@humanagencyp/hap-core 0.6.1 → 0.7.0

package/dist/index.d.mts

@@ -210,6 +210,21 @@ interface ProfileBoundsField {
      * treat a missing boundType as an error when running in v0.4 mode.
      */
     boundType?: BoundType;
+    /**
+     * Which execution action types this bound governs, e.g. `["write"]`.
+     *
+     * When present, this is authoritative. When absent, enforcement falls back to
+     * inferring the action type from the FIELD NAME (`send_daily_max` → `send`),
+     * which is a convention rather than a contract: a profile that names a bound
+     * after the domain concept instead of the action — calendar's
+     * `booking_daily_max` against an action type of `write` — matches nothing and
+     * is skipped, so a limit the user set is never applied and nothing says so.
+     *
+     * Declaring it removes the guess. Deliberately additive: profiles migrate one
+     * at a time, and every remaining fallback is logged, so the cases still
+     * relying on the naming convention become visible instead of staying silent.
+     */
+    appliesTo?: string[];
     /**
      * The measurement dimension of the bound's value. UI renders the unit
      * inline next to the input (e.g. `4 min`, `100 EUR`). Independent from
@@ -474,6 +489,18 @@ interface GatekeeperRequest {
     execution: Record<string, string | number>;
     /** v0.4: context parameters (currency, action_type, etc.) */
     context?: AgentContextParams;
+    /**
+     * Authorization path used to scope cumulative lookups in the execution log.
+     *
+     * Deliberately OUTSIDE `frame`: the frame is hashed and validated against the
+     * profile's boundsSchema, so an extra key there is rejected as an unknown
+     * field and breaks attestation verification outright. Cumulative checks
+     * previously read the path from the frame, where callers cannot legally put
+     * it — so it resolved to "" while the log stored real paths, no entry ever
+     * matched, and every running total read zero. The local gate existed but
+     * could never fire.
+     */
+    path?: string;
 }
 /**
  * Structured error from Gatekeeper verification.
@@ -652,8 +679,13 @@ declare function validateSubject(subject: Subject): SubjectValidation;
  * The name appears only at `high` with a disclosed name; otherwise no name.
  *
  *  - low / no disclosure → "Sent by an AI agent via «operator»"
- *  - high / as_vouched   → "Sent by an AI agent of «name», verified by «operator»"
- *  - high / eudi         → "Sent by an AI agent of «name», identity verified (EUDI)"
+ *  - high / as_vouched   → "Sent by «name»'s AI agent, verified by «operator»"
+ *  - high / eudi         → "Sent by «name»'s AI agent, identity verified (EUDI)"
+ *
+ * Footer wording v1.1 (July 2026): the named forms read "«name»'s AI agent"
+ * (more natural than the v1 "an AI agent of «name»"). The v1 wording is frozen
+ * for already-sent content; verifiers strip BOTH forms (see the gateway's
+ * FOOTER_RE and the AS ContentVerifier).
  *
  * Punctuation is ASCII (comma, not em-dash) so the line survives header and
  * plain-text encoding intact across email, calendar, and publishing channels.

package/dist/index.d.ts

@@ -210,6 +210,21 @@ interface ProfileBoundsField {
      * treat a missing boundType as an error when running in v0.4 mode.
      */
     boundType?: BoundType;
+    /**
+     * Which execution action types this bound governs, e.g. `["write"]`.
+     *
+     * When present, this is authoritative. When absent, enforcement falls back to
+     * inferring the action type from the FIELD NAME (`send_daily_max` → `send`),
+     * which is a convention rather than a contract: a profile that names a bound
+     * after the domain concept instead of the action — calendar's
+     * `booking_daily_max` against an action type of `write` — matches nothing and
+     * is skipped, so a limit the user set is never applied and nothing says so.
+     *
+     * Declaring it removes the guess. Deliberately additive: profiles migrate one
+     * at a time, and every remaining fallback is logged, so the cases still
+     * relying on the naming convention become visible instead of staying silent.
+     */
+    appliesTo?: string[];
     /**
      * The measurement dimension of the bound's value. UI renders the unit
      * inline next to the input (e.g. `4 min`, `100 EUR`). Independent from
@@ -474,6 +489,18 @@ interface GatekeeperRequest {
     execution: Record<string, string | number>;
     /** v0.4: context parameters (currency, action_type, etc.) */
     context?: AgentContextParams;
+    /**
+     * Authorization path used to scope cumulative lookups in the execution log.
+     *
+     * Deliberately OUTSIDE `frame`: the frame is hashed and validated against the
+     * profile's boundsSchema, so an extra key there is rejected as an unknown
+     * field and breaks attestation verification outright. Cumulative checks
+     * previously read the path from the frame, where callers cannot legally put
+     * it — so it resolved to "" while the log stored real paths, no entry ever
+     * matched, and every running total read zero. The local gate existed but
+     * could never fire.
+     */
+    path?: string;
 }
 /**
  * Structured error from Gatekeeper verification.
@@ -652,8 +679,13 @@ declare function validateSubject(subject: Subject): SubjectValidation;
  * The name appears only at `high` with a disclosed name; otherwise no name.
  *
  *  - low / no disclosure → "Sent by an AI agent via «operator»"
- *  - high / as_vouched   → "Sent by an AI agent of «name», verified by «operator»"
- *  - high / eudi         → "Sent by an AI agent of «name», identity verified (EUDI)"
+ *  - high / as_vouched   → "Sent by «name»'s AI agent, verified by «operator»"
+ *  - high / eudi         → "Sent by «name»'s AI agent, identity verified (EUDI)"
+ *
+ * Footer wording v1.1 (July 2026): the named forms read "«name»'s AI agent"
+ * (more natural than the v1 "an AI agent of «name»"). The v1 wording is frozen
+ * for already-sent content; verifiers strip BOTH forms (see the gateway's
+ * FOOTER_RE and the AS ContentVerifier).
  *
  * Punctuation is ASCII (comma, not em-dash) so the line survives header and
  * plain-text encoding intact across email, calendar, and publishing channels.

package/dist/index.js

@@ -170,9 +170,9 @@ function deriveIdentityLine(subject, { operatorName }) {
     return `Sent by an AI agent via ${operatorName}`;
   }
   if (subject.method === "eudi") {
-    return `Sent by an AI agent of ${name}, identity verified (EUDI)`;
+    return `Sent by ${name}'s AI agent, identity verified (EUDI)`;
   }
-  return `Sent by an AI agent of ${name}, verified by ${operatorName}`;
+  return `Sent by ${name}'s AI agent, verified by ${operatorName}`;
 }
 
 // src/frame.ts
@@ -626,12 +626,23 @@ function checkBoundsFromFrameSchema(request, profile) {
   }
   return errors;
 }
+function boundGovernsAction(fieldName, fieldDef, bt, actionType) {
+  if (fieldDef.appliesTo) {
+    return actionType ? fieldDef.appliesTo.includes(actionType) : true;
+  }
+  if (bt.kind !== "cumulative_count" || !actionType) return true;
+  const prefix = fieldName.replace(/_(?:daily|monthly|weekly)_max$/, "");
+  const namedForAnAction = prefix !== fieldName;
+  const matches = prefix === actionType || prefix.startsWith("transaction");
+  return !namedForAnAction || matches;
+}
 function checkBoundsV4(request, profile, executionLog, now) {
   const errors = [];
   if (!profile.boundsSchema) return errors;
   const bounds = request.frame;
   const profileId = String(bounds.profile ?? profile.id);
-  const path = bounds.path ? String(bounds.path) : "";
+  const actionType = typeof request.execution.action_type === "string" ? request.execution.action_type : void 0;
+  const path = request.path ?? (bounds.path ? String(bounds.path) : "");
   for (const [fieldName, fieldDef] of Object.entries(profile.boundsSchema.fields)) {
     if (fieldName === "profile" || fieldName === "path") continue;
     const boundValue = bounds[fieldName];
@@ -647,6 +658,7 @@ function checkBoundsV4(request, profile, executionLog, now) {
       });
       continue;
     }
+    if (!boundGovernsAction(fieldName, fieldDef, bt, actionType)) continue;
     switch (bt.kind) {
       case "per_transaction": {
         const actual = request.execution[bt.of];

package/dist/index.mjs

@@ -99,9 +99,9 @@ function deriveIdentityLine(subject, { operatorName }) {
     return `Sent by an AI agent via ${operatorName}`;
   }
   if (subject.method === "eudi") {
-    return `Sent by an AI agent of ${name}, identity verified (EUDI)`;
+    return `Sent by ${name}'s AI agent, identity verified (EUDI)`;
   }
-  return `Sent by an AI agent of ${name}, verified by ${operatorName}`;
+  return `Sent by ${name}'s AI agent, verified by ${operatorName}`;
 }
 
 // src/frame.ts
@@ -555,12 +555,23 @@ function checkBoundsFromFrameSchema(request, profile) {
   }
   return errors;
 }
+function boundGovernsAction(fieldName, fieldDef, bt, actionType) {
+  if (fieldDef.appliesTo) {
+    return actionType ? fieldDef.appliesTo.includes(actionType) : true;
+  }
+  if (bt.kind !== "cumulative_count" || !actionType) return true;
+  const prefix = fieldName.replace(/_(?:daily|monthly|weekly)_max$/, "");
+  const namedForAnAction = prefix !== fieldName;
+  const matches = prefix === actionType || prefix.startsWith("transaction");
+  return !namedForAnAction || matches;
+}
 function checkBoundsV4(request, profile, executionLog, now) {
   const errors = [];
   if (!profile.boundsSchema) return errors;
   const bounds = request.frame;
   const profileId = String(bounds.profile ?? profile.id);
-  const path = bounds.path ? String(bounds.path) : "";
+  const actionType = typeof request.execution.action_type === "string" ? request.execution.action_type : void 0;
+  const path = request.path ?? (bounds.path ? String(bounds.path) : "");
   for (const [fieldName, fieldDef] of Object.entries(profile.boundsSchema.fields)) {
     if (fieldName === "profile" || fieldName === "path") continue;
     const boundValue = bounds[fieldName];
@@ -576,6 +587,7 @@ function checkBoundsV4(request, profile, executionLog, now) {
       });
       continue;
     }
+    if (!boundGovernsAction(fieldName, fieldDef, bt, actionType)) continue;
     switch (bt.kind) {
       case "per_transaction": {
         const actual = request.execution[bt.of];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/src/gatekeeper.ts

@@ -40,6 +40,8 @@ import type {
   AgentContextParams,
   ExecutionLogQuery,
   CumulativeFieldDef,
+  ProfileBoundsField,
+  BoundType,
 } from './types';
 
 /**
@@ -406,6 +408,41 @@ function checkBoundsFromFrameSchema(request: GatekeeperRequest, profile: AgentPr
  *   enum             — bound value must be in the allowed set (attest-time
  *                      validation; not an execution-time check)
  */
+/**
+ * Does this bound govern the action being attempted?
+ *
+ * Cumulative totals are scoped by (profileId, path) only, so without this every
+ * cumulative_count bound on a profile sees the same running count. On customers
+ * — which declares both write_daily_max and delete_daily_max — the smaller
+ * delete limit would count writes and block them.
+ *
+ * Preferred answer is the profile's declared `appliesTo`. Absent that, fall back
+ * to the field-name convention (`delete_daily_max` → `delete`), matching how the
+ * Authority Server selects bounds so the two enforcement points cannot disagree.
+ *
+ * Fails CLOSED: when the action type is unknown, or the bound's name implies no
+ * particular action, the bound is enforced.
+ */
+function boundGovernsAction(
+  fieldName: string,
+  fieldDef: ProfileBoundsField,
+  bt: BoundType,
+  actionType: string | undefined,
+): boolean {
+  if (fieldDef.appliesTo) {
+    return actionType ? fieldDef.appliesTo.includes(actionType) : true;
+  }
+
+  // The name convention only ever disambiguated count bounds; sums are governed
+  // by their `of` field and stay unfiltered, as at the Authority Server.
+  if (bt.kind !== 'cumulative_count' || !actionType) return true;
+
+  const prefix = fieldName.replace(/_(?:daily|monthly|weekly)_max$/, '');
+  const namedForAnAction = prefix !== fieldName;
+  const matches = prefix === actionType || prefix.startsWith('transaction');
+  return !namedForAnAction || matches;
+}
+
 function checkBoundsV4(
   request: GatekeeperRequest,
   profile: AgentProfile,
@@ -417,7 +454,14 @@ function checkBoundsV4(
 
   const bounds = request.frame as AgentBoundsParams;
   const profileId = String(bounds.profile ?? profile.id);
-  const path = bounds.path ? String(bounds.path) : '';
+  const actionType = typeof request.execution.action_type === 'string'
+    ? request.execution.action_type
+    : undefined;
+  // Prefer the explicit request path. `frame.path` is retained only as a
+  // fallback for callers that legitimately declare `path` in their profile's
+  // boundsSchema; for every shipped profile it is absent, which is exactly why
+  // this silently resolved to "" and disabled the cumulative gate entirely.
+  const path = request.path ?? (bounds.path ? String(bounds.path) : '');
 
   for (const [fieldName, fieldDef] of Object.entries(profile.boundsSchema.fields)) {
     if (fieldName === 'profile' || fieldName === 'path') continue;
@@ -441,6 +485,8 @@ function checkBoundsV4(
       continue;
     }
 
+    if (!boundGovernsAction(fieldName, fieldDef, bt, actionType)) continue;
+
     switch (bt.kind) {
       case 'per_transaction': {
         const actual = request.execution[bt.of];

package/src/identity.ts

@@ -56,8 +56,13 @@ export function validateSubject(subject: Subject): SubjectValidation {
  * The name appears only at `high` with a disclosed name; otherwise no name.
  *
  *  - low / no disclosure → "Sent by an AI agent via «operator»"
- *  - high / as_vouched   → "Sent by an AI agent of «name», verified by «operator»"
- *  - high / eudi         → "Sent by an AI agent of «name», identity verified (EUDI)"
+ *  - high / as_vouched   → "Sent by «name»'s AI agent, verified by «operator»"
+ *  - high / eudi         → "Sent by «name»'s AI agent, identity verified (EUDI)"
+ *
+ * Footer wording v1.1 (July 2026): the named forms read "«name»'s AI agent"
+ * (more natural than the v1 "an AI agent of «name»"). The v1 wording is frozen
+ * for already-sent content; verifiers strip BOTH forms (see the gateway's
+ * FOOTER_RE and the AS ContentVerifier).
  *
  * Punctuation is ASCII (comma, not em-dash) so the line survives header and
  * plain-text encoding intact across email, calendar, and publishing channels.
@@ -76,7 +81,7 @@ export function deriveIdentityLine(
     return `Sent by an AI agent via ${operatorName}`;
   }
   if (subject!.method === 'eudi') {
-    return `Sent by an AI agent of ${name}, identity verified (EUDI)`;
+    return `Sent by ${name}'s AI agent, identity verified (EUDI)`;
   }
-  return `Sent by an AI agent of ${name}, verified by ${operatorName}`;
+  return `Sent by ${name}'s AI agent, verified by ${operatorName}`;
 }

package/src/types.ts

@@ -213,6 +213,21 @@ export interface ProfileBoundsField {
    * treat a missing boundType as an error when running in v0.4 mode.
    */
   boundType?: BoundType;
+  /**
+   * Which execution action types this bound governs, e.g. `["write"]`.
+   *
+   * When present, this is authoritative. When absent, enforcement falls back to
+   * inferring the action type from the FIELD NAME (`send_daily_max` → `send`),
+   * which is a convention rather than a contract: a profile that names a bound
+   * after the domain concept instead of the action — calendar's
+   * `booking_daily_max` against an action type of `write` — matches nothing and
+   * is skipped, so a limit the user set is never applied and nothing says so.
+   *
+   * Declaring it removes the guess. Deliberately additive: profiles migrate one
+   * at a time, and every remaining fallback is logged, so the cases still
+   * relying on the naming convention become visible instead of staying silent.
+   */
+  appliesTo?: string[];
   /**
    * The measurement dimension of the bound's value. UI renders the unit
    * inline next to the input (e.g. `4 min`, `100 EUR`). Independent from
@@ -502,6 +517,18 @@ export interface GatekeeperRequest {
   execution: Record<string, string | number>;
   /** v0.4: context parameters (currency, action_type, etc.) */
   context?: AgentContextParams;
+  /**
+   * Authorization path used to scope cumulative lookups in the execution log.
+   *
+   * Deliberately OUTSIDE `frame`: the frame is hashed and validated against the
+   * profile's boundsSchema, so an extra key there is rejected as an unknown
+   * field and breaks attestation verification outright. Cumulative checks
+   * previously read the path from the frame, where callers cannot legally put
+   * it — so it resolved to "" while the log stored real paths, no entry ever
+   * matched, and every running total read zero. The local gate existed but
+   * could never fire.
+   */
+  path?: string;
 }
 
 /**