@suveren/gateway 0.16.1 → 0.18.0

package/content/guides/1-interview.md

@@ -0,0 +1,31 @@
+# Interview
+
+Learn the company, the team and the work, and collect real cases. Nothing is loaded or proposed in this step.
+
+You ask; the person answers and checks. Ask one topic at a time and write down what you learn.
+
+## What to ask, in this order
+
+1. **Company:** what it sells, to whom, in which currency, and which systems it uses. The systems connected to this gateway are listed in the header above; ask about the ones that matter for the work.
+2. **Department and team:** who does the work today, what a normal day looks like, what must never happen.
+3. **The work to test:** which requests come in (for example quote requests, orders, questions), how many, how fast they are answered today, and what a good answer looks like.
+4. **Order of systems:** whether the team follows a fixed sequence across systems — for example: always look up the customer in the CRM before quoting in the ERP, and log the reply in the CRM after sending. Which step must come first, which may be skipped. This becomes the agent's process and a rule in its brief.
+5. **Real cases:** 5–10 recent examples, each with the request as it arrived and the reply that was actually sent. The person pastes or forwards them.
+6. **Rules that are not written down:** discounts, credit limits, who may promise delivery dates, when to escalate and to whom.
+
+## Renaming
+
+Before anything else happens, propose new names for every person, company and email domain in the cases. Keep amounts, products and dates realistic. Use `.example` domains (for example `einkauf@huber.example`). The person checks the renamed cases; change them until they agree.
+
+## Result of this step
+
+- A short written summary: company, team, the work, the order of systems, the rules.
+- The renamed cases.
+
+Both confirmed by the person. The summary feeds the agent brief and the mandates; the cases feed the test data.
+
+## Ask, don't guess
+
+If a rule or a step is unclear, ask the person. Never invent a rule, a limit or a step to fill a gap.
+
+Next: **package**.

package/content/guides/2-package.md

@@ -0,0 +1,30 @@
+# Package
+
+Turn the confirmed cases into test data and load it into the simulated systems.
+
+## Build the package
+
+One package feeds every simulated system. Its format, and how to build a good one, is described in the `load_simulation` tool of each simulated system — read it there; it is the authority. In short: the company's `name` and `currency`, the `customers`, `products` and `contacts` the cases need, and the `cases` themselves (each request as it arrived and the reply that was actually sent).
+
+- Include every customer, product and contact a case mentions, with stock, prices and credit limits that make each case answerable the way it really was.
+- Use only the renamed cases.
+- Show the person the package before loading it; load only after they agree.
+
+## Load
+
+- Loading needs a setup mandate for each system (see **mandates**). The working AI's mandates must never allow loading.
+- Call `load_simulation` in each simulated system with the same package.
+- A load only works into an empty system. Incoming requests are dated within the hour before the load, in case order.
+
+## Run again
+
+To run the same cases again under a different setup, or other cases under the same setup:
+
+1. `clear_simulation` in each system — this deletes all test data, including the record of what happened.
+2. `load_simulation` again.
+
+Clear and load each count against the setup mandate's daily limit, so one re-run costs two per system. If the limit is too small, propose a new setup mandate with a higher limit.
+
+The real replies stay inside the simulated email system. They are never shown to the working AI; they exist for comparing afterwards.
+
+Next: **mandates**.

package/content/guides/3-mandates.md

@@ -0,0 +1,34 @@
+# Mandates
+
+Propose the mandates the setup and the working AI need. You propose with `create_mandate`; the person approves each one on its own; only then is it created.
+
+## Ask first
+
+Before proposing any mandate, ask the person which steps they want to approve themselves. Their answer wins over everything below.
+
+## The standard (when the person has no preference)
+
+- **Steps the customer would see** — replies, sent quotes, orders — start in **review** mode: each one waits for the person's approval.
+- **Internal steps** — looking up and noting things in the CRM, drafting quotes, loading test data — run **automatically** within limits.
+
+Apply this to whatever systems are connected: the header above lists each system with its action types and tools. Judge from the action type and its tools whether the customer would see the result. When unsure, ask.
+
+## Rules
+
+- **One mandate per system.** Split a system into several mandates only when the team has different rules for different tasks. A mode applies to a whole mandate, so different modes for different steps of one system mean separate mandates (for example: drafting quotes automatically, sending quotes in review).
+- **Setup and work are separate.** Setup mandates allow loading and clearing test data and nothing else. The working AI's mandates allow no loading or clearing (setup limit 0).
+- **Start strict.** Where the team has not said otherwise, propose review mode or low caps. The person can loosen a mandate later by replacing it.
+- **Limits come from the interview:** amounts, discounts, daily counts, allowed recipients. Do not invent them; ask.
+- **Intent:** write why, goal and watch-outs in the person's words, in the language the team uses. It is signed with the mandate and the working AI follows it.
+- **Teams:** in a team, the person must be an approver for the profile. `create_mandate` refuses at once if not; tell the person who can fix it (a team admin).
+- **Reporting:** never propose a `reporting` mandate for the working AI during a run (see **risks**).
+
+## Example (only an example)
+
+- Setup, per system: automatic, setup limit 4–6 per day, everything else 0.
+- CRM: automatic, with daily limits.
+- Sales, drafting quotes: automatic, within value and discount caps.
+- Sales, sending quotes and orders: review.
+- Email replies: review, recipients limited to the customers' domains.
+
+Next: **brief**.

package/content/guides/4-brief.md

@@ -0,0 +1,30 @@
+# Brief
+
+Propose the agent brief — the standing instructions the working AI starts every session with. You propose with `set_agent_brief`; the person approves; it applies from the working AI's next session.
+
+## What goes in
+
+From the interview:
+
+- **Who the AI works for:** the company, the team, the person.
+- **The job:** which requests it handles and what a good outcome is.
+- **The process:** the steps in order, including the order of systems from the interview, written as a rule (for example: "Always look up the customer in the CRM before preparing a quote.").
+- **House rules:** tone, language, discounts, credit, what to escalate and to whom.
+- **Hard lines:** what it must never do, even where a mandate would allow it.
+- **When unsure, ask:** a missing rule or an unclear step goes to the person, never to a guess.
+
+Write the brief in the language the team uses.
+
+## What stays out
+
+- Anything that reveals a test: no "simulation", "test case", "expected reply" or similar words.
+- The real replies from the cases.
+- Secrets, passwords, keys.
+
+## Limits
+
+- At most 16 KB.
+- It replaces the whole brief each time — always write the complete brief, not a change.
+- The person approves every version.
+
+Next: **agent-process**.

package/content/guides/5-agent-process.md

@@ -0,0 +1,39 @@
+# Agent process
+
+Help the person set up the working AI's process in its own client. The process is the working AI's work, not the gateway's: the gateway only grants and checks what it may do.
+
+## Write the process as steps
+
+From the interview, for example:
+
+1. Read new messages in the inbox.
+2. Look up the customer in the CRM.
+3. Check stock and price in the ERP.
+4. Prepare the quote.
+5. Reply to the customer.
+
+Keep a fixed order of systems from the interview exactly as given; it is also a rule in the brief. The person confirms the steps.
+
+## Where it lives
+
+- In the working AI's client, as its standing instructions for this work, connected to this gateway.
+- In a separate conversation or project from this setup conversation.
+
+## What starts a run
+
+- The person asks (for example: "Work the new requests.").
+- Or a scheduled or triggered run, if the client offers one. Check what the person's client offers today; do not assume.
+
+## When a step is unclear
+
+The working AI stops and asks the person. It never fills a gap by guessing.
+
+## Claude Desktop
+
+Help the person connect the client to this gateway (the gateway's MCP address) and put the steps into the client's standing instructions for this work. Check the client's current settings with the person; menus change between versions.
+
+## ChatGPT
+
+Same as above: connect the gateway if the person's plan and client support custom MCP connectors, and add the steps as instructions. If connecting is not possible, say so — the working AI cannot be tested without the gateway.
+
+Next: **risks**, then start a run.

package/content/guides/6-risks.md

@@ -0,0 +1,14 @@
+# Risks
+
+What can make a test say more than it should, and what to do about each. Read this once at the start and again before every run.
+
+| Risk | Why it matters | What to do |
+| --- | --- | --- |
+| The client remembers earlier runs | A re-run of the same cases is no longer a fresh test | Start every run in a new conversation; turn the client's memory off for the working AI |
+| The working AI learns it is a test | It may behave differently | Never give it a `reporting` mandate during a run — its tools list the cases. Grant `reporting` only after the run, or to a separate AI session that only writes the report. Keep test words out of the brief |
+| Setup and work in the same session | Setup tools and the real replies stay in the working AI's context | Use separate conversations for setup and for work |
+| Mandates too loose | A wrong result can look like success | Start in review mode or with low caps; loosen by replacing the mandate |
+| Proposals are stored readable on the Authority Server | The content of every proposal, including intents, can be read there | Test data and renamed cases only — never real customer data in a setup |
+| Setup limit too low | A clear without the following load leaves empty systems | Use a setup limit of 4–6 per day; clear and load in one go |
+
+Next: start a run — the person asks the working AI to work the new requests.

package/dist/control-plane/index.mjs

@@ -40,6 +40,8 @@ var Vault = class {
    * disk, gone the moment the process restarts or the vault locks.
    */
   spSessionExpiresAt = null;
+  /** Who the current AS session belongs to (from the login response). Never persisted. */
+  sessionUser = null;
   /** Set by lockExpired(); cleared by any fresh unseal (a new login). */
   lockedReason = null;
   constructor(dataDir) {
@@ -97,6 +99,7 @@ var Vault = class {
     this.spSessionCookie = null;
     this.unsealedBy = null;
     this.spSessionExpiresAt = null;
+    this.sessionUser = null;
     this.lockedReason = null;
   }
   /**
@@ -149,6 +152,13 @@ var Vault = class {
   getSessionExpiresAt() {
     return this.spSessionExpiresAt;
   }
+  /** The signed-in person, set at login from the AS session response; cleared with the session. */
+  setSessionUser(user) {
+    this.sessionUser = user;
+  }
+  getSessionUser() {
+    return this.sessionUser;
+  }
   /**
    * Check if the vault was created by a different API key.
    * Tries to decrypt the first credential — if it fails, keys don't match.
@@ -414,6 +424,11 @@ async function runCommittedProposals() {
     headers: internalHeaders()
   });
 }
+async function getToolDisplay() {
+  const res = await fetch(`${MCP_BASE}/internal/tool-display`, { headers: internalHeaders() });
+  if (!res.ok) throw new Error(`MCP tool-display failed: ${res.status}`);
+  return res.json();
+}
 async function getIntegrations() {
   const res = await fetch(`${MCP_BASE}/internal/integrations`, {
     headers: internalHeaders()
@@ -1726,6 +1741,10 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
       }
       const sessionExpiresAt = typeof data.sessionExpiresAt === "number" ? data.sessionExpiresAt : null;
       vault2.setSessionExpiresAt(sessionExpiresAt);
+      const sessionUser = data.user;
+      vault2.setSessionUser(
+        typeof sessionUser?.id === "string" && typeof sessionUser?.did === "string" ? { id: sessionUser.id, did: sessionUser.did } : null
+      );
       onSessionEstablished?.();
       if (sessionCookie) {
         try {
@@ -3087,7 +3106,26 @@ function notify(title, message, platform = process.platform, url) {
 
 // src/routes/encrypt-intent.ts
 import { Router as Router7 } from "express";
+
+// src/lib/intent-encryption.ts
 import { computeIntentDisclosureHash } from "@hap/core";
+async function encryptIntentForRecipients(intent, recipients) {
+  const parsed = recipients.map(({ userId, publicKey }) => {
+    const bytes = new Uint8Array(Buffer.from(publicKey, "base64"));
+    if (bytes.length !== 32) throw new Error(`publicKey for userId "${userId}" must be 32 bytes (X25519); got ${bytes.length}`);
+    return { userId, publicKey: bytes };
+  });
+  const encrypted = await encryptForRecipients(intent, parsed);
+  const encryptedKeys = {};
+  for (const [userId, wrap] of Object.entries(encrypted.encryptedKeys)) {
+    encryptedKeys[userId] = { ct: Buffer.from(wrap.ct).toString("base64"), enc: Buffer.from(wrap.enc).toString("base64") };
+  }
+  const intentCiphertext = Buffer.from(encrypted.intentCiphertext).toString("base64");
+  const approversFrozen = parsed.map((r) => r.userId);
+  return { intentCiphertext, encryptedKeys, approversFrozen, intentDisclosureHash: computeIntentDisclosureHash(intentCiphertext, approversFrozen) };
+}
+
+// src/routes/encrypt-intent.ts
 function createEncryptIntentRouter() {
   const router = Router7();
   router.post("/", async (req, res) => {
@@ -3125,23 +3163,10 @@ function createEncryptIntentRouter() {
       parsed.push({ userId, publicKey: pubBytes });
     }
     try {
-      const encrypted = await encryptForRecipients(intent, parsed);
-      const encryptedKeys = {};
-      for (const [userId, wrap] of Object.entries(encrypted.encryptedKeys)) {
-        encryptedKeys[userId] = {
-          ct: Buffer.from(wrap.ct).toString("base64"),
-          enc: Buffer.from(wrap.enc).toString("base64")
-        };
-      }
-      const intentCiphertextB64 = Buffer.from(encrypted.intentCiphertext).toString("base64");
-      const approversFrozen = parsed.map((r) => r.userId);
-      const intentDisclosureHash = computeIntentDisclosureHash(intentCiphertextB64, approversFrozen);
-      res.json({
-        intentCiphertext: intentCiphertextB64,
-        encryptedKeys,
-        approversFrozen,
-        intentDisclosureHash
-      });
+      res.json(await encryptIntentForRecipients(
+        intent,
+        parsed.map((r) => ({ userId: r.userId, publicKey: Buffer.from(r.publicKey).toString("base64") }))
+      ));
     } catch (err) {
       console.error("[Control Plane] encrypt-intent error:", err);
       res.status(500).json({ error: err instanceof Error ? err.message : "Encryption failed" });
@@ -3757,6 +3782,201 @@ function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch
   return router;
 }
 
+// src/routes/internal-mandate.ts
+import { Router as Router15 } from "express";
+import { timingSafeEqual as timingSafeEqual3, randomUUID } from "crypto";
+
+// src/lib/mandate-ceremony.ts
+import {
+  allowedCommitmentModes,
+  computeBoundsHash,
+  computeContextHash,
+  computeIntentHash,
+  isCommitmentModeAllowed,
+  validateBoundsParams,
+  validateContextParams
+} from "@hap/core";
+var MandateRefused = class extends Error {
+};
+var INTENT_MAX = 2e3;
+var shortOf = (id) => id.replace(/@.*$/, "").split("/").pop() ?? id;
+var versionOf = (id) => id.split("@")[1] ?? "";
+function refuse(msg) {
+  throw new MandateRefused(msg);
+}
+async function resolveProfile(as, requested) {
+  let id = requested.trim();
+  if (!id.includes("@")) {
+    const list = await as("GET", "/api/profiles");
+    const matches = (list.body?.profiles ?? []).filter((p) => shortOf(p.id) === id);
+    if (matches.length === 0) refuse(`Unknown profile "${requested}".`);
+    matches.sort((a, b) => versionOf(b.id).localeCompare(versionOf(a.id), void 0, { numeric: true }));
+    id = matches[0].id;
+  }
+  const res = await as("GET", `/api/profiles/${encodeURIComponent(id)}`);
+  if (res.status !== 200 || !res.body?.id) refuse(`Unknown profile "${requested}".`);
+  return res.body;
+}
+function scalarRecord(label, value) {
+  if (value === void 0 || value === null) return {};
+  if (typeof value !== "object" || Array.isArray(value)) refuse(`\`${label}\` must be an object.`);
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v !== "string" && typeof v !== "number") refuse(`\`${label}.${k}\` must be a string or a number.`);
+    out[k] = v;
+  }
+  return out;
+}
+function approverPubkeys(body) {
+  const map = body?.pubkeys;
+  if (!map || typeof map !== "object" || Array.isArray(map)) return [];
+  return Object.entries(map).filter((e) => typeof e[1] === "string" && e[1].length > 0).map(([userId, publicKey]) => ({ userId, publicKey }));
+}
+async function planMandate(req, deps) {
+  const user = deps.user;
+  if (!user) refuse("The gateway is not signed in.");
+  const groupsRes = await deps.as("GET", "/api/groups");
+  const groups = groupsRes.body?.groups ?? [];
+  const group = req.team ? groups.find((g) => !g.isPersonal && (g.id === req.team || g.name === req.team)) : groups.find((g) => g.isPersonal);
+  if (!group) refuse(req.team ? `You are not a member of a team "${req.team}".` : "No personal workspace found.");
+  const isPersonal = !!group.isPersonal;
+  const profile = await resolveProfile(deps.as, req.profile);
+  const name = profile.name ?? shortOf(profile.id);
+  let approvers = [];
+  if (!isPersonal) {
+    const cfg = await deps.as("GET", `/api/groups/${encodeURIComponent(group.id)}/profile-config/${encodeURIComponent(profile.id)}`);
+    approvers = (cfg.status === 200 ? cfg.body?.config?.approvers : void 0) ?? [];
+    if (approvers.length === 0) refuse(`${name} is not enabled in "${group.name}": a team admin must name who may give ${name} mandates.`);
+    if (!approvers.includes(user.id)) refuse(`Only ${name}'s approvers in "${group.name}" can give this mandate, and the signed-in person is not one of them.`);
+  }
+  const bounds = { ...scalarRecord("limits", req.limits), profile: profile.id };
+  const bv = validateBoundsParams(bounds, profile);
+  const errors = [...bv.errors];
+  for (const [field, value] of Object.entries(bounds)) {
+    const bt = profile.boundsSchema?.fields[field]?.boundType;
+    if (bt?.kind === "enum" && Array.isArray(bt.values) && !bt.values.includes(String(value))) {
+      errors.push(`Field "${field}" must be one of ${bt.values.join(", ")}.`);
+    }
+  }
+  const context = scalarRecord("scope", req.scope);
+  errors.push(...validateContextParams(context, profile).errors);
+  if (errors.length) refuse(`The mandate does not fit profile ${profile.id}: ${errors.join(" ")}`);
+  if (!isCommitmentModeAllowed(profile, req.mode)) {
+    refuse(`Profile ${profile.id} allows mode ${allowedCommitmentModes(profile).join(" or ") || "none"}, not "${req.mode}".`);
+  }
+  const ttlSeconds = req.durationHours === void 0 ? profile.ttl.default : Math.round(req.durationHours * 3600);
+  if (!(ttlSeconds > 0)) refuse("`duration_hours` must be positive.");
+  if (ttlSeconds > profile.ttl.max) refuse(`At most ${profile.ttl.max / 3600} hours for profile ${profile.id}.`);
+  const intent = typeof req.intent === "string" ? req.intent.trim() : "";
+  if (!intent) refuse("`intent` is required \u2014 the why, goal and watch-outs, in the person's words.");
+  if (intent.length > INTENT_MAX) refuse(`\`intent\` is ${intent.length} characters; the limit is ${INTENT_MAX}.`);
+  return {
+    groupId: group.id,
+    groupName: group.name,
+    isPersonal,
+    domain: isPersonal ? "owner" : user.id,
+    profile,
+    bounds,
+    context,
+    intent,
+    mode: req.mode,
+    ttlSeconds,
+    title: (req.title ?? "").trim() || `${name} (proposed by AI)`,
+    approvers
+  };
+}
+async function createMandate(req, deps) {
+  const plan = await planMandate(req, deps);
+  const user = deps.user;
+  const boundsHash = computeBoundsHash(plan.bounds, plan.profile);
+  const contextHash = computeContextHash(plan.context, plan.profile);
+  const intentHash = computeIntentHash(plan.intent);
+  const ecHash = computeIntentHash(JSON.stringify({ profile: plan.profile.id, domain: plan.domain, group: plan.groupId }));
+  let enc;
+  if (!plan.isPersonal) {
+    const keys = await deps.as(
+      "GET",
+      `/api/groups/${encodeURIComponent(plan.groupId)}/profile-config/${encodeURIComponent(plan.profile.id)}/approvers/pubkeys`
+    );
+    const recipients = approverPubkeys(keys.body);
+    if (recipients.length > 0) enc = await deps.encrypt(plan.intent, recipients);
+  }
+  const authorizationId = deps.newAuthorizationId();
+  const res = await deps.as("POST", "/api/as/attest", {
+    authorization_id: authorizationId,
+    profile_id: plan.profile.id,
+    bounds: plan.bounds,
+    bounds_hash: boundsHash,
+    context_hash: contextHash,
+    domain: plan.domain,
+    did: user.did,
+    gate_content_hashes: { intent: intentHash },
+    execution_context_hash: ecHash,
+    group_id: plan.groupId,
+    ttl: plan.ttlSeconds,
+    commitment_mode: plan.mode,
+    title: plan.title,
+    intent_ciphertext: enc?.intentCiphertext,
+    encrypted_keys: enc?.encryptedKeys,
+    approvers_frozen: enc?.approversFrozen,
+    intent_disclosure_hash: enc?.intentDisclosureHash
+  });
+  if (res.status >= 300) {
+    const why = res.body?.message ?? res.body?.detail ?? res.body?.error ?? `status ${res.status}`;
+    refuse(`The Authority Server refused the mandate: ${why}`);
+  }
+  try {
+    await deps.deliverGateContent({ authorizationId, boundsHash, contextHash, context: plan.context, gateContent: { intent: plan.intent } });
+  } catch (err) {
+    await deps.as("POST", `/api/authorizations/${encodeURIComponent(authorizationId)}/revoke`, {
+      reason: "Auto-revoked: gate content delivery failed"
+    }).catch(() => {
+    });
+    refuse(`The mandate was signed but its intent could not be delivered to the gateway, so it was revoked. (${err instanceof Error ? err.message : String(err)})`);
+  }
+  return { authorizationId, plan };
+}
+
+// src/routes/internal-mandate.ts
+function secretMatches2(provided, expected) {
+  if (!expected || !provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual3(a, b);
+}
+function createInternalMandateRouter(getSecret, deps) {
+  const router = Router15();
+  router.post("/mandate", async (req, res) => {
+    if (!secretMatches2(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
+      res.status(401).json({ error: "unauthorized" });
+      return;
+    }
+    const { dryRun, request } = req.body ?? {};
+    if (!request || typeof request !== "object") {
+      res.status(400).json({ error: "missing request" });
+      return;
+    }
+    const d = { ...deps(), newAuthorizationId: () => `authz_${randomUUID()}` };
+    try {
+      if (dryRun === true) {
+        const plan2 = await planMandate(request, d);
+        res.json({ ok: true, groupName: plan2.groupName, profileId: plan2.profile.id, mode: plan2.mode, ttlSeconds: plan2.ttlSeconds });
+        return;
+      }
+      const { authorizationId, plan } = await createMandate(request, d);
+      res.json({ ok: true, authorizationId, profileId: plan.profile.id, groupName: plan.groupName, mode: plan.mode, ttlSeconds: plan.ttlSeconds });
+    } catch (err) {
+      if (err instanceof MandateRefused) {
+        res.status(422).json({ error: "mandate_refused", message: err.message });
+        return;
+      }
+      console.error("[Control Plane] /internal/mandate failed:", err);
+      res.status(500).json({ error: "internal", message: err instanceof Error ? err.message : String(err) });
+    }
+  });
+  return router;
+}
+
 // src/lib/notification-dispatcher.ts
 var TRIGGER_EVENTS = ["proposal-added", "action-approval-needed"];
 var TITLE = "Suveren";
@@ -4273,6 +4493,33 @@ app.get("/auth/oauth/:integrationId/health", authGuard, async (req, res) => {
 });
 app.get("/events", requireAllowedHost, requireAuthQueryOrHeader(vault), createEventsHandler());
 app.use("/internal", jsonParser, createInternalEventsRouter(() => internalSecret2, lockExpiredSession, lockAsKeyMismatch, lockAsTlsMismatch));
+app.use("/internal", jsonParser, createInternalMandateRouter(() => internalSecret2, () => ({
+  user: vault.getSessionUser(),
+  as: async (method, path, body) => {
+    const cookie = vault.getSpCookie();
+    if (!cookie) return { status: 401, body: { error: "not signed in" } };
+    const pin = readPairing(DATA_DIR);
+    try {
+      const { res } = await fetchAs(
+        `${SP_URL}${path}`,
+        {
+          method,
+          headers: { Cookie: cookie, ...body !== void 0 ? { "Content-Type": "application/json" } : {} },
+          body: body !== void 0 ? JSON.stringify(body) : void 0,
+          signal: AbortSignal.timeout(15e3)
+        },
+        { enforce: resolvePinTls(DATA_DIR), pinnedSpkiHex: pin && pin.asUrl === SP_URL ? pin.tlsSpkiPinHex : void 0 }
+      );
+      if (res.status === 401 && vault.isUnlocked()) lockExpiredSession();
+      return { status: res.status, body: await res.json().catch(() => ({})) };
+    } catch (err) {
+      if (err instanceof AsTlsMismatchError) lockAsTlsMismatch();
+      throw err;
+    }
+  },
+  encrypt: encryptIntentForRecipients,
+  deliverGateContent: (args) => pushGateContent(args)
+})));
 app.use("/vault", jsonParser, authGuard, createVaultRouter(vault));
 app.use("/ai", jsonParser, authGuard, createAIRouter(vault));
 app.use("/ai-prompts", jsonParser, authGuard, createAIPromptsRouter());
@@ -4466,6 +4713,14 @@ app.post("/gate-content", jsonParser, authGuard, async (req, res) => {
     res.status(500).json({ error: "Failed to forward gate content to MCP server" });
   }
 });
+app.get("/tool-display", authGuard, async (_req, res) => {
+  try {
+    res.json(await getToolDisplay());
+  } catch (err) {
+    console.error("[Control Plane] tool-display error:", err);
+    res.status(502).json({ error: "MCP server unavailable" });
+  }
+});
 app.post("/resync-gates", authGuard, async (_req, res) => {
   try {
     const data = await resyncGates();