@suveren/gateway 0.3.17 → 0.4.1

package/node_modules/@hap/core/dist/index.mjs

@@ -555,12 +555,23 @@ function checkBoundsFromFrameSchema(request, profile) {
   }
   return errors;
 }
+function boundGovernsAction(fieldName, fieldDef, bt, actionType) {
+  if (fieldDef.appliesTo) {
+    return actionType ? fieldDef.appliesTo.includes(actionType) : true;
+  }
+  if (bt.kind !== "cumulative_count" || !actionType) return true;
+  const prefix = fieldName.replace(/_(?:daily|monthly|weekly)_max$/, "");
+  const namedForAnAction = prefix !== fieldName;
+  const matches = prefix === actionType || prefix.startsWith("transaction");
+  return !namedForAnAction || matches;
+}
 function checkBoundsV4(request, profile, executionLog, now) {
   const errors = [];
   if (!profile.boundsSchema) return errors;
   const bounds = request.frame;
   const profileId = String(bounds.profile ?? profile.id);
-  const path = bounds.path ? String(bounds.path) : "";
+  const actionType = typeof request.execution.action_type === "string" ? request.execution.action_type : void 0;
+  const path = request.path ?? (bounds.path ? String(bounds.path) : "");
   for (const [fieldName, fieldDef] of Object.entries(profile.boundsSchema.fields)) {
     if (fieldName === "profile" || fieldName === "path") continue;
     const boundValue = bounds[fieldName];
@@ -576,6 +587,7 @@ function checkBoundsV4(request, profile, executionLog, now) {
       });
       continue;
     }
+    if (!boundGovernsAction(fieldName, fieldDef, bt, actionType)) continue;
     switch (bt.kind) {
       case "per_transaction": {
         const actual = request.execution[bt.of];

package/node_modules/@hap/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/node_modules/@hap/core/src/gatekeeper.ts

@@ -40,6 +40,8 @@ import type {
   AgentContextParams,
   ExecutionLogQuery,
   CumulativeFieldDef,
+  ProfileBoundsField,
+  BoundType,
 } from './types';
 
 /**
@@ -406,6 +408,41 @@ function checkBoundsFromFrameSchema(request: GatekeeperRequest, profile: AgentPr
  *   enum             — bound value must be in the allowed set (attest-time
  *                      validation; not an execution-time check)
  */
+/**
+ * Does this bound govern the action being attempted?
+ *
+ * Cumulative totals are scoped by (profileId, path) only, so without this every
+ * cumulative_count bound on a profile sees the same running count. On customers
+ * — which declares both write_daily_max and delete_daily_max — the smaller
+ * delete limit would count writes and block them.
+ *
+ * Preferred answer is the profile's declared `appliesTo`. Absent that, fall back
+ * to the field-name convention (`delete_daily_max` → `delete`), matching how the
+ * Authority Server selects bounds so the two enforcement points cannot disagree.
+ *
+ * Fails CLOSED: when the action type is unknown, or the bound's name implies no
+ * particular action, the bound is enforced.
+ */
+function boundGovernsAction(
+  fieldName: string,
+  fieldDef: ProfileBoundsField,
+  bt: BoundType,
+  actionType: string | undefined,
+): boolean {
+  if (fieldDef.appliesTo) {
+    return actionType ? fieldDef.appliesTo.includes(actionType) : true;
+  }
+
+  // The name convention only ever disambiguated count bounds; sums are governed
+  // by their `of` field and stay unfiltered, as at the Authority Server.
+  if (bt.kind !== 'cumulative_count' || !actionType) return true;
+
+  const prefix = fieldName.replace(/_(?:daily|monthly|weekly)_max$/, '');
+  const namedForAnAction = prefix !== fieldName;
+  const matches = prefix === actionType || prefix.startsWith('transaction');
+  return !namedForAnAction || matches;
+}
+
 function checkBoundsV4(
   request: GatekeeperRequest,
   profile: AgentProfile,
@@ -417,7 +454,14 @@ function checkBoundsV4(
 
   const bounds = request.frame as AgentBoundsParams;
   const profileId = String(bounds.profile ?? profile.id);
-  const path = bounds.path ? String(bounds.path) : '';
+  const actionType = typeof request.execution.action_type === 'string'
+    ? request.execution.action_type
+    : undefined;
+  // Prefer the explicit request path. `frame.path` is retained only as a
+  // fallback for callers that legitimately declare `path` in their profile's
+  // boundsSchema; for every shipped profile it is absent, which is exactly why
+  // this silently resolved to "" and disabled the cumulative gate entirely.
+  const path = request.path ?? (bounds.path ? String(bounds.path) : '');
 
   for (const [fieldName, fieldDef] of Object.entries(profile.boundsSchema.fields)) {
     if (fieldName === 'profile' || fieldName === 'path') continue;
@@ -441,6 +485,8 @@ function checkBoundsV4(
       continue;
     }
 
+    if (!boundGovernsAction(fieldName, fieldDef, bt, actionType)) continue;
+
     switch (bt.kind) {
       case 'per_transaction': {
         const actual = request.execution[bt.of];

package/node_modules/@hap/core/src/types.ts

@@ -213,6 +213,21 @@ export interface ProfileBoundsField {
    * treat a missing boundType as an error when running in v0.4 mode.
    */
   boundType?: BoundType;
+  /**
+   * Which execution action types this bound governs, e.g. `["write"]`.
+   *
+   * When present, this is authoritative. When absent, enforcement falls back to
+   * inferring the action type from the FIELD NAME (`send_daily_max` → `send`),
+   * which is a convention rather than a contract: a profile that names a bound
+   * after the domain concept instead of the action — calendar's
+   * `booking_daily_max` against an action type of `write` — matches nothing and
+   * is skipped, so a limit the user set is never applied and nothing says so.
+   *
+   * Declaring it removes the guess. Deliberately additive: profiles migrate one
+   * at a time, and every remaining fallback is logged, so the cases still
+   * relying on the naming convention become visible instead of staying silent.
+   */
+  appliesTo?: string[];
   /**
    * The measurement dimension of the bound's value. UI renders the unit
    * inline next to the input (e.g. `4 min`, `100 EUR`). Independent from
@@ -502,6 +517,18 @@ export interface GatekeeperRequest {
   execution: Record<string, string | number>;
   /** v0.4: context parameters (currency, action_type, etc.) */
   context?: AgentContextParams;
+  /**
+   * Authorization path used to scope cumulative lookups in the execution log.
+   *
+   * Deliberately OUTSIDE `frame`: the frame is hashed and validated against the
+   * profile's boundsSchema, so an extra key there is rejected as an unknown
+   * field and breaks attestation verification outright. Cumulative checks
+   * previously read the path from the frame, where callers cannot legally put
+   * it — so it resolved to "" while the log stored real paths, no entry ever
+   * matched, and every running total read zero. The local gate existed but
+   * could never fire.
+   */
+  path?: string;
 }
 
 /**

package/node_modules/@hono/node-server/README.md

@@ -1,12 +1,11 @@
 # Node.js Adapter for Hono
 
 This adapter `@hono/node-server` allows you to run your Hono application on Node.js.
-Initially, Hono wasn't designed for Node.js, but with this adapter, you can now use Hono on Node.js.
-It utilizes web standard APIs implemented in Node.js version 18 or higher.
+Initially, Hono wasn't designed for Node.js, but with this adapter, you can now use Hono on Node.js. It utilizes web standard APIs implemented in Node.js.
 
 ## Benchmarks
 
-Hono is 3.5 times faster than Express.
+Hono is 4.1 times faster than Express.
 
 Express:
 
@@ -14,12 +13,12 @@ Express:
 $ bombardier -d 10s --fasthttp http://localhost:3000/
 
 Statistics        Avg      Stdev        Max
-  Reqs/sec     16438.94    1603.39   19155.47
-  Latency        7.60ms     7.51ms   559.89ms
+  Reqs/sec     20803.37    1713.06   24910.85
+  Latency        6.01ms     5.21ms   451.37ms
   HTTP codes:
-    1xx - 0, 2xx - 164494, 3xx - 0, 4xx - 0, 5xx - 0
+    1xx - 0, 2xx - 208131, 3xx - 0, 4xx - 0, 5xx - 0
     others - 0
-  Throughput:     4.55MB/s
+  Throughput:     5.75MB/s
 ```
 
 Hono + `@hono/node-server`:
@@ -28,36 +27,25 @@ Hono + `@hono/node-server`:
 $ bombardier -d 10s --fasthttp http://localhost:3000/
 
 Statistics        Avg      Stdev        Max
-  Reqs/sec     58296.56    5512.74   74403.56
-  Latency        2.14ms     1.46ms   190.92ms
+  Reqs/sec     85405.51    7250.65  102658.51
+  Latency        1.46ms     1.00ms   149.95ms
   HTTP codes:
-    1xx - 0, 2xx - 583059, 3xx - 0, 4xx - 0, 5xx - 0
+    1xx - 0, 2xx - 854120, 3xx - 0, 4xx - 0, 5xx - 0
     others - 0
-  Throughput:    12.56MB/s
+  Throughput:    18.49MB/s
 ```
 
 ## Requirements
 
-It works on Node.js versions greater than 18.x. The specific required Node.js versions are as follows:
-
-- 18.x => 18.14.1+
-- 19.x => 19.7.0+
-- 20.x => 20.0.0+
-
-Essentially, you can simply use the latest version of each major release.
+It works on Node.js versions greater than 20.x.
 
 ## Installation
 
-You can install it from the npm registry with `npm` command:
+You can install it from the npm registry:
 
 ```sh
 npm install @hono/node-server
-```
-
-Or use `yarn`:
-
-```sh
-yarn add @hono/node-server
+pnpm add @hono/node-server
 ```
 
 ## Usage
@@ -77,6 +65,34 @@ serve(app, (info) => {
 })
 ```
 
+## WebSocket
+
+You can upgrade WebSocket connections with `upgradeWebSocket` from `@hono/node-server`.
+To enable this, install `ws` (and `@types/ws`) in your project, then create and provide a `WebSocketServer` as shown in the example below.
+
+```ts
+import { serve, upgradeWebSocket } from '@hono/node-server'
+import { WebSocketServer } from 'ws'
+import { Hono } from 'hono'
+
+const app = new Hono()
+
+app.get(
+  '/ws',
+  upgradeWebSocket(() => ({
+    onMessage(event, ws) {
+      ws.send(event.data)
+    },
+  }))
+)
+
+const wss = new WebSocketServer({ noServer: true }) // important to create with `noServer: true`
+serve({
+  fetch: app.fetch,
+  websocket: { server: wss },
+})
+```
+
 For example, run it using `ts-node`. Then an HTTP server will be launched. The default port is `3000`.
 
 ```sh
@@ -138,6 +154,23 @@ serve({
 })
 ```
 
+### `websocket`
+
+provide a websocket server to enable websocket support.
+
+```ts
+import { serve, upgradeWebSocket } from '@hono/node-server'
+import { WebSocketServer } from 'ws'
+
+// ...
+const wss = new WebSocketServer({ noServer: true })
+
+serve({
+  fetch: app.fetch,
+  websocket: { server: wss },
+})
+```
+
 ## Middleware
 
 Most built-in middleware also works with Node.js.

package/node_modules/@hono/node-server/dist/conninfo.cjs

@@ -0,0 +1,22 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/conninfo.ts
+/**
+* ConnInfo Helper for Node.js
+* @param c Context
+* @returns ConnInfo
+*/
+const getConnInfo = (c) => {
+	const bindings = c.env.server ? c.env.server : c.env;
+	const address = bindings.incoming.socket.remoteAddress;
+	const port = bindings.incoming.socket.remotePort;
+	const family = bindings.incoming.socket.remoteFamily;
+	return { remote: {
+		address,
+		port,
+		addressType: family === "IPv4" ? "IPv4" : family === "IPv6" ? "IPv6" : void 0
+	} };
+};
+
+//#endregion
+exports.getConnInfo = getConnInfo;

package/node_modules/@hono/node-server/dist/{conninfo.d.ts → conninfo.d.cts}

@@ -1,10 +1,11 @@
-import { GetConnInfo } from 'hono/conninfo';
+import { GetConnInfo } from "hono/conninfo";
 
+//#region src/conninfo.d.ts
 /**
  * ConnInfo Helper for Node.js
  * @param c Context
  * @returns ConnInfo
  */
 declare const getConnInfo: GetConnInfo;
-
-export { getConnInfo };
+//#endregion
+export { getConnInfo };

package/node_modules/@hono/node-server/dist/conninfo.d.mts

@@ -1,10 +1,11 @@
-import { GetConnInfo } from 'hono/conninfo';
+import { GetConnInfo } from "hono/conninfo";
 
+//#region src/conninfo.d.ts
 /**
  * ConnInfo Helper for Node.js
  * @param c Context
  * @returns ConnInfo
  */
 declare const getConnInfo: GetConnInfo;
-
-export { getConnInfo };
+//#endregion
+export { getConnInfo };

package/node_modules/@hono/node-server/dist/conninfo.mjs

@@ -1,17 +1,20 @@
-// src/conninfo.ts
-var getConnInfo = (c) => {
-  const bindings = c.env.server ? c.env.server : c.env;
-  const address = bindings.incoming.socket.remoteAddress;
-  const port = bindings.incoming.socket.remotePort;
-  const family = bindings.incoming.socket.remoteFamily;
-  return {
-    remote: {
-      address,
-      port,
-      addressType: family === "IPv4" ? "IPv4" : family === "IPv6" ? "IPv6" : void 0
-    }
-  };
-};
-export {
-  getConnInfo
+//#region src/conninfo.ts
+/**
+* ConnInfo Helper for Node.js
+* @param c Context
+* @returns ConnInfo
+*/
+const getConnInfo = (c) => {
+	const bindings = c.env.server ? c.env.server : c.env;
+	const address = bindings.incoming.socket.remoteAddress;
+	const port = bindings.incoming.socket.remotePort;
+	const family = bindings.incoming.socket.remoteFamily;
+	return { remote: {
+		address,
+		port,
+		addressType: family === "IPv4" ? "IPv4" : family === "IPv6" ? "IPv6" : void 0
+	} };
 };
+
+//#endregion
+export { getConnInfo };

package/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs

@@ -0,0 +1,5 @@
+//#region src/utils/response/constants.ts
+const X_ALREADY_SENT = "x-hono-already-sent";
+
+//#endregion
+export { X_ALREADY_SENT as t };

package/node_modules/@hono/node-server/dist/constants-BXAKTxRC.cjs

@@ -0,0 +1,11 @@
+
+//#region src/utils/response/constants.ts
+const X_ALREADY_SENT = "x-hono-already-sent";
+
+//#endregion
+Object.defineProperty(exports, 'X_ALREADY_SENT', {
+  enumerable: true,
+  get: function () {
+    return X_ALREADY_SENT;
+  }
+});