@suveren/gateway 0.3.2 → 0.3.4

package/dist/control-plane/index.mjs

@@ -2009,8 +2009,8 @@ app.get("/active-authorizations", authGuard, async (_req, res) => {
 });
 app.post("/gate-content", jsonParser, authGuard, async (req, res) => {
   try {
-    const { frameHash, boundsHash, contextHash, context, path, gateContent } = req.body;
-    await pushGateContent({ frameHash, boundsHash, contextHash, context, path, gateContent });
+    const { authorizationId, boundsHash, contextHash, context, path, gateContent } = req.body;
+    await pushGateContent({ authorizationId, boundsHash, contextHash, context, path, gateContent });
     res.json({ ok: true });
   } catch (err) {
     console.error("[Control Plane] Gate content forward error:", err);

package/dist/mcp-server/http.mjs

@@ -63,8 +63,8 @@ var SPClient = class {
   /**
    * Get all attestations for a frame hash.
    */
-  async getAttestations(frameHash) {
-    const res = await this.fetch(`/api/attestations?frame_hash=${encodeURIComponent(frameHash)}`);
+  async getAttestations(authorizationId) {
+    const res = await this.fetch(`/api/attestations?authorization_id=${encodeURIComponent(authorizationId)}`);
     if (!res.ok) throw new Error(`SP attestations request failed: ${res.status}`);
     return res.json();
   }
@@ -138,7 +138,7 @@ var SPClient = class {
     const res = await this.fetch("/api/proposals", {
       method: "POST",
       body: JSON.stringify({
-        frame_hash: data.frameHash,
+        authorization_id: data.authorizationId,
         profile_id: data.profileId,
         path: data.path,
         pending_domains: data.pendingDomains,
@@ -157,11 +157,11 @@ var SPClient = class {
     return res.json();
   }
   /**
-   * Phase 6: Fetch frame metadata for an authority by its boundsHash / frameHash.
+   * Phase 6: Fetch the authorization summary by its per-ceremony id.
    * Used to read aboveCap and approversFrozen at action time.
    */
-  async getFrameMetadata(frameHash) {
-    const res = await this.fetch(`/api/as/frame/${encodeURIComponent(frameHash)}`);
+  async getAuthorizationSummary(authorizationId) {
+    const res = await this.fetch(`/api/authorizations/${encodeURIComponent(authorizationId)}`);
     if (res.status === 404) return null;
     if (!res.ok) return null;
     return res.json();
@@ -228,16 +228,19 @@ var AttestationCache = class {
   /**
    * Fetch attestation data from SP for a frame hash and cache it.
    */
-  async syncAuthorization(frameHash) {
-    const result = await this.spClient.getAttestations(frameHash);
-    if (!result.profile_id || !result.frame) return null;
+  async syncAuthorization(authorizationId) {
+    const result = await this.spClient.getAttestations(authorizationId);
+    if (!result.profile_id) return null;
     if (result.revoked) {
-      this.authorizations.delete(frameHash);
-      if (result.frame_hash) this.authorizations.delete(result.frame_hash);
+      this.authorizations.delete(authorizationId);
       return null;
     }
-    const storageHash = result.frame_hash ?? result.bounds_hash;
-    const bounds = result.bounds ?? result.frame;
+    if (!result.authorization_id) {
+      throw new Error(
+        "Authority Server response lacks authorization_id \u2014 the AS predates per-ceremony identity. Update the Authority Server (lockstep deploy)."
+      );
+    }
+    const bounds = result.bounds ?? result.frame ?? {};
     let signedCommitmentMode;
     let subjects;
     const firstBlob = result.attestations[0]?.blob;
@@ -251,12 +254,12 @@ var AttestationCache = class {
       }
     }
     const auth = {
-      frameHash: storageHash,
+      authorizationId: result.authorization_id,
       boundsHash: result.bounds_hash,
       // content fingerprint (undefined for pre-v0.4 records)
       contextHash: result.context_hash,
       profileId: result.profile_id,
-      path: result.path ?? result.profile_id,
+      path: result.profile_id,
       frame: bounds,
       // compat alias
       bounds: result.bounds,
@@ -273,7 +276,7 @@ var AttestationCache = class {
       subjects,
       complete: result.complete
     };
-    this.authorizations.set(auth.frameHash ?? auth.path, auth);
+    this.authorizations.set(auth.authorizationId, auth);
     return auth;
   }
   /**
@@ -302,7 +305,7 @@ var AttestationCache = class {
    * Cache an authorization directly (e.g., from SP response after creation).
    */
   cacheAuthorization(auth) {
-    this.authorizations.set(auth.frameHash ?? auth.path, auth);
+    this.authorizations.set(auth.authorizationId, auth);
   }
   /**
    * Remove a cached authorization by path. Called when the SP reports the
@@ -717,9 +720,9 @@ var SharedState = class {
     this.executionLog = new ExecutionLog(gateStorePath);
     this.gatekeeper = new MCPGatekeeper(this.cache, this.executionLog);
   }
-  setGateContent(path, frameHash, profileId, content, opts) {
-    this.gateStore.set(path, {
-      frameHash,
+  setGateContent(path, authorizationId, profileId, content, opts) {
+    this.gateStore.set(authorizationId, {
+      authorizationId,
       boundsHash: opts?.boundsHash,
       contextHash: opts?.contextHash,
       path,
@@ -739,7 +742,7 @@ var SharedState = class {
   getEnrichedAuthorizations() {
     const authorizations = this.cache.getAllAuthorizations();
     return authorizations.map((auth) => {
-      const gateEntry = (auth.frameHash ? this.gateStore.get(auth.frameHash) : null) ?? (auth.boundsHash ? this.gateStore.get(auth.boundsHash) : null) ?? this.gateStore.get(auth.path) ?? null;
+      const gateEntry = this.gateStore.get(auth.authorizationId) ?? null;
       return {
         ...auth,
         gateContent: gateEntry?.gateContent ?? null,
@@ -932,20 +935,29 @@ import { getProfile as getProfile3 } from "@hap/core";
 import { deriveIdentityLine } from "@hap/core";
 var AS_BASE = (process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai").replace(/\/$/, "");
 var OPERATOR_NAME = process.env.SUVEREN_OPERATOR_NAME ?? "Suveren";
+var HAP_URL = "https://www.humanagencyprotocol.org/";
 var FOOTER_PROFILES = /* @__PURE__ */ new Set(["email", "calendar", "publish"]);
 var CONTENT_FIELD_CANDIDATES = ["body", "text", "description", "content"];
-var FOOTER_MARKER = "\u2014 Sent by an AI agent";
+var FOOTER_RE = /\n*(?:—|--) (?:Sent|Published) by an AI agent[\s\S]*$/;
 function shouldAttachFooter() {
   return true;
 }
-function verifyUrl(receiptId) {
+function receiptUrl(receiptId) {
   return `${AS_BASE}/r/${receiptId}`;
 }
-function footerText(receiptId, subject) {
-  const line = deriveIdentityLine(subject, { operatorName: OPERATOR_NAME });
+function verbForProfile(profile) {
+  return profile === "publish" ? "Published" : "Sent";
+}
+function hapLine() {
+  return `-- ${OPERATOR_NAME} is an implementation of the Human Agency Protocol (HAP), an open protocol to delegate execution to AI agents under human authority. ${HAP_URL}`;
+}
+function footerText(receiptId, verb, subject) {
+  const identity = deriveIdentityLine(subject, { operatorName: OPERATOR_NAME }).replace(/^Sent\b/, verb);
   return `
 
-\u2014 ${line}. Verify: ${verifyUrl(receiptId)}`;
+-- ${identity}. Receipt: ${receiptUrl(receiptId)}
+
+${hapLine()}`;
 }
 function isStringType(t) {
   return t === "string" || Array.isArray(t) && t.includes("string");
@@ -960,9 +972,7 @@ function detectContentField(tool) {
   return null;
 }
 function stripFooter(value) {
-  const i = value.indexOf(FOOTER_MARKER);
-  if (i === -1) return value;
-  return value.slice(0, i).replace(/\n+$/, "");
+  return value.replace(FOOTER_RE, "").replace(/\n+$/, "");
 }
 function appendVerificationFooter(tool, args, receiptId, subject) {
   const profile = tool.gating?.profile;
@@ -970,7 +980,7 @@ function appendVerificationFooter(tool, args, receiptId, subject) {
   const field = detectContentField(tool);
   if (!field) return args;
   const current = typeof args[field] === "string" ? args[field] : "";
-  return { ...args, [field]: stripFooter(current) + footerText(receiptId, subject) };
+  return { ...args, [field]: stripFooter(current) + footerText(receiptId, verbForProfile(profile), subject) };
 }
 
 // src/lib/content-binding.ts
@@ -1127,14 +1137,14 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
     }
     const errors = [];
     for (const auth of matchingAuths) {
-      const { result } = await state2.gatekeeper.verifyExecution(auth.frameHash ?? auth.path, execution, {
+      const { result } = await state2.gatekeeper.verifyExecution(auth.authorizationId, execution, {
         bounds: auth.bounds,
         context: auth.context
       });
       if (!result.approved) {
       }
       if (result.approved) {
-        const authHash = auth.frameHash ?? auth.boundsHash;
+        const authzId = auth.authorizationId;
         if (isCommitmentDowngrade(auth)) {
           return {
             content: [{
@@ -1148,7 +1158,7 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
           try {
             const enrichedArgs = await attachImagePreview(args);
             const { proposal } = await state2.spClient.submitProposal({
-              frameHash: authHash,
+              authorizationId: authzId,
               profileId: auth.profileId,
               path: auth.path,
               pendingDomains: auth.deferredCommitmentDomains,
@@ -1180,10 +1190,9 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           }
           const binding = computeContentBinding(auth.profileId, tool, args);
           const { receipt } = await state2.spClient.postReceipt({
-            // v0.5: send the bare content address; the AS reconstructs the
-            // per-user storage key. Fall back to frameHash only for legacy
-            // (pre-v0.4) records that predate bounds_hash.
-            boundsHash: auth.boundsHash ?? authHash,
+            authorizationId: authzId,
+            // Optional cross-check — the AS fails closed on a mismatch.
+            boundsHash: auth.boundsHash,
             profileId: auth.profileId,
             action: tool.namespacedName,
             actionType,
@@ -1199,20 +1208,20 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             let pendingApprovers = spBody.approvers ?? [];
             if (pendingApprovers.length === 0) {
               try {
-                const frameMeta = await state2.spClient.getFrameMetadata(authHash);
-                if (frameMeta?.approversFrozen) {
-                  pendingApprovers = frameMeta.approversFrozen;
+                const summary = await state2.spClient.getAuthorizationSummary(authzId);
+                if (summary?.approvers_frozen) {
+                  pendingApprovers = summary.approvers_frozen;
                 }
-                if (frameMeta?.createdBy) {
-                  pendingApprovers = [frameMeta.createdBy, ...pendingApprovers];
+                if (summary?.created_by) {
+                  pendingApprovers = [summary.created_by, ...pendingApprovers];
                 }
               } catch {
               }
             } else {
               try {
-                const frameMeta = await state2.spClient.getFrameMetadata(authHash);
-                if (frameMeta?.createdBy) {
-                  pendingApprovers = [frameMeta.createdBy, ...pendingApprovers];
+                const summary = await state2.spClient.getAuthorizationSummary(authzId);
+                if (summary?.created_by) {
+                  pendingApprovers = [summary.created_by, ...pendingApprovers];
                 }
               } catch {
               }
@@ -1221,7 +1230,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             try {
               const enrichedArgs = await attachImagePreview(args);
               const { proposal } = await state2.spClient.submitProposal({
-                frameHash: authHash,
+                authorizationId: authzId,
                 profileId: auth.profileId,
                 path: auth.path,
                 pendingDomains: [],
@@ -1252,7 +1261,7 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
           }
           if (err instanceof SPReceiptError && err.statusCode === 403) {
             if (/revoked/i.test(err.message)) {
-              state2.cache.invalidate(auth.frameHash ?? auth.path);
+              state2.cache.invalidate(auth.authorizationId);
             }
             return {
               content: [{ type: "text", text: `Blocked by SP: ${err.message}` }],
@@ -1418,8 +1427,8 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         const reviewDomains = auth.deferredCommitmentDomains ?? [];
         output2.push(reviewDomains.length > 0 ? "  Mode: review \u2014 each action requires your approval before it runs (a proposal is created, not executed)" : "  Mode: automatic \u2014 actions run immediately within bounds");
         try {
-          const meta = await state2.spClient.getFrameMetadata(auth.frameHash ?? auth.boundsHash ?? auth.path);
-          if (meta?.aboveCap) {
+          const meta = await state2.spClient.getAuthorizationSummary(auth.authorizationId);
+          if (meta?.above_cap) {
             output2.push("  \u26A0 Above team cap \u2014 actions here require approval even within these bounds.");
           }
         } catch {
@@ -1631,10 +1640,9 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   }
   let receiptId;
   try {
-    const boundsHash = proposal.frameHash.split(":").slice(0, 2).join(":");
     const binding = computeContentBinding(proposal.profileId, discovered, proposal.toolArgs);
     const { receipt } = await state2.spClient.postReceipt({
-      boundsHash,
+      authorizationId: proposal.authorizationId,
       profileId: proposal.profileId,
       action: proposal.tool,
       actionType: proposalActionType,
@@ -2494,18 +2502,17 @@ app.post("/internal/configure", internalOnly, (req, res) => {
 });
 app.post("/internal/gate-content", internalOnly, async (req, res) => {
   try {
-    const { frameHash, boundsHash, contextHash, context, path: rawPath, gateContent } = req.body;
-    const storageHash = frameHash ?? boundsHash;
+    const { authorizationId, boundsHash, contextHash, context, path: rawPath, gateContent } = req.body;
     const hasIntent = !!gateContent?.intent;
     const legacy = gateContent;
     const hasLegacy = !!legacy?.problem && !!legacy?.objective && !!legacy?.tradeoffs;
-    if (!storageHash || !hasIntent && !hasLegacy) {
-      res.status(400).json({ error: "Missing required fields: frameHash (or boundsHash), gateContent.{intent} or gateContent.{problem,objective,tradeoffs}" });
+    if (!authorizationId || !hasIntent && !hasLegacy) {
+      res.status(400).json({ error: "Missing required fields: authorizationId, gateContent.{intent} or gateContent.{problem,objective,tradeoffs}" });
       return;
     }
-    const auth = await state.cache.syncAuthorization(storageHash);
+    const auth = await state.cache.syncAuthorization(authorizationId);
     if (!auth) {
-      res.status(404).json({ error: `No attestation found for frame hash ${storageHash}` });
+      res.status(404).json({ error: `No authorization found for ${authorizationId}` });
       return;
     }
     const verification = verifyGateContentHashes(gateContent, auth);
@@ -2513,8 +2520,8 @@ app.post("/internal/gate-content", internalOnly, async (req, res) => {
       res.status(400).json({ error: "Gate content hash mismatch", details: verification.errors });
       return;
     }
-    const path = rawPath || storageHash;
-    state.setGateContent(path, storageHash, auth.profileId, gateContent, {
+    const path = rawPath || authorizationId;
+    state.setGateContent(path, authorizationId, auth.profileId, gateContent, {
       boundsHash,
       contextHash,
       context
@@ -2570,10 +2577,10 @@ app.post("/internal/resync-gates", internalOnly, async (_req, res) => {
   let orphaned = 0;
   for (const gate of gates) {
     try {
-      const syncHash = gate.frameHash ?? gate.boundsHash;
-      const auth = await state.cache.syncAuthorization(syncHash);
+      const authzId = gate.authorizationId;
+      const auth = await state.cache.syncAuthorization(authzId);
       if (auth) {
-        state.setGateContent(syncHash, syncHash, auth.profileId, gate.gateContent, {
+        state.setGateContent(auth.path, authzId, auth.profileId, gate.gateContent, {
           boundsHash: gate.boundsHash,
           contextHash: gate.contextHash,
           context: gate.context
@@ -2581,8 +2588,8 @@ app.post("/internal/resync-gates", internalOnly, async (_req, res) => {
         synced++;
         console.error(`[Suveren MCP] Re-synced gate: ${gate.path}`);
       } else {
-        state.cache.invalidate(syncHash);
-        state.gateStore.delete(syncHash);
+        state.cache.invalidate(authzId);
+        state.gateStore.delete(authzId);
         orphaned++;
         console.error(`[Suveren MCP] Orphan gate purged (SP attestation deleted): ${gate.path}`);
       }
@@ -2737,9 +2744,7 @@ app.get("/internal/gate-content", internalOnly, (req, res) => {
   const path = req.query.path;
   const gates = state.gateStore.getAll();
   if (path) {
-    const entry = gates.find(
-      (g) => g.path === path || g.profileId === path || g.boundsHash === path || g.frameHash === path
-    );
+    const entry = gates.find((g) => g.authorizationId === path);
     res.json({ entry: entry ?? null });
   } else {
     res.json({ entries: gates });
@@ -2748,7 +2753,7 @@ app.get("/internal/gate-content", internalOnly, (req, res) => {
 app.get("/internal/authorizations", internalOnly, (_req, res) => {
   const authorizations = state.getEnrichedAuthorizations().map((a) => ({
     profileId: a.profileId,
-    frameHash: a.frameHash,
+    authorizationId: a.authorizationId,
     bounds: a.frame,
     context: a.context ?? {},
     intent: a.gateContent?.intent ?? null,