@suveren/gateway 0.36.2 → 0.37.0

package/dist/mcp-server/http.mjs

@@ -10527,7 +10527,7 @@ function unifiedLineDiff(before, after) {
 }
 
 // src/lib/builtins/setup.ts
-import { getProfile as getProfile9 } from "@hap/core";
+import { getProfile as getProfile9, listProfiles } from "@hap/core";
 var DELEGATION_PROFILE = "delegation";
 var DELEGATION_INTENT_HINT = [
   "Why \u2014 With test data only, I want to find out which routine parts of my work an AI could take over, so people gain time \u2014 before anything touches real systems.",
@@ -10571,10 +10571,28 @@ function shortName(idOrName) {
 function versionOf(id) {
   return id.split("@")[1] ?? "";
 }
-function delegationItselfRefusal(args) {
-  const requested = typeof args.profile === "string" ? args.profile : "";
-  if (shortName(requested) === DELEGATION_PROFILE) {
-    return "Delegation can never be proposed \u2014 the AI cannot widen its own delegation.";
+var MANDATE_ACTION = "mandate";
+function knownVersions(short) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const key of listProfiles()) {
+    if (shortName(key) !== short) continue;
+    const p = getProfile9(key);
+    if (p) byId.set(p.id, p);
+  }
+  return [...byId.values()];
+}
+function proposalTargetRefusal(args) {
+  const requested = typeof args.profile === "string" ? shortName(args.profile.trim()) : "";
+  const versions = requested ? knownVersions(requested) : [];
+  if (versions.length === 0) {
+    return { code: "UNKNOWN_PROFILE", message: `Unknown profile "${requested}" \u2014 not in this gateway's profile catalog.` };
+  }
+  if (versions.some((p) => p.boundsSchema?.actionTypes?.includes(MANDATE_ACTION))) {
+    const name = versions.map((p) => p.name).find(Boolean) ?? requested;
+    return {
+      code: "DELEGATION_NOT_PROPOSABLE",
+      message: `${name} can never be proposed \u2014 it lets an AI propose mandates, and the AI cannot widen its own delegation.`
+    };
   }
   return void 0;
 }
@@ -10741,7 +10759,7 @@ function setupBuiltin(deps) {
         },
         create_mandate: {
           executionMapping: { profile: "allowed_profiles", mode: "allowed_modes" },
-          staticExecution: { action_type: "mandate" },
+          staticExecution: { action_type: MANDATE_ACTION },
           actionLabel: "Mandate proposed",
           hideUnlessAuthorized: true,
           // Shown like the mandate screen: limits and scope by the profile's own names.
@@ -10830,7 +10848,7 @@ ${body}`);
         description: "Propose a new mandate for the person running this gateway \u2014 the authority another tool needs (e.g. sales quotes up to a value). Always goes to the person's current workspace (their team, or Personal if they are not in one) \u2014 there is no way to name a different one. A person approves or rejects the proposal; only after approval is the mandate created, exactly as if they had signed it on the mandate screen. Checked against the profile before the proposal: unknown limits, a mode the profile does not allow, or a team where the person may not give this mandate are refused at once. Outside simulation mode, the profile and mode you may propose are themselves limited by your Delegation mandate's scope \u2014 Delegation itself can never be proposed. Create only.",
         inputSchema: CREATE_MANDATE_INPUT_SCHEMA,
         validate: async (args) => {
-          const fixed = delegationItselfRefusal(args);
+          const fixed = proposalTargetRefusal(args);
           if (fixed) {
             deps.state.denialLog?.record({
               ts: Date.now(),
@@ -10838,18 +10856,18 @@ ${body}`);
               integrationId: "setup",
               profile: DELEGATION_PROFILE,
               kind: "bound",
-              detail: fixed,
+              detail: fixed.message,
               who: "gateway",
-              code: "DELEGATION_NOT_PROPOSABLE"
+              code: fixed.code
             });
-            return fixed;
+            return fixed.message;
           }
           const check = await controlPlaneMandate(true, mandateRequest(args));
           return check.ok ? void 0 : check.message;
         },
         handler: async (args) => {
-          const fixed = delegationItselfRefusal(args);
-          if (fixed) return { ...builtinText(`Refused: ${fixed}`), isError: true };
+          const fixed = proposalTargetRefusal(args);
+          if (fixed) return { ...builtinText(`Refused: ${fixed.message}`), isError: true };
           const r = await controlPlaneMandate(false, mandateRequest(args));
           if (!r.ok) return { ...builtinText(`Refused: ${r.message}`), isError: true };
           return builtinText(