@suveren/gateway 0.29.0 → 0.30.0

package/content/integrations/gmail.json

@@ -145,6 +145,8 @@
       },
       "list_messages": {
         "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited",
         "read": {
           "ageField": "read_age_days",
           "queryArg": "q",
@@ -158,6 +160,8 @@
       },
       "get_message": {
         "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited",
         "read": {
           "ageField": "read_age_days",
           "resultDatePath": "internalDate",
@@ -175,6 +179,8 @@
       },
       "list_drafts": {
         "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited",
         "read": {
           "ageField": "read_age_days",
           "queryArg": "q",
@@ -187,6 +193,8 @@
       },
       "get_draft": {
         "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited",
         "read": {
           "ageField": "read_age_days",
           "resultDatePath": "message.internalDate",
@@ -207,8 +215,11 @@
       },
       "get_attachment": {
         "category": "read",
-        "readGovernance": "none",
-        "readGovernanceReason": "Transitively age-gated: an attachmentId is only obtainable from get_message, which enforces the read-age window. No independently addressable content."
+        "boundField": "read_access",
+        "requiredValue": "unlimited",
+        "read": {
+          "ageField": "read_age_days"
+        }
       },
       "list_labels": {
         "category": "read",

package/content/integrations/mail.json

@@ -7,6 +7,9 @@
   "profile": "email",
   "npmPackage": "@humanagencyp/email-mcp",
   "npmVersion": "0.3.0",
+  "readPolicy": {
+    "defaultAgeDays": 30
+  },
   "mcp": {
     "command": "email-mcp",
     "args": []
@@ -61,12 +64,19 @@
       "list_messages": {
         "category": "read",
         "boundField": "read_access",
-        "requiredValue": "unlimited"
+        "requiredValue": "unlimited",
+        "read": {
+          "ageField": "read_age_days"
+        }
       },
       "get_message": {
         "category": "read",
         "boundField": "read_access",
-        "requiredValue": "unlimited"
+        "requiredValue": "unlimited",
+        "read": {
+          "ageField": "read_age_days",
+          "resultDatePath": "received_at"
+        }
       },
       "send_message": {
         "executionMapping": {

package/content/integrations/mollie.json

@@ -129,6 +129,16 @@
         "staticExecution": {
           "action_type": "charge"
         }
+      },
+      "ListProfiles": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Returns the organisation's own payment profile configuration (names, websites, status) — no customer or payment data."
+      },
+      "GetOrganizationDetails": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Returns the connected Mollie organisation's own name/registration details — no customer or payment data."
       }
     }
   },

package/dist/control-plane/index.mjs

@@ -5,9 +5,9 @@ import {
 
 // src/index.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { existsSync as existsSync13, readFileSync as readFileSync15, renameSync as renameSync3 } from "fs";
-import { dirname as dirname10, join as join15 } from "path";
-import { homedir as homedir8 } from "os";
+import { existsSync as existsSync13, readFileSync as readFileSync16, renameSync as renameSync4 } from "fs";
+import { dirname as dirname11, join as join16 } from "path";
+import { homedir as homedir9 } from "os";
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
 
@@ -643,6 +643,13 @@ async function getSkippedCommitments() {
   if (!res.ok) throw new Error("Failed to fetch skipped commitments");
   return res.json();
 }
+async function getMyPendingProposals() {
+  const res = await fetch(`${MCP_BASE}/internal/my-pending-proposals`, {
+    headers: internalHeaders()
+  });
+  if (!res.ok) throw new Error("Failed to fetch my pending proposals");
+  return res.json();
+}
 async function getLocalEvidence() {
   const res = await fetch(`${MCP_BASE}/internal/evidence`, {
     headers: internalHeaders()
@@ -2258,6 +2265,7 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
         }
         vault2.wipe();
         await vault2.deriveAndSetKey(apiKey);
+        vault2.setSpCookie(sessionCookie);
       }
       const sessionExpiresAt = typeof data.sessionExpiresAt === "number" ? data.sessionExpiresAt : null;
       vault2.setSessionExpiresAt(sessionExpiresAt);
@@ -3376,15 +3384,15 @@ import { promisify } from "util";
 var run = promisify(execFile);
 var SUPPORTED = /* @__PURE__ */ new Set(["darwin", "win32", "linux"]);
 var MODULE_DIR = pathDirname(fileURLToPath(import.meta.url));
-function findCli(dirname11 = MODULE_DIR) {
+function findCli(dirname12 = MODULE_DIR) {
   const candidates = [
     // Bundled (the shipped layout): dist/control-plane → dist → root → bin
-    resolve(dirname11, "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname12, "..", "..", "bin", "suveren-gateway.js"),
     // Bundled, were the routes/ directory ever preserved.
-    resolve(dirname11, "..", "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname12, "..", "..", "..", "bin", "suveren-gateway.js"),
     // Dev, running from source: the repo's own bundle directory.
-    resolve(dirname11, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
-    resolve(dirname11, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
+    resolve(dirname12, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
+    resolve(dirname12, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
     // Deliberately NO process.cwd() fallback: it makes the result depend on
     // where the process happened to be launched from, so the same install
     // resolves differently between a shell and a login service — and it would
@@ -4622,10 +4630,62 @@ function createArchivedMandatesRouter(dataDir) {
   return router;
 }
 
-// src/routes/internal-events.ts
+// src/routes/blocked-seen.ts
 import { Router as Router19 } from "express";
+
+// src/lib/blocked-seen-store.ts
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, renameSync as renameSync3 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join14, dirname as dirname10 } from "path";
+function storePath2(dataDir) {
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join14(homedir8(), ".suveren");
+  return join14(dir, "blocked-seen.json");
+}
+function readLastSeenBlockedAt(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync14(storePath2(dataDir), "utf8"));
+    return typeof raw.lastSeenBlockedAt === "number" && Number.isFinite(raw.lastSeenBlockedAt) ? raw.lastSeenBlockedAt : 0;
+  } catch {
+    return 0;
+  }
+}
+function markBlockedSeen(ts, dataDir) {
+  const safeTs = typeof ts === "number" && Number.isFinite(ts) ? ts : Date.now();
+  const path = storePath2(dataDir);
+  mkdirSync9(dirname10(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  writeFileSync9(tmp, JSON.stringify({ lastSeenBlockedAt: safeTs }, null, 2) + "\n", "utf8");
+  renameSync3(tmp, path);
+  return safeTs;
+}
+
+// src/routes/blocked-seen.ts
+function createBlockedSeenRouter(dataDir) {
+  const router = Router19();
+  router.get("/", (_req, res) => {
+    res.json({ lastSeenBlockedAt: readLastSeenBlockedAt(dataDir) });
+  });
+  router.post("/", (req, res) => {
+    const body = req.body;
+    const ts = typeof body?.ts === "number" && Number.isFinite(body.ts) ? body.ts : Date.now();
+    try {
+      res.json({ lastSeenBlockedAt: markBlockedSeen(ts, dataDir) });
+    } catch (err) {
+      res.status(500).json({ error: `Could not save: ${err.message}` });
+    }
+  });
+  return router;
+}
+
+// src/routes/internal-events.ts
+import { Router as Router20 } from "express";
 import { timingSafeEqual as timingSafeEqual3 } from "crypto";
-var ALLOWED = ["proposal-added", "action-approval-needed"];
+var ALLOWED = [
+  "proposal-added",
+  "action-approval-needed",
+  "execution-failed",
+  "denial-recorded"
+];
 var SESSION_EXPIRED = "session-expired";
 var AS_KEY_MISMATCH = "as-key-mismatch";
 var AS_TLS_MISMATCH = "as-tls-mismatch";
@@ -4638,7 +4698,7 @@ function secretMatches2(provided, expected) {
   return timingSafeEqual3(a, b);
 }
 function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch, onAsTlsMismatch) {
-  const router = Router19();
+  const router = Router20();
   router.post("/event", (req, res) => {
     if (!secretMatches2(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
@@ -4672,7 +4732,7 @@ function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch
 }
 
 // src/routes/internal-mandate.ts
-import { Router as Router20 } from "express";
+import { Router as Router21 } from "express";
 import { timingSafeEqual as timingSafeEqual4, randomUUID } from "crypto";
 
 // src/lib/mandate-ceremony.ts
@@ -4854,7 +4914,7 @@ function secretMatches3(provided, expected) {
   return a.length === b.length && timingSafeEqual4(a, b);
 }
 function createInternalMandateRouter(getSecret, deps) {
-  const router = Router20();
+  const router = Router21();
   router.post("/mandate", async (req, res) => {
     if (!secretMatches3(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
       res.status(401).json({ error: "unauthorized" });
@@ -4887,9 +4947,13 @@ function createInternalMandateRouter(getSecret, deps) {
 }
 
 // src/lib/notification-dispatcher.ts
-var TRIGGER_EVENTS = ["proposal-added", "action-approval-needed"];
+var REVIEW_EVENTS = ["proposal-added", "action-approval-needed"];
+var FAILURE_EVENTS = ["execution-failed"];
+var TRIGGER_EVENTS = [...REVIEW_EVENTS, ...FAILURE_EVENTS];
 var TITLE = "Suveren";
 var WAITING_MESSAGE = "Something is waiting for your review.";
+var FAILURE_MESSAGE = "An approved action failed.";
+var MIXED_MESSAGE = "Something needs your attention.";
 var FLOOD_THRESHOLD = 10;
 var floodMessage = (n) => `Unusual volume: ${n} requests in the last minute.`;
 var DEBOUNCE_MS = 5e3;
@@ -4900,6 +4964,9 @@ var NotificationDispatcher = class {
   pendingWhileCoolingDown = false;
   /** Events observed since the current window opened — the flood signal only. */
   observedInWindow = 0;
+  /** Which kinds were observed since the current window opened — selects the message. */
+  reviewSeenInWindow = false;
+  failureSeenInWindow = false;
   unsubscribe = null;
   now;
   setTimeoutFn;
@@ -4917,7 +4984,8 @@ var NotificationDispatcher = class {
   start() {
     if (this.unsubscribe) return this.unsubscribe;
     const off = eventBus.subscribe((event) => {
-      if (TRIGGER_EVENTS.includes(event.type)) this.onTrigger();
+      if (FAILURE_EVENTS.includes(event.type)) this.onTrigger("failure");
+      else if (REVIEW_EVENTS.includes(event.type)) this.onTrigger("review");
     });
     this.unsubscribe = () => {
       off();
@@ -4929,9 +4997,15 @@ var NotificationDispatcher = class {
     };
     return this.unsubscribe;
   }
-  /** Exposed for tests; the bus subscription calls this. */
-  onTrigger() {
+  /**
+   * Exposed for tests; the bus subscription calls this. `kind` defaults to
+   * 'review' so every existing call site/test (written before FAILURE_EVENTS
+   * existed) keeps its exact behaviour.
+   */
+  onTrigger(kind = "review") {
     this.observedInWindow += 1;
+    if (kind === "failure") this.failureSeenInWindow = true;
+    else this.reviewSeenInWindow = true;
     if (this.cooldownTimer) {
       this.pendingWhileCoolingDown = true;
       return;
@@ -4944,7 +5018,11 @@ var NotificationDispatcher = class {
   }
   fire() {
     const count = this.observedInWindow;
+    const sawReview = this.reviewSeenInWindow;
+    const sawFailure = this.failureSeenInWindow;
     this.observedInWindow = 0;
+    this.reviewSeenInWindow = false;
+    this.failureSeenInWindow = false;
     let enabled = true;
     try {
       enabled = this.settingsFn().desktopNotifications;
@@ -4955,7 +5033,7 @@ var NotificationDispatcher = class {
       `[Control Plane] Review pending \u2014 desktop notification ${enabled ? "sent" : "suppressed (turned off)"}`
     );
     if (enabled) {
-      const message = count >= FLOOD_THRESHOLD ? floodMessage(count) : WAITING_MESSAGE;
+      const message = count >= FLOOD_THRESHOLD ? floodMessage(count) : sawReview && sawFailure ? MIXED_MESSAGE : sawFailure ? FAILURE_MESSAGE : WAITING_MESSAGE;
       this.notifyFn(TITLE, message, process.platform, this.url);
     }
     this.cooldownTimer = this.setTimeoutFn(() => {
@@ -5039,17 +5117,17 @@ function buildSessionHealth(vault2) {
 }
 
 // src/lib/denials-reader.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
+import { join as join15 } from "path";
 function loadDenials(dataDir, decrypt) {
-  const encPath = join14(dataDir, "denials.enc.json");
-  const plainPath = join14(dataDir, "denials.json");
+  const encPath = join15(dataDir, "denials.enc.json");
+  const plainPath = join15(dataDir, "denials.json");
   if (existsSync12(encPath)) {
-    const { blob } = JSON.parse(readFileSync14(encPath, "utf-8"));
+    const { blob } = JSON.parse(readFileSync15(encPath, "utf-8"));
     return JSON.parse(decrypt(blob)).records ?? [];
   }
   if (existsSync12(plainPath)) {
-    return JSON.parse(readFileSync14(plainPath, "utf-8")).records ?? [];
+    return JSON.parse(readFileSync15(plainPath, "utf-8")).records ?? [];
   }
   return [];
 }
@@ -5073,11 +5151,11 @@ function isSimulationMode() {
 // src/index.ts
 (function migrateDataDir() {
   if (process.env.SUVEREN_DATA_DIR) return;
-  const oldDir = join15(homedir8(), ".hap");
-  const newDir = join15(homedir8(), ".suveren");
+  const oldDir = join16(homedir9(), ".hap");
+  const newDir = join16(homedir9(), ".suveren");
   if (!existsSync13(newDir) && existsSync13(oldDir)) {
     try {
-      renameSync3(oldDir, newDir);
+      renameSync4(oldDir, newDir);
       console.error(`[Control Plane] Migrated data directory: ${oldDir} \u2192 ${newDir}`);
     } catch (err) {
       console.error(`[Control Plane] FATAL: could not migrate data directory ${oldDir} \u2192 ${newDir}:`, err);
@@ -5085,7 +5163,7 @@ function isSimulationMode() {
     }
   }
 })();
-var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join15(homedir8(), ".suveren");
+var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join16(homedir9(), ".suveren");
 var SP_URL = resolveAsUrl(DATA_DIR);
 validatePinTlsForUrl(resolvePinTls(DATA_DIR), SP_URL);
 var POLICY_LOCKED = [...readPolicy().locked];
@@ -5093,7 +5171,7 @@ var POLICY_LOCKED_INSTALL_METHOD = readPolicy().policy.installMethod;
 var POLICY_LOCKED_TEAM = readPolicy().policy.team;
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
-var UI_DIST = process.env.HAP_UI_DIST ?? join15(import.meta.dirname ?? __dirname, "../../ui/dist");
+var UI_DIST = process.env.HAP_UI_DIST ?? join16(import.meta.dirname ?? __dirname, "../../ui/dist");
 var vault = new Vault(DATA_DIR);
 var shownSnapshotStore = new ShownSnapshotStore(DATA_DIR);
 (function repairIfAsUrlChanged() {
@@ -5402,6 +5480,7 @@ app.use("/mcp", jsonParser, authGuard, createMCPRouter());
 app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRouter());
 app.use("/api/archived-mandates", jsonParser, authGuard, createArchivedMandatesRouter());
+app.use("/api/blocked-seen", jsonParser, authGuard, createBlockedSeenRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
 app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL, vault, DATA_DIR, lockAsTlsMismatch));
 app.use("/proposal-status", jsonParser, authGuard, createProposalStatusRouter(SP_URL, vault, DATA_DIR, lockAsTlsMismatch, shownSnapshotStore));
@@ -5546,6 +5625,15 @@ app.get("/skipped-commitments", authGuard, async (_req, res) => {
     res.status(500).json({ error: "Failed to fetch skipped commitments from MCP server" });
   }
 });
+app.get("/my-pending-proposals", authGuard, async (_req, res) => {
+  try {
+    const data = await getMyPendingProposals();
+    res.json(data);
+  } catch (err) {
+    console.error("[Control Plane] My-pending-proposals retrieval error:", err);
+    res.status(500).json({ error: "Failed to fetch pending proposals from MCP server" });
+  }
+});
 app.get("/as-pairing", authGuard, (_req, res) => {
   const pairing = readPairing(DATA_DIR);
   const paired = pairing !== null && pairing.asUrl === SP_URL;
@@ -5569,7 +5657,7 @@ app.get("/as-pairing", authGuard, (_req, res) => {
 });
 app.get("/denials", authGuard, (req, res) => {
   try {
-    const dataDir = process.env.SUVEREN_DATA_DIR ?? join15(homedir8(), ".suveren");
+    const dataDir = process.env.SUVEREN_DATA_DIR ?? join16(homedir9(), ".suveren");
     const all = loadDenials(dataDir, (blob) => vault.decrypt(blob));
     const since = Number(req.query.since);
     const limit = Number(req.query.limit);
@@ -5628,12 +5716,12 @@ app.put("/agent-brief/context", jsonParser, authGuard, async (req, res) => {
       res.status(413).json({ error: `Context exceeds ${AGENT_CONTEXT_MAX_BYTES}-byte cap` });
       return;
     }
-    const { mkdirSync: mkdirSync9, writeFileSync: writeFileSync9, renameSync: renameSync4 } = await import("fs");
+    const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync10, renameSync: renameSync5 } = await import("fs");
     const filePath = agentBriefPath();
-    mkdirSync9(dirname10(filePath), { recursive: true });
+    mkdirSync10(dirname11(filePath), { recursive: true });
     const tmpPath = `${filePath}.tmp`;
-    writeFileSync9(tmpPath, content, "utf-8");
-    renameSync4(tmpPath, filePath);
+    writeFileSync10(tmpPath, content, "utf-8");
+    renameSync5(tmpPath, filePath);
     res.json({ ok: true });
   } catch (err) {
     console.error("[Control Plane] agent-brief/context PUT failed:", err);
@@ -5725,10 +5813,10 @@ function detectRunningVersion() {
     return process.env.HAP_BUILD_SHA ?? "dev";
   }
   const dir = import.meta.dirname ?? __dirname;
-  const bundlePkg = join15(dir, "..", "..", "package.json");
+  const bundlePkg = join16(dir, "..", "..", "package.json");
   if (existsSync13(bundlePkg)) {
     try {
-      const pkg = JSON.parse(readFileSync15(bundlePkg, "utf8"));
+      const pkg = JSON.parse(readFileSync16(bundlePkg, "utf8"));
       if (pkg.name === "@suveren/gateway" && typeof pkg.version === "string") {
         return pkg.version;
       }
@@ -5780,7 +5868,7 @@ if (existsSync13(UI_DIST)) {
   }));
   app.get("*", (_req, res) => {
     res.setHeader("Cache-Control", "no-store, must-revalidate");
-    res.sendFile(join15(UI_DIST, "index.html"));
+    res.sendFile(join16(UI_DIST, "index.html"));
   });
 } else {
   app.get("/", (_req, res) => {