@suveren/gateway 0.11.2 → 0.13.0

package/dist/mcp-server/http.mjs

@@ -142,18 +142,237 @@ function fingerprintOf(publicKeyHex) {
 }
 
 // src/lib/as-config.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
+
+// src/lib/policy.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+import { spawnSync } from "child_process";
+var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
+var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
+function registryKeyPath(hive) {
+  const baseKey = process.env.SUVEREN_POLICY_REGISTRY_KEY || DEFAULT_REGISTRY_BASE_KEY;
+  return `${hive}\\${baseKey}`;
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function validateCaFile(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The CA file path is empty." };
+  if (!existsSync3(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
+  return { ok: true, path: trimmed };
+}
+function validateProxyUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The proxy URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { ok: false, error: `"${trimmed}" must use http:// or https://.` };
+  }
+  return { ok: true, url: trimmed };
+}
+function coerceBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (value === 0) return false;
+    if (value === 1) return true;
+    return void 0;
+  }
+  if (typeof value === "string") {
+    const v = value.trim().toLowerCase();
+    if (v === "true" || v === "1") return true;
+    if (v === "false" || v === "0") return false;
+  }
+  return void 0;
+}
+function parseRegQueryOutput(stdout) {
+  const out = {};
+  const lineRe = /^ {4}(\S+)\s+(REG_SZ|REG_EXPAND_SZ|REG_DWORD|REG_QWORD|REG_BINARY|REG_MULTI_SZ)\s+(.*)$/;
+  for (const line of stdout.split(/\r?\n/)) {
+    const m = lineRe.exec(line);
+    if (!m) continue;
+    const [, name, type, rawValue] = m;
+    if (!POLICY_KEYS.includes(name)) continue;
+    const key = name;
+    if (type === "REG_DWORD" || type === "REG_QWORD") {
+      out[key] = parseInt(rawValue, 16);
+    } else {
+      out[key] = rawValue;
+    }
+  }
+  return out;
+}
+function readRegistryHive(hive) {
+  const path = registryKeyPath(hive);
+  const source = `the registry policy (${path})`;
+  if (process.env.SUVEREN_POLICY_REGISTRY === "off") return { values: {}, source };
+  if (process.platform !== "win32") return { values: {}, source };
+  let result;
+  try {
+    result = spawnSync("reg", ["query", path], { encoding: "utf8" });
+  } catch {
+    return { values: {}, source };
+  }
+  if (!result || result.status !== 0 || !result.stdout) return { values: {}, source };
+  return { values: parseRegQueryOutput(result.stdout), source };
+}
+function policyFilePath() {
+  if (process.env.SUVEREN_POLICY_FILE) return process.env.SUVEREN_POLICY_FILE;
+  if (process.platform === "win32") {
+    const programData = process.env.ProgramData || process.env.PROGRAMDATA || "C:\\ProgramData";
+    return join3(programData, "Suveren", "gateway-policy.json");
+  }
+  if (process.platform === "darwin") {
+    return "/Library/Application Support/Suveren/gateway-policy.json";
+  }
+  return "/etc/suveren/gateway-policy.json";
+}
+function readPolicyFile() {
+  const path = policyFilePath();
+  const source = `the policy file (${path})`;
+  if (!existsSync3(path)) return { values: {}, source };
+  let data;
+  try {
+    data = JSON.parse(readFileSync3(path, "utf8"));
+  } catch (err) {
+    throw new Error(`Could not parse policy file ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const values = {};
+  for (const key of POLICY_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(data, key)) {
+      values[key] = data[key];
+    }
+  }
+  return { values, source };
+}
+function mergeBySource(entries) {
+  const merged = {};
+  const sourceOf = {};
+  for (const key of POLICY_KEYS) {
+    for (const entry of entries) {
+      if (Object.prototype.hasOwnProperty.call(entry.values, key) && entry.values[key] !== void 0) {
+        merged[key] = entry.values[key];
+        sourceOf[key] = entry.source;
+        break;
+      }
+    }
+  }
+  return { merged, sourceOf };
+}
+var cached = null;
+function readPolicy() {
+  if (cached) return cached;
+  const hklm = readRegistryHive("HKLM");
+  const hkcu = readRegistryHive("HKCU");
+  const file = readPolicyFile();
+  const { merged, sourceOf } = mergeBySource([hklm, hkcu, file]);
+  const policy = {};
+  const locked = /* @__PURE__ */ new Set();
+  if (merged.AsUrl !== void 0) {
+    const v = validateAsUrl(String(merged.AsUrl));
+    if (!v.ok) {
+      throw new Error(`Invalid policy AsUrl ("${merged.AsUrl}") from ${sourceOf.AsUrl}: ${v.error}`);
+    }
+    policy.asUrl = v.url;
+    locked.add("asUrl");
+  }
+  if (merged.CaFile !== void 0) {
+    const v = validateCaFile(String(merged.CaFile));
+    if (!v.ok) {
+      throw new Error(`Invalid policy CaFile ("${merged.CaFile}") from ${sourceOf.CaFile}: ${v.error}`);
+    }
+    policy.caFile = v.path;
+    locked.add("caFile");
+  }
+  if (merged.PinTls !== void 0) {
+    const b = coerceBoolean(merged.PinTls);
+    if (b === void 0) {
+      throw new Error(
+        `Invalid policy PinTls ("${String(merged.PinTls)}") from ${sourceOf.PinTls}: must be a boolean or 0/1.`
+      );
+    }
+    policy.pinTls = b;
+    locked.add("pinTls");
+  }
+  if (merged.Proxy !== void 0) {
+    const v = validateProxyUrl(String(merged.Proxy));
+    if (!v.ok) {
+      throw new Error(`Invalid policy Proxy ("${String(merged.Proxy)}") from ${sourceOf.Proxy}: ${v.error}`);
+    }
+    policy.proxy = v.url;
+    locked.add("proxy");
+  }
+  if (merged.NoProxy !== void 0) {
+    const raw = String(merged.NoProxy).trim();
+    if (!raw) {
+      throw new Error(`Invalid policy NoProxy ("${String(merged.NoProxy)}") from ${sourceOf.NoProxy}: must not be empty.`);
+    }
+    policy.noProxy = raw;
+    locked.add("noProxy");
+  }
+  if (merged.Simulation !== void 0) {
+    const b = coerceBoolean(merged.Simulation);
+    if (b === void 0) {
+      throw new Error(
+        `Invalid policy Simulation ("${String(merged.Simulation)}") from ${sourceOf.Simulation}: must be a boolean or 0/1.`
+      );
+    }
+    policy.simulation = b;
+    locked.add("simulation");
+  }
+  if (merged.InstallMethod !== void 0) {
+    const raw = String(merged.InstallMethod).trim().toLowerCase();
+    if (raw !== "managed") {
+      throw new Error(
+        `Invalid policy InstallMethod ("${String(merged.InstallMethod)}") from ${sourceOf.InstallMethod}: only "managed" is supported.`
+      );
+    }
+    policy.installMethod = "managed";
+    locked.add("installMethod");
+  }
+  cached = { policy, locked };
+  return cached;
+}
+
+// src/lib/as-config.ts
 var DEFAULT_AS_URL = "https://www.suveren.ai";
 function configPath(dataDir2) {
-  return join3(dataDir2, "config.json");
+  return join4(dataDir2, "config.json");
 }
 function readAsConfigStrict(dataDir2) {
   const path = configPath(dataDir2);
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   let data;
   try {
-    data = JSON.parse(readFileSync3(path, "utf-8"));
+    data = JSON.parse(readFileSync4(path, "utf-8"));
   } catch (err) {
     throw new Error(
       `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -168,9 +387,9 @@ function readAsConfigStrict(dataDir2) {
 }
 function readAsConfig(dataDir2) {
   const path = configPath(dataDir2);
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
-    const data = JSON.parse(readFileSync3(path, "utf-8"));
+    const data = JSON.parse(readFileSync4(path, "utf-8"));
     const out = {};
     if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
     if (typeof data.caFile === "string") out.caFile = data.caFile;
@@ -181,7 +400,7 @@ function readAsConfig(dataDir2) {
     return {};
   }
 }
-function validateAsUrl(candidate) {
+function validateAsUrl2(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
   let parsed;
@@ -206,26 +425,30 @@ function validateAsUrl(candidate) {
   return { ok: true, url: normalized };
 }
 function resolveAsUrl(dataDir2, flag) {
+  const policyUrl = readPolicy().policy.asUrl;
+  if (policyUrl) return policyUrl;
   if (flag) {
-    const v = validateAsUrl(flag);
+    const v = validateAsUrl2(flag);
     if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
     return v.url;
   }
   const envUrl = process.env.SUVEREN_AS_URL;
   if (envUrl) {
-    const v = validateAsUrl(envUrl);
+    const v = validateAsUrl2(envUrl);
     if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
     return v.url;
   }
   const saved = readAsConfigStrict(dataDir2).asUrl;
   if (saved) {
-    const v = validateAsUrl(saved);
+    const v = validateAsUrl2(saved);
     if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir2}/config.json: ${v.error}`);
     return v.url;
   }
   return DEFAULT_AS_URL;
 }
 function resolvePinTls(dataDir2) {
+  const policyPinTls = readPolicy().policy.pinTls;
+  if (policyPinTls !== void 0) return policyPinTls;
   return readAsConfig(dataDir2).pinTls === true;
 }
 function validatePinTlsForUrl(pinTls, asUrl) {
@@ -240,14 +463,58 @@ function validatePinTlsForUrl(pinTls, asUrl) {
 // src/lib/as-tls-pin.ts
 import { createHash as createHash2 } from "crypto";
 import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
+import { Agent as HttpsAgent2 } from "https";
+import { readFileSync as readFileSync5 } from "fs";
+import { Agent, ProxyAgent, fetch as undiciFetch } from "undici";
+
+// src/lib/proxy-env.ts
+function isLoopbackHostname(hostname) {
+  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (h === "localhost") return true;
+  if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
+  return /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.test(h);
+}
+function readProxyEnv() {
+  const http = process.env.http_proxy || process.env.HTTP_PROXY || void 0;
+  const https = process.env.https_proxy || process.env.HTTPS_PROXY || void 0;
+  const noProxy = process.env.no_proxy ?? process.env.NO_PROXY ?? "";
+  return { http, https, noProxy };
+}
+function matchesNoProxy(hostname, port2, noProxy) {
+  const entries = noProxy.split(/[,\s]+/).filter(Boolean);
+  if (entries.length === 0) return false;
+  if (entries.includes("*")) return true;
+  const h = hostname.toLowerCase();
+  for (const raw of entries) {
+    const m = raw.match(/^(.+):(\d+)$/);
+    const entryHost = (m ? m[1] : raw).replace(/^\*?\./, "").toLowerCase();
+    const entryPort = m ? Number(m[2]) : 0;
+    if (entryPort && entryPort !== port2) continue;
+    if (h === entryHost || h.endsWith(`.${entryHost}`)) return true;
+  }
+  return false;
+}
+function selectProxyUrl(targetUrl) {
+  const url = typeof targetUrl === "string" ? new URL(targetUrl) : targetUrl;
+  if (isLoopbackHostname(url.hostname)) return void 0;
+  const { http, https, noProxy } = readProxyEnv();
+  const port2 = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+  if (matchesNoProxy(url.hostname, port2, noProxy)) return void 0;
+  return url.protocol === "https:" ? https ?? http : http;
+}
+
+// src/lib/proxy-https-agent.ts
 import { Agent as HttpsAgent } from "https";
-import { readFileSync as readFileSync4 } from "fs";
-import { Agent, fetch as undiciFetch } from "undici";
+import { connect as netConnect } from "net";
+import { connect as tlsConnect } from "tls";
+var MAX_CONNECT_RESPONSE_BYTES = 64 * 1024;
+
+// src/lib/as-tls-pin.ts
 function effectiveCa() {
   const path = process.env.NODE_EXTRA_CA_CERTS;
   if (!path) return void 0;
   try {
-    return [...rootCertificates, readFileSync4(path, "utf-8")];
+    return [...rootCertificates, readFileSync5(path, "utf-8")];
   } catch {
     return void 0;
   }
@@ -302,24 +569,27 @@ function pinnedCheckServerIdentity(pinnedSpkiHex) {
     return void 0;
   };
 }
-function buildPinnedDispatcher(pinnedSpkiHex) {
-  return new Agent({
-    connect: {
-      ca: effectiveCa(),
-      checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
-    }
+function buildTlsDispatcher(url, connectOpts) {
+  const proxyUrl = selectProxyUrl(url);
+  if (proxyUrl) {
+    return new ProxyAgent({ uri: proxyUrl, requestTls: connectOpts });
+  }
+  return new Agent({ connect: connectOpts });
+}
+function buildPinnedDispatcher(pinnedSpkiHex, url) {
+  return buildTlsDispatcher(url, {
+    ca: effectiveCa(),
+    checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
   });
 }
-function buildCapturingDispatcher() {
+function buildCapturingDispatcher(url) {
   let captured;
-  const dispatcher = new Agent({
-    connect: {
-      ca: effectiveCa(),
-      checkServerIdentity: (hostname, cert) => {
-        captured = cert;
-        const defaultErr = defaultCheckServerIdentity(hostname, cert);
-        return defaultErr ? taggedCheckError(defaultErr) : void 0;
-      }
+  const dispatcher = buildTlsDispatcher(url, {
+    ca: effectiveCa(),
+    checkServerIdentity: (hostname, cert) => {
+      captured = cert;
+      const defaultErr = defaultCheckServerIdentity(hostname, cert);
+      return defaultErr ? taggedCheckError(defaultErr) : void 0;
     }
   });
   return { dispatcher, getCapturedCert: () => captured };
@@ -330,6 +600,34 @@ function withBoundedSignal(init) {
   const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
   return { ...init, signal };
 }
+var UNKNOWN_ISSUER_CODES = /* @__PURE__ */ new Set([
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "CERT_UNTRUSTED"
+]);
+function tlsErrorCode(err) {
+  if (!(err instanceof Error)) return void 0;
+  const cause = err.cause;
+  const withCode = cause instanceof Error ? cause : err;
+  return withCode.code;
+}
+function isUnknownIssuerError(err) {
+  const code = tlsErrorCode(err);
+  return !!code && UNKNOWN_ISSUER_CODES.has(code);
+}
+function rethrowWithIssuerHint(err, url) {
+  if (isUnknownIssuerError(err)) {
+    const hinted = new Error(
+      `Could not verify the certificate presented for ${url} \u2014 its issuer is not trusted (${tlsErrorCode(err)}). This is the typical signature of a company network that inspects HTTPS traffic with its own root certificate: trust it with \`suveren-gateway config set ca-file <path-to-company-root.pem>\` (or --ca-file / NODE_EXTRA_CA_CERTS), then try again. Original error: ${describeFetchError(err)}`
+    );
+    hinted.cause = err;
+    throw hinted;
+  }
+  throw err;
+}
 function closeAfter(dispatcher, pending) {
   pending.catch(() => {
   }).finally(() => {
@@ -339,8 +637,24 @@ function closeAfter(dispatcher, pending) {
 }
 async function fetchAs(url, init, pinning) {
   if (!pinning.enforce && !pinning.capture) {
-    const res2 = await fetch(url, withBoundedSignal(init));
-    return { res: res2 };
+    const proxyUrl = selectProxyUrl(url);
+    if (!proxyUrl) {
+      try {
+        const res2 = await fetch(url, withBoundedSignal(init));
+        return { res: res2 };
+      } catch (err) {
+        rethrowWithIssuerHint(err, url);
+      }
+    }
+    const dispatcher2 = new ProxyAgent({ uri: proxyUrl, requestTls: { ca: effectiveCa() } });
+    const pending2 = undiciFetch(url, { ...withBoundedSignal(init), dispatcher: dispatcher2 });
+    closeAfter(dispatcher2, pending2);
+    try {
+      const res2 = await pending2;
+      return { res: res2 };
+    } catch (err) {
+      rethrowWithIssuerHint(err, url);
+    }
   }
   if (pinning.enforce && !pinning.capture && !pinning.pinnedSpkiHex) {
     throw new AsTlsMismatchError(
@@ -348,27 +662,27 @@ async function fetchAs(url, init, pinning) {
     );
   }
   if (pinning.pinnedSpkiHex && (pinning.enforce || !pinning.capture)) {
-    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex);
+    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex, url);
     const pending2 = undiciFetch(url, { ...withBoundedSignal(init), dispatcher: dispatcher2 });
     closeAfter(dispatcher2, pending2);
     try {
       const res2 = await pending2;
       return { res: res2 };
     } catch (err) {
-      if (!isPinCheckError(err)) throw err;
+      if (!isPinCheckError(err)) rethrowWithIssuerHint(err, url);
       throw new AsTlsMismatchError(
-        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. If the Authority Server's certificate changed intentionally (a new key, not just renewal), an operator must clear the pairing and sign in again to re-pin it.`
+        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. Two things produce this: (1) the Authority Server's TLS certificate genuinely changed (a new signing key, not just a renewal) \u2014 clear the pairing and sign in again to re-pin it; or (2) a TLS-inspecting proxy on this network is re-signing traffic with its own certificate \u2014 ask network/IT to exempt the Authority Server's host from TLS inspection (pin-tls refusing this, even with a trusted --ca-file, is working as intended).`
       );
     }
   }
-  const { dispatcher, getCapturedCert } = buildCapturingDispatcher();
+  const { dispatcher, getCapturedCert } = buildCapturingDispatcher(url);
   const pending = undiciFetch(url, { ...withBoundedSignal(init), dispatcher });
   closeAfter(dispatcher, pending);
   let res;
   try {
     res = await pending;
   } catch (err) {
-    if (!isPinCheckError(err)) throw err;
+    if (!isPinCheckError(err)) rethrowWithIssuerHint(err, url);
     throw new AsTlsMismatchError(
       `could not verify the Authority Server at ${url} while establishing its TLS pin \u2014 ${describeFetchError(err)}.`
     );
@@ -834,11 +1148,11 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync5, unlinkSync as unlinkSync2 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join4(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join5(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
@@ -856,11 +1170,11 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync4(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync4(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
           unlinkSync2(this.plaintextFilePath);
         } catch {
@@ -898,11 +1212,11 @@ var GateStore = class {
   clearAll() {
     this.entries = /* @__PURE__ */ new Map();
     try {
-      if (existsSync4(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
+      if (existsSync5(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
     } catch {
     }
     try {
-      if (existsSync4(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
+      if (existsSync5(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
     } catch {
     }
   }
@@ -935,19 +1249,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join4(this.baseDir, "gates.json");
+    return join5(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join4(this.baseDir, "gates.enc.json");
+    return join5(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync4(this.plaintextFilePath)) {
+    if (!existsSync5(this.plaintextFilePath)) {
       mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -956,9 +1270,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync4(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -999,11 +1313,11 @@ var GateStore = class {
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join6(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -1022,11 +1336,11 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync5(this.encryptedFilePath)) {
+    if (existsSync6(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync5(this.plaintextFilePath)) {
+      if (existsSync6(this.plaintextFilePath)) {
         try {
           unlinkSync3(this.plaintextFilePath);
         } catch {
@@ -1130,19 +1444,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join5(this.baseDir, "execution-log.json");
+    return join6(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join5(this.baseDir, "execution-log.enc.json");
+    return join6(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync5(this.plaintextFilePath)) {
+    if (!existsSync6(this.plaintextFilePath)) {
       mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync7(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -1152,9 +1466,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync5(this.encryptedFilePath)) return;
+    if (!existsSync6(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync7(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -1201,11 +1515,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync6, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync7, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join6 } from "path";
+import { dirname as dirname5, join as join7 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join7(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -1218,11 +1532,11 @@ var DenialLog = class {
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync6(this.encryptedFilePath)) {
+    if (existsSync7(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync6(this.plaintextFilePath)) {
+      if (existsSync7(this.plaintextFilePath)) {
         try {
           unlinkSync4(this.plaintextFilePath);
         } catch {
@@ -1272,18 +1586,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join6(this.baseDir, "denials.json");
+    return join7(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join6(this.baseDir, "denials.enc.json");
+    return join7(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync6(this.plaintextFilePath)) {
+    if (!existsSync7(this.plaintextFilePath)) {
       mkdirSync5(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync7(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync8(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -1291,9 +1605,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync6(this.encryptedFilePath)) return;
+    if (!existsSync7(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync7(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync8(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -1319,11 +1633,11 @@ var DenialLog = class {
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, unlinkSync as unlinkSync5 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync8, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname6, join as join7 } from "path";
+import { dirname as dirname6, join as join8 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join8(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -1348,11 +1662,11 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync7(this.encryptedFilePath)) {
+    if (existsSync8(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync7(this.plaintextFilePath)) {
+      if (existsSync8(this.plaintextFilePath)) {
         try {
           unlinkSync5(this.plaintextFilePath);
         } catch {
@@ -1366,7 +1680,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync7(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync8(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -1467,19 +1781,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join7(this.baseDir, "receipt-archive.json");
+    return join8(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join7(this.baseDir, "receipt-archive.enc.json");
+    return join8(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync7(this.plaintextFilePath)) {
+    if (!existsSync8(this.plaintextFilePath)) {
       mkdirSync6(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync8(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync9(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1491,16 +1805,16 @@ var ReceiptArchive = class {
       try {
         writeFileSync6(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync8(this.plaintextFilePath)
+          readFileSync9(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync7(this.encryptedFilePath)) return;
+    if (!existsSync8(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync8(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync9(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1514,7 +1828,7 @@ var ReceiptArchive = class {
       try {
         writeFileSync6(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync8(this.encryptedFilePath)
+          readFileSync9(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1542,11 +1856,11 @@ var ReceiptArchive = class {
 };
 
 // src/lib/execution-journal.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7, existsSync as existsSync8, renameSync } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7, existsSync as existsSync9, renameSync } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname7, join as join8 } from "path";
+import { dirname as dirname7, join as join9 } from "path";
 import { createHash as createHash3 } from "crypto";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join9(homedir5(), ".suveren");
 var FILE_NAME = "execution-journal.json";
 var MAX_AGE_SECONDS2 = 90 * 24 * 60 * 60;
 function hashToolArgs(args) {
@@ -1563,7 +1877,7 @@ var ExecutionJournal = class {
   filePath;
   constructor(filePath) {
     const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR5;
-    this.filePath = join8(baseDir, FILE_NAME);
+    this.filePath = join9(baseDir, FILE_NAME);
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
@@ -1602,9 +1916,9 @@ var ExecutionJournal = class {
   }
   // ─── Persistence ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync8(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync9(this.filePath, "utf8"));
+      const parsed = JSON.parse(readFileSync10(this.filePath, "utf8"));
       if (parsed?.version !== 1 || !Array.isArray(parsed.entries)) {
         throw new Error("unexpected shape");
       }
@@ -1629,10 +1943,10 @@ function nowSec() {
 }
 
 // src/lib/proposal-submission-store.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync9, renameSync as renameSync2 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync10, renameSync as renameSync2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname8, join as join9 } from "path";
-var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
+import { dirname as dirname8, join as join10 } from "path";
+var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join10(homedir6(), ".suveren");
 var FILE_NAME2 = "proposal-submissions.json";
 var MAX_AGE_SECONDS3 = 90 * 24 * 60 * 60;
 function nowSec2() {
@@ -1642,7 +1956,7 @@ var ProposalSubmissionStore = class {
   filePath;
   constructor(filePath) {
     const baseDir = filePath && filePath.endsWith(".json") ? dirname8(filePath) : filePath ?? DEFAULT_DIR6;
-    this.filePath = join9(baseDir, FILE_NAME2);
+    this.filePath = join10(baseDir, FILE_NAME2);
   }
   /** Record what was submitted, right after a successful submitProposal(). */
   record(entry) {
@@ -1665,9 +1979,9 @@ var ProposalSubmissionStore = class {
     return this.load().entries.find((e) => e.proposalId === proposalId);
   }
   load() {
-    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync10(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync10(this.filePath, "utf-8"));
+      const parsed = JSON.parse(readFileSync11(this.filePath, "utf-8"));
       const cutoff = nowSec2() - MAX_AGE_SECONDS3;
       parsed.entries = (parsed.entries ?? []).filter((e) => e.submittedAt >= cutoff);
       return parsed;
@@ -1956,17 +2270,17 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync12, existsSync as existsSync11 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
-var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join10(homedir7(), ".suveren");
+import { join as join11 } from "path";
+var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir2) {
   const dir = dataDir2 ?? DEFAULT_DIR7;
-  const filePath = join10(dir, "context.md");
-  if (!existsSync10(filePath)) return null;
+  const filePath = join11(dir, "context.md");
+  if (!existsSync11(filePath)) return null;
   try {
-    const content = readFileSync11(filePath, "utf-8").trim();
+    const content = readFileSync12(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -2605,30 +2919,49 @@ import { extname } from "path";
 import { randomUUID } from "crypto";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync12, existsSync as existsSync11 } from "fs";
-import { join as join11, resolve } from "path";
+import { readFileSync as readFileSync13, existsSync as existsSync12 } from "fs";
+import { join as join12, resolve } from "path";
+var EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+function isExactSemver(value) {
+  return typeof value === "string" && EXACT_SEMVER_RE.test(value);
+}
+function invalidNpmPinReason(manifest) {
+  if (!manifest.npmPackage) return null;
+  if (manifest.npmVersion === void 0) {
+    return `npmPackage "${manifest.npmPackage}" is set but npmVersion is missing \u2014 every connector manifest must pin an exact tested version`;
+  }
+  if (!isExactSemver(manifest.npmVersion)) {
+    return `npmVersion ${JSON.stringify(manifest.npmVersion)} for "${manifest.npmPackage}" is not an exact semver (e.g. "1.2.3") \u2014 ranges, dist-tags like "latest", git specs, URLs, and file paths are not allowed`;
+  }
+  return null;
+}
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join11(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join12(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join11(dir, "index.json");
-  if (!existsSync11(indexPath)) {
+  const indexPath = join12(dir, "index.json");
+  if (!existsSync12(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync12(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync13(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join11(dir, relativePath);
+    const manifestPath = join12(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync12(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync13(manifestPath, "utf-8"));
+      const pinReason = invalidNpmPinReason(manifest);
+      if (pinReason) {
+        console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${pinReason}`);
+        continue;
+      }
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -2647,6 +2980,8 @@ function getAllManifests() {
 
 // src/lib/simulation-mode.ts
 function isSimulationMode() {
+  const policySimulation = readPolicy().policy.simulation;
+  if (policySimulation !== void 0) return policySimulation;
   return process.env.SUVEREN_SIMULATION === "1";
 }
 function manifestIsSimulated(manifest) {
@@ -4176,16 +4511,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync12 } from "fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname9, join as join12 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join12(homedir8(), ".suveren");
+import { dirname as dirname9, join as join13 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join13(homedir8(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir2) {
     const dir = dataDir2 ?? DEFAULT_DATA_DIR;
-    this.filePath = join12(dir, "integrations.json");
+    this.filePath = join13(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -4216,12 +4551,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync12(this.filePath)) {
+    if (!existsSync13(this.filePath)) {
       mkdirSync9(dirname9(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync13(this.filePath, "utf-8");
+      const raw = readFileSync14(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -4257,8 +4592,8 @@ var IntegrationRegistry = class {
 
 // src/lib/integration-manager.ts
 import { homedir as homedir9 } from "os";
-import { join as join13, delimiter } from "path";
-import { existsSync as existsSync13, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync } from "fs";
+import { join as join14, delimiter } from "path";
+import { existsSync as existsSync14, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync15, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -4335,25 +4670,26 @@ function safeHost(url) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join13(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join14(homedir9(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join14(DEFAULT_DATA_DIR2, "integrations");
+var OFFLINE_MODE = process.env.SUVEREN_OFFLINE === "1";
 var installLock = Promise.resolve();
 function withInstallLock(task) {
   const run = installLock.then(task, task);
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join13(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join14(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync13(INTEGRATIONS_DIR)) {
+  if (!existsSync14(INTEGRATIONS_DIR)) {
     mkdirSync10(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join13(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync13(pkgPath)) {
+  const pkgPath = join14(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync14(pkgPath)) {
     writeFileSync10(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
@@ -4383,6 +4719,17 @@ var IntegrationManager = class {
   }
   running = /* @__PURE__ */ new Map();
   onToolsChanged = null;
+  /**
+   * Called when a persisted config was migrated to the manifest's command/args
+   * (see `migrateNpxConfig`) so the caller can write the fix back to
+   * `integrations.json` — the manager itself has no registry/persistence
+   * handle, by design (mirrors `onToolsChanged`). Without a subscriber the
+   * migration still takes effect for THIS start (the in-memory config is
+   * still corrected before spawn); only the one-time persistence is skipped,
+   * so every later start keeps re-migrating in memory, which is safe, if
+   * redundant.
+   */
+  onConfigMigrated = null;
   /**
    * Per-integration operation queue. Start/stop for one id are serialized
    * through here; without it, a second start issued while the first is still
@@ -4408,6 +4755,16 @@ var IntegrationManager = class {
   setOnToolsChanged(cb) {
     this.onToolsChanged = cb;
   }
+  /**
+   * Register a callback invoked when a persisted config is migrated off a
+   * stale `npx` command to the current manifest's command/args (see
+   * `migrateNpxConfig`). The caller is expected to persist `updates` against
+   * `id` in `integrations.json` so the fix survives the next boot instead of
+   * silently reapplying on every start.
+   */
+  setOnConfigMigrated(cb) {
+    this.onConfigMigrated = cb;
+  }
   /**
    * Is `npmPackage` present AND usable?
    *
@@ -4420,24 +4777,41 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join13(pkgDir, "package.json");
-    if (!existsSync13(pkgDir) || !existsSync13(pkgJson)) return false;
+    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join14(pkgDir, "package.json");
+    if (!existsSync14(pkgDir) || !existsSync14(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync14(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync13(join13(pkgDir, target))) return false;
+        if (!existsSync14(join14(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync13(join13(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync14(join14(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
     }
   }
+  /**
+   * The installed version of `npmPackage`, or null if it isn't usably
+   * installed at all (see `isUsableInstall`) or its package.json has no
+   * parseable `version`. Never throws — an unreadable version is treated the
+   * same as "not installed", which is the safe direction: it drives a
+   * (re)install rather than a false "already pinned".
+   */
+  readInstalledVersion(npmPackage) {
+    if (!this.isUsableInstall(npmPackage)) return null;
+    const pkgJson = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
+    try {
+      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
+      return typeof pkg.version === "string" ? pkg.version : null;
+    } catch {
+      return null;
+    }
+  }
   /**
    * Does the node_modules/.bin shim for `binName` exist? On Windows npm writes
    * `<name>`, `<name>.cmd`, and `<name>.ps1`; the .cmd variant is what actually
@@ -4446,11 +4820,34 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync13(join13(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync14(join14(INTEGRATIONS_BIN, c)));
+  }
+  /**
+   * The exact version THIS gateway's CURRENTLY LOADED manifest pins
+   * `config.npmPackage` to — or undefined when there's no npmPackage, no
+   * manifest for this id, or the manifest's `npmPackage` no longer names the
+   * same package as `config` (a manually re-pointed integration: nothing in
+   * the manifest vouches for a version of config's actual package).
+   *
+   * Read fresh from `getManifest(config.id)` on every call, never from
+   * anything persisted on `config` itself — manifests are reloaded fresh on
+   * every boot, `integrations.json` is not, so this is what keeps the pin
+   * from going stale the day after an integration was first activated. Used
+   * both to decide the npm install/update (`ensureInstalled`) and to decide
+   * whether a persisted `npx …` command must be refused/migrated
+   * (`migrateNpxConfig`) — one definition of "pinned", so the two can't
+   * disagree about which connectors it applies to.
+   */
+  pinnedVersionFor(config) {
+    if (!config.npmPackage) return void 0;
+    const manifest = getManifest(config.id);
+    return manifest?.npmPackage === config.npmPackage ? manifest.npmVersion : void 0;
   }
   /**
    * Install an npm package into the managed integrations directory if not
-   * already present. Called automatically before spawning when
+   * already present, and — when `config`'s manifest pins an exact
+   * `npmVersion` for this same package — bring the installed copy to EXACTLY
+   * that version, older or newer. Called automatically before spawning when
    * config.npmPackage is set.
    *
    * Asynchronous ON PURPOSE. This used to be execSync, which blocked the MCP
@@ -4460,19 +4857,62 @@ var IntegrationManager = class {
    * CI runners: ~3.6s (Linux), ~5.4s (macOS), ~14s (Windows), and far worse
    * on machines with real-time antivirus.
    */
-  async ensureInstalled(npmPackage) {
+  async ensureInstalled(config) {
+    const npmPackage = config.npmPackage;
+    if (!npmPackage) return;
     ensureIntegrationsDir();
+    const pinnedVersion = this.pinnedVersionFor(config);
+    if (OFFLINE_MODE) {
+      const current = this.readInstalledVersion(npmPackage);
+      if (pinnedVersion) {
+        if (current === pinnedVersion) return;
+        throw new Error(
+          `${config.id}: connector ${npmPackage} version ${pinnedVersion} is not part of this installation (found ${current ?? "nothing installed"} at ${INTEGRATIONS_DIR}; SUVEREN_OFFLINE=1 so no npm install was attempted).`
+        );
+      }
+      if (current !== null) return;
+      throw new Error(
+        `${config.id}: connector ${npmPackage} is not part of this installation (nothing installed at ${INTEGRATIONS_DIR}; SUVEREN_OFFLINE=1 so no npm install was attempted).`
+      );
+    }
+    if (pinnedVersion) {
+      if (this.readInstalledVersion(npmPackage) === pinnedVersion) return;
+      return withInstallLock(async () => {
+        const current = this.readInstalledVersion(npmPackage);
+        if (current === pinnedVersion) return;
+        console.error(
+          `[IntegrationManager] ${npmPackage} ${current ?? "(not installed)"} \u2192 ${pinnedVersion} (pinned by manifest)`
+        );
+        const cleanFirst = !this.isUsableInstall(npmPackage);
+        await this.installNow(npmPackage, pinnedVersion, cleanFirst);
+      });
+    }
     if (this.isUsableInstall(npmPackage)) return;
     return withInstallLock(async () => {
       if (this.isUsableInstall(npmPackage)) return;
       await this.installNow(npmPackage);
     });
   }
-  /** The actual install. Callers MUST hold the install lock. */
-  async installNow(npmPackage) {
-    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync13(pkgDir)) {
-      console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
+  /**
+   * The actual install. Callers MUST hold the install lock.
+   *
+   * `exactVersion`, when given, is a pin already validated as an exact semver
+   * by the manifest loader (`isExactSemver`) — re-validated here anyway
+   * because this method does not trust its caller's caller, and because the
+   * version reaches a shell on Windows (see the package-name check below).
+   *
+   * `cleanFirst` (default true, i.e. today's behaviour for every caller
+   * except a version-only pin correction): wipe any existing package
+   * directory before installing. Needed for a genuinely broken/partial
+   * install, where stale files can make the reinstall itself fail; skipped
+   * for a USABLE install being corrected to a different pinned version, so a
+   * failed update leaves the previously-working version on disk instead of
+   * nothing at all.
+   */
+  async installNow(npmPackage, exactVersion, cleanFirst = true) {
+    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (cleanFirst && existsSync14(pkgDir)) {
+      console.error(`[IntegrationManager] Removing ${exactVersion ? "outdated" : "unusable"} install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
       } catch (err) {
@@ -4482,18 +4922,22 @@ var IntegrationManager = class {
     if (!/^(@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*$/i.test(npmPackage)) {
       throw new Error(`Refusing to install unsafe package name: ${JSON.stringify(npmPackage)}`);
     }
-    console.error(`[IntegrationManager] Installing ${npmPackage}...`);
+    if (exactVersion !== void 0 && !isExactSemver(exactVersion)) {
+      throw new Error(`Refusing to install ${npmPackage} at unsafe/non-exact version spec: ${JSON.stringify(exactVersion)}`);
+    }
+    const spec = exactVersion ? `${npmPackage}@${exactVersion}` : npmPackage;
+    console.error(`[IntegrationManager] Installing ${spec}...`);
     const startedAt = Date.now();
     const isWin = process.platform === "win32";
     await new Promise((resolve3, reject) => {
       const child = execFile(
         "npm",
-        ["install", "--no-fund", "--no-audit", npmPackage],
+        ["install", "--no-fund", "--no-audit", spec],
         {
           cwd: INTEGRATIONS_DIR,
           // Windows: a shell so cmd.exe finds npm.cmd (see EINVAL note above).
           // POSIX: no shell — npm is a normal executable and keeping shell off
-          // means the validated package name is still passed as a bare argv.
+          // means the validated package spec is still passed as a bare argv.
           shell: isWin,
           // No timeout: a slow install on a machine with antivirus is not an
           // error, and killing it midway is what created broken installs in
@@ -4503,20 +4947,28 @@ var IntegrationManager = class {
         },
         (err, _stdout, stderr) => {
           if (err) {
-            reject(new Error(`Failed to install ${npmPackage}: ${err.message}${stderr ? ` \u2014 ${stderr.trim()}` : ""}`));
+            reject(new Error(`Failed to install ${spec}: ${err.message}${stderr ? ` \u2014 ${stderr.trim()}` : ""}`));
             return;
           }
           resolve3();
         }
       );
-      child.on("error", (err) => reject(new Error(`Failed to run npm for ${npmPackage}: ${err.message}`)));
+      child.on("error", (err) => reject(new Error(`Failed to run npm for ${spec}: ${err.message}`)));
     });
     if (!this.isUsableInstall(npmPackage)) {
       throw new Error(
-        `Installed ${npmPackage} but it is not usable \u2014 package.json or its bin target is missing. Check ${INTEGRATIONS_DIR} for a partial install.`
+        `Installed ${spec} but it is not usable \u2014 package.json or its bin target is missing. Check ${INTEGRATIONS_DIR} for a partial install.`
       );
     }
-    console.error(`[IntegrationManager] Installed ${npmPackage} (${((Date.now() - startedAt) / 1e3).toFixed(1)}s)`);
+    if (exactVersion !== void 0) {
+      const installed = this.readInstalledVersion(npmPackage);
+      if (installed !== exactVersion) {
+        throw new Error(
+          `Installed ${npmPackage} but got version ${installed ?? "unknown"}, expected the pinned ${exactVersion}.`
+        );
+      }
+    }
+    console.error(`[IntegrationManager] Installed ${spec} (${((Date.now() - startedAt) / 1e3).toFixed(1)}s)`);
   }
   /**
    * Connect a client to its transport, but never wait indefinitely. Resolves
@@ -4575,7 +5027,26 @@ var IntegrationManager = class {
       throw new Error(`${config.id}: ${SIMULATION_BLOCK_REASON}`);
     }
     if (config.npmPackage) {
-      await this.ensureInstalled(config.npmPackage);
+      await this.ensureInstalled(config);
+    }
+    const pinnedVersion = this.pinnedVersionFor(config);
+    if (pinnedVersion && config.command === "npx") {
+      const manifest = getManifest(config.id);
+      const migrated = {
+        command: manifest.mcp.command,
+        args: manifest.mcp.args,
+        env: manifest.mcp.env ?? config.env
+      };
+      console.error(
+        `[IntegrationManager] ${config.id}: command migrated to manifest (was npx ${config.args.join(" ")})`
+      );
+      config = { ...config, ...migrated };
+      this.onConfigMigrated?.(config.id, migrated);
+    }
+    if (pinnedVersion && config.command === "npx") {
+      throw new Error(
+        `${config.id}: refusing to spawn a pinned connector ("${config.npmPackage}"@${pinnedVersion}) via npx \u2014 this would ignore the pinned local install and fetch the package fresh on every start. The manifest's mcp.command must name the installed binary, not "npx".`
+      );
     }
     const env = this.resolveEnvKeys(config);
     if (isSimulationMode()) {
@@ -4929,28 +5400,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
-import { join as join14, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
+import { join as join15, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join14(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join14(dir, "index.json");
-  if (!existsSync14(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join15(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join15(dir, "index.json");
+  if (!existsSync15(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync15(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync16(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join14(dir, relativePath);
+    const profilePath = join15(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync15(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync16(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -4986,8 +5457,8 @@ function warnNoProfiles(reason) {
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync16, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname10, join as join15 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync17, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname10, join as join16 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -5015,7 +5486,7 @@ var ExecutorLock = class {
   path;
   held = false;
   constructor(dataDir2) {
-    this.path = join15(dataDir2, "executor.lock");
+    this.path = join16(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -5047,9 +5518,9 @@ var ExecutorLock = class {
     }
   }
   read() {
-    if (!existsSync15(this.path)) return null;
+    if (!existsSync16(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync16(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync17(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -5067,19 +5538,19 @@ function isAlive(pid) {
 
 // bin/http.ts
 import { homedir as homedir10 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/lib/mcp-as-tracker.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname11, join as join16 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11, join as join17 } from "path";
 function trackerPath(dataDir2) {
-  return join16(dataDir2, "mcp-as-pairing.json");
+  return join17(dataDir2, "mcp-as-pairing.json");
 }
 function readMcpPairedAsUrl(dataDir2) {
   const path = trackerPath(dataDir2);
-  if (!existsSync16(path)) return null;
+  if (!existsSync17(path)) return null;
   try {
-    const data = JSON.parse(readFileSync17(path, "utf-8"));
+    const data = JSON.parse(readFileSync18(path, "utf-8"));
     return typeof data.asUrl === "string" ? data.asUrl : null;
   } catch {
     return null;
@@ -5092,7 +5563,7 @@ function writeMcpPairedAsUrl(dataDir2, asUrl) {
 }
 
 // bin/http.ts
-var dataDir = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join18(homedir10(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
 validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
@@ -5129,6 +5600,10 @@ function refreshAllSessions() {
 integrationManager.setOnToolsChanged(() => {
   refreshAllSessions();
 });
+integrationManager.setOnConfigMigrated((id, updates) => {
+  integrationRegistry.update(id, updates);
+  console.error(`[Suveren MCP] ${id}: persisted config migrated (${Object.keys(updates).join(", ")})`);
+});
 var app = express();
 app.use(express.json());
 app.use((_req, res, next) => {
@@ -5615,7 +6090,7 @@ app.listen(port, "0.0.0.0", () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join18(homedir10(), ".suveren");
   const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {