@suveren/gateway 0.19.0 → 0.19.2

package/dist/ui/index.html

@@ -14,7 +14,7 @@
     <meta name="apple-mobile-web-app-title" content="Suveren" />
     <meta name="theme-color" content="#111111" />
     <title>Suveren</title>
-    <script type="module" crossorigin src="/assets/index-DeQPO4Sj.js"></script>
+    <script type="module" crossorigin src="/assets/index-BE0Yn5xB.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-kObsFuwK.css">
   </head>
   <body>

package/lib/install-settings.d.mts

@@ -0,0 +1,41 @@
+/**
+ * Types for the plain-ESM install-settings module (ports + data folder).
+ * See config.d.mts for why the .mjs modules carry declarations.
+ */
+
+export declare const DEFAULT_CP_PORT: number;
+export declare const DEFAULT_MCP_PORT: number;
+export declare function defaultDataDir(): string;
+
+export declare function validatePort(candidate: unknown): { ok: true; port: number } | { ok: false; error: string };
+export declare function validateDataDir(candidate: unknown): { ok: true; path: string } | { ok: false; error: string };
+
+export interface SavedInstallSettings {
+  cpPort?: string;
+  mcpPort?: string;
+  dataDir?: string;
+}
+
+export declare function installSettingsFilePath(): string | null;
+export declare function installSettingsLocation(): string;
+export declare function installSettingsRegistryKey(): string;
+export declare function parseInstallSettingsRegQuery(stdout: string): SavedInstallSettings;
+export declare function readInstallSettings(): SavedInstallSettings;
+export declare function writeInstallSettings(patch: {
+  cpPort?: number | null;
+  mcpPort?: number | null;
+  dataDir?: string | null;
+}): void;
+
+export type InstallSettingSource = 'policy' | 'env' | 'saved' | 'default';
+
+export interface ResolvedInstallSettings {
+  cpPort: number;
+  mcpPort: number;
+  dataDir: string;
+  source: { cpPort: InstallSettingSource; mcpPort: InstallSettingSource; dataDir: InstallSettingSource };
+  errors: string[];
+}
+
+export declare function resolveInstallSettings(opts?: { tolerant?: boolean }): ResolvedInstallSettings;
+export declare function describeSource(source: InstallSettingSource, field: 'cpPort' | 'mcpPort' | 'dataDir'): string;

package/lib/install-settings.mjs

@@ -0,0 +1,318 @@
+/**
+ * Install settings — the gateway's two ports and its data folder, saved per
+ * user so a chosen value survives a reboot and every command agrees on it.
+ *
+ * Before this, all three were environment-only (SUVEREN_CP_PORT,
+ * SUVEREN_MCP_PORT, SUVEREN_DATA_DIR). That never reached the login task on
+ * Windows (Task Scheduler carries no environment), so a custom port or
+ * folder was silently lost after a reboot; and `status`/`stop`/the Start
+ * Menu entry looked at 3400 unless the variable was set in that very shell.
+ *
+ * They cannot live in `<dataDir>/config.json` like the other settings — the
+ * gateway has to know the data folder before it can read anything in it.
+ * So they get their own place outside it:
+ *
+ *   - Windows: `HKCU\Software\Suveren\Gateway`, values `Port`, `McpPort`,
+ *     `DataDir` (REG_SZ). The installer writes them from its PORT /
+ *     MCP_PORT / DATA_DIR properties (bundle/windows/wix/Product.wxs);
+ *     `config set` writes the same values with `reg add`.
+ *   - macOS: `~/Library/Application Support/Suveren/gateway.json`
+ *   - Linux: `$XDG_CONFIG_HOME/suveren/gateway.json` (default ~/.config)
+ *   - Any platform: `SUVEREN_INSTALL_SETTINGS_FILE` forces the JSON file at
+ *     that path — tests set it (see each app's vitest.setup.ts) so they never
+ *     touch the real registry or the real per-user file.
+ *
+ * Precedence, per setting: IT policy (`Port`, `McpPort`, `DataDir` — see
+ * policy.mjs; locked) > env var > saved install setting > default.
+ *
+ * Resolved ONLY here, by the CLI and by bundle/server.js. server.js passes
+ * the result to its children as SUVEREN_CP_PORT / SUVEREN_MCP_PORT /
+ * SUVEREN_DATA_DIR, so the two apps keep reading plain env vars and need no
+ * copy of this module (unlike config.mjs / policy.mjs, which they mirror).
+ */
+
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { readPolicy } from './policy.mjs';
+
+export const DEFAULT_CP_PORT = 3400;
+export const DEFAULT_MCP_PORT = 3430;
+
+export function defaultDataDir() {
+  return join(homedir(), '.suveren');
+}
+
+/** Saved-setting name ↔ registry value name ↔ env var. */
+const FIELDS = {
+  cpPort: { reg: 'Port', env: 'SUVEREN_CP_PORT', label: 'port' },
+  mcpPort: { reg: 'McpPort', env: 'SUVEREN_MCP_PORT', label: 'mcp-port' },
+  dataDir: { reg: 'DataDir', env: 'SUVEREN_DATA_DIR', label: 'data-dir' },
+};
+
+// ─── Validation ─────────────────────────────────────────────────────────
+
+/**
+ * A port someone chose to SAVE (CLI, installer, IT policy): 1024–65535.
+ * Below 1024 needs root on macOS/Linux and is reserved for system services —
+ * a gateway that silently cannot bind there is worse than a refusal now.
+ */
+export function validatePort(candidate) {
+  const raw = String(candidate ?? '').trim();
+  if (!/^\d+$/.test(raw)) return { ok: false, error: `"${raw}" is not a port number.` };
+  const port = Number(raw);
+  if (port < 1024 || port > 65535) {
+    return { ok: false, error: `${port} is outside 1024–65535.` };
+  }
+  return { ok: true, port };
+}
+
+/**
+ * An env-var port: any valid TCP port (1–65535). Looser than validatePort on
+ * purpose — the Docker image runs on 3000/3030 and dev setups have always
+ * been free to pick anything; only "not a number at all" is refused.
+ */
+function validateEnvPort(candidate) {
+  const raw = String(candidate).trim();
+  if (!/^\d+$/.test(raw)) return { ok: false, error: `"${raw}" is not a port number.` };
+  const port = Number(raw);
+  if (port < 1 || port > 65535) return { ok: false, error: `${port} is outside 1–65535.` };
+  return { ok: true, port };
+}
+
+/**
+ * A data folder someone chose to SAVE: must be an ABSOLUTE path (a relative
+ * one would resolve differently for the login service than for the shell
+ * that saved it), and must not be an existing file. It need not exist yet —
+ * the gateway creates it on start.
+ */
+export function validateDataDir(candidate) {
+  const raw = String(candidate ?? '').trim();
+  if (!raw) return { ok: false, error: 'The data folder path is empty.' };
+  if (!isAbsolute(raw)) return { ok: false, error: `"${raw}" is not a full path (it must start at a drive or at /).` };
+  const path = resolve(raw);
+  if (existsSync(path) && !statSync(path).isDirectory()) {
+    return { ok: false, error: `"${path}" is a file, not a folder.` };
+  }
+  return { ok: true, path };
+}
+
+// ─── Storage ────────────────────────────────────────────────────────────
+
+export function installSettingsFilePath() {
+  if (process.env.SUVEREN_INSTALL_SETTINGS_FILE) return process.env.SUVEREN_INSTALL_SETTINGS_FILE;
+  if (process.platform === 'win32') return null; // registry — see installSettingsRegistryKey
+  if (process.platform === 'darwin') {
+    return join(homedir(), 'Library', 'Application Support', 'Suveren', 'gateway.json');
+  }
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+  return join(base, 'suveren', 'gateway.json');
+}
+
+/** Where the settings live, for messages. */
+export function installSettingsLocation() {
+  const file = installSettingsFilePath();
+  return file ?? `the registry (${installSettingsRegistryKey()})`;
+}
+
+export function installSettingsRegistryKey() {
+  return 'HKCU\\Software\\Suveren\\Gateway';
+}
+
+/** Parse `reg query` output down to the three values this module owns. */
+export function parseInstallSettingsRegQuery(stdout) {
+  const out = {};
+  const lineRe = /^ {4}(\S+)\s+(REG_SZ|REG_EXPAND_SZ|REG_DWORD)\s*(.*)$/;
+  for (const line of stdout.split(/\r?\n/)) {
+    const m = lineRe.exec(line);
+    if (!m) continue;
+    const [, name, type, rawValue] = m;
+    const field = Object.keys(FIELDS).find((k) => FIELDS[k].reg === name);
+    if (!field) continue;
+    const value = type === 'REG_DWORD' ? String(parseInt(rawValue, 16)) : rawValue.trim();
+    // The installer writes an empty value when a field was left blank —
+    // that means "not set", not "set to nothing".
+    if (value !== '') out[field] = value;
+  }
+  return out;
+}
+
+/**
+ * Raw saved values (strings, unvalidated). Throws when the JSON file exists
+ * but cannot be parsed — fail closed and audibly, same rule as config.mjs's
+ * readConfigStrict: silently falling back to defaults would start a second,
+ * empty gateway on the default port next to the one the person configured.
+ */
+export function readInstallSettings() {
+  const file = installSettingsFilePath();
+  if (file) {
+    if (!existsSync(file)) return {};
+    let data;
+    try {
+      data = JSON.parse(readFileSync(file, 'utf8'));
+    } catch (err) {
+      throw new Error(`Could not parse ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const out = {};
+    for (const key of Object.keys(FIELDS)) {
+      const v = data?.[key];
+      if (v !== undefined && v !== null && String(v).trim() !== '') out[key] = String(v);
+    }
+    return out;
+  }
+  let result;
+  try {
+    result = spawnSync('reg', ['query', installSettingsRegistryKey()], { encoding: 'utf8', windowsHide: true });
+  } catch {
+    return {};
+  }
+  // Exit 1 = key absent: the normal "nothing saved" case.
+  if (!result || result.status !== 0 || !result.stdout) return {};
+  return parseInstallSettingsRegQuery(result.stdout);
+}
+
+/**
+ * Save or clear settings. `patch` maps cpPort/mcpPort/dataDir to a value
+ * (saved) or null (cleared — back to the default). Values must already be
+ * validated by the caller.
+ */
+export function writeInstallSettings(patch) {
+  const file = installSettingsFilePath();
+  if (file) {
+    let current = {};
+    if (existsSync(file)) {
+      try { current = JSON.parse(readFileSync(file, 'utf8')) ?? {}; } catch { current = {}; }
+    }
+    for (const [key, value] of Object.entries(patch)) {
+      if (!(key in FIELDS)) continue;
+      if (value === null || value === undefined) delete current[key];
+      else current[key] = key === 'dataDir' ? String(value) : Number(value);
+    }
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    writeFileSync(file, JSON.stringify(current, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    return;
+  }
+  const key = installSettingsRegistryKey();
+  for (const [field, value] of Object.entries(patch)) {
+    if (!(field in FIELDS)) continue;
+    const name = FIELDS[field].reg;
+    const clearing = value === null || value === undefined;
+    const args = clearing
+      ? ['delete', key, '/v', name, '/f']
+      : ['add', key, '/v', name, '/t', 'REG_SZ', '/d', String(value), '/f'];
+    const r = spawnSync('reg', args, { encoding: 'utf8', windowsHide: true });
+    if (r.status === 0) continue;
+    // Clearing a value that was never there fails `reg delete` — that is
+    // the result we wanted. (Checked by reading back, not by matching the
+    // error text, which Windows localizes.)
+    if (clearing && readInstallSettings()[field] === undefined) continue;
+    throw new Error(`Could not save ${FIELDS[field].label} to ${key}: ${(r.stderr || r.stdout || '').trim()}`);
+  }
+}
+
+// ─── Resolution ─────────────────────────────────────────────────────────
+
+/**
+ * The effective ports + data folder, with where each one came from.
+ *
+ * Returns `{ cpPort, mcpPort, dataDir, source: { cpPort, mcpPort, dataDir },
+ * errors }`, source being 'policy' | 'env' | 'saved' | 'default'.
+ *
+ * Strict (the default): throws a named error on any invalid value, or when
+ * both ports end up equal — the gateway must not start on a guess.
+ * `{ tolerant: true }`: an invalid value falls through to the next tier and
+ * is reported in `errors` instead — used ONLY by `config`/`help`, so a bad
+ * saved value can still be inspected and fixed with the CLI.
+ */
+export function resolveInstallSettings({ tolerant = false } = {}) {
+  const errors = [];
+  const fail = (msg) => {
+    if (!tolerant) throw new Error(msg);
+    errors.push(msg);
+  };
+
+  let policy = {};
+  try {
+    policy = readPolicy().policy;
+  } catch (err) {
+    if (!tolerant) throw err;
+    errors.push(err instanceof Error ? err.message : String(err));
+  }
+
+  let saved = {};
+  try {
+    saved = readInstallSettings();
+  } catch (err) {
+    fail(err instanceof Error ? err.message : String(err));
+  }
+  const where = installSettingsLocation();
+
+  const out = { source: {}, errors };
+
+  // Ports.
+  for (const [field, policyKey, fallback] of [
+    ['cpPort', 'port', DEFAULT_CP_PORT],
+    ['mcpPort', 'mcpPort', DEFAULT_MCP_PORT],
+  ]) {
+    const { env, label } = FIELDS[field];
+    if (policy[policyKey] !== undefined) {
+      out[field] = policy[policyKey];
+      out.source[field] = 'policy';
+      continue;
+    }
+    const envValue = process.env[env];
+    if (envValue !== undefined && envValue !== '') {
+      const v = validateEnvPort(envValue);
+      if (v.ok) { out[field] = v.port; out.source[field] = 'env'; continue; }
+      fail(`Invalid ${env}: ${v.error}`);
+    }
+    if (saved[field] !== undefined) {
+      const v = validatePort(saved[field]);
+      if (v.ok) { out[field] = v.port; out.source[field] = 'saved'; continue; }
+      fail(`Invalid saved ${label} "${saved[field]}" in ${where}: ${v.error}`);
+    }
+    out[field] = fallback;
+    out.source[field] = 'default';
+  }
+
+  // Data folder.
+  if (policy.dataDir !== undefined) {
+    out.dataDir = policy.dataDir;
+    out.source.dataDir = 'policy';
+  } else if (process.env.SUVEREN_DATA_DIR) {
+    // Env keeps its long-standing meaning: taken as given (relative to the
+    // current folder if relative) — Docker and the dev scripts rely on it.
+    out.dataDir = resolve(process.env.SUVEREN_DATA_DIR);
+    out.source.dataDir = 'env';
+  } else if (saved.dataDir !== undefined) {
+    const v = validateDataDir(saved.dataDir);
+    if (v.ok) {
+      out.dataDir = v.path;
+      out.source.dataDir = 'saved';
+    } else {
+      fail(`Invalid saved data-dir "${saved.dataDir}" in ${where}: ${v.error}`);
+    }
+  }
+  if (!out.dataDir) {
+    out.dataDir = defaultDataDir();
+    out.source.dataDir = 'default';
+  }
+
+  if (out.cpPort === out.mcpPort) {
+    fail(
+      `The gateway port and the MCP port are both ${out.cpPort} — they must differ ` +
+        `(port from ${out.source.cpPort}, mcp-port from ${out.source.mcpPort}).`,
+    );
+  }
+
+  return out;
+}
+
+/** Human wording for a source, used in `config get` and error hints. */
+export function describeSource(source, field) {
+  if (source === 'policy') return 'set by your IT';
+  if (source === 'env') return `from ${FIELDS[field].env}`;
+  if (source === 'saved') return 'saved';
+  return 'default';
+}

package/lib/policy.d.mts

@@ -7,7 +7,9 @@
  * (see config.d.mts for the established precedent).
  */
 
-export type PolicyKey = 'asUrl' | 'caFile' | 'pinTls' | 'proxy' | 'noProxy' | 'simulation' | 'installMethod';
+export type PolicyKey =
+  | 'asUrl' | 'caFile' | 'pinTls' | 'proxy' | 'noProxy' | 'simulation' | 'installMethod'
+  | 'port' | 'mcpPort' | 'dataDir';
 
 export interface GatewayPolicy {
   asUrl?: string;
@@ -17,6 +19,9 @@ export interface GatewayPolicy {
   noProxy?: string;
   simulation?: boolean;
   installMethod?: 'managed';
+  port?: number;
+  mcpPort?: number;
+  dataDir?: string;
 }
 
 export interface ResolvedPolicy {

package/lib/policy.mjs

@@ -31,7 +31,7 @@
  *
  * Registry value names = JSON file keys (PascalCase, matching what an IT
  * admin would see in either place): AsUrl, CaFile, PinTls, Proxy, NoProxy,
- * Simulation, InstallMethod.
+ * Simulation, InstallMethod, Port, McpPort, DataDir.
  *
  * Mirrored (same logic, duplicated — no shared runtime package between the
  * CLI and the two apps, see config.mjs's doc comment for the established
@@ -39,11 +39,14 @@
  * `apps/control-plane/src/lib/policy.ts`. Keep all three in step.
  */
 
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 
-const POLICY_KEYS = ['AsUrl', 'CaFile', 'PinTls', 'Proxy', 'NoProxy', 'Simulation', 'InstallMethod'];
+// Port, McpPort and DataDir exist ONLY here, not in the two apps' TS
+// mirrors: they are resolved by the CLI and bundle/server.js alone (see
+// install-settings.mjs), which hand the result to the apps as plain env vars.
+const POLICY_KEYS = ['AsUrl', 'CaFile', 'PinTls', 'Proxy', 'NoProxy', 'Simulation', 'InstallMethod', 'Port', 'McpPort', 'DataDir'];
 
 /** The documented production path, relative to the hive — never changes for
  *  a real install. Overridable ONLY via `SUVEREN_POLICY_REGISTRY_KEY`, which
@@ -122,6 +125,28 @@ function validateProxyUrl(candidate) {
   return { ok: true, url: trimmed };
 }
 
+/** Same rule as install-settings.mjs's validatePort (duplicated, not
+ *  imported — that module imports this one): 1024–65535. A REG_DWORD
+ *  arrives as a number, a REG_SZ / JSON value as either. */
+function validatePort(candidate) {
+  const raw = String(candidate ?? '').trim();
+  if (!/^\d+$/.test(raw)) return { ok: false, error: `"${raw}" is not a port number.` };
+  const port = Number(raw);
+  if (port < 1024 || port > 65535) return { ok: false, error: `${port} is outside 1024–65535.` };
+  return { ok: true, port };
+}
+
+/** Same rule as install-settings.mjs's validateDataDir: an absolute path
+ *  that is not an existing file. It need not exist yet. */
+function validateDataDir(candidate) {
+  const raw = String(candidate ?? '').trim();
+  if (!raw) return { ok: false, error: 'The data folder path is empty.' };
+  if (!isAbsolute(raw)) return { ok: false, error: `"${raw}" is not a full path.` };
+  const path = resolve(raw);
+  if (existsSync(path) && !statSync(path).isDirectory()) return { ok: false, error: `"${path}" is a file, not a folder.` };
+  return { ok: true, path };
+}
+
 /** Accepts a JSON boolean, or the DWORD-style 0/1 (as a number OR a string,
  *  since the registry parser below hands back numbers but a hand-edited
  *  JSON file might use either). Returns undefined — not a default — for
@@ -352,6 +377,25 @@ export function readPolicy() {
     locked.add('installMethod');
   }
 
+  for (const [rawKey, key] of [['Port', 'port'], ['McpPort', 'mcpPort']]) {
+    if (merged[rawKey] === undefined) continue;
+    const v = validatePort(merged[rawKey]);
+    if (!v.ok) {
+      throw new Error(`Invalid policy ${rawKey} ("${merged[rawKey]}") from ${sourceOf[rawKey]}: ${v.error}`);
+    }
+    policy[key] = v.port;
+    locked.add(key);
+  }
+
+  if (merged.DataDir !== undefined) {
+    const v = validateDataDir(merged.DataDir);
+    if (!v.ok) {
+      throw new Error(`Invalid policy DataDir ("${merged.DataDir}") from ${sourceOf.DataDir}: ${v.error}`);
+    }
+    policy.dataDir = v.path;
+    locked.add('dataDir');
+  }
+
   cached = { policy, locked };
   return cached;
 }

package/node_modules/@hap/core/dist/index.d.mts

@@ -315,6 +315,19 @@ interface ProfileBoundsField {
      * kinds, and the same boundType can carry different units.
      */
     unit?: FieldUnit;
+    /**
+     * The largest value a mandate may set for this (numeric) bound — a ceiling
+     * on what the owner can grant, declared by the profile. E.g. reporting@0.2
+     * `read_max_age_days: { maximum: 366 }`: no reporting mandate may read back
+     * further than a year.
+     *
+     * Distinct from the bound itself: the bound limits each ACTION; `maximum`
+     * limits the MANDATE. A value above it is not a valid mandate for this
+     * profile — the mandate editor caps its input, the issuing Authority Server
+     * should refuse it, and an enforcement point that reads the bound applies
+     * min(value, maximum). Absent → no ceiling.
+     */
+    maximum?: number;
     /** @deprecated v0.4: use boundType instead. */
     constraint?: FieldConstraint;
     /** @deprecated v0.4: use boundType: { kind: 'enum', values: [...] }. */

package/node_modules/@hap/core/dist/index.d.ts

@@ -315,6 +315,19 @@ interface ProfileBoundsField {
      * kinds, and the same boundType can carry different units.
      */
     unit?: FieldUnit;
+    /**
+     * The largest value a mandate may set for this (numeric) bound — a ceiling
+     * on what the owner can grant, declared by the profile. E.g. reporting@0.2
+     * `read_max_age_days: { maximum: 366 }`: no reporting mandate may read back
+     * further than a year.
+     *
+     * Distinct from the bound itself: the bound limits each ACTION; `maximum`
+     * limits the MANDATE. A value above it is not a valid mandate for this
+     * profile — the mandate editor caps its input, the issuing Authority Server
+     * should refuse it, and an enforcement point that reads the bound applies
+     * min(value, maximum). Absent → no ceiling.
+     */
+    maximum?: number;
     /** @deprecated v0.4: use boundType instead. */
     constraint?: FieldConstraint;
     /** @deprecated v0.4: use boundType: { kind: 'enum', values: [...] }. */

package/node_modules/@hap/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/node_modules/@hap/core/src/types.ts

@@ -320,6 +320,19 @@ export interface ProfileBoundsField {
    * kinds, and the same boundType can carry different units.
    */
   unit?: FieldUnit;
+  /**
+   * The largest value a mandate may set for this (numeric) bound — a ceiling
+   * on what the owner can grant, declared by the profile. E.g. reporting@0.2
+   * `read_max_age_days: { maximum: 366 }`: no reporting mandate may read back
+   * further than a year.
+   *
+   * Distinct from the bound itself: the bound limits each ACTION; `maximum`
+   * limits the MANDATE. A value above it is not a valid mandate for this
+   * profile — the mandate editor caps its input, the issuing Authority Server
+   * should refuse it, and an enforcement point that reads the bound applies
+   * min(value, maximum). Absent → no ceiling.
+   */
+  maximum?: number;
   /** @deprecated v0.4: use boundType instead. */
   constraint?: FieldConstraint;
   /** @deprecated v0.4: use boundType: { kind: 'enum', values: [...] }. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",
@@ -26,10 +26,10 @@
   "dependencies": {
     "@hap/core": "npm:@humanagencyp/hap-core@^0.11.1",
     "@hpke/core": "^1.9.0",
-    "express": "^4.18.0",
-    "http-proxy-middleware": "^3.0.0",
+    "express": "^4.22.3",
+    "http-proxy-middleware": "^3.0.7",
     "undici": "^7.30.0",
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "htmlparser2": "^12.0.0",
     "sanitize-html": "^2.18.0",
     "zod": "^3.22.0"

package/server.js

@@ -10,11 +10,12 @@
 import { spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir, tmpdir, constants as osConstants } from 'node:os';
+import { tmpdir, constants as osConstants } from 'node:os';
 import { existsSync, mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
 import { resolveCaFile, resolveProxyUrl, resolveSimulation } from './lib/config.mjs';
 import { readPolicy, isPolicyLocked } from './lib/policy.mjs';
 import { unsupportedNodeReason } from './lib/node-version.mjs';
+import { resolveInstallSettings } from './lib/install-settings.mjs';
 
 // Docker and the login service start this file directly, not through the CLI,
 // so it checks the Node version too (see lib/node-version.mjs).
@@ -63,7 +64,19 @@ function exitLikeChild(code, signal) {
 // MERGED into one combined PEM file instead. Comparing against that combined
 // path would never match the saved path alone, so the guard has to be a
 // dedicated marker, not a value comparison (which would also re-exec forever).
-const DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join(homedir(), '.suveren');
+// Ports + data folder: IT policy > env > saved install setting > default
+// (see lib/install-settings.mjs). Resolved here, not just in the CLI,
+// because the login service starts this file directly. Refuses to start on
+// an invalid value rather than guessing a port or a folder.
+let INSTALL;
+try {
+  INSTALL = resolveInstallSettings();
+} catch (err) {
+  console.error(`[suveren-gateway] ${err instanceof Error ? err.message : String(err)}`);
+  console.error('[suveren-gateway] Fix it with `suveren-gateway config set …` (see `suveren-gateway config help`).');
+  process.exit(1);
+}
+const DATA_DIR = INSTALL.dataDir;
 const savedCaFile = resolveCaFile(DATA_DIR);
 if (savedCaFile && !process.env.SUVEREN_CA_REEXEC_DONE) {
   let effectiveCaFile = savedCaFile;
@@ -159,8 +172,8 @@ if (policyNoProxy) {
   process.env.NO_PROXY = policyNoProxy;
 }
 
-const CP_PORT = process.env.SUVEREN_CP_PORT ?? '3400';
-const MCP_PORT = process.env.SUVEREN_MCP_PORT ?? '3430';
+const CP_PORT = String(INSTALL.cpPort);
+const MCP_PORT = String(INSTALL.mcpPort);
 const UI_DIST = process.env.HAP_UI_DIST ?? join(__dirname, 'dist', 'ui');
 // Integration manifests + profile catalog ship inside the bundle so a
 // fresh `npm install -g` install has working integrations and profiles
@@ -176,6 +189,9 @@ const env = {
   NODE_ENV: 'production',
   SUVEREN_CP_PORT: CP_PORT,
   SUVEREN_MCP_PORT: MCP_PORT,
+  // Only when not the default: the control plane's one-time ~/.hap →
+  // ~/.suveren migration runs only while SUVEREN_DATA_DIR is unset.
+  ...(INSTALL.source.dataDir !== 'default' ? { SUVEREN_DATA_DIR: DATA_DIR } : {}),
   // The control plane talks to the MCP server over this URL. It defaults to
   // 127.0.0.1:3430 in mcp-bridge.ts, so if the user overrode SUVEREN_MCP_PORT
   // without also setting this, every CP→MCP internal call hit the wrong port