@suveren/gateway 0.12.0 → 0.13.0

package/dist/mcp-server/http.mjs

@@ -142,18 +142,237 @@ function fingerprintOf(publicKeyHex) {
 }
 
 // src/lib/as-config.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
+
+// src/lib/policy.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+import { spawnSync } from "child_process";
+var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
+var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
+function registryKeyPath(hive) {
+  const baseKey = process.env.SUVEREN_POLICY_REGISTRY_KEY || DEFAULT_REGISTRY_BASE_KEY;
+  return `${hive}\\${baseKey}`;
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function validateCaFile(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The CA file path is empty." };
+  if (!existsSync3(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
+  return { ok: true, path: trimmed };
+}
+function validateProxyUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The proxy URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { ok: false, error: `"${trimmed}" must use http:// or https://.` };
+  }
+  return { ok: true, url: trimmed };
+}
+function coerceBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (value === 0) return false;
+    if (value === 1) return true;
+    return void 0;
+  }
+  if (typeof value === "string") {
+    const v = value.trim().toLowerCase();
+    if (v === "true" || v === "1") return true;
+    if (v === "false" || v === "0") return false;
+  }
+  return void 0;
+}
+function parseRegQueryOutput(stdout) {
+  const out = {};
+  const lineRe = /^ {4}(\S+)\s+(REG_SZ|REG_EXPAND_SZ|REG_DWORD|REG_QWORD|REG_BINARY|REG_MULTI_SZ)\s+(.*)$/;
+  for (const line of stdout.split(/\r?\n/)) {
+    const m = lineRe.exec(line);
+    if (!m) continue;
+    const [, name, type, rawValue] = m;
+    if (!POLICY_KEYS.includes(name)) continue;
+    const key = name;
+    if (type === "REG_DWORD" || type === "REG_QWORD") {
+      out[key] = parseInt(rawValue, 16);
+    } else {
+      out[key] = rawValue;
+    }
+  }
+  return out;
+}
+function readRegistryHive(hive) {
+  const path = registryKeyPath(hive);
+  const source = `the registry policy (${path})`;
+  if (process.env.SUVEREN_POLICY_REGISTRY === "off") return { values: {}, source };
+  if (process.platform !== "win32") return { values: {}, source };
+  let result;
+  try {
+    result = spawnSync("reg", ["query", path], { encoding: "utf8" });
+  } catch {
+    return { values: {}, source };
+  }
+  if (!result || result.status !== 0 || !result.stdout) return { values: {}, source };
+  return { values: parseRegQueryOutput(result.stdout), source };
+}
+function policyFilePath() {
+  if (process.env.SUVEREN_POLICY_FILE) return process.env.SUVEREN_POLICY_FILE;
+  if (process.platform === "win32") {
+    const programData = process.env.ProgramData || process.env.PROGRAMDATA || "C:\\ProgramData";
+    return join3(programData, "Suveren", "gateway-policy.json");
+  }
+  if (process.platform === "darwin") {
+    return "/Library/Application Support/Suveren/gateway-policy.json";
+  }
+  return "/etc/suveren/gateway-policy.json";
+}
+function readPolicyFile() {
+  const path = policyFilePath();
+  const source = `the policy file (${path})`;
+  if (!existsSync3(path)) return { values: {}, source };
+  let data;
+  try {
+    data = JSON.parse(readFileSync3(path, "utf8"));
+  } catch (err) {
+    throw new Error(`Could not parse policy file ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const values = {};
+  for (const key of POLICY_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(data, key)) {
+      values[key] = data[key];
+    }
+  }
+  return { values, source };
+}
+function mergeBySource(entries) {
+  const merged = {};
+  const sourceOf = {};
+  for (const key of POLICY_KEYS) {
+    for (const entry of entries) {
+      if (Object.prototype.hasOwnProperty.call(entry.values, key) && entry.values[key] !== void 0) {
+        merged[key] = entry.values[key];
+        sourceOf[key] = entry.source;
+        break;
+      }
+    }
+  }
+  return { merged, sourceOf };
+}
+var cached = null;
+function readPolicy() {
+  if (cached) return cached;
+  const hklm = readRegistryHive("HKLM");
+  const hkcu = readRegistryHive("HKCU");
+  const file = readPolicyFile();
+  const { merged, sourceOf } = mergeBySource([hklm, hkcu, file]);
+  const policy = {};
+  const locked = /* @__PURE__ */ new Set();
+  if (merged.AsUrl !== void 0) {
+    const v = validateAsUrl(String(merged.AsUrl));
+    if (!v.ok) {
+      throw new Error(`Invalid policy AsUrl ("${merged.AsUrl}") from ${sourceOf.AsUrl}: ${v.error}`);
+    }
+    policy.asUrl = v.url;
+    locked.add("asUrl");
+  }
+  if (merged.CaFile !== void 0) {
+    const v = validateCaFile(String(merged.CaFile));
+    if (!v.ok) {
+      throw new Error(`Invalid policy CaFile ("${merged.CaFile}") from ${sourceOf.CaFile}: ${v.error}`);
+    }
+    policy.caFile = v.path;
+    locked.add("caFile");
+  }
+  if (merged.PinTls !== void 0) {
+    const b = coerceBoolean(merged.PinTls);
+    if (b === void 0) {
+      throw new Error(
+        `Invalid policy PinTls ("${String(merged.PinTls)}") from ${sourceOf.PinTls}: must be a boolean or 0/1.`
+      );
+    }
+    policy.pinTls = b;
+    locked.add("pinTls");
+  }
+  if (merged.Proxy !== void 0) {
+    const v = validateProxyUrl(String(merged.Proxy));
+    if (!v.ok) {
+      throw new Error(`Invalid policy Proxy ("${String(merged.Proxy)}") from ${sourceOf.Proxy}: ${v.error}`);
+    }
+    policy.proxy = v.url;
+    locked.add("proxy");
+  }
+  if (merged.NoProxy !== void 0) {
+    const raw = String(merged.NoProxy).trim();
+    if (!raw) {
+      throw new Error(`Invalid policy NoProxy ("${String(merged.NoProxy)}") from ${sourceOf.NoProxy}: must not be empty.`);
+    }
+    policy.noProxy = raw;
+    locked.add("noProxy");
+  }
+  if (merged.Simulation !== void 0) {
+    const b = coerceBoolean(merged.Simulation);
+    if (b === void 0) {
+      throw new Error(
+        `Invalid policy Simulation ("${String(merged.Simulation)}") from ${sourceOf.Simulation}: must be a boolean or 0/1.`
+      );
+    }
+    policy.simulation = b;
+    locked.add("simulation");
+  }
+  if (merged.InstallMethod !== void 0) {
+    const raw = String(merged.InstallMethod).trim().toLowerCase();
+    if (raw !== "managed") {
+      throw new Error(
+        `Invalid policy InstallMethod ("${String(merged.InstallMethod)}") from ${sourceOf.InstallMethod}: only "managed" is supported.`
+      );
+    }
+    policy.installMethod = "managed";
+    locked.add("installMethod");
+  }
+  cached = { policy, locked };
+  return cached;
+}
+
+// src/lib/as-config.ts
 var DEFAULT_AS_URL = "https://www.suveren.ai";
 function configPath(dataDir2) {
-  return join3(dataDir2, "config.json");
+  return join4(dataDir2, "config.json");
 }
 function readAsConfigStrict(dataDir2) {
   const path = configPath(dataDir2);
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   let data;
   try {
-    data = JSON.parse(readFileSync3(path, "utf-8"));
+    data = JSON.parse(readFileSync4(path, "utf-8"));
   } catch (err) {
     throw new Error(
       `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -168,9 +387,9 @@ function readAsConfigStrict(dataDir2) {
 }
 function readAsConfig(dataDir2) {
   const path = configPath(dataDir2);
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
-    const data = JSON.parse(readFileSync3(path, "utf-8"));
+    const data = JSON.parse(readFileSync4(path, "utf-8"));
     const out = {};
     if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
     if (typeof data.caFile === "string") out.caFile = data.caFile;
@@ -181,7 +400,7 @@ function readAsConfig(dataDir2) {
     return {};
   }
 }
-function validateAsUrl(candidate) {
+function validateAsUrl2(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
   let parsed;
@@ -206,26 +425,30 @@ function validateAsUrl(candidate) {
   return { ok: true, url: normalized };
 }
 function resolveAsUrl(dataDir2, flag) {
+  const policyUrl = readPolicy().policy.asUrl;
+  if (policyUrl) return policyUrl;
   if (flag) {
-    const v = validateAsUrl(flag);
+    const v = validateAsUrl2(flag);
     if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
     return v.url;
   }
   const envUrl = process.env.SUVEREN_AS_URL;
   if (envUrl) {
-    const v = validateAsUrl(envUrl);
+    const v = validateAsUrl2(envUrl);
     if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
     return v.url;
   }
   const saved = readAsConfigStrict(dataDir2).asUrl;
   if (saved) {
-    const v = validateAsUrl(saved);
+    const v = validateAsUrl2(saved);
     if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir2}/config.json: ${v.error}`);
     return v.url;
   }
   return DEFAULT_AS_URL;
 }
 function resolvePinTls(dataDir2) {
+  const policyPinTls = readPolicy().policy.pinTls;
+  if (policyPinTls !== void 0) return policyPinTls;
   return readAsConfig(dataDir2).pinTls === true;
 }
 function validatePinTlsForUrl(pinTls, asUrl) {
@@ -240,14 +463,58 @@ function validatePinTlsForUrl(pinTls, asUrl) {
 // src/lib/as-tls-pin.ts
 import { createHash as createHash2 } from "crypto";
 import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
+import { Agent as HttpsAgent2 } from "https";
+import { readFileSync as readFileSync5 } from "fs";
+import { Agent, ProxyAgent, fetch as undiciFetch } from "undici";
+
+// src/lib/proxy-env.ts
+function isLoopbackHostname(hostname) {
+  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (h === "localhost") return true;
+  if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
+  return /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.test(h);
+}
+function readProxyEnv() {
+  const http = process.env.http_proxy || process.env.HTTP_PROXY || void 0;
+  const https = process.env.https_proxy || process.env.HTTPS_PROXY || void 0;
+  const noProxy = process.env.no_proxy ?? process.env.NO_PROXY ?? "";
+  return { http, https, noProxy };
+}
+function matchesNoProxy(hostname, port2, noProxy) {
+  const entries = noProxy.split(/[,\s]+/).filter(Boolean);
+  if (entries.length === 0) return false;
+  if (entries.includes("*")) return true;
+  const h = hostname.toLowerCase();
+  for (const raw of entries) {
+    const m = raw.match(/^(.+):(\d+)$/);
+    const entryHost = (m ? m[1] : raw).replace(/^\*?\./, "").toLowerCase();
+    const entryPort = m ? Number(m[2]) : 0;
+    if (entryPort && entryPort !== port2) continue;
+    if (h === entryHost || h.endsWith(`.${entryHost}`)) return true;
+  }
+  return false;
+}
+function selectProxyUrl(targetUrl) {
+  const url = typeof targetUrl === "string" ? new URL(targetUrl) : targetUrl;
+  if (isLoopbackHostname(url.hostname)) return void 0;
+  const { http, https, noProxy } = readProxyEnv();
+  const port2 = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+  if (matchesNoProxy(url.hostname, port2, noProxy)) return void 0;
+  return url.protocol === "https:" ? https ?? http : http;
+}
+
+// src/lib/proxy-https-agent.ts
 import { Agent as HttpsAgent } from "https";
-import { readFileSync as readFileSync4 } from "fs";
-import { Agent, fetch as undiciFetch } from "undici";
+import { connect as netConnect } from "net";
+import { connect as tlsConnect } from "tls";
+var MAX_CONNECT_RESPONSE_BYTES = 64 * 1024;
+
+// src/lib/as-tls-pin.ts
 function effectiveCa() {
   const path = process.env.NODE_EXTRA_CA_CERTS;
   if (!path) return void 0;
   try {
-    return [...rootCertificates, readFileSync4(path, "utf-8")];
+    return [...rootCertificates, readFileSync5(path, "utf-8")];
   } catch {
     return void 0;
   }
@@ -302,24 +569,27 @@ function pinnedCheckServerIdentity(pinnedSpkiHex) {
     return void 0;
   };
 }
-function buildPinnedDispatcher(pinnedSpkiHex) {
-  return new Agent({
-    connect: {
-      ca: effectiveCa(),
-      checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
-    }
+function buildTlsDispatcher(url, connectOpts) {
+  const proxyUrl = selectProxyUrl(url);
+  if (proxyUrl) {
+    return new ProxyAgent({ uri: proxyUrl, requestTls: connectOpts });
+  }
+  return new Agent({ connect: connectOpts });
+}
+function buildPinnedDispatcher(pinnedSpkiHex, url) {
+  return buildTlsDispatcher(url, {
+    ca: effectiveCa(),
+    checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
   });
 }
-function buildCapturingDispatcher() {
+function buildCapturingDispatcher(url) {
   let captured;
-  const dispatcher = new Agent({
-    connect: {
-      ca: effectiveCa(),
-      checkServerIdentity: (hostname, cert) => {
-        captured = cert;
-        const defaultErr = defaultCheckServerIdentity(hostname, cert);
-        return defaultErr ? taggedCheckError(defaultErr) : void 0;
-      }
+  const dispatcher = buildTlsDispatcher(url, {
+    ca: effectiveCa(),
+    checkServerIdentity: (hostname, cert) => {
+      captured = cert;
+      const defaultErr = defaultCheckServerIdentity(hostname, cert);
+      return defaultErr ? taggedCheckError(defaultErr) : void 0;
     }
   });
   return { dispatcher, getCapturedCert: () => captured };
@@ -330,6 +600,34 @@ function withBoundedSignal(init) {
   const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
   return { ...init, signal };
 }
+var UNKNOWN_ISSUER_CODES = /* @__PURE__ */ new Set([
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "CERT_UNTRUSTED"
+]);
+function tlsErrorCode(err) {
+  if (!(err instanceof Error)) return void 0;
+  const cause = err.cause;
+  const withCode = cause instanceof Error ? cause : err;
+  return withCode.code;
+}
+function isUnknownIssuerError(err) {
+  const code = tlsErrorCode(err);
+  return !!code && UNKNOWN_ISSUER_CODES.has(code);
+}
+function rethrowWithIssuerHint(err, url) {
+  if (isUnknownIssuerError(err)) {
+    const hinted = new Error(
+      `Could not verify the certificate presented for ${url} \u2014 its issuer is not trusted (${tlsErrorCode(err)}). This is the typical signature of a company network that inspects HTTPS traffic with its own root certificate: trust it with \`suveren-gateway config set ca-file <path-to-company-root.pem>\` (or --ca-file / NODE_EXTRA_CA_CERTS), then try again. Original error: ${describeFetchError(err)}`
+    );
+    hinted.cause = err;
+    throw hinted;
+  }
+  throw err;
+}
 function closeAfter(dispatcher, pending) {
   pending.catch(() => {
   }).finally(() => {
@@ -339,8 +637,24 @@ function closeAfter(dispatcher, pending) {
 }
 async function fetchAs(url, init, pinning) {
   if (!pinning.enforce && !pinning.capture) {
-    const res2 = await fetch(url, withBoundedSignal(init));
-    return { res: res2 };
+    const proxyUrl = selectProxyUrl(url);
+    if (!proxyUrl) {
+      try {
+        const res2 = await fetch(url, withBoundedSignal(init));
+        return { res: res2 };
+      } catch (err) {
+        rethrowWithIssuerHint(err, url);
+      }
+    }
+    const dispatcher2 = new ProxyAgent({ uri: proxyUrl, requestTls: { ca: effectiveCa() } });
+    const pending2 = undiciFetch(url, { ...withBoundedSignal(init), dispatcher: dispatcher2 });
+    closeAfter(dispatcher2, pending2);
+    try {
+      const res2 = await pending2;
+      return { res: res2 };
+    } catch (err) {
+      rethrowWithIssuerHint(err, url);
+    }
   }
   if (pinning.enforce && !pinning.capture && !pinning.pinnedSpkiHex) {
     throw new AsTlsMismatchError(
@@ -348,27 +662,27 @@ async function fetchAs(url, init, pinning) {
     );
   }
   if (pinning.pinnedSpkiHex && (pinning.enforce || !pinning.capture)) {
-    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex);
+    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex, url);
     const pending2 = undiciFetch(url, { ...withBoundedSignal(init), dispatcher: dispatcher2 });
     closeAfter(dispatcher2, pending2);
     try {
       const res2 = await pending2;
       return { res: res2 };
     } catch (err) {
-      if (!isPinCheckError(err)) throw err;
+      if (!isPinCheckError(err)) rethrowWithIssuerHint(err, url);
       throw new AsTlsMismatchError(
-        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. If the Authority Server's certificate changed intentionally (a new key, not just renewal), an operator must clear the pairing and sign in again to re-pin it.`
+        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. Two things produce this: (1) the Authority Server's TLS certificate genuinely changed (a new signing key, not just a renewal) \u2014 clear the pairing and sign in again to re-pin it; or (2) a TLS-inspecting proxy on this network is re-signing traffic with its own certificate \u2014 ask network/IT to exempt the Authority Server's host from TLS inspection (pin-tls refusing this, even with a trusted --ca-file, is working as intended).`
       );
     }
   }
-  const { dispatcher, getCapturedCert } = buildCapturingDispatcher();
+  const { dispatcher, getCapturedCert } = buildCapturingDispatcher(url);
   const pending = undiciFetch(url, { ...withBoundedSignal(init), dispatcher });
   closeAfter(dispatcher, pending);
   let res;
   try {
     res = await pending;
   } catch (err) {
-    if (!isPinCheckError(err)) throw err;
+    if (!isPinCheckError(err)) rethrowWithIssuerHint(err, url);
     throw new AsTlsMismatchError(
       `could not verify the Authority Server at ${url} while establishing its TLS pin \u2014 ${describeFetchError(err)}.`
     );
@@ -834,11 +1148,11 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync5, unlinkSync as unlinkSync2 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join4(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join5(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
@@ -856,11 +1170,11 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync4(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync4(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
           unlinkSync2(this.plaintextFilePath);
         } catch {
@@ -898,11 +1212,11 @@ var GateStore = class {
   clearAll() {
     this.entries = /* @__PURE__ */ new Map();
     try {
-      if (existsSync4(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
+      if (existsSync5(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
     } catch {
     }
     try {
-      if (existsSync4(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
+      if (existsSync5(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
     } catch {
     }
   }
@@ -935,19 +1249,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join4(this.baseDir, "gates.json");
+    return join5(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join4(this.baseDir, "gates.enc.json");
+    return join5(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync4(this.plaintextFilePath)) {
+    if (!existsSync5(this.plaintextFilePath)) {
       mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -956,9 +1270,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync4(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -999,11 +1313,11 @@ var GateStore = class {
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join6(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -1022,11 +1336,11 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync5(this.encryptedFilePath)) {
+    if (existsSync6(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync5(this.plaintextFilePath)) {
+      if (existsSync6(this.plaintextFilePath)) {
         try {
           unlinkSync3(this.plaintextFilePath);
         } catch {
@@ -1130,19 +1444,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join5(this.baseDir, "execution-log.json");
+    return join6(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join5(this.baseDir, "execution-log.enc.json");
+    return join6(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync5(this.plaintextFilePath)) {
+    if (!existsSync6(this.plaintextFilePath)) {
       mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync7(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -1152,9 +1466,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync5(this.encryptedFilePath)) return;
+    if (!existsSync6(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync7(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -1201,11 +1515,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync6, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync7, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join6 } from "path";
+import { dirname as dirname5, join as join7 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join7(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -1218,11 +1532,11 @@ var DenialLog = class {
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync6(this.encryptedFilePath)) {
+    if (existsSync7(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync6(this.plaintextFilePath)) {
+      if (existsSync7(this.plaintextFilePath)) {
         try {
           unlinkSync4(this.plaintextFilePath);
         } catch {
@@ -1272,18 +1586,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join6(this.baseDir, "denials.json");
+    return join7(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join6(this.baseDir, "denials.enc.json");
+    return join7(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync6(this.plaintextFilePath)) {
+    if (!existsSync7(this.plaintextFilePath)) {
       mkdirSync5(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync7(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync8(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -1291,9 +1605,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync6(this.encryptedFilePath)) return;
+    if (!existsSync7(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync7(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync8(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -1319,11 +1633,11 @@ var DenialLog = class {
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, unlinkSync as unlinkSync5 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync8, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname6, join as join7 } from "path";
+import { dirname as dirname6, join as join8 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join8(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -1348,11 +1662,11 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync7(this.encryptedFilePath)) {
+    if (existsSync8(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync7(this.plaintextFilePath)) {
+      if (existsSync8(this.plaintextFilePath)) {
         try {
           unlinkSync5(this.plaintextFilePath);
         } catch {
@@ -1366,7 +1680,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync7(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync8(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -1467,19 +1781,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join7(this.baseDir, "receipt-archive.json");
+    return join8(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join7(this.baseDir, "receipt-archive.enc.json");
+    return join8(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync7(this.plaintextFilePath)) {
+    if (!existsSync8(this.plaintextFilePath)) {
       mkdirSync6(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync8(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync9(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1491,16 +1805,16 @@ var ReceiptArchive = class {
       try {
         writeFileSync6(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync8(this.plaintextFilePath)
+          readFileSync9(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync7(this.encryptedFilePath)) return;
+    if (!existsSync8(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync8(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync9(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1514,7 +1828,7 @@ var ReceiptArchive = class {
       try {
         writeFileSync6(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync8(this.encryptedFilePath)
+          readFileSync9(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1542,11 +1856,11 @@ var ReceiptArchive = class {
 };
 
 // src/lib/execution-journal.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7, existsSync as existsSync8, renameSync } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7, existsSync as existsSync9, renameSync } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname7, join as join8 } from "path";
+import { dirname as dirname7, join as join9 } from "path";
 import { createHash as createHash3 } from "crypto";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join9(homedir5(), ".suveren");
 var FILE_NAME = "execution-journal.json";
 var MAX_AGE_SECONDS2 = 90 * 24 * 60 * 60;
 function hashToolArgs(args) {
@@ -1563,7 +1877,7 @@ var ExecutionJournal = class {
   filePath;
   constructor(filePath) {
     const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR5;
-    this.filePath = join8(baseDir, FILE_NAME);
+    this.filePath = join9(baseDir, FILE_NAME);
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
@@ -1602,9 +1916,9 @@ var ExecutionJournal = class {
   }
   // ─── Persistence ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync8(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync9(this.filePath, "utf8"));
+      const parsed = JSON.parse(readFileSync10(this.filePath, "utf8"));
       if (parsed?.version !== 1 || !Array.isArray(parsed.entries)) {
         throw new Error("unexpected shape");
       }
@@ -1629,10 +1943,10 @@ function nowSec() {
 }
 
 // src/lib/proposal-submission-store.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync9, renameSync as renameSync2 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync10, renameSync as renameSync2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname8, join as join9 } from "path";
-var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
+import { dirname as dirname8, join as join10 } from "path";
+var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join10(homedir6(), ".suveren");
 var FILE_NAME2 = "proposal-submissions.json";
 var MAX_AGE_SECONDS3 = 90 * 24 * 60 * 60;
 function nowSec2() {
@@ -1642,7 +1956,7 @@ var ProposalSubmissionStore = class {
   filePath;
   constructor(filePath) {
     const baseDir = filePath && filePath.endsWith(".json") ? dirname8(filePath) : filePath ?? DEFAULT_DIR6;
-    this.filePath = join9(baseDir, FILE_NAME2);
+    this.filePath = join10(baseDir, FILE_NAME2);
   }
   /** Record what was submitted, right after a successful submitProposal(). */
   record(entry) {
@@ -1665,9 +1979,9 @@ var ProposalSubmissionStore = class {
     return this.load().entries.find((e) => e.proposalId === proposalId);
   }
   load() {
-    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync10(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync10(this.filePath, "utf-8"));
+      const parsed = JSON.parse(readFileSync11(this.filePath, "utf-8"));
       const cutoff = nowSec2() - MAX_AGE_SECONDS3;
       parsed.entries = (parsed.entries ?? []).filter((e) => e.submittedAt >= cutoff);
       return parsed;
@@ -1956,17 +2270,17 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync12, existsSync as existsSync11 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
-var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join10(homedir7(), ".suveren");
+import { join as join11 } from "path";
+var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir2) {
   const dir = dataDir2 ?? DEFAULT_DIR7;
-  const filePath = join10(dir, "context.md");
-  if (!existsSync10(filePath)) return null;
+  const filePath = join11(dir, "context.md");
+  if (!existsSync11(filePath)) return null;
   try {
-    const content = readFileSync11(filePath, "utf-8").trim();
+    const content = readFileSync12(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -2605,8 +2919,8 @@ import { extname } from "path";
 import { randomUUID } from "crypto";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync12, existsSync as existsSync11 } from "fs";
-import { join as join11, resolve } from "path";
+import { readFileSync as readFileSync13, existsSync as existsSync12 } from "fs";
+import { join as join12, resolve } from "path";
 var EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 function isExactSemver(value) {
   return typeof value === "string" && EXACT_SEMVER_RE.test(value);
@@ -2624,25 +2938,25 @@ function invalidNpmPinReason(manifest) {
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join11(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join12(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join11(dir, "index.json");
-  if (!existsSync11(indexPath)) {
+  const indexPath = join12(dir, "index.json");
+  if (!existsSync12(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync12(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync13(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join11(dir, relativePath);
+    const manifestPath = join12(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync12(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync13(manifestPath, "utf-8"));
       const pinReason = invalidNpmPinReason(manifest);
       if (pinReason) {
         console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${pinReason}`);
@@ -2666,6 +2980,8 @@ function getAllManifests() {
 
 // src/lib/simulation-mode.ts
 function isSimulationMode() {
+  const policySimulation = readPolicy().policy.simulation;
+  if (policySimulation !== void 0) return policySimulation;
   return process.env.SUVEREN_SIMULATION === "1";
 }
 function manifestIsSimulated(manifest) {
@@ -4195,16 +4511,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync12 } from "fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname9, join as join12 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join12(homedir8(), ".suveren");
+import { dirname as dirname9, join as join13 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join13(homedir8(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir2) {
     const dir = dataDir2 ?? DEFAULT_DATA_DIR;
-    this.filePath = join12(dir, "integrations.json");
+    this.filePath = join13(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -4235,12 +4551,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync12(this.filePath)) {
+    if (!existsSync13(this.filePath)) {
       mkdirSync9(dirname9(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync13(this.filePath, "utf-8");
+      const raw = readFileSync14(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -4276,8 +4592,8 @@ var IntegrationRegistry = class {
 
 // src/lib/integration-manager.ts
 import { homedir as homedir9 } from "os";
-import { join as join13, delimiter } from "path";
-import { existsSync as existsSync13, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync } from "fs";
+import { join as join14, delimiter } from "path";
+import { existsSync as existsSync14, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync15, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -4354,25 +4670,26 @@ function safeHost(url) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join13(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join14(homedir9(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join14(DEFAULT_DATA_DIR2, "integrations");
+var OFFLINE_MODE = process.env.SUVEREN_OFFLINE === "1";
 var installLock = Promise.resolve();
 function withInstallLock(task) {
   const run = installLock.then(task, task);
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join13(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join14(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync13(INTEGRATIONS_DIR)) {
+  if (!existsSync14(INTEGRATIONS_DIR)) {
     mkdirSync10(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join13(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync13(pkgPath)) {
+  const pkgPath = join14(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync14(pkgPath)) {
     writeFileSync10(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
@@ -4460,19 +4777,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join13(pkgDir, "package.json");
-    if (!existsSync13(pkgDir) || !existsSync13(pkgJson)) return false;
+    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join14(pkgDir, "package.json");
+    if (!existsSync14(pkgDir) || !existsSync14(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync14(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync13(join13(pkgDir, target))) return false;
+        if (!existsSync14(join14(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync13(join13(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync14(join14(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -4487,9 +4804,9 @@ var IntegrationManager = class {
    */
   readInstalledVersion(npmPackage) {
     if (!this.isUsableInstall(npmPackage)) return null;
-    const pkgJson = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
+    const pkgJson = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
     try {
-      const pkg = JSON.parse(readFileSync14(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
       return typeof pkg.version === "string" ? pkg.version : null;
     } catch {
       return null;
@@ -4503,7 +4820,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync13(join13(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync14(join14(INTEGRATIONS_BIN, c)));
   }
   /**
    * The exact version THIS gateway's CURRENTLY LOADED manifest pins
@@ -4545,6 +4862,19 @@ var IntegrationManager = class {
     if (!npmPackage) return;
     ensureIntegrationsDir();
     const pinnedVersion = this.pinnedVersionFor(config);
+    if (OFFLINE_MODE) {
+      const current = this.readInstalledVersion(npmPackage);
+      if (pinnedVersion) {
+        if (current === pinnedVersion) return;
+        throw new Error(
+          `${config.id}: connector ${npmPackage} version ${pinnedVersion} is not part of this installation (found ${current ?? "nothing installed"} at ${INTEGRATIONS_DIR}; SUVEREN_OFFLINE=1 so no npm install was attempted).`
+        );
+      }
+      if (current !== null) return;
+      throw new Error(
+        `${config.id}: connector ${npmPackage} is not part of this installation (nothing installed at ${INTEGRATIONS_DIR}; SUVEREN_OFFLINE=1 so no npm install was attempted).`
+      );
+    }
     if (pinnedVersion) {
       if (this.readInstalledVersion(npmPackage) === pinnedVersion) return;
       return withInstallLock(async () => {
@@ -4580,8 +4910,8 @@ var IntegrationManager = class {
    * nothing at all.
    */
   async installNow(npmPackage, exactVersion, cleanFirst = true) {
-    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (cleanFirst && existsSync13(pkgDir)) {
+    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (cleanFirst && existsSync14(pkgDir)) {
       console.error(`[IntegrationManager] Removing ${exactVersion ? "outdated" : "unusable"} install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -5070,28 +5400,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
-import { join as join14, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
+import { join as join15, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join14(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join14(dir, "index.json");
-  if (!existsSync14(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join15(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join15(dir, "index.json");
+  if (!existsSync15(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync15(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync16(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join14(dir, relativePath);
+    const profilePath = join15(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync15(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync16(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -5127,8 +5457,8 @@ function warnNoProfiles(reason) {
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync16, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname10, join as join15 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync17, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname10, join as join16 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -5156,7 +5486,7 @@ var ExecutorLock = class {
   path;
   held = false;
   constructor(dataDir2) {
-    this.path = join15(dataDir2, "executor.lock");
+    this.path = join16(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -5188,9 +5518,9 @@ var ExecutorLock = class {
     }
   }
   read() {
-    if (!existsSync15(this.path)) return null;
+    if (!existsSync16(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync16(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync17(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -5208,19 +5538,19 @@ function isAlive(pid) {
 
 // bin/http.ts
 import { homedir as homedir10 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/lib/mcp-as-tracker.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname11, join as join16 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11, join as join17 } from "path";
 function trackerPath(dataDir2) {
-  return join16(dataDir2, "mcp-as-pairing.json");
+  return join17(dataDir2, "mcp-as-pairing.json");
 }
 function readMcpPairedAsUrl(dataDir2) {
   const path = trackerPath(dataDir2);
-  if (!existsSync16(path)) return null;
+  if (!existsSync17(path)) return null;
   try {
-    const data = JSON.parse(readFileSync17(path, "utf-8"));
+    const data = JSON.parse(readFileSync18(path, "utf-8"));
     return typeof data.asUrl === "string" ? data.asUrl : null;
   } catch {
     return null;
@@ -5233,7 +5563,7 @@ function writeMcpPairedAsUrl(dataDir2, asUrl) {
 }
 
 // bin/http.ts
-var dataDir = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join18(homedir10(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
 validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
@@ -5760,7 +6090,7 @@ app.listen(port, "0.0.0.0", () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join18(homedir10(), ".suveren");
   const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {