@metamynd/agentsafe-signer 0.17.1 → 0.18.0

package/README.md

@@ -197,6 +197,18 @@ as the counterparty that executes for it. Rate limit: 120 per 10 s. Needs `@meta
   (`daemon-log-integrity.smoke.mjs`, above) — though it covers only the local hash-chain half of
   T11, not the external-anchoring half, which remains open per the bullet above.
 
+## Signed jurisdiction (`sign-authorize`, since 0.18.0)
+
+`sign-authorize` accepts an optional `jurisdiction` (two ASCII letters; the client normalises it to upper case and
+sends the same string). With it the daemon signs the v2 message (MAGP §8.3.12: the eight fields, `MAGP-AUTH-v2`, the
+jurisdiction) and **echoes** `jurisdiction` in its result; without it, the v1 message exactly as before and no echo.
+A malformed value is `DAEMON_MALFORMED_REQUEST` and nothing is signed. The echo is how a client tells this daemon
+from an older one, which ignores the field and would sign v1 for a request that is sent with it:
+`@metamynd/agentsafe-guard` ≥ 0.16.0 and `metamynd-client` ≥ 0.6.0 refuse such a daemon
+(`JURISDICTION_SIGNING_UNSUPPORTED`) rather than send a request the gate would reject. At the gate, a registered
+payee's country wins over the signed one (`JURISDICTION_MISMATCH`); the other refusals are `JURISDICTION_REQUIRED`
+and `JURISDICTION_NOT_ALLOWED`.
+
 ## Hardening tiers — what a real host actually confirms (T3, T5)
 
 `daemon-hardening.smoke.mjs` checks the tier directives **from outside** the process, against the

package/daemon.mjs

@@ -300,12 +300,20 @@ export class SignerDaemon {
   #handleSignAuthorize(params = {}) {
     this.#assertRateLimit('sign-authorize');
     this.#validateCoreFields(params);
-    const { agentDid, action, amount, currency = 'USD', merchant, resource, nonce, issuedAt } = params;
+    const { agentDid, action, amount, currency = 'USD', merchant, resource, nonce, issuedAt, jurisdiction } = params;
+    // The signed jurisdiction (spec §8.3.12): present → the v2 message, absent → v1 exactly as before. Signed as the
+    // literal value given (the client normalises it and sends the same string), so it must be two ASCII letters — the
+    // shape the gate accepts. Echoed back so a client can tell this daemon from one that predates the field (which
+    // ignores it and signs v1): signed and sent must never differ.
+    if (jurisdiction !== undefined && (typeof jurisdiction !== 'string' || !/^[A-Za-z]{2}$/.test(jurisdiction))) {
+      throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'jurisdiction must be an ISO 3166-1 alpha-2 code');
+    }
     // `resource` is the 8th canonical field (canonical.ts) — dropping it here (found live: it
     // was) means every request signed via this daemon silently omits it from the signature,
     // so the real gate's 8-field reconstruction never matches for any resource-bearing call.
-    const message = buildAuthMessage({ agentDid, action, amount, currency, merchant, resource, nonce, issuedAt });
-    return { signature: this.#sign(Buffer.from(message, 'utf8')) };
+    const message = buildAuthMessage({ agentDid, action, amount, currency, merchant, resource, nonce, issuedAt, ...(jurisdiction === undefined ? {} : { jurisdiction }) });
+    const signature = this.#sign(Buffer.from(message, 'utf8'));
+    return jurisdiction === undefined ? { signature } : { signature, jurisdiction };
   }
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamynd/agentsafe-signer",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "description": "Local signer daemon for AgentSafe agent/service keys \u2014 the key never enters the calling guard's own process. See docs/design/agent-key-custody-local-signer-daemon-plan.md.",
   "type": "module",
   "main": "./daemon.mjs",
@@ -29,7 +29,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node daemon-protocol.smoke.mjs && node daemon-key-exfiltration.smoke.mjs && node kek-backends.smoke.mjs && node service-installer.smoke.mjs && node daemon-envelope-parity.smoke.mjs && node daemon-admin-socket.smoke.mjs && node daemon-log-integrity.smoke.mjs && node daemon-socket-permissions.smoke.mjs && node daemon-hardening.smoke.mjs && node daemon-hardening-tier2.smoke.mjs && node log-anchor.smoke.mjs && node migrate.smoke.mjs && node secure-memory.smoke.mjs",
+    "test": "node daemon-protocol.smoke.mjs && node daemon-key-exfiltration.smoke.mjs && node kek-backends.smoke.mjs && node service-installer.smoke.mjs && node daemon-envelope-parity.smoke.mjs && node daemon-jurisdiction.smoke.mjs && node daemon-admin-socket.smoke.mjs && node daemon-log-integrity.smoke.mjs && node daemon-socket-permissions.smoke.mjs && node daemon-hardening.smoke.mjs && node daemon-hardening-tier2.smoke.mjs && node log-anchor.smoke.mjs && node migrate.smoke.mjs && node secure-memory.smoke.mjs",
     "start": "node cli.mjs"
   },
   "dependencies": {

package/policy-core.mjs

@@ -411,6 +411,10 @@ function requiredContextFor(predicates) {
 
 // src/policy-core/standards-rules.ts
 var CONTEXT_UNVERIFIABLE = "CONTEXT_UNVERIFIABLE";
+var JURISDICTION_ATOM = "jurisdiction-not-allowed";
+function documentEnforcesJurisdiction(doc) {
+  return (doc?.molecules ?? []).some((m) => m?.decision !== "observe" && (m?.atoms ?? []).some((a) => a?.predicate === JURISDICTION_ATOM));
+}
 var PRECEDENCE = { allow: 0, observe: 1, escalate: 2, block: 3, suspend: 4, quarantine: 5, decommission: 6 };
 function atomFires(atom, ctx) {
   const pred = ATOM_REGISTRY[atom.predicate];
@@ -489,7 +493,7 @@ function evaluateBoundStandards(standards, ctx) {
     const r = evaluateStandardRules(s.document?.molecules, ctx, s.standardKey);
     if (PRECEDENCE[r.decision] > PRECEDENCE[best.decision]) best = r;
   }
-  return best;
+  return standards.some((s) => documentEnforcesJurisdiction(s.document)) ? { ...best, jurisdictionRequired: true } : best;
 }
 function configValueValid(field, value) {
   switch (field.type) {
@@ -587,12 +591,17 @@ var REASON_BY_OPERAND = {
   "mm:counterparty": "COUNTERPARTY_NOT_ALLOWED"
 };
 var AMOUNT_OPERANDS = /* @__PURE__ */ new Set(["mm:payAmount", "mm:cumulativeSpend"]);
+var JURISDICTION_OPERANDS = /* @__PURE__ */ new Set(["mm:jurisdiction", "jurisdiction"]);
 function reasonFor(constraint, req) {
   if (!constraint) return "CONSTRAINT_FAILED";
   const { leftOperand } = constraint;
   if (AMOUNT_OPERANDS.has(leftOperand) && !Object.prototype.hasOwnProperty.call(req.values, leftOperand)) {
     return "AMOUNT_NOT_DETERMINABLE";
   }
+  if (JURISDICTION_OPERANDS.has(leftOperand)) {
+    const v = req.values[leftOperand];
+    return v === void 0 || v === null || v === "" ? "JURISDICTION_REQUIRED" : "JURISDICTION_NOT_ALLOWED";
+  }
   return REASON_BY_OPERAND[leftOperand] ?? `CONSTRAINT_FAILED:${leftOperand}`;
 }
 function constraintSatisfied(c, req, strict) {
@@ -703,11 +712,14 @@ function evaluate(input) {
 }
 
 // src/policy-core/canonical.ts
+var AUTH_MESSAGE_V2_TAG = "MAGP-AUTH-v2";
 function escapeField(v) {
   return v.replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
 }
 function buildAuthMessage(f) {
-  return [f.agentDid, f.action, f.amount, f.currency, f.merchant ?? "", f.resource ?? "", f.nonce, f.issuedAt].map((v) => escapeField(String(v))).join("|");
+  const v1 = [f.agentDid, f.action, f.amount, f.currency, f.merchant ?? "", f.resource ?? "", f.nonce, f.issuedAt];
+  const fields = f.jurisdiction === void 0 || f.jurisdiction === null ? v1 : [...v1, AUTH_MESSAGE_V2_TAG, f.jurisdiction];
+  return fields.map((v) => escapeField(String(v))).join("|");
 }
 function buildLegacyAuthMessageV1(f) {
   return [f.agentDid, f.action, f.amount, f.currency, f.merchant ?? "", f.nonce, f.issuedAt].map((v) => escapeField(String(v))).join("|");
@@ -768,8 +780,10 @@ export {
   ATOM_DEFAULT_REQUIRED_CONTEXT,
   ATOM_REGISTRY,
   ATOM_SPECS,
+  AUTH_MESSAGE_V2_TAG,
   CATALOGUED_ATOMS,
   CONTEXT_UNVERIFIABLE,
+  JURISDICTION_ATOM,
   MODES_BY_RANK,
   MODE_RANK,
   PROVENANCE_KEY,
@@ -789,6 +803,7 @@ export {
   buildRuleContext,
   canAuthorize,
   contextFieldProblem,
+  documentEnforcesJurisdiction,
   evaluate,
   evaluateBoundStandards,
   evaluateMandate,