@suveren/gateway 0.21.0 → 0.22.0

package/content/integrations/erp.json

@@ -117,7 +117,13 @@
         "staticExecution": {
           "action_type": "send"
         },
-        "actionLabel": "Quote sent"
+        "actionLabel": "Quote sent",
+        "preview": {
+          "tool": "get_quote",
+          "args": { "id": "id", "revision": "revision" },
+          "version": { "arg": "revision", "field": "revision" },
+          "fields": ["number", "revision", "status", "customer_id", "lines", "net_total", "discount_pct", "valid_until"]
+        }
       },
       "convert_quote_to_order": {
         "executionMapping": {
@@ -128,7 +134,13 @@
         "staticExecution": {
           "action_type": "order"
         },
-        "actionLabel": "Quote converted to order"
+        "actionLabel": "Quote converted to order",
+        "preview": {
+          "tool": "get_quote",
+          "args": { "id": "id", "revision": "revision" },
+          "version": { "arg": "revision", "field": "revision" },
+          "fields": ["number", "revision", "status", "customer_id", "lines", "net_total", "discount_pct", "valid_until"]
+        }
       },
       "load_simulation": {
         "executionMapping": {},

package/dist/control-plane/index.mjs

@@ -5,8 +5,8 @@ import {
 
 // src/index.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { existsSync as existsSync11, readFileSync as readFileSync13, renameSync as renameSync2 } from "fs";
-import { dirname as dirname9, join as join13 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync14, renameSync as renameSync2 } from "fs";
+import { dirname as dirname9, join as join14 } from "path";
 import { homedir as homedir7 } from "os";
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
@@ -599,6 +599,25 @@ async function exportReport(gatewayVersion) {
   const filename = /filename="([^"]+)"/.exec(res.headers.get("content-disposition") ?? "")?.[1] ?? "suveren-report.html";
   return { html, filename };
 }
+async function getToolPreview(data) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 12e3);
+  try {
+    const res = await fetch(`${MCP_BASE}/internal/preview`, {
+      method: "POST",
+      headers: internalHeaders(),
+      body: JSON.stringify(data),
+      signal: controller.signal
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({ error: "Unknown error" }));
+      throw new Error(`MCP preview failed: ${err.error ?? res.status}`);
+    }
+    return res.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 async function getAgentContact() {
   const res = await fetch(`${MCP_BASE}/internal/agent-contact`, {
     headers: internalHeaders()
@@ -3404,8 +3423,121 @@ function createEvidenceExportRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2)
   return router;
 }
 
-// src/routes/evidence.ts
+// src/routes/proposal-preview.ts
 import { Router as Router10 } from "express";
+
+// src/lib/execution-journal-reader.ts
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+import { join as join10 } from "path";
+function loadJournalEntries(dataDir) {
+  const path = join10(dataDir, "execution-journal.json");
+  if (!existsSync10(path)) return [];
+  try {
+    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
+    return parsed.entries ?? [];
+  } catch {
+    return [];
+  }
+}
+function findLatestByProposal(dataDir, proposalId) {
+  const rows = loadJournalEntries(dataDir).filter((e) => e.proposalId === proposalId);
+  return rows[rows.length - 1];
+}
+
+// src/routes/proposal-preview.ts
+var AS_FETCH_TIMEOUT_MS2 = 1e4;
+function createProposalStatusRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2) {
+  const router = Router10();
+  router.get("/:id/preview", async (req, res) => {
+    const proposalId = req.params.id;
+    const cookie = vault2.getSpCookie();
+    if (!cookie) {
+      res.status(401).json({ error: "No Authority Server session \u2014 sign in to preview this proposal." });
+      return;
+    }
+    let proposal;
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), AS_FETCH_TIMEOUT_MS2);
+      const pin = readPairing(dataDir);
+      let asStatus;
+      let asBody;
+      try {
+        const { res: asRes } = await fetchAs(
+          `${spUrl}/api/proposals/${encodeURIComponent(proposalId)}`,
+          { headers: { Cookie: cookie }, signal: controller.signal },
+          {
+            enforce: resolvePinTls(dataDir),
+            pinnedSpkiHex: pin && pin.asUrl === spUrl ? pin.tlsSpkiPinHex : void 0
+          }
+        );
+        asStatus = asRes.status;
+        asBody = await asRes.json().catch(() => ({}));
+      } finally {
+        clearTimeout(timeout);
+      }
+      if (asStatus < 200 || asStatus >= 300 || !asBody.proposal) {
+        res.status(asStatus >= 400 ? asStatus : 502).json({
+          error: asBody.error ?? `Could not fetch proposal ${proposalId} (${asStatus})`
+        });
+        return;
+      }
+      proposal = asBody.proposal;
+    } catch (err) {
+      if (err instanceof AsTlsMismatchError) {
+        lockAsTlsMismatch2();
+        res.status(502).json({ error: err.message });
+        return;
+      }
+      res.status(502).json({ error: `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}` });
+      return;
+    }
+    try {
+      const result = await getToolPreview({ proposalId, tool: proposal.tool, toolArgs: proposal.toolArgs });
+      if (result.status !== "ok") {
+        res.json(result);
+        return;
+      }
+      const response = { ...result, readAt: Date.now() };
+      res.json(response);
+    } catch (err) {
+      res.status(502).json({ error: `MCP server unavailable: ${err instanceof Error ? err.message : String(err)}` });
+    }
+  });
+  router.get("/:id/outcome", (req, res) => {
+    try {
+      const entry = findLatestByProposal(dataDir, req.params.id);
+      if (!entry) {
+        const none = { state: "none" };
+        res.json(none);
+        return;
+      }
+      if (entry.state === "intent") {
+        const intent = { state: "intent", at: entry.startedAt };
+        res.json(intent);
+        return;
+      }
+      if (entry.state === "done") {
+        const done = { state: "done", at: entry.finishedAt ?? entry.startedAt };
+        res.json(done);
+        return;
+      }
+      const failed = {
+        state: "failed",
+        at: entry.finishedAt ?? entry.startedAt,
+        ...entry.outcome ? { outcome: entry.outcome } : {},
+        ...entry.detail ? { detail: entry.detail } : {}
+      };
+      res.json(failed);
+    } catch (err) {
+      res.status(500).json({ error: `Could not read the execution journal: ${err instanceof Error ? err.message : String(err)}` });
+    }
+  });
+  return router;
+}
+
+// src/routes/evidence.ts
+import { Router as Router11 } from "express";
 import { verifyTicketSignature, encodeDidKey } from "@hap/core";
 function issuerFromPublicKeyHex(publicKeyHex) {
   return encodeDidKey(Buffer.from(publicKeyHex, "hex"));
@@ -3471,7 +3603,7 @@ function mergeAuthorizations(evidence) {
   return out;
 }
 function createEvidenceRouter() {
-  const router = Router10();
+  const router = Router11();
   router.get("/authorizations", async (_req, res) => {
     try {
       const evidence = await getLocalEvidence();
@@ -3514,7 +3646,7 @@ function createEvidenceRouter() {
 }
 
 // src/routes/report.ts
-import { Router as Router11 } from "express";
+import { Router as Router12 } from "express";
 function handleError(res, err) {
   if (err instanceof McpLockedError) {
     res.status(503).json({ error: err.message });
@@ -3526,7 +3658,7 @@ function handleError(res, err) {
   });
 }
 function createReportRouter(getGatewayVersion) {
-  const router = Router11();
+  const router = Router12();
   router.get("/", async (_req, res) => {
     try {
       res.json(await getReport());
@@ -3572,9 +3704,9 @@ function createReportRouter(getGatewayVersion) {
 }
 
 // src/routes/decrypt-intent.ts
-import { Router as Router12 } from "express";
+import { Router as Router13 } from "express";
 function createDecryptIntentRouter(vault2) {
-  const router = Router12();
+  const router = Router13();
   router.post("/", async (req, res) => {
     const { intentCiphertext, encryptedKey, approverId } = req.body;
     if (typeof intentCiphertext !== "string" || intentCiphertext.length === 0) {
@@ -3750,22 +3882,22 @@ data: ${data}
 }
 
 // src/routes/gateway-settings.ts
-import { Router as Router13 } from "express";
+import { Router as Router14 } from "express";
 
 // src/lib/gateway-settings.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join10, dirname as dirname7 } from "path";
+import { join as join11, dirname as dirname7 } from "path";
 var DEFAULT_SETTINGS = {
   desktopNotifications: true
 };
 function settingsPath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join10(homedir5(), ".suveren");
-  return join10(dir, "settings.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join11(homedir5(), ".suveren");
+  return join11(dir, "settings.json");
 }
 function readSettings(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync10(settingsPath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync11(settingsPath(dataDir), "utf8"));
     return {
       desktopNotifications: typeof raw.desktopNotifications === "boolean" ? raw.desktopNotifications : DEFAULT_SETTINGS.desktopNotifications
     };
@@ -3786,7 +3918,7 @@ function writeSettings(patch, dataDir) {
 
 // src/routes/gateway-settings.ts
 function createGatewaySettingsRouter() {
-  const router = Router13();
+  const router = Router14();
   router.get("/", (_req, res) => {
     res.json(readSettings());
   });
@@ -3809,23 +3941,23 @@ function createGatewaySettingsRouter() {
 }
 
 // src/routes/archived-mandates.ts
-import { Router as Router14 } from "express";
+import { Router as Router15 } from "express";
 
 // src/lib/archived-mandates-store.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join11, dirname as dirname8 } from "path";
+import { join as join12, dirname as dirname8 } from "path";
 var ID_PATTERN = /^[A-Za-z0-9_.:-]{1,200}$/;
 function isValidMandateId(id) {
   return typeof id === "string" && ID_PATTERN.test(id);
 }
 function storePath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join11(homedir6(), ".suveren");
-  return join11(dir, "archived-mandates.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join12(homedir6(), ".suveren");
+  return join12(dir, "archived-mandates.json");
 }
 function readArchived(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync11(storePath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync12(storePath(dataDir), "utf8"));
     if (!Array.isArray(raw.archived)) return [];
     return [...new Set(raw.archived.filter(isValidMandateId))];
   } catch {
@@ -3852,7 +3984,7 @@ function unarchiveMandate(id, dataDir) {
 
 // src/routes/archived-mandates.ts
 function createArchivedMandatesRouter(dataDir) {
-  const router = Router14();
+  const router = Router15();
   router.get("/", (_req, res) => {
     res.json({ archived: readArchived(dataDir) });
   });
@@ -3874,7 +4006,7 @@ function createArchivedMandatesRouter(dataDir) {
 }
 
 // src/routes/internal-events.ts
-import { Router as Router15 } from "express";
+import { Router as Router16 } from "express";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 var SESSION_EXPIRED = "session-expired";
@@ -3889,7 +4021,7 @@ function secretMatches(provided, expected) {
   return timingSafeEqual2(a, b);
 }
 function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch, onAsTlsMismatch) {
-  const router = Router15();
+  const router = Router16();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
@@ -3923,7 +4055,7 @@ function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch
 }
 
 // src/routes/internal-mandate.ts
-import { Router as Router16 } from "express";
+import { Router as Router17 } from "express";
 import { timingSafeEqual as timingSafeEqual3, randomUUID } from "crypto";
 
 // src/lib/mandate-ceremony.ts
@@ -4105,7 +4237,7 @@ function secretMatches2(provided, expected) {
   return a.length === b.length && timingSafeEqual3(a, b);
 }
 function createInternalMandateRouter(getSecret, deps) {
-  const router = Router16();
+  const router = Router17();
   router.post("/mandate", async (req, res) => {
     if (!secretMatches2(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
       res.status(401).json({ error: "unauthorized" });
@@ -4346,17 +4478,17 @@ function buildSessionHealth(vault2) {
 }
 
 // src/lib/denials-reader.ts
-import { existsSync as existsSync10, readFileSync as readFileSync12 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
+import { join as join13 } from "path";
 function loadDenials(dataDir, decrypt) {
-  const encPath = join12(dataDir, "denials.enc.json");
-  const plainPath = join12(dataDir, "denials.json");
-  if (existsSync10(encPath)) {
-    const { blob } = JSON.parse(readFileSync12(encPath, "utf-8"));
+  const encPath = join13(dataDir, "denials.enc.json");
+  const plainPath = join13(dataDir, "denials.json");
+  if (existsSync11(encPath)) {
+    const { blob } = JSON.parse(readFileSync13(encPath, "utf-8"));
     return JSON.parse(decrypt(blob)).records ?? [];
   }
-  if (existsSync10(plainPath)) {
-    return JSON.parse(readFileSync12(plainPath, "utf-8")).records ?? [];
+  if (existsSync11(plainPath)) {
+    return JSON.parse(readFileSync13(plainPath, "utf-8")).records ?? [];
   }
   return [];
 }
@@ -4380,9 +4512,9 @@ function isSimulationMode() {
 // src/index.ts
 (function migrateDataDir() {
   if (process.env.SUVEREN_DATA_DIR) return;
-  const oldDir = join13(homedir7(), ".hap");
-  const newDir = join13(homedir7(), ".suveren");
-  if (!existsSync11(newDir) && existsSync11(oldDir)) {
+  const oldDir = join14(homedir7(), ".hap");
+  const newDir = join14(homedir7(), ".suveren");
+  if (!existsSync12(newDir) && existsSync12(oldDir)) {
     try {
       renameSync2(oldDir, newDir);
       console.error(`[Control Plane] Migrated data directory: ${oldDir} \u2192 ${newDir}`);
@@ -4392,14 +4524,14 @@ function isSimulationMode() {
     }
   }
 })();
-var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join13(homedir7(), ".suveren");
+var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join14(homedir7(), ".suveren");
 var SP_URL = resolveAsUrl(DATA_DIR);
 validatePinTlsForUrl(resolvePinTls(DATA_DIR), SP_URL);
 var POLICY_LOCKED = [...readPolicy().locked];
 var POLICY_LOCKED_INSTALL_METHOD = readPolicy().policy.installMethod;
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
-var UI_DIST = process.env.HAP_UI_DIST ?? join13(import.meta.dirname ?? __dirname, "../../ui/dist");
+var UI_DIST = process.env.HAP_UI_DIST ?? join14(import.meta.dirname ?? __dirname, "../../ui/dist");
 var vault = new Vault(DATA_DIR);
 (function repairIfAsUrlChanged() {
   const pairing = readPairing(DATA_DIR);
@@ -4689,6 +4821,7 @@ app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRou
 app.use("/api/archived-mandates", jsonParser, authGuard, createArchivedMandatesRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
 app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL, vault, DATA_DIR, lockAsTlsMismatch));
+app.use("/proposal-status", authGuard, createProposalStatusRouter(SP_URL, vault, DATA_DIR, lockAsTlsMismatch));
 app.use("/api/evidence", authGuard, createEvidenceRouter());
 app.use("/api/report", jsonParser, authGuard, createReportRouter(() => RUNNING_VERSION));
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
@@ -4851,7 +4984,7 @@ app.get("/as-pairing", authGuard, (_req, res) => {
 });
 app.get("/denials", authGuard, (req, res) => {
   try {
-    const dataDir = process.env.SUVEREN_DATA_DIR ?? join13(homedir7(), ".suveren");
+    const dataDir = process.env.SUVEREN_DATA_DIR ?? join14(homedir7(), ".suveren");
     const all = loadDenials(dataDir, (blob) => vault.decrypt(blob));
     const since = Number(req.query.since);
     const limit = Number(req.query.limit);
@@ -4992,7 +5125,7 @@ app.use(
 function detectInstallMethod2() {
   return detectInstallMethod({
     dir: import.meta.dirname ?? __dirname,
-    dockerEnv: existsSync11("/.dockerenv"),
+    dockerEnv: existsSync12("/.dockerenv"),
     managed: process.env.SUVEREN_INSTALL_METHOD === "managed" || POLICY_LOCKED_INSTALL_METHOD === "managed"
   });
 }
@@ -5002,10 +5135,10 @@ function detectRunningVersion() {
     return process.env.HAP_BUILD_SHA ?? "dev";
   }
   const dir = import.meta.dirname ?? __dirname;
-  const bundlePkg = join13(dir, "..", "..", "package.json");
-  if (existsSync11(bundlePkg)) {
+  const bundlePkg = join14(dir, "..", "..", "package.json");
+  if (existsSync12(bundlePkg)) {
     try {
-      const pkg = JSON.parse(readFileSync13(bundlePkg, "utf8"));
+      const pkg = JSON.parse(readFileSync14(bundlePkg, "utf8"));
       if (pkg.name === "@suveren/gateway" && typeof pkg.version === "string") {
         return pkg.version;
       }
@@ -5047,7 +5180,7 @@ app.get("/health", async (req, res) => {
     }
   });
 });
-if (existsSync11(UI_DIST)) {
+if (existsSync12(UI_DIST)) {
   app.use(express.static(UI_DIST, {
     setHeaders: (res, filePath) => {
       if (filePath.endsWith("index.html")) {
@@ -5057,7 +5190,7 @@ if (existsSync11(UI_DIST)) {
   }));
   app.get("*", (_req, res) => {
     res.setHeader("Cache-Control", "no-store, must-revalidate");
-    res.sendFile(join13(UI_DIST, "index.html"));
+    res.sendFile(join14(UI_DIST, "index.html"));
   });
 } else {
   app.get("/", (_req, res) => {