input');
+    input.type = 'checkbox'; input.name = name; input.value = value;
+    option.append(input, make('span', label)); container.append(option); result.push(input);
+  }
+  return result;
+}
+const authorizedChoices = choiceList($('techniques'), 'authorized-technique');
+const excludedChoices = choiceList($('excluded-techniques'), 'excluded-technique');
+const checked = (choices) => choices.filter((item) => item.checked).map((item) => item.value);
+function setChecked(choices, values) { for (const item of choices) item.checked = values.includes(item.value); }
+function localDate(value) { const date = new Date(value); return new Date(date.getTime() - date.getTimezoneOffset() * 60000).toISOString().slice(0, 16); }
+function draftFromForm() {
+  if (!$('starts').value || !$('ends').value) throw new Error('Enter both engagement dates.');
+  const start = new Date($('starts').value); const end = new Date($('ends').value);
+  if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime())) throw new Error('Enter valid engagement dates.');
+  return { profile: $('profile').value, allowedHosts: lines('hosts'), manifest: {
+    engagement_id: $('engagement').value.trim(), client: $('client').value.trim(), operator: $('operator').value.trim(),
+    authorized_targets: { ip_ranges: lines('ips'), domains: lines('domains'), urls: lines('urls'), cloud_accounts: lines('cloud') },
+    excluded_targets: lines('excluded-targets'), authorized_techniques: checked(authorizedChoices),
+    excluded_techniques: checked(excludedChoices), engagement_window: { start: start.toISOString(), end: end.toISOString() },
+  } };
+}
+function summarize(scope) {
+  const m = scope.manifest;
+  return `Engagement: ${m.engagement_id || '(missing)'}\nClient: ${m.client || '(missing)'} · Operator: ${m.operator || '(missing)'}\nWindow: ${m.engagement_window.start} → ${m.engagement_window.end}\nProfile: ${scope.profile}\nTargets: ${Object.values(m.authorized_targets).flat().join(', ') || '(none)'}\nExcluded targets: ${m.excluded_targets.join(', ') || '(none)'}\nAuthorized techniques: ${m.authorized_techniques.join(', ') || '(none)'}\nExcluded techniques: ${m.excluded_techniques.join(', ') || '(none)'}\nAllowed MCP hosts: ${scope.allowedHosts.join(', ') || '(none)'}`;
+}
+function downloadPolicy(scope) {
+  const policy = { ...scope.manifest, gateway: { profile: scope.profile, allowed_hosts: scope.allowedHosts || [] } };
+  const filename = `${(scope.manifest.engagement_id || 'engagement').replace(/[^a-z0-9_-]/gi, '_')}.scope.json`;
+  const url = URL.createObjectURL(new Blob([`${JSON.stringify(policy, null, 2)}\n`], { type: 'application/json' }));
+  const link = document.createElement('a'); link.href = url; link.download = filename; document.body.append(link); link.click(); link.remove();
+  setTimeout(() => URL.revokeObjectURL(url), 1000);
+}
+function updateEditorActions() {
+  const current = state?.scopes.find((scope) => scope.id === viewingScopeId);
+  $('approve-current').hidden = !(current?.status === 'draft');
+  $('approve-current').disabled = dirty;
+  $('assign-me').hidden = !(role === 'admin' && mode === 'access' && current?.status === 'approved' && email && !current.assignedUserEmails.includes(email));
+  const windowOpen = current && Date.now() >= Date.parse(current.manifest.engagement_window.start) && Date.now() <= Date.parse(current.manifest.engagement_window.end);
+  $('use-current').hidden = !(current?.status === 'approved' && windowOpen && (mode === 'token' || current.assignedUserEmails.includes(email)) && !(mode === 'access' && current.profile === 'isolated'));
+}
+function newScope() {
+  if (dirty && !confirm('Discard unsaved scope changes?')) return;
+  clearEditor(); $('editor-card').scrollIntoView({ behavior: 'smooth' }); $('engagement').focus();
+}
+async function approveScope(scope) {
+  if (scope.id === viewingScopeId && dirty) throw new Error('Save your changes before approving this scope.');
+  if (!confirm(`Approve this scope for ${scope.manifest.engagement_id}?\n\n${summarize(scope)}\n\nApproval makes it eligible for assignment. No user is automatically assigned.`)) return;
+  await api(`/api/scopes/${scope.id}/approve`, 'POST'); await refresh();
+  const approved = state.scopes.find((item) => item.id === scope.id); if (approved) loadScope(approved);
+  status('Scope approved. Assign testers, then each tester selects the engagement.');
+}
+function reviewForm() {
+  try {
+    const scope = draftFromForm(); const m = scope.manifest; const warnings = [];
+    if (/^example/i.test(m.engagement_id) || /^example client$/i.test(m.client)) warnings.push('Replace the example engagement ID and client.');
+    if (m.authorized_targets.domains.some((value) => value.includes('example.'))) warnings.push('Replace documentation domains with real authorized domains.');
+    if (m.authorized_targets.urls.some((value) => value.includes('example.'))) warnings.push('Replace documentation URLs with real authorized URLs.');
+    if (Date.parse(m.engagement_window.end) <= Date.now()) warnings.push('Choose an end time in the future.');
+    $('scope-review').textContent = `${warnings.length ? `Before approval: ${warnings.join(' ')}\n\n` : ''}${summarize(scope)}`;
+  } catch (error) { $('scope-review').textContent = error.message; }
+  updateEditorActions();
+}
+for (const field of $('editor-card').querySelectorAll('input,select,textarea')) field.addEventListener('input', () => { dirty = true; reviewForm(); });
 
 async function refresh() {
-  state = await api('/api/state');
-  if (mode === 'access') {
-    const users = $('users'); users.replaceChildren();
-    for (const item of state.users) {
-      const row = make('div', ''); row.className = 'row';
-      const bootstrap = bootstrapAdmins.has(item.email);
-      row.append(make('div', `${item.email} · ${item.role}${bootstrap ? ' · Bootstrap administrator' : ''}`));
-      if (!bootstrap) {
-        row.append(button(item.role === 'admin' ? 'Make tester' : 'Make admin', async () => { await api(`/api/users/${item.id}`, 'PATCH', { role: item.role === 'admin' ? 'tester' : 'admin' }); await refresh(); }));
-        row.append(button('Remove', async () => { if (confirm(`Remove ${item.email}?`)) { await api(`/api/users/${item.id}`, 'DELETE'); await refresh(); } }, 'danger'));
-      }
-      users.append(row);
+  const mine = await api('/api/engagements');
+  $('my-card').hidden = false;
+  $('create-engagement').hidden = role !== 'admin';
+  $('import-policy').hidden = role !== 'admin';
+  const list = $('my-engagements'); list.replaceChildren();
+  for (const scope of mine.engagements) {
+    const active = mine.selectedScopeId === scope.id;
+    const windowOpen = Date.now() >= Date.parse(scope.manifest.engagement_window.start) && Date.now() <= Date.parse(scope.manifest.engagement_window.end);
+    const row = make('div', ''); row.className = 'row';
+    row.append(make('span', `${scope.manifest.engagement_id} · ${scope.manifest.client} · ${scope.profile} · ${windowOpen ? 'window open' : 'window closed'}${active ? ' · SELECTED' : ''}`));
+    const select = button(active ? 'Selected' : 'Select', async () => { await api('/api/my-scope', 'POST', { scopeId: scope.id }); await refresh(); });
+    select.disabled = active || !windowOpen;
+    row.append(select, button('Download scope JSON', () => downloadPolicy(scope))); list.append(row);
+  }
+  if (!mine.engagements.length) list.append(make('p', role === 'admin' ? 'No engagement assigned to you yet. Create one, or assign yourself to an approved scope below.' : 'No approved engagements have been assigned to you yet. Ask an administrator.'));
+  const selected = mine.engagements.find((item) => item.id === mine.selectedScopeId);
+  $('clear-selection').hidden = !selected;
+  const selectedWindowOpen = selected && Date.now() >= Date.parse(selected.manifest.engagement_window.start) && Date.now() <= Date.parse(selected.manifest.engagement_window.end);
+  $('my-selection').textContent = selected ? selectedWindowOpen ? `Current engagement: ${selected.manifest.engagement_id}. Its scope applies only to your MCP calls.` : `Engagement ${selected.manifest.engagement_id} is outside its approved window. Your MCP client will see no tools.` : 'No engagement selected. Your MCP client will see no tools.';
+  $('connection').textContent = `MCP endpoint: ${location.origin}/mcp. ${selected ? `Current engagement: ${selected.manifest.engagement_id}.` : 'Select an engagement before using tools.'}`;
+  if (role === 'admin') {
+    state = await api('/api/state');
+    renderUsers(); renderUpstreams(); renderPresets(); renderScopes();
+  }
+  status('Gateway state loaded.');
+}
+function renderUsers() {
+  if (mode !== 'access') return;
+  const container = $('users'); container.replaceChildren();
+  for (const user of state.users) {
+    const row = make('div', ''); row.className = 'row'; const bootstrap = bootstrapAdmins.has(user.email);
+    row.append(make('span', `${user.email} · ${user.role}${bootstrap ? ' · bootstrap administrator' : ''}`));
+    if (!bootstrap) {
+      row.append(button(user.role === 'admin' ? 'Make tester' : 'Make admin', async () => { await api(`/api/users/${user.id}`, 'PATCH', { role: user.role === 'admin' ? 'tester' : 'admin' }); await refresh(); }));
+      row.append(button('Remove', async () => { if (confirm(`Remove ${user.email} and all engagement assignments?`)) { await api(`/api/users/${user.id}`, 'DELETE'); await refresh(); } }, 'danger'));
     }
+    container.append(row);
   }
-  const up = $('upstreams'); up.replaceChildren();
+}
+function renderUpstreams() {
+  const container = $('upstreams'); container.replaceChildren();
   for (const item of state.upstreams) {
     const row = make('div', ''); row.className = 'row';
-    const label = make('div', `${item.name} · ${item.transport} · ${item.enabled ? 'Enabled' : 'Disabled'}`);
-    label.appendChild(make('div', item.transport === 'stdio' ? item.command : item.url));
-    row.append(label, button(item.enabled ? 'Disable' : 'Enable', async () => { await api(`/api/upstreams/${item.id}`, 'PATCH', { enabled: !item.enabled }); await refresh(); }));
-    row.append(button('Remove', async () => { if (confirm(`Remove ${item.name}?`)) { await api(`/api/upstreams/${item.id}`, 'DELETE'); await refresh(); } }, 'danger'));
-    up.append(row);
+    row.append(make('span', `${item.name} · ${item.transport} · ${item.enabled ? 'On' : 'Off'} · ${item.transport === 'stdio' ? item.command : item.url}`));
+    row.append(button(item.enabled ? 'Turn off' : 'Turn on', async () => { await api(`/api/upstreams/${item.id}`, 'PATCH', { enabled: !item.enabled }); await refresh(); }));
+    row.append(button('Remove', async () => { if (confirm(`Remove server ${item.name}?`)) { await api(`/api/upstreams/${item.id}`, 'DELETE'); await refresh(); } }, 'danger'));
+    container.append(row);
+  }
+}
+function renderPresets() {
+  const container = $('presets'); container.replaceChildren();
+  for (const preset of presets) {
+    const row = make('div', ''); row.className = 'row'; const detail = make('div', `${preset.label} · ${preset.note} `);
+    const link = make('a', 'Official information'); link.href = preset.source; link.target = '_blank'; link.rel = 'noopener noreferrer'; detail.append(link);
+    row.append(detail);
+    if (preset.name) {
+      if (mode === 'access' && preset.local) row.append(make('span', 'Local gateway only'));
+      else if (state.upstreams.some((item) => item.name === preset.name)) row.append(make('span', 'Added'));
+      else row.append(button('Add server', async () => { await api('/api/upstreams', 'POST', { name: preset.name, enabled: false, transport: preset.transport, command: preset.command, args: preset.args || [], url: preset.url }); await refresh(); status(`${preset.label} added and off. Turn it on when ready.`); }));
+    }
+    container.append(row);
   }
-  const scopes = $('scopes'); scopes.replaceChildren();
-  for (const item of state.scopes) {
-    const active = item.id === state.activeScopeId;
+}
+function renderScopes() {
+  const container = $('scopes'); container.replaceChildren();
+  for (const scope of state.scopes) {
     const row = make('div', ''); row.className = 'row';
-    row.append(make('div', `${item.manifest.engagement_id} · ${item.profile}${active ? ' · ACTIVE' : ''}`));
-    row.append(button('View', async () => loadScope(item)));
-    if (!active) {
-      row.append(button('Activate', async () => { await api(`/api/scopes/${item.id}/activate`, 'POST'); await refresh(); }));
-      row.append(button('Delete', async () => { if (confirm(`Delete draft ${item.manifest.engagement_id}?`)) { await api(`/api/scopes/${item.id}`, 'DELETE'); await refresh(); } }, 'danger'));
+    const label = make('div', `${scope.manifest.engagement_id} · ${scope.manifest.client}`);
+    label.append(make('span', scope.status === 'draft' ? 'Needs approval' : scope.status)); label.lastChild.className = 'pill';
+    row.append(label);
+    const actions = make('div', ''); actions.className = 'actions';
+    actions.append(button(scope.status === 'draft' ? 'Edit' : 'View', () => loadScope(scope)));
+    actions.append(button('Duplicate', async () => { const copy = await api(`/api/scopes/${scope.id}/duplicate`, 'POST'); await refresh(); loadScope(copy); status('Draft copy created. Edit and approve it when ready.'); }));
+    actions.append(button('Download JSON', () => downloadPolicy(scope)));
+    if (scope.status === 'draft') actions.append(button('Review and approve', () => approveScope(scope)));
+    actions.append(button('Delete', async () => { if (confirm(`Delete ${scope.manifest.engagement_id} (${scope.status})? Assigned users will lose this engagement.`)) { await api(`/api/scopes/${scope.id}`, 'DELETE'); await refresh(); } }, 'danger'));
+    row.append(actions); container.append(row);
+    if (scope.status === 'approved' && mode === 'access') {
+      const assignment = make('div', ''); assignment.className = 'choices';
+      const inputs = state.users.map((user) => { const label = make('label', ''); const input = document.createElement('input'); input.type = 'checkbox'; input.value = user.email; input.checked = scope.assignedUserEmails.includes(user.email); label.append(input, make('span', user.email)); assignment.append(label); return input; });
+      assignment.append(button('Save assignments', async () => { await api(`/api/scopes/${scope.id}/assignments`, 'PUT', { emails: inputs.filter((item) => item.checked).map((item) => item.value) }); await refresh(); }));
+      container.append(assignment);
     }
-    scopes.append(row);
   }
-  $('connection').textContent = `MCP endpoint: ${location.origin}/mcp. ${state.activeScopeId ? 'An engagement scope is active.' : 'Activate a scope before connecting clients.'}`;
-  status('Gateway state loaded.');
+  if (!state.scopes.length) container.append(make('p', 'No scopes yet. Use the editor below to create a draft.'));
 }
-function loadScope(item) {
-  editing = item.id === state.activeScopeId ? null : item.id;
-  const m = item.manifest;
+function loadScope(scope) {
+  editing = scope.status === 'draft' ? scope.id : null; viewingScopeId = scope.id; dirty = false;
+  const m = scope.manifest;
   $('engagement').value = m.engagement_id; $('client').value = m.client; $('operator').value = m.operator;
-  $('starts').value = m.engagement_window.start.slice(0,16); $('ends').value = m.engagement_window.end.slice(0,16);
-  $('profile').value = item.profile; setLines('ips', m.authorized_targets.ip_ranges); setLines('domains', m.authorized_targets.domains);
+  $('starts').value = localDate(m.engagement_window.start); $('ends').value = localDate(m.engagement_window.end);
+  $('profile').value = scope.profile; setLines('ips', m.authorized_targets.ip_ranges); setLines('domains', m.authorized_targets.domains);
   setLines('urls', m.authorized_targets.urls); setLines('cloud', m.authorized_targets.cloud_accounts);
-  setLines('excluded-targets', m.excluded_targets); setLines('techniques', m.authorized_techniques);
-  setLines('excluded-techniques', m.excluded_techniques); setLines('hosts', item.allowedHosts);
-  status(item.id === state.activeScopeId ? 'Viewing active scope. Saving creates a new draft.' : 'Draft loaded for editing.');
+  setLines('excluded-targets', m.excluded_targets); setLines('hosts', scope.allowedHosts);
+  setChecked(authorizedChoices, m.authorized_techniques); setChecked(excludedChoices, m.excluded_techniques);
+  for (const field of $('editor-card').querySelectorAll('input,select,textarea')) field.disabled = scope.status !== 'draft';
+  $('save-scope').disabled = scope.status !== 'draft';
+  $('editor-help').textContent = scope.status === 'draft' ? 'Editing a saved scope. Replace any example details and choose a future end date before approval.' : 'Viewing an immutable scope. Choose Duplicate to create an editable scope.';
+  reviewForm(); $('editor-card').scrollIntoView({ behavior: 'smooth' });
 }
-$('connect').onclick = () => { sessionStorage.setItem('gateway-token', token.value); refresh().catch(e => status(e.message, true)); };
-$('add-user').onclick = async () => {
-  try {
-    await api('/api/users', 'POST', { email: $('user-email').value.trim(), role: $('user-role').value });
-    $('user-email').value = ''; await refresh();
-  } catch (e) { status(e.message, true); }
-};
-$('add-upstream').onclick = async () => {
-  try {
-    const transport = $('up-transport').value;
-    await api('/api/upstreams', 'POST', { name: $('up-name').value.trim(), enabled: true, transport,
-      ...(transport === 'stdio' ? { command: $('up-target').value.trim(), args: lines('up-args') } : { url: $('up-target').value.trim(), args: [] }) });
-    $('up-name').value = ''; $('up-target').value = ''; $('up-args').value = ''; await refresh();
-  } catch (e) { status(e.message, true); }
-};
-$('new-scope').onclick = () => { editing = null; for (const id of ['engagement','client','operator','starts','ends','ips','domains','urls','cloud','excluded-targets','techniques','excluded-techniques','hosts']) $(id).value = ''; $('profile').value = 'isolated'; status('New draft.'); };
-$('save-scope').onclick = async () => {
+function clearEditor() {
+  editing = null; viewingScopeId = null; dirty = false;
+  for (const id of ['engagement', 'client', 'operator', 'starts', 'ends', 'ips', 'domains', 'urls', 'cloud', 'excluded-targets', 'hosts']) $(id).value = '';
+  $('profile').value = mode === 'access' ? 'connected' : 'isolated'; setChecked(authorizedChoices, []); setChecked(excludedChoices, []);
+  for (const field of $('editor-card').querySelectorAll('input,select,textarea')) field.disabled = false;
+  $('save-scope').disabled = false; $('editor-help').textContent = 'New scope. Enter the client, exact authorized targets, window and techniques, then Save.'; reviewForm();
+}
+function loadExample(kind) {
+  if (dirty && !confirm('Discard unsaved scope changes and load a template?')) return;
+  clearEditor();
+  if (kind === 'web') setChecked(authorizedChoices, ['recon', 'web_app']);
+  if (kind === 'internal') setChecked(authorizedChoices, ['recon']);
+  if (kind === 'cloud') setChecked(authorizedChoices, ['cloud_audit']);
+  $('editor-help').textContent = 'Template loaded. Enter your real engagement ID, client, operator, authorized targets and signed time window. Review the selected techniques against the rules of engagement.';
+  reviewForm();
+}
+$('connect').onclick = () => { sessionStorage.setItem('gateway-token', token.value); refresh().catch((error) => status(error.message, true)); };
+$('create-engagement').onclick = newScope;
+$('import-policy').onclick = () => $('policy-file').click();
+$('policy-file').onchange = async () => {
+  const file = $('policy-file').files?.[0]; $('policy-file').value = '';
+  if (!file) return;
   try {
-    const scope = { profile: $('profile').value, allowedHosts: lines('hosts'), manifest: {
-      engagement_id: $('engagement').value.trim(), client: $('client').value.trim(), operator: $('operator').value.trim(),
-      authorized_targets: { ip_ranges: lines('ips'), domains: lines('domains'), urls: lines('urls'), cloud_accounts: lines('cloud') },
-      excluded_targets: lines('excluded-targets'), authorized_techniques: lines('techniques'), excluded_techniques: lines('excluded-techniques'),
-      engagement_window: { start: new Date($('starts').value).toISOString(), end: new Date($('ends').value).toISOString() },
-    } };
-    await api(editing ? `/api/scopes/${editing}` : '/api/scopes', editing ? 'PUT' : 'POST', scope);
-    editing = null; await refresh(); status('Draft saved. Review it before activation.');
-  } catch (e) { status(e.message, true); }
+    if (!file.name.toLowerCase().endsWith('.json') || file.size > 1024 * 1024 || file.size === 0) throw new Error('Choose a nonempty JSON policy file under 1 MB.');
+    const input = JSON.parse(await file.text());
+    if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Policy file must contain a JSON object.');
+    const manifest = input.manifest || input;
+    const profile = input.profile || input.gateway?.profile || (mode === 'access' ? 'connected' : 'isolated');
+    const allowedHosts = input.allowedHosts || input.gateway?.allowed_hosts || [];
+    const imported = await api('/api/scopes', 'POST', { manifest, profile, allowedHosts });
+    await refresh(); loadScope(imported);
+    status('Policy imported as a saved scope. Review and approve it before assigning users.');
+  } catch (error) { status(`Could not import policy: ${error.message}`, true); }
 };
+$('clear-selection').onclick = () => api('/api/my-scope', 'POST', { scopeId: null }).then(refresh).catch((error) => status(error.message, true));
+$('add-user').onclick = async () => { try { await api('/api/users', 'POST', { email: $('user-email').value.trim(), role: $('user-role').value }); $('user-email').value = ''; await refresh(); } catch (error) { status(error.message, true); } };
+$('add-upstream').onclick = async () => { try { const transport = $('up-transport').value; await api('/api/upstreams', 'POST', { name: $('up-name').value.trim(), enabled: false, transport,
+  ...(transport === 'stdio' ? { command: $('up-target').value.trim(), args: lines('up-args') } : { url: $('up-target').value.trim(), args: [] }) });
+  $('up-name').value = ''; $('up-target').value = ''; $('up-args').value = ''; await refresh(); status('Server added and off. Turn it on when ready.'); } catch (error) { status(error.message, true); } };
+$('new-scope').onclick = newScope;
+for (const kind of ['web', 'internal', 'cloud']) $(`example-${kind}`).onclick = () => loadExample(kind);
+$('save-scope').onclick = async () => { try { if (viewingScopeId && !editing) throw new Error('Duplicate an approved or archived scope to edit it.');
+  const scope = draftFromForm(); const result = await api(editing ? `/api/scopes/${editing}` : '/api/scopes', editing ? 'PUT' : 'POST', scope);
+  const saved = editing ? result.scopes.find((item) => item.id === editing) : result;
+  await refresh(); loadScope(saved); status('Scope saved. Review it, then approve and assign users.');
+} catch (error) { status(error.message, true); } };
+$('approve-current').onclick = () => { const scope = state?.scopes.find((item) => item.id === viewingScopeId); if (scope) approveScope(scope).catch((error) => status(error.message, true)); };
+$('assign-me').onclick = async () => { try {
+  const scope = state?.scopes.find((item) => item.id === viewingScopeId);
+  if (!scope || !email) throw new Error('Select an approved scope first.');
+  await api(`/api/scopes/${scope.id}/assignments`, 'PUT', { emails: [...new Set([...scope.assignedUserEmails, email])] });
+  await refresh(); loadScope(state.scopes.find((item) => item.id === scope.id)); status('Engagement assigned to you. Choose Use engagement when its window opens.');
+} catch (error) { status(error.message, true); } };
+$('use-current').onclick = async () => { try {
+  if (!viewingScopeId) throw new Error('Select an approved scope first.');
+  await api('/api/my-scope', 'POST', { scopeId: viewingScopeId }); await refresh(); status('Engagement selected for your MCP calls.');
+} catch (error) { status(error.message, true); } };
 async function initialize() {
   const response = await fetch('/api/session', { credentials: 'same-origin', cache: 'no-store' });
-  const session = await response.json();
-  if (!response.ok) throw new Error(session.error || `HTTP ${response.status}`);
-  mode = session.mode;
+  const session = await response.json(); if (!response.ok) throw new Error(session.error || `HTTP ${response.status}`);
+  mode = session.mode; role = session.role || 'admin'; email = session.email || null;
   bootstrapAdmins = new Set(session.bootstrapAdminEmails || []);
+  $('identity').textContent = email ? `${email} · ${role}` : 'Local gateway';
   $('token-card').hidden = mode !== 'token';
-  $('users-card').hidden = mode !== 'access';
+  for (const card of document.querySelectorAll('.admin-only')) card.hidden = role !== 'admin' || (card.id === 'users-card' && mode !== 'access');
+  clearEditor();
   if (mode === 'access' || token.value) await refresh();
+  reviewForm();
 }
-initialize().catch(e => status(e.message, true));
+initialize().catch((error) => status(error.message, true));

package/dist/src/gateway/runtime.d.ts

@@ -9,7 +9,6 @@ export declare class GatewayRuntime {
     private clients;
     private pending;
     private proxies;
-    private proxyScope?;
     constructor(store: GatewayStore, hosted: boolean, requiredAuditSink?: ((entry: AuditEntry) => Promise<void>) | undefined, isActorAllowed?: ((email?: string) => boolean) | undefined);
     sync(): Promise<void>;
     private scopeProxy;

package/dist/src/gateway/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/gateway/runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAiE,MAAM,YAAY,CAAC;AAIzG,qBAAa,cAAc;IAMb,QAAQ,CAAC,KAAK,EAAE,YAAY;IAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAW,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAAwC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IALvL,OAAO,CAAC,OAAO,CAA4D;IAC3E,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,UAAU,CAAC,CAAc;gBAEZ,KAAK,EAAE,YAAY,EAAmB,MAAM,EAAE,OAAO,EAAmB,iBAAiB,CAAC,GAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,aAAA,EAAmB,cAAc,CAAC,GAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,aAAA;IAE9M,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,OAAO,CAAC,UAAU;YAcJ,SAAS;IA2BvB,OAAO,CAAC,SAAS;IAOjB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAmE9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/gateway/runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAiE,MAAM,YAAY,CAAC;AAIzG,qBAAa,cAAc;IAKb,QAAQ,CAAC,KAAK,EAAE,YAAY;IAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAW,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAAwC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAJvL,OAAO,CAAC,OAAO,CAA4D;IAC3E,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,OAAO,CAA4C;gBAEtC,KAAK,EAAE,YAAY,EAAmB,MAAM,EAAE,OAAO,EAAmB,iBAAiB,CAAC,GAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,aAAA,EAAmB,cAAc,CAAC,GAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,aAAA;IAE9M,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAY3B,OAAO,CAAC,UAAU;YAWJ,SAAS;IA2BvB,OAAO,CAAC,SAAS;IAOjB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAyE9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}