@winstonsayno/mcp-gateway 3.7.0 → 3.9.0

package/CHANGELOG.md

@@ -9,6 +9,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.9.0] - 2026-10-08
+
+### Added
+- **`mcp-gateway migrate`** rewrites a config file to schema v4 — `version: 4`, API-key scope nested under `scope:`,
+  `least-latency` → `smart` with a latency-only score — keeping YAML comments and layout. `--write` (keeps a `.bak`),
+  `-o <file>`, `--check` (exit 3 when a migration is needed, for CI).
+- **v4 preview:** 3.9 already reads `version: 4` and `auth.apiKeys[].scope`, so a migrated file runs on 3.9 before
+  the 4.0 upgrade.
+- **`mcp-gateway bench`**: in-process benchmark (REST, REST with auth, cache hit, `/mcp`) with req/s and p50 / p95 / p99;
+  `runBenchmark()` exported. Reference numbers in [docs/benchmarks.md](docs/benchmarks.md).
+- [Migrating to 4.0](docs/guides/migrating-to-v4.md) (preview). The GitHub Pages demo lists the new deprecations.
+
+### Deprecated (removed in 4.0)
+- `version: 3` → `version: 4`.
+- `servers` / `tools` / `rateLimit` directly on an API key → `scope: { servers, tools, rateLimit }`.
+- `loadBalancing.strategy: least-latency` → `smart` with `score: { latency: 1, errorRate: 0, cost: 0 }`.
+- (Already scheduled) plugin API v1.
+
+`mcp-gateway validate` and `GET /api/v1/admin/deprecations` list each with the affected keys / servers.
+
+## [3.8.0] - 2026-10-08
+
+### Added
+- **Developer portal** at `/portal` (`portal.enabled`, needs `auth.strategy: api-key`): self-service API keys
+  (`signup: open | approval | closed`, allowed e-mail domains, keys per e-mail, default scope / rate limit / TTL),
+  shown once and stored as SHA-256 digests (`portal.keysFile` to persist).
+- **Usage view:** a key holder sees 7-day calls, errors, latency, calls per tool and per day; can rotate or revoke
+  the key.
+- **Interactive tool docs:** every tool in the key's scope with its input schema, generated example arguments,
+  curl / JavaScript / Python snippets and a live **Try it**.
+- Portal keys join `auth.apiKeys` as `portal-<id>`, so scopes, quotas, policy, audit and compliance apply unchanged.
+  Operators approve / deny / revoke via `/api/v1/portal/keys`.
+- The GitHub Pages demo publishes `portal.html` with a simulated backend; `dashboard/portal.html` ships in the npm
+  package and the Docker image.
+
+### Security
+- Self-contained page with a hash-based CSP (no inline handlers, no CDN); signups throttled per IP; key records
+  never expose digests.
+
 ## [3.7.0] - 2026-10-08
 
 ### Added

package/README.md

@@ -581,6 +581,26 @@ await gateway.start();
 process.on('SIGTERM', () => gateway.stop());
 ```
 
+## What's New in v3.9
+
+| Feature | Description |
+|---------|-------------|
+| **`mcp-gateway migrate`** | Rewrites your config to schema v4, comments kept; `--check` for CI |
+| **v4 deprecation warnings** | `version: 3`, flat API-key scope, `least-latency` — removed in 4.0 |
+| **`mcp-gateway bench`** | Built-in load test with latency percentiles; see [benchmarks](docs/benchmarks.md) |
+
+Details: [CHANGELOG](CHANGELOG.md) · [Migrating to 4.0](docs/guides/migrating-to-v4.md).
+
+## What's New in v3.8
+
+| Feature | Description |
+|---------|-------------|
+| **Self-serve keys** | `/portal`: sign up, get a scoped key; open, approval or closed signup |
+| **Usage** | 7-day calls, errors, latency per key; rotate / revoke |
+| **Interactive docs** | Tools in scope with schemas, example arguments, snippets and “Try it” |
+
+Details: [CHANGELOG](CHANGELOG.md) · [Configuration](docs/configuration.md#developer-portal-38).
+
 ## What's New in v3.7
 
 | Feature | Description |

package/dashboard/portal.html

@@ -0,0 +1,202 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+<meta name="color-scheme" content="dark light" />
+<meta name="theme-color" content="#0b0d12" />
+<title>mcp-gateway · Developer portal</title>
+<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='8' fill='%236d5efc'/%3E%3Cpath d='M9 22V10l7 7 7-7v12' stroke='white' stroke-width='2.6' fill='none' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E" />
+<!--
+  mcp-gateway developer portal (3.8) — one self-contained file like the dashboard: no build step, no CDN.
+  Talks only to /api/v1/portal/* and /api/v1/tools/call. Served at /portal when portal.enabled.
+-->
+<style>
+:root { --radius: 14px; --font: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, "PingFang SC", "Microsoft YaHei", sans-serif; --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; --accent: #7c6cff; --ok: #22c55e; --bad: #ef4444; --warn: #f59e0b;
+  --bg: #0b0d12; --surface: #161a24; --surface-2: #1c2130; --border: rgba(255,255,255,.09); --text: #e8ebf3; --muted: #9aa3b5; }
+@media (prefers-color-scheme: light) { :root { --bg: #f6f7fb; --surface: #fff; --surface-2: #f0f2f8; --border: rgba(10,20,40,.1); --text: #141822; --muted: #5b6475; } }
+* { box-sizing: border-box; }
+body { margin: 0; font: 15px/1.5 var(--font); background: var(--bg); color: var(--text); }
+header { max-width: 980px; margin: 0 auto; padding: 28px 20px 8px; display: flex; gap: 14px; align-items: center; flex-wrap: wrap; }
+header h1 { font-size: 22px; margin: 0; letter-spacing: -.01em; }
+header .ver { color: var(--muted); font-size: 13px; }
+header nav { margin-left: auto; display: flex; gap: 6px; }
+main { max-width: 980px; margin: 0 auto; padding: 8px 20px 60px; display: grid; gap: 16px; }
+.card { background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius); padding: 18px 20px; min-width: 0; }
+.card h2 { font-size: 16px; margin: 0 0 10px; }
+.muted { color: var(--muted); font-size: 13.5px; }
+label { display: block; font-size: 13px; color: var(--muted); margin: 10px 0 4px; }
+input, textarea { width: 100%; font: inherit; color: var(--text); background: var(--surface-2); border: 1px solid var(--border); border-radius: 9px; padding: 9px 11px; }
+textarea { font: 13px/1.45 var(--mono); min-height: 96px; resize: vertical; }
+button { font: 600 14px var(--font); border: 0; border-radius: 9px; padding: 9px 14px; cursor: pointer; background: var(--accent); color: #fff; }
+button.ghost { background: transparent; color: var(--text); border: 1px solid var(--border); }
+button.danger { background: transparent; color: var(--bad); border: 1px solid var(--bad); }
+button:disabled { opacity: .5; cursor: default; }
+.row { display: flex; gap: 10px; flex-wrap: wrap; align-items: center; margin-top: 12px; }
+.grid2 { display: grid; grid-template-columns: repeat(auto-fit, minmax(260px, 1fr)); gap: 16px; }
+.key { font: 600 14px var(--mono); word-break: break-all; padding: 10px 12px; border-radius: 9px; background: var(--surface-2); border: 1px dashed var(--accent); }
+.badge { display: inline-block; font-size: 12px; padding: 2px 8px; border-radius: 99px; border: 1px solid var(--border); }
+.badge.active { color: var(--ok); border-color: var(--ok); }
+.badge.pending { color: var(--warn); border-color: var(--warn); }
+.stats { display: grid; grid-template-columns: repeat(3, 1fr); gap: 10px; margin: 8px 0; }
+.stat b { display: block; font-size: 22px; }
+.bars { display: flex; align-items: flex-end; gap: 4px; height: 60px; margin-top: 8px; }
+.bars span { flex: 1; background: var(--accent); border-radius: 4px 4px 0 0; min-height: 2px; }
+.tools { display: grid; gap: 10px; }
+details.tool { background: var(--surface-2); border: 1px solid var(--border); border-radius: 11px; padding: 10px 14px; }
+details.tool summary { cursor: pointer; font-weight: 600; list-style: none; display: flex; gap: 8px; align-items: baseline; flex-wrap: wrap; }
+details.tool summary small { color: var(--muted); font-weight: 400; }
+pre { font: 12.5px/1.45 var(--mono); background: var(--bg); border: 1px solid var(--border); border-radius: 9px; padding: 10px 12px; overflow: auto; margin: 8px 0; white-space: pre-wrap; word-break: break-word; }
+.tabs { display: flex; gap: 6px; margin-top: 8px; }
+.tabs button { padding: 4px 10px; font-size: 12.5px; }
+.msg { margin-top: 10px; font-size: 13.5px; }
+.msg.err { color: var(--bad); }
+.hide { display: none !important; }
+@media (max-width: 560px) { header nav { margin-left: 0; } .stats { grid-template-columns: 1fr 1fr 1fr; } }
+</style>
+</head>
+<body>
+<header>
+  <h1 id="title">Developer portal</h1><span class="ver" id="ver"></span>
+  <nav><button class="ghost" id="lang" type="button">中文</button></nav>
+</header>
+<main>
+  <div class="grid2">
+    <section class="card" id="signup-card">
+      <h2 data-t="signup">Get an API key</h2>
+      <p class="muted" id="signup-note"></p>
+      <form id="signup">
+        <label for="name" data-t="name">Name or project</label>
+        <input id="name" name="name" required maxlength="80" autocomplete="name" />
+        <label for="email" data-t="email">E-mail</label>
+        <input id="email" name="email" type="email" required autocomplete="email" />
+        <div class="row"><button type="submit" data-t="create">Create key</button></div>
+      </form>
+      <div id="issued" class="hide">
+        <p class="msg" id="issued-msg"></p>
+        <div class="key" id="issued-key"></div>
+        <div class="row"><button class="ghost" id="copy" type="button" data-t="copy">Copy</button><button class="ghost" id="use" type="button" data-t="use">Use this key here</button></div>
+      </div>
+      <p class="msg err hide" id="signup-err"></p>
+    </section>
+    <section class="card">
+      <h2 data-t="mykey">Your key</h2>
+      <label for="key" data-t="paste">Paste your API key (kept in this tab only)</label>
+      <input id="key" type="password" autocomplete="off" spellcheck="false" />
+      <div class="row"><button id="load" type="button" data-t="load">Load usage &amp; tools</button><button class="ghost hide" id="rotate" type="button" data-t="rotate">Rotate</button><button class="danger hide" id="revoke" type="button" data-t="revoke">Revoke</button></div>
+      <div id="me" class="hide">
+        <p><span id="me-name"></span> <span class="badge" id="me-status"></span></p>
+        <div class="stats"><div class="stat"><b id="u-calls">0</b><span class="muted" data-t="calls">calls (7 days)</span></div><div class="stat"><b id="u-err">0</b><span class="muted" data-t="errors">errors</span></div><div class="stat"><b id="u-lat">0</b><span class="muted" data-t="latency">avg ms</span></div></div>
+        <div class="bars" id="bars" aria-label="Calls per day"></div>
+        <p class="muted" id="me-scope"></p>
+      </div>
+      <p class="msg err hide" id="me-err"></p>
+    </section>
+  </div>
+  <section class="card">
+    <h2 data-t="tools">Tools you can call</h2>
+    <p class="muted" data-t="toolsnote">Load your key to see the tools in its scope, with example arguments, snippets and a live “Try it”.</p>
+    <div class="tools" id="tools"></div>
+  </section>
+</main>
+<script>
+(() => {
+  'use strict';
+  const T = {
+    en: { signup: 'Get an API key', name: 'Name or project', email: 'E-mail', create: 'Create key', copy: 'Copy', use: 'Use this key here', mykey: 'Your key', paste: 'Paste your API key (kept in this tab only)', load: 'Load usage & tools', rotate: 'Rotate', revoke: 'Revoke', calls: 'calls (7 days)', errors: 'errors', latency: 'avg ms', tools: 'Tools you can call', toolsnote: 'Load your key to see the tools in its scope, with example arguments, snippets and a live “Try it”.', open: 'Keys work immediately.', approval: 'An operator approves new keys before they work.', closed: 'Self-service signup is closed — ask an operator for a key.', domains: 'Allowed e-mail domains: ', tryit: 'Try it', args: 'Arguments (JSON)', copied: 'Copied', confirmRevoke: 'Revoke this key? Apps using it stop working.', scope: 'Scope: ', none: 'No tools in this key’s scope yet.', expires: 'expires ' },
+    zh: { signup: '申请 API Key', name: '名称或项目', email: '邮箱', create: '创建 Key', copy: '复制', use: '在此页使用该 Key', mykey: '我的 Key', paste: '粘贴你的 API Key（仅保存在本标签页）', load: '加载用量与工具', rotate: '轮换', revoke: '吊销', calls: '次调用（7 天）', errors: '错误', latency: '平均毫秒', tools: '可调用的工具', toolsnote: '加载 Key 后可查看其权限范围内的工具、示例参数、代码片段，并可在线试用。', open: '新 Key 立即可用。', approval: '新 Key 需管理员审批后才能使用。', closed: '自助申请已关闭，请联系管理员获取 Key。', domains: '允许的邮箱域名：', tryit: '试一试', args: '参数（JSON）', copied: '已复制', confirmRevoke: '确定吊销该 Key？使用它的应用将无法访问。', scope: '范围：', none: '该 Key 的范围内暂无工具。', expires: '到期 ' },
+  };
+  let lang = (localStorage.getItem('mcp-gateway.lang') || navigator.language || 'en').startsWith('zh') ? 'zh' : 'en';
+  const t = (k) => T[lang][k] || T.en[k] || k;
+  const $ = (id) => document.getElementById(id);
+  const api = (p, init = {}) => {
+    const key = sessionStorage.getItem('mcp-gateway.portal.key');
+    const headers = { 'Content-Type': 'application/json', ...(init.auth !== false && key ? { Authorization: 'Bearer ' + key } : {}) };
+    return fetch('api/v1' + p, { ...init, headers }).then(async (r) => { const b = await r.json().catch(() => ({})); if (!r.ok) throw new Error(b.message || b.error || ('HTTP ' + r.status)); return b; });
+  };
+  const show = (el, on) => el.classList.toggle('hide', !on);
+  const err = (el, e) => { el.textContent = e ? String(e.message || e) : ''; show(el, !!e); };
+  let info = null;
+  function applyLang() {
+    document.documentElement.lang = lang === 'zh' ? 'zh-CN' : 'en';
+    document.querySelectorAll('[data-t]').forEach((el) => { el.textContent = t(el.dataset.t); });
+    $('lang').textContent = lang === 'zh' ? 'English' : '中文';
+    if (info) $('signup-note').textContent = t(info.signup) + (info.allowedEmailDomains.length ? ' ' + t('domains') + info.allowedEmailDomains.map((d) => '@' + d).join(', ') : '');
+  }
+  $('lang').addEventListener('click', () => { lang = lang === 'zh' ? 'en' : 'zh'; localStorage.setItem('mcp-gateway.lang', lang); applyLang(); });
+  api('/portal/info', { auth: false }).then((i) => {
+    info = i;
+    $('title').textContent = i.title;
+    $('ver').textContent = 'v' + i.version;
+    if (i.signup === 'closed') show($('signup'), false);
+    applyLang();
+  }).catch((e) => err($('signup-err'), e));
+
+  $('signup').addEventListener('submit', (ev) => {
+    ev.preventDefault();
+    err($('signup-err'));
+    api('/portal/signup', { method: 'POST', auth: false, body: JSON.stringify({ name: $('name').value, email: $('email').value }) }).then((r) => {
+      $('issued-msg').textContent = r.message;
+      $('issued-key').textContent = r.key;
+      show($('issued'), true);
+      show($('signup'), false);
+    }).catch((e) => err($('signup-err'), e));
+  });
+  $('copy').addEventListener('click', () => { navigator.clipboard?.writeText($('issued-key').textContent).then(() => { $('copy').textContent = t('copied'); }); });
+  $('use').addEventListener('click', () => { $('key').value = $('issued-key').textContent; load(); });
+  $('load').addEventListener('click', load);
+  $('key').addEventListener('keydown', (e) => { if (e.key === 'Enter') load(); });
+
+  function load() {
+    const k = $('key').value.trim();
+    if (!k) return;
+    sessionStorage.setItem('mcp-gateway.portal.key', k);
+    err($('me-err'));
+    api('/portal/me').then(renderMe).catch((e) => { show($('me'), false); err($('me-err'), e); });
+    api('/portal/tools').then(renderTools).catch(() => {});
+  }
+  function renderMe(m) {
+    show($('me'), true); show($('rotate'), true); show($('revoke'), true);
+    $('me-name').textContent = m.key.name + ' · ' + m.key.prefix + '…';
+    $('me-status').textContent = m.key.status;
+    $('me-status').className = 'badge ' + m.key.status;
+    $('u-calls').textContent = m.usage.calls;
+    $('u-err').textContent = m.usage.errors;
+    $('u-lat').textContent = m.usage.avgLatencyMs;
+    const max = Math.max(1, ...m.usage.byDay.map((d) => d.calls));
+    $('bars').replaceChildren(...m.usage.byDay.map((d) => { const s = document.createElement('span'); s.style.height = Math.round((d.calls / max) * 100) + '%'; s.title = d.day + ': ' + d.calls; return s; }));
+    $('me-scope').textContent = t('scope') + ((m.key.servers || ['*']).join(', ')) + (m.key.rateLimit ? ' · ' + m.key.rateLimit.limit + '/' + m.key.rateLimit.windowSeconds + 's' : '') + (m.key.expiresAt ? ' · ' + t('expires') + m.key.expiresAt.slice(0, 10) : '');
+  }
+  $('rotate').addEventListener('click', () => api('/portal/me/rotate', { method: 'POST' }).then((r) => { $('key').value = r.key; $('issued-msg').textContent = r.message; $('issued-key').textContent = r.key; show($('issued'), true); load(); }).catch((e) => err($('me-err'), e)));
+  $('revoke').addEventListener('click', () => { if (confirm(t('confirmRevoke'))) api('/portal/me', { method: 'DELETE' }).then(() => { sessionStorage.removeItem('mcp-gateway.portal.key'); $('key').value = ''; show($('me'), false); $('tools').replaceChildren(); }).catch((e) => err($('me-err'), e)); });
+
+  function el(tag, props = {}, ...kids) { const e = document.createElement(tag); Object.assign(e, props); e.append(...kids); return e; }
+  function renderTools(r) {
+    const box = $('tools');
+    if (!r.tools.length) return box.replaceChildren(el('p', { className: 'muted', textContent: t('none') }));
+    box.replaceChildren(...r.tools.map((tool) => {
+      const pre = el('pre', { textContent: tool.snippets.curl });
+      const tabs = el('div', { className: 'tabs' }, ...['curl', 'javascript', 'python'].map((lang2) => { const b = el('button', { type: 'button', className: 'ghost', textContent: lang2 }); b.addEventListener('click', () => { pre.textContent = tool.snippets[lang2]; }); return b; }));
+      const args = el('textarea', { value: JSON.stringify(tool.example, null, 2), spellcheck: false });
+      const out = el('pre', { className: 'hide' });
+      const run = el('button', { type: 'button', textContent: t('tryit') });
+      run.addEventListener('click', () => {
+        let a; try { a = JSON.parse(args.value || '{}'); } catch (e) { out.textContent = String(e.message); show(out, true); return; }
+        run.disabled = true;
+        api('/tools/call', { method: 'POST', body: JSON.stringify({ server: tool.server, tool: tool.name, arguments: a }) }).then((res) => { out.textContent = JSON.stringify(res.result, null, 2); }).catch((e) => { out.textContent = String(e.message); }).finally(() => { run.disabled = false; show(out, true); });
+      });
+      return el('details', { className: 'tool' },
+        el('summary', {}, tool.server + ' / ' + tool.name, el('small', { textContent: tool.description || '' })),
+        el('pre', { textContent: JSON.stringify(tool.inputSchema || {}, null, 2) }),
+        tabs, pre,
+        el('label', { textContent: t('args') }), args,
+        el('div', { className: 'row' }, run), out);
+    }));
+  }
+  applyLang();
+  const saved = sessionStorage.getItem('mcp-gateway.portal.key');
+  if (saved) { $('key').value = saved; load(); }
+})();
+</script>
+</body>
+</html>

package/dist/bench/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Built-in benchmark (3.9): `mcp-gateway bench`.
+ *
+ * Starts an in-process gateway on 127.0.0.1 with a minimal stdio echo MCP server (written to a temp file, run with the
+ * current Node binary) and drives it with N concurrent keep-alive clients for a fixed time per scenario:
+ *
+ *  - `rest`: `POST /api/v1/tools/call` (auth off) — the full pipeline (scopes, policy, quotas, audit in memory);
+ *  - `rest-auth`: the same with an API key and a rate-limit-free key;
+ *  - `cache`: a cached tool (`cache.rules`) — the gateway's own overhead without the upstream round trip;
+ *  - `mcp`: JSON-RPC `tools/call` on the streamable-HTTP `/mcp` endpoint (one session per client).
+ *
+ * Reports requests/s, mean and p50 / p95 / p99 latency, and errors. Numbers depend on the machine; compare runs on
+ * the same host.
+ *
+ * @module bench
+ */
+export type BenchScenario = 'rest' | 'rest-auth' | 'cache' | 'mcp';
+export declare const BENCH_SCENARIOS: BenchScenario[];
+export interface BenchOptions {
+    durationMs?: number;
+    concurrency?: number;
+    scenarios?: BenchScenario[];
+    /** Warm-up per scenario (not measured). */
+    warmupMs?: number;
+}
+export interface BenchResult {
+    scenario: BenchScenario;
+    requests: number;
+    errors: number;
+    rps: number;
+    meanMs: number;
+    p50Ms: number;
+    p95Ms: number;
+    p99Ms: number;
+    maxMs: number;
+}
+export interface BenchReport {
+    node: string;
+    platform: string;
+    cpus: number;
+    concurrency: number;
+    durationMs: number;
+    results: BenchResult[];
+}
+export declare function percentile(sorted: number[], p: number): number;
+export declare function summarize(scenario: BenchScenario, latencies: number[], errors: number, elapsedMs: number): BenchResult;
+export declare function runBenchmark(opts?: BenchOptions): Promise<BenchReport>;
+/** Markdown table of a report. */
+export declare function benchMarkdown(r: BenchReport): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/bench/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bench/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC;AACnE,eAAO,MAAM,eAAe,EAAE,aAAa,EAA0C,CAAC;AAEtF,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAeD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CActH;AAyBD,wBAAsB,YAAY,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwEhF;AAED,kCAAkC;AAClC,wBAAgB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAIpD"}

package/dist/bench/index.js

@@ -0,0 +1,162 @@
+/**
+ * Built-in benchmark (3.9): `mcp-gateway bench`.
+ *
+ * Starts an in-process gateway on 127.0.0.1 with a minimal stdio echo MCP server (written to a temp file, run with the
+ * current Node binary) and drives it with N concurrent keep-alive clients for a fixed time per scenario:
+ *
+ *  - `rest`: `POST /api/v1/tools/call` (auth off) — the full pipeline (scopes, policy, quotas, audit in memory);
+ *  - `rest-auth`: the same with an API key and a rate-limit-free key;
+ *  - `cache`: a cached tool (`cache.rules`) — the gateway's own overhead without the upstream round trip;
+ *  - `mcp`: JSON-RPC `tools/call` on the streamable-HTTP `/mcp` endpoint (one session per client).
+ *
+ * Reports requests/s, mean and p50 / p95 / p99 latency, and errors. Numbers depend on the machine; compare runs on
+ * the same host.
+ *
+ * @module bench
+ */
+import { mkdtempSync, writeFileSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { Gateway } from '../gateway/index.js';
+export const BENCH_SCENARIOS = ['rest', 'rest-auth', 'cache', 'mcp'];
+const ECHO_SERVER = `
+const rl = require('readline').createInterface({ input: process.stdin });
+const send = (m) => process.stdout.write(JSON.stringify(m) + '\\n');
+rl.on('line', (line) => {
+  let msg; try { msg = JSON.parse(line); } catch { return; }
+  if (msg.method === 'initialize') return send({ jsonrpc: '2.0', id: msg.id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: 'bench-echo', version: '1' } } });
+  if (msg.method === 'tools/list') return send({ jsonrpc: '2.0', id: msg.id, result: { tools: [{ name: 'echo', description: 'Echo', inputSchema: { type: 'object' } }, { name: 'cached', description: 'Cached echo', inputSchema: { type: 'object' } }] } });
+  if (msg.method === 'tools/call') return send({ jsonrpc: '2.0', id: msg.id, result: { content: [{ type: 'text', text: JSON.stringify(msg.params.arguments || {}) }] } });
+  if (msg.method === 'ping') return send({ jsonrpc: '2.0', id: msg.id, result: {} });
+  if (msg.id !== undefined && msg.method) send({ jsonrpc: '2.0', id: msg.id, error: { code: -32601, message: 'unknown' } });
+});
+`;
+export function percentile(sorted, p) {
+    if (!sorted.length)
+        return 0;
+    const i = Math.min(sorted.length - 1, Math.max(0, Math.ceil(p * sorted.length) - 1));
+    return sorted[i];
+}
+export function summarize(scenario, latencies, errors, elapsedMs) {
+    const s = [...latencies].sort((a, b) => a - b);
+    const r2 = (n) => Math.round(n * 100) / 100;
+    return {
+        scenario,
+        requests: s.length,
+        errors,
+        rps: Math.round((s.length / Math.max(1, elapsedMs)) * 1000),
+        meanMs: r2(s.reduce((a, b) => a + b, 0) / Math.max(1, s.length)),
+        p50Ms: r2(percentile(s, 0.5)),
+        p95Ms: r2(percentile(s, 0.95)),
+        p99Ms: r2(percentile(s, 0.99)),
+        maxMs: r2(s[s.length - 1] ?? 0),
+    };
+}
+async function drive(durationMs, concurrency, once) {
+    const latencies = [];
+    let errors = 0;
+    const t0 = performance.now();
+    const end = t0 + durationMs;
+    await Promise.all(Array.from({ length: concurrency }, async (_, w) => {
+        while (performance.now() < end) {
+            const s = performance.now();
+            let ok = false;
+            try {
+                ok = await once(w);
+            }
+            catch {
+                ok = false;
+            }
+            if (ok)
+                latencies.push(performance.now() - s);
+            else
+                errors++;
+        }
+    }));
+    return { latencies, errors, elapsed: performance.now() - t0 };
+}
+export async function runBenchmark(opts = {}) {
+    const durationMs = opts.durationMs ?? 10_000;
+    const concurrency = opts.concurrency ?? 32;
+    const warmupMs = opts.warmupMs ?? Math.min(1000, durationMs / 5);
+    const scenarios = opts.scenarios ?? BENCH_SCENARIOS;
+    const dir = mkdtempSync(join(tmpdir(), 'mgw-bench-'));
+    const script = join(dir, 'echo.cjs');
+    writeFileSync(script, ECHO_SERVER);
+    const KEY = 'bench-key-0123456789abcdef';
+    const config = {
+        port: 0,
+        host: '127.0.0.1',
+        logLevel: 'error',
+        monitor: { requestLog: false },
+        servers: [{ id: 'echo', name: 'echo', transport: 'stdio', command: process.execPath, args: [script], maxConcurrency: Math.max(64, concurrency * 2) }],
+        cache: { enabled: true, rules: [{ tools: ['cached'], ttlSeconds: 3600, scope: 'shared' }] },
+    };
+    const results = [];
+    const gw = new Gateway(config);
+    const gwAuth = new Gateway({ ...config, auth: { strategy: 'api-key', apiKeys: [{ name: 'bench', key: KEY }] } });
+    try {
+        await gw.start();
+        if (scenarios.includes('rest-auth'))
+            await gwAuth.start();
+        const base = `http://127.0.0.1:${gw.address().port}`;
+        const baseAuth = scenarios.includes('rest-auth') ? `http://127.0.0.1:${gwAuth.address().port}` : '';
+        const call = (url, tool, headers = {}) => async () => {
+            const r = await fetch(`${url}/api/v1/tools/call`, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body: JSON.stringify({ server: 'echo', tool, arguments: { n: 1 } }) });
+            await r.arrayBuffer();
+            return r.ok;
+        };
+        for (const sc of scenarios) {
+            let once;
+            if (sc === 'rest')
+                once = call(base, 'echo');
+            else if (sc === 'rest-auth')
+                once = call(baseAuth, 'echo', { authorization: `Bearer ${KEY}` });
+            else if (sc === 'cache')
+                once = call(base, 'cached');
+            else {
+                // One MCP session per worker.
+                const sessions = [];
+                for (let w = 0; w < concurrency; w++) {
+                    const r = await fetch(`${base}/mcp`, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json', accept: 'application/json, text/event-stream' },
+                        body: JSON.stringify({ jsonrpc: '2.0', id: 0, method: 'initialize', params: { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'bench', version: '1' } } }),
+                    });
+                    await r.arrayBuffer();
+                    const sid = r.headers.get('mcp-session-id') ?? '';
+                    sessions.push(sid);
+                    await fetch(`${base}/mcp`, { method: 'POST', headers: { 'content-type': 'application/json', accept: 'application/json, text/event-stream', ...(sid ? { 'mcp-session-id': sid } : {}) }, body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }) }).then((x) => x.arrayBuffer());
+                }
+                let id = 1;
+                once = async (w) => {
+                    const sid = sessions[w];
+                    const r = await fetch(`${base}/mcp`, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json', accept: 'application/json, text/event-stream', ...(sid ? { 'mcp-session-id': sid } : {}) },
+                        body: JSON.stringify({ jsonrpc: '2.0', id: id++, method: 'tools/call', params: { name: 'echo', arguments: { n: 1 } } }),
+                    });
+                    const text = await r.text();
+                    return r.ok && text.includes('"result"');
+                };
+            }
+            await drive(warmupMs, concurrency, once);
+            const { latencies, errors, elapsed } = await drive(durationMs, concurrency, once);
+            results.push(summarize(sc, latencies, errors, elapsed));
+        }
+    }
+    finally {
+        await gw.stop().catch(() => undefined);
+        await gwAuth.stop().catch(() => undefined);
+        rmSync(dir, { recursive: true, force: true });
+    }
+    const os = await import('os');
+    return { node: process.version, platform: `${process.platform}-${process.arch}`, cpus: os.cpus().length, concurrency, durationMs, results };
+}
+/** Markdown table of a report. */
+export function benchMarkdown(r) {
+    const head = `Node ${r.node} · ${r.platform} · ${r.cpus} CPU · concurrency ${r.concurrency} · ${r.durationMs / 1000}s per scenario\n\n`;
+    const rows = r.results.map((x) => `| ${x.scenario} | ${x.rps} | ${x.meanMs} | ${x.p50Ms} | ${x.p95Ms} | ${x.p99Ms} | ${x.errors} |`);
+    return head + ['| Scenario | req/s | mean ms | p50 ms | p95 ms | p99 ms | errors |', '|---|---:|---:|---:|---:|---:|---:|', ...rows].join('\n') + '\n';
+}
+//# sourceMappingURL=index.js.map

package/dist/bench/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bench/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAI9C,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AA+BtF,MAAM,WAAW,GAAG;;;;;;;;;;;CAWnB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,MAAgB,EAAE,CAAS;IACpD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAuB,EAAE,SAAmB,EAAE,MAAc,EAAE,SAAiB;IACvG,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACpD,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3D,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAChE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7B,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9B,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9B,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,UAAkB,EAAE,WAAmB,EAAE,IAA0C;IACtG,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;IAC5B,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;QACjD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC5B,IAAI,EAAE,GAAG,KAAK,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,KAAK,CAAC;YACb,CAAC;YACD,IAAI,EAAE;gBAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;;gBACzC,MAAM,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,4BAA4B,CAAC;IACzC,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,CAAC;QACP,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;QAC9B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QACrJ,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE;KAC3E,CAAC;IACnB,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAmB,CAAC,CAAC;IAClI,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,OAAO,EAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,UAAkC,EAAE,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;YAC3F,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACxM,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,EAAE,CAAC;QACd,CAAC,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,IAAqC,CAAC;YAC1C,IAAI,EAAE,KAAK,MAAM;gBAAE,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACxC,IAAI,EAAE,KAAK,WAAW;gBAAE,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,CAAC;iBAC1F,IAAI,EAAE,KAAK,OAAO;gBAAE,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAChD,CAAC;gBACJ,8BAA8B;gBAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;gBAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;oBACrC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;wBACnC,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE;wBAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;qBAChL,CAAC,CAAC;oBACH,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnB,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACxS,CAAC;gBACD,IAAI,EAAE,GAAG,CAAC,CAAC;gBACX,IAAI,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE;oBACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;wBACnC,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;wBACzI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;qBACxH,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC5B,OAAO,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAC3C,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC9I,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,aAAa,CAAC,CAAc;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC;IACxI,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IACrI,OAAO,IAAI,GAAG,CAAC,oEAAoE,EAAE,qCAAqC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACzJ,CAAC"}

package/dist/cli.js

@@ -132,9 +132,9 @@ program
         console.log(`  Servers: ${config.servers.length}`);
         console.log(`  Auth: ${config.auth?.strategy ?? 'none'}`);
         if (config.deprecations?.length) {
-            console.log('\nDeprecated (removed in 3.0):');
+            console.log('\nDeprecated:');
             for (const d of config.deprecations)
-                console.log(`  ! ${d.message}`);
+                console.log(`  ! (removed in ${d.removedIn}) ${d.message}${d.detail ? ` — ${d.detail}` : ''}`);
         }
         const warnings = securityWarnings(config);
         if (warnings.length > 0) {
@@ -297,6 +297,81 @@ program
     console.log(`hash: ${hash}`);
     console.log('\nGive the key to the client; put the hash in auth.apiKeys. The key is not shown again.');
 });
+// ─── migrate (3.9) ────────────────────────────────────────────────────────────
+program
+    .command('migrate')
+    .description('Rewrite a config file to schema v4 (keeps comments); prints the changes')
+    .option('-c, --config <path>', 'Config file (default: the usual search paths)')
+    .option('--to <version>', 'Target schema version', '4')
+    .option('--write', 'Write the file in place (a .bak copy is kept)')
+    .option('-o, --output <path>', 'Write the migrated config to this file instead')
+    .option('--check', 'Exit with code 3 when the file needs migrating (CI)')
+    .action(async (options) => {
+    const { readFile } = await import('fs/promises');
+    const { migrateConfigText } = await import('./config/migrate.js');
+    const path = resolveConfigPath(options.config);
+    if (!path) {
+        logger.error('No config file found (use -c <path>)');
+        process.exit(1);
+    }
+    try {
+        const text = await readFile(path, 'utf8');
+        const r = migrateConfigText(text, /\.json$/i.test(path) ? 'json' : 'yaml', Number(options.to));
+        if (!r.changed) {
+            console.log(`✓ ${path} is already on schema v${options.to}`);
+        }
+        else {
+            console.log(`${path}: ${r.changes.length} change(s)`);
+            for (const c of r.changes)
+                console.log(`  ~ ${c}`);
+        }
+        for (const n of r.notes)
+            console.log(`  ! ${n}`);
+        if (r.changed && options.check)
+            process.exit(3);
+        if (!r.changed)
+            return;
+        if (options.output) {
+            await writeFile(options.output, r.text);
+            console.log(`Written to ${options.output}`);
+        }
+        else if (options.write) {
+            await writeFile(`${path}.bak`, text);
+            await writeFile(path, r.text);
+            console.log(`Written (backup: ${path}.bak)`);
+        }
+        else {
+            console.log('\n--- migrated config (use --write to save) ---\n');
+            process.stdout.write(r.text);
+        }
+    }
+    catch (err) {
+        logger.error(`Migration failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+});
+// ─── bench (3.9) ──────────────────────────────────────────────────────────────
+program
+    .command('bench')
+    .description('Benchmark an in-process gateway with a local echo server (REST, auth, cache, /mcp)')
+    .option('-d, --duration <seconds>', 'Seconds per scenario', '10')
+    .option('--concurrency <n>', 'Concurrent clients', '32')
+    .option('-s, --scenario <list>', 'Comma-separated: rest,rest-auth,cache,mcp', 'rest,rest-auth,cache,mcp')
+    .option('--json', 'Print JSON')
+    .action(async (options) => {
+    const { runBenchmark, benchMarkdown, BENCH_SCENARIOS } = await import('./bench/index.js');
+    const scenarios = String(options.scenario).split(',').map((x) => x.trim()).filter(Boolean);
+    const bad = scenarios.filter((x) => !BENCH_SCENARIOS.includes(x));
+    const duration = Number(options.duration);
+    const concurrency = Number(options.concurrency);
+    if (bad.length || !(duration > 0) || !Number.isInteger(concurrency) || concurrency < 1) {
+        logger.error(`Invalid options${bad.length ? `: unknown scenario(s) ${bad.join(', ')}` : ''}`);
+        process.exit(1);
+    }
+    logger.setLevel('error');
+    const report = await runBenchmark({ durationMs: duration * 1000, concurrency, scenarios: scenarios });
+    console.log(options.json ? JSON.stringify(report, null, 2) : benchMarkdown(report));
+});
 program.parse(process.argv);
 if (!process.argv.slice(2).length) {
     program.outputHelp();