@suveren/gateway 0.6.3 → 0.6.4

package/content/integrations/deploy-github.json

@@ -80,7 +80,10 @@
           "action_type": "release"
         },
         "contentField": "deployment_url",
-        "actionLabel": "Deployment released"
+        "actionLabel": "Deployment released",
+        "argNormalization": {
+          "deployment_url": "url"
+        }
       }
     }
   },

package/dist/mcp-server/http.mjs

@@ -1270,6 +1270,49 @@ function encodeOutgoingArgs(tool, args) {
   return out ?? args;
 }
 
+// src/lib/arg-normalization.ts
+function normalizeUrl(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return value;
+  const withScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed) ? trimmed : `https://${trimmed}`;
+  let url;
+  try {
+    url = new URL(withScheme);
+  } catch {
+    return value;
+  }
+  if (!url.hostname) return value;
+  const scheme = url.protocol.replace(/:$/, "").toLowerCase();
+  const host = url.hostname.toLowerCase();
+  const defaultPort = scheme === "https" && url.port === "443" || scheme === "http" && url.port === "80";
+  const port2 = url.port && !defaultPort ? `:${url.port}` : "";
+  return `${scheme}://${host}${port2}`;
+}
+var NORMALIZERS = {
+  url: normalizeUrl
+};
+function normalizeIncomingArgs(tool, args) {
+  const declared = tool?.gating?.argNormalization;
+  if (!declared || !args) return args;
+  let out = null;
+  for (const [field, form] of Object.entries(declared)) {
+    const normalize = NORMALIZERS[form];
+    if (!normalize) {
+      console.error(
+        `[Suveren MCP] Warning: ${tool?.namespacedName} declares argNormalization "${form}" for "${field}", which this gateway does not implement. Using the value as supplied.`
+      );
+      continue;
+    }
+    const value = args[field];
+    if (typeof value !== "string") continue;
+    const normalized = normalize(value);
+    if (normalized === value) continue;
+    out ??= { ...args };
+    out[field] = normalized;
+  }
+  return out ?? args;
+}
+
 // src/lib/scope-specificity.ts
 function tokenSet(value) {
   if (value === void 0 || value === null) return /* @__PURE__ */ new Set();
@@ -1542,7 +1585,8 @@ function denyRead(state2, tool, reason, detail, target) {
   return { content: [{ type: "text", text: `Read blocked by Gatekeeper: ${detail}` }], isError: true };
 }
 function createGatedToolHandler(tool, integrationManager2, state2) {
-  const inner = createGatedToolHandlerInner(tool, integrationManager2, state2);
+  const gated = createGatedToolHandlerInner(tool, integrationManager2, state2);
+  const inner = async (args) => gated(normalizeIncomingArgs(tool, args));
   const blocked = tool.gating?.blockedArgs ?? [];
   if (blocked.length === 0) return inner;
   return async (args) => {
@@ -3204,7 +3248,8 @@ var IntegrationManager = class {
         // simply carries no binding, which only surfaces when a verifier asks.
         contentField: ext.contentField,
         blockedArgs: ext.blockedArgs,
-        argEncoding: ext.argEncoding
+        argEncoding: ext.argEncoding,
+        argNormalization: ext.argNormalization
       };
     }
     return {

package/node_modules/@hap/core/dist/index.d.mts

@@ -415,6 +415,28 @@ interface AgentProfile {
      * know why 0.5 exists. Absent → surfaces show the version alone.
      */
     whatsNew?: string;
+    /**
+     * Whether receipts under this profile may be looked up BY THEIR CONTENT — a
+     * verifier holding the content supplies its hash and learns which receipts
+     * bind it, without needing a receipt id.
+     *
+     * OFF unless declared, and that default is the point. The lookup is a
+     * confirmation oracle: given a guess at the content it says whether that
+     * content was authorized. Where the bound content has low entropy this is
+     * disclosure, not verification — guessing a message body is hopeless,
+     * guessing `production` takes a second. It is the same enumeration hazard
+     * recorded for per-field commitments, arriving from the other direction.
+     *
+     * Enable only when the bound content is unguessable enough that producing it
+     * is equivalent to already having it: prose, an artifact URL, a whole record
+     * payload. Never for a binding over a short value drawn from a small set.
+     *
+     * Why it must exist at all: most consequential actions cannot carry their
+     * receipt id. A released build was built before the receipt existed, a
+     * content-addressed artifact would change identity if the id were added, and
+     * a forwarded message has usually lost the footer that carried it.
+     */
+    receipt_lookup?: boolean;
     /**
      * v0.3 frame schema (deprecated, kept for backward compat).
      * Used when boundsSchema is not present.

package/node_modules/@hap/core/dist/index.d.ts

@@ -415,6 +415,28 @@ interface AgentProfile {
      * know why 0.5 exists. Absent → surfaces show the version alone.
      */
     whatsNew?: string;
+    /**
+     * Whether receipts under this profile may be looked up BY THEIR CONTENT — a
+     * verifier holding the content supplies its hash and learns which receipts
+     * bind it, without needing a receipt id.
+     *
+     * OFF unless declared, and that default is the point. The lookup is a
+     * confirmation oracle: given a guess at the content it says whether that
+     * content was authorized. Where the bound content has low entropy this is
+     * disclosure, not verification — guessing a message body is hopeless,
+     * guessing `production` takes a second. It is the same enumeration hazard
+     * recorded for per-field commitments, arriving from the other direction.
+     *
+     * Enable only when the bound content is unguessable enough that producing it
+     * is equivalent to already having it: prose, an artifact URL, a whole record
+     * payload. Never for a binding over a short value drawn from a small set.
+     *
+     * Why it must exist at all: most consequential actions cannot carry their
+     * receipt id. A released build was built before the receipt existed, a
+     * content-addressed artifact would change identity if the id were added, and
+     * a forwarded message has usually lost the footer that carried it.
+     */
+    receipt_lookup?: boolean;
     /**
      * v0.3 frame schema (deprecated, kept for backward compat).
      * Used when boundsSchema is not present.

package/node_modules/@hap/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/node_modules/@hap/core/src/types.ts

@@ -427,6 +427,29 @@ export interface AgentProfile {
    */
   whatsNew?: string;
 
+  /**
+   * Whether receipts under this profile may be looked up BY THEIR CONTENT — a
+   * verifier holding the content supplies its hash and learns which receipts
+   * bind it, without needing a receipt id.
+   *
+   * OFF unless declared, and that default is the point. The lookup is a
+   * confirmation oracle: given a guess at the content it says whether that
+   * content was authorized. Where the bound content has low entropy this is
+   * disclosure, not verification — guessing a message body is hopeless,
+   * guessing `production` takes a second. It is the same enumeration hazard
+   * recorded for per-field commitments, arriving from the other direction.
+   *
+   * Enable only when the bound content is unguessable enough that producing it
+   * is equivalent to already having it: prose, an artifact URL, a whole record
+   * payload. Never for a binding over a short value drawn from a small set.
+   *
+   * Why it must exist at all: most consequential actions cannot carry their
+   * receipt id. A released build was built before the receipt existed, a
+   * content-addressed artifact would change identity if the id were added, and
+   * a forwarded message has usually lost the footer that carried it.
+   */
+  receipt_lookup?: boolean;
+
   /**
    * v0.3 frame schema (deprecated, kept for backward compat).
    * Used when boundsSchema is not present.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",

package/profiles/deploy/0.7.profile.json

@@ -164,5 +164,6 @@
   "content_binding": {
     "version": "1",
     "kind": "text"
-  }
+  },
+  "receipt_lookup": true
 }