@suveren/gateway 0.13.0 → 0.13.1

package/README.md

@@ -89,7 +89,7 @@ No credentials. No signing keys. Just the scope of what the agent is allowed to
 
 ## Quick Start
 
-Pick whichever you have on hand — both produce the same gateway.
+Pick whichever fits — all three produce the same gateway. For company laptops managed by IT, use Option C.
 
 ### Option A — Docker
 
@@ -99,7 +99,7 @@ Requires [Docker](https://docs.docker.com/get-docker/).
 docker run -d --name suveren-gateway \
   -p 7400:3000 -p 7430:3030 \
   -v $HOME/.suveren:/app/data \
-  ghcr.io/humanagencyprotocol/suveren-gateway
+  ghcr.io/suverenai/suveren-gateway
 ```
 
 Open `http://localhost:7400`. The MCP server is at `http://localhost:7430`.
@@ -130,9 +130,23 @@ suveren-gateway restart
 PowerShell 5.1, which is what ships with Windows. Use `;` there if you want
 them on one line.)
 
+### Option C — Windows installer (company laptops)
+
+For laptops managed by a company's IT: no admin rights, no Node.js and no access to the public npm registry needed. Every [GitHub Release](https://github.com/suverenai/suveren-gateway/releases) from 0.13.0 on carries:
+
+| File | What it is |
+|---|---|
+| `suveren-gateway-<version>-windows-unsigned.msi` | Per-user installer: the gateway, its own Node.js and the tested connector versions — nothing is downloaded at runtime |
+| `suveren-gateway-<version>-windows-signing-kit.zip` | The unpacked contents, the installer source and `build-signed.ps1`, so IT can sign every file with its own certificate and rebuild the `.msi` |
+| `SHA256SUMS` | Checksums of both files |
+
+**The installer is not signed by us.** IT checks where it comes from (`sha256sum -c SHA256SUMS` and `gh attestation verify <file> -R suverenai/suveren-gateway`, which shows the exact commit it was built from), signs it, and distributes it, e.g. with Intune. IT can preset the Authority Server, simulation mode, proxy and certificate centrally; the employee cannot change them, and updates come from IT. Step by step: [Windows IT guide](docs/windows-it-guide.md) · settings: [Managed settings](docs/managed-settings.md).
+
+Open `http://localhost:3400` (Start menu: *Suveren Gateway*). The MCP server is at `http://localhost:3430`.
+
 ### Connecting an MCP client
 
-Either path exposes the same MCP transports — use the port from the path you chose (7430 for Docker, 3430 for npm):
+Every option exposes the same MCP transports — use the port from the option you chose (7430 for Docker, 3430 for npm and the Windows installer):
 
 ```
 Streamable HTTP:  POST http://localhost:<port>/mcp
@@ -263,6 +277,8 @@ for the full command reference.
 | [Authorization Flow](docs/authorization-flow.md) | Data flow, gate wizard, tool execution, agent context |
 | [Security Model](docs/security.md) | Enforcement layers, verification, encryption, fail-closed design |
 | [Development](docs/development.md) | Local setup, env vars, Docker, testing |
+| [Windows IT guide](docs/windows-it-guide.md) | Verify, sign and distribute the Windows installer; network and updates |
+| [Managed settings](docs/managed-settings.md) | Settings IT presets and locks (registry or policy file) |
 
 ---
 

package/dist/mcp-server/http.mjs

@@ -2202,7 +2202,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z as z2 } from "zod";
 
 // src/lib/mandate-brief.ts
-import { getProfile } from "@hap/core";
+import { getProfile as getProfile3 } from "@hap/core";
 
 // src/lib/consumption.ts
 import { boundActionTypes } from "@hap/core";
@@ -2296,87 +2296,16 @@ function getContextForBrief(dataDir2) {
   return { brief: truncated, truncated: true };
 }
 
-// src/lib/mandate-brief.ts
-function shortProfileName(profileId) {
-  const withoutVersion = profileId.replace(/@.*$/, "");
-  const parts = withoutVersion.split("/");
-  return parts[parts.length - 1];
-}
-function countToolsByGating(profileId, integrationManager2) {
-  if (!integrationManager2) return { gated: 0, readOnly: 0 };
-  const allTools = integrationManager2.getAllTools();
-  let gated = 0;
-  let readOnly = 0;
-  for (const tool of allTools) {
-    if (!tool.gating || !tool.gating.profile) {
-      readOnly++;
-    } else if (tool.gating.profile === profileId || tool.gating.profile === shortProfileName(profileId)) {
-      if (tool.gating.staticExecution?.action_type === "read" && Object.keys(tool.gating.executionMapping ?? {}).length === 0) {
-        readOnly++;
-      } else {
-        gated++;
-      }
-    }
-  }
-  return { gated, readOnly };
+// src/lib/simulation-mode.ts
+function isSimulationMode() {
+  const policySimulation = readPolicy().policy.simulation;
+  if (policySimulation !== void 0) return policySimulation;
+  return process.env.SUVEREN_SIMULATION === "1";
 }
-function buildMandateBrief(opts) {
-  const { authorizations, executionLog, integrationManager: integrationManager2, contextDir } = opts;
-  const lines = [
-    "You are connected to Suveren \u2014 the gateway that gates every privileged tool call you make.",
-    "Suveren implements the bounded-authority model from the open Human Agency Protocol (HAP).",
-    "You have bounded authorities granted by human decision owners.",
-    "You MUST stay within these bounds \u2014 the Gatekeeper will reject actions that exceed them."
-  ];
-  const { brief: contextBrief } = getContextForBrief(contextDir);
-  if (contextBrief) {
-    lines.push("");
-    lines.push("=== CONTEXT ===");
-    lines.push("");
-    lines.push(contextBrief);
-  }
-  const active = authorizations.filter((a) => a.complete);
-  const pending = authorizations.filter((a) => !a.complete);
-  const now = Math.floor(Date.now() / 1e3);
-  if (active.length > 0) {
-    lines.push("");
-    lines.push("=== ACTIVE AUTHORITIES ===");
-    lines.push("");
-    for (const auth of active) {
-      const earliestExpiry = Math.min(...auth.attestations.map((a) => a.expiresAt));
-      const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
-      const shortName = shortProfileName(auth.profileId);
-      const version = auth.profileId.match(/@(.+)$/)?.[1] ?? "";
-      const shortId = version ? `${shortName}@${version}` : shortName;
-      const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}:${value}`).join(" \xB7 ");
-      const parts = [];
-      if (boundsDesc) parts.push(boundsDesc);
-      if (executionLog) {
-        const profile = getProfile(auth.profileId) ?? getProfile(shortName);
-        const consumption = getConsumptionState(auth, executionLog, profile);
-        const compact = formatConsumptionCompact(consumption);
-        if (compact) parts.push(compact);
-      }
-      const { gated, readOnly } = countToolsByGating(auth.profileId, integrationManager2);
-      if (gated > 0 || readOnly > 0) parts.push(`${gated} gated tools`);
-      parts.push(`${remainingMin} min remaining`);
-      lines.push(`[${shortId}] ${parts.join(" \xB7 ")}`);
-      lines.push(`  \u2192 list-authorizations(domain: "${shortName}") for intent & details`);
-      lines.push("");
-    }
-  }
-  if (pending.length > 0) {
-    lines.push("=== PENDING (awaiting attestations) ===");
-    lines.push("");
-    for (const auth of pending) {
-      const missing = auth.requiredDomains.filter((d) => !auth.attestedDomains.includes(d));
-      lines.push(`[${auth.path}] ${auth.profileId} \u2014 needs: ${missing.join(", ")}`);
-    }
-    lines.push("");
-  }
-  lines.push("When you receive a task, call list-authorizations(domain) to load full details for the relevant domain.");
-  return lines.join("\n");
+function manifestIsSimulated(manifest) {
+  return Boolean(manifest?.simulation);
 }
+var SIMULATION_BLOCK_REASON = "blocked: simulation mode \u2014 real systems are off";
 
 // src/lib/locked-notice.ts
 function uiUrl() {
@@ -2426,9 +2355,6 @@ function lockedNotice(action, reason = "restart") {
   }
 }
 
-// src/tools/authorizations.ts
-import { getProfile as getProfile4 } from "@hap/core";
-
 // src/lib/receipt-footer.ts
 import { deriveIdentityLine } from "@hap/core";
 var AS_BASE = (process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai").replace(/\/$/, "");
@@ -2490,10 +2416,10 @@ import {
   selectBoundFields,
   isFieldBinding,
   bindingAppliesTo,
-  getProfile as getProfile2
+  getProfile
 } from "@hap/core";
 function getContentBinding(profileId) {
-  return getProfile2(profileId)?.content_binding;
+  return getProfile(profileId)?.content_binding;
 }
 function computeContentBinding(profileId, tool, toolArgs, actionType) {
   const binding = getContentBinding(profileId);
@@ -2913,7 +2839,7 @@ function clampAgeFloor(requested, maxAgeDays, nowMs, format = "iso") {
 }
 
 // src/lib/tool-proxy.ts
-import { getProfile as getProfile3, ContentBindingError, boundActionTypes as boundActionTypes2 } from "@hap/core";
+import { getProfile as getProfile2, ContentBindingError, boundActionTypes as boundActionTypes2 } from "@hap/core";
 import { readFile } from "fs/promises";
 import { extname } from "path";
 import { randomUUID } from "crypto";
@@ -2978,17 +2904,6 @@ function getAllManifests() {
   return Array.from(manifests.values());
 }
 
-// src/lib/simulation-mode.ts
-function isSimulationMode() {
-  const policySimulation = readPolicy().policy.simulation;
-  if (policySimulation !== void 0) return policySimulation;
-  return process.env.SUVEREN_SIMULATION === "1";
-}
-function manifestIsSimulated(manifest) {
-  return Boolean(manifest?.simulation);
-}
-var SIMULATION_BLOCK_REASON = "blocked: simulation mode \u2014 real systems are off";
-
 // src/lib/tool-proxy.ts
 var IMAGE_MIME = {
   ".jpg": "image/jpeg",
@@ -3050,7 +2965,7 @@ function profileMatches(profileId, shortName) {
   return profileId === shortName || profileId.includes("/" + shortName + "@") || profileId.endsWith("/" + shortName);
 }
 function countBoundsFor(profileId, actionType) {
-  const fields = getProfile3(profileId)?.boundsSchema?.fields;
+  const fields = getProfile2(profileId)?.boundsSchema?.fields;
   if (!fields) return null;
   return Object.entries(fields).filter(([, def]) => def.boundType?.kind === "cumulative_count").filter(([name, def]) => {
     const applies = boundActionTypes2(name, def);
@@ -3110,7 +3025,7 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
     return async () => ({
       content: [{
         type: "text",
-        text: `Refused: "${tool.namespacedName}" talks to a real system, but this gateway is running in simulation mode (real systems are off). No ticket was requested.`
+        text: `Refused: "${tool.namespacedName}" is not available. No ticket was requested.`
       }],
       isError: true
     });
@@ -3131,6 +3046,17 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
     };
   };
 }
+function isStaleMandateRefusal(err) {
+  const errors = err.body?.errors;
+  const code = errors?.[0]?.code;
+  if (err.statusCode === 403 && (code === "ATTESTATION_REVOKED" || code === "ATTESTATION_EXPIRED")) {
+    return true;
+  }
+  if (err.statusCode === 404 && code === "ATTESTATION_NOT_FOUND") {
+    return true;
+  }
+  return false;
+}
 function createGatedToolHandlerInner(tool, integrationManager2, state2) {
   if (!tool.gating || !tool.gating.profile) {
     return async () => {
@@ -3202,7 +3128,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
           );
         }
       }
-      const readProfile = readAdapter ? getProfile3(matchingAuths[0].profileId) : void 0;
+      const readProfile = readAdapter ? getProfile2(matchingAuths[0].profileId) : void 0;
       const boundsSchema = readProfile?.boundsSchema;
       const ageBoundField = readAdapter?.ageField ? resolveAgeBoundField(boundsSchema, readAdapter.ageField) : null;
       const hasAgeDimension = Boolean(readAdapter?.ageField);
@@ -3358,7 +3284,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
       };
     }
     {
-      const profileDef = getProfile3(profile);
+      const profileDef = getProfile2(profile);
       const registry = profileDef?.boundsSchema?.actionTypes;
       if (Array.isArray(registry) && registry.length > 0 && !registry.includes(declaredActionType)) {
         return {
@@ -3415,23 +3341,24 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
         isError: true
       };
     }
-    const contextKeys = getProfile3(passers[0].profileId)?.contextSchema?.keyOrder ?? [];
-    const selection = selectAuthorization(
-      contextKeys,
-      passers.map((a) => ({
-        id: a.authorizationId,
-        auth: a,
-        context: a.context ?? {},
-        requiresApproval: (a.deferredCommitmentDomains ?? []).length > 0
-      }))
-    );
-    const auth = selection.chosen.auth;
-    if (selection.superseded.length > 0) {
-      console.error(
-        `[Suveren MCP] selection(${tool.namespacedName}): chose ${auth.authorizationId} (${selection.reason}) over [${selection.superseded.map((s) => s.id).join(", ")}]`
+    const contextKeys = getProfile2(passers[0].profileId)?.contextSchema?.keyOrder ?? [];
+    return attemptWithCandidates(passers);
+    async function attemptWithCandidates(candidates) {
+      const selection = selectAuthorization(
+        contextKeys,
+        candidates.map((a) => ({
+          id: a.authorizationId,
+          auth: a,
+          context: a.context ?? {},
+          requiresApproval: (a.deferredCommitmentDomains ?? []).length > 0
+        }))
       );
-    }
-    {
+      const auth = selection.chosen.auth;
+      if (selection.superseded.length > 0) {
+        console.error(
+          `[Suveren MCP] selection(${tool.namespacedName}): chose ${auth.authorizationId} (${selection.reason}) over [${selection.superseded.map((s) => s.id).join(", ")}]`
+        );
+      }
       const authzId = auth.authorizationId;
       if (isCommitmentDowngrade(auth)) {
         return {
@@ -3544,6 +3471,24 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             isError: true
           };
         }
+        if (err instanceof SPReceiptError && isStaleMandateRefusal(err)) {
+          state2.cache.invalidate(auth.authorizationId);
+          const code = err.body?.errors?.[0]?.code ?? "unknown";
+          const remaining = candidates.filter((c) => c.authorizationId !== auth.authorizationId);
+          if (remaining.length === 0) {
+            console.error(
+              `[Suveren MCP] fallback(${tool.namespacedName}): mandate ${auth.authorizationId} invalid (${code}) \u2014 no remaining candidates`
+            );
+            return {
+              content: [{ type: "text", text: `Blocked by SP: ${err.message}` }],
+              isError: true
+            };
+          }
+          console.error(
+            `[Suveren MCP] fallback(${tool.namespacedName}): mandate ${auth.authorizationId} invalid (${code}) \u2192 retrying with [${remaining.map((c) => c.authorizationId).join(", ")}]`
+          );
+          return attemptWithCandidates(remaining);
+        }
         if (err instanceof SPReceiptError && err.statusCode === 409) {
           const spBody = err.body;
           let pendingApprovers = spBody.approvers ?? [];
@@ -3700,7 +3645,106 @@ function buildProxiedToolDescription(tool, state2) {
   return `[Suveren: ${profile} \u2014 ${tag}] ${tool.description}`;
 }
 
+// src/lib/agent-visibility.ts
+function agentVisibleAuthorizations(authorizations, integrationManager2) {
+  if (!isSimulationMode()) return authorizations;
+  if (!integrationManager2) return [];
+  const runningProfiles = /* @__PURE__ */ new Set();
+  for (const tool of integrationManager2.getAllTools()) {
+    const profile = tool.gating?.profile;
+    if (profile) runningProfiles.add(profile);
+  }
+  if (runningProfiles.size === 0) return [];
+  return authorizations.filter(
+    (auth) => [...runningProfiles].some((profile) => profileMatches(auth.profileId, profile))
+  );
+}
+
+// src/lib/mandate-brief.ts
+function shortProfileName(profileId) {
+  const withoutVersion = profileId.replace(/@.*$/, "");
+  const parts = withoutVersion.split("/");
+  return parts[parts.length - 1];
+}
+function countToolsByGating(profileId, integrationManager2) {
+  if (!integrationManager2) return { gated: 0, readOnly: 0 };
+  const allTools = integrationManager2.getAllTools();
+  let gated = 0;
+  let readOnly = 0;
+  for (const tool of allTools) {
+    if (!tool.gating || !tool.gating.profile) {
+      readOnly++;
+    } else if (tool.gating.profile === profileId || tool.gating.profile === shortProfileName(profileId)) {
+      if (tool.gating.staticExecution?.action_type === "read" && Object.keys(tool.gating.executionMapping ?? {}).length === 0) {
+        readOnly++;
+      } else {
+        gated++;
+      }
+    }
+  }
+  return { gated, readOnly };
+}
+function buildMandateBrief(opts) {
+  const { executionLog, integrationManager: integrationManager2, contextDir } = opts;
+  const authorizations = agentVisibleAuthorizations(opts.authorizations, integrationManager2);
+  const lines = [
+    "You are connected to Suveren \u2014 the gateway that gates every privileged tool call you make.",
+    "Suveren implements the bounded-authority model from the open Human Agency Protocol (HAP).",
+    "You have bounded authorities granted by human decision owners.",
+    "You MUST stay within these bounds \u2014 the Gatekeeper will reject actions that exceed them."
+  ];
+  const { brief: contextBrief } = getContextForBrief(contextDir);
+  if (contextBrief) {
+    lines.push("");
+    lines.push("=== CONTEXT ===");
+    lines.push("");
+    lines.push(contextBrief);
+  }
+  const active = authorizations.filter((a) => a.complete);
+  const pending = authorizations.filter((a) => !a.complete);
+  const now = Math.floor(Date.now() / 1e3);
+  if (active.length > 0) {
+    lines.push("");
+    lines.push("=== ACTIVE AUTHORITIES ===");
+    lines.push("");
+    for (const auth of active) {
+      const earliestExpiry = Math.min(...auth.attestations.map((a) => a.expiresAt));
+      const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
+      const shortName = shortProfileName(auth.profileId);
+      const version = auth.profileId.match(/@(.+)$/)?.[1] ?? "";
+      const shortId = version ? `${shortName}@${version}` : shortName;
+      const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}:${value}`).join(" \xB7 ");
+      const parts = [];
+      if (boundsDesc) parts.push(boundsDesc);
+      if (executionLog) {
+        const profile = getProfile3(auth.profileId) ?? getProfile3(shortName);
+        const consumption = getConsumptionState(auth, executionLog, profile);
+        const compact = formatConsumptionCompact(consumption);
+        if (compact) parts.push(compact);
+      }
+      const { gated, readOnly } = countToolsByGating(auth.profileId, integrationManager2);
+      if (gated > 0 || readOnly > 0) parts.push(`${gated} gated tools`);
+      parts.push(`${remainingMin} min remaining`);
+      lines.push(`[${shortId}] ${parts.join(" \xB7 ")}`);
+      lines.push(`  \u2192 list-authorizations(domain: "${shortName}") for intent & details`);
+      lines.push("");
+    }
+  }
+  if (pending.length > 0) {
+    lines.push("=== PENDING (awaiting attestations) ===");
+    lines.push("");
+    for (const auth of pending) {
+      const missing = auth.requiredDomains.filter((d) => !auth.attestedDomains.includes(d));
+      lines.push(`[${auth.path}] ${auth.profileId} \u2014 needs: ${missing.join(", ")}`);
+    }
+    lines.push("");
+  }
+  lines.push("When you receive a task, call list-authorizations(domain) to load full details for the relevant domain.");
+  return lines.join("\n");
+}
+
 // src/tools/authorizations.ts
+import { getProfile as getProfile4 } from "@hap/core";
 function shortProfileName2(profileId) {
   const withoutVersion = profileId.replace(/@.*$/, "");
   const parts = withoutVersion.split("/");
@@ -3761,7 +3805,7 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
     if (!state2.spClient.isUnlocked()) {
       return { content: [{ type: "text", text: lockedNotice("list authorizations", state2.spClient.getLockReason() ?? "restart") }] };
     }
-    const authorizations = state2.getEnrichedAuthorizations();
+    const authorizations = agentVisibleAuthorizations(state2.getEnrichedAuthorizations(), integrationManager2);
     const now = Math.floor(Date.now() / 1e3);
     const domain = args?.domain;
     if (authorizations.length === 0) {

package/node_modules/@hap/core/dist/index.d.mts

@@ -205,10 +205,29 @@ type BoundType =
  * Per-transaction cap. The execution context field named in `of` must
  * satisfy `execution[of] <= bound` for the current call. No cumulative
  * tracking. Used by: amount_max, recipient_max, booking_duration_max, etc.
+ *
+ * `requiredFor` (v0.8+) closes the converse: without it, a call that does
+ * not carry `of` at all is simply skipped — a 5,000 cap refuses 6,000 but
+ * permits a call that declares no value whatsoever, which is indistinguishable
+ * from an unenforced bound. The same hole, and the same fix, as
+ * `FieldConstraint.requiredFor` on a scope constraint (below): values drawn
+ * from the profile's `boundsSchema.actionTypes` registry. For a listed
+ * `action_type`, an execution whose context lacks `of` — or whose value is
+ * not a finite number — MUST be refused rather than skipped. For an
+ * unlisted (or when `requiredFor` is absent) action type, today's
+ * skip-on-absence behaviour is unchanged. Meaningful only on
+ * `per_transaction`; the other `BoundType` kinds have no per-call "value
+ * exposed or not" question — `cumulative_sum`/`cumulative_count` always read
+ * from the execution log regardless of what this call declares, and `enum`
+ * is a capability flag, not a runtime value — so the field does not exist
+ * on those variants and a profile that puts it there has it silently
+ * ignored by every enforcement point (TypeScript also refuses it when the
+ * profile is authored against this type rather than raw JSON).
  */
 {
     kind: 'per_transaction';
     of: string;
+    requiredFor?: string[];
 }
 /**
  * Cumulative sum within a time window. The SP maintains a running sum
@@ -503,6 +522,16 @@ interface AgentProfile {
     boundsSchema?: {
         keyOrder: string[];
         fields: Record<string, ProfileBoundsField>;
+        /**
+         * v0.5+ registry of the action types this profile recognizes (e.g.
+         * `["send", "delete", "setup"]`). Every `execution.action_type` the
+         * Authority Server and gateway accept for this profile MUST be a member
+         * when the registry is declared (protocol.md → Bounds Schema, rule 2);
+         * it is also what a `per_transaction` bound's `requiredFor` draws from.
+         * Absent on profiles published before the registry existed — membership
+         * is then uncheckable, not a violation.
+         */
+        actionTypes?: readonly string[];
     };
     /**
      * v0.4 context schema — defines the execution context parameters (e.g., currency, action_type).
@@ -983,6 +1012,25 @@ declare function validateContextParams(params: AgentContextParams, profile: Agen
     valid: boolean;
     errors: string[];
 };
+/**
+ * Authoring-time check for `per_transaction` bound `requiredFor` (v0.8+):
+ * entries must name a real `action_type` from the profile's declared
+ * `boundsSchema.actionTypes` registry, and the field is only meaningful on
+ * `per_transaction` bounds (see `BoundType`'s doc comment for why the other
+ * kinds don't carry it).
+ *
+ * This is NOT wired into `registerProfile` or any enforcement path — nothing
+ * in hap-core validates profile JSON at load time today (the pre-existing
+ * `requiredFor` on a context/scope constraint has the same gap), so adding
+ * an automatic refusal here would be new behaviour beyond this change's
+ * scope. Call it explicitly from an authoring tool, a hap-profiles CI check,
+ * or a test, to catch a `requiredFor` entry that can never match (misspelled
+ * action type) or is attached to a bound kind that silently ignores it.
+ *
+ * Returns an empty array when the profile has no boundsSchema or nothing to
+ * check — never throws.
+ */
+declare function validateBoundsRequiredFor(profile: AgentProfile): string[];
 /**
  * Thrown when a value cannot be canonicalized at all — currently only for raw
  * LF/CR inside a value. Carries the protocol error code so callers can map it
@@ -1353,4 +1401,4 @@ interface ReceiptPayload {
  */
 declare function verifyReceiptSignature(receipt: ReceiptPayload, publicKeyHex: string): Promise<void>;
 
-export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type ApprovalObject, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, CanonicalValueError, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type MandateBinding, MandateError, type MandateProjection, type OwnerMandate, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ReceiptPayload, type ResolvedDomain, type SigningSurface, type Subject, type SubjectValidation, approvalSigningBytes, attestationId, bindingAppliesTo, boundActionTypes, buildMandateProjection, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFieldsContentHash, computeFrameHash, computeIntentDisclosureHash, computeIntentHash, contentCanonicalBytes, decodeAttestationBlob, decodeDidKey, deriveIdentityLine, encodeAttestationBlob, encodeDidKey, frameHash, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isFieldBinding, isKeyBearingDid, isV4Attestation, listProfiles, mandateSigningBytes, registerProfile, selectBoundFields, signApproval, signMandateProjection, validateBoundsParams, validateContextParams, validateFrameParams, validateSubject, verify, verifyApproval, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash, verifyOwnerMandate, verifyOwnerMandates, verifyReceiptSignature };
+export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type ApprovalObject, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, CanonicalValueError, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type MandateBinding, MandateError, type MandateProjection, type OwnerMandate, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ReceiptPayload, type ResolvedDomain, type SigningSurface, type Subject, type SubjectValidation, approvalSigningBytes, attestationId, bindingAppliesTo, boundActionTypes, buildMandateProjection, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFieldsContentHash, computeFrameHash, computeIntentDisclosureHash, computeIntentHash, contentCanonicalBytes, decodeAttestationBlob, decodeDidKey, deriveIdentityLine, encodeAttestationBlob, encodeDidKey, frameHash, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isFieldBinding, isKeyBearingDid, isV4Attestation, listProfiles, mandateSigningBytes, registerProfile, selectBoundFields, signApproval, signMandateProjection, validateBoundsParams, validateBoundsRequiredFor, validateContextParams, validateFrameParams, validateSubject, verify, verifyApproval, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash, verifyOwnerMandate, verifyOwnerMandates, verifyReceiptSignature };

package/node_modules/@hap/core/dist/index.d.ts

@@ -205,10 +205,29 @@ type BoundType =
  * Per-transaction cap. The execution context field named in `of` must
  * satisfy `execution[of] <= bound` for the current call. No cumulative
  * tracking. Used by: amount_max, recipient_max, booking_duration_max, etc.
+ *
+ * `requiredFor` (v0.8+) closes the converse: without it, a call that does
+ * not carry `of` at all is simply skipped — a 5,000 cap refuses 6,000 but
+ * permits a call that declares no value whatsoever, which is indistinguishable
+ * from an unenforced bound. The same hole, and the same fix, as
+ * `FieldConstraint.requiredFor` on a scope constraint (below): values drawn
+ * from the profile's `boundsSchema.actionTypes` registry. For a listed
+ * `action_type`, an execution whose context lacks `of` — or whose value is
+ * not a finite number — MUST be refused rather than skipped. For an
+ * unlisted (or when `requiredFor` is absent) action type, today's
+ * skip-on-absence behaviour is unchanged. Meaningful only on
+ * `per_transaction`; the other `BoundType` kinds have no per-call "value
+ * exposed or not" question — `cumulative_sum`/`cumulative_count` always read
+ * from the execution log regardless of what this call declares, and `enum`
+ * is a capability flag, not a runtime value — so the field does not exist
+ * on those variants and a profile that puts it there has it silently
+ * ignored by every enforcement point (TypeScript also refuses it when the
+ * profile is authored against this type rather than raw JSON).
  */
 {
     kind: 'per_transaction';
     of: string;
+    requiredFor?: string[];
 }
 /**
  * Cumulative sum within a time window. The SP maintains a running sum
@@ -503,6 +522,16 @@ interface AgentProfile {
     boundsSchema?: {
         keyOrder: string[];
         fields: Record<string, ProfileBoundsField>;
+        /**
+         * v0.5+ registry of the action types this profile recognizes (e.g.
+         * `["send", "delete", "setup"]`). Every `execution.action_type` the
+         * Authority Server and gateway accept for this profile MUST be a member
+         * when the registry is declared (protocol.md → Bounds Schema, rule 2);
+         * it is also what a `per_transaction` bound's `requiredFor` draws from.
+         * Absent on profiles published before the registry existed — membership
+         * is then uncheckable, not a violation.
+         */
+        actionTypes?: readonly string[];
     };
     /**
      * v0.4 context schema — defines the execution context parameters (e.g., currency, action_type).
@@ -983,6 +1012,25 @@ declare function validateContextParams(params: AgentContextParams, profile: Agen
     valid: boolean;
     errors: string[];
 };
+/**
+ * Authoring-time check for `per_transaction` bound `requiredFor` (v0.8+):
+ * entries must name a real `action_type` from the profile's declared
+ * `boundsSchema.actionTypes` registry, and the field is only meaningful on
+ * `per_transaction` bounds (see `BoundType`'s doc comment for why the other
+ * kinds don't carry it).
+ *
+ * This is NOT wired into `registerProfile` or any enforcement path — nothing
+ * in hap-core validates profile JSON at load time today (the pre-existing
+ * `requiredFor` on a context/scope constraint has the same gap), so adding
+ * an automatic refusal here would be new behaviour beyond this change's
+ * scope. Call it explicitly from an authoring tool, a hap-profiles CI check,
+ * or a test, to catch a `requiredFor` entry that can never match (misspelled
+ * action type) or is attached to a bound kind that silently ignores it.
+ *
+ * Returns an empty array when the profile has no boundsSchema or nothing to
+ * check — never throws.
+ */
+declare function validateBoundsRequiredFor(profile: AgentProfile): string[];
 /**
  * Thrown when a value cannot be canonicalized at all — currently only for raw
  * LF/CR inside a value. Carries the protocol error code so callers can map it
@@ -1353,4 +1401,4 @@ interface ReceiptPayload {
  */
 declare function verifyReceiptSignature(receipt: ReceiptPayload, publicKeyHex: string): Promise<void>;
 
-export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type ApprovalObject, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, CanonicalValueError, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type MandateBinding, MandateError, type MandateProjection, type OwnerMandate, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ReceiptPayload, type ResolvedDomain, type SigningSurface, type Subject, type SubjectValidation, approvalSigningBytes, attestationId, bindingAppliesTo, boundActionTypes, buildMandateProjection, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFieldsContentHash, computeFrameHash, computeIntentDisclosureHash, computeIntentHash, contentCanonicalBytes, decodeAttestationBlob, decodeDidKey, deriveIdentityLine, encodeAttestationBlob, encodeDidKey, frameHash, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isFieldBinding, isKeyBearingDid, isV4Attestation, listProfiles, mandateSigningBytes, registerProfile, selectBoundFields, signApproval, signMandateProjection, validateBoundsParams, validateContextParams, validateFrameParams, validateSubject, verify, verifyApproval, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash, verifyOwnerMandate, verifyOwnerMandates, verifyReceiptSignature };
+export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type ApprovalObject, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, CanonicalValueError, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type MandateBinding, MandateError, type MandateProjection, type OwnerMandate, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ReceiptPayload, type ResolvedDomain, type SigningSurface, type Subject, type SubjectValidation, approvalSigningBytes, attestationId, bindingAppliesTo, boundActionTypes, buildMandateProjection, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFieldsContentHash, computeFrameHash, computeIntentDisclosureHash, computeIntentHash, contentCanonicalBytes, decodeAttestationBlob, decodeDidKey, deriveIdentityLine, encodeAttestationBlob, encodeDidKey, frameHash, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isFieldBinding, isKeyBearingDid, isV4Attestation, listProfiles, mandateSigningBytes, registerProfile, selectBoundFields, signApproval, signMandateProjection, validateBoundsParams, validateBoundsRequiredFor, validateContextParams, validateFrameParams, validateSubject, verify, verifyApproval, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash, verifyOwnerMandate, verifyOwnerMandates, verifyReceiptSignature };