@winstonsayno/mcp-gateway 2.7.0 → 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. package/CHANGELOG.md +14 -0
  2. package/README.md +9 -0
  3. package/dist/cli.js +29 -0
  4. package/dist/cli.js.map +1 -1
  5. package/dist/config/loader.d.ts +208 -1
  6. package/dist/config/loader.d.ts.map +1 -1
  7. package/dist/config/loader.js +121 -29
  8. package/dist/config/loader.js.map +1 -1
  9. package/dist/gateway/index.d.ts +7 -0
  10. package/dist/gateway/index.d.ts.map +1 -1
  11. package/dist/gateway/index.js +25 -0
  12. package/dist/gateway/index.js.map +1 -1
  13. package/dist/monitor/siem.d.ts +53 -0
  14. package/dist/monitor/siem.d.ts.map +1 -0
  15. package/dist/monitor/siem.js +211 -0
  16. package/dist/monitor/siem.js.map +1 -0
  17. package/dist/policy/tool-policy.d.ts +9 -0
  18. package/dist/policy/tool-policy.d.ts.map +1 -1
  19. package/dist/policy/tool-policy.js +14 -0
  20. package/dist/policy/tool-policy.js.map +1 -1
  21. package/dist/utils/types.d.ts +52 -0
  22. package/dist/utils/types.d.ts.map +1 -1
  23. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -9,6 +9,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
9
9
 
10
10
  ## [Unreleased]
11
11
 
12
+ ## [2.8.0] - 2026-10-07
13
+
14
+ Policy as code and audit export to SIEMs.
15
+
16
+ ### Added
17
+ - **Policy files** (`policy.files`): YAML / JSON rule files (relative to the config) appended after inline rules;
18
+ optional `default` and `tests`. Re-read on every config reload; invalid files reject the reload.
19
+ - **Policy tests**: `policy.tests` / file `tests` (`call`, `expect`, optional `rule`) and the
20
+ `mcp-gateway policy test [--json]` command (exit 1 on failure) for CI.
21
+ - **SIEM export** (`audit.export`): RFC 5424 syslog over UDP / TCP (octet counting) / TLS, and batched HTTP webhooks
22
+ (JSON or NDJSON) with retries, a bounded queue, `failuresOnly` and `kinds` filters. Works with or without the
23
+ SQLite audit store. `Gateway#auditExportStats()` / `flushAuditExport()`.
24
+ - Docs: [Policy as code and SIEM export](docs/guides/policy-as-code.md).
25
+
12
26
  ## [2.7.0] - 2026-10-07
13
27
 
14
28
  Bridges: OpenAI-compatible tools proxy and A2A agent card.
package/README.md CHANGED
@@ -579,6 +579,15 @@ await gateway.start();
579
579
  process.on('SIGTERM', () => gateway.stop());
580
580
  ```
581
581
 
582
+ ## What's New in v2.8
583
+
584
+ | Feature | Description |
585
+ |---------|-------------|
586
+ | **Policy as code** | `policy.files` + policy unit tests, `mcp-gateway policy test` for CI |
587
+ | **SIEM export** | Audit records to syslog (UDP / TCP / TLS) or webhooks — [guide](docs/guides/policy-as-code.md) |
588
+
589
+ Details: [CHANGELOG](CHANGELOG.md).
590
+
582
591
  ## What's New in v2.7
583
592
 
584
593
  | Feature | Description |
package/dist/cli.js CHANGED
@@ -8,6 +8,7 @@ import { existsSync } from 'fs';
8
8
  import { writeFile } from 'fs/promises';
9
9
  import { loadConfig, generateDefaultConfig, resolveConfigPath } from './config/loader.js';
10
10
  import { ConfigWatcher } from './config/watcher.js';
11
+ import { runPolicyTests } from './policy/tool-policy.js';
11
12
  import { Gateway } from './gateway/index.js';
12
13
  import { logger } from './utils/logger.js';
13
14
  import { VERSION } from './utils/version.js';
@@ -142,6 +143,34 @@ program
142
143
  process.exit(1);
143
144
  }
144
145
  });
146
+ program
147
+ .command('policy')
148
+ .description('Policy-as-code tools')
149
+ .command('test')
150
+ .description('Run policy tests (policy.tests and the tests in policy.files) against the merged rules')
151
+ .option('-c, --config <path>', 'Path to config file')
152
+ .option('--json', 'Print results as JSON')
153
+ .action(async (options) => {
154
+ try {
155
+ const config = await loadConfig(options.config);
156
+ const results = runPolicyTests(config.policy);
157
+ const failed = results.filter((r) => !r.passed);
158
+ if (options.json)
159
+ console.log(JSON.stringify({ total: results.length, failed: failed.length, results }, null, 2));
160
+ else {
161
+ console.log(`Policy: ${config.policy?.rules?.length ?? 0} rules, default ${config.policy?.default ?? 'allow'}`);
162
+ for (const r of results)
163
+ console.log(` ${r.passed ? '✓' : '✗'} ${r.name}${r.passed ? '' : ` — expected ${r.expected}, got ${r.actual}`}`);
164
+ console.log(results.length === 0 ? 'No policy tests defined.' : `${results.length - failed.length}/${results.length} passed`);
165
+ }
166
+ if (failed.length > 0)
167
+ process.exit(1);
168
+ }
169
+ catch (err) {
170
+ logger.error(err instanceof Error ? err.message : String(err));
171
+ process.exit(1);
172
+ }
173
+ });
145
174
  // ─── keys ─────────────────────────────────────────────────────────────────────
146
175
  async function readStdin() {
147
176
  const chunks = [];
package/dist/cli.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAE/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,aAAa,CAAC;KACnB,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;KAC1D,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,CAAC;KAClE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;KACjD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,OAA4B,CAAC;IACjC,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,QAAQ,eAAe,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE,CAAC;QAEb,8DAA8D;QAC9D,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;YAClC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,sBAAsB,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,+BAA+B,CAAC,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAEjB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,CAAC;YACZ,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gBACtB,8CAA8C;gBAC9C,IAAI,OAAO,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACrC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,KAAK;gBAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACxB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;oBACzD,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;gBACrB,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC;KAC/D,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,6CAA6C,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,UAAU,EAAE,mDAAmD,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kGAAkG,CAAC;KAC/G,QAAQ,CAAC,OAAO,EAAE,8DAA8D,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,GAAY,EAAE,EAAE;IAC7B,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,IAAI,CAAC;KACxD,MAAM,CAAC,mBAAmB,EAAE,kDAAkD,EAAE,MAAM,CAAC;KACvF,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC9B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,KAAK,YAAY,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}
1
+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAE/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,aAAa,CAAC;KACnB,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;KAC1D,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,CAAC;KAClE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;KACjD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,OAA4B,CAAC;IACjC,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,QAAQ,eAAe,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE,CAAC;QAEb,8DAA8D;QAC9D,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;YAClC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,sBAAsB,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,+BAA+B,CAAC,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAEjB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,CAAC;YACZ,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gBACtB,8CAA8C;gBAC9C,IAAI,OAAO,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACrC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,KAAK;gBAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACxB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;oBACzD,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;gBACrB,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC;KAC/D,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,6CAA6C,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,UAAU,EAAE,mDAAmD,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,sBAAsB,CAAC;KACnC,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wFAAwF,CAAC;KACrG,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;KACzC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;aAC7G,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,mBAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAChH,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3I,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kGAAkG,CAAC;KAC/G,QAAQ,CAAC,OAAO,EAAE,8DAA8D,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,GAAY,EAAE,EAAE;IAC7B,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,IAAI,CAAC;KACxD,MAAM,CAAC,mBAAmB,EAAE,kDAAkD,EAAE,MAAM,CAAC;KACvF,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC9B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,KAAK,YAAY,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}
package/dist/config/loader.d.ts CHANGED
@@ -2,7 +2,209 @@
2
2
  * Configuration loader
3
3
  * Supports YAML, JSON, and environment variable overrides
4
4
  */
5
- import type { GatewayConfig } from '../utils/types.js';
5
+ import { z } from 'zod';
6
+ import type { GatewayConfig, ToolPolicyConfig } from '../utils/types.js';
7
+ /** A policy-as-code file (`policy.files`): rules, an optional default and optional tests. */
8
+ export declare const PolicyFileSchema: z.ZodObject<{
9
+ version: z.ZodOptional<z.ZodLiteral<1>>;
10
+ default: z.ZodOptional<z.ZodEnum<["allow", "deny", "approve"]>>;
11
+ rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
12
+ name: z.ZodOptional<z.ZodString>;
13
+ effect: z.ZodEnum<["allow", "deny", "approve"]>;
14
+ clients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
15
+ servers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
16
+ tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
17
+ args: z.ZodOptional<z.ZodArray<z.ZodObject<{
18
+ path: z.ZodString;
19
+ exists: z.ZodOptional<z.ZodBoolean>;
20
+ equals: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
21
+ in: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>, "many">>;
22
+ glob: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
23
+ notGlob: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
24
+ regex: z.ZodOptional<z.ZodString>;
25
+ notRegex: z.ZodOptional<z.ZodString>;
26
+ longerThan: z.ZodOptional<z.ZodNumber>;
27
+ under: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
28
+ notUnder: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
29
+ }, "strict", z.ZodTypeAny, {
30
+ path: string;
31
+ exists?: boolean | undefined;
32
+ equals?: string | number | boolean | undefined;
33
+ in?: (string | number | boolean)[] | undefined;
34
+ glob?: string[] | undefined;
35
+ notGlob?: string[] | undefined;
36
+ regex?: string | undefined;
37
+ notRegex?: string | undefined;
38
+ longerThan?: number | undefined;
39
+ under?: string[] | undefined;
40
+ notUnder?: string[] | undefined;
41
+ }, {
42
+ path: string;
43
+ exists?: boolean | undefined;
44
+ equals?: string | number | boolean | undefined;
45
+ in?: (string | number | boolean)[] | undefined;
46
+ glob?: string[] | undefined;
47
+ notGlob?: string[] | undefined;
48
+ regex?: string | undefined;
49
+ notRegex?: string | undefined;
50
+ longerThan?: number | undefined;
51
+ under?: string[] | undefined;
52
+ notUnder?: string[] | undefined;
53
+ }>, "many">>;
54
+ message: z.ZodOptional<z.ZodString>;
55
+ }, "strict", z.ZodTypeAny, {
56
+ effect: "allow" | "deny" | "approve";
57
+ servers?: string[] | undefined;
58
+ tools?: string[] | undefined;
59
+ name?: string | undefined;
60
+ message?: string | undefined;
61
+ args?: {
62
+ path: string;
63
+ exists?: boolean | undefined;
64
+ equals?: string | number | boolean | undefined;
65
+ in?: (string | number | boolean)[] | undefined;
66
+ glob?: string[] | undefined;
67
+ notGlob?: string[] | undefined;
68
+ regex?: string | undefined;
69
+ notRegex?: string | undefined;
70
+ longerThan?: number | undefined;
71
+ under?: string[] | undefined;
72
+ notUnder?: string[] | undefined;
73
+ }[] | undefined;
74
+ clients?: string[] | undefined;
75
+ }, {
76
+ effect: "allow" | "deny" | "approve";
77
+ servers?: string[] | undefined;
78
+ tools?: string[] | undefined;
79
+ name?: string | undefined;
80
+ message?: string | undefined;
81
+ args?: {
82
+ path: string;
83
+ exists?: boolean | undefined;
84
+ equals?: string | number | boolean | undefined;
85
+ in?: (string | number | boolean)[] | undefined;
86
+ glob?: string[] | undefined;
87
+ notGlob?: string[] | undefined;
88
+ regex?: string | undefined;
89
+ notRegex?: string | undefined;
90
+ longerThan?: number | undefined;
91
+ under?: string[] | undefined;
92
+ notUnder?: string[] | undefined;
93
+ }[] | undefined;
94
+ clients?: string[] | undefined;
95
+ }>, "many">>;
96
+ tests: z.ZodOptional<z.ZodArray<z.ZodObject<{
97
+ name: z.ZodOptional<z.ZodString>;
98
+ call: z.ZodObject<{
99
+ client: z.ZodOptional<z.ZodString>;
100
+ server: z.ZodString;
101
+ tool: z.ZodString;
102
+ args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
103
+ }, "strict", z.ZodTypeAny, {
104
+ tool: string;
105
+ server: string;
106
+ client?: string | undefined;
107
+ args?: Record<string, unknown> | undefined;
108
+ }, {
109
+ tool: string;
110
+ server: string;
111
+ client?: string | undefined;
112
+ args?: Record<string, unknown> | undefined;
113
+ }>;
114
+ expect: z.ZodEnum<["allow", "deny", "approve"]>;
115
+ rule: z.ZodOptional<z.ZodString>;
116
+ }, "strict", z.ZodTypeAny, {
117
+ call: {
118
+ tool: string;
119
+ server: string;
120
+ client?: string | undefined;
121
+ args?: Record<string, unknown> | undefined;
122
+ };
123
+ expect: "allow" | "deny" | "approve";
124
+ rule?: string | undefined;
125
+ name?: string | undefined;
126
+ }, {
127
+ call: {
128
+ tool: string;
129
+ server: string;
130
+ client?: string | undefined;
131
+ args?: Record<string, unknown> | undefined;
132
+ };
133
+ expect: "allow" | "deny" | "approve";
134
+ rule?: string | undefined;
135
+ name?: string | undefined;
136
+ }>, "many">>;
137
+ }, "strict", z.ZodTypeAny, {
138
+ rules: {
139
+ effect: "allow" | "deny" | "approve";
140
+ servers?: string[] | undefined;
141
+ tools?: string[] | undefined;
142
+ name?: string | undefined;
143
+ message?: string | undefined;
144
+ args?: {
145
+ path: string;
146
+ exists?: boolean | undefined;
147
+ equals?: string | number | boolean | undefined;
148
+ in?: (string | number | boolean)[] | undefined;
149
+ glob?: string[] | undefined;
150
+ notGlob?: string[] | undefined;
151
+ regex?: string | undefined;
152
+ notRegex?: string | undefined;
153
+ longerThan?: number | undefined;
154
+ under?: string[] | undefined;
155
+ notUnder?: string[] | undefined;
156
+ }[] | undefined;
157
+ clients?: string[] | undefined;
158
+ }[];
159
+ default?: "allow" | "deny" | "approve" | undefined;
160
+ version?: 1 | undefined;
161
+ tests?: {
162
+ call: {
163
+ tool: string;
164
+ server: string;
165
+ client?: string | undefined;
166
+ args?: Record<string, unknown> | undefined;
167
+ };
168
+ expect: "allow" | "deny" | "approve";
169
+ rule?: string | undefined;
170
+ name?: string | undefined;
171
+ }[] | undefined;
172
+ }, {
173
+ default?: "allow" | "deny" | "approve" | undefined;
174
+ version?: 1 | undefined;
175
+ rules?: {
176
+ effect: "allow" | "deny" | "approve";
177
+ servers?: string[] | undefined;
178
+ tools?: string[] | undefined;
179
+ name?: string | undefined;
180
+ message?: string | undefined;
181
+ args?: {
182
+ path: string;
183
+ exists?: boolean | undefined;
184
+ equals?: string | number | boolean | undefined;
185
+ in?: (string | number | boolean)[] | undefined;
186
+ glob?: string[] | undefined;
187
+ notGlob?: string[] | undefined;
188
+ regex?: string | undefined;
189
+ notRegex?: string | undefined;
190
+ longerThan?: number | undefined;
191
+ under?: string[] | undefined;
192
+ notUnder?: string[] | undefined;
193
+ }[] | undefined;
194
+ clients?: string[] | undefined;
195
+ }[] | undefined;
196
+ tests?: {
197
+ call: {
198
+ tool: string;
199
+ server: string;
200
+ client?: string | undefined;
201
+ args?: Record<string, unknown> | undefined;
202
+ };
203
+ expect: "allow" | "deny" | "approve";
204
+ rule?: string | undefined;
205
+ name?: string | undefined;
206
+ }[] | undefined;
207
+ }>;
6
208
  /**
7
209
  * Resolve the config file that `loadConfig` would read: the explicit path if
8
210
  * given, otherwise the first match in the default search paths.
@@ -11,5 +213,10 @@ export declare function resolveConfigPath(configPath?: string): string | undefin
11
213
  /** Validate (and apply defaults to) a raw config object; throws a readable error listing every issue. */
12
214
  export declare function validateConfig(raw: unknown): GatewayConfig;
13
215
  export declare function loadConfig(configPath?: string): Promise<GatewayConfig>;
216
+ /**
217
+ * Merge `policy.files` into the policy: inline rules first, then each file's rules in order (first match wins).
218
+ * A file's `default` applies when the inline policy sets none (the last file with one wins). Tests are collected.
219
+ */
220
+ export declare function loadPolicyFiles(policy: ToolPolicyConfig, baseDir: string): Promise<ToolPolicyConfig>;
14
221
  export declare function generateDefaultConfig(): string;
15
222
  //# sourceMappingURL=loader.d.ts.map
package/dist/config/loader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA6jBvD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMzE;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAQ1D;AAED,wBAAsB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAiB5E;AAyCD,wBAAgB,qBAAqB,IAAI,MAAM,CAiH9C"}
1
+ {"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAc,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA8TrF,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOlB,CAAC;AAoTZ;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMzE;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAQ1D;AAED,wBAAsB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAkB5E;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwB1G;AAyCD,wBAAgB,qBAAqB,IAAI,MAAM,CAiH9C"}
package/dist/config/loader.js CHANGED
@@ -233,6 +233,89 @@ const SecuritySchema = z
233
233
  exposeErrorDetails: z.boolean().default(false),
234
234
  })
235
235
  .strict();
236
+ const PolicyRuleSchema = z
237
+ .object({
238
+ name: z.string().optional(),
239
+ effect: z.enum(['allow', 'deny', 'approve']),
240
+ clients: z.array(z.string()).optional(),
241
+ servers: z.array(z.string()).optional(),
242
+ tools: z.array(z.string()).optional(),
243
+ args: z
244
+ .array(z
245
+ .object({
246
+ path: z.string().min(1),
247
+ exists: z.boolean().optional(),
248
+ equals: z.union([z.string(), z.number(), z.boolean()]).optional(),
249
+ in: z.array(z.union([z.string(), z.number(), z.boolean()])).optional(),
250
+ glob: z.array(z.string()).optional(),
251
+ notGlob: z.array(z.string()).optional(),
252
+ regex: z.string().optional(),
253
+ notRegex: z.string().optional(),
254
+ longerThan: z.number().int().min(0).optional(),
255
+ under: z.array(z.string()).optional(),
256
+ notUnder: z.array(z.string()).optional(),
257
+ })
258
+ .strict())
259
+ .optional(),
260
+ message: z.string().optional(),
261
+ })
262
+ .strict();
263
+ const ExportCommon = {
264
+ enabled: z.boolean().optional(),
265
+ kinds: z.array(z.enum(['tool', 'resource', 'prompt'])).optional(),
266
+ failuresOnly: z.boolean().optional(),
267
+ batchSize: z.number().int().positive().max(10_000).optional(),
268
+ flushIntervalMs: z.number().int().min(10).optional(),
269
+ retries: z.number().int().min(0).max(10).optional(),
270
+ maxQueue: z.number().int().positive().optional(),
271
+ };
272
+ const AuditExportSchema = z.discriminatedUnion('type', [
273
+ z
274
+ .object({
275
+ type: z.literal('syslog'),
276
+ host: z.string().min(1),
277
+ port: z.number().int().min(1).max(65535).optional(),
278
+ protocol: z.enum(['udp', 'tcp', 'tls']).optional(),
279
+ facility: z.enum(['kern', 'user', 'daemon', 'auth', 'syslog', 'authpriv', 'local0', 'local1', 'local2', 'local3', 'local4', 'local5', 'local6', 'local7']).optional(),
280
+ appName: z.string().min(1).optional(),
281
+ ...ExportCommon,
282
+ })
283
+ .strict(),
284
+ z
285
+ .object({
286
+ type: z.literal('webhook'),
287
+ url: z.string().url(),
288
+ headers: z.record(z.string()).optional(),
289
+ format: z.enum(['json', 'ndjson']).optional(),
290
+ timeoutMs: z.number().int().positive().optional(),
291
+ ...ExportCommon,
292
+ })
293
+ .strict(),
294
+ ]);
295
+ const PolicyTestSchema = z
296
+ .object({
297
+ name: z.string().optional(),
298
+ call: z
299
+ .object({
300
+ client: z.string().optional(),
301
+ server: z.string().min(1),
302
+ tool: z.string().min(1),
303
+ args: z.record(z.unknown()).optional(),
304
+ })
305
+ .strict(),
306
+ expect: z.enum(['allow', 'deny', 'approve']),
307
+ rule: z.string().optional(),
308
+ })
309
+ .strict();
310
+ /** A policy-as-code file (`policy.files`): rules, an optional default and optional tests. */
311
+ export const PolicyFileSchema = z
312
+ .object({
313
+ version: z.literal(1).optional(),
314
+ default: z.enum(['allow', 'deny', 'approve']).optional(),
315
+ rules: z.array(PolicyRuleSchema).default([]),
316
+ tests: z.array(PolicyTestSchema).optional(),
317
+ })
318
+ .strict();
236
319
  const GatewayConfigSchema = z.object({
237
320
  port: z.number().int().min(1).max(65535).default(4000),
238
321
  host: z.string().default('0.0.0.0'),
@@ -323,6 +406,7 @@ const GatewayConfigSchema = z.object({
323
406
  enabled: z.boolean().default(false),
324
407
  path: z.string().min(1).default('mcp-gateway-audit.db'),
325
408
  retentionDays: z.number().int().min(0).default(30),
409
+ export: z.array(AuditExportSchema).optional(),
326
410
  })
327
411
  .strict()
328
412
  .optional(),
@@ -347,35 +431,9 @@ const GatewayConfigSchema = z.object({
347
431
  security: SecuritySchema.optional(),
348
432
  policy: z
349
433
  .object({
350
- rules: z
351
- .array(z
352
- .object({
353
- name: z.string().optional(),
354
- effect: z.enum(['allow', 'deny', 'approve']),
355
- clients: z.array(z.string()).optional(),
356
- servers: z.array(z.string()).optional(),
357
- tools: z.array(z.string()).optional(),
358
- args: z
359
- .array(z
360
- .object({
361
- path: z.string().min(1),
362
- exists: z.boolean().optional(),
363
- equals: z.union([z.string(), z.number(), z.boolean()]).optional(),
364
- in: z.array(z.union([z.string(), z.number(), z.boolean()])).optional(),
365
- glob: z.array(z.string()).optional(),
366
- notGlob: z.array(z.string()).optional(),
367
- regex: z.string().optional(),
368
- notRegex: z.string().optional(),
369
- longerThan: z.number().int().min(0).optional(),
370
- under: z.array(z.string()).optional(),
371
- notUnder: z.array(z.string()).optional(),
372
- })
373
- .strict())
374
- .optional(),
375
- message: z.string().optional(),
376
- })
377
- .strict())
378
- .optional(),
434
+ rules: z.array(PolicyRuleSchema).optional(),
435
+ files: z.array(z.string().min(1)).optional(),
436
+ tests: z.array(PolicyTestSchema).optional(),
379
437
  default: z.enum(['allow', 'deny', 'approve']).optional(),
380
438
  approval: z
381
439
  .object({ timeoutSeconds: z.number().int().positive().optional(), allowSelfApproval: z.boolean().optional() })
@@ -595,8 +653,42 @@ export async function loadConfig(configPath) {
595
653
  const config = validateConfig(raw);
596
654
  if (filePath)
597
655
  config.configDir = dirname(filePath);
656
+ if (config.policy?.files?.length)
657
+ config.policy = await loadPolicyFiles(config.policy, config.configDir ?? process.cwd());
598
658
  return config;
599
659
  }
660
+ /**
661
+ * Merge `policy.files` into the policy: inline rules first, then each file's rules in order (first match wins).
662
+ * A file's `default` applies when the inline policy sets none (the last file with one wins). Tests are collected.
663
+ */
664
+ export async function loadPolicyFiles(policy, baseDir) {
665
+ const rules = [...(policy.rules ?? [])];
666
+ const tests = [...(policy.tests ?? [])];
667
+ let fileDefault;
668
+ for (const f of policy.files ?? []) {
669
+ const path = resolve(baseDir, f);
670
+ let raw;
671
+ try {
672
+ raw = await readConfigFile(path);
673
+ }
674
+ catch (err) {
675
+ throw new Error(`Invalid configuration: policy file ${f}: ${err instanceof Error ? err.message : String(err)}`);
676
+ }
677
+ const parsed = PolicyFileSchema.safeParse(Array.isArray(raw) ? { rules: raw } : (raw ?? {}));
678
+ if (!parsed.success) {
679
+ throw new Error(`Invalid configuration: policy file ${f}:\n${parsed.error.issues.map((i) => ` - ${i.path.join('.')}: ${i.message}`).join('\n')}`);
680
+ }
681
+ rules.push(...parsed.data.rules.map((r, i) => ({ ...r, name: r.name ?? `${f}#${i + 1}` })));
682
+ tests.push(...(parsed.data.tests ?? []));
683
+ if (parsed.data.default)
684
+ fileDefault = parsed.data.default;
685
+ }
686
+ const merged = { ...policy, rules, tests, default: policy.default ?? fileDefault };
687
+ const bad = invalidPolicy(merged);
688
+ if (bad)
689
+ throw new Error(`Invalid configuration: ${bad}`);
690
+ return merged;
691
+ }
600
692
  async function readConfigFile(filePath) {
601
693
  const content = await readFile(filePath, 'utf-8');
602
694
  if (filePath.endsWith('.json')) {