@mcp-audit-gateway/core 0.1.0

package/dist/policy/engine.js

@@ -0,0 +1,130 @@
+export class PolicyEngine {
+    defaultEffect;
+    rules;
+    rateLimitState = {
+        minuteCounts: new Map(),
+        hourCounts: new Map(),
+    };
+    constructor(defaultEffect, rules) {
+        this.defaultEffect = defaultEffect;
+        this.rules = rules;
+    }
+    evaluate(principal, tool) {
+        let matchedRule = null;
+        for (const rule of this.rules) {
+            if (this.ruleMatches(rule, principal, tool)) {
+                matchedRule = rule;
+                break;
+            }
+        }
+        if (!matchedRule) {
+            return { allowed: this.defaultEffect === "allow" };
+        }
+        if (matchedRule.effect === "deny") {
+            return { allowed: false, reason: "denied by policy rule" };
+        }
+        if (matchedRule.rateLimit) {
+            const key = `${principal ?? "anonymous"}:${tool.name}`;
+            const rateLimited = this.checkRateLimit(key, matchedRule.rateLimit);
+            if (rateLimited) {
+                return { allowed: false, reason: "rate limit exceeded", rateLimit: matchedRule.rateLimit };
+            }
+        }
+        return { allowed: true, rateLimit: matchedRule.rateLimit };
+    }
+    filterTools(principal, tools) {
+        return tools.filter((tool) => this.evaluate(principal, tool).allowed);
+    }
+    recordInvocation(principal, tool) {
+        const key = `${principal ?? "anonymous"}:${tool.name}`;
+        this.incrementCounter(key);
+    }
+    ruleMatches(rule, principal, tool) {
+        if (rule.principals && rule.principals.length > 0) {
+            if (!principal || !this.matchesPattern(principal, rule.principals)) {
+                return false;
+            }
+        }
+        if (rule.namespaces && rule.namespaces.length > 0) {
+            if (!rule.namespaces.includes(tool.namespace)) {
+                return false;
+            }
+        }
+        if (rule.tools && rule.tools.length > 0) {
+            if (!this.matchesPattern(tool.name, rule.tools) &&
+                !this.matchesPattern(tool.originalName, rule.tools)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    matchesPattern(value, patterns) {
+        return patterns.some((pattern) => this.globMatch(pattern, value));
+    }
+    globMatch(pattern, value) {
+        if (!pattern.includes("*"))
+            return pattern === value;
+        const parts = pattern.split("*");
+        let pos = 0;
+        for (let i = 0; i < parts.length; i++) {
+            const part = parts[i];
+            if (part === "")
+                continue;
+            if (i === 0) {
+                if (!value.startsWith(part))
+                    return false;
+                pos = part.length;
+            }
+            else if (i === parts.length - 1) {
+                if (value.length - pos < part.length)
+                    return false;
+                if (!value.endsWith(part))
+                    return false;
+                const suffixStart = value.length - part.length;
+                if (suffixStart < pos)
+                    return false;
+            }
+            else {
+                const idx = value.indexOf(part, pos);
+                if (idx === -1)
+                    return false;
+                pos = idx + part.length;
+            }
+        }
+        return true;
+    }
+    checkRateLimit(key, limit) {
+        const now = Date.now();
+        if (limit.maxPerMinute != null) {
+            const entry = this.rateLimitState.minuteCounts.get(key);
+            if (entry && entry.resetAt > now && entry.count >= limit.maxPerMinute) {
+                return true;
+            }
+        }
+        if (limit.maxPerHour != null) {
+            const entry = this.rateLimitState.hourCounts.get(key);
+            if (entry && entry.resetAt > now && entry.count >= limit.maxPerHour) {
+                return true;
+            }
+        }
+        return false;
+    }
+    incrementCounter(key) {
+        const now = Date.now();
+        const minute = this.rateLimitState.minuteCounts.get(key);
+        if (!minute || minute.resetAt <= now) {
+            this.rateLimitState.minuteCounts.set(key, { count: 1, resetAt: now + 60_000 });
+        }
+        else {
+            minute.count++;
+        }
+        const hour = this.rateLimitState.hourCounts.get(key);
+        if (!hour || hour.resetAt <= now) {
+            this.rateLimitState.hourCounts.set(key, { count: 1, resetAt: now + 3_600_000 });
+        }
+        else {
+            hour.count++;
+        }
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/policy/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAaA,MAAM,OAAO,YAAY;IAOb;IACA;IAPF,cAAc,GAAmB;QACvC,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,UAAU,EAAE,IAAI,GAAG,EAAE;KACtB,CAAC;IAEF,YACU,aAA+B,EAC/B,KAAmB;QADnB,kBAAa,GAAb,aAAa,CAAkB;QAC/B,UAAK,GAAL,KAAK,CAAc;IAC1B,CAAC;IAEJ,QAAQ,CAAC,SAA6B,EAAE,IAAe;QACrD,IAAI,WAAW,GAAsB,IAAI,CAAC;QAE1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;IAC7D,CAAC;IAED,WAAW,CAAC,SAA6B,EAAE,KAAkB;QAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,gBAAgB,CAAC,SAA6B,EAAE,IAAe;QAC7D,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CACjB,IAAgB,EAChB,SAA6B,EAC7B,IAAe;QAEf,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;gBAC3C,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,KAAa,EAAE,QAAkB;QACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,SAAS,CAAC,OAAe,EAAE,KAAa;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,KAAK,KAAK,CAAC;QAErD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAE1B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC1C,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACpB,CAAC;iBAAM,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC/C,IAAI,WAAW,GAAG,GAAG;oBAAE,OAAO,KAAK,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC7B,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CACpB,GAAW,EACX,KAAqD;QAErD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/policy/engine.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=engine.test.d.ts.map

package/dist/policy/engine.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.test.d.ts","sourceRoot":"","sources":["../../src/policy/engine.test.ts"],"names":[],"mappings":""}

package/dist/policy/engine.test.js

@@ -0,0 +1,80 @@
+import { describe, it, expect } from "vitest";
+import { PolicyEngine } from "./engine.js";
+const tool = (name, ns) => ({
+    name: `${ns}/${name}`,
+    originalName: name,
+    namespace: ns,
+    upstream: `${ns}-server`,
+});
+describe("PolicyEngine", () => {
+    describe("default-allow", () => {
+        const engine = new PolicyEngine("allow", [
+            { effect: "deny", principals: ["agent:readonly-*"], tools: ["*/write_*", "*/delete_*"] },
+            { effect: "deny", tools: ["admin/shutdown"] },
+        ]);
+        it("allows unmatched tools", () => {
+            const decision = engine.evaluate("agent:dev", tool("read_data", "github"));
+            expect(decision.allowed).toBe(true);
+        });
+        it("denies matching principal+tool pattern", () => {
+            const decision = engine.evaluate("agent:readonly-bot", tool("write_file", "fs"));
+            expect(decision.allowed).toBe(false);
+        });
+        it("allows write for non-readonly principal", () => {
+            const decision = engine.evaluate("agent:admin", tool("write_file", "fs"));
+            expect(decision.allowed).toBe(true);
+        });
+        it("denies tool pattern regardless of principal", () => {
+            const decision = engine.evaluate("agent:admin", tool("shutdown", "admin"));
+            expect(decision.allowed).toBe(false);
+        });
+    });
+    describe("default-deny", () => {
+        const engine = new PolicyEngine("deny", [
+            { effect: "allow", principals: ["agent:trusted-*"], namespaces: ["github"] },
+        ]);
+        it("denies by default", () => {
+            const decision = engine.evaluate("agent:unknown", tool("create_pr", "github"));
+            expect(decision.allowed).toBe(false);
+        });
+        it("allows matching principal+namespace", () => {
+            const decision = engine.evaluate("agent:trusted-ci", tool("create_pr", "github"));
+            expect(decision.allowed).toBe(true);
+        });
+        it("denies trusted principal on wrong namespace", () => {
+            const decision = engine.evaluate("agent:trusted-ci", tool("drop_table", "database"));
+            expect(decision.allowed).toBe(false);
+        });
+    });
+    describe("rate limiting", () => {
+        it("allows calls within limit", () => {
+            const engine = new PolicyEngine("allow", [
+                { effect: "allow", principals: ["agent:bot"], rateLimit: { maxPerMinute: 3 } },
+            ]);
+            const t = tool("read", "api");
+            engine.evaluate("agent:bot", t);
+            engine.recordInvocation("agent:bot", t);
+            engine.recordInvocation("agent:bot", t);
+            engine.recordInvocation("agent:bot", t);
+            const decision = engine.evaluate("agent:bot", t);
+            expect(decision.allowed).toBe(false);
+            expect(decision.reason).toContain("rate limit");
+        });
+    });
+    describe("filterTools", () => {
+        const engine = new PolicyEngine("allow", [
+            { effect: "deny", principals: ["agent:limited"], tools: ["*/dangerous_*"] },
+        ]);
+        it("removes denied tools from list", () => {
+            const tools = [
+                tool("safe_read", "fs"),
+                tool("dangerous_delete", "fs"),
+                tool("safe_write", "fs"),
+            ];
+            const filtered = engine.filterTools("agent:limited", tools);
+            expect(filtered).toHaveLength(2);
+            expect(filtered.map((t) => t.originalName)).not.toContain("dangerous_delete");
+        });
+    });
+});
+//# sourceMappingURL=engine.test.js.map

package/dist/policy/engine.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.test.js","sourceRoot":"","sources":["../../src/policy/engine.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAa,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;IACrB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,SAAS;CACzB,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;YACxF,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE;SAC9C,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE;YACtC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;SAC7E,CAAC,CAAC;QAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;YACrF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE;aAC/E,CAAC,CAAC;YAEH,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAExC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE;SAC5E,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,KAAK,GAAG;gBACZ,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;gBACvB,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC;gBAC9B,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC;aACzB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/proxy/gateway.d.ts

@@ -0,0 +1,54 @@
+import type { GatewayConfig, UpstreamStatus, AuditRecord } from "../types.js";
+export declare class Gateway {
+    private config;
+    private toolCatalog;
+    private manualStatuses?;
+    private policyEngine;
+    private auditLog;
+    private tracer;
+    private metrics;
+    private upstreamManager;
+    constructor(config: GatewayConfig);
+    init(): Promise<void>;
+    private connectUpstream;
+    handleToolsList(principal?: string, _meta?: Record<string, unknown>): Promise<{
+        tools: unknown[];
+        _meta?: Record<string, unknown>;
+    }>;
+    handleToolsCall(toolName: string, args: Record<string, unknown>, principal?: string, traceContext?: {
+        traceparent?: string;
+        tracestate?: string;
+    }): Promise<{
+        result: unknown;
+        auditRecord: AuditRecord;
+    }>;
+    getStatus(): {
+        gateway: {
+            status: string;
+            version: string;
+        };
+        upstreams: UpstreamStatus[];
+        aggregate: {
+            totalUpstreams: number;
+            healthyUpstreams: number;
+            degradedUpstreams: number;
+            unavailableUpstreams: number;
+            totalTools: number;
+        };
+    };
+    getServerDiscover(): Record<string, unknown>;
+    registerUpstreamTools(upstreamName: string, namespace: string, tools: Array<{
+        name: string;
+        description?: string;
+        inputSchema?: unknown;
+        annotations?: Record<string, unknown>;
+    }>): void;
+    private safeAuditRecord;
+    shutdown(): Promise<void>;
+}
+export declare class ToolCallError extends Error {
+    code: number;
+    auditRecord: AuditRecord;
+    constructor(code: number, message: string, auditRecord: AuditRecord);
+}
+//# sourceMappingURL=gateway.d.ts.map

package/dist/proxy/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/proxy/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EAEd,WAAW,EACZ,MAAM,aAAa,CAAC;AAQrB,qBAAa,OAAO;IASN,OAAO,CAAC,MAAM;IAR1B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,cAAc,CAAC,CAA8B;IACrD,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,eAAe,CAAkB;gBAErB,MAAM,EAAE,aAAa;IAkBnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,eAAe;IAavB,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA8B3D,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IA8GzD,SAAS,IAAI;QACX,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,SAAS,EAAE,cAAc,EAAE,CAAC;QAC5B,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC;YACvB,gBAAgB,EAAE,MAAM,CAAC;YACzB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,oBAAoB,EAAE,MAAM,CAAC;YAC7B,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;IAoBD,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAoB5C,qBAAqB,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,GACD,IAAI;YA2BO,eAAe;IAkBvB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,qBAAa,aAAc,SAAQ,KAAK;IAE7B,IAAI,EAAE,MAAM;IAEZ,WAAW,EAAE,WAAW;gBAFxB,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,WAAW,EAAE,WAAW;CAKlC"}

package/dist/proxy/gateway.js

@@ -0,0 +1,245 @@
+import { PolicyEngine } from "../policy/engine.js";
+import { AuditLog } from "../attestation/audit-log.js";
+import { createSigner } from "../attestation/signer.js";
+import { GatewayTracer } from "../telemetry/tracer.js";
+import { GatewayMetrics } from "../telemetry/metrics.js";
+import { UpstreamManager } from "./upstream-manager.js";
+export class Gateway {
+    config;
+    toolCatalog = new Map();
+    manualStatuses;
+    policyEngine;
+    auditLog;
+    tracer;
+    metrics;
+    upstreamManager;
+    constructor(config) {
+        this.config = config;
+        this.policyEngine = new PolicyEngine(config.policy.defaultEffect, config.policy.rules);
+        const signer = createSigner(config.attestation);
+        this.auditLog = new AuditLog(config.auditLog.path, signer, config.auditLog.rotateAfterMb * 1024 * 1024);
+        this.tracer = new GatewayTracer(config.telemetry);
+        this.metrics = new GatewayMetrics(config.telemetry);
+        this.upstreamManager = new UpstreamManager();
+    }
+    async init() {
+        await this.auditLog.init();
+        for (const upstream of this.config.upstreams) {
+            await this.connectUpstream(upstream);
+        }
+    }
+    async connectUpstream(upstream) {
+        try {
+            const conn = await this.upstreamManager.connect(upstream);
+            this.registerUpstreamTools(upstream.name, upstream.namespace, conn.tools);
+        }
+        catch (err) {
+            console.error(`Failed to connect to upstream ${upstream.name}: ${err}`);
+        }
+    }
+    async handleToolsList(principal, _meta) {
+        const allTools = Array.from(this.toolCatalog.values());
+        const filtered = this.policyEngine.filterTools(principal, allTools);
+        const tools = filtered.map((entry) => ({
+            name: entry.name,
+            description: entry.description,
+            inputSchema: entry.inputSchema,
+            annotations: entry.annotations,
+            _meta: {
+                "x-gateway-routing/v1": {
+                    upstream: entry.upstream,
+                    namespace: entry.namespace,
+                },
+            },
+        }));
+        return {
+            tools,
+            _meta: {
+                "x-gateway-routing/v1": {
+                    filteringApplied: true,
+                    identityResolved: principal ?? "anonymous",
+                    totalToolsPreFilter: this.toolCatalog.size,
+                    totalToolsPostFilter: filtered.length,
+                },
+            },
+        };
+    }
+    async handleToolsCall(toolName, args, principal, traceContext) {
+        const startTime = Date.now();
+        const tool = this.toolCatalog.get(toolName);
+        if (!tool) {
+            const record = await this.auditLog.record("tools/call", {
+                toolName,
+                principal,
+                durationMs: Date.now() - startTime,
+                success: false,
+                errorCode: -32602,
+            });
+            throw new ToolCallError(-32602, `Unknown tool: ${toolName}`, record);
+        }
+        const decision = this.policyEngine.evaluate(principal, tool);
+        if (!decision.allowed) {
+            this.metrics.recordPolicyDenial({
+                principal: principal ?? "anonymous",
+                tool: toolName,
+                reason: decision.reason ?? "unauthorized",
+            });
+            const record = await this.auditLog.record("tools/call", {
+                toolName,
+                namespace: tool.namespace,
+                upstream: tool.upstream,
+                principal,
+                durationMs: Date.now() - startTime,
+                success: false,
+                errorCode: -32603,
+            });
+            throw new ToolCallError(-32603, decision.reason ?? "unauthorized", record);
+        }
+        const span = this.tracer.startRouteSpan("tools/call", toolName, tool.upstream, traceContext);
+        try {
+            this.policyEngine.recordInvocation(principal, tool);
+            const result = await this.upstreamManager.callTool(tool.upstream, tool.originalName, args);
+            const durationMs = Date.now() - startTime;
+            this.tracer.recordDuration(span, durationMs);
+            this.tracer.endSpan(span, true);
+            this.metrics.recordToolCall({
+                namespace: tool.namespace,
+                tool: toolName,
+                principal: principal ?? "anonymous",
+                success: "true",
+            });
+            this.metrics.recordDuration(durationMs, {
+                namespace: tool.namespace,
+                upstream: tool.upstream,
+            });
+            const record = await this.safeAuditRecord("tools/call", {
+                toolName,
+                namespace: tool.namespace,
+                upstream: tool.upstream,
+                principal,
+                durationMs,
+                success: true,
+            });
+            return { result, auditRecord: record };
+        }
+        catch (err) {
+            const durationMs = Date.now() - startTime;
+            this.tracer.recordDuration(span, durationMs);
+            this.tracer.endSpan(span, false);
+            this.metrics.recordToolCall({
+                namespace: tool.namespace,
+                tool: toolName,
+                principal: principal ?? "anonymous",
+                success: "false",
+            });
+            this.metrics.recordDuration(durationMs, {
+                namespace: tool.namespace,
+                upstream: tool.upstream,
+            });
+            if (err instanceof ToolCallError)
+                throw err;
+            const record = await this.safeAuditRecord("tools/call", {
+                toolName,
+                namespace: tool.namespace,
+                upstream: tool.upstream,
+                principal,
+                durationMs,
+                success: false,
+                errorCode: -32603,
+            });
+            throw new ToolCallError(-32603, "Upstream server error", record);
+        }
+    }
+    getStatus() {
+        const managed = this.upstreamManager.getAllStatuses();
+        const manual = this.manualStatuses ? Array.from(this.manualStatuses.values()) : [];
+        const upstreams = managed.length > 0 ? managed : manual;
+        return {
+            gateway: {
+                status: "healthy",
+                version: this.config.version,
+            },
+            upstreams,
+            aggregate: {
+                totalUpstreams: upstreams.length,
+                healthyUpstreams: upstreams.filter((u) => u.status === "healthy").length,
+                degradedUpstreams: upstreams.filter((u) => u.status === "degraded").length,
+                unavailableUpstreams: upstreams.filter((u) => u.status === "unavailable").length,
+                totalTools: this.toolCatalog.size,
+            },
+        };
+    }
+    getServerDiscover() {
+        return {
+            name: this.config.name,
+            version: this.config.version,
+            protocol: "2025-03-26",
+            capabilities: {
+                tools: { listChanged: true },
+                gateway: {
+                    namespacing: true,
+                    filtering: true,
+                    routing: true,
+                    healthReporting: true,
+                    attestation: this.config.attestation.enabled,
+                    upstreamCount: this.config.upstreams.length,
+                },
+            },
+            extensions: ["x-gateway-routing/v1", "x-gateway-attestation/v1"],
+        };
+    }
+    registerUpstreamTools(upstreamName, namespace, tools) {
+        for (const tool of tools) {
+            const namespacedName = `${namespace}/${tool.name}`;
+            const entry = {
+                name: namespacedName,
+                originalName: tool.name,
+                namespace,
+                upstream: upstreamName,
+                description: tool.description,
+                inputSchema: tool.inputSchema,
+                annotations: tool.annotations,
+            };
+            this.toolCatalog.set(namespacedName, entry);
+        }
+        if (!this.manualStatuses)
+            this.manualStatuses = new Map();
+        this.manualStatuses.set(upstreamName, {
+            name: upstreamName,
+            namespace,
+            status: "healthy",
+            toolCount: tools.length,
+            lastSuccessfulContact: new Date().toISOString(),
+        });
+        this.metrics.setUpstreamStatus(upstreamName, "healthy", 1);
+    }
+    async safeAuditRecord(method, opts) {
+        try {
+            return await this.auditLog.record(method, opts);
+        }
+        catch (err) {
+            console.error(`Audit log write failed: ${err}`);
+            return {
+                id: "unrecorded",
+                timestamp: new Date().toISOString(),
+                method,
+                ...opts,
+                attestation: undefined,
+            };
+        }
+    }
+    async shutdown() {
+        await this.upstreamManager.disconnectAll();
+    }
+}
+export class ToolCallError extends Error {
+    code;
+    auditRecord;
+    constructor(code, message, auditRecord) {
+        super(message);
+        this.code = code;
+        this.auditRecord = auditRecord;
+        this.name = "ToolCallError";
+    }
+}
+//# sourceMappingURL=gateway.js.map

package/dist/proxy/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/proxy/gateway.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,OAAO,OAAO;IASE;IARZ,WAAW,GAA2B,IAAI,GAAG,EAAE,CAAC;IAChD,cAAc,CAA+B;IAC7C,YAAY,CAAe;IAC3B,QAAQ,CAAW;IACnB,MAAM,CAAgB;IACtB,OAAO,CAAiB;IACxB,eAAe,CAAkB;IAEzC,YAAoB,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QACvC,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,MAAM,CAAC,MAAM,CAAC,aAAa,EAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CACpB,CAAC;QAEF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAC1B,MAAM,CAAC,QAAQ,CAAC,IAAI,EACpB,MAAM,EACN,MAAM,CAAC,QAAQ,CAAC,aAAa,GAAG,IAAI,GAAG,IAAI,CAC5C,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAAwB;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,CAAC,qBAAqB,CACxB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,SAAS,EAClB,IAAI,CAAC,KAAK,CACX,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,SAAkB,EAClB,KAA+B;QAE/B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEpE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE;gBACL,sBAAsB,EAAE;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF;SACF,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,KAAK;YACL,KAAK,EAAE;gBACL,sBAAsB,EAAE;oBACtB,gBAAgB,EAAE,IAAI;oBACtB,gBAAgB,EAAE,SAAS,IAAI,WAAW;oBAC1C,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;oBAC1C,oBAAoB,EAAE,QAAQ,CAAC,MAAM;iBACtC;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,QAAgB,EAChB,IAA6B,EAC7B,SAAkB,EAClB,YAA4D;QAE5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;gBACtD,QAAQ;gBACR,SAAS;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,aAAa,CAAC,CAAC,KAAK,EAAE,iBAAiB,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBAC9B,SAAS,EAAE,SAAS,IAAI,WAAW;gBACnC,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,cAAc;aAC1C,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;gBACtD,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,aAAa,CACrB,CAAC,KAAK,EACN,QAAQ,CAAC,MAAM,IAAI,cAAc,EACjC,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CACrC,YAAY,EACZ,QAAQ,EACR,IAAI,CAAC,QAAQ,EACb,YAAY,CACb,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAChD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,YAAY,EACjB,IAAI,CACL,CAAC;YACF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAEhC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,SAAS,IAAI,WAAW;gBACnC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE;gBACtC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE;gBACtD,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS;gBACT,UAAU;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAEjC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,SAAS,IAAI,WAAW;gBACnC,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE;gBACtC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,IAAI,GAAG,YAAY,aAAa;gBAAE,MAAM,GAAG,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE;gBACtD,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS;gBACT,UAAU;gBACV,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,aAAa,CAAC,CAAC,KAAK,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,SAAS;QAWP,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACxD,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;aAC7B;YACD,SAAS;YACT,SAAS,EAAE;gBACT,cAAc,EAAE,SAAS,CAAC,MAAM;gBAChC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;gBACxE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;gBAC1E,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM;gBAChF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;aAClC;SACF,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE;gBACZ,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;gBAC5B,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,IAAI;oBACrB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO;oBAC5C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;iBAC5C;aACF;YACD,UAAU,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,qBAAqB,CACnB,YAAoB,EACpB,SAAiB,EACjB,KAKE;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,KAAK,GAAc;gBACvB,IAAI,EAAE,cAAc;gBACpB,YAAY,EAAE,IAAI,CAAC,IAAI;gBACvB,SAAS;gBACT,QAAQ,EAAE,YAAY;gBACtB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE;YACpC,IAAI,EAAE,YAAY;YAClB,SAAS;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,qBAAqB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,MAAc,EACd,IAAuC;QAEvC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;gBACL,EAAE,EAAE,YAAY;gBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,MAAM;gBACN,GAAG,IAAI;gBACP,WAAW,EAAE,SAAS;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IAE7B;IAEA;IAHT,YACS,IAAY,EACnB,OAAe,EACR,WAAwB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAJ,IAAI,CAAQ;QAEZ,gBAAW,GAAX,WAAW,CAAa;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF"}

package/dist/proxy/gateway.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gateway.test.d.ts.map

package/dist/proxy/gateway.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.test.d.ts","sourceRoot":"","sources":["../../src/proxy/gateway.test.ts"],"names":[],"mappings":""}

package/dist/proxy/gateway.test.js

@@ -0,0 +1,93 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { Gateway } from "./gateway.js";
+const testConfig = {
+    name: "test-gateway",
+    version: "0.1.0",
+    listen: { transport: "streamable-http", port: 3100, host: "127.0.0.1" },
+    upstreams: [
+        {
+            name: "test-server",
+            namespace: "test",
+            transport: { type: "stdio", command: "echo", args: [] },
+        },
+    ],
+    policy: {
+        defaultEffect: "allow",
+        rules: [
+            {
+                effect: "deny",
+                principals: ["agent:blocked"],
+                tools: ["test/dangerous_tool"],
+            },
+        ],
+    },
+    attestation: { enabled: true, algorithm: "hmac-sha256", secret: "a".repeat(64), includeParams: false, includeResult: false },
+    telemetry: { enabled: false, serviceName: "test", sampleRate: 0 },
+    auditLog: { enabled: true, path: "/tmp/test-audit.jsonl", rotateAfterMb: 10 },
+};
+describe("Gateway", () => {
+    let gateway;
+    beforeEach(async () => {
+        gateway = new Gateway(testConfig);
+        await gateway.init();
+        gateway.registerUpstreamTools("test-server", "test", [
+            { name: "safe_tool", description: "A safe tool" },
+            { name: "dangerous_tool", description: "A dangerous tool" },
+            { name: "read_data", description: "Read some data" },
+        ]);
+    });
+    describe("server/discover", () => {
+        it("advertises gateway capabilities", () => {
+            const discover = gateway.getServerDiscover();
+            expect(discover.capabilities).toHaveProperty("gateway");
+            const gw = discover.capabilities.gateway;
+            expect(gw.namespacing).toBe(true);
+            expect(gw.filtering).toBe(true);
+            expect(gw.routing).toBe(true);
+            expect(gw.attestation).toBe(true);
+            expect(gw.upstreamCount).toBe(1);
+        });
+    });
+    describe("tools/list", () => {
+        it("returns namespaced tools", async () => {
+            const result = await gateway.handleToolsList();
+            expect(result.tools).toHaveLength(3);
+            const names = result.tools.map((t) => t.name);
+            expect(names).toContain("test/safe_tool");
+            expect(names).toContain("test/dangerous_tool");
+            expect(names).toContain("test/read_data");
+        });
+        it("filters tools based on policy", async () => {
+            const result = await gateway.handleToolsList("agent:blocked");
+            const names = result.tools.map((t) => t.name);
+            expect(names).toContain("test/safe_tool");
+            expect(names).not.toContain("test/dangerous_tool");
+            expect(names).toContain("test/read_data");
+        });
+        it("includes filtering metadata", async () => {
+            const result = await gateway.handleToolsList("agent:blocked");
+            const meta = result._meta;
+            expect(meta["x-gateway-routing/v1"].filteringApplied).toBe(true);
+            expect(meta["x-gateway-routing/v1"].totalToolsPreFilter).toBe(3);
+            expect(meta["x-gateway-routing/v1"].totalToolsPostFilter).toBe(2);
+        });
+    });
+    describe("tools/call", () => {
+        it("rejects unknown tools", async () => {
+            await expect(gateway.handleToolsCall("nonexistent/tool", {})).rejects.toThrow("Unknown tool");
+        });
+        it("rejects unauthorized tool calls", async () => {
+            await expect(gateway.handleToolsCall("test/dangerous_tool", {}, "agent:blocked")).rejects.toThrow();
+        });
+    });
+    describe("status", () => {
+        it("reports gateway and upstream health", () => {
+            const status = gateway.getStatus();
+            expect(status.gateway.status).toBe("healthy");
+            expect(status.upstreams).toHaveLength(1);
+            expect(status.upstreams[0].name).toBe("test-server");
+            expect(status.aggregate.totalTools).toBe(3);
+        });
+    });
+});
+//# sourceMappingURL=gateway.test.js.map