@suveren/gateway 0.6.3 → 0.6.5

package/content/integrations/deploy-github.json

@@ -79,8 +79,11 @@
         "staticExecution": {
           "action_type": "release"
         },
-        "contentField": "deployment_url",
-        "actionLabel": "Deployment released"
+        "contentField": "commit",
+        "actionLabel": "Deployment released",
+        "argNormalization": {
+          "commit": "sha"
+        }
       }
     }
   },

package/dist/mcp-server/http.mjs

@@ -1270,6 +1270,54 @@ function encodeOutgoingArgs(tool, args) {
   return out ?? args;
 }
 
+// src/lib/arg-normalization.ts
+function normalizeUrl(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return value;
+  const withScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed) ? trimmed : `https://${trimmed}`;
+  let url;
+  try {
+    url = new URL(withScheme);
+  } catch {
+    return value;
+  }
+  if (!url.hostname) return value;
+  const scheme = url.protocol.replace(/:$/, "").toLowerCase();
+  const host = url.hostname.toLowerCase();
+  const defaultPort = scheme === "https" && url.port === "443" || scheme === "http" && url.port === "80";
+  const port2 = url.port && !defaultPort ? `:${url.port}` : "";
+  return `${scheme}://${host}${port2}`;
+}
+function normalizeSha(value) {
+  const trimmed = value.trim();
+  return /^[0-9a-fA-F]{7,64}$/.test(trimmed) ? trimmed.toLowerCase() : value;
+}
+var NORMALIZERS = {
+  url: normalizeUrl,
+  sha: normalizeSha
+};
+function normalizeIncomingArgs(tool, args) {
+  const declared = tool?.gating?.argNormalization;
+  if (!declared || !args) return args;
+  let out = null;
+  for (const [field, form] of Object.entries(declared)) {
+    const normalize = NORMALIZERS[form];
+    if (!normalize) {
+      console.error(
+        `[Suveren MCP] Warning: ${tool?.namespacedName} declares argNormalization "${form}" for "${field}", which this gateway does not implement. Using the value as supplied.`
+      );
+      continue;
+    }
+    const value = args[field];
+    if (typeof value !== "string") continue;
+    const normalized = normalize(value);
+    if (normalized === value) continue;
+    out ??= { ...args };
+    out[field] = normalized;
+  }
+  return out ?? args;
+}
+
 // src/lib/scope-specificity.ts
 function tokenSet(value) {
   if (value === void 0 || value === null) return /* @__PURE__ */ new Set();
@@ -1542,7 +1590,8 @@ function denyRead(state2, tool, reason, detail, target) {
   return { content: [{ type: "text", text: `Read blocked by Gatekeeper: ${detail}` }], isError: true };
 }
 function createGatedToolHandler(tool, integrationManager2, state2) {
-  const inner = createGatedToolHandlerInner(tool, integrationManager2, state2);
+  const gated = createGatedToolHandlerInner(tool, integrationManager2, state2);
+  const inner = async (args) => gated(normalizeIncomingArgs(tool, args));
   const blocked = tool.gating?.blockedArgs ?? [];
   if (blocked.length === 0) return inner;
   return async (args) => {
@@ -3204,7 +3253,8 @@ var IntegrationManager = class {
         // simply carries no binding, which only surfaces when a verifier asks.
         contentField: ext.contentField,
         blockedArgs: ext.blockedArgs,
-        argEncoding: ext.argEncoding
+        argEncoding: ext.argEncoding,
+        argNormalization: ext.argNormalization
       };
     }
     return {

package/node_modules/@hap/core/dist/index.d.mts

@@ -415,6 +415,28 @@ interface AgentProfile {
      * know why 0.5 exists. Absent → surfaces show the version alone.
      */
     whatsNew?: string;
+    /**
+     * Whether receipts under this profile may be looked up BY THEIR CONTENT — a
+     * verifier holding the content supplies its hash and learns which receipts
+     * bind it, without needing a receipt id.
+     *
+     * OFF unless declared, and that default is the point. The lookup is a
+     * confirmation oracle: given a guess at the content it says whether that
+     * content was authorized. Where the bound content has low entropy this is
+     * disclosure, not verification — guessing a message body is hopeless,
+     * guessing `production` takes a second. It is the same enumeration hazard
+     * recorded for per-field commitments, arriving from the other direction.
+     *
+     * Enable only when the bound content is unguessable enough that producing it
+     * is equivalent to already having it: prose, an artifact URL, a whole record
+     * payload. Never for a binding over a short value drawn from a small set.
+     *
+     * Why it must exist at all: most consequential actions cannot carry their
+     * receipt id. A released build was built before the receipt existed, a
+     * content-addressed artifact would change identity if the id were added, and
+     * a forwarded message has usually lost the footer that carried it.
+     */
+    receipt_lookup?: boolean;
     /**
      * v0.3 frame schema (deprecated, kept for backward compat).
      * Used when boundsSchema is not present.

package/node_modules/@hap/core/dist/index.d.ts

@@ -415,6 +415,28 @@ interface AgentProfile {
      * know why 0.5 exists. Absent → surfaces show the version alone.
      */
     whatsNew?: string;
+    /**
+     * Whether receipts under this profile may be looked up BY THEIR CONTENT — a
+     * verifier holding the content supplies its hash and learns which receipts
+     * bind it, without needing a receipt id.
+     *
+     * OFF unless declared, and that default is the point. The lookup is a
+     * confirmation oracle: given a guess at the content it says whether that
+     * content was authorized. Where the bound content has low entropy this is
+     * disclosure, not verification — guessing a message body is hopeless,
+     * guessing `production` takes a second. It is the same enumeration hazard
+     * recorded for per-field commitments, arriving from the other direction.
+     *
+     * Enable only when the bound content is unguessable enough that producing it
+     * is equivalent to already having it: prose, an artifact URL, a whole record
+     * payload. Never for a binding over a short value drawn from a small set.
+     *
+     * Why it must exist at all: most consequential actions cannot carry their
+     * receipt id. A released build was built before the receipt existed, a
+     * content-addressed artifact would change identity if the id were added, and
+     * a forwarded message has usually lost the footer that carried it.
+     */
+    receipt_lookup?: boolean;
     /**
      * v0.3 frame schema (deprecated, kept for backward compat).
      * Used when boundsSchema is not present.

package/node_modules/@hap/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/node_modules/@hap/core/src/types.ts

@@ -427,6 +427,29 @@ export interface AgentProfile {
    */
   whatsNew?: string;
 
+  /**
+   * Whether receipts under this profile may be looked up BY THEIR CONTENT — a
+   * verifier holding the content supplies its hash and learns which receipts
+   * bind it, without needing a receipt id.
+   *
+   * OFF unless declared, and that default is the point. The lookup is a
+   * confirmation oracle: given a guess at the content it says whether that
+   * content was authorized. Where the bound content has low entropy this is
+   * disclosure, not verification — guessing a message body is hopeless,
+   * guessing `production` takes a second. It is the same enumeration hazard
+   * recorded for per-field commitments, arriving from the other direction.
+   *
+   * Enable only when the bound content is unguessable enough that producing it
+   * is equivalent to already having it: prose, an artifact URL, a whole record
+   * payload. Never for a binding over a short value drawn from a small set.
+   *
+   * Why it must exist at all: most consequential actions cannot carry their
+   * receipt id. A released build was built before the receipt existed, a
+   * content-addressed artifact would change identity if the id were added, and
+   * a forwarded message has usually lost the footer that carried it.
+   */
+  receipt_lookup?: boolean;
+
   /**
    * v0.3 frame schema (deprecated, kept for backward compat).
    * Used when boundsSchema is not present.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",

package/profiles/deploy/0.7.profile.json

@@ -164,5 +164,6 @@
   "content_binding": {
     "version": "1",
     "kind": "text"
-  }
+  },
+  "receipt_lookup": true
 }

package/profiles/deploy/0.8.profile.json

@@ -0,0 +1,170 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/deploy@0.8",
+  "name": "Deploy",
+  "version": "0.8",
+  "description": "Authority to make an already-built version live. Successor to deploy@0.6, which gated 'build and deploy this commit'; this gates the act of putting something in front of real users, because building is not consequential and going live is. The action is a RELEASE: it activates bytes that already exist, so the human can look at the artifact before approving and no rebuild can diverge from what was approved. Host-agnostic — the artifact identifier is a Vercel deployment id, a container image digest, an Azure slot — named by the connector manifest, never here.",
+  "boundsSchema": {
+    "keyOrder": [
+      "profile",
+      "release_daily_max",
+      "rollback_allowed"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "release_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Times per day something may go live",
+        "description": "How often the agent may make a build live for real users. Counted by the Authority Server, so a compromised gateway cannot exceed it. Building a preview is NOT counted: previews harm nobody, and charging them against this limit would exhaust it before anything reached anyone.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        }
+      },
+      "rollback_allowed": {
+        "type": "string",
+        "required": true,
+        "displayName": "May put a previous version back live",
+        "description": "Whether the agent may promote a PREVIOUS artifact back to live. Its own action type: reverting carries different risk from releasing, and the artifact being restored was approved for a moment that has passed.",
+        "enum": [
+          "yes",
+          "no"
+        ],
+        "boundType": {
+          "kind": "enum",
+          "values": [
+            "yes",
+            "no"
+          ]
+        }
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "allowed_repos",
+      "allowed_environments",
+      "allowed_workflows",
+      "allowed_branches"
+    ],
+    "fields": {
+      "allowed_repos": {
+        "type": "string",
+        "required": true,
+        "displayName": "Allowed repositories",
+        "description": "Repositories the agent may deploy from, e.g. humanagencyprotocol/hap",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_environments": {
+        "type": "string",
+        "required": true,
+        "displayName": "Allowed environments",
+        "description": "Deployment targets the agent may reach. Deliberately NOT an enum: hosts disagree — GitHub uses names you define, Vercel has production and preview, Netlify has deploy-preview and branch-deploy. The connector discovers the real list.",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_workflows": {
+        "type": "string",
+        "required": true,
+        "displayName": "Allowed pipelines",
+        "description": "Named pipelines the agent may run, e.g. deploy.yml. Scoping by pipeline rather than by 'deploy' means adding CI later — a migration, an infrastructure apply — is an edit to this list, not a new profile. The limit of this approach: the grant knows a pipeline is permitted, not what it does. The name has to carry that meaning to the human signing.",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_branches": {
+        "type": "string",
+        "required": false,
+        "displayName": "Allowed branches",
+        "description": "Branches a deployable commit may come from. Optional: a host with no branch concept leaves it empty.",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "action_type": {
+        "source": "static",
+        "description": "release or rollback — declared by the manifest, never taken from an agent argument",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "equals"
+          ]
+        }
+      },
+      "allowed_repos": {
+        "source": "declared",
+        "description": "Repository this action targets, checked against the authorized set",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_environments": {
+        "source": "declared",
+        "description": "Environment this action targets, checked against the authorized set. Recorded in the receipt, so the proof names where the release went.",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      },
+      "allowed_workflows": {
+        "source": "declared",
+        "description": "Pipeline this action runs, checked against the authorized set. Recorded in the receipt, so the proof names what ran.",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "subset"
+          ]
+        }
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 2592000,
+    "max": 31536000
+  },
+  "retention_minimum": 7776000,
+  "content_binding": {
+    "version": "1",
+    "kind": "text"
+  },
+  "receipt_lookup": true,
+  "whatsNew": "Binds the source commit the build came from, not only the artifact address. A released page can show its commit but never its own deployment URL, so this is what lets a reader tie the page they are on to the approval that put it there."
+}

package/profiles/index.json

@@ -12,6 +12,7 @@
     "github.com/humanagencyprotocol/hap-profiles/publish@0.4": "publish/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/records@0.4": "records/0.4.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/deploy@0.6": "deploy/0.6.profile.json",
-    "github.com/humanagencyprotocol/hap-profiles/deploy@0.7": "deploy/0.7.profile.json"
+    "github.com/humanagencyprotocol/hap-profiles/deploy@0.7": "deploy/0.7.profile.json",
+    "github.com/humanagencyprotocol/hap-profiles/deploy@0.8": "deploy/0.8.profile.json"
   }
 }