@suveren/gateway 0.28.0 → 0.28.1

package/content/integrations/crm.json

@@ -340,7 +340,8 @@
           "action_type": "setup"
         },
         "actionLabel": "Test data loaded",
-        "hideUnlessAuthorized": true
+        "hideUnlessAuthorized": true,
+        "simulationOnly": true
       },
       "clear_simulation": {
         "executionMapping": {},
@@ -349,7 +350,8 @@
           "action_type": "setup"
         },
         "actionLabel": "Test data cleared",
-        "hideUnlessAuthorized": true
+        "hideUnlessAuthorized": true,
+        "simulationOnly": true
       }
     }
   },

package/content/integrations/erp.json

@@ -186,7 +186,8 @@
           "action_type": "setup"
         },
         "actionLabel": "Test data loaded",
-        "hideUnlessAuthorized": true
+        "hideUnlessAuthorized": true,
+        "simulationOnly": true
       },
       "clear_simulation": {
         "executionMapping": {},
@@ -194,7 +195,8 @@
           "action_type": "setup"
         },
         "actionLabel": "Test data cleared",
-        "hideUnlessAuthorized": true
+        "hideUnlessAuthorized": true,
+        "simulationOnly": true
       }
     }
   },

package/content/integrations/mail.json

@@ -83,7 +83,8 @@
           "action_type": "setup"
         },
         "actionLabel": "Test data loaded",
-        "hideUnlessAuthorized": true
+        "hideUnlessAuthorized": true,
+        "simulationOnly": true
       },
       "clear_simulation": {
         "executionMapping": {},
@@ -91,7 +92,8 @@
           "action_type": "setup"
         },
         "actionLabel": "Test data cleared",
-        "hideUnlessAuthorized": true
+        "hideUnlessAuthorized": true,
+        "simulationOnly": true
       }
     }
   },

package/dist/mcp-server/http.mjs

@@ -4409,8 +4409,10 @@ function zeroCappedBound(profileId, bounds, actionType) {
 }
 function toolAlwaysListed(tool, isBuiltin) {
   if (tool.internal || !tool.gating?.profile) return false;
-  if (tool.gating.hideUnlessAuthorized || tool.gating.category === "disabled") return false;
-  return !isBuiltin(tool.integrationId);
+  if (tool.gating.category === "disabled") return false;
+  if (isBuiltin(tool.integrationId)) return false;
+  if (!tool.gating.hideUnlessAuthorized) return true;
+  return Boolean(tool.gating.simulationOnly) && isSimulationMode();
 }
 function toolIsAuthorizedForDisplay(tool, matchingAuths) {
   if (!tool.gating?.hideUnlessAuthorized) return true;
@@ -4826,6 +4828,18 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
       }
     }
     const { matching: matchingAuths, refusals } = eligibleMandates();
+    if (tool.gating?.simulationOnly && isSimulationMode() && !toolIsAuthorizedForDisplay(tool, matchingAuths)) {
+      const actionType = staticExecution?.action_type;
+      const mandateLabel = typeof actionType === "string" ? actionType : profile;
+      recordBlocked(state2, tool, {
+        kind: "not_authorized",
+        detail: `No active authorization grants "${mandateLabel}" under profile "${profile}".`,
+        field: mandateLabel,
+        who: "gateway",
+        code: "NO_MATCHING_MANDATE"
+      });
+      return { content: [{ type: "text", text: noMandateRefusal(tool.namespacedName, mandateLabel) }], isError: true };
+    }
     if (matchingAuths.length === 0) return noEligibleMandate(refusals);
     const errors = [];
     const passers = [];
@@ -7493,6 +7507,7 @@ var IntegrationManager = class {
           readGovernanceReason: ext.readGovernanceReason,
           blockedArgs: ext.blockedArgs,
           hideUnlessAuthorized: ext.hideUnlessAuthorized,
+          simulationOnly: ext.simulationOnly,
           approvalView: ext.approvalView
         };
       }
@@ -7509,6 +7524,7 @@ var IntegrationManager = class {
         argEncoding: ext.argEncoding,
         argNormalization: ext.argNormalization,
         hideUnlessAuthorized: ext.hideUnlessAuthorized,
+        simulationOnly: ext.simulationOnly,
         approvalView: ext.approvalView
       };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",