@suveren/gateway 0.4.0 → 0.5.0

package/node_modules/jose/dist/webapi/util/decode_protected_header.js

@@ -1,6 +1,4 @@
-import { decode as b64u } from './base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
-import { isObject } from '../lib/type_checks.js';
+import { parseJoseHeader } from '../lib/helpers.js';
 export function decodeProtectedHeader(token) {
     let protectedB64u;
     if (typeof token === 'string') {
@@ -18,17 +16,9 @@ export function decodeProtectedHeader(token) {
             throw new TypeError('Token does not contain a Protected Header');
         }
     }
-    try {
-        if (typeof protectedB64u !== 'string' || !protectedB64u) {
-            throw new Error();
-        }
-        const result = JSON.parse(decoder.decode(b64u(protectedB64u)));
-        if (!isObject(result)) {
-            throw new Error();
-        }
-        return result;
-    }
-    catch {
-        throw new TypeError('Invalid Token or Protected Header formatting');
+    const invalid = 'Invalid Token or Protected Header formatting';
+    if (typeof protectedB64u !== 'string' || !protectedB64u) {
+        throw new TypeError(invalid);
     }
+    return parseJoseHeader(protectedB64u, TypeError, invalid);
 }

package/node_modules/jose/dist/webapi/util/errors.js

@@ -76,7 +76,7 @@ export class JWKSNoMatchingKey extends JOSEError {
     }
 }
 export class JWKSMultipleMatchingKeys extends JOSEError {
-    [Symbol.asyncIterator];
+    [Symbol.asyncIterator] = async function* () { };
     static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {

package/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.4",
+  "version": "6.2.5",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",
@@ -193,8 +193,6 @@
     "!dist/**/*.bundle.js",
     "!dist/**/*.umd.js",
     "!dist/**/*.min.js",
-    "!dist/types/runtime/*",
-    "!dist/types/lib/*",
-    "!dist/deno/**/*"
+    "!dist/types/lib/**"
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",
@@ -12,6 +12,7 @@
   },
   "files": [
     "bin",
+    "lib",
     "dist",
     "scripts",
     "content",

package/profiles/email/0.4.profile.json

@@ -50,8 +50,9 @@
         "type": "number",
         "required": false,
         "displayName": "Max email age (days)",
-        "description": "Maximum age in days for email search",
+        "description": "Maximum age in days for email search. Enforced locally by the Gatekeeper, never by the Authority Server: reads carry no receipt, so no signed check ever reads this value. Set it on the integration instead, where it is live-editable. Kept in the schema as the fallback for grants issued before that setting existed.",
         "unit": "days",
+        "enforcedBy": "gatekeeper",
         "boundType": {
           "kind": "per_transaction",
           "of": "read_age_days"