@suveren/gateway 0.8.7 → 0.10.0

package/profiles/sales/0.1.profile.json

@@ -0,0 +1,252 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/sales@0.1",
+  "name": "Sales",
+  "version": "0.1",
+  "description": "Sales authority — governs quote-to-order in an ERP: draft quotes, send quotes to customers, convert quotes to orders. No invoicing, delivery, payments or master data.",
+  "boundsSchema": {
+    "actionTypes": [
+      "quote",
+      "send",
+      "order"
+    ],
+    "keyOrder": [
+      "profile",
+      "read_access",
+      "value_max",
+      "discount_max",
+      "order_value_daily_max",
+      "quote_daily_max",
+      "send_daily_max",
+      "order_daily_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "read_access": {
+        "type": "string",
+        "required": true,
+        "displayName": "Read access",
+        "description": "Allow the agent to look up items, stock, list prices, customers (incl. credit limit and open balance), quotes and orders.",
+        "boundType": {
+          "kind": "enum",
+          "values": [
+            "unlimited",
+            "none"
+          ]
+        },
+        "toolsDescription": "list_items, get_item, find_customers, get_customer, list_quotes, get_quote, list_orders, get_order",
+        "default": "unlimited"
+      },
+      "value_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max value per quote or order",
+        "description": "Maximum net document total of a single quote or order, in currency units. The connector recalculates the total from the lines and refuses a call whose declared value does not match.",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "value"
+        }
+      },
+      "discount_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max discount",
+        "description": "Maximum document discount against list price, in percent. 0 means list price only. The connector recalculates the discount from list prices and refuses a call whose declared discount does not match.",
+        "unit": "percent",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "discount_pct"
+        }
+      },
+      "order_value_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Daily order value",
+        "description": "Maximum cumulative net value of orders created per day, in currency units.",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "cumulative_sum",
+          "of": "value",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "order"
+        ]
+      },
+      "quote_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Quotes per day",
+        "description": "Maximum draft quotes created or edited per day",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "quote"
+        ]
+      },
+      "send_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Quotes sent per day",
+        "description": "Maximum quotes sent to customers per day. Sending a quote is a binding offer.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "send"
+        ]
+      },
+      "order_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Orders per day",
+        "description": "Maximum quotes converted to orders per day. An order reserves stock and commits a delivery date.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "order"
+        ]
+      }
+    }
+  },
+  "contextSchema": {
+    "keyOrder": [
+      "currency"
+    ],
+    "fields": {
+      "currency": {
+        "type": "string",
+        "required": true,
+        "displayName": "Currency",
+        "description": "Permitted document currency",
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        },
+        "enum": [
+          "EUR",
+          "CHF",
+          "USD",
+          "GBP"
+        ]
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "value": {
+        "source": "declared",
+        "description": "Net document total in currency units (verified by the connector against the lines)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "discount_pct": {
+        "source": "declared",
+        "description": "Document discount against list price in percent (verified by the connector against list prices)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "currency": {
+        "source": "declared",
+        "description": "Document currency",
+        "required": true,
+        "constraint": {
+          "type": "string",
+          "enforceable": [
+            "enum"
+          ]
+        }
+      },
+      "order_value_daily": {
+        "source": "cumulative",
+        "description": "Running daily order value (resolved from execution log)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "value",
+        "window": "daily"
+      },
+      "quote_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily quote count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "send_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily send count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "order_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily order count",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "decision_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 2592000
+  },
+  "retention_minimum": 7776000,
+  "content_binding": {
+    "version": "1",
+    "kind": "jcs"
+  }
+}

package/server.js

@@ -10,8 +10,107 @@
 import { spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { homedir, tmpdir, constants as osConstants } from 'node:os';
+import { existsSync, mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { resolveCaFile } from './lib/config.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
+const THIS_FILE = fileURLToPath(import.meta.url);
+
+/** Exit this process the way a shell reports a signal-terminated child: 128
+ *  plus the signal number, so a caller (or a test) can tell "exited cleanly
+ *  with code N" from "was killed by signal N" instead of both collapsing to
+ *  a bare exit(1). */
+function exitLikeChild(code, signal) {
+  if (signal) {
+    const num = osConstants.signals?.[signal];
+    process.exit(128 + (typeof num === 'number' ? num : 0));
+  }
+  process.exit(code ?? 0);
+}
+
+// ─── Internal CA bundle (--ca-file / `config set ca-file`) ─────────────────
+//
+// `NODE_EXTRA_CA_CERTS` is read by Node ONLY at process start, before any of
+// our own code runs — setting `process.env.NODE_EXTRA_CA_CERTS` here would be
+// too late to affect THIS process's own TLS. It still needs to reach the
+// control-plane and MCP-server children below (those are fresh processes, so
+// setting it in the `env` object we spawn them with DOES work), but this
+// process itself also makes its own outbound calls in a few paths.
+//
+// This is the ONE place that has to handle it for every way the gateway can
+// start: `suveren-gateway start` (the CLI just spawns this same file),
+// autostart (launchd/systemd/Task Scheduler spawn this file DIRECTLY,
+// bypassing the CLI's own flag handling), and Docker (`CMD node server.js`).
+// Re-exec once, here, before anything network-related happens, rather than
+// have three separate top-level entry points each remember to do it.
+//
+// Guarded by SUVEREN_CA_REEXEC_DONE, not by comparing NODE_EXTRA_CA_CERTS to
+// the saved path: when the caller's shell already has its OWN
+// NODE_EXTRA_CA_CERTS set (a corporate proxy CA, say), overwriting it would
+// silently break trust for everything else this process does (npm registry
+// fetches for on-demand integrations, other HTTPS calls) — so the two are
+// MERGED into one combined PEM file instead. Comparing against that combined
+// path would never match the saved path alone, so the guard has to be a
+// dedicated marker, not a value comparison (which would also re-exec forever).
+const DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join(homedir(), '.suveren');
+const savedCaFile = resolveCaFile(DATA_DIR);
+if (savedCaFile && !process.env.SUVEREN_CA_REEXEC_DONE) {
+  let effectiveCaFile = savedCaFile;
+  /** Set only when a combined-CA temp dir was actually created, so it can be
+   *  cleaned up on exit rather than left behind on every restart. */
+  let combinedDirToClean = null;
+  const existingCaFile = process.env.NODE_EXTRA_CA_CERTS;
+  if (existingCaFile && existingCaFile !== savedCaFile && existsSync(existingCaFile)) {
+    try {
+      const combined =
+        readFileSync(existingCaFile, 'utf8').trimEnd() + '\n' + readFileSync(savedCaFile, 'utf8').trimEnd() + '\n';
+      const combinedDir = mkdtempSync(join(tmpdir(), 'suveren-ca-'));
+      const combinedPath = join(combinedDir, 'combined-ca-certs.pem');
+      writeFileSync(combinedPath, combined, 'utf8');
+      effectiveCaFile = combinedPath;
+      combinedDirToClean = combinedDir;
+      console.error(
+        `[suveren-gateway] Merged --ca-file with the existing NODE_EXTRA_CA_CERTS (${existingCaFile}) ` +
+          `so neither trust source is lost.`,
+      );
+    } catch (err) {
+      console.error(
+        `[suveren-gateway] Could not merge NODE_EXTRA_CA_CERTS with the saved --ca-file (${err.message}); ` +
+          `using the saved --ca-file alone, which may break other HTTPS calls that relied on the existing one.`,
+      );
+    }
+  }
+
+  const child = spawn(
+    process.execPath,
+    [THIS_FILE, ...process.argv.slice(2)],
+    { env: { ...process.env, NODE_EXTRA_CA_CERTS: effectiveCaFile, SUVEREN_CA_REEXEC_DONE: '1' }, stdio: 'inherit' },
+  );
+  child.on('exit', (code, signal) => {
+    if (combinedDirToClean) {
+      try { rmSync(combinedDirToClean, { recursive: true, force: true }); } catch { /* best-effort */ }
+    }
+    exitLikeChild(code, signal);
+  });
+  for (const sig of ['SIGINT', 'SIGTERM']) {
+    process.on(sig, () => child.kill(sig));
+  }
+  // Stop here — the re-executed child (which now has NODE_EXTRA_CA_CERTS set
+  // from its own start) is the one that spawns control-plane + mcp-server;
+  // this parent's only job from here is to relay its exit code and signals,
+  // both wired above. Top-level await pauses the rest of THIS module's
+  // evaluation (the spawns below) until that promise settles, which only
+  // happens via the exit handler calling process.exit().
+  await new Promise(() => {});
+}
+
+// Reached only in the re-executed child (or when no --ca-file is set at
+// all). SUVEREN_CA_REEXEC_DONE is bookkeeping for the block above — internal
+// to this file, and meaningless (worse, confusing) to anything downstream —
+// so it must not ride along in the env every child process below inherits
+// via `...process.env`, all the way down to individual integrations.
+delete process.env.SUVEREN_CA_REEXEC_DONE;
 
 const CP_PORT = process.env.SUVEREN_CP_PORT ?? '3400';
 const MCP_PORT = process.env.SUVEREN_MCP_PORT ?? '3430';