@suveren/gateway 0.2.7 → 0.2.9

package/dist/mcp-server/http.mjs

@@ -904,6 +904,54 @@ function buildMandateBrief(opts) {
 // src/tools/authorizations.ts
 import { getProfile as getProfile2 } from "@hap/core";
 
+// src/lib/receipt-footer.ts
+var AS_BASE = (process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai").replace(/\/$/, "");
+var FOOTER_PROFILES = /* @__PURE__ */ new Set(["email", "calendar", "publish"]);
+var CONTENT_FIELD_CANDIDATES = ["body", "text", "description"];
+var FOOTER_MARKER = "\u2014 Sent by an AI agent via Suveren";
+function shouldAttachFooter() {
+  return true;
+}
+function verifyUrl(receiptId) {
+  return `${AS_BASE}/r/${receiptId}`;
+}
+function footerText(receiptId) {
+  return `
+
+${FOOTER_MARKER}. Verify: ${verifyUrl(receiptId)}`;
+}
+function isStringType(t) {
+  return t === "string" || Array.isArray(t) && t.includes("string");
+}
+function detectContentField(tool) {
+  const schema = tool.inputSchema;
+  const props = schema?.properties ?? {};
+  for (const candidate of CONTENT_FIELD_CANDIDATES) {
+    const prop = props[candidate];
+    if (prop && isStringType(prop.type)) return candidate;
+  }
+  return null;
+}
+function stripFooter(value) {
+  const i = value.indexOf(FOOTER_MARKER);
+  if (i === -1) return value;
+  return value.slice(0, i).replace(/\n+$/, "");
+}
+function appendVerificationFooter(tool, args, receiptId) {
+  const profile = tool.gating?.profile;
+  if (!profile || !FOOTER_PROFILES.has(profile)) return args;
+  if (typeof args.raw === "string" && args.raw.trim().length > 0) {
+    console.error(
+      `[Suveren MCP] ${tool.namespacedName}: 'raw' message present \u2014 skipping verification footer.`
+    );
+    return args;
+  }
+  const field = detectContentField(tool);
+  if (!field) return args;
+  const current = typeof args[field] === "string" ? args[field] : "";
+  return { ...args, [field]: stripFooter(current) + footerText(receiptId) };
+}
+
 // src/lib/tool-proxy.ts
 import { readFile } from "fs/promises";
 import { extname } from "path";
@@ -1064,6 +1112,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             };
           }
         }
+        let receiptId;
         try {
           const actionType = typeof execution.action_type === "string" ? execution.action_type : void 0;
           if (!actionType) {
@@ -1071,7 +1120,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               `[Suveren MCP] Warning: tool ${tool.namespacedName} has no action_type in staticExecution. Bounds check may be skipped. Fix the integration manifest.`
             );
           }
-          await state2.spClient.postReceipt({
+          const { receipt } = await state2.spClient.postReceipt({
             // v0.5: send the bare content address; the AS reconstructs the
             // per-user storage key. Fall back to frameHash only for legacy
             // (pre-v0.4) records that predate bounds_hash.
@@ -1083,6 +1132,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             amount: typeof execution.amount === "number" ? execution.amount : void 0,
             idempotencyKey: randomUUID()
           });
+          receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
         } catch (err) {
           if (err instanceof SPReceiptError && err.statusCode === 409) {
             const spBody = err.body;
@@ -1160,7 +1210,8 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
           execution: { ...execution },
           timestamp: Math.floor(Date.now() / 1e3)
         });
-        return integrationManager2.callTool(tool.integrationId, tool.originalName, args);
+        const outgoingArgs = shouldAttachFooter() && receiptId ? appendVerificationFooter(tool, args, receiptId) : args;
+        return integrationManager2.callTool(tool.integrationId, tool.originalName, outgoingArgs);
       }
       const reasons = result.errors.map((e) => {
         if (e.code === "BOUND_EXCEEDED") {
@@ -2193,7 +2244,7 @@ function loadProfiles(profilesDir) {
   const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join6(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
   const indexPath = join6(dir, "index.json");
   if (!existsSync6(indexPath)) {
-    console.error(`[ProfileLoader] No index.json found at ${indexPath}, skipping profile loading`);
+    warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
@@ -2218,9 +2269,26 @@ function loadProfiles(profilesDir) {
       console.error(`[ProfileLoader] Failed to load profile ${profileId} from ${profilePath}:`, err);
     }
   }
-  console.error(`[ProfileLoader] Loaded ${loaded} profile(s) from ${dir}`);
+  if (loaded === 0) {
+    warnNoProfiles(`index.json at ${indexPath} registered 0 profiles`);
+  } else {
+    console.error(`[ProfileLoader] Loaded ${loaded} profile(s) from ${dir}`);
+  }
   return loaded;
 }
+function warnNoProfiles(reason) {
+  console.error(
+    `
+\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+\u2551  \u26A0  NO PROFILES LOADED \u2014 every gated action will be REJECTED with   \u2551
+\u2551     "Unknown profile". This gateway is misconfigured.               \u2551
+\u2551     Reason: ${reason}
+\u2551     Fix: install a build that bundles profiles, or set              \u2551
+\u2551     SUVEREN_PROFILES_DIR to a hap-profiles checkout, then restart.  \u2551
+\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+`
+  );
+}
 
 // src/lib/manifest-loader.ts
 import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
@@ -2554,11 +2622,13 @@ app.all("/mcp", async (req, res) => {
     res.status(405).json({ error: "Method not allowed" });
   }
 });
+var profilesLoaded = 0;
 app.get("/health", (_req, res) => {
   res.json({
     status: "ok",
     transports: ["sse", "streamable-http"],
     sp: spUrl,
+    profilesLoaded,
     activeSessions: activeSessions.size,
     storedGates: state.gateStore.getAll().length,
     serviceCredentials: Array.from(serviceCredentials.keys()),
@@ -2648,7 +2718,7 @@ app.listen(port, "0.0.0.0", () => {
   console.error(`[Suveren MCP]   SSE:        http://0.0.0.0:${port}/sse`);
   console.error(`[Suveren MCP]   Streamable: http://0.0.0.0:${port}/mcp`);
   console.error(`[Suveren MCP]   SP server:  ${spUrl}`);
-  loadProfiles();
+  profilesLoaded = loadProfiles();
   loadManifests();
   if (integrationRegistry.getEnabled().length === 0) {
     const personalManifests = getAllManifests().filter((m) => m.personalDefault);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",

package/profiles/README.md

@@ -0,0 +1,209 @@
+# HAP Authority Profiles
+
+Authorization templates for the [Human Agency Protocol](https://humanagencyprotocol.org). Each profile defines what an AI agent is allowed to do within a specific domain — the bounds a human sets, and the Gatekeeper enforces.
+
+> **Version 0.4** — March 2026
+
+---
+
+## What Profiles Define
+
+A profile is a complete authorization schema. It specifies:
+
+- **Bounds schema** — the limits a human commits to (e.g., max amount, allowed currencies)
+- **Context schema** — local parameters that stay encrypted (e.g., allowed services, environment)
+- **Execution context** — what the Gatekeeper checks at runtime, including cumulative limits
+- **Execution paths** — governance tiers with required domain owners and TTLs
+- **Gates** — the structured questions a human must answer before authorization
+
+Profiles are referenced by ID (e.g., `charge@0.4`) and are immutable once published.
+
+---
+
+## Profiles
+
+### charge — Charge Authority
+
+Governs charging customers: payments, refunds, subscriptions.
+
+| Bound | Type | Purpose |
+|-------|------|---------|
+| `amount_max` | per-transaction | Maximum monetary amount |
+| `amount_daily_max` | cumulative | Daily charge cap |
+| `amount_monthly_max` | cumulative | Monthly charge cap |
+| `transaction_count_daily_max` | cumulative | Daily transaction limit |
+
+| Context | Type | Purpose |
+|---------|------|---------|
+| `currency` | enum | Permitted currencies |
+| `action_type` | enum | charge, refund, subscribe |
+
+| Path | Default TTL |
+|------|-------------|
+| `charge-routine` | 24h |
+| `charge-reviewed` | 4h |
+
+---
+
+### purchase — Purchase Authority
+
+Governs spending company money: subscriptions, supplies, services, advertising.
+
+| Bound | Type | Purpose |
+|-------|------|---------|
+| `spend_max` | per-transaction | Maximum spend amount |
+| `spend_daily_max` | cumulative | Daily spend cap |
+| `spend_monthly_max` | cumulative | Monthly spend cap |
+| `transaction_count_daily_max` | cumulative | Daily transaction limit |
+
+| Context | Type | Purpose |
+|---------|------|---------|
+| `currency` | enum | Permitted currencies |
+| `category` | enum | subscription, supply, service, advertising |
+| `allowed_vendors` | subset | Approved vendor names |
+
+| Path | Default TTL |
+|------|-------------|
+| `purchase-routine` | 24h |
+| `purchase-reviewed` | 4h |
+
+---
+
+### email — Email Authority
+
+Governs sending, drafting, and reading email via Gmail.
+
+| Bound | Type | Purpose |
+|-------|------|---------|
+| `recipient_max` | per-email | Maximum recipients |
+| `send_daily_max` | cumulative | Daily send/draft limit |
+| `read_max_age_days` | per-query | Max email age for search |
+| `read_daily_max` | cumulative | Daily read limit |
+
+| Context | Type | Purpose |
+|---------|------|---------|
+| `allowed_recipients` | subset | Permitted email addresses |
+| `allowed_domains` | subset | Permitted recipient domains |
+
+| Path | Default TTL |
+|------|-------------|
+| `email-draft` | 24h |
+| `email-send` | 4h |
+| `email-read` | 24h |
+
+---
+
+### customers — Customer Management
+
+Governs CRM operations: contacts, activities, deals, tasks.
+
+| Bound | Type | Purpose |
+|-------|------|---------|
+| `write_daily_max` | cumulative | Daily write operations |
+
+| Context | Type | Purpose |
+|---------|------|---------|
+| `contact_type` | subset | customer, lead, partner, vendor |
+
+| Path | Default TTL |
+|------|-------------|
+| `customers-read` | 24h |
+| `customers-write` | 8h |
+| `customers-delete` | 2h |
+
+---
+
+### schedule — Scheduling Authority
+
+Governs calendar access: reading, drafting, and booking events.
+
+| Bound | Type | Purpose |
+|-------|------|---------|
+| `booking_daily_max` | cumulative | Daily new bookings |
+| `booking_duration_max` | per-event | Max event duration (minutes) |
+| `lookahead_days_max` | per-event | Max days into the future |
+
+| Context | Type | Purpose |
+|---------|------|---------|
+| `allowed_calendars` | subset | Permitted calendar names |
+| `allowed_attendees` | subset | Permitted attendee emails |
+| `allowed_domains` | subset | Permitted attendee domains |
+
+| Path | Default TTL |
+|------|-------------|
+| `schedule-read` | 24h |
+| `schedule-draft` | 24h |
+| `schedule-book` | 4h |
+
+---
+
+### publish — Content Publishing
+
+Governs posting public content to social media, blogs, and other platforms.
+
+| Bound | Type | Purpose |
+|-------|------|---------|
+| `post_daily_max` | cumulative | Daily post limit |
+| `post_monthly_max` | cumulative | Monthly post limit |
+
+| Context | Type | Purpose |
+|---------|------|---------|
+| `allowed_platforms` | subset | twitter, linkedin, instagram, blog, medium |
+| `content_type` | enum | text, image, link, thread |
+| `audience` | enum | public, followers, connections |
+
+| Path | Default TTL |
+|------|-------------|
+| `publish-draft` | 24h |
+| `publish-post` | 4h |
+
+---
+
+### records — Records Authority
+
+Governs accessing and modifying personal structured data: queries, schema changes, exports. Renamed from `data` — for personal databases and spreadsheet replacements, not shared CRM data.
+
+| Bound | Type | Purpose |
+|-------|------|---------|
+| `row_limit_max` | per-query | Maximum rows returned |
+| `query_count_daily_max` | cumulative | Daily query limit |
+| `export_row_count_daily_max` | cumulative | Daily exported row limit |
+
+| Context | Type | Purpose |
+|---------|------|---------|
+| `access_level` | enum | read, write, admin |
+| `data_scope` | enum | public, internal, pii |
+| `scope` | enum | external (production), internal (sandbox) |
+
+| Path | Default TTL |
+|------|-------------|
+| `records-read` | 8h |
+| `records-write` | 2h |
+| `records-export` | 1h |
+
+---
+
+## How Profiles Work
+
+A human creates an authorization by selecting a profile and execution path, setting the bounds, and answering the gate questions. Domain owners cryptographically attest to the bounds. The Gatekeeper then enforces those bounds on every tool call:
+
+```
+Human sets bounds          Agent requests execution        Gatekeeper checks
+amount_max: 80 EUR    ->   amount: 5 EUR              ->  5 <= 80, approved
+action_type: [charge]      action_type: "charge"          "charge" in [charge], approved
+amount_daily_max: 500      amount_daily: 423 (from log)   423 + 5 <= 500, approved
+```
+
+If any bound is exceeded, the Gatekeeper blocks execution.
+
+All profiles require the same six gates: bounds, problem, objective, tradeoff, commitment, and decision owner.
+
+---
+
+## Community Profiles
+
+Anyone can create and publish profiles through the [HAP Service Provider](https://humanagencyprotocol.com). Published profiles are immutable and versioned. There is no approval process — trust decisions are local.
+
+---
+
+See [humanagencyprotocol.org](https://humanagencyprotocol.org) for the full protocol specification.

package/profiles/calendar/0.4.profile.json

@@ -0,0 +1,183 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/calendar@0.4",
+  "name": "Calendar",
+  "version": "0.4",
+  "description": "Calendar authority \u2014 governs calendar access: reading, drafting, and booking events",
+  "boundsSchema": {
+    "keyOrder": [
+      "profile",
+      "booking_daily_max",
+      "booking_duration_max",
+      "lookahead_days_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "booking_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily booking limit",
+        "description": "Maximum new events booked per day",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        }
+      },
+      "booking_duration_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max event duration",
+        "description": "Maximum duration of a single event",
+        "unit": "minutes",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "duration"
+        }
+      },
+      "lookahead_days_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max lookahead",
+        "description": "Maximum number of days into the future an event can be booked",
+        "unit": "days",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "lookahead"
+        }
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "allowed_calendars",
+      "allowed_attendees",
+      "allowed_domains"
+    ],
+    "fields": {
+      "allowed_calendars": {
+        "type": "string",
+        "required": false,
+        "displayName": "Allowed calendars",
+        "description": "Comma-separated list of calendar names the agent may access",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_attendees": {
+        "type": "string",
+        "required": false,
+        "displayName": "Allowed attendees",
+        "format": "email",
+        "description": "Comma-separated list of allowed attendee email addresses",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_domains": {
+        "type": "string",
+        "required": false,
+        "displayName": "Allowed domains",
+        "format": "domain",
+        "description": "Comma-separated list of allowed attendee domains (e.g. acme.com,partner.org)",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "duration": {
+        "source": "declared",
+        "description": "Duration of the event in minutes",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "lookahead": {
+        "source": "declared",
+        "description": "Days from now the event is scheduled",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "allowed_calendars": {
+        "source": "declared",
+        "description": "Calendar being used (checked against authorized calendars)",
+        "required": false,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_attendees": {
+        "source": "declared",
+        "description": "Attendee addresses from this event (checked against authorized attendees)",
+        "required": false,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_domains": {
+        "source": "declared",
+        "description": "Unique attendee domains from this event (checked against authorized domains)",
+        "required": false,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "booking_count_daily": {
+        "source": "cumulative",
+        "cumulativeField": "_count",
+        "window": "daily",
+        "description": "Running daily booking count (resolved from execution log)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 31536000
+  },
+  "retention_minimum": 7776000
+}