@humanagencyp/hap-core 0.4.1 → 0.4.2

package/dist/index.js

@@ -371,7 +371,7 @@ async function verifyV3(request, profile, publicKeyHex, now, executionLog, error
 async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   const errors = [];
   const bounds = request.frame;
-  const context = request.context ?? {};
+  const context = request.context;
   let expectedBoundsHash;
   let expectedContextHash;
   try {
@@ -379,10 +379,12 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   } catch (err) {
     return { approved: false, errors: [{ code: "BOUNDS_MISMATCH", message: `Bounds hash computation failed: ${err}` }] };
   }
-  try {
-    expectedContextHash = computeContextHash(context, profile);
-  } catch (err) {
-    return { approved: false, errors: [{ code: "CONTEXT_MISMATCH", message: `Context hash computation failed: ${err}` }] };
+  if (context && Object.keys(context).length > 0) {
+    try {
+      expectedContextHash = computeContextHash(context, profile);
+    } catch (err) {
+      return { approved: false, errors: [{ code: "CONTEXT_MISMATCH", message: `Context hash computation failed: ${err}` }] };
+    }
   }
   const requiredDomains = [];
   const coveredDomains = /* @__PURE__ */ new Set();
@@ -406,7 +408,7 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
       errors.push({ code: "BOUNDS_MISMATCH", message: "Attestation bounds_hash does not match computed bounds_hash" });
       continue;
     }
-    if (isV4Attestation(attestation)) {
+    if (isV4Attestation(attestation) && expectedContextHash) {
       try {
         verifyContextHash(attestation, expectedContextHash);
       } catch {
@@ -443,7 +445,7 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   if (boundsErrors.length > 0) {
     return { approved: false, errors: boundsErrors };
   }
-  if (profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
+  if (context && profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
     const contextErrors = checkContextConstraints(context, request.execution, profile);
     if (contextErrors.length > 0) {
       return { approved: false, errors: contextErrors };

package/dist/index.mjs

@@ -309,7 +309,7 @@ async function verifyV3(request, profile, publicKeyHex, now, executionLog, error
 async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   const errors = [];
   const bounds = request.frame;
-  const context = request.context ?? {};
+  const context = request.context;
   let expectedBoundsHash;
   let expectedContextHash;
   try {
@@ -317,10 +317,12 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   } catch (err) {
     return { approved: false, errors: [{ code: "BOUNDS_MISMATCH", message: `Bounds hash computation failed: ${err}` }] };
   }
-  try {
-    expectedContextHash = computeContextHash(context, profile);
-  } catch (err) {
-    return { approved: false, errors: [{ code: "CONTEXT_MISMATCH", message: `Context hash computation failed: ${err}` }] };
+  if (context && Object.keys(context).length > 0) {
+    try {
+      expectedContextHash = computeContextHash(context, profile);
+    } catch (err) {
+      return { approved: false, errors: [{ code: "CONTEXT_MISMATCH", message: `Context hash computation failed: ${err}` }] };
+    }
   }
   const requiredDomains = [];
   const coveredDomains = /* @__PURE__ */ new Set();
@@ -344,7 +346,7 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
       errors.push({ code: "BOUNDS_MISMATCH", message: "Attestation bounds_hash does not match computed bounds_hash" });
       continue;
     }
-    if (isV4Attestation(attestation)) {
+    if (isV4Attestation(attestation) && expectedContextHash) {
       try {
         verifyContextHash(attestation, expectedContextHash);
       } catch {
@@ -381,7 +383,7 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   if (boundsErrors.length > 0) {
     return { approved: false, errors: boundsErrors };
   }
-  if (profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
+  if (context && profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
     const contextErrors = checkContextConstraints(context, request.execution, profile);
     if (contextErrors.length > 0) {
       return { approved: false, errors: contextErrors };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/src/gatekeeper.ts

@@ -181,11 +181,11 @@ async function verifyV4(
 
   // In v0.4 the `frame` param carries bounds; `context` carries context params
   const bounds = request.frame as AgentBoundsParams;
-  const context: AgentContextParams = request.context ?? {};
+  const context: AgentContextParams | undefined = request.context;
 
   // Compute expected hashes
   let expectedBoundsHash: string;
-  let expectedContextHash: string;
+  let expectedContextHash: string | undefined;
 
   try {
     expectedBoundsHash = computeBoundsHash(bounds, profile);
@@ -193,10 +193,14 @@ async function verifyV4(
     return { approved: false, errors: [{ code: 'BOUNDS_MISMATCH', message: `Bounds hash computation failed: ${err}` }] };
   }
 
-  try {
-    expectedContextHash = computeContextHash(context, profile);
-  } catch (err) {
-    return { approved: false, errors: [{ code: 'CONTEXT_MISMATCH', message: `Context hash computation failed: ${err}` }] };
+  // Context hash is only computed when context is explicitly provided.
+  // At execution time, context is not re-verified — it was checked at authorization time.
+  if (context && Object.keys(context).length > 0) {
+    try {
+      expectedContextHash = computeContextHash(context, profile);
+    } catch (err) {
+      return { approved: false, errors: [{ code: 'CONTEXT_MISMATCH', message: `Context hash computation failed: ${err}` }] };
+    }
   }
 
   // Verify attestations (domains come from SP group config, not profile)
@@ -227,8 +231,8 @@ async function verifyV4(
       continue;
     }
 
-    // Verify context hash (only for v0.4 attestations that have context_hash)
-    if (isV4Attestation(attestation)) {
+    // Verify context hash (only when context was provided and hash was computed)
+    if (isV4Attestation(attestation) && expectedContextHash) {
       try {
         verifyContextHash(attestation, expectedContextHash);
       } catch {
@@ -275,7 +279,7 @@ async function verifyV4(
   }
 
   // Check context constraints using contextSchema
-  if (profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
+  if (context && profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
     const contextErrors = checkContextConstraints(context, request.execution, profile);
     if (contextErrors.length > 0) {
       return { approved: false, errors: contextErrors };