@praxis.guard/auditor-cli 0.0.62 → 0.0.64

package/dist/mcp/gateway.d.ts

@@ -1,24 +1,6 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { type CallToolResult, type Tool } from "@modelcontextprotocol/sdk/types.js";
-/**
- * One downstream MCP server, abstracted so tests can inject fakes without
- * spawning real subprocesses. The real implementation is `connectStdioServer`.
- */
-export interface GatewayConnection {
-    readonly id: string;
-    /** Tools advertised by this downstream server (fetched at connect). */
-    tools: Tool[];
-    callTool(tool: string, args: Record<string, unknown>): Promise<CallToolResult>;
-    /** Re-establish the underlying transport after a failure. Returns false if it cannot. */
-    reconnect(): Promise<boolean>;
-    /**
-     * Register a callback fired AFTER this connection refreshes its tool slice in
-     * response to a downstream `tools/list_changed` (or a reconnect-driven refresh).
-     * `createGatewayServer` uses it to re-emit the gateway's own `list_changed`
-     * upstream. Optional so in-process test fakes need not implement it.
-     */
-    onToolsChanged?(listener: () => void): void;
-}
+import { type GatewayConnection } from "./gateway-connection.js";
+export type { GatewayConnection } from "./gateway-connection.js";
 /**
  * Build the low-level MCP `Server` that fronts the given downstream connections.
  * Exported for tests (inject fake connections); `runMcpGateway` wires the real ones.

package/dist/mcp/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,IAAI,EACV,MAAM,oCAAoC,CAAC;AAuB5C;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,yFAAyF;IACzF,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;CAC7C;AAwHD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAyG5E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC9E"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAmBnE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAmC5E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B9E"}

package/dist/mcp/gateway.js

@@ -1,116 +1,14 @@
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport, getDefaultEnvironment, } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { CallToolRequestSchema, ListToolsRequestSchema, ToolListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { mkdirSync } from "node:fs";
 import path from "node:path";
 import { AUDITOR_CLI_VERSION } from "../runtime/version.js";
 import { GUARD_DIR } from "../bridge/guard-storage-root.js";
-import { exposedToolName, loadGatewayConfig, parseExposedToolName, resolveGatewayStorageRoot, } from "./gateway-config.js";
-import { evaluateGatewayCall } from "./gateway-evaluate.js";
-const CONNECT_TIMEOUT_MS = 10_000;
-/** stderr only — stdout is the MCP protocol channel. */
-function logErr(line) {
-    process.stderr.write(`[auditor-gateway] ${line}\n`);
-}
-function withTimeout(p, ms, label) {
-    return new Promise((resolve, reject) => {
-        const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
-        p.then((v) => {
-            clearTimeout(t);
-            resolve(v);
-        }, (e) => {
-            clearTimeout(t);
-            reject(e);
-        });
-    });
-}
-/**
- * Register the downstream `tools/list_changed` handler on `client` (the CURRENT
- * one; call again after a reconnect with the fresh client). On notification:
- * re-list (bounded), swap the connection's slice, then fire `getListener` so the
- * gateway re-emits list_changed upstream. A failed refresh keeps the prior slice
- * (no crash); the next call's reconnect path heals the connection.
- */
-function attachListChangedHandler(client, conn, getListener) {
-    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
-        try {
-            const re = await withTimeout(client.listTools(), CONNECT_TIMEOUT_MS, `listTools ${conn.id}`);
-            conn.tools = re.tools;
-            getListener()?.();
-        }
-        catch (e) {
-            logErr(`tools/list_changed refresh for "${conn.id}" failed: ${truncErr(e)}`);
-        }
-    });
-}
-/** Real stdio-backed connection to a downstream MCP server. */
-async function connectStdioServer(server) {
-    const spawn = () => new StdioClientTransport({
-        command: server.command,
-        args: server.args,
-        env: server.env ? { ...getDefaultEnvironment(), ...server.env } : undefined,
-    });
-    let client = new Client({ name: `praxis-gateway-client-${server.id}`, version: AUDITOR_CLI_VERSION });
-    // Set when createGatewayServer wires this connection (re-emits list_changed upstream).
-    let toolsChangedListener = null;
-    const getListener = () => toolsChangedListener;
-    await withTimeout(client.connect(spawn()), CONNECT_TIMEOUT_MS, `connect ${server.id}`);
-    const listed = await withTimeout(client.listTools(), CONNECT_TIMEOUT_MS, `listTools ${server.id}`);
-    const conn = {
-        id: server.id,
-        tools: listed.tools,
-        onToolsChanged(listener) {
-            toolsChangedListener = listener;
-        },
-        async callTool(tool, args) {
-            return (await client.callTool({ name: tool, arguments: args }));
-        },
-        async reconnect() {
-            try {
-                // Close the old client first so the dead subprocess + pipes are reaped;
-                // otherwise a flapping downstream leaks one child process per failure.
-                await client.close().catch(() => { });
-                client = new Client({
-                    name: `praxis-gateway-client-${server.id}`,
-                    version: AUDITOR_CLI_VERSION,
-                });
-                await withTimeout(client.connect(spawn()), CONNECT_TIMEOUT_MS, `reconnect ${server.id}`);
-                const re = await withTimeout(client.listTools(), CONNECT_TIMEOUT_MS, `listTools ${server.id}`);
-                conn.tools = re.tools;
-                // Fresh client needs its own handler; the tool set may have changed across
-                // the gap, so propagate the refreshed slice upstream.
-                attachListChangedHandler(client, conn, getListener);
-                toolsChangedListener?.();
-                return true;
-            }
-            catch (e) {
-                logErr(`reconnect to "${server.id}" failed: ${String(e)}`);
-                return false;
-            }
-        },
-    };
-    attachListChangedHandler(client, conn, getListener);
-    return conn;
-}
-function textResult(text, isError) {
-    return { content: [{ type: "text", text }], isError };
-}
-/** Bound downstream-supplied error text so a hostile downstream can't flood or spoof the result. */
-function truncErr(e) {
-    return String(e).slice(0, 300);
-}
-function blockedResult(serverId, tool, d) {
-    const reason = d.reasons[0] ?? "policy";
-    if (d.inlineApproval) {
-        return textResult(`Praxis guard requires human approval for ${serverId}__${tool} (tier=${d.tier}). ` +
-            `Approve at ${d.inlineApproval.open_url} then retry this exact tool call. ` +
-            `(request ${d.inlineApproval.request_id})`, true);
-    }
-    return textResult(`Praxis guard blocked ${serverId}__${tool} (tier=${d.tier}): ${reason}. ` +
-        (d.tier === "DESTRUCTIVE" ? "Destructive actions cannot be auto-approved." : ""), true);
-}
+import { exposedToolName, loadGatewayConfig, resolveGatewayStorageRoot, } from "./gateway-config.js";
+import { handleGatewayCallTool } from "./gateway-call-handler.js";
+import { connectStdioServer, } from "./gateway-connection.js";
+import { logGatewayErr, truncGatewayErr } from "./gateway-log.js";
 /**
  * Build the low-level MCP `Server` that fronts the given downstream connections.
  * Exported for tests (inject fake connections); `runMcpGateway` wires the real ones.
@@ -120,10 +18,7 @@ function blockedResult(serverId, tool, d) {
 export function createGatewayServer(connections) {
     const byId = new Map(connections.map((c) => [c.id, c]));
     const ids = connections.map((c) => c.id);
-    const server = new Server({ name: "praxis-guard-gateway", version: AUDITOR_CLI_VERSION }, 
-    // listChanged: true tells the host (Desktop) to listen for tools/list_changed
-    // so downstream tools that appear after login (auth-gated) become visible.
-    { capabilities: { tools: { listChanged: true } } });
+    const server = new Server({ name: "praxis-guard-gateway", version: AUDITOR_CLI_VERSION }, { capabilities: { tools: { listChanged: true } } });
     server.setRequestHandler(ListToolsRequestSchema, async () => {
         const tools = [];
         for (const conn of connections) {
@@ -133,75 +28,17 @@ export function createGatewayServer(connections) {
         }
         return { tools };
     });
-    // When any downstream refreshes its tool slice, re-emit the gateway's own
-    // list_changed upstream so the host re-fetches the combined namespaced set.
     for (const conn of connections) {
         conn.onToolsChanged?.(() => {
-            server.sendToolListChanged().catch((e) => logErr(`sendToolListChanged failed: ${truncErr(e)}`));
+            server.sendToolListChanged().catch((e) => logGatewayErr(`sendToolListChanged failed: ${truncGatewayErr(e)}`));
         });
     }
-    server.setRequestHandler(CallToolRequestSchema, async (request) => {
-        // Fail closed: any unexpected throw in parsing/gating (e.g. a corrupt policy
-        // file making evaluateGatewayCall reject) blocks the call rather than letting
-        // it slip through. Mirrors the hook's failClosedBeforeMcpHookErrorResponse.
-        try {
-            const exposed = request.params.name;
-            const args = (request.params.arguments ?? {});
-            const parsed = parseExposedToolName(exposed, ids);
-            if (!parsed) {
-                return textResult(`Praxis gateway: unknown tool "${exposed}".`, true);
-            }
-            const conn = byId.get(parsed.serverId);
-            if (!conn) {
-                return textResult(`Praxis gateway: downstream "${parsed.serverId}" is not connected.`, true);
-            }
-            // Only proxy tools the downstream actually advertised. Without this, any
-            // `knownServer__anything` would be forwarded (and classified skipped->allow),
-            // proxying tools the downstream never listed. The gateway owns this check, not
-            // the downstream (found in QA: ISSUE-001).
-            if (!conn.tools.some((t) => t.name === parsed.tool)) {
-                return textResult(`Praxis gateway: "${parsed.serverId}" does not expose a tool named "${parsed.tool}".`, true);
-            }
-            const decision = await evaluateGatewayCall({
-                serverId: parsed.serverId,
-                tool: parsed.tool,
-                toolInput: args,
-            });
-            if (decision.decision === "block") {
-                return blockedResult(parsed.serverId, parsed.tool, decision);
-            }
-            // allow -> forward, returning the downstream result VERBATIM (decision D5).
-            try {
-                return await conn.callTool(parsed.tool, args);
-            }
-            catch (e) {
-                logErr(`downstream "${parsed.serverId}" call failed: ${truncErr(e)}; reconnecting`);
-                const ok = await conn.reconnect();
-                // Retry ONLY idempotent (READ) calls. A redeemed MUTATE/DESTRUCTIVE must not
-                // be auto-replayed: if the first attempt reached the downstream and mutated
-                // state before the transport died, a blind retry double-applies it. Reconnect
-                // still heals the connection for the next call.
-                if (ok && decision.tier === "READ") {
-                    try {
-                        return await conn.callTool(parsed.tool, args);
-                    }
-                    catch (e2) {
-                        return textResult(`Praxis gateway: downstream "${parsed.serverId}" error after reconnect: ${truncErr(e2)}`, true);
-                    }
-                }
-                return textResult(`Praxis gateway: downstream "${parsed.serverId}" call failed` +
-                    (ok ? " (reconnected; not retried to avoid double-execution)" : " and is unavailable") +
-                    `: ${truncErr(e)}`, true);
-            }
-        }
-        catch (e) {
-            logErr(`gating error for "${request.params?.name}": ${truncErr(e)}`);
-            // Blast-radius escape hatch: the gateway fronts every Desktop connector, so a
-            // fail-closed bug blocks all tools. Name the recovery path in the result.
-            return textResult("Praxis gateway: guard evaluation failed; blocking this call (fail-closed). " +
-                "To restore direct tools: run `auditor setup gateway --revert --apply`, then relaunch Claude Desktop.", true);
-        }
-    });
+    server.setRequestHandler(CallToolRequestSchema, async (request) => handleGatewayCallTool({
+        exposed: request.params.name,
+        args: (request.params.arguments ?? {}),
+        ids,
+        byId,
+    }));
     return server;
 }
 /**
@@ -211,33 +48,28 @@ export function createGatewayServer(connections) {
  * stdio. Blocks until disconnect.
  */
 export async function runMcpGateway(explicitConfigPath) {
-    // Create the dedicated gateway guard storage marker BEFORE any evaluation so
-    // resolveGuardStorageRoot resolves ticket/approval/audit state to the gateway's
-    // own root (not $HOME). Without this marker the walk-up would land on $HOME and
-    // re-share the namespace with hook hosts (decision D9). Best-effort: a failure
-    // here must not stop the gateway from serving.
     try {
         mkdirSync(path.join(resolveGatewayStorageRoot(), GUARD_DIR), { recursive: true });
     }
     catch (e) {
-        logErr(`could not create gateway storage root: ${truncErr(e)}`);
+        logGatewayErr(`could not create gateway storage root: ${truncGatewayErr(e)}`);
     }
     const { servers, errors } = await loadGatewayConfig(explicitConfigPath);
     for (const e of errors)
-        logErr(e);
+        logGatewayErr(e);
     const settled = await Promise.allSettled(servers.map((s) => connectStdioServer(s)));
     const connections = [];
     settled.forEach((r, i) => {
         if (r.status === "fulfilled") {
             connections.push(r.value);
-            logErr(`connected "${servers[i].id}" (${r.value.tools.length} tools)`);
+            logGatewayErr(`connected "${servers[i].id}" (${r.value.tools.length} tools)`);
         }
         else {
-            logErr(`skipping "${servers[i].id}": ${String(r.reason)}`);
+            logGatewayErr(`skipping "${servers[i].id}": ${String(r.reason)}`);
         }
     });
     if (connections.length === 0) {
-        logErr("no downstream servers connected; gateway will expose no tools. " +
+        logGatewayErr("no downstream servers connected; gateway will expose no tools. " +
             "To restore direct connectors: run `auditor setup gateway --revert --apply`, then relaunch Claude Desktop.");
     }
     const server = createGatewayServer(connections);

package/dist/mcp/gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/mcp/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iCAAiC,GAGlC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,GAE1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,wDAAwD;AACxD,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;AACtD,CAAC;AAsBD,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU,EAAE,KAAa;IAC9D,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE;YACJ,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;YACJ,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,MAAc,EACd,IAAuB,EACvB,WAAsC;IAEtC,MAAM,CAAC,sBAAsB,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC1E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,kBAAkB,EAAE,aAAa,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;YACtB,WAAW,EAAE,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,mCAAmC,IAAI,CAAC,EAAE,aAAa,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+DAA+D;AAC/D,KAAK,UAAU,kBAAkB,CAAC,MAAqB;IACrD,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,IAAI,oBAAoB,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC,CAAC;IAEL,IAAI,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACtG,uFAAuF;IACvF,IAAI,oBAAoB,GAAwB,IAAI,CAAC;IACrD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,oBAAoB,CAAC;IAE/C,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,kBAAkB,EAAE,WAAW,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,kBAAkB,EAAE,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAEnG,MAAM,IAAI,GAAsB;QAC9B,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,CAAC,QAAQ;YACrB,oBAAoB,GAAG,QAAQ,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI;YACvB,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAmB,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,SAAS;YACb,IAAI,CAAC;gBACH,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrC,MAAM,GAAG,IAAI,MAAM,CAAC;oBAClB,IAAI,EAAE,yBAAyB,MAAM,CAAC,EAAE,EAAE;oBAC1C,OAAO,EAAE,mBAAmB;iBAC7B,CAAC,CAAC;gBACH,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,kBAAkB,EAAE,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzF,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,kBAAkB,EAAE,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/F,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;gBACtB,2EAA2E;gBAC3E,sDAAsD;gBACtD,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;gBACpD,oBAAoB,EAAE,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,iBAAiB,MAAM,CAAC,EAAE,aAAa,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;IACF,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAAgB;IAChD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,oGAAoG;AACpG,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY,EAAE,CAAkD;IACvG,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IACxC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,UAAU,CACf,4CAA4C,QAAQ,KAAK,IAAI,UAAU,CAAC,CAAC,IAAI,KAAK;YAChF,cAAc,CAAC,CAAC,cAAc,CAAC,QAAQ,oCAAoC;YAC3E,YAAY,CAAC,CAAC,cAAc,CAAC,UAAU,GAAG,EAC5C,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CACf,wBAAwB,QAAQ,KAAK,IAAI,UAAU,CAAC,CAAC,IAAI,MAAM,MAAM,IAAI;QACvE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE,CAAC,EAClF,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAgC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE;IAC9D,8EAA8E;IAC9E,2EAA2E;IAC3E,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CACnD,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAW,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE;YACzB,MAAM,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,+BAA+B,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;QACzF,6EAA6E;QAC7E,8EAA8E;QAC9E,4EAA4E;QAC5E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;YAEzE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,UAAU,CAAC,iCAAiC,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,UAAU,CAAC,+BAA+B,MAAM,CAAC,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC;YAC/F,CAAC;YACD,yEAAyE;YACzE,8EAA8E;YAC9E,+EAA+E;YAC/E,2CAA2C;YAC3C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,OAAO,UAAU,CACf,oBAAoB,MAAM,CAAC,QAAQ,mCAAmC,MAAM,CAAC,IAAI,IAAI,EACrF,IAAI,CACL,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;gBACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC/D,CAAC;YAED,4EAA4E;YAC5E,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,eAAe,MAAM,CAAC,QAAQ,kBAAkB,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;gBACpF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClC,6EAA6E;gBAC7E,4EAA4E;gBAC5E,8EAA8E;gBAC9E,gDAAgD;gBAChD,IAAI,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACnC,IAAI,CAAC;wBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAChD,CAAC;oBAAC,OAAO,EAAE,EAAE,CAAC;wBACZ,OAAO,UAAU,CACf,+BAA+B,MAAM,CAAC,QAAQ,4BAA4B,QAAQ,CAAC,EAAE,CAAC,EAAE,EACxF,IAAI,CACL,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,UAAU,CACf,+BAA+B,MAAM,CAAC,QAAQ,eAAe;oBAC3D,CAAC,EAAE,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,qBAAqB,CAAC;oBACtF,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EACpB,IAAI,CACL,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrE,8EAA8E;YAC9E,0EAA0E;YAC1E,OAAO,UAAU,CACf,6EAA6E;gBAC3E,sGAAsG,EACxG,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,kBAA2B;IAC7D,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,+CAA+C;IAC/C,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,0CAA0C,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,cAAc,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,CACJ,iEAAiE;YAC/D,2GAA2G,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/mcp/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACL,kBAAkB,GAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIlE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAgC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAC9D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CACnD,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAW,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE;YACzB,MAAM,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,+BAA+B,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAChE,qBAAqB,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;QAC5B,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B;QACjE,GAAG;QACH,IAAI;KACL,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,kBAA2B;IAC7D,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,aAAa,CAAC,0CAA0C,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1B,aAAa,CAAC,cAAc,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,aAAa,CACX,iEAAiE;YAC/D,2GAA2G,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/policies.v1.json

@@ -667,6 +667,12 @@
       }
     },
     "mcp": {
+      "m365:demo-resource": {
+        "get": "READ",
+        "update": "MUTATE",
+        "delete": "DESTRUCTIVE",
+        "*": "MUTATE"
+      },
       "user-salai-MCP": {
         "get_my_cart": "READ",
         "delete_cart": "DESTRUCTIVE",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praxis.guard/auditor-cli",
-  "version": "0.0.62",
+  "version": "0.0.64",
   "private": false,
   "type": "module",
   "license": "MIT",