@suveren/gateway 0.35.1 → 0.35.2

package/dist/mcp-server/http.mjs

@@ -5749,18 +5749,19 @@ async function finalizeAttachmentsForExecution(integrationManager2, integrationI
         contentBase64: d.contentBase64
       }));
     } else {
-      const to = toStringArray(outgoing.to);
-      const cc = toStringArray(outgoing.cc);
-      const subject = typeof outgoing.subject === "string" ? outgoing.subject : "";
-      const bodyText = typeof outgoing.body === "string" ? outgoing.body : "";
-      const mime = buildMimeMessage({
-        to,
-        cc,
-        subject,
-        bodyText,
-        attachments: resolvedDocs.map((d) => ({ filename: d.filename, contentType: d.contentType, contentBase64: d.contentBase64 }))
+      const arg = transport.arg;
+      const attachments = resolvedDocs.map((d) => ({ filename: d.filename, contentType: d.contentType, contentBase64: d.contentBase64 }));
+      const withRaw = (a) => ({
+        ...a,
+        [arg]: toBase64Url(buildMimeMessage({
+          to: toStringArray(a.to),
+          cc: toStringArray(a.cc),
+          subject: typeof a.subject === "string" ? a.subject : "",
+          bodyText: typeof a.body === "string" ? a.body : "",
+          attachments
+        }))
       });
-      outgoing[transport.arg] = toBase64Url(mime);
+      return { ok: true, args: withRaw(outgoing), rebuildTransport: withRaw };
     }
   }
   return { ok: true, args: outgoing };
@@ -6795,12 +6796,14 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
         }
       }
       let finalArgs = callArgs;
+      let rebuildTransport;
       if (tool.gating?.attachmentsArg || tool.gating?.insertFields?.length) {
         const finalized = await finalizeAttachmentsForExecution(integrationManager2, tool.integrationId, callArgs);
         if (!finalized.ok) {
           return { content: [{ type: "text", text: finalized.message }], isError: true };
         }
         finalArgs = finalized.args;
+        rebuildTransport = finalized.rebuildTransport;
       }
       let receiptId;
       try {
@@ -7031,6 +7034,7 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.` + a
       });
       let outgoingArgs = shouldAttachFooter() && receiptId ? appendVerificationFooter(tool, finalArgs, receiptId, auth.subjects?.[0]) : finalArgs;
       if (receiptId) outgoingArgs = attachTicketId(tool, outgoingArgs, receiptId);
+      if (rebuildTransport) outgoingArgs = rebuildTransport(outgoingArgs);
       outgoingArgs = encodeOutgoingArgs(tool, outgoingArgs);
       outgoingArgs = stripSourceLink(outgoingArgs);
       outgoingArgs = stripAttachmentsSealedMeta(outgoingArgs);
@@ -8654,6 +8658,9 @@ function withoutBlockedArgs(schema, blocked) {
   }
   return out;
 }
+function stableEnvKey(env) {
+  return JSON.stringify(Object.keys(env).sort().map((k) => [k, env[k]]));
+}
 var RESPAWN_DELAYS = [2e3, 4e3, 6e3];
 var MAX_RESPAWN_ATTEMPTS = 3;
 var CONNECT_TIMEOUT_MS = 3e4;
@@ -8995,6 +9002,7 @@ var IntegrationManager = class {
       );
     }
     const env = this.resolveEnvKeys(config);
+    const credentialEnv = stableEnvKey(env);
     if (isSimulationMode()) {
       const manifest = getManifest(config.id);
       const simDecl = manifest?.simulation;
@@ -9068,7 +9076,8 @@ var IntegrationManager = class {
       client,
       transport,
       tools,
-      respawnAttempts: 0
+      respawnAttempts: 0,
+      credentialEnv
     };
     this.running.set(config.id, entry);
     transport.onclose = () => {
@@ -9391,6 +9400,21 @@ var IntegrationManager = class {
   isRunning(id) {
     return this.running.has(id);
   }
+  /**
+   * True when the integration is running but the vault credentials would now
+   * resolve to a different env than the one its process was started with.
+   *
+   * Why: at boot the gateway starts connectors whose settings are all optional
+   * (ERP, CRM — mode/adapter/company file) BEFORE the vault is unlocked, so they
+   * come up on their defaults (simulation). The settings arrive on unlock, and
+   * without a restart the process keeps running on the wrong mode — the user's
+   * live data silently disappears from view.
+   */
+  credentialsChangedSinceStart(config) {
+    const entry = this.running.get(config.id);
+    if (!entry) return false;
+    return stableEnvKey(this.resolveEnvKeys(config)) !== entry.credentialEnv;
+  }
   /**
    * Check if all required env keys for an integration can be resolved.
    */
@@ -9557,7 +9581,8 @@ var IntegrationManager = class {
           client: null,
           transport: null,
           tools: [],
-          respawnAttempts: attempts + 1
+          respawnAttempts: attempts + 1,
+          credentialEnv: ""
         };
         this.running.set(id, fakeEntry);
         this.handleCrash(id);
@@ -11708,11 +11733,16 @@ async function startIntegrationForService(serviceId) {
     (c) => c.id === serviceId || Object.values(c.envKeys ?? {}).some((ref) => typeof ref === "string" && ref.startsWith(`${serviceId}.`))
   );
   for (const config of candidates) {
+    if (integrationManager.isRunning(config.id) && integrationManager.credentialsChangedSinceStart(config)) {
+      console.error(`[Suveren MCP] ${config.id}: credentials changed since start \u2014 restarting`);
+      await startOneIntegration(config, { restart: true });
+      continue;
+    }
     await startOneIntegration(config);
   }
 }
-async function startOneIntegration(config) {
-  if (integrationManager.isRunning(config.id)) return;
+async function startOneIntegration(config, opts = {}) {
+  if (!opts.restart && integrationManager.isRunning(config.id)) return;
   const needsCreds = Object.keys(config.envKeys ?? {}).length > 0;
   if (needsCreds && !integrationManager.canResolveEnvKeys(config)) {
     const missing = [];
@@ -11731,7 +11761,7 @@ async function startOneIntegration(config) {
   const manifest = getManifest(config.id);
   const effectiveConfig = manifest ? { ...config, toolGating: manifest.toolGating, npmPackage: manifest.npmPackage ?? config.npmPackage } : config;
   try {
-    await integrationManager.startIntegration(effectiveConfig, { skipIfRunning: true });
+    await integrationManager.startIntegration(effectiveConfig, { skipIfRunning: !opts.restart });
   } catch (err) {
     console.error(`[Suveren MCP] Failed to start integration ${config.id}:`, err);
   }