@humanagencyp/hap-core 0.7.0 → 0.8.0

package/dist/index.d.mts

@@ -113,6 +113,27 @@ interface Attestation {
 interface FieldConstraint {
     type: 'number' | 'string';
     enforceable: Array<'max' | 'enum' | 'subset'>;
+    /**
+     * Action types for which this dimension MUST be present in the execution
+     * context. When the grant constrains this field and the action is one of
+     * these, an absent value is a denial rather than a skipped check.
+     *
+     * Without it, a constraint is only enforced against calls that happen to
+     * expose the value. Gmail's `send_message` is the live case: pass `raw` and
+     * `to` is never populated, so `allowed_recipients` had nothing to compare and
+     * the check passed — a send to an unverified recipient looked authorized.
+     * `send_draft` has the same shape: it transmits, and the Gatekeeper cannot
+     * see to whom.
+     *
+     * Keyed on `action_type` because "does this action engage recipients?" is a
+     * property of the action, not of the field name — deleting a draft has no
+     * recipients and must keep passing, while sending one must not. This keeps
+     * the engine profile-agnostic: it compares declared strings and knows nothing
+     * about email, calendars or payments.
+     *
+     * Omitted → previous behaviour: absence skips the check.
+     */
+    requiredFor?: string[];
 }
 /**
  * Frame field definition within a profile.

package/dist/index.d.ts

@@ -113,6 +113,27 @@ interface Attestation {
 interface FieldConstraint {
     type: 'number' | 'string';
     enforceable: Array<'max' | 'enum' | 'subset'>;
+    /**
+     * Action types for which this dimension MUST be present in the execution
+     * context. When the grant constrains this field and the action is one of
+     * these, an absent value is a denial rather than a skipped check.
+     *
+     * Without it, a constraint is only enforced against calls that happen to
+     * expose the value. Gmail's `send_message` is the live case: pass `raw` and
+     * `to` is never populated, so `allowed_recipients` had nothing to compare and
+     * the check passed — a send to an unverified recipient looked authorized.
+     * `send_draft` has the same shape: it transmits, and the Gatekeeper cannot
+     * see to whom.
+     *
+     * Keyed on `action_type` because "does this action engage recipients?" is a
+     * property of the action, not of the field name — deleting a draft has no
+     * recipients and must keep passing, while sending one must not. This keeps
+     * the engine profile-agnostic: it compares declared strings and knows nothing
+     * about email, calendars or payments.
+     *
+     * Omitted → previous behaviour: absence skips the check.
+     */
+    requiredFor?: string[];
 }
 /**
  * Frame field definition within a profile.

package/dist/index.js

@@ -757,6 +757,23 @@ function checkContextConstraints(context, execution, profile) {
   if (!profile.contextSchema) return errors;
   for (const [fieldName, fieldDef] of Object.entries(profile.contextSchema.fields)) {
     if (!fieldDef.constraint) continue;
+    const requiredFor = fieldDef.constraint.requiredFor;
+    if (requiredFor?.length) {
+      const boundValue = context[fieldName];
+      const actualValue = execution[fieldName];
+      const actionType = execution["action_type"];
+      const constrained = boundValue !== void 0 && boundValue !== "";
+      const engaged = actionType !== void 0 && requiredFor.includes(String(actionType));
+      if (constrained && engaged && (actualValue === void 0 || actualValue === "")) {
+        errors.push({
+          code: "BOUND_EXCEEDED",
+          field: fieldName,
+          message: `Authorization limits "${fieldName}" to [${boundValue}], but this "${String(actionType)}" call exposes no ${fieldName} to check against it. Refusing: the call cannot be shown to stay in scope.`,
+          bound: boundValue
+        });
+        continue;
+      }
+    }
     for (const enforceType of fieldDef.constraint.enforceable) {
       if (enforceType === "enum") {
         const boundValue = context[fieldName];

package/dist/index.mjs

@@ -686,6 +686,23 @@ function checkContextConstraints(context, execution, profile) {
   if (!profile.contextSchema) return errors;
   for (const [fieldName, fieldDef] of Object.entries(profile.contextSchema.fields)) {
     if (!fieldDef.constraint) continue;
+    const requiredFor = fieldDef.constraint.requiredFor;
+    if (requiredFor?.length) {
+      const boundValue = context[fieldName];
+      const actualValue = execution[fieldName];
+      const actionType = execution["action_type"];
+      const constrained = boundValue !== void 0 && boundValue !== "";
+      const engaged = actionType !== void 0 && requiredFor.includes(String(actionType));
+      if (constrained && engaged && (actualValue === void 0 || actualValue === "")) {
+        errors.push({
+          code: "BOUND_EXCEEDED",
+          field: fieldName,
+          message: `Authorization limits "${fieldName}" to [${boundValue}], but this "${String(actionType)}" call exposes no ${fieldName} to check against it. Refusing: the call cannot be shown to stay in scope.`,
+          bound: boundValue
+        });
+        continue;
+      }
+    }
     for (const enforceType of fieldDef.constraint.enforceable) {
       if (enforceType === "enum") {
         const boundValue = context[fieldName];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/src/gatekeeper.ts

@@ -612,6 +612,34 @@ function checkContextConstraints(
   for (const [fieldName, fieldDef] of Object.entries(profile.contextSchema.fields)) {
     if (!fieldDef.constraint) continue;
 
+    // A constrained dimension that the call does not expose cannot be checked.
+    // Skipping is only safe when the action does not engage that dimension —
+    // deleting a draft has no recipients. When it DOES engage it, silence must
+    // not read as compliance: an absent value means the Gatekeeper cannot show
+    // the call is in scope, and an unverifiable send is exactly what the scope
+    // exists to prevent. The profile declares which actions engage the field.
+    const requiredFor = fieldDef.constraint.requiredFor;
+    if (requiredFor?.length) {
+      const boundValue = context[fieldName];
+      const actualValue = execution[fieldName];
+      const actionType = execution['action_type'];
+      const constrained = boundValue !== undefined && boundValue !== '';
+      const engaged = actionType !== undefined && requiredFor.includes(String(actionType));
+
+      if (constrained && engaged && (actualValue === undefined || actualValue === '')) {
+        errors.push({
+          code: 'BOUND_EXCEEDED',
+          field: fieldName,
+          message:
+            `Authorization limits "${fieldName}" to [${boundValue}], but this ` +
+            `"${String(actionType)}" call exposes no ${fieldName} to check against it. ` +
+            `Refusing: the call cannot be shown to stay in scope.`,
+          bound: boundValue,
+        });
+        continue; // nothing further to compare for this field
+      }
+    }
+
     for (const enforceType of fieldDef.constraint.enforceable) {
       if (enforceType === 'enum') {
         // The context field value is the allowed value; execution must match

package/src/types.ts

@@ -121,6 +121,27 @@ export interface Attestation {
 export interface FieldConstraint {
   type: 'number' | 'string';
   enforceable: Array<'max' | 'enum' | 'subset'>;
+  /**
+   * Action types for which this dimension MUST be present in the execution
+   * context. When the grant constrains this field and the action is one of
+   * these, an absent value is a denial rather than a skipped check.
+   *
+   * Without it, a constraint is only enforced against calls that happen to
+   * expose the value. Gmail's `send_message` is the live case: pass `raw` and
+   * `to` is never populated, so `allowed_recipients` had nothing to compare and
+   * the check passed — a send to an unverified recipient looked authorized.
+   * `send_draft` has the same shape: it transmits, and the Gatekeeper cannot
+   * see to whom.
+   *
+   * Keyed on `action_type` because "does this action engage recipients?" is a
+   * property of the action, not of the field name — deleting a draft has no
+   * recipients and must keep passing, while sending one must not. This keeps
+   * the engine profile-agnostic: it compares declared strings and knows nothing
+   * about email, calendars or payments.
+   *
+   * Omitted → previous behaviour: absence skips the check.
+   */
+  requiredFor?: string[];
 }
 
 /**