@suveren/gateway 0.22.0 → 0.23.1

package/content/integrations/crm.json

@@ -6,7 +6,7 @@
   "icon": "users",
   "profile": "customers",
   "npmPackage": "@humanagencyp/crm-mcp",
-  "npmVersion": "1.3.0",
+  "npmVersion": "1.4.1",
   "mcp": {
     "command": "crm-mcp",
     "args": []
@@ -41,10 +41,10 @@
   "oauth": null,
   "toolGating": {
     "default": {
-      "executionMapping": {},
-      "staticExecution": {
-        "contact_type": "customer"
-      }
+      "executionMapping": {
+        "contact_type": "contact_type"
+      },
+      "staticExecution": {}
     },
     "overrides": {
       "create_contact": {
@@ -57,54 +57,230 @@
         "actionLabel": "Contact created"
       },
       "update_contact": {
-        "executionMapping": {},
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
         "staticExecution": {
-          "contact_type": "customer",
           "action_type": "write"
         },
-        "actionLabel": "Contact updated"
+        "actionLabel": "Contact updated",
+        "preview": {
+          "tool": "get_contact",
+          "args": {
+            "id": "id",
+            "revision": "revision"
+          },
+          "version": {
+            "arg": "revision",
+            "field": "revision"
+          },
+          "fields": [
+            "name",
+            "company",
+            "type",
+            "stage",
+            "email",
+            "archived",
+            "revision"
+          ]
+        }
       },
       "delete_contact": {
-        "executionMapping": {},
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
+        "staticExecution": {
+          "action_type": "delete"
+        },
+        "actionLabel": "Contact archived",
+        "preview": {
+          "tool": "get_contact",
+          "args": {
+            "id": "id",
+            "revision": "revision"
+          },
+          "version": {
+            "arg": "revision",
+            "field": "revision"
+          },
+          "fields": [
+            "name",
+            "company",
+            "type",
+            "stage",
+            "email",
+            "archived",
+            "revision"
+          ]
+        }
+      },
+      "restore_contact": {
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
         "staticExecution": {
-          "contact_type": "customer",
           "action_type": "delete"
         },
-        "actionLabel": "Contact deleted"
+        "actionLabel": "Contact restored",
+        "preview": {
+          "tool": "get_contact",
+          "args": {
+            "id": "id",
+            "revision": "revision"
+          },
+          "version": {
+            "arg": "revision",
+            "field": "revision"
+          },
+          "fields": [
+            "name",
+            "company",
+            "type",
+            "stage",
+            "email",
+            "archived",
+            "revision"
+          ]
+        }
+      },
+      "convert_contact": {
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
+        "staticExecution": {
+          "action_type": "write"
+        },
+        "actionLabel": "Contact type changed",
+        "preview": {
+          "tool": "get_contact",
+          "args": {
+            "id": "id",
+            "revision": "revision"
+          },
+          "version": {
+            "arg": "revision",
+            "field": "revision"
+          },
+          "fields": [
+            "name",
+            "company",
+            "type",
+            "stage",
+            "email",
+            "archived",
+            "revision"
+          ]
+        }
       },
       "log_activity": {
-        "executionMapping": {},
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
         "staticExecution": {
-          "contact_type": "customer",
           "action_type": "write"
+        },
+        "preview": {
+          "tool": "get_contact",
+          "args": {
+            "id": "contact_id"
+          },
+          "fields": [
+            "name",
+            "company",
+            "type"
+          ]
         }
       },
       "create_deal": {
-        "executionMapping": {},
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
         "staticExecution": {
-          "contact_type": "customer",
           "action_type": "write"
+        },
+        "preview": {
+          "tool": "get_contact",
+          "args": {
+            "id": "contact_id"
+          },
+          "fields": [
+            "name",
+            "company",
+            "type"
+          ]
         }
       },
       "update_deal": {
-        "executionMapping": {},
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
         "staticExecution": {
-          "contact_type": "customer",
           "action_type": "write"
+        },
+        "preview": {
+          "tool": "get_deal",
+          "args": {
+            "id": "id",
+            "revision": "revision"
+          },
+          "version": {
+            "arg": "revision",
+            "field": "revision"
+          },
+          "fields": [
+            "title",
+            "value",
+            "currency",
+            "stage",
+            "expected_close",
+            "contact_id",
+            "revision"
+          ]
         }
       },
       "create_task": {
-        "executionMapping": {},
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
         "staticExecution": {
-          "contact_type": "customer",
           "action_type": "write"
+        },
+        "preview": {
+          "tool": "get_contact",
+          "args": {
+            "id": "contact_id"
+          },
+          "fields": [
+            "name",
+            "company",
+            "type"
+          ]
         }
       },
       "complete_task": {
-        "executionMapping": {},
+        "executionMapping": {
+          "contact_type": "contact_type"
+        },
         "staticExecution": {
-          "contact_type": "customer",
           "action_type": "write"
+        },
+        "preview": {
+          "tool": "get_task",
+          "args": {
+            "id": "id",
+            "revision": "revision"
+          },
+          "version": {
+            "arg": "revision",
+            "field": "revision"
+          },
+          "fields": [
+            "title",
+            "status",
+            "due_date",
+            "contact_id",
+            "revision"
+          ]
         }
       },
       "find_contacts": {
@@ -112,6 +288,11 @@
         "boundField": "read_access",
         "requiredValue": "unlimited"
       },
+      "get_contact": {
+        "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited"
+      },
       "get_timeline": {
         "category": "read",
         "boundField": "read_access",
@@ -122,11 +303,21 @@
         "boundField": "read_access",
         "requiredValue": "unlimited"
       },
+      "get_deal": {
+        "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited"
+      },
       "list_tasks": {
         "category": "read",
         "boundField": "read_access",
         "requiredValue": "unlimited"
       },
+      "get_task": {
+        "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited"
+      },
       "export_crm": {
         "category": "read",
         "boundField": "export_access",

package/dist/control-plane/index.mjs

@@ -3538,10 +3538,31 @@ function createProposalStatusRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2)
 
 // src/routes/evidence.ts
 import { Router as Router11 } from "express";
-import { verifyTicketSignature, encodeDidKey } from "@hap/core";
+import { createPublicKey as createPublicKey2, verify as verifyEd25519 } from "crypto";
+import { verifyTicketSignature, encodeDidKey, canonicalize as canonicalize2 } from "@hap/core";
 function issuerFromPublicKeyHex(publicKeyHex) {
   return encodeDidKey(Buffer.from(publicKeyHex, "hex"));
 }
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function isPreV07Ticket(receipt) {
+  return receipt.issuer === void 0 || receipt.issuer === null;
+}
+function verifyPreV07TicketSignature(receipt, asPublicKeyHex) {
+  const { signature, ...signed } = receipt;
+  if (typeof signature !== "string" || !/^[0-9a-f]{64}$/i.test(asPublicKeyHex)) return false;
+  try {
+    const key = createPublicKey2({
+      key: Buffer.concat([ED25519_SPKI_PREFIX, Buffer.from(asPublicKeyHex, "hex")]),
+      format: "der",
+      type: "spki"
+    });
+    const sig = Buffer.from(signature, "base64");
+    if (sig.length !== 64) return false;
+    return verifyEd25519(null, Buffer.from(canonicalize2(signed), "utf8"), key, sig);
+  } catch {
+    return false;
+  }
+}
 async function verifyAll(receipts) {
   const out = {};
   for (const raw of receipts) {
@@ -3552,6 +3573,11 @@ async function verifyAll(receipts) {
       out[id] = "unverifiable";
       continue;
     }
+    const receipt = e.receipt;
+    if (isPreV07Ticket(receipt)) {
+      out[id] = verifyPreV07TicketSignature(receipt, e.asPublicKey) ? "valid-legacy" : "invalid";
+      continue;
+    }
     try {
       await verifyTicketSignature(e.receipt, { trustedIssuers: [issuerFromPublicKeyHex(e.asPublicKey)] });
       out[id] = "valid";
@@ -4131,7 +4157,7 @@ async function planMandate(req, deps) {
   if (!isPersonal) {
     const cfg = await deps.as("GET", `/api/groups/${encodeURIComponent(group.id)}/profile-config/${encodeURIComponent(profile.id)}`);
     approvers = (cfg.status === 200 ? cfg.body?.config?.approvers : void 0) ?? [];
-    if (approvers.length === 0) refuse(`${name} is not enabled in "${group.name}": a team admin must name who may give ${name} mandates.`);
+    if (approvers.length === 0) refuse(`${name} ${versionOf(profile.id)} is not enabled in "${group.name}". Ask an admin of "${group.name}" to enable ${name} ${versionOf(profile.id)} and name who may give its mandates.`);
     if (!approvers.includes(user.id)) refuse(`Only ${name}'s approvers in "${group.name}" can give this mandate, and the signed-in person is not one of them.`);
   }
   const bounds = { ...scalarRecord("limits", req.limits), profile: profile.id };

package/dist/mcp-server/http.mjs

@@ -3270,6 +3270,9 @@ function mapPreviewArgs(preview, actionArgs) {
   }
   return mapped;
 }
+function previewHasNoTarget(preview, mapped) {
+  return Object.keys(preview.args).length > 0 && Object.keys(mapped).length === 0;
+}
 var PreviewTimeoutError = class extends Error {
 };
 function withTimeout(p, ms) {
@@ -3322,6 +3325,7 @@ async function computeSubmissionPreviewHash(integrationManager2, integrationId,
   const preview = getToolPreviewConfig(integrationId, toolName);
   if (!preview || preview.version) return void 0;
   const mapped = mapPreviewArgs(preview, actionArgs);
+  if (previewHasNoTarget(preview, mapped)) return void 0;
   const read = await readPreview(integrationManager2, integrationId, preview.tool, mapped);
   if (read.status !== "ok") return void 0;
   return hashPreviewBody(read.body);
@@ -3338,6 +3342,7 @@ async function buildInternalPreview(integrationManager2, integrationId, toolName
   const preview = getToolPreviewConfig(integrationId, toolName);
   if (!preview) return { status: "none" };
   const mappedArgs = mapPreviewArgs(preview, actionArgs);
+  if (previewHasNoTarget(preview, mappedArgs)) return { status: "none", reason: "no_target" };
   const read1 = await readPreview(integrationManager2, integrationId, preview.tool, mappedArgs);
   if (read1.status !== "ok") return read1;
   const ok = (extra = {}) => ({