agentgate-runtime-control 2.13.8

package/src/policy-packs.js

@@ -0,0 +1,115 @@
+/**
+ * Curated, reviewable policy packs for common agent side-effect workflows.
+ * Packs are deterministic data: they never grant authorization by themselves.
+ */
+
+const SUPPORT_REFUND_SAFETY = Object.freeze({
+  id: 'support-refund-safety',
+  name: 'Support Refund Safety Pack',
+  version: '1.0.0',
+  description: 'Conservative controls for customer-support agents that can issue refunds.',
+  useCase: 'support-financial-operations',
+  policies: Object.freeze({
+    productionBlock: false,
+    autoApproveAmount: 500,
+    approvalAmount: 5000,
+    blockActions: Object.freeze(['export_all'])
+  }),
+  cases: Object.freeze([
+    { name: 'small refund', action: 'refund', amount: 250, environment: 'production', expected: 'ASK' },
+    { name: 'review refund', action: 'refund', amount: 1200, environment: 'production', expected: 'ASK' },
+    { name: 'ceiling refund', action: 'refund', amount: 5000, environment: 'production', expected: 'ASK' },
+    { name: 'over-ceiling refund', action: 'refund', amount: 5000.01, environment: 'production', expected: 'BLOCK' },
+    { name: 'invalid refund amount', action: 'refund', amount: '5000.01', environment: 'production', expected: 'BLOCK' },
+    { name: 'production export', action: 'export_all', amount: 0, environment: 'production', expected: 'BLOCK' }
+  ]),
+  limitations: Object.freeze([
+    'Does not prove an agent is safe or prevent every prompt-injection technique.',
+    'Does not replace application authorization, IAM, network isolation, or provider controls.',
+    'Review policy thresholds and tool semantics before production enforcement.'
+  ])
+});
+
+const PRODUCTION_DEVOPS_SAFETY = Object.freeze({
+  id: 'production-devops-safety',
+  name: 'Production DevOps Safety Pack',
+  version: '1.0.0',
+  description: 'Conservative controls for agents that can change or delete production infrastructure.',
+  useCase: 'devops-it-operations',
+  policies: Object.freeze({
+    productionBlock: true,
+    requireApprovalForDestructive: true,
+    blockActions: Object.freeze(['update_production', 'delete', 'deploy'])
+  }),
+  cases: Object.freeze([
+    { name: 'read production', action: 'read', environment: 'production', expected: 'ALLOW' },
+    { name: 'production delete', action: 'delete', environment: 'production', expected: 'BLOCK' },
+    { name: 'production config', action: 'update_production', environment: 'production', expected: 'BLOCK' },
+    { name: 'production deploy', action: 'deploy', environment: 'production', expected: 'BLOCK' },
+    { name: 'export everything', action: 'export_all', environment: 'production', expected: 'BLOCK' }
+  ]),
+  limitations: Object.freeze([
+    'Does not replace cloud IAM, deployment approvals, change management, or infrastructure isolation.',
+    'Review action names and production detection against the actual tool contract.',
+    'This pack is intentionally conservative and may require explicit exceptions.'
+  ])
+});
+
+const CUSTOMER_DATA_EXPORT_SAFETY = Object.freeze({
+  id: 'customer-data-export-safety',
+  name: 'Customer Data Export Safety Pack',
+  version: '1.0.0',
+  description: 'Conservative controls for CRM/data agents handling exports and bulk customer changes.',
+  useCase: 'crm-customer-data',
+  policies: Object.freeze({
+    productionBlock: false,
+    requireApprovalForDestructive: true,
+    blockActions: Object.freeze(['export_all', 'bulk_update'])
+  }),
+  cases: Object.freeze([
+    { name: 'search customer', action: 'search', environment: 'production', expected: 'ALLOW' },
+    { name: 'export all customers', action: 'export_all', environment: 'production', expected: 'BLOCK' },
+    { name: 'bulk customer update', action: 'bulk_update', environment: 'production', expected: 'BLOCK' },
+    { name: 'delete customer', action: 'delete', environment: 'production', expected: 'ASK' }
+  ]),
+  limitations: Object.freeze([
+    'Does not establish legal compliance or automatically satisfy privacy requirements.',
+    'Tenant and identity authorization should be configured separately.',
+    'Review data classification and destination controls before enforcement.'
+  ])
+});
+
+const PACKS = Object.freeze({
+  [SUPPORT_REFUND_SAFETY.id]: SUPPORT_REFUND_SAFETY,
+  [PRODUCTION_DEVOPS_SAFETY.id]: PRODUCTION_DEVOPS_SAFETY,
+  [CUSTOMER_DATA_EXPORT_SAFETY.id]: CUSTOMER_DATA_EXPORT_SAFETY
+});
+
+export function listPolicyPacks() {
+  return Object.values(PACKS).map(pack => ({
+    id: pack.id,
+    name: pack.name,
+    version: pack.version,
+    useCase: pack.useCase,
+    description: pack.description
+  }));
+}
+
+export function getPolicyPack(id = '') {
+  const pack = PACKS[String(id).trim().toLowerCase()];
+  if (!pack) return null;
+  return clonePack(pack);
+}
+
+export function getDefaultPolicyPack() {
+  return clonePack(SUPPORT_REFUND_SAFETY);
+}
+
+function clonePack(pack) {
+  return {
+    ...pack,
+    policies: { ...pack.policies, ...(pack.policies.approvalActions ? { approvalActions: [...pack.policies.approvalActions] } : {}), ...(pack.policies.blockActions ? { blockActions: [...pack.policies.blockActions] } : {}) },
+    cases: pack.cases.map(item => ({ ...item })),
+    limitations: [...pack.limitations]
+  };
+}

package/src/policy-registry.js

@@ -0,0 +1,58 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { evaluate } from './policy-engine.js';
+
+export const POLICY_STATES = Object.freeze({ DRAFT:'draft', TESTED:'tested', ACTIVE:'active', ARCHIVED:'archived' });
+
+const clone = (v) => structuredClone(v ?? {});
+const digest = (v) => crypto.createHash('sha256').update(JSON.stringify(v, Object.keys(v).sort())).digest('hex').slice(0,16);
+
+export class PolicyRegistry {
+  constructor(options = {}) {
+    this.filePath = path.resolve(options.filePath || '.agentgate/policies.json');
+    this.limit = options.limit || 500;
+    this.items = this.#load();
+    this.audit = this.#loadAudit();
+  }
+  #load() { try { const x=JSON.parse(fs.readFileSync(this.filePath,'utf8')); return Array.isArray(x)?x:[]; } catch { return []; } }
+  #loadAudit() { try { const p=this.filePath.replace(/\.json$/,'-audit.json'); const x=JSON.parse(fs.readFileSync(p,'utf8')); return Array.isArray(x)?x:[]; } catch { return []; } }
+  #save() { fs.mkdirSync(path.dirname(this.filePath),{recursive:true}); const t=this.filePath+'.tmp'; fs.writeFileSync(t,JSON.stringify(this.items,null,2)); fs.renameSync(t,this.filePath); const ap=this.filePath.replace(/\.json$/,'-audit.json'); fs.writeFileSync(ap,JSON.stringify(this.audit.slice(0,2000),null,2)); }
+  #versions(name, tenantId = null) { return this.items.filter(x=>x.name===name && (tenantId == null ? !x.tenantId : x.tenantId === tenantId)).sort((a,b)=>b.version-a.version); }
+  create(name, policy={}, metadata={}, tenantId = null) {
+    if (!name || typeof name!=='string') throw new TypeError('Policy name is required');
+    const versions=this.#versions(name, tenantId); const version=(versions[0]?.version||0)+1;
+    const item={id:`pol_${name.toLowerCase().replace(/[^a-z0-9]+/g,'_')}_v${version}`,name,version,state:POLICY_STATES.DRAFT,policy:clone(policy),metadata:clone(metadata),tenantId: tenantId || null,hash:digest(policy),createdAt:new Date().toISOString()};
+    this.items.unshift(item); this.#audit('create',item); this.#save(); return clone(item);
+  }
+  get(name, version, tenantId = null) { return clone(this.#versions(name, tenantId).find(x=>version==null||x.version===Number(version))||null); }
+  list(name, tenantId = null) { return this.#versions(name, tenantId).map(clone); }
+  active(name, tenantId = null) { return clone(this.#versions(name, tenantId).find(x=>x.state===POLICY_STATES.ACTIVE)||null); }
+  activeAll(tenantId = null) { return this.items.filter(x => x.state === POLICY_STATES.ACTIVE && (tenantId == null ? !x.tenantId : x.tenantId === tenantId)).map(clone); }
+  updateDraft(name, version, policy, metadata, tenantId = null) {
+    const item=this.#versions(name, tenantId).find(x=>x.version===Number(version));
+    if(!item) return null; if(item.state!==POLICY_STATES.DRAFT) throw new Error('Only draft policies can be updated');
+    item.policy=clone(policy); if(metadata) item.metadata=clone(metadata); item.hash=digest(policy); item.updatedAt=new Date().toISOString(); this.#audit('update',item); this.#save(); return clone(item);
+  }
+  test(name, version, cases=[], tenantId = null) {
+    const item=this.#versions(name, tenantId).find(x=>x.version===Number(version)); if(!item) throw new Error('Policy version not found');
+    const results=cases.map((c)=>{const r=evaluate(c.input||c.request||{},item.policy); return {name:c.name||c.id||'case',expected:c.expected,actual:r.decision,passed:c.expected?c.expected===r.decision:true,reason:r.reason,risk:r.risk};});
+    const passed=results.every(r=>r.passed); if(passed && item.state===POLICY_STATES.DRAFT) item.state=POLICY_STATES.TESTED; item.lastTest={at:new Date().toISOString(),passed,results}; this.#audit('test',item,{passed}); this.#save(); return clone(item.lastTest);
+  }
+  activate(name, version, tenantId = null) {
+    const target=this.#versions(name, tenantId).find(x=>x.version===Number(version)); if(!target) throw new Error('Policy version not found');
+    if(target.state!==POLICY_STATES.TESTED && target.state!==POLICY_STATES.ACTIVE) throw new Error('Policy must pass tests before activation');
+    for(const x of this.#versions(name, tenantId)) if(x.state===POLICY_STATES.ACTIVE) x.state=POLICY_STATES.ARCHIVED;
+    target.state=POLICY_STATES.ACTIVE; target.activatedAt=new Date().toISOString(); this.#audit('activate',target); this.#save(); return clone(target);
+  }
+  rollback(name, version, tenantId = null) { return this.activate(name,version,tenantId); }
+  diff(name, a, b, tenantId = null) {
+    const left=this.get(name,a,tenantId)?.policy||{}, right=this.get(name,b,tenantId)?.policy||{}; const keys=new Set([...Object.keys(left),...Object.keys(right)]); const changes=[];
+    for(const key of [...keys].sort()) if(JSON.stringify(left[key])!==JSON.stringify(right[key])) changes.push({key,from:clone(left[key]),to:clone(right[key])});
+    return {name,from:Number(a),to:Number(b),tenantId:tenantId || null,changes};
+  }
+  auditLog(name, tenantId = null) { return this.audit.filter(x=>(!name||x.name===name) && (tenantId == null ? !x.tenantId : x.tenantId === tenantId)).map(clone); }
+  #audit(action,item,extra={}) { this.audit.unshift({id:`pa_${crypto.randomUUID()}`,at:new Date().toISOString(),action,name:item.name,tenantId:item.tenantId || null,version:item.version,state:item.state,hash:item.hash,...extra}); }
+}
+
+export function createPolicyRegistry(options={}) { return new PolicyRegistry(options); }

package/src/postgres-adapter.js

@@ -0,0 +1,76 @@
+export class PostgresStoreAdapter {
+  constructor(options = {}) {
+    this.client = options.client;
+    this.table = options.table || 'agentgate_records';
+    this.requireTenant = options.requireTenant !== false;
+    if (!this.client || typeof this.client.query !== 'function') throw new TypeError('PostgresStoreAdapter expects a client with query()');
+  }
+  async #withTenant(tenantId, fn) {
+    if (!this.requireTenant || !tenantId) return fn(this.client);
+    if (typeof this.client.connect === 'function') {
+      const conn = await this.client.connect();
+      try {
+        await conn.query('BEGIN');
+        await conn.query("select set_config('agentgate.tenant_id', $1, true)", [tenantId]);
+        const result = await fn(conn);
+        await conn.query('COMMIT');
+        return result;
+      } catch (error) {
+        try { await conn.query('ROLLBACK'); } catch {}
+        throw error;
+      } finally { conn.release?.(); }
+    }
+    // Minimal query-only clients (including test doubles) still receive explicit tenant predicates.
+    // Production pooled clients should expose connect() so RLS can be scoped with SET LOCAL.
+    return fn(this.client);
+  }
+  async add(record) {
+    const tenantId = record.tenantId || null;
+    if (this.requireTenant && !tenantId) throw new Error('tenantId is required for Postgres persistence');
+    return this.#withTenant(tenantId, async client => {
+      await client.query(`insert into ${this.table} (id, tenant_id, kind, data) values ($1,$2,$3,$4)`, [record.id, tenantId, record.kind || 'record', JSON.stringify(record)]);
+      return record;
+    });
+  }
+  async get(id, tenantId) {
+    if (this.requireTenant && !tenantId) throw new Error('tenantId is required for Postgres reads');
+    return this.#withTenant(tenantId, async client => {
+      const r = await client.query(`select data, version from ${this.table} where id=$1 and tenant_id=$2 limit 1`, [id, tenantId]);
+      return r.rows?.[0]?.data ? { ...r.rows[0].data, _storageVersion: r.rows[0].version } : null;
+    });
+  }
+  async list(tenantId, kind = null) {
+    if (this.requireTenant && !tenantId) throw new Error('tenantId is required for Postgres reads');
+    return this.#withTenant(tenantId, async client => {
+      const r = await client.query(`select data, version from ${this.table} where tenant_id=$1 and ($2::text is null or kind=$2) order by created_at desc`, [tenantId, kind]);
+      return (r.rows || []).map(x => ({ ...x.data, _storageVersion: x.version }));
+    });
+  }
+  async update(id, tenantId, patch = {}, expectedVersion = null) {
+    if (this.requireTenant && !tenantId) throw new Error('tenantId is required for Postgres updates');
+    return this.#withTenant(tenantId, async client => {
+      const r = await client.query(
+        `update ${this.table} set data = data || $3::jsonb, version = version + 1 where id=$1 and tenant_id=$2 and ($4::int is null or version=$4) returning data, version`,
+        [id, tenantId, JSON.stringify(patch), expectedVersion == null ? null : Number(expectedVersion)]
+      );
+      if (!r.rows?.[0]) throw new Error(expectedVersion == null ? 'Record not found' : 'Concurrent update detected');
+      return { ...r.rows[0].data, _storageVersion: r.rows[0].version };
+    });
+  }
+}
+
+export const POSTGRES_SCHEMA = `create table if not exists agentgate_records (id text primary key, tenant_id text not null, kind text not null, data jsonb not null, version integer not null default 1, created_at timestamptz not null default now());
+create index if not exists agentgate_records_tenant_kind_idx on agentgate_records (tenant_id, kind);
+alter table agentgate_records enable row level security;
+drop policy if exists agentgate_tenant_isolation on agentgate_records;
+create policy agentgate_tenant_isolation on agentgate_records using (tenant_id = current_setting('agentgate.tenant_id', true)) with check (tenant_id = current_setting('agentgate.tenant_id', true));`;
+
+export function createSupabaseAdapter(supabase, options = {}) {
+  if (!supabase || typeof supabase.from !== 'function') throw new TypeError('createSupabaseAdapter expects a Supabase client');
+  const table = options.table || 'agentgate_records';
+  return {
+    async add(record) { if (!record.tenantId) throw new Error('tenantId is required for Supabase persistence'); const { error } = await supabase.from(table).insert({ id: record.id, tenant_id: record.tenantId, kind: record.kind || 'record', data: record }); if (error) throw error; return record; },
+    async get(id, tenantId = null) { if (!tenantId) throw new Error('tenantId is required for Supabase reads'); let q = supabase.from(table).select('data,version').eq('id', id).eq('tenant_id', tenantId); const { data, error } = await q.maybeSingle(); if (error) throw error; return data?.data ? { ...data.data, _storageVersion: data.version } : null; },
+    async list(tenantId = null, kind = null) { if (!tenantId) throw new Error('tenantId is required for Supabase reads'); let q = supabase.from(table).select('data,version').order('created_at', { ascending: false }).eq('tenant_id', tenantId); if (kind) q = q.eq('kind', kind); const { data, error } = await q; if (error) throw error; return (data || []).map(x => x.data); }
+  };
+}

package/src/runtime.js

@@ -0,0 +1,138 @@
+import { evaluate } from './policy-engine.js';
+import { createPersistentRunStore, createPersistentApprovalStore } from './persistent-store.js';
+import { createApprovalStore, createApprovalRequest, APPROVAL_STATUS } from './approval.js';
+
+export class RunStore {
+  constructor(limit = 25000) { this.limit = limit; this.runs = []; }
+  add(event) { this.runs.unshift(event); if (this.runs.length > this.limit) this.runs.pop(); return event; }
+  list() { return [...this.runs]; }
+  get(id) { return this.runs.find(r => r.id === id); }
+}
+
+export function createRuntime(options = {}) {
+  const policies = options.policies || {};
+  const store = options.store || (options.persistence ? createPersistentRunStore({ filePath: options.persistence, limit: options.maxRuns || 25000 }) : new RunStore());
+  const approvalStore = options.approvalStore || (options.persistence ? createPersistentApprovalStore({ filePath: options.approvalPersistence || `${options.persistence}.approvals.json`, limit: options.maxApprovals || options.maxRuns || 25000 }) : createApprovalStore({ limit: options.maxApprovals || options.maxRuns || 25000 }));
+  const pending = new Map();
+  const mode = options.mode || 'enforce'; // observe | enforce
+
+  async function check(request = {}) {
+    const result = evaluate(request, policies);
+    const event = {
+      id: `run_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+      createdAt: new Date().toISOString(),
+      mode,
+      request: structuredCloneSafe(request),
+      decision: result.decision,
+      risk: result.risk,
+      reason: result.reason,
+      winningRule: result.winningRule || null,
+      ruleTrace: result.ruleTrace || [],
+      simulated: mode === 'observe' && result.decision !== 'ALLOW'
+    };
+    store.add(event);
+    return event;
+  }
+
+  async function execute(tool, request = {}) {
+    const event = await check(request);
+    if (mode === 'enforce' && event.decision !== 'ALLOW') {
+      if (event.decision === 'ASK') {
+        const approval = createApprovalRequest({
+          runId: event.id,
+          tenantId: request.tenantId,
+          request,
+          decision: event.decision,
+          risk: event.risk,
+          reason: event.reason,
+          metadata: { action: request.action || request.tool || null }
+        }, approvalStore);
+        event.status = 'pending_approval';
+        event.approvalId = approval.id;
+        pending.set(approval.id, { tool, request: structuredCloneSafe(request), event });
+        approvalStore.save?.();
+        store.save?.();
+        return { status: 'approval_required', approvalId: approval.id, agentgate: event };
+      }
+      const error = new Error(`AgentGate blocked action: ${event.reason}`);
+      error.code = 'AGENTGATE_BLOCKED'; error.agentgate = event; throw error;
+    }
+    const value = await tool(request);
+    event.status = 'executed';
+    event.executed = true;
+    event.valuePreview = preview(value);
+    store.save?.();
+    return { status: 'executed', value, agentgate: event };
+  }
+
+  function approvals(status) { return approvalStore.list(status); }
+  function getApproval(id) { return approvalStore.get(id); }
+
+  async function approve(approvalId) {
+    const approval = approvalStore.get(approvalId);
+    if (!approval) return { ok: false, error: 'Approval not found' };
+    if (approval.status !== APPROVAL_STATUS.PENDING) return { ok: false, error: `Approval is already ${approval.status}`, approval };
+    const item = pending.get(approvalId);
+    if (!item) return { ok: false, error: 'Pending approval execution is no longer available', approval };
+    approval.status = APPROVAL_STATUS.APPROVED;
+    approval.resolvedAt = new Date().toISOString();
+    const { tool, request, event } = item;
+    try {
+      const value = await tool(request);
+      event.status = 'executed';
+      event.executed = true;
+      event.approval = { status: approval.status, resolvedAt: approval.resolvedAt, approver: 'explicit' };
+      event.valuePreview = preview(value);
+      approvalStore.save?.();
+      store.save?.();
+      pending.delete(approvalId);
+      return { ok: true, status: 'executed', value, approval, agentgate: event };
+    } catch (error) {
+      event.status = 'execution_error';
+      event.executed = true;
+      event.error = error?.message || String(error);
+      approvalStore.save?.();
+      store.save?.();
+      pending.delete(approvalId);
+      return { ok: true, status: 'execution_error', error: event.error, approval, agentgate: event };
+    }
+  }
+
+  function deny(approvalId, reason = 'Denied by approver') {
+    const approval = approvalStore.get(approvalId);
+    if (!approval) return { ok: false, error: 'Approval not found' };
+    if (approval.status !== APPROVAL_STATUS.PENDING) return { ok: false, error: `Approval is already ${approval.status}`, approval };
+    const item = pending.get(approvalId);
+    approval.status = APPROVAL_STATUS.DENIED;
+    approval.resolvedAt = new Date().toISOString();
+    approval.resolutionReason = reason;
+    if (item) {
+      item.event.status = 'denied';
+      item.event.approval = { status: approval.status, resolvedAt: approval.resolvedAt, reason };
+    }
+    pending.delete(approvalId);
+    approvalStore.save?.();
+    store.save?.();
+    return { ok: true, status: 'denied', approval, agentgate: item?.event || null };
+  }
+
+  return {
+    check,
+    execute,
+    approve,
+    deny,
+    approvals,
+    getApproval,
+    runs: () => store.list(),
+    replay: id => store.get(id),
+    mode,
+    policies
+  };
+}
+
+function preview(value) {
+  try { return JSON.stringify(value).slice(0, 500); } catch { return '[unserializable]'; }
+}
+function structuredCloneSafe(value) {
+  try { return structuredClone(value); } catch { return JSON.parse(JSON.stringify(value)); }
+}

package/src/saas.js

@@ -0,0 +1,67 @@
+import crypto from 'node:crypto';
+import { PersistentCollectionStore } from './persistent-store.js';
+
+export const PLANS = Object.freeze({
+  free: Object.freeze({ name:'free', tenants:1, members:2, agents:3, runsPerMonth:1000, apiKeys:3, webhooks:2 }),
+  pro: Object.freeze({ name:'pro', tenants:10, members:10, agents:50, runsPerMonth:100000, apiKeys:25, webhooks:25 }),
+  enterprise: Object.freeze({ name:'enterprise', tenants:1000, members:1000, agents:10000, runsPerMonth:10000000, apiKeys:5000, webhooks:1000 })
+});
+
+const ROLES = new Set(['owner','admin','developer','viewer','billing']);
+const id = prefix => `${prefix}_${crypto.randomBytes(8).toString('hex')}`;
+const now = () => new Date().toISOString();
+
+export class OrganizationRegistry {
+  constructor(options={}) {
+    const base = options.persistence || '.agentgate';
+    this.orgs = options.orgStore || new PersistentCollectionStore(options.filePath || `${base}/organizations.json`, {limit: options.limit||10000});
+    this.members = options.memberStore || new PersistentCollectionStore(options.memberPath || `${base}/organization-members.json`, {limit: options.memberLimit||50000});
+    this.tenants = options.tenantStore || new PersistentCollectionStore(options.tenantPath || `${base}/organization-tenants.json`, {limit: options.tenantLimit||10000});
+  }
+  create(name, owner={}) {
+    const org={id:id('org'),name:String(name||'').trim(),plan:'free',status:'active',createdAt:now(),metadata:owner.metadata||{}};
+    if(!org.name) throw new Error('Organization name is required');
+    this.orgs.add(org);
+    this.addMember(org.id, owner.userId || owner.email || 'owner', 'owner', owner);
+    return org;
+  }
+  get(orgId){ return this.orgs.get(orgId); }
+  list(){ return this.orgs.list(); }
+  setPlan(orgId, plan){ if(!PLANS[plan]) throw new Error('Unknown plan'); const o=this.get(orgId); if(!o) throw new Error('Organization not found'); o.plan=plan; o.updatedAt=now(); this.orgs.save(); return o; }
+  addMember(orgId,userId,role='developer',metadata={}) { if(!this.get(orgId)) throw new Error('Organization not found'); if(!ROLES.has(role)) throw new Error('Invalid member role'); const existing=this.members.list(m=>m.orgId===orgId&&m.userId===String(userId))[0]; if(existing){existing.role=role; existing.updatedAt=now(); this.members.save(); return existing;} const m={id:id('mem'),orgId,userId:String(userId),role,metadata,createdAt:now()}; return this.members.add(m); }
+  removeMember(orgId,userId){ const m=this.members.list(x=>x.orgId===orgId&&x.userId===String(userId))[0]; if(!m) return null; this.members.remove?.(m.id); if(!this.members.remove){m.revokedAt=now(); this.members.save();} return m; }
+  membersFor(orgId){ return this.members.list(m=>m.orgId===orgId); }
+  authorize(orgId,userId,action){ const m=this.membersFor(orgId).find(x=>x.userId===String(userId)); if(!m) return {allowed:false,reason:'Member not found'}; if(action==='billing' && !['owner','billing'].includes(m.role)) return {allowed:false,reason:'Billing permission required'}; if(['admin','members:write'].includes(action) && !['owner','admin'].includes(m.role)) return {allowed:false,reason:'Admin permission required'}; return {allowed:true,role:m.role}; }
+  linkTenant(orgId,tenantId){ if(!this.get(orgId)) throw new Error('Organization not found'); if(this.tenants.list(x=>x.orgId===orgId&&x.tenantId===tenantId)[0]) return this.tenants.list(x=>x.orgId===orgId&&x.tenantId===tenantId)[0]; const t={id:id('ot'),orgId,tenantId,createdAt:now()}; return this.tenants.add(t); }
+  tenantsFor(orgId){ return this.tenants.list(x=>x.orgId===orgId); }
+}
+
+export class UsageMeter {
+  constructor(options={}) { this.store=options.store||new PersistentCollectionStore(options.filePath||'.agentgate/usage.json',{limit:options.limit||100000}); }
+  period(date=new Date()){ return date.toISOString().slice(0,7); }
+  get(orgId,metric='runs',period=this.period()){ return this.store.list(x=>x.orgId===orgId&&x.metric===metric&&x.period===period)[0] || {orgId,metric,period,quantity:0}; }
+  increment(orgId,metric='runs',quantity=1,period=this.period()){ const n=Number(quantity); if(!Number.isFinite(n)||n<0) throw new Error('Quantity must be a non-negative number'); let row=this.get(orgId,metric,period); if(!row.id){ row={...row,id:id('usage'),quantity:0,updatedAt:now()}; this.store.add(row); } row.quantity += n; row.updatedAt=now(); this.store.save(); return row; }
+  snapshot(orgId,period=this.period()){ return this.store.list(x=>x.orgId===orgId&&x.period===period); }
+}
+
+export class EntitlementService {
+  constructor({organizations,usage}={}) { this.organizations=organizations||new OrganizationRegistry(); this.usageMeter=usage||new UsageMeter(); }
+  plan(orgId){ const o=this.organizations.get(orgId); if(!o) throw new Error('Organization not found'); return PLANS[o.plan]||PLANS.free; }
+  usage(orgId,metric='runs'){ return this.usageMeter.get(orgId,metric); }
+  check(orgId,metric='runs',additional=1){ const p=this.plan(orgId), u=this.usage(orgId,metric).quantity||0; const limit=p[`${metric}PerMonth`] ?? p[metric]; return {allowed: limit===undefined || u+additional<=limit,metric,used:u,requested:additional,limit,plan:p.name}; }
+  consume(orgId,metric='runs',quantity=1){ const check=this.check(orgId,metric,quantity); if(!check.allowed){ const e=new Error(`Plan limit exceeded for ${metric}`); e.code='AGENTGATE_QUOTA_EXCEEDED'; e.entitlement=check; throw e; } return this.usageMeter.increment(orgId,metric,quantity); }
+}
+
+export class BillingAdapter {
+  constructor(options={}) { this.provider=options.provider||'none'; this.checkout=options.checkout|| (async ({orgId,plan})=>({provider:this.provider,orgId,plan,status:'not_configured'})); this.portal=options.portal|| (async ({orgId})=>({provider:this.provider,orgId,status:'not_configured'})); }
+  async createCheckout(input){ return this.checkout(input); }
+  async customerPortal(input){ return this.portal(input); }
+}
+
+export function createSaaSControl(options={}) {
+  const organizations=options.organizations||new OrganizationRegistry(options);
+  const usage=options.usage||new UsageMeter(options);
+  const entitlements=options.entitlements||new EntitlementService({organizations,usage});
+  const billing=options.billing||new BillingAdapter(options);
+  return {organizations,usage,entitlements,billing};
+}

package/src/security-report.js

@@ -0,0 +1,42 @@
+import { summarizeAttackResults } from './attack-lab.js';
+import { analyzeBehavior, analyzeBlastRadius } from './behavior.js';
+
+function safe(value) { return String(value ?? '').replace(/[&<>"']/g, ch => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[ch])); }
+
+export function generateSecurityReport({ attackResults = [], runs = [], policies = {}, metadata = {}, behavior, blastRadius } = {}) {
+  const summary = summarizeAttackResults(attackResults);
+  const findings = attackResults
+    .filter(item => !item.passed)
+    .map(item => ({ id: item.id, name: item.name, decision: item.decision, risk: Number(item.risk || 0), runId: item.runId || null }));
+  const topRisks = [...attackResults].sort((a,b) => Number(b.risk||0) - Number(a.risk||0)).slice(0,5).map(item => ({
+    id:item.id, name:item.name, risk:Number(item.risk||0), decision:item.decision, passed:Boolean(item.passed), runId:item.runId||null
+  }));
+  const behaviorAnalysis = behavior || analyzeBehavior(runs);
+  const blastRadiusAnalysis = blastRadius || analyzeBlastRadius(runs);
+  const generatedAt = new Date().toISOString();
+  return {
+    schemaVersion: '1.0',
+    product: 'AgentGate',
+    reportType: 'security-assessment',
+    generatedAt,
+    metadata: { environment: metadata.environment || 'production', agent: metadata.agent || 'unknown', ...metadata },
+    summary: { ...summary, findingCount: findings.length, runCount: runs.length },
+    findings,
+    topRisks,
+    policies,
+    behavior: behaviorAnalysis,
+    blastRadius: blastRadiusAnalysis,
+    attacks: attackResults.map(({ response, ...item }) => ({ ...item })),
+    runs: runs.map(run => ({ id: run.id, createdAt: run.createdAt, decision: run.decision, risk: run.risk, reason: run.reason, request: run.request }))
+  };
+}
+
+export function renderSecurityReportHTML(report) {
+  const s = report.summary;
+  const rows = report.attacks.map(item => `<tr><td>${safe(item.name)}</td><td>${safe(item.decision)}</td><td>${safe(item.risk)}</td><td>${item.passed ? 'PASS' : 'FINDING'}</td></tr>`).join('');
+  const status = safe(s.status);
+  const behavior = report.behavior || { status:'NORMAL', findingCount:0, maxRisk:0, findings:[] };
+  const blast = report.blastRadius || { status:'LOW', maxScore:0, assessments:[] };
+  const behaviorRows = behavior.findings.map(item => `<tr><td>${safe(item.title)}</td><td>${safe(item.severity)}</td><td>${safe(item.risk)}</td><td><code>${safe(item.action)}</code></td></tr>`).join('');
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>AgentGate Security Report</title><style>body{margin:0;background:#08080d;color:#eee;font:15px system-ui,sans-serif}main{max-width:1000px;margin:auto;padding:40px}.hero,.card{background:#11111a;border:1px solid #29283a;border-radius:18px;padding:24px;margin-bottom:18px}.brand{color:#a78bfa;font-weight:800;letter-spacing:.08em}.status{font-size:28px;font-weight:800;margin:12px 0}.grid{display:grid;grid-template-columns:repeat(4,1fr);gap:12px}.metric{background:#0b0b12;border-radius:12px;padding:16px}.metric b{display:block;font-size:24px}.muted{color:#9292a4}table{width:100%;border-collapse:collapse}th,td{text-align:left;padding:12px;border-bottom:1px solid #262533}th{color:#aaa}code{color:#c4b5fd}.pill{display:inline-block;padding:6px 10px;border:1px solid #343246;border-radius:999px;margin-right:8px}@media(max-width:700px){main{padding:18px}.grid{grid-template-columns:repeat(2,1fr)}}</style></head><body><main><section class="hero"><div class="brand">AGENTGATE / SECURITY REPORT</div><div class="status">${status}</div><div class="muted">${safe(report.metadata.agent)} · ${safe(report.metadata.environment)} · ${safe(report.generatedAt)}</div></section><section class="card"><div class="grid"><div class="metric"><span class="muted">Attacks</span><b>${s.total}</b></div><div class="metric"><span class="muted">Passed</span><b>${s.passed}</b></div><div class="metric"><span class="muted">Findings</span><b>${s.failed}</b></div><div class="metric"><span class="muted">Avg risk</span><b>${s.averageRisk}</b></div></div></section><section class="card"><h2>Behavior analysis</h2><p><span class="pill">Status: ${safe(behavior.status)}</span><span class="pill">Findings: ${behavior.findingCount}</span><span class="pill">Max risk: ${behavior.maxRisk}</span></p><table><thead><tr><th>Finding</th><th>Severity</th><th>Risk</th><th>Action</th></tr></thead><tbody>${behaviorRows || '<tr><td colspan="4">No behavior findings</td></tr>'}</tbody></table></section><section class="card"><h2>Blast radius</h2><p><span class="pill">Status: ${safe(blast.status)}</span><span class="pill">Max score: ${blast.maxScore}</span><span class="pill">Runs: ${blast.runCount}</span></p><p class="muted">Deterministic estimate based on request metadata, not a guarantee of actual impact.</p></section><section class="card"><h2>Attack assessment</h2><table><thead><tr><th>Test</th><th>Decision</th><th>Risk</th><th>Result</th></tr></thead><tbody>${rows || '<tr><td colspan="4">No attack results</td></tr>'}</tbody></table></section><section class="card"><h2>Policies</h2><pre><code>${safe(JSON.stringify(report.policies,null,2))}</code></pre></section></main></body></html>`;
+}

package/src/security-validation.js

@@ -0,0 +1,92 @@
+import { createMCPGateway } from './mcp-gateway.js';
+import { runGatewayAttackLab } from './attack-lab.js';
+import { inspectEgress } from './egress-guard.js';
+import { evaluate } from './policy-engine.js';
+import { createControlPlane } from './control-plane.js';
+import { TenantRegistry } from './multi-tenant.js';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+function result(name, ok, details = {}) { return { name, ok: Boolean(ok), details }; }
+
+async function httpJson(url, options = {}) {
+  const response = await fetch(url, options);
+  let body = null;
+  try { body = await response.json(); } catch { body = null; }
+  return { status: response.status, body };
+}
+
+export async function runSecurityValidation(options = {}) {
+  const counters = { read: 0, refund: 0, delete: 0, export_all: 0 };
+  const gateway = options.gateway || createMCPGateway({
+    mode: 'enforce',
+    maxRuns: Number(options.maxRuns || 2000),
+    policies: { productionBlock: true, approvalActions: ['refund'], approvalAmount: 5000, blockActions: ['export_all'] },
+    tools: [
+      { name: 'read', handler: async () => { counters.read++; return { ok: true }; } },
+      { name: 'refund', handler: async args => { counters.refund++; return { refunded: args.amount }; } },
+      { name: 'delete', handler: async () => { counters.delete++; return { deleted: true }; } },
+      { name: 'export_all', handler: async () => { counters.export_all++; return { secret: 'SHOULD_NOT_RUN' }; } },
+      { name: 'update_production', handler: async () => ({ changed: true }) },
+      { name: 'publish', handler: async () => ({ published: true }) }
+    ]
+  });
+  const checks = [];
+  const attacks = await runGatewayAttackLab(gateway);
+  checks.push(result('attack-lab', attacks.every(x => x.passed), { total: attacks.length, passed: attacks.filter(x => x.passed).length }));
+
+  const beforeDelete = counters.delete;
+  const blocked = await gateway.handle({ jsonrpc:'2.0', id:'validation-block', method:'tools/call', params:{ name:'delete', action:'delete', environment:'production', arguments:{ id:'x' }, agent:'validator', tenantId:'tenant_a' }});
+  checks.push(result('pre-execution-block', blocked?.result?._agentgate?.decision?.decision === 'BLOCK' && counters.delete === beforeDelete, { decision: blocked?.result?._agentgate?.decision?.decision, handlerExecuted: counters.delete !== beforeDelete }));
+
+  const beforeRefund = counters.refund;
+  const ask = await gateway.handle({ jsonrpc:'2.0', id:'validation-ask', method:'tools/call', params:{ name:'refund', action:'refund', environment:'development', arguments:{ amount:1200 }, agent:'validator', tenantId:'tenant_a' }});
+  const approvalId = ask.result?._agentgate?.approvalId;
+  checks.push(result('approval-boundary', ask?.result?._agentgate?.decision?.decision === 'ASK' && counters.refund === beforeRefund && Boolean(approvalId), { decision: ask?.result?._agentgate?.decision?.decision, executed: counters.refund !== beforeRefund, approvalId }));
+
+  const secret = inspectEgress(JSON.stringify({ token:'Bearer abcdefghijklmnopqrstuvwxyz123456', email:'x@example.com' }));
+  checks.push(result('egress-detection', Array.isArray(secret?.findings) && secret.findings.length > 0, { findings: secret?.findings?.length || 0 }));
+
+  const malformed = [null, {}, { action:null }, { action:'refund', amount:'not-a-number' }, { action:'delete', environment:123 }];
+  const malformedResults = malformed.map(input => { try { const x = evaluate(input || {}, { productionBlock:true }); return ['ALLOW','ASK','BLOCK'].includes(x.decision); } catch { return false; } });
+  checks.push(result('malformed-input-resilience', malformedResults.every(Boolean), { cases: malformedResults.length, passed: malformedResults.filter(Boolean).length }));
+
+  const tenantA = gateway.runs('tenant_a');
+  const tenantB = gateway.runs('tenant_b');
+  checks.push(result('tenant-run-scope', tenantA.every(x => x.tenantId === 'tenant_a') && tenantB.every(x => x.tenantId === 'tenant_b'), { tenantA: tenantA.length, tenantB: tenantB.length }));
+
+  const retention = gateway.retention?.() || {};
+  checks.push(result('replay-retention-status', retention.limit >= 1000 && retention.count >= 1 && typeof retention.nearLimit === 'boolean', retention));
+
+  // Exercise the actual HTTP control plane with two scoped tenant keys.
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'agentgate-validation-'));
+  const registry = new TenantRegistry({ filePath: path.join(tempRoot, 'tenants.json'), keyPath: path.join(tempRoot, 'keys.json') });
+  const tenantOne = registry.create('Validation A');
+  const tenantTwo = registry.create('Validation B');
+  const keyA = registry.issueKey(tenantOne.id, { scopes: ['runs:read'] }).secret;
+  const keyB = registry.issueKey(tenantTwo.id, { scopes: ['runs:read'] }).secret;
+  await gateway.handle({ jsonrpc:'2.0', id:'tenant-a-seed', method:'tools/call', params:{ name:'read', action:'read', environment:'development', arguments:{ seed:'A' }, tenantId:tenantOne.id }});
+  await gateway.handle({ jsonrpc:'2.0', id:'tenant-b-seed', method:'tools/call', params:{ name:'read', action:'read', environment:'development', arguments:{ seed:'B' }, tenantId:tenantTwo.id }});
+  const control = createControlPlane({ gateway, tenantRegistry: registry, authRequired: true, rateLimit: 100000, tenantRateLimit: 100000 });
+  await new Promise((resolve, reject) => { control.server.listen(0, '127.0.0.1', resolve).on('error', reject); });
+  const address = control.server.address();
+  const base = `http://127.0.0.1:${address.port}`;
+  try {
+    const own = await httpJson(`${base}/api/runs`, { headers: { 'x-agentgate-key': keyA } });
+    const crossQuery = await httpJson(`${base}/api/runs?tenantId=${encodeURIComponent(tenantTwo.id)}`, { headers: { 'x-agentgate-key': keyA } });
+    const ownB = await httpJson(`${base}/api/runs`, { headers: { authorization: `Bearer ${keyB}` } });
+    checks.push(result('tenant-cross-tenant-http', own.status === 200 && Array.isArray(own.body?.runs) && own.body.runs.every(r => r.tenantId === tenantOne.id) && crossQuery.status === 403 && ownB.status === 200 && Array.isArray(ownB.body?.runs) && ownB.body.runs.every(r => r.tenantId === tenantTwo.id), {
+      tenantAStatus: own.status,
+      tenantAVisibleTenants: [...new Set((own.body?.runs || []).map(r => r.tenantId))],
+      crossTenantStatus: crossQuery.status,
+      tenantBStatus: ownB.status,
+      tenantBVisibleTenants: [...new Set((ownB.body?.runs || []).map(r => r.tenantId))]
+    }));
+  } finally {
+    await new Promise(resolve => control.server.close(resolve));
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+
+  return { ok: checks.every(x => x.ok), checks, attacks, counters, generatedAt: new Date().toISOString() };
+}