@suveren/gateway 0.12.0 → 0.13.1

package/profiles/purchase/0.6.profile.json

@@ -0,0 +1,234 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/purchase@0.6",
+  "name": "Purchase",
+  "version": "0.6",
+  "description": "Purchase authority — governs spending company money: subscriptions, supplies, services, advertising",
+  "boundsSchema": {
+    "actionTypes": [
+      "purchase"
+    ],
+    "keyOrder": [
+      "profile",
+      "spend_max",
+      "spend_daily_max",
+      "spend_monthly_max",
+      "transaction_count_daily_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "spend_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max per transaction",
+        "description": "Maximum spend per transaction in currency units",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "spend",
+          "requiredFor": [
+            "purchase"
+          ]
+        }
+      },
+      "spend_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily spend limit",
+        "description": "Maximum cumulative spend per day in currency units",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "cumulative_sum",
+          "of": "spend",
+          "window": "daily"
+        }
+      },
+      "spend_monthly_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Monthly spend limit",
+        "description": "Maximum cumulative spend per month in currency units",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "cumulative_sum",
+          "of": "spend",
+          "window": "monthly"
+        }
+      },
+      "transaction_count_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily transaction limit",
+        "description": "Maximum number of purchase transactions per day",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "purchase"
+        ]
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "currency",
+      "category",
+      "allowed_vendors"
+    ],
+    "fields": {
+      "currency": {
+        "type": "string",
+        "required": true,
+        "displayName": "Currency",
+        "description": "Permitted currency code",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        },
+        "enum": [
+          "USD",
+          "EUR",
+          "GBP",
+          "CHF",
+          "JPY",
+          "CAD",
+          "AUD"
+        ]
+      },
+      "category": {
+        "type": "string",
+        "required": true,
+        "displayName": "Purchase category",
+        "description": "Authorized purchase category",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        },
+        "enum": [
+          "subscription",
+          "supply",
+          "service",
+          "advertising"
+        ]
+      },
+      "allowed_vendors": {
+        "type": "string",
+        "required": false,
+        "displayName": "Allowed vendors",
+        "description": "Comma-separated list of approved vendor names",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "spend": {
+        "source": "declared",
+        "description": "Purchase amount in currency units",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "currency": {
+        "source": "declared",
+        "description": "Currency code",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        }
+      },
+      "category": {
+        "source": "declared",
+        "description": "Purchase category",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        }
+      },
+      "allowed_vendors": {
+        "source": "declared",
+        "description": "Vendor name for this purchase (checked against approved list)",
+        "required": false,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "spend_daily": {
+        "source": "cumulative",
+        "cumulativeField": "spend",
+        "window": "daily",
+        "description": "Running daily spend total (resolved from execution log)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "spend_monthly": {
+        "source": "cumulative",
+        "cumulativeField": "spend",
+        "window": "monthly",
+        "description": "Running monthly spend total (resolved from execution log)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "transaction_count_daily": {
+        "source": "cumulative",
+        "cumulativeField": "_count",
+        "window": "daily",
+        "description": "Running daily transaction count (resolved from execution log)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 2592000
+  },
+  "retention_minimum": 7776000
+}

package/profiles/sales/0.3.profile.json

@@ -0,0 +1,290 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/sales@0.3",
+  "name": "Sales",
+  "version": "0.3",
+  "description": "Sales authority — governs quote-to-order in an ERP: draft quotes, send quotes to customers, convert quotes to orders. No invoicing, delivery, payments or master data.",
+  "boundsSchema": {
+    "actionTypes": [
+      "quote",
+      "send",
+      "order",
+      "setup"
+    ],
+    "keyOrder": [
+      "profile",
+      "read_access",
+      "value_max",
+      "discount_max",
+      "order_value_daily_max",
+      "quote_daily_max",
+      "send_daily_max",
+      "order_daily_max",
+      "setup_daily_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "read_access": {
+        "type": "string",
+        "required": true,
+        "displayName": "Read access",
+        "description": "Allow the agent to look up items, stock, list prices, customers (incl. credit limit and open balance), quotes and orders.",
+        "boundType": {
+          "kind": "enum",
+          "values": [
+            "unlimited",
+            "none"
+          ]
+        },
+        "toolsDescription": "list_items, get_item, find_customers, get_customer, list_quotes, get_quote, list_orders, get_order",
+        "default": "unlimited"
+      },
+      "value_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max value per quote or order",
+        "description": "Maximum net document total of a single quote or order, in currency units. The connector recalculates the total from the lines and refuses a call whose declared value does not match.",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "value",
+          "requiredFor": [
+            "quote",
+            "order"
+          ]
+        }
+      },
+      "discount_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max discount",
+        "description": "Maximum document discount against list price, in percent. 0 means list price only. The connector recalculates the discount from list prices and refuses a call whose declared discount does not match.",
+        "unit": "percent",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "discount_pct",
+          "requiredFor": [
+            "quote",
+            "order"
+          ]
+        }
+      },
+      "order_value_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily order value",
+        "description": "Maximum cumulative net value of orders created per day, in currency units.",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "cumulative_sum",
+          "of": "value",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "order"
+        ]
+      },
+      "quote_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Quotes per day",
+        "description": "Maximum draft quotes created or edited per day",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "quote"
+        ]
+      },
+      "send_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Quotes sent per day",
+        "description": "Maximum quotes sent to customers per day. Sending a quote is a binding offer.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "send"
+        ]
+      },
+      "order_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Orders per day",
+        "description": "Maximum quotes converted to orders per day. An order reserves stock and commits a delivery date.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "order"
+        ]
+      },
+      "setup_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Test-data loads per day",
+        "description": "How many times per day the simulated system may be loaded with a simulation package (load_simulation). Only works while the connector runs in simulation mode, and only into an empty system — a load cannot edit or replace existing test data. 0 = not allowed. Grant it only in a separate setup mandate, never in the mandate the AI uses for its work.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "setup"
+        ],
+        "default": 0
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "currency"
+    ],
+    "fields": {
+      "currency": {
+        "type": "string",
+        "required": true,
+        "displayName": "Currency",
+        "description": "Permitted document currency",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        },
+        "enum": [
+          "EUR",
+          "CHF",
+          "USD",
+          "GBP"
+        ]
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "value": {
+        "source": "declared",
+        "description": "Net document total in currency units (verified by the connector against the lines)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "discount_pct": {
+        "source": "declared",
+        "description": "Document discount against list price in percent (verified by the connector against list prices)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "currency": {
+        "source": "declared",
+        "description": "Document currency",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        }
+      },
+      "order_value_daily": {
+        "source": "cumulative",
+        "description": "Running daily order value (resolved from execution log)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "value",
+        "window": "daily"
+      },
+      "quote_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily quote count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "send_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily send count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "order_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily order count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "setup_count_daily": {
+        "source": "cumulative",
+        "cumulativeField": "_count",
+        "window": "daily",
+        "description": "Running daily count of test-data loads",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 2592000
+  },
+  "retention_minimum": 7776000,
+  "content_binding": {
+    "version": "1",
+    "kind": "jcs"
+  }
+}

package/server.js

@@ -12,7 +12,8 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir, tmpdir, constants as osConstants } from 'node:os';
 import { existsSync, mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { resolveCaFile, resolveSimulation } from './lib/config.mjs';
+import { resolveCaFile, resolveProxyUrl, resolveSimulation } from './lib/config.mjs';
+import { readPolicy, isPolicyLocked } from './lib/policy.mjs';
 import { unsupportedNodeReason } from './lib/node-version.mjs';
 
 // Docker and the login service start this file directly, not through the CLI,
@@ -121,6 +122,43 @@ if (savedCaFile && !process.env.SUVEREN_CA_REEXEC_DONE) {
 // via `...process.env`, all the way down to individual integrations.
 delete process.env.SUVEREN_CA_REEXEC_DONE;
 
+// ─── Corporate proxy (`config set proxy <url>` / `--proxy` / IT policy) ────
+//
+// `HTTP_PROXY`/`HTTPS_PROXY` are read fresh on every outbound call (see
+// proxy-env.ts in both apps) — unlike NODE_EXTRA_CA_CERTS above, there is no
+// Node-startup-time requirement, so no re-exec dance is needed here.
+//
+// Two different precedence rules apply, because `resolveProxyUrl` already
+// folds IT policy ahead of the saved value (see config.mjs):
+//   - IT policy LOCKED (`Proxy` — see lib/policy.mjs): OVERRIDES an
+//     operator's own HTTP_PROXY/HTTPS_PROXY unconditionally — "locked"
+//     means locked even against a pre-existing env var, the one case among
+//     all the policy-able settings where there IS a meaningful env tier to
+//     override (every other locked key has none to begin with). This is
+//     the Windows-company-laptop case: the proxy lives in system settings,
+//     not an env var an employee thinks to set.
+//   - Otherwise (a plain saved `config set proxy`): fills in whichever of
+//     HTTP_PROXY/HTTPS_PROXY is still unset — an operator's own value
+//     always wins, same as every other env-vs-saved precedence here.
+const resolvedProxyUrl = resolveProxyUrl(DATA_DIR);
+if (resolvedProxyUrl) {
+  if (isPolicyLocked('proxy')) {
+    process.env.HTTP_PROXY = resolvedProxyUrl;
+    process.env.HTTPS_PROXY = resolvedProxyUrl;
+  } else {
+    process.env.HTTP_PROXY ??= resolvedProxyUrl;
+    process.env.HTTPS_PROXY ??= resolvedProxyUrl;
+  }
+}
+
+// `NoProxy` has no saved-config/CLI counterpart at all (see policy.mjs) —
+// NO_PROXY stays env-only except for this one IT-policy override, which (like
+// `Proxy` above) overrides an operator's own NO_PROXY unconditionally when set.
+const policyNoProxy = readPolicy().policy.noProxy;
+if (policyNoProxy) {
+  process.env.NO_PROXY = policyNoProxy;
+}
+
 const CP_PORT = process.env.SUVEREN_CP_PORT ?? '3400';
 const MCP_PORT = process.env.SUVEREN_MCP_PORT ?? '3430';
 const UI_DIST = process.env.HAP_UI_DIST ?? join(__dirname, 'dist', 'ui');
@@ -147,13 +185,18 @@ const env = {
   SUVEREN_PROFILES_DIR: PROFILES_DIR,
   // Single shared internal secret so CP↔MCP authenticate the bridge.
   SUVEREN_INTERNAL_SECRET: process.env.SUVEREN_INTERNAL_SECRET ?? randomHex(32),
-  // Simulation mode — same precedence as the CA bundle above: an explicit env
-  // var (set directly, or by `start --simulation` setting process.env for
-  // THIS run — see bundle/bin/suveren-gateway.js) wins; otherwise the saved
-  // config.json value, which is what `suveren-gateway simulation on|off`
-  // changes for every future start/restart, including autostart (which
-  // spawns this file directly, bypassing the CLI's own flag handling).
-  SUVEREN_SIMULATION: process.env.SUVEREN_SIMULATION ?? (resolveSimulation(DATA_DIR) ? '1' : '0'),
+  // Simulation mode — IT policy (see lib/policy.mjs) wins UNCONDITIONALLY,
+  // ahead of even an explicit env var: that is what "locked" means. Below
+  // that: an explicit env var (set directly, or by `start --simulation`
+  // setting process.env for THIS run — see bundle/bin/suveren-gateway.js)
+  // wins; otherwise the saved config.json value, which is what
+  // `suveren-gateway simulation on|off` changes for every future
+  // start/restart, including autostart (which spawns this file directly,
+  // bypassing the CLI's own flag handling).
+  SUVEREN_SIMULATION:
+    readPolicy().policy.simulation !== undefined
+      ? (readPolicy().policy.simulation ? '1' : '0')
+      : (process.env.SUVEREN_SIMULATION ?? (resolveSimulation(DATA_DIR) ? '1' : '0')),
   // Passed by the login service (see bundle/lib/autostart-templates.mjs) so the
   // control-plane knows a human is NOT sitting in front of a terminal watching
   // it start — that is when a locked gateway needs to announce itself.