changelog

/ Releases

Every release of @waterlock/gateway: what was added, what changed, and how to move to it.

Nov 8, 2026

GraphQL, and a Linear provider

GraphQL requests become actions like REST calls do, and Linear is the first GraphQL provider.

GraphQL support. Requests to a provider's GraphQL endpoint are matched on the body: the top-level field is the action and its arguments, with variables resolved, are r.params. (#6)
```
{ when: (r) => r.action === "linear.mutation.issueCreate" && r.params.input.teamId === TEAM_ID }
```
Linear provider, @waterlock/gateway/providers/linear, generated from Linear's schema. auth: "apiKey" for personal API keys.
@waterlock/gateway/graphql with createGraphqlMatcher, for GraphQL providers of your own, and GraphQL schemas as a codegen input.
Denials on a GraphQL endpoint use GraphQL's error shape, so GraphQL clients show the reason.

A provider can be GraphQL-only: its REST operation table is now optional.
One operation and one top-level field per GraphQL request. Batches, subscriptions, persisted queries and introspection are rejected. See the GraphQL limitation.

Nov 7, 2026

No changes to the library.

Nov 7, 2026

The policy gateway, with a Gmail provider.

The gateway. Agents call APIs through it with a session token; it holds the real credential, checks each call against your policy, and forwards it. (#1)
Policies of TypeScript rows, default deny, typed per action.
Checks: plain-language deny rows answered by a model you call, with helpers in @waterlock/gateway/checks.
Sessions: signed, short-lived tokens with createSessions, and an optional store for the human's messages (memoryStore).
Credentials: staticToken and oauth2Refresh.
Gmail provider, @waterlock/gateway/providers/gmail, generated from Google's Discovery document, with recipients, subject and body decoded into r.context for sends and drafts.
Codegen, @waterlock/gateway/codegen, to generate providers from Discovery and OpenAPI specs.