@suveren/gateway 0.6.2 → 0.6.3

package/node_modules/jose/dist/webapi/lib/jwe_algorithms.js

@@ -49,7 +49,7 @@ function pbes2() {
         ops: ['deriveBits', 'deriveBits'],
     };
 }
-const JWE = table({
+export const JWE = table({
     dir: {
         kty: ['oct'],
         secret: true,
@@ -96,21 +96,12 @@ const ENC = table({
     'A192CBC-HS384': contentEncryption(384, true),
     'A256CBC-HS512': contentEncryption(512, true),
 });
-const unsupportedAlg = 'Invalid or unsupported "alg" (JWE Algorithm) header value';
-export function jweAlgorithm(alg) {
-    const entry = JWE[alg];
-    if (!entry) {
-        throw new JOSENotSupported(unsupportedAlg);
-    }
-    return entry;
+function unsupported(parameter, name) {
+    throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`);
 }
-export function maybeJWEAlgorithm(alg) {
-    return JWE[alg];
+export function jweAlgorithm(alg) {
+    return (typeof alg === 'string' ? JWE[alg] : undefined) ?? unsupported('alg', 'Algorithm');
 }
 export function jweEncryption(enc) {
-    const entry = ENC[enc];
-    if (!entry) {
-        throw new JOSENotSupported(`Unsupported JWE Algorithm: ${enc}`);
-    }
-    return entry;
+    return ((typeof enc === 'string' ? ENC[enc] : undefined) ?? unsupported('enc', 'Encryption Algorithm'));
 }

package/node_modules/jose/dist/webapi/lib/jws_algorithms.js

@@ -45,7 +45,7 @@ function mldsa(bits) {
         usages: sig,
     };
 }
-const JWS = table({
+export const JWS = table({
     HS256: hmac(256),
     HS384: hmac(384),
     HS512: hmac(512),
@@ -65,12 +65,9 @@ const JWS = table({
     'ML-DSA-87': mldsa(87),
 });
 export function jwsAlgorithm(alg) {
-    const entry = JWS[alg];
+    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
     if (!entry) {
         throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
     return entry;
 }
-export function maybeJWSAlgorithm(alg) {
-    return JWS[alg];
-}

package/node_modules/jose/dist/webapi/lib/key.js

@@ -81,7 +81,7 @@ function cached(key, alg, value) {
             entry[alg] = value;
         }
         else {
-            cache.set(key, { [alg]: value });
+            cache.set(key, { __proto__: null, [alg]: value });
         }
     }
     return value ?? entry?.[alg];

package/node_modules/jose/dist/webapi/lib/key_algorithm.js

@@ -1,10 +1,10 @@
 import { JOSENotSupported } from '../util/errors.js';
-import { maybeJWSAlgorithm } from './jws_algorithms.js';
-import { maybeJWEAlgorithm } from './jwe_algorithms.js';
-export function keyAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? (maybeJWSAlgorithm(alg) ?? maybeJWEAlgorithm(alg)) : undefined;
-    if (!entry) {
-        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-    }
-    return entry;
+import { JWS } from './jws_algorithms.js';
+import { JWE } from './jwe_algorithms.js';
+export const algArgument = '"alg" (Algorithm)';
+export function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+    throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+export function keyAlgorithm(alg, source) {
+    return (typeof alg === 'string' ? (JWS[alg] ?? JWE[alg]) : undefined) ?? unsupportedAlg(source);
 }

package/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.7",
+  "version": "6.2.8",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",
@@ -24,7 +24,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@hap/core": "npm:@humanagencyp/hap-core@^0.8.0",
+    "@hap/core": "npm:@humanagencyp/hap-core@^0.8.1",
     "@hpke/core": "^1.9.0",
     "express": "^4.18.0",
     "http-proxy-middleware": "^3.0.0",

package/profiles/email/0.5.profile.json

@@ -0,0 +1,200 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/email@0.5",
+  "name": "Email",
+  "version": "0.5",
+  "description": "Email authority — governs sending, drafting, and reading email via Gmail",
+  "whatsNew": "Binds the recipients to the receipt, not only the message body — an approved message can no longer be delivered to someone else without breaking the proof.",
+  "boundsSchema": {
+    "keyOrder": [
+      "profile",
+      "recipient_max",
+      "send_daily_max",
+      "read_max_age_days",
+      "read_daily_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "recipient_max": {
+        "type": "number",
+        "required": false,
+        "displayName": "Recipients per email",
+        "description": "Maximum recipients per email",
+        "unit": "count",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "recipient_count"
+        },
+        "paths": [
+          "email-send",
+          "email-draft"
+        ]
+      },
+      "send_daily_max": {
+        "type": "number",
+        "required": false,
+        "displayName": "Daily send limit",
+        "description": "Maximum emails sent or drafted per day",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "paths": [
+          "email-send",
+          "email-draft"
+        ]
+      },
+      "read_max_age_days": {
+        "type": "number",
+        "required": false,
+        "displayName": "Max email age (days)",
+        "description": "Maximum age in days for email search. Enforced locally by the Gatekeeper, never by the Authority Server: reads carry no receipt, so no signed check ever reads this value. Set it on the integration instead, where it is live-editable. Kept in the schema as the fallback for grants issued before that setting existed.",
+        "unit": "days",
+        "enforcedBy": "gatekeeper",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "read_age_days"
+        },
+        "paths": [
+          "email-read"
+        ]
+      },
+      "read_daily_max": {
+        "type": "number",
+        "required": false,
+        "displayName": "Daily read limit",
+        "description": "Not currently enforced: reads carry no receipt, so no component counts them. Hidden from the authorization editor until enforcement exists.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "paths": [
+          "email-read"
+        ],
+        "enforced": false
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "allowed_recipients",
+      "allowed_domains"
+    ],
+    "fields": {
+      "allowed_recipients": {
+        "type": "string",
+        "required": false,
+        "displayName": "Allowed recipients",
+        "format": "email",
+        "description": "Comma-separated list of allowed email addresses",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ],
+          "requiredFor": [
+            "send"
+          ]
+        }
+      },
+      "allowed_domains": {
+        "type": "string",
+        "required": false,
+        "displayName": "Allowed domains",
+        "format": "domain",
+        "description": "Comma-separated list of allowed recipient domains (e.g. acme.com,partner.org)",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ],
+          "requiredFor": [
+            "send"
+          ]
+        }
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "recipient_count": {
+        "source": "declared",
+        "description": "Number of recipients in this email",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "allowed_recipients": {
+        "source": "declared",
+        "description": "Comma-separated recipient addresses from this call (checked against context)",
+        "required": false,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_domains": {
+        "source": "declared",
+        "description": "Comma-separated unique recipient domains from this call (checked against context)",
+        "required": false,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "send_count_daily": {
+        "source": "cumulative",
+        "cumulativeField": "_count",
+        "window": "daily",
+        "description": "Running daily send/draft count (resolved from execution log)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 31536000
+  },
+  "retention_minimum": 7776000,
+  "content_binding": {
+    "version": "2",
+    "kind": "jcs",
+    "fields": [
+      "to",
+      "cc",
+      "subject",
+      "body"
+    ],
+    "required_fields": [
+      "to",
+      "body"
+    ],
+    "appliesTo": [
+      "send"
+    ]
+  }
+}

package/profiles/index.json

@@ -4,6 +4,7 @@
     "github.com/humanagencyprotocol/hap-profiles/charge@0.4": "charge/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/purchase@0.4": "purchase/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/email@0.4": "email/0.4.profile.json",
+    "github.com/humanagencyprotocol/hap-profiles/email@0.5": "email/0.5.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/customers@0.4": "customers/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/customers@0.5": "customers/0.5.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/customers@0.6": "customers/0.6.profile.json",