@suveren/gateway 0.19.5 → 0.20.0

package/content/integrations/crm.json

@@ -6,7 +6,7 @@
   "icon": "users",
   "profile": "customers",
   "npmPackage": "@humanagencyp/crm-mcp",
-  "npmVersion": "1.2.0",
+  "npmVersion": "1.3.0",
   "mcp": {
     "command": "crm-mcp",
     "args": []

package/content/integrations/deploy-github.json

@@ -6,7 +6,7 @@
   "icon": "wrench",
   "profile": "deploy",
   "npmPackage": "@humanagencyp/deploy-mcp",
-  "npmVersion": "0.4.2",
+  "npmVersion": "0.5.0",
   "mcp": {
     "command": "deploy-mcp",
     "args": []

package/content/integrations/erp.json

@@ -6,7 +6,7 @@
   "icon": "briefcase",
   "profile": "sales",
   "npmPackage": "@humanagencyp/erp-mcp",
-  "npmVersion": "0.4.0",
+  "npmVersion": "0.5.0",
   "mcp": {
     "command": "erp-mcp",
     "args": [],

package/content/integrations/mail.json

@@ -6,7 +6,7 @@
   "icon": "mail",
   "profile": "email",
   "npmPackage": "@humanagencyp/email-mcp",
-  "npmVersion": "0.2.0",
+  "npmVersion": "0.3.0",
   "mcp": {
     "command": "email-mcp",
     "args": []

package/content/integrations/records.json

@@ -6,7 +6,7 @@
   "icon": "file-text",
   "profile": "records",
   "npmPackage": "@humanagencyp/records-mcp",
-  "npmVersion": "1.0.4",
+  "npmVersion": "1.1.0",
   "personalDefault": true,
   "mcp": {
     "command": "records-mcp",

package/dist/control-plane/index.mjs

@@ -3347,7 +3347,7 @@ function createEvidenceExportRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2)
       try {
         const pin = readPairing(dataDir);
         const { res: asRes } = await fetchAs(
-          `${spUrl}/api/receipts/export`,
+          `${spUrl}/api/tickets/export`,
           { headers: { Cookie: cookie }, signal: controller.signal },
           {
             enforce: resolvePinTls(dataDir),
@@ -3406,7 +3406,10 @@ function createEvidenceExportRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2)
 
 // src/routes/evidence.ts
 import { Router as Router10 } from "express";
-import { verifyReceiptSignature } from "@hap/core";
+import { verifyTicketSignature, encodeDidKey } from "@hap/core";
+function issuerFromPublicKeyHex(publicKeyHex) {
+  return encodeDidKey(Buffer.from(publicKeyHex, "hex"));
+}
 async function verifyAll(receipts) {
   const out = {};
   for (const raw of receipts) {
@@ -3418,7 +3421,7 @@ async function verifyAll(receipts) {
       continue;
     }
     try {
-      await verifyReceiptSignature(e.receipt, e.asPublicKey);
+      await verifyTicketSignature(e.receipt, { trustedIssuers: [issuerFromPublicKeyHex(e.asPublicKey)] });
       out[id] = "valid";
     } catch {
       out[id] = "invalid";
@@ -3927,11 +3930,13 @@ import { timingSafeEqual as timingSafeEqual3, randomUUID } from "crypto";
 import {
   allowedCommitmentModes,
   computeBoundsHash,
-  computeContextHash,
+  computeScopeHash,
   computeIntentHash,
+  computeProfileHash,
   isCommitmentModeAllowed,
   validateBoundsParams,
-  validateContextParams
+  validateScopeParams,
+  PROTOCOL_VERSION
 } from "@hap/core";
 var MandateRefused = class extends Error {
 };
@@ -3971,8 +3976,8 @@ function approverPubkeys(body) {
 }
 async function delegationWorkspace(deps, groups) {
   const personal = groups.find((g) => g.isPersonal);
-  const mine = await deps.as("GET", "/api/attestations/mine?status=active");
-  const rows = mine.status === 200 ? mine.body?.attestations ?? [] : [];
+  const mine = await deps.as("GET", "/api/mandates/mine?status=active");
+  const rows = mine.status === 200 ? mine.body?.mandates ?? [] : [];
   const ids = new Set(rows.filter((r) => r.profileId && shortOf(r.profileId) === "delegation" && r.groupId).map((r) => r.groupId));
   const found = groups.filter((g) => ids.has(g.id));
   if (found.length === 0) return personal;
@@ -4011,7 +4016,7 @@ async function planMandate(req, deps) {
     }
   }
   const context = scalarRecord("scope", req.scope);
-  errors.push(...validateContextParams(context, profile).errors);
+  errors.push(...validateScopeParams(context, profile).errors);
   if (errors.length) refuse(`The mandate does not fit profile ${profile.id}: ${errors.join(" ")}`);
   if (!isCommitmentModeAllowed(profile, req.mode)) {
     refuse(`Profile ${profile.id} allows mode ${allowedCommitmentModes(profile).join(" or ") || "none"}, not "${req.mode}".`);
@@ -4041,7 +4046,7 @@ async function createMandate(req, deps) {
   const plan = await planMandate(req, deps);
   const user = deps.user;
   const boundsHash = computeBoundsHash(plan.bounds, plan.profile);
-  const contextHash = computeContextHash(plan.context, plan.profile);
+  const scopeHash = computeScopeHash(plan.context, plan.profile);
   const intentHash = computeIntentHash(plan.intent);
   const ecHash = computeIntentHash(JSON.stringify({ profile: plan.profile.id, domain: plan.domain, group: plan.groupId }));
   let enc;
@@ -4054,14 +4059,17 @@ async function createMandate(req, deps) {
     if (recipients.length > 0) enc = await deps.encrypt(plan.intent, recipients);
   }
   const authorizationId = deps.newAuthorizationId();
-  const res = await deps.as("POST", "/api/as/attest", {
+  const res = await deps.as("POST", "/api/as/mandate", {
     authorization_id: authorizationId,
     profile_id: plan.profile.id,
+    profile_hash: computeProfileHash(plan.profile),
+    supported_versions: [PROTOCOL_VERSION],
     bounds: plan.bounds,
     bounds_hash: boundsHash,
-    context_hash: contextHash,
+    scope_hash: scopeHash,
     domain: plan.domain,
     did: user.did,
+    mandate_owners: [{ did: user.did }],
     gate_content_hashes: { intent: intentHash },
     execution_context_hash: ecHash,
     group_id: plan.groupId,
@@ -4078,7 +4086,7 @@ async function createMandate(req, deps) {
     refuse(`The Authority Server refused the mandate: ${why}`);
   }
   try {
-    await deps.deliverGateContent({ authorizationId, boundsHash, contextHash, context: plan.context, gateContent: { intent: plan.intent } });
+    await deps.deliverGateContent({ authorizationId, boundsHash, contextHash: scopeHash, context: plan.context, gateContent: { intent: plan.intent } });
   } catch (err) {
     await deps.as("POST", `/api/authorizations/${encodeURIComponent(authorizationId)}/revoke`, {
       reason: "Auto-revoked: gate content delivery failed"
@@ -4960,7 +4968,7 @@ app.use(
         const url = req.url ?? "";
         if (method !== "POST" && method !== "DELETE") return;
         const path = url.split("?")[0];
-        if (method === "POST" && path === "/api/as/attest" || method === "POST" && /^\/api\/attestations\/[^/]+\/revoke$/.test(path) || method === "POST" && /^\/api\/authorizations\/[^/]+\/delete$/.test(path)) {
+        if (method === "POST" && path === "/api/as/mandate" || method === "POST" && /^\/api\/attestations\/[^/]+\/revoke$/.test(path) || method === "POST" && /^\/api\/authorizations\/[^/]+\/(revoke|delete)$/.test(path)) {
           eventBus.emit("attestation-changed");
           void resyncGates().catch(() => {
           });

package/dist/mcp-server/{chunk-ZRRZFGRL.mjs → chunk-APIQIEUA.mjs}

@@ -1053,7 +1053,7 @@ function renderReportHtml(rawHtml, elements, opts = {}) {
 }
 
 // src/lib/report/export-report.ts
-import { decodeAttestationBlob, getProfile as getProfile2 } from "@hap/core";
+import { decodeMandateBlob, getProfile as getProfile2 } from "@hap/core";
 function processTimeZone() {
   try {
     const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
@@ -1074,7 +1074,7 @@ function disclosedNames(blobs) {
   const names = /* @__PURE__ */ new Map();
   for (const blob of blobs) {
     try {
-      for (const sub of decodeAttestationBlob(blob).payload.subjects ?? []) {
+      for (const sub of decodeMandateBlob(blob).payload.subjects ?? []) {
         if (sub.assurance === "high" && sub.disclose?.name) {
           if (!names.has(sub.did)) names.set(sub.did, /* @__PURE__ */ new Set());
           names.get(sub.did).add(sub.disclose.name);
@@ -1089,7 +1089,7 @@ function firstOwnerDids(auth) {
   const blob = auth?.attestations[0]?.blob;
   if (!blob) return [];
   try {
-    return decodeAttestationBlob(blob).payload.resolved_owners ?? [];
+    return (decodeMandateBlob(blob).payload.mandate_owners ?? []).map((o) => o.did);
   } catch {
     return [];
   }
@@ -1267,10 +1267,16 @@ function isExportBundle(v) {
 
 // src/lib/report/verify-export.ts
 import { Parser as Parser2 } from "htmlparser2";
-import { verifyReceiptSignature as verifyReceiptSignature2, verifyAttestationSignature as verifyAttestationSignature4, decodeAttestationBlob as decodeAttestationBlob5, computeBoundsHash } from "@hap/core";
+import { verifyTicketSignature as verifyTicketSignature2, verifyMandateSignature as verifyMandateSignature4, decodeMandateBlob as decodeMandateBlob5, computeBoundsHash } from "@hap/core";
+
+// src/lib/issuer-from-hex.ts
+import { encodeDidKey } from "@hap/core";
+function issuerFromPublicKeyHex(publicKeyHex) {
+  return encodeDidKey(Buffer.from(publicKeyHex, "hex"));
+}
 
 // src/lib/report/verify-drawn.ts
-import { computeIntentHash, decodeAttestationBlob as decodeAttestationBlob4, verifyAttestationSignature as verifyAttestationSignature3 } from "@hap/core";
+import { computeIntentHash, decodeMandateBlob as decodeMandateBlob4, verifyMandateSignature as verifyMandateSignature3 } from "@hap/core";
 
 // src/lib/report/metric-resolvers.ts
 var METRIC_KINDS = [
@@ -1335,10 +1341,10 @@ function computeMetric(kind, cases, refusalTimes = []) {
 }
 
 // src/lib/report/ticket-resolvers.ts
-import { verifyReceiptSignature, verifyAttestationSignature as verifyAttestationSignature2, decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
+import { verifyTicketSignature, verifyMandateSignature as verifyMandateSignature2, decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
 
 // src/lib/report/identity.ts
-import { decodeAttestationBlob as decodeAttestationBlob2, verifyAttestationSignature } from "@hap/core";
+import { decodeMandateBlob as decodeMandateBlob2, verifyMandateSignature } from "@hap/core";
 var cache = /* @__PURE__ */ new WeakMap();
 function cacheKey(archive) {
   const auths = archive.getAuthorizations();
@@ -1353,14 +1359,13 @@ async function build(archive) {
     if (!key2) continue;
     for (const att of auth.attestations) {
       try {
-        const attestation = decodeAttestationBlob2(att.blob);
-        await verifyAttestationSignature(attestation, key2);
-        for (const s of attestation.payload.subjects ?? []) {
+        const mandate = decodeMandateBlob2(att.blob);
+        await verifyMandateSignature(mandate, { trustedIssuers: [issuerFromPublicKeyHex(key2)] });
+        for (const s of mandate.payload.subjects ?? []) {
           if (s.assurance === "high" && s.disclose?.name && !names.has(s.did)) names.set(s.did, s.disclose.name);
         }
-        for (const rd of attestation.payload.resolved_domains ?? []) {
-          if (rd?.domain && rd?.did && !domainDids.has(rd.domain)) domainDids.set(rd.domain, rd.did);
-        }
+        const ownerDid = mandate.payload.mandate_owners?.[0]?.did;
+        if (att.domain && ownerDid && !domainDids.has(att.domain)) domainDids.set(att.domain, ownerDid);
       } catch {
       }
     }
@@ -1486,7 +1491,9 @@ async function checkTicket(archive, ticketId2) {
     return { ok: false, reason: `Ticket "${ticketId2}" has no archived Authority Server key to verify it against.`, entry };
   }
   try {
-    await verifyReceiptSignature(entry.receipt, entry.asPublicKey);
+    await verifyTicketSignature(entry.receipt, {
+      trustedIssuers: [issuerFromPublicKeyHex(entry.asPublicKey)]
+    });
   } catch (err) {
     return {
       ok: false,
@@ -1583,11 +1590,13 @@ async function resolveMandateElement(archive, ticketRef) {
   const firstBlob = auth.attestations[0]?.blob;
   if (firstBlob && check.entry.asPublicKey) {
     try {
-      const attestation = decodeAttestationBlob3(firstBlob);
-      await verifyAttestationSignature2(attestation, check.entry.asPublicKey);
-      mode = attestation.payload.commitment_mode;
-      const dids = attestation.payload.resolved_owners ?? [];
-      const subjects = attestation.payload.subjects ?? [];
+      const mandate = decodeMandateBlob3(firstBlob);
+      await verifyMandateSignature2(mandate, {
+        trustedIssuers: [issuerFromPublicKeyHex(check.entry.asPublicKey)]
+      });
+      mode = mandate.payload.commitment_mode;
+      const dids = (mandate.payload.mandate_owners ?? []).map((o) => o.did);
+      const subjects = mandate.payload.subjects ?? [];
       ownersRaw = dids;
       const dir = await getIdentityDirectory(archive);
       owners = dids.map((did) => {
@@ -1787,9 +1796,9 @@ function checkDocumentReproduces(bundle, documentHtml) {
 }
 async function verifiedPayload(blob, publicKeyHex) {
   try {
-    const att = decodeAttestationBlob4(blob);
-    await verifyAttestationSignature3(att, publicKeyHex);
-    return att.payload;
+    const mandate = decodeMandateBlob4(blob);
+    await verifyMandateSignature3(mandate, { trustedIssuers: [issuerFromPublicKeyHex(publicKeyHex)] });
+    return mandate.payload;
   } catch {
     return null;
   }
@@ -1996,7 +2005,7 @@ function checkMandateFields(ctx, att, m, r, box, prefix) {
   }
 }
 function checkOwners(att, payload, labels, box, prefix) {
-  const dids = payload.resolved_owners ?? [];
+  const dids = (payload.mandate_owners ?? []).map((o) => o.did);
   if (labels.length !== dids.length) {
     box.mismatches.push(`${prefix}owner: the box shows ${labels.length} owner(s), the signed mandate names ${dids.length}.`);
     return;
@@ -2243,8 +2252,8 @@ async function checkAttestations(auth, publicKeyHex) {
   }
   for (const att of auth.attestations) {
     try {
-      const attestation = decodeAttestationBlob5(att.blob);
-      await verifyAttestationSignature4(attestation, publicKeyHex);
+      const mandate = decodeMandateBlob5(att.blob);
+      await verifyMandateSignature4(mandate, { trustedIssuers: [issuerFromPublicKeyHex(publicKeyHex)] });
     } catch (err) {
       return { valid: false, error: err instanceof Error ? err.message : String(err) };
     }
@@ -2263,7 +2272,9 @@ async function verifyExportBundle(bundle, opts = {}) {
       continue;
     }
     try {
-      await verifyReceiptSignature2(receipt, bundle.authorityServer.publicKeyHex);
+      await verifyTicketSignature2(receipt, {
+        trustedIssuers: [issuerFromPublicKeyHex(bundle.authorityServer.publicKeyHex)]
+      });
       tickets.push({ ticketId: id, referenced: referencedIds.has(id), present: true, signatureValid: true });
     } catch (err) {
       tickets.push({
@@ -2283,7 +2294,7 @@ async function verifyExportBundle(bundle, opts = {}) {
     if (auth.boundsHash) hashes.push({ from: "the mandate record", value: auth.boundsHash, signed: false });
     for (const att of auth.attestations) {
       try {
-        const bh = decodeAttestationBlob5(att.blob).payload.bounds_hash;
+        const bh = decodeMandateBlob5(att.blob).payload.bounds_hash;
         if (bh) hashes.push({ from: "the signed attestation", value: bh, signed: attestationValid });
       } catch {
       }
@@ -2379,6 +2390,7 @@ function resolveKeyConfirmation(actualKeyHex, opts) {
 export {
   readPairing,
   fingerprintOf,
+  issuerFromPublicKeyHex,
   REPORT_ELEMENTS,
   REPORT_BRIEF,
   sanitizeReport,