@mcp-audit-gateway/core 0.1.0 → 0.4.0

package/dist/attestation/verify.js

@@ -1,5 +1,6 @@
 import { createReadStream } from "node:fs";
 import { createInterface } from "node:readline";
+import { isCheckpoint, isChainBreak } from "../types.js";
 import { hashRecord } from "./audit-log.js";
 export async function verifyAuditLog(path, signer, options) {
     const result = { total: 0, valid: 0, invalid: 0, errors: [] };
@@ -71,13 +72,31 @@ export async function verifyAuditLog(path, signer, options) {
     }
     return result;
 }
+function getRecordPreviousHash(record) {
+    if (isChainBreak(record))
+        return undefined;
+    return record.previousHash;
+}
 export async function verifyChain(records) {
     const result = { total: records.length, valid: true, errors: [] };
     for (let i = 0; i < records.length; i++) {
         const record = records[i];
         const lineNum = i + 1;
+        // chain_break records are valid chain starts (no previousHash required)
+        if (isChainBreak(record)) {
+            if (i !== 0) {
+                result.valid = false;
+                result.errors.push({
+                    line: lineNum,
+                    id: record.id,
+                    reason: "chain_break record must be at position 0",
+                });
+            }
+            continue;
+        }
+        const prevHash = getRecordPreviousHash(record);
         if (i === 0) {
-            if (record.previousHash !== "genesis") {
+            if (prevHash !== "genesis") {
                 result.valid = false;
                 result.errors.push({
                     line: lineNum,
@@ -89,7 +108,7 @@ export async function verifyChain(records) {
         else {
             const prevRecord = records[i - 1];
             const expectedHash = hashRecord(prevRecord);
-            if (record.previousHash !== expectedHash) {
+            if (prevHash !== expectedHash) {
                 result.valid = false;
                 result.errors.push({
                     line: lineNum,
@@ -101,4 +120,202 @@ export async function verifyChain(records) {
     }
     return result;
 }
+export function verifyCompleteness(records, externalCheckpoint, options) {
+    const mode = options?.mode ?? "strict";
+    const actualRecordCount = records.length;
+    let foundCheckpoint = null;
+    let checkpointIndex = -1;
+    for (let i = 0; i < records.length; i++) {
+        const record = records[i];
+        if (isCheckpoint(record)) {
+            if (record.previousHash === externalCheckpoint.previousHash &&
+                record.sequence === externalCheckpoint.sequence &&
+                record.recordCount === externalCheckpoint.recordCount) {
+                foundCheckpoint = record;
+                checkpointIndex = i;
+                break;
+            }
+        }
+    }
+    if (!foundCheckpoint) {
+        let hasDescendant = false;
+        for (const record of records) {
+            if (isCheckpoint(record) && record.sequence > externalCheckpoint.sequence) {
+                hasDescendant = true;
+                break;
+            }
+        }
+        if (hasDescendant) {
+            // In relative mode: descendant is acceptable, but absolute counts are unverified
+            if (mode === "relative") {
+                const deltaResult = verifyAdjacentDeltas(records, "relative");
+                if (deltaResult)
+                    return { ...deltaResult, verificationMode: "relative" };
+                return {
+                    truncated: false,
+                    lastCheckpoint: null,
+                    expectedRecordCount: externalCheckpoint.recordCount,
+                    actualRecordCount,
+                    absoluteCountVerified: false,
+                    verificationMode: "relative",
+                };
+            }
+            return {
+                truncated: false,
+                lastCheckpoint: null,
+                expectedRecordCount: externalCheckpoint.recordCount,
+                actualRecordCount,
+                verificationMode: "strict",
+            };
+        }
+        return {
+            truncated: true,
+            lastCheckpoint: null,
+            expectedRecordCount: externalCheckpoint.recordCount,
+            actualRecordCount,
+            failureCode: "head_missing",
+            verificationMode: mode,
+            reason: "externalized checkpoint not found in chain and no descendant checkpoint exists",
+        };
+    }
+    // Check for sequence regression, segmented at chain_break boundaries.
+    // A chain_break legitimately resets counters, so monotonicity is only
+    // enforced within each segment (between breaks).
+    const regressionResult = checkSequenceRegression(records, externalCheckpoint, actualRecordCount, mode);
+    if (regressionResult)
+        return regressionResult;
+    // Verify recordCount against prefix (strict mode: absolute; relative mode: delta only)
+    if (mode === "strict") {
+        let nonCheckpointsBefore = 0;
+        for (let i = 0; i < checkpointIndex; i++) {
+            if (!isCheckpoint(records[i]))
+                nonCheckpointsBefore++;
+        }
+        const recordCountValid = nonCheckpointsBefore === foundCheckpoint.recordCount;
+        if (!recordCountValid) {
+            return {
+                truncated: true,
+                lastCheckpoint: foundCheckpoint,
+                expectedRecordCount: externalCheckpoint.recordCount,
+                actualRecordCount,
+                recordCountValid,
+                absoluteCountVerified: true,
+                failureCode: "count_mismatch",
+                verificationMode: "strict",
+                reason: `recordCount mismatch: checkpoint claims ${foundCheckpoint.recordCount} records but ${nonCheckpointsBefore} non-checkpoint records precede it`,
+            };
+        }
+    }
+    // Adjacent-pair delta checks (both modes; segment-initial anchor only in strict)
+    const deltaResult = verifyAdjacentDeltas(records, mode);
+    if (deltaResult)
+        return { ...deltaResult, verificationMode: mode };
+    const chainContainsBreak = records.some(isChainBreak);
+    return {
+        truncated: false,
+        lastCheckpoint: foundCheckpoint,
+        expectedRecordCount: externalCheckpoint.recordCount,
+        actualRecordCount,
+        recordCountValid: true,
+        absoluteCountVerified: mode === "strict",
+        verificationMode: mode,
+        hasChainBreak: chainContainsBreak || undefined,
+    };
+}
+/**
+ * Check sequence monotonicity, segmented at chain_break boundaries.
+ * A chain_break legitimately resets counters, so regression is only
+ * flagged within a contiguous segment.
+ */
+function checkSequenceRegression(records, externalCheckpoint, actualRecordCount, mode) {
+    let segmentCheckpoints = [];
+    for (const record of records) {
+        if (isChainBreak(record)) {
+            segmentCheckpoints = [];
+            continue;
+        }
+        if (isCheckpoint(record)) {
+            if (segmentCheckpoints.length > 0) {
+                const prev = segmentCheckpoints[segmentCheckpoints.length - 1];
+                if (record.sequence <= prev.sequence) {
+                    return {
+                        truncated: true,
+                        lastCheckpoint: record,
+                        expectedRecordCount: externalCheckpoint.recordCount,
+                        actualRecordCount,
+                        failureCode: "sequence_regression",
+                        verificationMode: mode,
+                        reason: `checkpoint sequence regressed: ${record.sequence} <= ${prev.sequence}`,
+                    };
+                }
+            }
+            segmentCheckpoints.push(record);
+        }
+    }
+    return null;
+}
+/**
+ * Verify that the recordCount delta between adjacent checkpoints matches
+ * the actual number of non-checkpoint records between them.
+ * Segmented at chain_break boundaries (delta resets across breaks).
+ */
+function verifyAdjacentDeltas(records, mode) {
+    const checkpoints = [];
+    // Segment start: index after the most recent chain_break (or 0 if none).
+    // No chain_break can occur between same-segment checkpoints — the reset clears the list.
+    let segmentStart = 0;
+    for (let i = 0; i < records.length; i++) {
+        if (isChainBreak(records[i])) {
+            checkpoints.length = 0;
+            segmentStart = i + 1;
+            continue;
+        }
+        if (isCheckpoint(records[i])) {
+            checkpoints.push({ checkpoint: records[i], index: i });
+        }
+    }
+    // Segment-initial checkpoint absolute anchor (strict mode only — relative mode
+    // receives a suffix and can't verify absolute counts).
+    if (mode === "strict" && checkpoints.length > 0) {
+        const first = checkpoints[0];
+        let nonCheckpointsBefore = 0;
+        for (let j = segmentStart; j < first.index; j++) {
+            if (!isCheckpoint(records[j]) && !isChainBreak(records[j]))
+                nonCheckpointsBefore++;
+        }
+        if (nonCheckpointsBefore !== first.checkpoint.recordCount) {
+            return {
+                truncated: true,
+                lastCheckpoint: first.checkpoint,
+                expectedRecordCount: null,
+                actualRecordCount: records.length,
+                recordCountValid: false,
+                failureCode: "count_mismatch",
+                reason: `segment-initial checkpoint claims recordCount ${first.checkpoint.recordCount} but ${nonCheckpointsBefore} non-checkpoint records precede it in segment`,
+            };
+        }
+    }
+    for (let i = 1; i < checkpoints.length; i++) {
+        const prev = checkpoints[i - 1];
+        const curr = checkpoints[i];
+        const expectedDelta = curr.checkpoint.recordCount - prev.checkpoint.recordCount;
+        let actualNonCheckpoints = 0;
+        for (let j = prev.index + 1; j < curr.index; j++) {
+            if (!isCheckpoint(records[j]))
+                actualNonCheckpoints++;
+        }
+        if (actualNonCheckpoints !== expectedDelta) {
+            return {
+                truncated: true,
+                lastCheckpoint: curr.checkpoint,
+                expectedRecordCount: null,
+                actualRecordCount: records.length,
+                recordCountValid: false,
+                failureCode: "count_mismatch",
+                reason: `adjacent checkpoint delta mismatch: checkpoints ${prev.checkpoint.sequence}->${curr.checkpoint.sequence} claim delta ${expectedDelta} but ${actualNonCheckpoints} non-checkpoint records found between them`,
+            };
+        }
+    }
+    return null;
+}
 //# sourceMappingURL=verify.js.map

package/dist/attestation/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/attestation/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAe5C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,MAAc,EACd,OAAmC;IAEnC,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC;QAC7B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACvC,OAAO,gBAAgB,CAAC,WAAW,CAAC;QAEpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,gBAA+B,EAAE,SAAS,CAAC,CAAC;QAC9E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,oCAAoC;iBAC7C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,gBAAgB,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;gBAC1E,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;oBAC7C,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,CAAC;oBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;wBACjB,IAAI,EAAE,OAAO;wBACb,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,MAAM,EAAE,qBAAqB;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAErF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,+CAA+C;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,kDAAkD;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/attestation/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAe5C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,MAAc,EACd,OAAmC;IAEnC,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC;QAC7B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACvC,OAAO,gBAAgB,CAAC,WAAW,CAAC;QAEpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,gBAA+B,EAAE,SAAS,CAAC,CAAC;QAC9E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,oCAAoC;iBAC7C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,gBAAgB,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;gBAC1E,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;oBAC7C,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,CAAC;oBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;wBACjB,IAAI,EAAE,OAAO;wBACb,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,MAAM,EAAE,qBAAqB;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB;IAChD,IAAI,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAQ,MAAyC,CAAC,YAAY,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAErF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,wEAAwE;QACxE,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,0CAA0C;iBACnD,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,+CAA+C;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,kDAAkD;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAwBD,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,kBAAmF,EACnF,OAAmC;IAEnC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,QAAQ,CAAC;IACvC,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IACzC,IAAI,eAAe,GAA4B,IAAI,CAAC;IACpD,IAAI,eAAe,GAAG,CAAC,CAAC,CAAC;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IACE,MAAM,CAAC,YAAY,KAAK,kBAAkB,CAAC,YAAY;gBACvD,MAAM,CAAC,QAAQ,KAAK,kBAAkB,CAAC,QAAQ;gBAC/C,MAAM,CAAC,WAAW,KAAK,kBAAkB,CAAC,WAAW,EACrD,CAAC;gBACD,eAAe,GAAG,MAAM,CAAC;gBACzB,eAAe,GAAG,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC;gBAC1E,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,iFAAiF;YACjF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC9D,IAAI,WAAW;oBAAE,OAAO,EAAE,GAAG,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;gBACzE,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,cAAc,EAAE,IAAI;oBACpB,mBAAmB,EAAE,kBAAkB,CAAC,WAAW;oBACnD,iBAAiB;oBACjB,qBAAqB,EAAE,KAAK;oBAC5B,gBAAgB,EAAE,UAAU;iBAC7B,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI;gBACpB,mBAAmB,EAAE,kBAAkB,CAAC,WAAW;gBACnD,iBAAiB;gBACjB,gBAAgB,EAAE,QAAQ;aAC3B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,kBAAkB,CAAC,WAAW;YACnD,iBAAiB;YACjB,WAAW,EAAE,cAAc;YAC3B,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACvG,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,uFAAuF;IACvF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,oBAAoB,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,gBAAgB,GAAG,oBAAoB,KAAK,eAAe,CAAC,WAAW,CAAC;QAE9E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,eAAe;gBAC/B,mBAAmB,EAAE,kBAAkB,CAAC,WAAW;gBACnD,iBAAiB;gBACjB,gBAAgB;gBAChB,qBAAqB,EAAE,IAAI;gBAC3B,WAAW,EAAE,gBAAgB;gBAC7B,gBAAgB,EAAE,QAAQ;gBAC1B,MAAM,EAAE,2CAA2C,eAAe,CAAC,WAAW,gBAAgB,oBAAoB,oCAAoC;aACvJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,WAAW;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEtD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,eAAe;QAC/B,mBAAmB,EAAE,kBAAkB,CAAC,WAAW;QACnD,iBAAiB;QACjB,gBAAgB,EAAE,IAAI;QACtB,qBAAqB,EAAE,IAAI,KAAK,QAAQ;QACxC,gBAAgB,EAAE,IAAI;QACtB,aAAa,EAAE,kBAAkB,IAAI,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,OAAsB,EACtB,kBAAmF,EACnF,iBAAyB,EACzB,IAA2B;IAE3B,IAAI,kBAAkB,GAAuB,EAAE,CAAC;IAEhD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,kBAAkB,GAAG,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/D,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACrC,OAAO;wBACL,SAAS,EAAE,IAAI;wBACf,cAAc,EAAE,MAAM;wBACtB,mBAAmB,EAAE,kBAAkB,CAAC,WAAW;wBACnD,iBAAiB;wBACjB,WAAW,EAAE,qBAAqB;wBAClC,gBAAgB,EAAE,IAAI;wBACtB,MAAM,EAAE,kCAAkC,MAAM,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,EAAE;qBAChF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAsB,EAAE,IAA4B;IAChF,MAAM,WAAW,GAAsD,EAAE,CAAC;IAC1E,yEAAyE;IACzE,yFAAyF;IACzF,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;YACvB,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,uDAAuD;IACvD,IAAI,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,oBAAoB,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,oBAAoB,KAAK,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC1D,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK,CAAC,UAAU;gBAChC,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,OAAO,CAAC,MAAM;gBACjC,gBAAgB,EAAE,KAAK;gBACvB,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EAAE,iDAAiD,KAAK,CAAC,UAAU,CAAC,WAAW,QAAQ,oBAAoB,+CAA+C;aACjK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAEhF,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,oBAAoB,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,oBAAoB,KAAK,aAAa,EAAE,CAAC;YAC3C,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,IAAI,CAAC,UAAU;gBAC/B,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,OAAO,CAAC,MAAM;gBACjC,gBAAgB,EAAE,KAAK;gBACvB,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EAAE,mDAAmD,IAAI,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,gBAAgB,aAAa,QAAQ,oBAAoB,4CAA4C;aACtN,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { Gateway, ToolCallError } from "./proxy/gateway.js";
 export { runWrapProxy } from "./wrap/proxy.js";
 export { McpServerAdapter } from "./proxy/mcp-server-adapter.js";
 export { UpstreamManager } from "./proxy/upstream-manager.js";
-export { PolicyEngine } from "./policy/engine.js";
+export { PolicyEngine, computeDecisionContextDigest, type DecisionContext } from "./policy/engine.js";
 export { AuditLog } from "./attestation/audit-log.js";
 export { createSigner, HmacSigner, Ed25519Signer } from "./attestation/signer.js";
 export { verifyAuditLog } from "./attestation/verify.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -2,7 +2,7 @@ export { Gateway, ToolCallError } from "./proxy/gateway.js";
 export { runWrapProxy } from "./wrap/proxy.js";
 export { McpServerAdapter } from "./proxy/mcp-server-adapter.js";
 export { UpstreamManager } from "./proxy/upstream-manager.js";
-export { PolicyEngine } from "./policy/engine.js";
+export { PolicyEngine, computeDecisionContextDigest } from "./policy/engine.js";
 export { AuditLog } from "./attestation/audit-log.js";
 export { createSigner, HmacSigner, Ed25519Signer } from "./attestation/signer.js";
 export { verifyAuditLog } from "./attestation/verify.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,GASpB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAwB,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,GASpB,MAAM,YAAY,CAAC"}

package/dist/integration.test.js

@@ -22,6 +22,7 @@ const config = {
     attestation: { enabled: true, algorithm: "hmac-sha256", secret: "c".repeat(64), includeParams: false, includeResult: false },
     telemetry: { enabled: false, serviceName: "test", sampleRate: 0 },
     auditLog: { enabled: true, path: AUDIT_PATH, rotateAfterMb: 10 },
+    checkpoint: { enabled: false, intervalRecords: 100, intervalSeconds: 60, trigger: "whichever_first" },
 };
 describe("Integration: Gateway with in-memory MCP server", () => {
     afterEach(async () => {

package/dist/integration.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration.test.js","sourceRoot":"","sources":["../src/integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C,MAAM,UAAU,GAAG,mCAAmC,CAAC;AAEvD,MAAM,MAAM,GAAkB;IAC5B,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE;IACvE,SAAS,EAAE,EAAE;IACb,MAAM,EAAE;QACN,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE;YACL,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE;SACzE;KACF;IACD,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;IAC5H,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE;IACjE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE;CACjE,CAAC;AAEF,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,sBAAsB,EACtB,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE;gBAChI,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE;aACzF;SACF,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAClB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;SAC5E,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAErB,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAExD,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAErC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"integration.test.js","sourceRoot":"","sources":["../src/integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C,MAAM,UAAU,GAAG,mCAAmC,CAAC;AAEvD,MAAM,MAAM,GAAkB;IAC5B,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE;IACvE,SAAS,EAAE,EAAE;IACb,MAAM,EAAE;QACN,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE;YACL,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE;SACzE;KACF;IACD,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;IAC5H,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE;IACjE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE;IAChE,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,iBAA0B,EAAE;CAC/G,CAAC;AAEF,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,sBAAsB,EACtB,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE;gBAChI,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE;aACzF;SACF,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAClB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;SAC5E,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAErB,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAExD,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAErC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/policy/engine.d.ts

@@ -7,12 +7,23 @@ export interface PolicyDecision {
         maxPerHour?: number;
     };
 }
+export interface DecisionContext {
+    principal: string | null;
+    toolName: string;
+    toolNamespace: string;
+    toolUpstream: string;
+    matchedRule: PolicyRule | null;
+    effect: "allow" | "deny";
+}
+export declare function computeDecisionContextDigest(ctx: DecisionContext): string;
 export declare class PolicyEngine {
     private defaultEffect;
     private rules;
     private rateLimitState;
     constructor(defaultEffect: "allow" | "deny", rules: PolicyRule[]);
-    evaluate(principal: string | undefined, tool: ToolEntry): PolicyDecision;
+    evaluate(principal: string | undefined, tool: ToolEntry): PolicyDecision & {
+        decisionContext: DecisionContext;
+    };
     filterTools(principal: string | undefined, tools: ToolEntry[]): ToolEntry[];
     recordInvocation(principal: string | undefined, tool: ToolEntry): void;
     private ruleMatches;

package/dist/policy/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAOD,qBAAa,YAAY;IAOrB,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,KAAK;IAPf,OAAO,CAAC,cAAc,CAGpB;gBAGQ,aAAa,EAAE,OAAO,GAAG,MAAM,EAC/B,KAAK,EAAE,UAAU,EAAE;IAG7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc;IA6BxE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE;IAI3E,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAKtE,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,gBAAgB;CAiBzB"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAWzE;AAOD,qBAAa,YAAY;IAOrB,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,KAAK;IAPf,OAAO,CAAC,cAAc,CAGpB;gBAGQ,aAAa,EAAE,OAAO,GAAG,MAAM,EAC/B,KAAK,EAAE,UAAU,EAAE;IAG7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG;QAAE,eAAe,EAAE,eAAe,CAAA;KAAE;IAuC/G,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE;IAI3E,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAKtE,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,gBAAgB;CAiBzB"}

package/dist/policy/engine.js

@@ -1,3 +1,16 @@
+import { createHash } from "node:crypto";
+export function computeDecisionContextDigest(ctx) {
+    const ordered = [
+        ["principal", ctx.principal],
+        ["toolName", ctx.toolName],
+        ["toolNamespace", ctx.toolNamespace],
+        ["toolUpstream", ctx.toolUpstream],
+        ["matchedRule", ctx.matchedRule],
+        ["effect", ctx.effect],
+    ];
+    const canonical = JSON.stringify(ordered);
+    return createHash("sha256").update(canonical).digest("hex");
+}
 export class PolicyEngine {
     defaultEffect;
     rules;
@@ -17,20 +30,29 @@ export class PolicyEngine {
                 break;
             }
         }
+        const buildContext = (effect) => ({
+            principal: principal ?? null,
+            toolName: tool.name,
+            toolNamespace: tool.namespace,
+            toolUpstream: tool.upstream,
+            matchedRule,
+            effect,
+        });
         if (!matchedRule) {
-            return { allowed: this.defaultEffect === "allow" };
+            const allowed = this.defaultEffect === "allow";
+            return { allowed, decisionContext: buildContext(allowed ? "allow" : "deny") };
         }
         if (matchedRule.effect === "deny") {
-            return { allowed: false, reason: "denied by policy rule" };
+            return { allowed: false, reason: "denied by policy rule", decisionContext: buildContext("deny") };
         }
         if (matchedRule.rateLimit) {
             const key = `${principal ?? "anonymous"}:${tool.name}`;
             const rateLimited = this.checkRateLimit(key, matchedRule.rateLimit);
             if (rateLimited) {
-                return { allowed: false, reason: "rate limit exceeded", rateLimit: matchedRule.rateLimit };
+                return { allowed: false, reason: "rate limit exceeded", rateLimit: matchedRule.rateLimit, decisionContext: buildContext("deny") };
             }
         }
-        return { allowed: true, rateLimit: matchedRule.rateLimit };
+        return { allowed: true, rateLimit: matchedRule.rateLimit, decisionContext: buildContext("allow") };
     }
     filterTools(principal, tools) {
         return tools.filter((tool) => this.evaluate(principal, tool).allowed);

package/dist/policy/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAaA,MAAM,OAAO,YAAY;IAOb;IACA;IAPF,cAAc,GAAmB;QACvC,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,UAAU,EAAE,IAAI,GAAG,EAAE;KACtB,CAAC;IAEF,YACU,aAA+B,EAC/B,KAAmB;QADnB,kBAAa,GAAb,aAAa,CAAkB;QAC/B,UAAK,GAAL,KAAK,CAAc;IAC1B,CAAC;IAEJ,QAAQ,CAAC,SAA6B,EAAE,IAAe;QACrD,IAAI,WAAW,GAAsB,IAAI,CAAC;QAE1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;IAC7D,CAAC;IAED,WAAW,CAAC,SAA6B,EAAE,KAAkB;QAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,gBAAgB,CAAC,SAA6B,EAAE,IAAe;QAC7D,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CACjB,IAAgB,EAChB,SAA6B,EAC7B,IAAe;QAEf,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;gBAC3C,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,KAAa,EAAE,QAAkB;QACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,SAAS,CAAC,OAAe,EAAE,KAAa;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,KAAK,KAAK,CAAC;QAErD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAE1B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC1C,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACpB,CAAC;iBAAM,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC/C,IAAI,WAAW,GAAG,GAAG;oBAAE,OAAO,KAAK,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC7B,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CACpB,GAAW,EACX,KAAqD;QAErD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkBzC,MAAM,UAAU,4BAA4B,CAAC,GAAoB;IAC/D,MAAM,OAAO,GAAwB;QACnC,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC;QAC5B,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC;QAC1B,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC;QACpC,CAAC,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC;QAClC,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;KACvB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAOD,MAAM,OAAO,YAAY;IAOb;IACA;IAPF,cAAc,GAAmB;QACvC,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,UAAU,EAAE,IAAI,GAAG,EAAE;KACtB,CAAC;IAEF,YACU,aAA+B,EAC/B,KAAmB;QADnB,kBAAa,GAAb,aAAa,CAAkB;QAC/B,UAAK,GAAL,KAAK,CAAc;IAC1B,CAAC;IAEJ,QAAQ,CAAC,SAA6B,EAAE,IAAe;QACrD,IAAI,WAAW,GAAsB,IAAI,CAAC;QAE1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,MAAwB,EAAmB,EAAE,CAAC,CAAC;YACnE,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACpG,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACpI,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACrG,CAAC;IAED,WAAW,CAAC,SAA6B,EAAE,KAAkB;QAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,gBAAgB,CAAC,SAA6B,EAAE,IAAe;QAC7D,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CACjB,IAAgB,EAChB,SAA6B,EAC7B,IAAe;QAEf,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;gBAC3C,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,KAAa,EAAE,QAAkB;QACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,SAAS,CAAC,OAAe,EAAE,KAAa;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,KAAK,KAAK,CAAC;QAErD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAE1B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC1C,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACpB,CAAC;iBAAM,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC/C,IAAI,WAAW,GAAG,GAAG;oBAAE,OAAO,KAAK,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC7B,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CACpB,GAAW,EACX,KAAqD;QAErD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/policy/engine.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { PolicyEngine } from "./engine.js";
+import { PolicyEngine, computeDecisionContextDigest } from "./engine.js";
 const tool = (name, ns) => ({
     name: `${ns}/${name}`,
     originalName: name,
@@ -76,5 +76,46 @@ describe("PolicyEngine", () => {
             expect(filtered.map((t) => t.originalName)).not.toContain("dangerous_delete");
         });
     });
+    describe("decisionContext", () => {
+        const engine = new PolicyEngine("allow", [
+            { effect: "deny", principals: ["agent:readonly-*"], tools: ["*/write_*"] },
+        ]);
+        it("returns decision context with evaluation", () => {
+            const t = tool("write_file", "fs");
+            const result = engine.evaluate("agent:readonly-bot", t);
+            expect(result.decisionContext).toBeDefined();
+            expect(result.decisionContext.principal).toBe("agent:readonly-bot");
+            expect(result.decisionContext.toolName).toBe("fs/write_file");
+            expect(result.decisionContext.toolNamespace).toBe("fs");
+            expect(result.decisionContext.effect).toBe("deny");
+            expect(result.decisionContext.matchedRule).toEqual({
+                effect: "deny",
+                principals: ["agent:readonly-*"],
+                tools: ["*/write_*"],
+            });
+        });
+        it("produces stable digest for same input", () => {
+            const t = tool("write_file", "fs");
+            const r1 = engine.evaluate("agent:readonly-bot", t);
+            const r2 = engine.evaluate("agent:readonly-bot", t);
+            const d1 = computeDecisionContextDigest(r1.decisionContext);
+            const d2 = computeDecisionContextDigest(r2.decisionContext);
+            expect(d1).toBe(d2);
+            expect(d1).toHaveLength(64);
+        });
+        it("produces different digest for different principal", () => {
+            const t = tool("read_data", "github");
+            const r1 = engine.evaluate("agent:alpha", t);
+            const r2 = engine.evaluate("agent:beta", t);
+            const d1 = computeDecisionContextDigest(r1.decisionContext);
+            const d2 = computeDecisionContextDigest(r2.decisionContext);
+            expect(d1).not.toBe(d2);
+        });
+        it("includes null principal when undefined", () => {
+            const t = tool("read_data", "github");
+            const result = engine.evaluate(undefined, t);
+            expect(result.decisionContext.principal).toBeNull();
+        });
+    });
 });
 //# sourceMappingURL=engine.test.js.map

package/dist/policy/engine.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.test.js","sourceRoot":"","sources":["../../src/policy/engine.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAa,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;IACrB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,SAAS;CACzB,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;YACxF,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE;SAC9C,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE;YACtC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;SAC7E,CAAC,CAAC;QAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;YACrF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE;aAC/E,CAAC,CAAC;YAEH,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAExC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE;SAC5E,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,KAAK,GAAG;gBACZ,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;gBACvB,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC;gBAC9B,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC;aACzB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"engine.test.js","sourceRoot":"","sources":["../../src/policy/engine.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAGzE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAa,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;IACrB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,SAAS;CACzB,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;YACxF,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE;SAC9C,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE;YACtC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;SAC7E,CAAC,CAAC;QAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;YACrF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE;aAC/E,CAAC,CAAC;YAEH,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAExC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE;SAC5E,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,KAAK,GAAG;gBACZ,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;gBACvB,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC;gBAC9B,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC;aACzB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;SAC3E,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACpE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;gBACjD,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,CAAC,kBAAkB,CAAC;gBAChC,KAAK,EAAE,CAAC,WAAW,CAAC;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/proxy/gateway.d.ts

@@ -18,6 +18,10 @@ export declare class Gateway {
     handleToolsCall(toolName: string, args: Record<string, unknown>, principal?: string, traceContext?: {
         traceparent?: string;
         tracestate?: string;
+    }, aiInvocation?: {
+        turnId?: string;
+        invocationReason?: string;
+        model?: string;
     }): Promise<{
         result: unknown;
         auditRecord: AuditRecord;

package/dist/proxy/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/proxy/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EAEd,WAAW,EACZ,MAAM,aAAa,CAAC;AAQrB,qBAAa,OAAO;IASN,OAAO,CAAC,MAAM;IAR1B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,cAAc,CAAC,CAA8B;IACrD,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,eAAe,CAAkB;gBAErB,MAAM,EAAE,aAAa;IAkBnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,eAAe;IAavB,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA8B3D,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IA8GzD,SAAS,IAAI;QACX,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,SAAS,EAAE,cAAc,EAAE,CAAC;QAC5B,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC;YACvB,gBAAgB,EAAE,MAAM,CAAC;YACzB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,oBAAoB,EAAE,MAAM,CAAC;YAC7B,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;IAoBD,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAoB5C,qBAAqB,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,GACD,IAAI;YA2BO,eAAe;IAkBvB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,qBAAa,aAAc,SAAQ,KAAK;IAE7B,IAAI,EAAE,MAAM;IAEZ,WAAW,EAAE,WAAW;gBAFxB,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,WAAW,EAAE,WAAW;CAKlC"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/proxy/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EAEd,WAAW,EACZ,MAAM,aAAa,CAAC;AAQrB,qBAAa,OAAO;IASN,OAAO,CAAC,MAAM;IAR1B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,cAAc,CAAC,CAA8B;IACrD,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,eAAe,CAAkB;gBAErB,MAAM,EAAE,aAAa;IAkBnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,eAAe;IAavB,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA8B3D,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5D,YAAY,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5E,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IAsHzD,SAAS,IAAI;QACX,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,SAAS,EAAE,cAAc,EAAE,CAAC;QAC5B,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC;YACvB,gBAAgB,EAAE,MAAM,CAAC;YACzB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,oBAAoB,EAAE,MAAM,CAAC;YAC7B,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;IAoBD,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAoB5C,qBAAqB,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,GACD,IAAI;YA2BO,eAAe;IAkBvB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,qBAAa,aAAc,SAAQ,KAAK;IAE7B,IAAI,EAAE,MAAM;IAEZ,WAAW,EAAE,WAAW;gBAFxB,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,WAAW,EAAE,WAAW;CAKlC"}

package/dist/proxy/gateway.js

@@ -1,4 +1,4 @@
-import { PolicyEngine } from "../policy/engine.js";
+import { PolicyEngine, computeDecisionContextDigest } from "../policy/engine.js";
 import { AuditLog } from "../attestation/audit-log.js";
 import { createSigner } from "../attestation/signer.js";
 import { GatewayTracer } from "../telemetry/tracer.js";
@@ -64,7 +64,7 @@ export class Gateway {
             },
         };
     }
-    async handleToolsCall(toolName, args, principal, traceContext) {
+    async handleToolsCall(toolName, args, principal, traceContext, aiInvocation) {
         const startTime = Date.now();
         const tool = this.toolCatalog.get(toolName);
         if (!tool) {
@@ -78,6 +78,7 @@ export class Gateway {
             throw new ToolCallError(-32602, `Unknown tool: ${toolName}`, record);
         }
         const decision = this.policyEngine.evaluate(principal, tool);
+        const contextDigest = computeDecisionContextDigest(decision.decisionContext);
         if (!decision.allowed) {
             this.metrics.recordPolicyDenial({
                 principal: principal ?? "anonymous",
@@ -92,6 +93,8 @@ export class Gateway {
                 durationMs: Date.now() - startTime,
                 success: false,
                 errorCode: -32603,
+                decisionContextDigest: contextDigest,
+                aiInvocation,
             });
             throw new ToolCallError(-32603, decision.reason ?? "unauthorized", record);
         }
@@ -119,6 +122,8 @@ export class Gateway {
                 principal,
                 durationMs,
                 success: true,
+                decisionContextDigest: contextDigest,
+                aiInvocation,
             });
             return { result, auditRecord: record };
         }
@@ -146,6 +151,8 @@ export class Gateway {
                 durationMs,
                 success: false,
                 errorCode: -32603,
+                decisionContextDigest: contextDigest,
+                aiInvocation,
             });
             throw new ToolCallError(-32603, "Upstream server error", record);
         }