gora8-signer 0.1.4 → 0.1.5

package/dist/ipc-server.js

@@ -1,5 +1,6 @@
 import { createServer } from "node:net";
-import { unlink } from "node:fs/promises";
+import { mkdir, unlink } from "node:fs/promises";
+import { dirname } from "node:path";
 export class SignerIpcServer {
     signer;
     socketPath;
@@ -9,6 +10,16 @@ export class SignerIpcServer {
         this.socketPath = socketPath;
     }
     async start() {
+        // The socket's directory (~/.gora8/signer/<name>/) doesn't exist yet
+        // on a brand-new signer name — nothing else in this package creates
+        // it (audit-log.ts/keystore.ts/rate-limit-backend.ts each lazily
+        // create their own file's directory, none of which is guaranteed to
+        // run before this does). Without this, server.listen() below fails
+        // with EACCES on macOS — libuv/Node report a missing parent
+        // directory as EACCES rather than ENOENT for a Unix domain socket
+        // bind, which reads exactly like a real permissions problem and
+        // isn't one.
+        await mkdir(dirname(this.socketPath), { recursive: true, mode: 0o700 });
         // Remove a stale socket file from an unclean previous shutdown —
         // net.createServer refuses to bind over an existing path otherwise.
         await unlink(this.socketPath).catch(() => { });

package/dist/policy.d.ts

@@ -3,6 +3,7 @@ export interface Mandate {
     protocol: string;
     mandateId: string;
     status: "active" | "revoked";
+    mode?: "advisory" | "policy-bounded" | "fully-autonomous";
     spending: {
         perTransactionLimit: number | null;
         dailyCap: number | null;

package/dist/policy.js

@@ -30,6 +30,14 @@ export class PolicyEngine {
         if (new Date(mandate.validUntil).getTime() < Date.now()) {
             return { allowed: false, reason: `Mandate ${mandate.mandateId} expired at ${mandate.validUntil}.` };
         }
+        // Independent enforcement of the same rule api/src/lib/
+        // policy-enforcement.ts's checkSpendingLimit() applies server-side —
+        // real defense-in-depth per this class's own doc comment: even a
+        // gora8 API that somehow let an Advisory-mode hire through still gets
+        // refused here, at the signature itself, before anything is signed.
+        if (request.amount !== null && mandate.mode === "advisory") {
+            return { allowed: false, reason: `Mandate ${mandate.mandateId} is in Advisory mode — this signer refuses to sign a value-moving transaction without explicit owner confirmation outside this flow.` };
+        }
         if (request.amount !== null) {
             const { perTransactionLimit, dailyCap, monthlyCap } = mandate.spending;
             if (perTransactionLimit !== null && request.amount > perTransactionLimit) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gora8-signer",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "publishConfig": {
     "access": "public"
   },