@suveren/gateway 0.2.10 → 0.2.11

package/dist/control-plane/index.mjs

@@ -270,6 +270,12 @@ async function resyncGates() {
   }
   return res.json();
 }
+async function runCommittedProposals() {
+  await fetch(`${MCP_BASE}/internal/run-committed`, {
+    method: "POST",
+    headers: internalHeaders()
+  });
+}
 async function getIntegrations() {
   const res = await fetch(`${MCP_BASE}/internal/integrations`, {
     headers: internalHeaders()
@@ -1935,6 +1941,8 @@ app.use(
           eventBus.emit("proposal-added");
         } else if (method === "POST" && /^\/api\/proposals\/[^/]+\/resolve$/.test(path)) {
           eventBus.emit("proposal-resolved");
+          void runCommittedProposals().catch(() => {
+          });
         } else if (method === "POST" && /^\/api\/proposals\/[^/]+\/approve$/.test(path)) {
           eventBus.emit("proposal-approved");
         } else if (method === "POST" && /^\/api\/proposals\/[^/]+\/reject$/.test(path)) {

package/dist/mcp-server/http.mjs

@@ -902,12 +902,12 @@ function buildMandateBrief(opts) {
 }
 
 // src/tools/authorizations.ts
-import { getProfile as getProfile2 } from "@hap/core";
+import { getProfile as getProfile3 } from "@hap/core";
 
 // src/lib/receipt-footer.ts
 var AS_BASE = (process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai").replace(/\/$/, "");
 var FOOTER_PROFILES = /* @__PURE__ */ new Set(["email", "calendar", "publish"]);
-var CONTENT_FIELD_CANDIDATES = ["body", "text", "description"];
+var CONTENT_FIELD_CANDIDATES = ["body", "text", "description", "content"];
 var FOOTER_MARKER = "\u2014 Sent by an AI agent via Suveren";
 function shouldAttachFooter() {
   return true;
@@ -940,18 +940,51 @@ function stripFooter(value) {
 function appendVerificationFooter(tool, args, receiptId) {
   const profile = tool.gating?.profile;
   if (!profile || !FOOTER_PROFILES.has(profile)) return args;
-  if (typeof args.raw === "string" && args.raw.trim().length > 0) {
-    console.error(
-      `[Suveren MCP] ${tool.namespacedName}: 'raw' message present \u2014 skipping verification footer.`
-    );
-    return args;
-  }
   const field = detectContentField(tool);
   if (!field) return args;
   const current = typeof args[field] === "string" ? args[field] : "";
   return { ...args, [field]: stripFooter(current) + footerText(receiptId) };
 }
 
+// src/lib/content-binding.ts
+import { createHash } from "crypto";
+import { canonicalize, getProfile as getProfile2 } from "@hap/core";
+function canonicalizeText(input) {
+  const nfc = input.normalize("NFC");
+  const lf = nfc.replace(/\r\n?/g, "\n");
+  const lines = lf.split("\n").map((line) => line.replace(/[ \t]+$/, ""));
+  return lines.join("\n").replace(/\n+$/, "");
+}
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes, "utf8").digest("hex");
+}
+function getContentBinding(profileId) {
+  const profile = getProfile2(profileId);
+  return profile?.content_binding;
+}
+function computeContentBinding(profileId, tool, toolArgs) {
+  const binding = getContentBinding(profileId);
+  if (!binding) return void 0;
+  let canonicalBytes;
+  if (binding.kind === "jcs") {
+    canonicalBytes = canonicalize(toolArgs);
+  } else {
+    const field = tool ? detectContentField(tool) : null;
+    if (!field) return void 0;
+    const raw = typeof toolArgs[field] === "string" ? toolArgs[field] : "";
+    canonicalBytes = canonicalizeText(raw);
+  }
+  return {
+    contentHash: `sha256:${sha256Hex(canonicalBytes)}`,
+    contentBinding: { version: binding.version, kind: binding.kind }
+  };
+}
+function attachReceiptId(tool, args, receiptId) {
+  const schema = tool.inputSchema;
+  if (!schema?.properties || !("receipt_id" in schema.properties)) return args;
+  return { ...args, receipt_id: receiptId };
+}
+
 // src/lib/tool-proxy.ts
 import { readFile } from "fs/promises";
 import { extname } from "path";
@@ -1120,6 +1153,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               `[Suveren MCP] Warning: tool ${tool.namespacedName} has no action_type in staticExecution. Bounds check may be skipped. Fix the integration manifest.`
             );
           }
+          const binding = computeContentBinding(auth.profileId, tool, args);
           const { receipt } = await state2.spClient.postReceipt({
             // v0.5: send the bare content address; the AS reconstructs the
             // per-user storage key. Fall back to frameHash only for legacy
@@ -1130,7 +1164,8 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             actionType,
             executionContext: { ...execution },
             amount: typeof execution.amount === "number" ? execution.amount : void 0,
-            idempotencyKey: randomUUID()
+            idempotencyKey: randomUUID(),
+            ...binding ?? {}
           });
           receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
         } catch (err) {
@@ -1210,7 +1245,8 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
           execution: { ...execution },
           timestamp: Math.floor(Date.now() / 1e3)
         });
-        const outgoingArgs = shouldAttachFooter() && receiptId ? appendVerificationFooter(tool, args, receiptId) : args;
+        let outgoingArgs = shouldAttachFooter() && receiptId ? appendVerificationFooter(tool, args, receiptId) : args;
+        if (receiptId) outgoingArgs = attachReceiptId(tool, outgoingArgs, receiptId);
         return integrationManager2.callTool(tool.integrationId, tool.originalName, outgoingArgs);
       }
       const reasons = result.errors.map((e) => {
@@ -1287,7 +1323,9 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
     } else if (override !== void 0) {
       const mappingDesc = Object.entries(override.executionMapping ?? {}).map(([arg, mapping]) => {
         if (typeof mapping === "string") return `${mapping} from ${arg}`;
-        return `${mapping.field} from ${arg} (/${mapping.divisor})`;
+        if (Array.isArray(mapping)) return `${mapping.map((m) => m.field).join("+")} from ${arg}`;
+        if ("divisor" in mapping) return `${mapping.field} from ${arg} (/${mapping.divisor})`;
+        return `${mapping.field} from ${arg}`;
       }).join(", ");
       const actionType = override.staticExecution?.action_type ?? "unknown";
       gated.push(`      - ${tool.originalName}: ${actionType}${mappingDesc ? `, ${mappingDesc}` : ""}`);
@@ -1353,7 +1391,7 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         output2.push("");
         output2.push(`  Bounds: ${boundsDesc}`);
         const shortName = shortProfileName2(auth.profileId);
-        const profile = getProfile2(auth.profileId) ?? getProfile2(shortName);
+        const profile = getProfile3(auth.profileId) ?? getProfile3(shortName);
         if (profile) {
           const consumption = getConsumptionState(auth, state2.executionLog, profile);
           const consumptionText = formatConsumptionFull(consumption);
@@ -1406,7 +1444,7 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         const lines = [`  [${auth.path}] ${auth.profileId} \u2014 ${remainingMin} min remaining`];
         lines.push(`    Bounds: ${boundsDesc}`);
         const shortName = shortProfileName2(auth.profileId);
-        const profile = getProfile2(auth.profileId) ?? getProfile2(shortName);
+        const profile = getProfile3(auth.profileId) ?? getProfile3(shortName);
         if (profile) {
           const consumption = getConsumptionState(auth, state2.executionLog, profile);
           const compact = formatConsumptionCompact(consumption);
@@ -1547,6 +1585,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   }
   const integrationId = proposal.tool.slice(0, sep);
   const toolName = proposal.tool.slice(sep + 2);
+  const discovered = integrationManager2.getAllTools().find((t) => t.integrationId === integrationId && t.originalName === toolName);
   const proposalActionType = typeof proposal.executionContext.action_type === "string" ? proposal.executionContext.action_type : void 0;
   if (!proposalActionType) {
     console.error(
@@ -1556,6 +1595,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   let receiptId;
   try {
     const boundsHash = proposal.frameHash.split(":").slice(0, 2).join(":");
+    const binding = computeContentBinding(proposal.profileId, discovered, proposal.toolArgs);
     const { receipt } = await state2.spClient.postReceipt({
       boundsHash,
       profileId: proposal.profileId,
@@ -1564,7 +1604,8 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       executionContext: proposal.executionContext,
       amount: typeof proposal.executionContext.amount === "number" ? proposal.executionContext.amount : void 0,
       proposalId: proposal.id,
-      toolArgs: proposal.toolArgs
+      toolArgs: proposal.toolArgs,
+      ...binding ?? {}
     });
     receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
   } catch (err) {
@@ -1587,11 +1628,11 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   }
   try {
     let outgoingArgs = proposal.toolArgs;
-    if (shouldAttachFooter() && receiptId) {
-      const discovered = integrationManager2.getAllTools().find((t) => t.integrationId === integrationId && t.originalName === toolName);
-      if (discovered) {
-        outgoingArgs = appendVerificationFooter(discovered, proposal.toolArgs, receiptId);
+    if (discovered && receiptId) {
+      if (shouldAttachFooter()) {
+        outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId);
       }
+      outgoingArgs = attachReceiptId(discovered, outgoingArgs, receiptId);
     }
     const result = await integrationManager2.callTool(integrationId, toolName, outgoingArgs);
     state2.executionLog.record({
@@ -1825,10 +1866,10 @@ function createMcpServer(state2, integrationManager2) {
 }
 
 // src/lib/gate-content.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { decodeAttestationBlob } from "@hap/core";
 function hashGateContent(text) {
-  const hex = createHash("sha256").update(text, "utf-8").digest("hex");
+  const hex = createHash2("sha256").update(text, "utf-8").digest("hex");
   return `sha256:${hex}`;
 }
 function verifyGateContentHashes(content, auth) {
@@ -1902,15 +1943,14 @@ var IntegrationRegistry = class {
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
           const old = i;
-          const toolGating = old.toolGating;
           const config = {
-            id: i.id,
-            name: i.name,
-            command: i.command,
-            args: i.args,
-            envKeys: i.envKeys,
-            profile: toolGating?.profile ?? null,
-            enabled: i.enabled
+            id: old.id,
+            name: old.name,
+            command: old.command,
+            args: old.args,
+            envKeys: old.envKeys,
+            profile: old.toolGating?.profile ?? null,
+            enabled: old.enabled
           };
           return config;
         }
@@ -1939,7 +1979,7 @@ import { existsSync as existsSync5, writeFileSync as writeFileSync4, mkdirSync a
 import { execSync } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { getProfile as getProfile3 } from "@hap/core";
+import { getProfile as getProfile4 } from "@hap/core";
 var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
 var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join5(DEFAULT_DATA_DIR2, "integrations");
 var INTEGRATIONS_BIN = join5(INTEGRATIONS_DIR, "node_modules", ".bin");
@@ -2024,7 +2064,7 @@ var IntegrationManager = class {
     await client.connect(transport);
     console.error(`[IntegrationManager] Connected to ${config.id} (${config.command} ${config.args.join(" ")})`);
     const toolsResult = await client.listTools();
-    const profileGating = config.toolGating ?? (config.profile ? getProfile3(config.profile)?.toolGating ?? null : null);
+    const profileGating = config.toolGating ?? (config.profile ? getProfile4(config.profile)?.toolGating ?? null : null);
     const tools = (toolsResult.tools ?? []).map((tool) => {
       const gating = this.resolveToolGating(config.profile, profileGating, tool.name);
       return {
@@ -2421,7 +2461,8 @@ app.post("/internal/gate-content", internalOnly, async (req, res) => {
     const { frameHash, boundsHash, contextHash, context, path: rawPath, gateContent } = req.body;
     const storageHash = frameHash ?? boundsHash;
     const hasIntent = !!gateContent?.intent;
-    const hasLegacy = !!gateContent?.problem && !!gateContent?.objective && !!gateContent?.tradeoffs;
+    const legacy = gateContent;
+    const hasLegacy = !!legacy?.problem && !!legacy?.objective && !!legacy?.tradeoffs;
     if (!storageHash || !hasIntent && !hasLegacy) {
       res.status(400).json({ error: "Missing required fields: frameHash (or boundsHash), gateContent.{intent} or gateContent.{problem,objective,tradeoffs}" });
       return;
@@ -2477,6 +2518,12 @@ app.post("/internal/start-pending-integrations", internalOnly, async (_req, res)
     res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
   }
 });
+var triggerCommittedExecution = () => {
+};
+app.post("/internal/run-committed", internalOnly, (_req, res) => {
+  triggerCommittedExecution();
+  res.json({ ok: true });
+});
 app.post("/internal/resync-gates", internalOnly, async (_req, res) => {
   const gates = state.gateStore.getAll();
   if (gates.length === 0) {
@@ -2790,4 +2837,7 @@ app.listen(port, "0.0.0.0", () => {
     }
   }
   setInterval(executeCommittedProposals, PROPOSAL_POLL_INTERVAL);
+  triggerCommittedExecution = () => {
+    void executeCommittedProposals();
+  };
 });

package/node_modules/@hap/core/dist/index.d.mts

@@ -161,6 +161,32 @@ interface ProfileBoundsField {
     /** @deprecated v0.4: use boundType: { kind: 'enum', values: [...] }. */
     enum?: string[];
 }
+/**
+ * v0.5 Content Provenance — how a profile's action content is hashed into a
+ * signed receipt (`contentHash`). The ephemeral-content analog of Output
+ * Provenance: it binds the *bytes* of the action rather than a location.
+ *
+ * Profile-bound and OPTIONAL. Absent → no content hash is produced (full
+ * backward compatibility). The gateway computes the hash; the SP only ever
+ * receives the hash, never the content, so HAP's privacy-minimal design holds.
+ *
+ * The profile declares only the *policy* — whether to bind and how to
+ * canonicalize. It does NOT name the tool field: that is tool-specific and is
+ * resolved at runtime (the same content-field resolver the footer uses for
+ * `kind:"text"`; the whole record payload for `kind:"jcs"`).
+ */
+interface ContentBinding {
+    /** Canonicalization version. A verifier MUST pin the version named here. */
+    version: string;
+    /**
+     * - 'jcs'  → structured writes: RFC 8785 JCS over the record payload.
+     * - 'text' → free text: NFC + LF + trailing-whitespace strip (see
+     *   canonicalizeText), auto-detected content field.
+     */
+    kind: 'jcs' | 'text';
+    /** text only: hash the content BEFORE any appended Suveren footer. */
+    pre_footer?: boolean;
+}
 /**
  * Context field definition within a v0.4 profile.
  */
@@ -280,6 +306,13 @@ interface AgentProfile {
         max: number;
     };
     retention_minimum: number;
+    /**
+     * v0.5 Content Provenance (OPTIONAL, profile-bound). When present, the
+     * gateway computes a `contentHash` for gated writes under this profile and
+     * passes it (hash only) to the SP, which signs it into the receipt. Absent
+     * → no content hash. See {@link ContentBinding}.
+     */
+    content_binding?: ContentBinding;
     /**
      * Tool gating configuration — how MCP tools map to execution context.
      * @deprecated Tool gating now lives in integration manifests (content/integrations/*.json).
@@ -436,6 +469,55 @@ type GatekeeperResult = {
  */
 declare function canonicalize(value: unknown): string;
 
+/**
+ * Content binding — Level 2 content proof (HAP v0.5 Content Provenance).
+ *
+ * A receipt normally proves who/why/bounds/when but NOT the action's content.
+ * Content binding closes that gap: the gateway computes a `content_hash` over
+ * the action's content per the profile's {@link ContentBinding} and hands the
+ * SP only the hash. The SP signs it into the receipt verbatim — it never sees
+ * the content, so HAP's privacy-minimal design is preserved. Anyone holding
+ * the content can recompute the hash and check it against the signed receipt.
+ *
+ * The hash only verifies if the verifier reproduces the EXACT bytes we hashed,
+ * so canonicalization is normative and versioned (pin via `ContentBinding.version`):
+ *
+ *  - kind:"jcs"  → RFC 8785 JCS of the record payload (see {@link canonicalize}).
+ *  - kind:"text" → UTF-8 of the string after {@link canonicalizeText}
+ *    (Unicode NFC, LF line endings, trailing per-line whitespace stripped,
+ *    trailing blank lines removed), taken pre-footer when `pre_footer` is set.
+ *
+ * Both Node and the browser produce byte-identical output: JCS relies only on
+ * environment-independent primitives, and the text rule uses String.normalize +
+ * plain string ops. The SHA-256 is computed with Node `crypto` here (the same
+ * pattern as frame.ts); browser callers that need to recompute use their own
+ * SubtleCrypto digest over the identical canonical bytes.
+ */
+
+/**
+ * Canonicalize free text per the v0.5 'text' rule. Idempotent.
+ *
+ *   1. Unicode NFC normalization.
+ *   2. CRLF / CR → LF.
+ *   3. Strip trailing spaces/tabs from every line.
+ *   4. Remove trailing blank lines.
+ */
+declare function canonicalizeText(input: string): string;
+/**
+ * Compute the canonical bytes that a content hash is taken over, WITHOUT
+ * hashing — exposed so verifiers can debug a mismatch by inspecting the exact
+ * serialization both sides should agree on.
+ */
+declare function contentCanonicalBytes(kind: ContentBinding['kind'], content: Record<string, unknown> | string): string;
+/**
+ * Compute a profile-bound content hash, formatted `sha256:<hex>` (matching the
+ * frame/bounds/context hash format used elsewhere in HAP).
+ *
+ * @param binding the profile's content_binding declaration
+ * @param content the record payload (jcs) or the resolved text field (text)
+ */
+declare function computeContentHash(binding: ContentBinding, content: Record<string, unknown> | string): string;
+
 /**
  * Frame Canonicalization for Agent Profiles
  *
@@ -633,4 +715,4 @@ declare function listProfiles(): string[];
 declare function getAllProfiles(): AgentProfile[];
 declare function clearProfiles(): void;
 
-export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContextHash, computeFrameHash, decodeAttestationBlob, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };
+export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type ContentBinding, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFrameHash, contentCanonicalBytes, decodeAttestationBlob, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };

package/node_modules/@hap/core/dist/index.d.ts

@@ -161,6 +161,32 @@ interface ProfileBoundsField {
     /** @deprecated v0.4: use boundType: { kind: 'enum', values: [...] }. */
     enum?: string[];
 }
+/**
+ * v0.5 Content Provenance — how a profile's action content is hashed into a
+ * signed receipt (`contentHash`). The ephemeral-content analog of Output
+ * Provenance: it binds the *bytes* of the action rather than a location.
+ *
+ * Profile-bound and OPTIONAL. Absent → no content hash is produced (full
+ * backward compatibility). The gateway computes the hash; the SP only ever
+ * receives the hash, never the content, so HAP's privacy-minimal design holds.
+ *
+ * The profile declares only the *policy* — whether to bind and how to
+ * canonicalize. It does NOT name the tool field: that is tool-specific and is
+ * resolved at runtime (the same content-field resolver the footer uses for
+ * `kind:"text"`; the whole record payload for `kind:"jcs"`).
+ */
+interface ContentBinding {
+    /** Canonicalization version. A verifier MUST pin the version named here. */
+    version: string;
+    /**
+     * - 'jcs'  → structured writes: RFC 8785 JCS over the record payload.
+     * - 'text' → free text: NFC + LF + trailing-whitespace strip (see
+     *   canonicalizeText), auto-detected content field.
+     */
+    kind: 'jcs' | 'text';
+    /** text only: hash the content BEFORE any appended Suveren footer. */
+    pre_footer?: boolean;
+}
 /**
  * Context field definition within a v0.4 profile.
  */
@@ -280,6 +306,13 @@ interface AgentProfile {
         max: number;
     };
     retention_minimum: number;
+    /**
+     * v0.5 Content Provenance (OPTIONAL, profile-bound). When present, the
+     * gateway computes a `contentHash` for gated writes under this profile and
+     * passes it (hash only) to the SP, which signs it into the receipt. Absent
+     * → no content hash. See {@link ContentBinding}.
+     */
+    content_binding?: ContentBinding;
     /**
      * Tool gating configuration — how MCP tools map to execution context.
      * @deprecated Tool gating now lives in integration manifests (content/integrations/*.json).
@@ -436,6 +469,55 @@ type GatekeeperResult = {
  */
 declare function canonicalize(value: unknown): string;
 
+/**
+ * Content binding — Level 2 content proof (HAP v0.5 Content Provenance).
+ *
+ * A receipt normally proves who/why/bounds/when but NOT the action's content.
+ * Content binding closes that gap: the gateway computes a `content_hash` over
+ * the action's content per the profile's {@link ContentBinding} and hands the
+ * SP only the hash. The SP signs it into the receipt verbatim — it never sees
+ * the content, so HAP's privacy-minimal design is preserved. Anyone holding
+ * the content can recompute the hash and check it against the signed receipt.
+ *
+ * The hash only verifies if the verifier reproduces the EXACT bytes we hashed,
+ * so canonicalization is normative and versioned (pin via `ContentBinding.version`):
+ *
+ *  - kind:"jcs"  → RFC 8785 JCS of the record payload (see {@link canonicalize}).
+ *  - kind:"text" → UTF-8 of the string after {@link canonicalizeText}
+ *    (Unicode NFC, LF line endings, trailing per-line whitespace stripped,
+ *    trailing blank lines removed), taken pre-footer when `pre_footer` is set.
+ *
+ * Both Node and the browser produce byte-identical output: JCS relies only on
+ * environment-independent primitives, and the text rule uses String.normalize +
+ * plain string ops. The SHA-256 is computed with Node `crypto` here (the same
+ * pattern as frame.ts); browser callers that need to recompute use their own
+ * SubtleCrypto digest over the identical canonical bytes.
+ */
+
+/**
+ * Canonicalize free text per the v0.5 'text' rule. Idempotent.
+ *
+ *   1. Unicode NFC normalization.
+ *   2. CRLF / CR → LF.
+ *   3. Strip trailing spaces/tabs from every line.
+ *   4. Remove trailing blank lines.
+ */
+declare function canonicalizeText(input: string): string;
+/**
+ * Compute the canonical bytes that a content hash is taken over, WITHOUT
+ * hashing — exposed so verifiers can debug a mismatch by inspecting the exact
+ * serialization both sides should agree on.
+ */
+declare function contentCanonicalBytes(kind: ContentBinding['kind'], content: Record<string, unknown> | string): string;
+/**
+ * Compute a profile-bound content hash, formatted `sha256:<hex>` (matching the
+ * frame/bounds/context hash format used elsewhere in HAP).
+ *
+ * @param binding the profile's content_binding declaration
+ * @param content the record payload (jcs) or the resolved text field (text)
+ */
+declare function computeContentHash(binding: ContentBinding, content: Record<string, unknown> | string): string;
+
 /**
  * Frame Canonicalization for Agent Profiles
  *
@@ -633,4 +715,4 @@ declare function listProfiles(): string[];
 declare function getAllProfiles(): AgentProfile[];
 declare function clearProfiles(): void;
 
-export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContextHash, computeFrameHash, decodeAttestationBlob, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };
+export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type ContentBinding, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFrameHash, contentCanonicalBytes, decodeAttestationBlob, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };

package/node_modules/@hap/core/dist/index.js

@@ -35,11 +35,14 @@ __export(index_exports, {
   canonicalContext: () => canonicalContext,
   canonicalFrame: () => canonicalFrame,
   canonicalize: () => canonicalize,
+  canonicalizeText: () => canonicalizeText,
   checkAttestationExpiry: () => checkAttestationExpiry,
   clearProfiles: () => clearProfiles,
   computeBoundsHash: () => computeBoundsHash,
+  computeContentHash: () => computeContentHash,
   computeContextHash: () => computeContextHash,
   computeFrameHash: () => computeFrameHash,
+  contentCanonicalBytes: () => contentCanonicalBytes,
   decodeAttestationBlob: () => decodeAttestationBlob,
   encodeAttestationBlob: () => encodeAttestationBlob,
   frameHash: () => frameHash,
@@ -86,8 +89,35 @@ function canonicalize(value) {
   return "{" + parts.join(",") + "}";
 }
 
-// src/frame.ts
+// src/content-binding.ts
 var import_crypto = require("crypto");
+function canonicalizeText(input) {
+  const nfc = input.normalize("NFC");
+  const lf = nfc.replace(/\r\n?/g, "\n");
+  const lines = lf.split("\n").map((line) => line.replace(/[ \t]+$/, ""));
+  return lines.join("\n").replace(/\n+$/, "");
+}
+function sha256Hex(bytes) {
+  return (0, import_crypto.createHash)("sha256").update(bytes, "utf8").digest("hex");
+}
+function contentCanonicalBytes(kind, content) {
+  if (kind === "jcs") {
+    if (typeof content === "string") {
+      throw new Error('content_binding kind="jcs" expects a record payload (object), got a string');
+    }
+    return canonicalize(content);
+  }
+  if (typeof content !== "string") {
+    throw new Error('content_binding kind="text" expects a string, got an object');
+  }
+  return canonicalizeText(content);
+}
+function computeContentHash(binding, content) {
+  return `sha256:${sha256Hex(contentCanonicalBytes(binding.kind, content))}`;
+}
+
+// src/frame.ts
+var import_crypto2 = require("crypto");
 function validateFrameParams(params, profile) {
   const errors = [];
   if (!profile.frameSchema) {
@@ -124,7 +154,7 @@ function canonicalFrame(params, profile) {
   return lines.join("\n");
 }
 function frameHash(canonicalFrameString) {
-  const hash = (0, import_crypto.createHash)("sha256").update(canonicalFrameString, "utf8").digest("hex");
+  const hash = (0, import_crypto2.createHash)("sha256").update(canonicalFrameString, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeFrameHash(params, profile) {
@@ -208,17 +238,17 @@ function canonicalContext(params, profile) {
 }
 function computeBoundsHash(params, profile) {
   const canonical = canonicalBounds(params, profile);
-  const hash = (0, import_crypto.createHash)("sha256").update(canonical, "utf8").digest("hex");
+  const hash = (0, import_crypto2.createHash)("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeContextHash(params, profile) {
   const canonical = canonicalContext(params, profile);
-  const hash = (0, import_crypto.createHash)("sha256").update(canonical, "utf8").digest("hex");
+  const hash = (0, import_crypto2.createHash)("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 
 // src/attestation.ts
-var import_crypto2 = require("crypto");
+var import_crypto3 = require("crypto");
 var ed = __toESM(require("@noble/ed25519"));
 function decodeAttestationBlob(blob) {
   try {
@@ -236,7 +266,7 @@ function encodeAttestationBlob(attestation) {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function attestationId(blob) {
-  const hash = (0, import_crypto2.createHash)("sha256").update(blob, "utf8").digest("hex");
+  const hash = (0, import_crypto3.createHash)("sha256").update(blob, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 async function verifyAttestationSignature(attestation, publicKeyHex) {
@@ -746,11 +776,14 @@ function resolveCumulativeFields(request, profile, executionLog, now) {
   canonicalContext,
   canonicalFrame,
   canonicalize,
+  canonicalizeText,
   checkAttestationExpiry,
   clearProfiles,
   computeBoundsHash,
+  computeContentHash,
   computeContextHash,
   computeFrameHash,
+  contentCanonicalBytes,
   decodeAttestationBlob,
   encodeAttestationBlob,
   frameHash,

package/node_modules/@hap/core/dist/index.mjs

@@ -23,8 +23,35 @@ function canonicalize(value) {
   return "{" + parts.join(",") + "}";
 }
 
-// src/frame.ts
+// src/content-binding.ts
 import { createHash } from "crypto";
+function canonicalizeText(input) {
+  const nfc = input.normalize("NFC");
+  const lf = nfc.replace(/\r\n?/g, "\n");
+  const lines = lf.split("\n").map((line) => line.replace(/[ \t]+$/, ""));
+  return lines.join("\n").replace(/\n+$/, "");
+}
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes, "utf8").digest("hex");
+}
+function contentCanonicalBytes(kind, content) {
+  if (kind === "jcs") {
+    if (typeof content === "string") {
+      throw new Error('content_binding kind="jcs" expects a record payload (object), got a string');
+    }
+    return canonicalize(content);
+  }
+  if (typeof content !== "string") {
+    throw new Error('content_binding kind="text" expects a string, got an object');
+  }
+  return canonicalizeText(content);
+}
+function computeContentHash(binding, content) {
+  return `sha256:${sha256Hex(contentCanonicalBytes(binding.kind, content))}`;
+}
+
+// src/frame.ts
+import { createHash as createHash2 } from "crypto";
 function validateFrameParams(params, profile) {
   const errors = [];
   if (!profile.frameSchema) {
@@ -61,7 +88,7 @@ function canonicalFrame(params, profile) {
   return lines.join("\n");
 }
 function frameHash(canonicalFrameString) {
-  const hash = createHash("sha256").update(canonicalFrameString, "utf8").digest("hex");
+  const hash = createHash2("sha256").update(canonicalFrameString, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeFrameHash(params, profile) {
@@ -145,17 +172,17 @@ function canonicalContext(params, profile) {
 }
 function computeBoundsHash(params, profile) {
   const canonical = canonicalBounds(params, profile);
-  const hash = createHash("sha256").update(canonical, "utf8").digest("hex");
+  const hash = createHash2("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeContextHash(params, profile) {
   const canonical = canonicalContext(params, profile);
-  const hash = createHash("sha256").update(canonical, "utf8").digest("hex");
+  const hash = createHash2("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 
 // src/attestation.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import * as ed from "@noble/ed25519";
 function decodeAttestationBlob(blob) {
   try {
@@ -173,7 +200,7 @@ function encodeAttestationBlob(attestation) {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function attestationId(blob) {
-  const hash = createHash2("sha256").update(blob, "utf8").digest("hex");
+  const hash = createHash3("sha256").update(blob, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 async function verifyAttestationSignature(attestation, publicKeyHex) {
@@ -682,11 +709,14 @@ export {
   canonicalContext,
   canonicalFrame,
   canonicalize,
+  canonicalizeText,
   checkAttestationExpiry,
   clearProfiles,
   computeBoundsHash,
+  computeContentHash,
   computeContextHash,
   computeFrameHash,
+  contentCanonicalBytes,
   decodeAttestationBlob,
   encodeAttestationBlob,
   frameHash,

package/node_modules/@hap/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/node_modules/@hap/core/src/content-binding.ts

@@ -0,0 +1,83 @@
+/**
+ * Content binding — Level 2 content proof (HAP v0.5 Content Provenance).
+ *
+ * A receipt normally proves who/why/bounds/when but NOT the action's content.
+ * Content binding closes that gap: the gateway computes a `content_hash` over
+ * the action's content per the profile's {@link ContentBinding} and hands the
+ * SP only the hash. The SP signs it into the receipt verbatim — it never sees
+ * the content, so HAP's privacy-minimal design is preserved. Anyone holding
+ * the content can recompute the hash and check it against the signed receipt.
+ *
+ * The hash only verifies if the verifier reproduces the EXACT bytes we hashed,
+ * so canonicalization is normative and versioned (pin via `ContentBinding.version`):
+ *
+ *  - kind:"jcs"  → RFC 8785 JCS of the record payload (see {@link canonicalize}).
+ *  - kind:"text" → UTF-8 of the string after {@link canonicalizeText}
+ *    (Unicode NFC, LF line endings, trailing per-line whitespace stripped,
+ *    trailing blank lines removed), taken pre-footer when `pre_footer` is set.
+ *
+ * Both Node and the browser produce byte-identical output: JCS relies only on
+ * environment-independent primitives, and the text rule uses String.normalize +
+ * plain string ops. The SHA-256 is computed with Node `crypto` here (the same
+ * pattern as frame.ts); browser callers that need to recompute use their own
+ * SubtleCrypto digest over the identical canonical bytes.
+ */
+
+import { createHash } from 'crypto';
+import { canonicalize } from './canonicalize';
+import type { ContentBinding } from './types';
+
+/**
+ * Canonicalize free text per the v0.5 'text' rule. Idempotent.
+ *
+ *   1. Unicode NFC normalization.
+ *   2. CRLF / CR → LF.
+ *   3. Strip trailing spaces/tabs from every line.
+ *   4. Remove trailing blank lines.
+ */
+export function canonicalizeText(input: string): string {
+  const nfc = input.normalize('NFC');
+  const lf = nfc.replace(/\r\n?/g, '\n');
+  const lines = lf.split('\n').map((line) => line.replace(/[ \t]+$/, ''));
+  return lines.join('\n').replace(/\n+$/, '');
+}
+
+/** sha256 of a UTF-8 string → 64 hex chars. */
+function sha256Hex(bytes: string): string {
+  return createHash('sha256').update(bytes, 'utf8').digest('hex');
+}
+
+/**
+ * Compute the canonical bytes that a content hash is taken over, WITHOUT
+ * hashing — exposed so verifiers can debug a mismatch by inspecting the exact
+ * serialization both sides should agree on.
+ */
+export function contentCanonicalBytes(
+  kind: ContentBinding['kind'],
+  content: Record<string, unknown> | string,
+): string {
+  if (kind === 'jcs') {
+    if (typeof content === 'string') {
+      throw new Error('content_binding kind="jcs" expects a record payload (object), got a string');
+    }
+    return canonicalize(content);
+  }
+  if (typeof content !== 'string') {
+    throw new Error('content_binding kind="text" expects a string, got an object');
+  }
+  return canonicalizeText(content);
+}
+
+/**
+ * Compute a profile-bound content hash, formatted `sha256:<hex>` (matching the
+ * frame/bounds/context hash format used elsewhere in HAP).
+ *
+ * @param binding the profile's content_binding declaration
+ * @param content the record payload (jcs) or the resolved text field (text)
+ */
+export function computeContentHash(
+  binding: ContentBinding,
+  content: Record<string, unknown> | string,
+): string {
+  return `sha256:${sha256Hex(contentCanonicalBytes(binding.kind, content))}`;
+}

package/node_modules/@hap/core/src/index.ts

@@ -6,6 +6,7 @@
 
 export * from './types';
 export * from './canonicalize';
+export * from './content-binding';
 export * from './frame';
 export * from './attestation';
 export * from './gatekeeper';

package/node_modules/@hap/core/src/types.ts

@@ -166,6 +166,33 @@ export interface ProfileBoundsField {
   enum?: string[];
 }
 
+/**
+ * v0.5 Content Provenance — how a profile's action content is hashed into a
+ * signed receipt (`contentHash`). The ephemeral-content analog of Output
+ * Provenance: it binds the *bytes* of the action rather than a location.
+ *
+ * Profile-bound and OPTIONAL. Absent → no content hash is produced (full
+ * backward compatibility). The gateway computes the hash; the SP only ever
+ * receives the hash, never the content, so HAP's privacy-minimal design holds.
+ *
+ * The profile declares only the *policy* — whether to bind and how to
+ * canonicalize. It does NOT name the tool field: that is tool-specific and is
+ * resolved at runtime (the same content-field resolver the footer uses for
+ * `kind:"text"`; the whole record payload for `kind:"jcs"`).
+ */
+export interface ContentBinding {
+  /** Canonicalization version. A verifier MUST pin the version named here. */
+  version: string;
+  /**
+   * - 'jcs'  → structured writes: RFC 8785 JCS over the record payload.
+   * - 'text' → free text: NFC + LF + trailing-whitespace strip (see
+   *   canonicalizeText), auto-detected content field.
+   */
+  kind: 'jcs' | 'text';
+  /** text only: hash the content BEFORE any appended Suveren footer. */
+  pre_footer?: boolean;
+}
+
 /**
  * Context field definition within a v0.4 profile.
  */
@@ -295,6 +322,14 @@ export interface AgentProfile {
   ttl: { default: number; max: number };
   retention_minimum: number;
 
+  /**
+   * v0.5 Content Provenance (OPTIONAL, profile-bound). When present, the
+   * gateway computes a `contentHash` for gated writes under this profile and
+   * passes it (hash only) to the SP, which signs it into the receipt. Absent
+   * → no content hash. See {@link ContentBinding}.
+   */
+  content_binding?: ContentBinding;
+
   /**
    * Tool gating configuration — how MCP tools map to execution context.
    * @deprecated Tool gating now lives in integration manifests (content/integrations/*.json).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",

package/profiles/customers/0.4.profile.json

@@ -107,5 +107,6 @@
     "default": 86400,
     "max": 31536000
   },
-  "retention_minimum": 7776000
+  "retention_minimum": 7776000,
+  "content_binding": { "version": "1", "kind": "jcs" }
 }

package/profiles/records/0.4.profile.json

@@ -101,5 +101,6 @@
     "default": 86400,
     "max": 31536000
   },
-  "retention_minimum": 7776000
+  "retention_minimum": 7776000,
+  "content_binding": { "version": "1", "kind": "jcs" }
 }