@suveren/gateway 0.33.0 → 0.34.0

package/dist/mcp-server/http.mjs

@@ -4316,11 +4316,45 @@ function invalidManifestContextReason(manifest) {
   }
   return null;
 }
-function invalidManifestReadGateReason(manifest) {
-  const profileDef = getProfile2(manifest.profile);
-  if (!profileDef) return null;
+function overrideProfile(entry) {
+  if (entry === null || typeof entry !== "object") return void 0;
+  const p = entry.profile;
+  return typeof p === "string" ? p : void 0;
+}
+function distinctProfilesOf(manifest) {
+  const out = [manifest.profile];
+  for (const entry of Object.values(manifest.toolGating?.overrides ?? {})) {
+    const p = overrideProfile(entry);
+    if (p && !out.includes(p)) out.push(p);
+  }
+  return out;
+}
+function invalidManifestOverrideProfilesReason(manifest) {
   const overrides = manifest.toolGating?.overrides ?? {};
-  return uncoveredReadSwitchReason(overrides, profileDef.boundsSchema);
+  for (const [toolName, entry] of Object.entries(overrides)) {
+    const profile = overrideProfile(entry);
+    if (!profile) continue;
+    if (!getProfile2(manifest.profile) && !getProfile2(profile)) continue;
+    if (!getProfile2(profile)) {
+      return `override "${toolName}".profile "${profile}" does not resolve to a known profile (full id or short name) \u2014 area-per-tool overrides must name a real profile, same as the manifest's own "profile"`;
+    }
+  }
+  return null;
+}
+function invalidManifestReadGateReason(manifest) {
+  const allOverrides = manifest.toolGating?.overrides ?? {};
+  for (const profileId of distinctProfilesOf(manifest)) {
+    const profileDef = getProfile2(profileId);
+    if (!profileDef) continue;
+    const ownOverrides = {};
+    for (const [toolName, entry] of Object.entries(allOverrides)) {
+      const resolved = overrideProfile(entry) ?? manifest.profile;
+      if (resolved === profileId) ownOverrides[toolName] = entry;
+    }
+    const reason = uncoveredReadSwitchReason(ownOverrides, profileDef.boundsSchema);
+    if (reason) return reason;
+  }
+  return null;
 }
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
@@ -4359,6 +4393,11 @@ function loadManifests(integrationsDir) {
         console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${contextReason}`);
         continue;
       }
+      const overrideProfilesReason = invalidManifestOverrideProfilesReason(manifest);
+      if (overrideProfilesReason) {
+        console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${overrideProfilesReason}`);
+        continue;
+      }
       const readGateReason = invalidManifestReadGateReason(manifest);
       if (readGateReason) {
         console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${readGateReason}`);
@@ -6716,29 +6755,30 @@ function listIntegrationsHandler(state2, integrationManager2) {
     }
     const auths = state2.getEnrichedAuthorizations();
     const statuses = integrationManager2.getStatus();
-    const integrations = statuses.filter((s) => s.running).map((s) => {
+    const integrations = statuses.filter((s) => s.running).flatMap((s) => {
       const tools = integrationManager2.getAllTools().filter((t) => t.integrationId === s.id);
-      const profile = tools[0]?.gating?.profile ?? null;
-      const matchingAuths = profile ? auths.filter((a) => a.complete && profileMatches(a.profileId, profile)) : [];
-      let status;
-      if (matchingAuths.length > 0) {
-        const soonestExpiry = Math.min(
-          ...matchingAuths.flatMap(
-            (a) => a.attestations.map((att) => att.expiresAt)
-          )
-        );
-        const remainingMs = soonestExpiry * 1e3 - Date.now();
-        const remainingMin = Math.ceil(remainingMs / 6e4);
-        status = `authorized (${matchingAuths.length} path${matchingAuths.length > 1 ? "s" : ""}, ${remainingMin} min remaining)`;
-      } else {
-        const allProfileAuths = profile ? auths.filter((a) => profileMatches(a.profileId, profile)) : [];
-        status = allProfileAuths.length > 0 ? "expired" : "no authorization";
-      }
-      return {
-        id: s.id,
-        profile: profile ? shortProfileName3(profile) : null,
-        status
-      };
+      const profiles = [...new Set(tools.map((t) => t.gating?.profile).filter((p) => !!p))];
+      if (profiles.length === 0) {
+        return [{ id: s.id, profile: null, status: "no authorization" }];
+      }
+      return profiles.map((profile) => {
+        const matchingAuths = auths.filter((a) => a.complete && profileMatches(a.profileId, profile));
+        let status;
+        if (matchingAuths.length > 0) {
+          const soonestExpiry = Math.min(
+            ...matchingAuths.flatMap(
+              (a) => a.attestations.map((att) => att.expiresAt)
+            )
+          );
+          const remainingMs = soonestExpiry * 1e3 - Date.now();
+          const remainingMin = Math.ceil(remainingMs / 6e4);
+          status = `authorized (${matchingAuths.length} path${matchingAuths.length > 1 ? "s" : ""}, ${remainingMin} min remaining)`;
+        } else {
+          const allProfileAuths = auths.filter((a) => profileMatches(a.profileId, profile));
+          status = allProfileAuths.length > 0 ? "expired" : "no authorization";
+        }
+        return { id: s.id, profile: shortProfileName3(profile), status };
+      });
     });
     const text = integrations.length === 0 ? "No integrations running." : integrations.map(
       (i) => `${i.id} [${i.profile ?? "ungated"}] \u2014 ${i.status}`
@@ -8601,18 +8641,26 @@ var IntegrationManager = class {
   /**
    * Resolve gating config for a tool from the profile's toolGating section.
    * Returns the runtime ToolGatingConfig that tool-proxy.ts consumes.
+   *
+   * Area per tool: an override may declare its OWN `profile`, gating that
+   * one tool under a different area than the rest of the connector (e.g.
+   * an ERP's `create_invoice` under `invoicing` while `create_quote` stays
+   * under the manifest's own `sales`). `resolvedProfile` below is what every
+   * downstream consumer reads as this tool's governing profile — falling
+   * back to the manifest-level `profileId` when the override doesn't say.
    */
   resolveToolGating(profileId, profileGating, toolName) {
     if (!profileId || !profileGating) return null;
     if (profileGating.overrides && toolName in profileGating.overrides) {
       const override = profileGating.overrides[toolName];
       const ext = override ?? {};
+      const resolvedProfile = ext.profile ?? profileId;
       if (ext.category === "disabled") {
-        return { profile: profileId, executionMapping: {}, category: "disabled" };
+        return { profile: resolvedProfile, executionMapping: {}, category: "disabled" };
       }
       if (override === null || ext.category === "read") {
         return {
-          profile: profileId,
+          profile: resolvedProfile,
           executionMapping: {},
           category: "read",
           boundField: ext.boundField,
@@ -8627,7 +8675,7 @@ var IntegrationManager = class {
         };
       }
       return {
-        profile: profileId,
+        profile: resolvedProfile,
         executionMapping: override.executionMapping,
         staticExecution: override.staticExecution,
         // Which argument the receipt binds to. This resolver is an explicit