@sentinel-atl/trust-gateway 0.3.0

package/dist/proxy.js

@@ -0,0 +1,399 @@
+/**
+ * Trust Gateway HTTP Proxy — sits between MCP client and server,
+ * enforcing trust policies on every tool call.
+ *
+ * Supports upstream protocols:
+ *   - http:// / https://  → SSE-based MCP server
+ *   - stdio://             → stdio-based MCP server (spawns child process)
+ *
+ * Endpoints exposed:
+ *   GET  /sse              → SSE stream (proxied from upstream)
+ *   POST /message          → JSON-RPC message relay (tool calls pass through trust engine)
+ *   GET  /health           → Proxy health
+ *   GET  /stats            → Gateway stats
+ */
+import { spawn } from 'node:child_process';
+import { TrustGateway } from './gateway.js';
+import { TrustStore } from './trust-store.js';
+import { randomUUID } from 'node:crypto';
+import { authenticate, sendUnauthorized, applyCors, defaultCorsConfig, createSecureServer, setRateLimitHeaders, sendRateLimited, applySecurityHeaders, } from '@sentinel-atl/hardening';
+// ─── Proxy ───────────────────────────────────────────────────────────
+export class TrustGatewayProxy {
+    server = null;
+    gateway;
+    config;
+    sseClients = new Set();
+    stdioUpstreams = new Map();
+    defaultCallerId;
+    authConfig;
+    corsConfig;
+    tlsConfig;
+    globalRateLimiter;
+    constructor(options) {
+        this.config = options.config;
+        this.defaultCallerId = options.defaultCallerId ?? 'anonymous';
+        this.authConfig = options.auth ?? { enabled: false, keys: [] };
+        this.corsConfig = options.cors ?? defaultCorsConfig();
+        this.tlsConfig = options.tls;
+        const trustStore = options.trustStore ?? new TrustStore();
+        this.gateway = new TrustGateway(this.config, trustStore);
+        // Public paths: health + stats + SSE are readable without auth
+        if (this.authConfig.enabled && !this.authConfig.publicPaths) {
+            this.authConfig.publicPaths = ['/health', '/stats', '/sse'];
+        }
+    }
+    getGateway() {
+        return this.gateway;
+    }
+    /**
+     * Start the HTTP proxy server.
+     */
+    async start() {
+        const port = this.config.gateway.port ?? 3100;
+        // Pre-connect to stdio upstreams
+        for (const server of this.config.servers) {
+            if (server.upstream.startsWith('stdio://')) {
+                this.connectStdio(server);
+            }
+        }
+        return new Promise((resolve, reject) => {
+            this.server = createSecureServer((req, res) => this.handleRequest(req, res), this.tlsConfig);
+            this.server.on('error', reject);
+            this.server.listen(port, () => {
+                resolve({ port });
+            });
+        });
+    }
+    /**
+     * Stop the proxy and clean up.
+     */
+    async stop() {
+        // Close SSE clients
+        for (const client of this.sseClients) {
+            client.res.end();
+        }
+        this.sseClients.clear();
+        // Kill stdio upstreams
+        for (const [, upstream] of this.stdioUpstreams) {
+            upstream.process.kill();
+            for (const [, pending] of upstream.pending) {
+                pending.reject(new Error('Proxy shutting down'));
+            }
+        }
+        this.stdioUpstreams.clear();
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    // ─── HTTP Router ────────────────────────────────────────────────
+    handleRequest(req, res) {
+        const url = new URL(req.url ?? '/', `http://localhost`);
+        const path = url.pathname;
+        // CORS (configurable origins)
+        if (applyCors(req, res, this.corsConfig))
+            return; // preflight handled
+        // Security headers
+        applySecurityHeaders(res, { hsts: !!this.tlsConfig?.enabled });
+        // Authentication
+        const authResult = authenticate(req, this.authConfig);
+        if (!authResult.authenticated) {
+            sendUnauthorized(res, this.authConfig, authResult.error);
+            return;
+        }
+        if (path === '/health' && req.method === 'GET') {
+            this.handleHealth(res);
+        }
+        else if (path === '/stats' && req.method === 'GET') {
+            this.handleStats(res);
+        }
+        else if (path === '/sse' && req.method === 'GET') {
+            this.handleSSE(req, res, url);
+        }
+        else if (path === '/message' && req.method === 'POST') {
+            this.handleMessage(req, res);
+        }
+        else {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Not found' }));
+        }
+    }
+    // ─── Health ──────────────────────────────────────────────────────
+    handleHealth(res) {
+        const payload = {
+            status: 'ok',
+            gateway: this.config.gateway.name,
+            mode: this.config.gateway.mode,
+            servers: this.config.servers.map(s => s.name),
+            sseClients: this.sseClients.size,
+        };
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(payload));
+    }
+    // ─── Stats ───────────────────────────────────────────────────────
+    handleStats(res) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(this.gateway.getStats()));
+    }
+    // ─── SSE Stream ──────────────────────────────────────────────────
+    handleSSE(req, res, url) {
+        const serverName = url.searchParams.get('server') ?? this.config.servers[0]?.name;
+        if (!serverName) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No server configured' }));
+            return;
+        }
+        const client = { id: randomUUID(), res, serverName };
+        res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            'Connection': 'keep-alive',
+        });
+        // Send endpoint info
+        res.write(`event: endpoint\ndata: /message?sessionId=${client.id}&server=${serverName}\n\n`);
+        this.sseClients.add(client);
+        req.on('close', () => {
+            this.sseClients.delete(client);
+        });
+    }
+    sendSSEEvent(client, data) {
+        client.res.write(`event: message\ndata: ${JSON.stringify(data)}\n\n`);
+    }
+    // ─── Message (JSON-RPC) ──────────────────────────────────────────
+    async handleMessage(req, res) {
+        // Content-Type enforcement
+        const contentType = req.headers['content-type'];
+        if (!contentType || !contentType.includes('application/json')) {
+            res.writeHead(415, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Content-Type must be application/json' }));
+            return;
+        }
+        const url = new URL(req.url ?? '/', `http://localhost`);
+        const serverName = url.searchParams.get('server')
+            ?? req.headers['x-server-name']
+            ?? this.config.servers[0]?.name;
+        if (!serverName) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No server specified' }));
+            return;
+        }
+        const callerId = req.headers['x-caller-id'] ?? this.defaultCallerId;
+        let body;
+        try {
+            body = await readBody(req);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid request body' }));
+            return;
+        }
+        let jsonRpc;
+        try {
+            jsonRpc = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        // Extract tool name from JSON-RPC method
+        const method = jsonRpc.method ?? '';
+        const toolName = method === 'tools/call'
+            ? jsonRpc.params?.name ?? 'unknown'
+            : method;
+        // ── Trust check ──
+        const gatewayResult = await this.gateway.processRequest({
+            serverName,
+            toolName,
+            callerId,
+            arguments: jsonRpc.params?.arguments,
+        });
+        // ── Global rate-limit check (with RFC 6585 headers) ──
+        if (this.globalRateLimiter) {
+            const rlResult = this.globalRateLimiter.check(callerId);
+            if (!rlResult.allowed) {
+                sendRateLimited(res, rlResult.info);
+                return;
+            }
+            setRateLimitHeaders(res, rlResult.info);
+        }
+        if (!gatewayResult.allowed) {
+            // Per-server rate-limit denial from gateway uses 429
+            const statusCode = gatewayResult.decision === 'deny-rate-limit' ? 429 : 403;
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            if (statusCode === 429) {
+                res.setHeader('Retry-After', '60');
+            }
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                id: jsonRpc.id,
+                error: {
+                    code: -32600,
+                    message: `Trust gateway denied: ${gatewayResult.reason}`,
+                    data: {
+                        decision: gatewayResult.decision,
+                        trustScore: gatewayResult.trustScore,
+                        grade: gatewayResult.grade,
+                    },
+                },
+            }));
+            // Notify SSE clients
+            const sessionId = url.searchParams.get('sessionId');
+            if (sessionId) {
+                const client = [...this.sseClients].find(c => c.id === sessionId);
+                if (client) {
+                    this.sendSSEEvent(client, {
+                        jsonrpc: '2.0',
+                        id: jsonRpc.id,
+                        error: { code: -32600, message: `Trust gateway denied: ${gatewayResult.reason}` },
+                    });
+                }
+            }
+            return;
+        }
+        // ── Forward to upstream ──
+        try {
+            const upstream = this.findUpstream(serverName);
+            const upstreamResult = await this.forwardToUpstream(upstream, serverName, jsonRpc);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(upstreamResult));
+            // Notify SSE clients
+            const sessionId = url.searchParams.get('sessionId');
+            if (sessionId) {
+                const client = [...this.sseClients].find(c => c.id === sessionId);
+                if (client) {
+                    this.sendSSEEvent(client, upstreamResult);
+                }
+            }
+        }
+        catch (err) {
+            res.writeHead(502, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                id: jsonRpc.id,
+                error: { code: -32603, message: `Upstream error: ${err.message}` },
+            }));
+        }
+    }
+    // ─── Upstream Management ─────────────────────────────────────────
+    findUpstream(serverName) {
+        const server = this.config.servers.find(s => s.name === serverName);
+        if (!server)
+            throw new Error(`Unknown server: ${serverName}`);
+        return server;
+    }
+    async forwardToUpstream(server, serverName, jsonRpc) {
+        if (server.upstream.startsWith('stdio://')) {
+            return this.forwardStdio(serverName, jsonRpc);
+        }
+        else {
+            return this.forwardHttp(server.upstream, jsonRpc);
+        }
+    }
+    // ─── HTTP Upstream ───────────────────────────────────────────────
+    async forwardHttp(upstream, jsonRpc) {
+        // Resolve message endpoint from upstream URL
+        const baseUrl = upstream.replace(/\/sse$/, '');
+        const messageUrl = `${baseUrl}/message`;
+        const response = await fetch(messageUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(jsonRpc),
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (!response.ok) {
+            throw new Error(`Upstream returned ${response.status}`);
+        }
+        return response.json();
+    }
+    // ─── Stdio Upstream ──────────────────────────────────────────────
+    connectStdio(server) {
+        const command = server.upstream.replace('stdio://', '');
+        const parts = command.split(' ');
+        const proc = spawn(parts[0], parts.slice(1), {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const upstream = {
+            process: proc,
+            pending: new Map(),
+            buffer: '',
+        };
+        proc.stdout.on('data', (chunk) => {
+            upstream.buffer += chunk.toString();
+            // Process complete JSON-RPC messages (newline-delimited)
+            const lines = upstream.buffer.split('\n');
+            upstream.buffer = lines.pop() ?? '';
+            for (const line of lines) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const msg = JSON.parse(line);
+                    if (msg.id !== undefined && upstream.pending.has(msg.id)) {
+                        const { resolve } = upstream.pending.get(msg.id);
+                        upstream.pending.delete(msg.id);
+                        resolve(msg);
+                    }
+                }
+                catch {
+                    // Ignore malformed lines
+                }
+            }
+        });
+        proc.on('error', (err) => {
+            for (const [, { reject }] of upstream.pending) {
+                reject(err);
+            }
+            upstream.pending.clear();
+        });
+        proc.on('exit', () => {
+            for (const [, { reject }] of upstream.pending) {
+                reject(new Error('Process exited'));
+            }
+            upstream.pending.clear();
+            this.stdioUpstreams.delete(server.name);
+        });
+        this.stdioUpstreams.set(server.name, upstream);
+    }
+    forwardStdio(serverName, jsonRpc) {
+        const upstream = this.stdioUpstreams.get(serverName);
+        if (!upstream)
+            throw new Error(`No stdio connection for server: ${serverName}`);
+        return new Promise((resolve, reject) => {
+            const msg = jsonRpc;
+            const id = msg.id ?? randomUUID();
+            const timer = setTimeout(() => {
+                upstream.pending.delete(id);
+                reject(new Error('Stdio upstream timeout'));
+            }, 30_000);
+            upstream.pending.set(id, {
+                resolve: (data) => { clearTimeout(timer); resolve(data); },
+                reject: (err) => { clearTimeout(timer); reject(err); },
+            });
+            upstream.process.stdin.write(JSON.stringify(jsonRpc) + '\n');
+        });
+    }
+}
+// ─── Helpers ──────────────────────────────────────────────────────────
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        const MAX_BODY = 1_048_576; // 1 MB
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY) {
+                reject(new Error('Request body too large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString()));
+        req.on('error', reject);
+    });
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAwB,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,YAAY,EAAE,gBAAgB,EAC9B,SAAS,EAAE,iBAAiB,EAC5B,kBAAkB,EAClB,mBAAmB,EAAE,eAAe,EAEpC,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AA+BjC,wEAAwE;AAExE,MAAM,OAAO,iBAAiB;IACpB,MAAM,GAAkB,IAAI,CAAC;IAC7B,OAAO,CAAe;IACtB,MAAM,CAAgB;IACtB,UAAU,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,eAAe,CAAS;IACxB,UAAU,CAAa;IACvB,UAAU,CAAa;IACvB,SAAS,CAAa;IACtB,iBAAiB,CAAuB;IAEhD,YAAY,OAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,UAAU,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAEzD,+DAA+D;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC5D,IAAI,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;QAE9C,iCAAiC;QACjC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAC9B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1C,IAAI,CAAC,SAAS,CACf,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC5B,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,oBAAoB;QACpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAExB,uBAAuB;QACvB,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC3C,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mEAAmE;IAE3D,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE1B,8BAA8B;QAC9B,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,oBAAoB;QAEtE,mBAAmB;QACnB,oBAAoB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,iBAAiB;QACjB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAC9B,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACnD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,oEAAoE;IAE5D,YAAY,CAAC,GAAmB;QACtC,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;YACjC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;YAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;SACjC,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,oEAAoE;IAE5D,WAAW,CAAC,GAAmB;QACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,oEAAoE;IAE5D,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ;QACnE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAClF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAc,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAEhE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;QAEH,qBAAqB;QACrB,GAAG,CAAC,KAAK,CAAC,6CAA6C,MAAM,CAAC,EAAE,WAAW,UAAU,MAAM,CAAC,CAAC;QAE7F,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE5B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,MAAiB,EAAE,IAAa;QACnD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,oEAAoE;IAE5D,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACnE,2BAA2B;QAC3B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;eAC5C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAW;eACtC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAW,IAAI,IAAI,CAAC,eAAe,CAAC;QAE9E,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,YAAY;YACtC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS;YACnC,CAAC,CAAC,MAAM,CAAC;QAEX,oBAAoB;QACpB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YACtD,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS;SACrC,CAAC,CAAC;QAEH,wDAAwD;QACxD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,qDAAqD;YACrD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClE,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;gBACvB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,yBAAyB,aAAa,CAAC,MAAM,EAAE;oBACxD,IAAI,EAAE;wBACJ,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,UAAU,EAAE,aAAa,CAAC,UAAU;wBACpC,KAAK,EAAE,aAAa,CAAC,KAAK;qBAC3B;iBACF;aACF,CAAC,CAAC,CAAC;YAEJ,qBAAqB;YACrB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;gBAClE,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;wBACxB,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,aAAa,CAAC,MAAM,EAAE,EAAE;qBAClF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAEnF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;YAExC,qBAAqB;YACrB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;gBAClE,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE,EAAE;aAC9E,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAED,oEAAoE;IAE5D,YAAY,CAAC,UAAkB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,MAAoB,EACpB,UAAkB,EAClB,OAAgB;QAEhB,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,oEAAoE;IAE5D,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,OAAgB;QAC1D,6CAA6C;QAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,GAAG,OAAO,UAAU,CAAC;QAExC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,oEAAoE;IAE5D,YAAY,CAAC,MAAoB;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC3C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAkB;YAC9B,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,MAAM,EAAE,EAAE;SACX,CAAC;QAEF,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpC,yDAAyD;YACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC7B,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;wBACzD,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;wBAClD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAChC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACf,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACnB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAEO,YAAY,CAAC,UAAkB,EAAE,OAAgB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;QAEhF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,OAAmC,CAAC;YAChD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;YAElC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC9C,CAAC,EAAE,MAAM,CAAC,CAAC;YAEX,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE;gBACvB,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1D,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACvD,CAAC,CAAC;YAEH,QAAQ,CAAC,OAAO,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,yEAAyE;AAEzE,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,OAAO;QAEnC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/trust-store.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Trust Store — manages loaded Sentinel Trust Certificates for runtime verification.
+ * Supports optional persistent backend via SentinelStore.
+ */
+import { type SentinelTrustCertificate } from '@sentinel-atl/scanner';
+import type { SentinelStore } from '@sentinel-atl/store';
+export interface StoredCertificate {
+    certificate: SentinelTrustCertificate;
+    serverName: string;
+    verified: boolean;
+    loadedAt: string;
+}
+export interface TrustStoreOptions {
+    /** Persistent backend — data survives restarts */
+    backend?: SentinelStore;
+    /** Key prefix for the backend (default: 'trust-store:') */
+    prefix?: string;
+}
+export declare class TrustStore {
+    private certificates;
+    private backend?;
+    private prefix;
+    constructor(options?: TrustStoreOptions);
+    /** Load all entries from the backend into the in-memory cache. Call once on startup. */
+    load(): Promise<void>;
+    /**
+     * Load an STC from a file and verify its signature.
+     */
+    loadCertificate(serverName: string, filePath: string): Promise<StoredCertificate>;
+    /**
+     * Register a pre-loaded certificate.
+     */
+    addCertificate(serverName: string, certificate: SentinelTrustCertificate): Promise<StoredCertificate>;
+    /**
+     * Get the certificate for a server.
+     */
+    getCertificate(serverName: string): StoredCertificate | undefined;
+    /**
+     * Check if a server has a valid, non-expired certificate.
+     */
+    isVerified(serverName: string): boolean;
+    /**
+     * Get all stored certificates.
+     */
+    getAll(): StoredCertificate[];
+    /**
+     * Remove a certificate.
+     */
+    remove(serverName: string): Promise<boolean>;
+}
+//# sourceMappingURL=trust-store.d.ts.map

package/dist/trust-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-store.d.ts","sourceRoot":"","sources":["../src/trust-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAa,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,wBAAwB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,UAAU;IACrB,OAAO,CAAC,YAAY,CAAwC;IAC5D,OAAO,CAAC,OAAO,CAAC,CAAgB;IAChC,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,CAAC,EAAE,iBAAiB;IAKvC,wFAAwF;IAClF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B;;OAEG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAsBvF;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmB3G;;OAEG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIjE;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,MAAM,IAAI,iBAAiB,EAAE;IAI7B;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAOnD"}

package/dist/trust-store.js

@@ -0,0 +1,95 @@
+/**
+ * Trust Store — manages loaded Sentinel Trust Certificates for runtime verification.
+ * Supports optional persistent backend via SentinelStore.
+ */
+import { readFile } from 'node:fs/promises';
+import { verifySTC } from '@sentinel-atl/scanner';
+const KEY_PREFIX_DEFAULT = 'trust-store:';
+export class TrustStore {
+    certificates = new Map();
+    backend;
+    prefix;
+    constructor(options) {
+        this.backend = options?.backend;
+        this.prefix = options?.prefix ?? KEY_PREFIX_DEFAULT;
+    }
+    /** Load all entries from the backend into the in-memory cache. Call once on startup. */
+    async load() {
+        if (!this.backend)
+            return;
+        const keys = await this.backend.keys(this.prefix);
+        const values = await this.backend.getMany(keys);
+        for (const [, json] of values) {
+            const stored = JSON.parse(json);
+            this.certificates.set(stored.serverName, stored);
+        }
+    }
+    /**
+     * Load an STC from a file and verify its signature.
+     */
+    async loadCertificate(serverName, filePath) {
+        const raw = await readFile(filePath, 'utf-8');
+        const certificate = JSON.parse(raw);
+        const result = await verifySTC(certificate);
+        const stored = {
+            certificate,
+            serverName,
+            verified: result.valid,
+            loadedAt: new Date().toISOString(),
+        };
+        this.certificates.set(serverName, stored);
+        if (this.backend) {
+            await this.backend.set(`${this.prefix}${serverName}`, JSON.stringify(stored));
+        }
+        return stored;
+    }
+    /**
+     * Register a pre-loaded certificate.
+     */
+    async addCertificate(serverName, certificate) {
+        const result = await verifySTC(certificate);
+        const stored = {
+            certificate,
+            serverName,
+            verified: result.valid,
+            loadedAt: new Date().toISOString(),
+        };
+        this.certificates.set(serverName, stored);
+        if (this.backend) {
+            await this.backend.set(`${this.prefix}${serverName}`, JSON.stringify(stored));
+        }
+        return stored;
+    }
+    /**
+     * Get the certificate for a server.
+     */
+    getCertificate(serverName) {
+        return this.certificates.get(serverName);
+    }
+    /**
+     * Check if a server has a valid, non-expired certificate.
+     */
+    isVerified(serverName) {
+        const stored = this.certificates.get(serverName);
+        if (!stored || !stored.verified)
+            return false;
+        return new Date(stored.certificate.expiresAt) > new Date();
+    }
+    /**
+     * Get all stored certificates.
+     */
+    getAll() {
+        return Array.from(this.certificates.values());
+    }
+    /**
+     * Remove a certificate.
+     */
+    async remove(serverName) {
+        const existed = this.certificates.delete(serverName);
+        if (existed && this.backend) {
+            await this.backend.delete(`${this.prefix}${serverName}`);
+        }
+        return existed;
+    }
+}
+//# sourceMappingURL=trust-store.js.map

package/dist/trust-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-store.js","sourceRoot":"","sources":["../src/trust-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAiC,MAAM,uBAAuB,CAAC;AAiBjF,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,MAAM,OAAO,UAAU;IACb,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,OAAO,CAAiB;IACxB,MAAM,CAAS;IAEvB,YAAY,OAA2B;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,kBAAkB,CAAC;IACtD,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,QAAgB;QACxD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,WAAW,GAA6B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAsB;YAChC,WAAW;YACX,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACnC,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,WAAqC;QAC5E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAsB;YAChC,WAAW;YACX,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACnC,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,UAAkB;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,UAAkB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@sentinel-atl/trust-gateway",
+  "version": "0.3.0",
+  "description": "YAML-configured MCP trust gateway — runtime enforcement of Sentinel Trust Certificates",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "sentinel-gateway": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "lint": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@sentinel-atl/core": "*",
+    "@sentinel-atl/scanner": "*",
+    "@sentinel-atl/audit": "*",
+    "@sentinel-atl/hardening": "*",
+    "@sentinel-atl/store": "*",
+    "yaml": "^2.7.0"
+  },
+  "devDependencies": {
+    "vitest": "^3.2.4",
+    "typescript": "^5.7.0",
+    "@types/node": "^20.0.0"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sentinel-atl/project-sentinel.git",
+    "directory": "packages/trust-gateway"
+  },
+  "keywords": [
+    "mcp",
+    "gateway",
+    "trust",
+    "security",
+    "proxy",
+    "ai-agent",
+    "yaml"
+  ],
+  "homepage": "https://github.com/sentinel-atl/project-sentinel#readme",
+  "bugs": {
+    "url": "https://github.com/sentinel-atl/project-sentinel/issues"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
+}