meshguard 0.1.0

package/dist/cjs/client.js

@@ -0,0 +1,314 @@
+"use strict";
+/**
+ * MeshGuard Client
+ *
+ * Core client for interacting with the MeshGuard gateway.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MeshGuardClient = void 0;
+const exceptions_js_1 = require("./exceptions.js");
+/**
+ * Client for the MeshGuard governance gateway.
+ *
+ * @example
+ * ```ts
+ * const client = new MeshGuardClient({
+ *   gatewayUrl: "https://dashboard.meshguard.app",
+ *   agentToken: "your-agent-token",
+ * });
+ *
+ * // Check if an action is allowed
+ * const decision = await client.check("read:contacts");
+ * if (decision.allowed) {
+ *   // proceed
+ * }
+ *
+ * // Or enforce (throws on deny)
+ * await client.enforce("read:contacts");
+ *
+ * // Or govern a function
+ * const result = await client.govern("read:contacts", async () => {
+ *   return fetchContacts();
+ * });
+ * ```
+ */
+class MeshGuardClient {
+    gatewayUrl;
+    agentToken;
+    adminToken;
+    timeout;
+    traceId;
+    constructor(options = {}) {
+        this.gatewayUrl = (options.gatewayUrl ??
+            process.env.MESHGUARD_GATEWAY_URL ??
+            "http://localhost:3100").replace(/\/+$/, "");
+        this.agentToken =
+            options.agentToken ?? process.env.MESHGUARD_AGENT_TOKEN;
+        this.adminToken =
+            options.adminToken ?? process.env.MESHGUARD_ADMIN_TOKEN;
+        this.timeout = options.timeout ?? 30_000;
+        this.traceId = options.traceId ?? crypto.randomUUID();
+    }
+    // ---------------------------------------------------------------------------
+    // Internal helpers
+    // ---------------------------------------------------------------------------
+    headers(includeAuth = true) {
+        const h = {
+            "X-MeshGuard-Trace-ID": this.traceId,
+        };
+        if (includeAuth && this.agentToken) {
+            h["Authorization"] = `Bearer ${this.agentToken}`;
+        }
+        return h;
+    }
+    adminHeaders() {
+        if (!this.adminToken) {
+            throw new exceptions_js_1.AuthenticationError("Admin token required for this operation");
+        }
+        return {
+            "X-Admin-Token": this.adminToken,
+            "X-MeshGuard-Trace-ID": this.traceId,
+        };
+    }
+    async handleResponse(response) {
+        if (response.status === 401) {
+            throw new exceptions_js_1.AuthenticationError("Invalid or expired token");
+        }
+        if (response.status === 403) {
+            const data = await this.safeJson(response);
+            throw new exceptions_js_1.PolicyDeniedError({
+                action: data.action ?? "unknown",
+                policy: data.policy,
+                rule: data.rule,
+                reason: data.message ?? "Access denied by policy",
+            });
+        }
+        if (response.status === 429) {
+            throw new exceptions_js_1.RateLimitError("Rate limit exceeded");
+        }
+        if (response.status >= 400) {
+            const text = await response.text();
+            throw new exceptions_js_1.MeshGuardError(`Request failed: ${response.status} ${text}`);
+        }
+        return this.safeJson(response);
+    }
+    async safeJson(response) {
+        const text = await response.text();
+        if (!text)
+            return {};
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return {};
+        }
+    }
+    async fetch(url, init = {}) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        try {
+            return await fetch(url, { ...init, signal: controller.signal });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Core Governance
+    // ---------------------------------------------------------------------------
+    /**
+     * Check if an action is allowed by policy.
+     *
+     * Returns a {@link PolicyDecision} — never throws on deny.
+     */
+    async check(action, resource) {
+        const h = this.headers();
+        h["X-MeshGuard-Action"] = action;
+        if (resource)
+            h["X-MeshGuard-Resource"] = resource;
+        try {
+            const response = await this.fetch(`${this.gatewayUrl}/proxy/check`, {
+                method: "GET",
+                headers: h,
+            });
+            if (response.status === 403) {
+                const data = await this.safeJson(response);
+                return {
+                    allowed: false,
+                    action,
+                    decision: "deny",
+                    policy: data.policy,
+                    rule: data.rule,
+                    reason: data.message,
+                    traceId: this.traceId,
+                };
+            }
+            const data = await this.handleResponse(response);
+            return {
+                allowed: true,
+                action,
+                decision: "allow",
+                policy: data.policy,
+                traceId: this.traceId,
+            };
+        }
+        catch (err) {
+            if (err instanceof exceptions_js_1.PolicyDeniedError) {
+                return {
+                    allowed: false,
+                    action,
+                    decision: "deny",
+                    policy: err.policy,
+                    rule: err.rule,
+                    reason: err.reason,
+                    traceId: this.traceId,
+                };
+            }
+            throw err;
+        }
+    }
+    /**
+     * Enforce policy — throws {@link PolicyDeniedError} if the action is denied.
+     */
+    async enforce(action, resource) {
+        const decision = await this.check(action, resource);
+        if (!decision.allowed) {
+            throw new exceptions_js_1.PolicyDeniedError({
+                action,
+                policy: decision.policy,
+                rule: decision.rule,
+                reason: decision.reason,
+            });
+        }
+        return decision;
+    }
+    /**
+     * Execute a function only if the action is allowed by policy.
+     *
+     * @example
+     * ```ts
+     * const contacts = await client.govern("read:contacts", async () => {
+     *   return db.contacts.findAll();
+     * });
+     * ```
+     */
+    async govern(action, fn, resource) {
+        await this.enforce(action, resource);
+        return fn();
+    }
+    // ---------------------------------------------------------------------------
+    // Proxy Requests
+    // ---------------------------------------------------------------------------
+    /**
+     * Make a governed request through the MeshGuard proxy.
+     */
+    async request(method, path, action, init = {}) {
+        const h = {
+            ...this.headers(),
+            "X-MeshGuard-Action": action,
+        };
+        // Merge any caller-provided headers
+        if (init.headers) {
+            const extra = init.headers instanceof Headers
+                ? Object.fromEntries(init.headers.entries())
+                : init.headers;
+            Object.assign(h, extra);
+        }
+        const response = await this.fetch(`${this.gatewayUrl}/proxy/${path.replace(/^\/+/, "")}`, { ...init, method, headers: h });
+        await this.handleResponse(response);
+        return response;
+    }
+    /** GET through the governance proxy. */
+    async get(path, action, init) {
+        return this.request("GET", path, action, init);
+    }
+    /** POST through the governance proxy. */
+    async post(path, action, init) {
+        return this.request("POST", path, action, init);
+    }
+    /** PUT through the governance proxy. */
+    async put(path, action, init) {
+        return this.request("PUT", path, action, init);
+    }
+    /** DELETE through the governance proxy. */
+    async delete(path, action, init) {
+        return this.request("DELETE", path, action, init);
+    }
+    // ---------------------------------------------------------------------------
+    // Health & Info
+    // ---------------------------------------------------------------------------
+    /** Check gateway health. */
+    async health() {
+        const response = await this.fetch(`${this.gatewayUrl}/health`);
+        return (await response.json());
+    }
+    /** Quick boolean health check. */
+    async isHealthy() {
+        try {
+            const h = await this.health();
+            return h.status === "healthy";
+        }
+        catch {
+            return false;
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Admin Operations
+    // ---------------------------------------------------------------------------
+    /** List all agents (requires admin token). */
+    async listAgents() {
+        const response = await this.fetch(`${this.gatewayUrl}/admin/agents`, {
+            headers: this.adminHeaders(),
+        });
+        const data = await this.handleResponse(response);
+        const agents = data.agents ?? [];
+        return agents.map((a) => ({
+            id: a.id,
+            name: a.name,
+            trustTier: a.trustTier,
+            tags: a.tags ?? [],
+            orgId: a.orgId,
+        }));
+    }
+    /** Create a new agent (requires admin token). */
+    async createAgent(options) {
+        const response = await this.fetch(`${this.gatewayUrl}/admin/agents`, {
+            method: "POST",
+            headers: {
+                ...this.adminHeaders(),
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                name: options.name,
+                trustTier: options.trustTier ?? "verified",
+                tags: options.tags ?? [],
+            }),
+        });
+        return this.handleResponse(response);
+    }
+    /** Revoke an agent (requires admin token). */
+    async revokeAgent(agentId) {
+        const response = await this.fetch(`${this.gatewayUrl}/admin/agents/${agentId}`, { method: "DELETE", headers: this.adminHeaders() });
+        await this.handleResponse(response);
+    }
+    /** List all policies (requires admin token). */
+    async listPolicies() {
+        const response = await this.fetch(`${this.gatewayUrl}/admin/policies`, {
+            headers: this.adminHeaders(),
+        });
+        const data = await this.handleResponse(response);
+        return data.policies ?? [];
+    }
+    /** Get audit log entries (requires admin token). */
+    async getAuditLog(options = {}) {
+        const params = new URLSearchParams();
+        params.set("limit", String(options.limit ?? 50));
+        if (options.decision)
+            params.set("decision", options.decision);
+        const response = await this.fetch(`${this.gatewayUrl}/admin/audit?${params}`, { headers: this.adminHeaders() });
+        const data = await this.handleResponse(response);
+        return data.entries ?? [];
+    }
+}
+exports.MeshGuardClient = MeshGuardClient;
+//# sourceMappingURL=client.js.map

package/dist/cjs/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,mDAKyB;AAEzB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAa,eAAe;IACjB,UAAU,CAAS;IACnB,UAAU,CAAU;IACpB,UAAU,CAAU;IACpB,OAAO,CAAS;IAChB,OAAO,CAAS;IAEzB,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,UAAU,GAAG,CAChB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB;YACjC,uBAAuB,CACxB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEtB,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IACxD,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAEtE,OAAO,CAAC,WAAW,GAAG,IAAI;QAChC,MAAM,CAAC,GAA2B;YAChC,sBAAsB,EAAE,IAAI,CAAC,OAAO;SACrC,CAAC;QACF,IAAI,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,mCAAmB,CAAC,yCAAyC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,UAAU;YAChC,sBAAsB,EAAE,IAAI,CAAC,OAAO;SACrC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAkB;QAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,mCAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,IAAI,iCAAiB,CAAC;gBAC1B,MAAM,EAAG,IAAI,CAAC,MAAiB,IAAI,SAAS;gBAC5C,MAAM,EAAE,IAAI,CAAC,MAA4B;gBACzC,IAAI,EAAE,IAAI,CAAC,IAA0B;gBACrC,MAAM,EAAG,IAAI,CAAC,OAAkB,IAAI,yBAAyB;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAAc,CAAC,qBAAqB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,8BAAc,CAAC,mBAAmB,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,QAAkB;QACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,GAAW,EACX,OAAoB,EAAE;QAEtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,QAAiB;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC;QACjC,IAAI,QAAQ;YAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC;QAEnD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,cAAc,EAAE;gBAClE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,CAAC;aACX,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,IAAI,CAAC,MAA4B;oBACzC,IAAI,EAAE,IAAI,CAAC,IAA0B;oBACrC,MAAM,EAAE,IAAI,CAAC,OAA6B;oBAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM;gBACN,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,IAAI,CAAC,MAA4B;gBACzC,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iCAAiB,EAAE,CAAC;gBACrC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,QAAiB;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,iCAAiB,CAAC;gBAC1B,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CACV,MAAc,EACd,EAAwB,EACxB,QAAiB;QAEjB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,iBAAiB;IACjB,8EAA8E;IAE9E;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,MAAc,EACd,OAAoB,EAAE;QAEtB,MAAM,CAAC,GAA2B;YAChC,GAAG,IAAI,CAAC,OAAO,EAAE;YACjB,oBAAoB,EAAE,MAAM;SAC7B,CAAC;QAEF,oCAAoC;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,YAAY,OAAO;gBAC7B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC5C,CAAC,CAAE,IAAI,CAAC,OAAkC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,GAAG,IAAI,CAAC,UAAU,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EACtD,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAChC,CAAC;QAEF,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,IAAkB;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,MAAc,EAAE,IAAkB;QACzD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,IAAkB;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,MAAc,EAAE,IAAkB;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,gBAAgB;IAChB,8EAA8E;IAE9E,4BAA4B;IAC5B,KAAK,CAAC,MAAM;QACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,SAAS,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;IACjD,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,8CAA8C;IAC9C,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,eAAe,EAAE;YACnE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,MAAM,GAAI,IAAI,CAAC,MAAyC,IAAI,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,CAAC,CAAC,EAAY;YAClB,IAAI,EAAE,CAAC,CAAC,IAAc;YACtB,SAAS,EAAE,CAAC,CAAC,SAAmB;YAChC,IAAI,EAAG,CAAC,CAAC,IAAiB,IAAI,EAAE;YAChC,KAAK,EAAE,CAAC,CAAC,KAA2B;SACrC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,OAA2B;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,eAAe,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,YAAY,EAAE;gBACtB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,UAAU;gBAC1C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;aACzB,CAAC;SACH,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,GAAG,IAAI,CAAC,UAAU,iBAAiB,OAAO,EAAE,EAC5C,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CACnD,CAAC;QACF,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,iBAAiB,EAAE;YACrE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAQ,IAAI,CAAC,QAAqB,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,WAAW,CAAC,UAA2B,EAAE;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,GAAG,IAAI,CAAC,UAAU,gBAAgB,MAAM,EAAE,EAC1C,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CACjC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAQ,IAAI,CAAC,OAAwB,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF;AAxUD,0CAwUC"}

package/dist/cjs/exceptions.d.ts

@@ -0,0 +1,33 @@
+/**
+ * MeshGuard Exceptions
+ */
+/** Base error for all MeshGuard errors. */
+export declare class MeshGuardError extends Error {
+    constructor(message: string);
+}
+/** Raised when authentication fails (401). */
+export declare class AuthenticationError extends MeshGuardError {
+    constructor(message?: string);
+}
+/** Raised when an action is denied by policy (403). */
+export declare class PolicyDeniedError extends MeshGuardError {
+    /** The action that was denied. */
+    readonly action: string;
+    /** The policy that denied the action. */
+    readonly policy?: string;
+    /** The specific rule that matched. */
+    readonly rule?: string;
+    /** Human-readable reason for denial. */
+    readonly reason: string;
+    constructor(options: {
+        action: string;
+        policy?: string;
+        rule?: string;
+        reason?: string;
+    });
+}
+/** Raised when rate limit is exceeded (429). */
+export declare class RateLimitError extends MeshGuardError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=exceptions.d.ts.map

package/dist/cjs/exceptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,2CAA2C;AAC3C,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAM5B;AAED,8CAA8C;AAC9C,qBAAa,mBAAoB,SAAQ,cAAc;gBACzC,OAAO,GAAE,MAAmC;CAIzD;AAED,uDAAuD;AACvD,qBAAa,iBAAkB,SAAQ,cAAc;IACnD,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;CAeF;AAED,gDAAgD;AAChD,qBAAa,cAAe,SAAQ,cAAc;gBACpC,OAAO,GAAE,MAA8B;CAIpD"}

package/dist/cjs/exceptions.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * MeshGuard Exceptions
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimitError = exports.PolicyDeniedError = exports.AuthenticationError = exports.MeshGuardError = void 0;
+/** Base error for all MeshGuard errors. */
+class MeshGuardError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "MeshGuardError";
+        // Fix prototype chain for instanceof checks
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.MeshGuardError = MeshGuardError;
+/** Raised when authentication fails (401). */
+class AuthenticationError extends MeshGuardError {
+    constructor(message = "Invalid or expired token") {
+        super(message);
+        this.name = "AuthenticationError";
+    }
+}
+exports.AuthenticationError = AuthenticationError;
+/** Raised when an action is denied by policy (403). */
+class PolicyDeniedError extends MeshGuardError {
+    /** The action that was denied. */
+    action;
+    /** The policy that denied the action. */
+    policy;
+    /** The specific rule that matched. */
+    rule;
+    /** Human-readable reason for denial. */
+    reason;
+    constructor(options) {
+        const { action, policy, rule, reason = "Access denied by policy" } = options;
+        let message = `Action '${action}' denied`;
+        if (policy)
+            message += ` by policy '${policy}'`;
+        if (rule)
+            message += ` (rule: ${rule})`;
+        message += `: ${reason}`;
+        super(message);
+        this.name = "PolicyDeniedError";
+        this.action = action;
+        this.policy = policy;
+        this.rule = rule;
+        this.reason = reason;
+    }
+}
+exports.PolicyDeniedError = PolicyDeniedError;
+/** Raised when rate limit is exceeded (429). */
+class RateLimitError extends MeshGuardError {
+    constructor(message = "Rate limit exceeded") {
+        super(message);
+        this.name = "RateLimitError";
+    }
+}
+exports.RateLimitError = RateLimitError;
+//# sourceMappingURL=exceptions.js.map

package/dist/cjs/exceptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/exceptions.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,2CAA2C;AAC3C,MAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,4CAA4C;QAC5C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAPD,wCAOC;AAED,8CAA8C;AAC9C,MAAa,mBAAoB,SAAQ,cAAc;IACrD,YAAY,UAAkB,0BAA0B;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AAED,uDAAuD;AACvD,MAAa,iBAAkB,SAAQ,cAAc;IACnD,kCAAkC;IACzB,MAAM,CAAS;IACxB,yCAAyC;IAChC,MAAM,CAAU;IACzB,sCAAsC;IAC7B,IAAI,CAAU;IACvB,wCAAwC;IAC/B,MAAM,CAAS;IAExB,YAAY,OAKX;QACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,yBAAyB,EAAE,GAAG,OAAO,CAAC;QAE7E,IAAI,OAAO,GAAG,WAAW,MAAM,UAAU,CAAC;QAC1C,IAAI,MAAM;YAAE,OAAO,IAAI,eAAe,MAAM,GAAG,CAAC;QAChD,IAAI,IAAI;YAAE,OAAO,IAAI,WAAW,IAAI,GAAG,CAAC;QACxC,OAAO,IAAI,KAAK,MAAM,EAAE,CAAC;QAEzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AA9BD,8CA8BC;AAED,gDAAgD;AAChD,MAAa,cAAe,SAAQ,cAAc;IAChD,YAAY,UAAkB,qBAAqB;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AALD,wCAKC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * MeshGuard SDK for TypeScript / JavaScript
+ *
+ * AI agent governance — policy enforcement, audit logging, and trust management.
+ *
+ * @example
+ * ```ts
+ * import { MeshGuardClient } from "meshguard";
+ *
+ * const client = new MeshGuardClient({ agentToken: "tok_..." });
+ *
+ * const decision = await client.check("read:contacts");
+ * if (decision.allowed) {
+ *   // proceed
+ * }
+ * ```
+ *
+ * @packageDocumentation
+ */
+export { MeshGuardClient } from "./client.js";
+export type { MeshGuardOptions, PolicyDecision, Agent, CreateAgentOptions, AuditEntry, AuditLogOptions, HealthStatus, Policy, } from "./types.js";
+export { MeshGuardError, AuthenticationError, PolicyDeniedError, RateLimitError, } from "./exceptions.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,KAAK,EACL,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,YAAY,EACZ,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,iBAAiB,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * MeshGuard SDK for TypeScript / JavaScript
+ *
+ * AI agent governance — policy enforcement, audit logging, and trust management.
+ *
+ * @example
+ * ```ts
+ * import { MeshGuardClient } from "meshguard";
+ *
+ * const client = new MeshGuardClient({ agentToken: "tok_..." });
+ *
+ * const decision = await client.check("read:contacts");
+ * if (decision.allowed) {
+ *   // proceed
+ * }
+ * ```
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimitError = exports.PolicyDeniedError = exports.AuthenticationError = exports.MeshGuardError = exports.MeshGuardClient = void 0;
+// Core client
+var client_js_1 = require("./client.js");
+Object.defineProperty(exports, "MeshGuardClient", { enumerable: true, get: function () { return client_js_1.MeshGuardClient; } });
+// Exceptions
+var exceptions_js_1 = require("./exceptions.js");
+Object.defineProperty(exports, "MeshGuardError", { enumerable: true, get: function () { return exceptions_js_1.MeshGuardError; } });
+Object.defineProperty(exports, "AuthenticationError", { enumerable: true, get: function () { return exceptions_js_1.AuthenticationError; } });
+Object.defineProperty(exports, "PolicyDeniedError", { enumerable: true, get: function () { return exceptions_js_1.PolicyDeniedError; } });
+Object.defineProperty(exports, "RateLimitError", { enumerable: true, get: function () { return exceptions_js_1.RateLimitError; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH,cAAc;AACd,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AAcxB,aAAa;AACb,iDAKyB;AAJvB,+GAAA,cAAc,OAAA;AACd,oHAAA,mBAAmB,OAAA;AACnB,kHAAA,iBAAiB,OAAA;AACjB,+GAAA,cAAc,OAAA"}

package/dist/cjs/langchain.d.ts

@@ -0,0 +1,106 @@
+/**
+ * MeshGuard LangChain.js Integration
+ *
+ * Provides wrappers for governing LangChain tools with MeshGuard policy.
+ *
+ * @example
+ * ```ts
+ * import { MeshGuardClient } from "meshguard";
+ * import { GovernedTool, GovernedToolkit } from "meshguard/langchain";
+ * ```
+ */
+import { MeshGuardClient } from "./client.js";
+import { PolicyDeniedError } from "./exceptions.js";
+/** Minimal interface matching LangChain `StructuredTool` / `Tool`. */
+export interface LangChainTool {
+    name: string;
+    description: string;
+    invoke(input: unknown, config?: unknown): Promise<unknown>;
+    call?(input: unknown, config?: unknown): Promise<unknown>;
+}
+type DenyHandler = (error: PolicyDeniedError, ...args: unknown[]) => unknown;
+/**
+ * Wrap a LangChain tool so every invocation is governed by MeshGuard policy.
+ *
+ * @example
+ * ```ts
+ * import { DuckDuckGoSearch } from "@langchain/community/tools/duckduckgo";
+ * import { MeshGuardClient } from "meshguard";
+ * import { governedTool } from "meshguard/langchain";
+ *
+ * const client = new MeshGuardClient();
+ * const search = governedTool("read:web_search", client, new DuckDuckGoSearch());
+ *
+ * const result = await search.invoke("TypeScript SDK patterns");
+ * ```
+ */
+export declare function governedTool<T extends LangChainTool>(action: string, client: MeshGuardClient, tool: T, onDeny?: DenyHandler): T;
+/**
+ * Wraps an existing LangChain tool with MeshGuard governance.
+ *
+ * @example
+ * ```ts
+ * const governed = new GovernedTool({
+ *   tool: myTool,
+ *   action: "read:web_search",
+ *   client,
+ * });
+ * const result = await governed.invoke("query");
+ * ```
+ */
+export declare class GovernedTool implements LangChainTool {
+    readonly name: string;
+    readonly description: string;
+    readonly action: string;
+    private readonly tool;
+    private readonly client;
+    private readonly onDeny?;
+    constructor(options: {
+        tool: LangChainTool;
+        action: string;
+        client: MeshGuardClient;
+        onDeny?: DenyHandler;
+    });
+    /** Invoke the tool with governance. */
+    invoke(input: unknown, config?: unknown): Promise<unknown>;
+    /** Legacy call method. */
+    call(input: unknown, config?: unknown): Promise<unknown>;
+}
+/**
+ * Govern a collection of LangChain tools with MeshGuard policies.
+ *
+ * @example
+ * ```ts
+ * const toolkit = new GovernedToolkit({
+ *   tools: [searchTool, calcTool],
+ *   client,
+ *   actionMap: {
+ *     "search": "read:web_search",
+ *     "calculator": "execute:math",
+ *   },
+ *   defaultAction: "execute:tool",
+ * });
+ *
+ * const governedTools = toolkit.getTools();
+ * ```
+ */
+export declare class GovernedToolkit {
+    private readonly tools;
+    private readonly client;
+    private readonly actionMap;
+    private readonly defaultAction;
+    private readonly onDeny?;
+    constructor(options: {
+        tools: LangChainTool[];
+        client: MeshGuardClient;
+        actionMap?: Record<string, string>;
+        defaultAction?: string;
+        onDeny?: DenyHandler;
+    });
+    /** Get the MeshGuard action for a tool. */
+    getAction(tool: LangChainTool): string;
+    /** Return governed versions of all tools. */
+    getTools(): GovernedTool[];
+}
+export {};
+//# sourceMappingURL=langchain.d.ts.map

package/dist/cjs/langchain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain.d.ts","sourceRoot":"","sources":["../../src/langchain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAMpD,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3D,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED,KAAK,WAAW,GAAG,CACjB,KAAK,EAAE,iBAAiB,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACf,OAAO,CAAC;AAMb;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,aAAa,EAClD,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,CAAC,EACP,MAAM,CAAC,EAAE,WAAW,GACnB,CAAC,CAuBH;AAMD;;;;;;;;;;;;GAYG;AACH,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;gBAE1B,OAAO,EAAE;QACnB,IAAI,EAAE,aAAa,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,eAAe,CAAC;QACxB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB;IAUD,uCAAuC;IACjC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAYhE,0BAA0B;IACpB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAG/D;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;gBAE1B,OAAO,EAAE;QACnB,KAAK,EAAE,aAAa,EAAE,CAAC;QACvB,MAAM,EAAE,eAAe,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB;IAQD,2CAA2C;IAC3C,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM;IAItC,6CAA6C;IAC7C,QAAQ,IAAI,YAAY,EAAE;CAW3B"}