Build a governed app

DOME_TOKEN=dome_...
DOME_GATEWAY_URL=https://GATEWAY_HOST/gateways/DEFAULT_GATEWAY_ID
DOME_POOL=employee-summary

async function sendChat(prompt: string) {
  // ...
  const messages = [...prior, { role: "user" as const, content: text }];
  // ...
  const res = await fetch("/api/chat", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ messages }),
  });
  const result = (await res.json()) as AgentResponse;
  // ...
}

app.post("/api/chat", async (c) => {
  // ... build messages from body.messages or body.prompt
  const result = await runAgent({
    messages,
    pool: body.pool,
  });
  return c.json(result);
});

export async function chatCompletion(options: {
  prompt?: string;
  messages?: ChatMessage[];
  pool?: string;
  tools?: unknown[];
}): Promise<CallTrace> {
  const base = process.env.DOME_GATEWAY_URL;
  const token = process.env.DOME_TOKEN;
  const pool = options.pool || process.env.DOME_POOL || DEFAULT_POOL;

  const requestBody: Record<string, unknown> = {
    model: pool,
    messages,
  };
  if (options.tools?.length) {
    requestBody.tools = options.tools;
    requestBody.tool_choice = "auto";
  }
  // ...
  const url = `${base.replace(/\/$/, "")}/v1/chat/completions`;
  const res = await fetch(url, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(requestBody),
  });
  // ...
}

export const TOOL_MAP: Record<string, string> = {
  list_employees: "demo-hr/hr/list_employees",
  get_employee: "demo-hr/hr/get_employee",
  get_salary: "demo-hr/finance/get_salary",
  // ...
};

for (const call of toolCalls) {
  const shortName = call.function?.name ?? "";
  const mcpName = TOOL_MAP[shortName] ?? shortName;
  // ... parse arguments
  const toolTrace = await callTool(mcpName, args);
  // ...
}

export async function callTool(
  name: string,
  args: Record<string, unknown> = {},
): Promise<CallTrace> {
  const base = process.env.DOME_GATEWAY_URL;
  const token = process.env.DOME_TOKEN;

  const requestBody = {
    jsonrpc: "2.0" as const,
    id: 1,
    method: "tools/call" as const,
    params: { name, arguments: args },
  };
  // ...
  const url = `${base.replace(/\/$/, "")}/mcp`;
  const res = await fetch(url, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(requestBody),
  });
  // ... map body.error → denied, result → allowed / error
}

export async function runAgent(options: {
  messages: ChatMessage[];
  pool?: string;
}): Promise<AgentResult> {
  // ... seed system prompt + user messages
  for (let round = 0; round < MAX_ROUNDS; round++) {
    const trace = await chatCompletion({
      messages: messages as ChatMessage[],
      pool: options.pool,
      tools: OPENAI_TOOLS,
    });
    steps.push({ type: "model", trace });
    // ... return early if denied / no tool_calls

    for (const call of toolCalls) {
      const shortName = call.function?.name ?? "";
      const mcpName = TOOL_MAP[shortName] ?? shortName;
      // ... parse arguments
      const toolTrace = await callTool(mcpName, args);
      steps.push({ type: "tool", name: shortName, mcpName, arguments: args, trace: toolTrace });
      messages.push({
        role: "tool",
        tool_call_id: call.id,
        content: toolResultContent(toolTrace),
      });
    }
  }
  // ...
}

async function runTool(action: (typeof TOOL_ACTIONS)[number]) {
  // ...
  const res = await fetch("/api/tool", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ name: action.name, arguments: action.args }),
  });
  const trace = (await res.json()) as CallTrace;
  // ...
}

app.post("/api/tool", async (c) => {
  const body = await c.req.json<{
    name?: string;
    arguments?: Record<string, unknown>;
  }>();
  // ...
  const trace = await callTool(body.name, body.arguments ?? {});
  return c.json(trace);
});