@suveren/gateway 0.7.4 → 0.8.0

package/content/integrations/mollie.json

@@ -8,19 +8,32 @@
   "npmPackage": "mcp-remote",
   "mcp": {
     "command": "mcp-remote",
-    "args": ["https://mcp.mollie.com/mcp", "--header", "Authorization: Bearer ${MOLLIE_ACCESS_TOKEN}"]
+    "args": [
+      "https://mcp.mollie.com/mcp",
+      "--header",
+      "Authorization: Bearer ${MOLLIE_ACCESS_TOKEN}"
+    ]
   },
   "credentials": {
     "fields": [
-      { "key": "accessToken", "label": "Access Token", "type": "password", "placeholder": "access_org_..." }
+      {
+        "key": "accessToken",
+        "label": "Access Token",
+        "type": "password",
+        "placeholder": "access_org_..."
+      }
     ],
-    "envMapping": { "MOLLIE_ACCESS_TOKEN": "accessToken" }
+    "envMapping": {
+      "MOLLIE_ACCESS_TOKEN": "accessToken"
+    }
   },
   "oauth": null,
   "toolGating": {
     "default": {
       "executionMapping": {},
-      "staticExecution": { "action_type": "read" }
+      "staticExecution": {
+        "action_type": "unclassified"
+      }
     },
     "overrides": {
       "CreatePayment": {
@@ -28,67 +41,93 @@
           "amount": "amount",
           "currency": "currency"
         },
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "CreatePaymentForCustomer": {
         "executionMapping": {
           "amount": "amount",
           "currency": "currency"
         },
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "CreatePaymentLink": {
         "executionMapping": {
           "amount": "amount",
           "currency": "currency"
         },
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "CreateCapture": {
         "executionMapping": {
           "amount_value": "amount",
           "amount_currency": "currency"
         },
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "CreateSubscription": {
         "executionMapping": {
           "amount_value": "amount",
           "amount_currency": "currency"
         },
-        "staticExecution": { "action_type": "subscribe" }
+        "staticExecution": {
+          "action_type": "subscribe"
+        }
       },
       "UpdateSubscription": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "subscribe" }
+        "staticExecution": {
+          "action_type": "subscribe"
+        }
       },
       "CancelSubscription": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "subscribe" }
+        "staticExecution": {
+          "action_type": "subscribe"
+        }
       },
       "CreateCustomer": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "UpdateCustomer": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "CreateMandate": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "RevokeMandate": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "CreateWebhook": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       },
       "UpdateWebhook": {
         "executionMapping": {},
-        "staticExecution": { "action_type": "charge" }
+        "staticExecution": {
+          "action_type": "charge"
+        }
       }
     }
   },
@@ -98,33 +137,69 @@
       "description": "Read-only. View payments, balances, invoices, and transaction history.",
       "risk": "low",
       "mode": "automatic",
-      "bounds": { "amount_max": "0", "amount_daily_max": "0", "amount_monthly_max": "0", "transaction_count_daily_max": "100" },
-      "context": { "currency": "EUR", "action_type": "charge" },
+      "bounds": {
+        "amount_max": "0",
+        "amount_daily_max": "0",
+        "amount_monthly_max": "0",
+        "transaction_count_daily_max": "100"
+      },
+      "context": {
+        "currency": "EUR",
+        "action_type": "charge"
+      },
       "intent": "Allow the agent to monitor payments and view transaction history. Read-only — no payments are created or modified.",
       "ttl": 2592000,
-      "tags": ["read-only", "EUR", "100 ops/day"]
+      "tags": [
+        "read-only",
+        "EUR",
+        "100 ops/day"
+      ]
     },
     {
       "name": "Small Payments",
-      "description": "Create payment links and process charges up to \u20ac50 per transaction.",
+      "description": "Create payment links and process charges up to €50 per transaction.",
       "risk": "medium",
       "mode": "automatic",
-      "bounds": { "amount_max": "50", "amount_daily_max": "200", "amount_monthly_max": "2000", "transaction_count_daily_max": "20" },
-      "context": { "currency": "EUR", "action_type": "charge" },
-      "intent": "Allow the agent to create payment links and process small charges for routine invoicing. Max \u20ac50 per transaction, \u20ac200 per day.",
+      "bounds": {
+        "amount_max": "50",
+        "amount_daily_max": "200",
+        "amount_monthly_max": "2000",
+        "transaction_count_daily_max": "20"
+      },
+      "context": {
+        "currency": "EUR",
+        "action_type": "charge"
+      },
+      "intent": "Allow the agent to create payment links and process small charges for routine invoicing. Max €50 per transaction, €200 per day.",
       "ttl": 2592000,
-      "tags": ["\u20ac50/tx", "\u20ac200/day", "20 ops/day"]
+      "tags": [
+        "€50/tx",
+        "€200/day",
+        "20 ops/day"
+      ]
     },
     {
       "name": "Full Payment Management",
       "description": "Payments, refunds, and subscriptions. Every action requires your approval.",
       "risk": "high",
       "mode": "review",
-      "bounds": { "amount_max": "1000", "amount_daily_max": "5000", "amount_monthly_max": "20000", "transaction_count_daily_max": "50" },
-      "context": { "currency": "EUR", "action_type": "charge,refund,subscribe" },
+      "bounds": {
+        "amount_max": "1000",
+        "amount_daily_max": "5000",
+        "amount_monthly_max": "20000",
+        "transaction_count_daily_max": "50"
+      },
+      "context": {
+        "currency": "EUR",
+        "action_type": "charge,refund,subscribe"
+      },
       "intent": "Full payment management — create payments, issue refunds, manage subscriptions. Every write action requires human review before execution.",
       "ttl": 2592000,
-      "tags": ["\u20ac1,000/tx", "\u20ac5,000/day", "review mode"]
+      "tags": [
+        "€1,000/tx",
+        "€5,000/day",
+        "review mode"
+      ]
     }
   ],
   "setupHint": "Use a test token (test_...) for development.",

package/dist/control-plane/index.mjs

@@ -419,6 +419,13 @@ async function getEnrichedAuthorizations() {
   if (!res.ok) throw new Error("Failed to fetch authorizations");
   return res.json();
 }
+async function getLocalEvidence() {
+  const res = await fetch(`${MCP_BASE}/internal/evidence`, {
+    headers: internalHeaders()
+  });
+  if (!res.ok) throw new Error(`Failed to fetch local evidence: ${res.status}`);
+  return res.json();
+}
 async function getMcpHealth() {
   const res = await fetch(`${MCP_BASE}/health`);
   if (!res.ok) throw new Error("MCP server unreachable");
@@ -1935,49 +1942,11 @@ function createEncryptIntentRouter() {
   return router;
 }
 
-// src/routes/decrypt-intent.ts
-import { Router as Router8 } from "express";
-function createDecryptIntentRouter(vault2) {
-  const router = Router8();
-  router.post("/", async (req, res) => {
-    const { intentCiphertext, encryptedKey, approverId } = req.body;
-    if (typeof intentCiphertext !== "string" || intentCiphertext.length === 0) {
-      res.status(400).json({ error: "Missing or invalid field: intentCiphertext (base64 string)" });
-      return;
-    }
-    if (typeof encryptedKey !== "object" || encryptedKey === null || typeof encryptedKey.ct !== "string" || typeof encryptedKey.enc !== "string") {
-      res.status(400).json({ error: "Missing or invalid field: encryptedKey ({ ct: string; enc: string })" });
-      return;
-    }
-    if (typeof approverId !== "string" || approverId.length === 0) {
-      res.status(400).json({ error: "Missing or invalid field: approverId (string)" });
-      return;
-    }
-    try {
-      const kp = await loadOrGenerateKeyPair(vault2);
-      const { ct, enc } = encryptedKey;
-      const encrypted = {
-        intentCiphertext: new Uint8Array(Buffer.from(intentCiphertext, "base64")),
-        encryptedKeys: {
-          [approverId]: {
-            ct: new Uint8Array(Buffer.from(ct, "base64")),
-            enc: new Uint8Array(Buffer.from(enc, "base64"))
-          }
-        }
-      };
-      const intent = await decryptIntent(encrypted, approverId, kp.privateKey);
-      res.json({ intent });
-    } catch (err) {
-      console.error("[Control Plane] decrypt-intent error:", err);
-      const msg = err instanceof Error ? err.message : "Decryption failed";
-      res.status(500).json({ error: msg });
-    }
-  });
-  return router;
-}
+// src/routes/evidence-export.ts
+import { Router as Router9 } from "express";
 
 // src/routes/approved-intents.ts
-import { Router as Router9 } from "express";
+import { Router as Router8 } from "express";
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
@@ -1997,19 +1966,22 @@ function writeFile(data) {
   mkdirSync3(SUVEREN_DATA_DIR, { recursive: true });
   writeFileSync3(FILE_PATH, JSON.stringify(data, null, 2), "utf-8");
 }
+function readApprovedIntents(vault2) {
+  const file = readFile();
+  const result = {};
+  for (const [authorityId, blob] of Object.entries(file.entries)) {
+    try {
+      result[authorityId] = vault2.decrypt(blob);
+    } catch {
+    }
+  }
+  return result;
+}
 function createApprovedIntentsRouter(vault2) {
-  const router = Router9();
+  const router = Router8();
   router.get("/", (req, res) => {
     try {
-      const file = readFile();
-      const result = {};
-      for (const [authorityId, blob] of Object.entries(file.entries)) {
-        try {
-          result[authorityId] = vault2.decrypt(blob);
-        } catch {
-        }
-      }
-      res.json({ intents: result });
+      res.json({ intents: readApprovedIntents(vault2) });
     } catch (err) {
       console.error("[Control Plane] approved-intents GET error:", err);
       res.status(500).json({ error: "Failed to read approved intents" });
@@ -2039,6 +2011,222 @@ function createApprovedIntentsRouter(vault2) {
   return router;
 }
 
+// src/routes/evidence-export.ts
+var AS_FETCH_TIMEOUT_MS = 2e4;
+function createEvidenceExportRouter(spUrl, vault2) {
+  const router = Router9();
+  const getSpCookie = () => vault2.getSpCookie();
+  router.get("/", async (_req, res) => {
+    let local = null;
+    let localError;
+    try {
+      local = await getLocalEvidence();
+    } catch (err) {
+      localError = err instanceof Error ? err.message : String(err);
+    }
+    let authorityServer = null;
+    let asError;
+    const cookie = getSpCookie();
+    if (!cookie) {
+      asError = "No Authority Server session \u2014 sign in to include the full account history.";
+    } else {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), AS_FETCH_TIMEOUT_MS);
+      try {
+        const asRes = await fetch(`${spUrl}/api/receipts/export`, {
+          headers: { Cookie: cookie },
+          signal: controller.signal
+        });
+        if (asRes.ok) {
+          authorityServer = await asRes.json();
+        } else {
+          asError = `Authority Server export failed: ${asRes.status}`;
+        }
+      } catch (err) {
+        asError = `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}`;
+      } finally {
+        clearTimeout(timeout);
+      }
+    }
+    if (!local && !authorityServer) {
+      res.status(502).json({
+        error: "No evidence source available.",
+        localError,
+        asError
+      });
+      return;
+    }
+    let approvedIntents = {};
+    try {
+      approvedIntents = readApprovedIntents(vault2);
+    } catch {
+    }
+    const exportedAt = Math.floor(Date.now() / 1e3);
+    const date = new Date(exportedAt * 1e3).toISOString().slice(0, 10);
+    res.setHeader("Content-Disposition", `attachment; filename="suveren-evidence-${date}.json"`).setHeader("Cache-Control", "no-store").json({
+      format: "suveren-evidence-bundle/1",
+      exportedAt,
+      sources: {
+        local: local !== null,
+        authorityServer: authorityServer !== null,
+        ...localError ? { localError } : {},
+        ...asError ? { asError } : {}
+      },
+      local,
+      approvedIntents,
+      authorityServer
+    });
+  });
+  return router;
+}
+
+// src/routes/evidence.ts
+import { Router as Router10 } from "express";
+import { verifyReceiptSignature } from "@hap/core";
+async function verifyAll(receipts) {
+  const out = {};
+  for (const raw of receipts) {
+    const e = raw;
+    const id = typeof e.receipt?.id === "string" ? e.receipt.id : void 0;
+    if (!id) continue;
+    if (!e.asPublicKey) {
+      out[id] = "unverifiable";
+      continue;
+    }
+    try {
+      await verifyReceiptSignature(e.receipt, e.asPublicKey);
+      out[id] = "valid";
+    } catch {
+      out[id] = "invalid";
+    }
+  }
+  return out;
+}
+function mergeAuthorizations(evidence) {
+  const out = {};
+  for (const raw of evidence.authorizations ?? []) {
+    const a = raw;
+    const id = a.authorizationId;
+    if (!id) continue;
+    out[id] = {
+      authorizationId: id,
+      profileId: a.profileId,
+      boundsHash: a.boundsHash,
+      contextHash: a.contextHash,
+      bounds: a.bounds,
+      context: a.context,
+      intent: a.intent,
+      archived: true
+    };
+  }
+  for (const raw of evidence.gates ?? []) {
+    const g = raw;
+    const id = g.authorizationId;
+    if (!id) continue;
+    const gateContent = g.gateContent ?? {};
+    const existing = out[id];
+    if (!existing) {
+      out[id] = {
+        authorizationId: id,
+        profileId: g.profileId,
+        boundsHash: g.boundsHash,
+        contextHash: g.contextHash,
+        context: g.context,
+        intent: gateContent.intent,
+        archived: false
+      };
+      continue;
+    }
+    existing.intent ??= gateContent.intent;
+    existing.context ??= g.context;
+    existing.contextHash ??= g.contextHash;
+  }
+  return out;
+}
+function createEvidenceRouter() {
+  const router = Router10();
+  router.get("/authorizations", async (_req, res) => {
+    try {
+      const evidence = await getLocalEvidence();
+      res.json({
+        authorizations: mergeAuthorizations(evidence),
+        // Verified here, on this machine, so the card's badge reports a check
+        // that actually ran rather than the issuer vouching for itself.
+        signatures: await verifyAll(evidence.receipts ?? [])
+      });
+    } catch (err) {
+      res.status(503).json({
+        error: "Local evidence unavailable",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  router.get("/receipt/:id", async (req, res) => {
+    const id = String(req.params.id);
+    try {
+      const evidence = await getLocalEvidence();
+      const entry = (evidence.receipts ?? []).find(
+        (r) => r.receipt?.id === id
+      );
+      if (!entry) {
+        res.status(404).json({ error: "No local copy of this receipt" });
+        return;
+      }
+      const authorizationId = entry.authorizationId;
+      const authorization = authorizationId ? mergeAuthorizations(evidence)[authorizationId] ?? null : null;
+      const signature = (await verifyAll([entry]))[id] ?? "unverifiable";
+      res.json({ entry, authorization, signature });
+    } catch (err) {
+      res.status(503).json({
+        error: "Local evidence unavailable",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  return router;
+}
+
+// src/routes/decrypt-intent.ts
+import { Router as Router11 } from "express";
+function createDecryptIntentRouter(vault2) {
+  const router = Router11();
+  router.post("/", async (req, res) => {
+    const { intentCiphertext, encryptedKey, approverId } = req.body;
+    if (typeof intentCiphertext !== "string" || intentCiphertext.length === 0) {
+      res.status(400).json({ error: "Missing or invalid field: intentCiphertext (base64 string)" });
+      return;
+    }
+    if (typeof encryptedKey !== "object" || encryptedKey === null || typeof encryptedKey.ct !== "string" || typeof encryptedKey.enc !== "string") {
+      res.status(400).json({ error: "Missing or invalid field: encryptedKey ({ ct: string; enc: string })" });
+      return;
+    }
+    if (typeof approverId !== "string" || approverId.length === 0) {
+      res.status(400).json({ error: "Missing or invalid field: approverId (string)" });
+      return;
+    }
+    try {
+      const kp = await loadOrGenerateKeyPair(vault2);
+      const { ct, enc } = encryptedKey;
+      const encrypted = {
+        intentCiphertext: new Uint8Array(Buffer.from(intentCiphertext, "base64")),
+        encryptedKeys: {
+          [approverId]: {
+            ct: new Uint8Array(Buffer.from(ct, "base64")),
+            enc: new Uint8Array(Buffer.from(enc, "base64"))
+          }
+        }
+      };
+      const intent = await decryptIntent(encrypted, approverId, kp.privateKey);
+      res.json({ intent });
+    } catch (err) {
+      console.error("[Control Plane] decrypt-intent error:", err);
+      const msg = err instanceof Error ? err.message : "Decryption failed";
+      res.status(500).json({ error: msg });
+    }
+  });
+  return router;
+}
+
 // src/lib/update-checker.ts
 import { execSync } from "child_process";
 import { dirname as dirname3 } from "path";
@@ -2175,7 +2363,7 @@ data: null
 }
 
 // src/routes/gateway-settings.ts
-import { Router as Router10 } from "express";
+import { Router as Router12 } from "express";
 
 // src/lib/gateway-settings.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
@@ -2211,7 +2399,7 @@ function writeSettings(patch, dataDir) {
 
 // src/routes/gateway-settings.ts
 function createGatewaySettingsRouter() {
-  const router = Router10();
+  const router = Router12();
   router.get("/", (_req, res) => {
     res.json(readSettings());
   });
@@ -2234,7 +2422,7 @@ function createGatewaySettingsRouter() {
 }
 
 // src/routes/internal-events.ts
-import { Router as Router11 } from "express";
+import { Router as Router13 } from "express";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 function secretMatches(provided, expected) {
@@ -2246,7 +2434,7 @@ function secretMatches(provided, expected) {
   return timingSafeEqual2(a, b);
 }
 function createInternalEventsRouter(getSecret) {
-  const router = Router11();
+  const router = Router13();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
@@ -2628,6 +2816,8 @@ app.use("/mcp", jsonParser, authGuard, createMCPRouter());
 app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
+app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL2, vault));
+app.use("/api/evidence", authGuard, createEvidenceRouter());
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
 app.use("/api/approved-intents", jsonParser, authGuard, createApprovedIntentsRouter(vault));
 app.put("/integrations/:id/read-policy", jsonParser, authGuard, async (req, res) => {
@@ -2850,10 +3040,10 @@ app.use(
         const url = req.url ?? "";
         if (method !== "POST" && method !== "DELETE") return;
         const path = url.split("?")[0];
-        if (method === "POST" && path === "/api/as/attest") {
-          eventBus.emit("attestation-changed");
-        } else if (method === "POST" && /^\/api\/attestations\/[^/]+\/revoke$/.test(path)) {
+        if (method === "POST" && path === "/api/as/attest" || method === "POST" && /^\/api\/attestations\/[^/]+\/revoke$/.test(path) || method === "POST" && /^\/api\/authorizations\/[^/]+\/delete$/.test(path)) {
           eventBus.emit("attestation-changed");
+          void resyncGates().catch(() => {
+          });
         } else if (method === "POST" && path === "/api/proposals") {
           eventBus.emit("proposal-added");
         } else if (method === "POST" && /^\/api\/proposals\/[^/]+\/resolve$/.test(path)) {