@suveren/gateway 0.18.0 → 0.18.1

package/dist/mcp-server/http.mjs

@@ -1,4 +1,22 @@
 #!/usr/bin/env node
+import {
+  METRIC_LABELS,
+  fingerprintOf,
+  formatActionLabel,
+  formatCurrency,
+  formatDateTime,
+  formatDuration,
+  formatMetricValue,
+  parseCaseAttrs,
+  parseElements,
+  parseTimestampSeconds,
+  profileShortLabel,
+  readPairing,
+  resolveApprovalElement,
+  resolveCaseElement,
+  resolveMandateElement,
+  resolveTicketElement
+} from "./chunk-JUFH4SKS.mjs";
 
 // bin/http.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -112,42 +130,13 @@ function clientVersionHeaders() {
   };
 }
 
-// src/lib/as-pairing.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
-import { dirname, join as join2 } from "path";
-function pairingPath(dataDir2) {
-  return join2(dataDir2, "as-pairing.json");
-}
-function readPairing(dataDir2) {
-  const path = pairingPath(dataDir2);
-  if (!existsSync2(path)) return null;
-  try {
-    const data = JSON.parse(readFileSync2(path, "utf-8"));
-    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
-    return {
-      asUrl: data.asUrl,
-      publicKeyHex: data.publicKeyHex,
-      pairedAt: data.pairedAt ?? "",
-      ...typeof data.tlsSpkiPinHex === "string" ? { tlsSpkiPinHex: data.tlsSpkiPinHex } : {}
-    };
-  } catch {
-    return null;
-  }
-}
-function fingerprintOf(publicKeyHex) {
-  const raw = Buffer.from(publicKeyHex, "hex");
-  const digest = createHash("sha256").update(raw).digest("hex").toUpperCase();
-  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
-}
-
 // src/lib/as-config.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { dirname, join as join3 } from "path";
 
 // src/lib/policy.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
 import { spawnSync } from "child_process";
 var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
 var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
@@ -182,7 +171,7 @@ function validateAsUrl(candidate) {
 function validateCaFile(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The CA file path is empty." };
-  if (!existsSync3(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
+  if (!existsSync2(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
   return { ok: true, path: trimmed };
 }
 function validateProxyUrl(candidate) {
@@ -248,7 +237,7 @@ function policyFilePath() {
   if (process.env.SUVEREN_POLICY_FILE) return process.env.SUVEREN_POLICY_FILE;
   if (process.platform === "win32") {
     const programData = process.env.ProgramData || process.env.PROGRAMDATA || "C:\\ProgramData";
-    return join3(programData, "Suveren", "gateway-policy.json");
+    return join2(programData, "Suveren", "gateway-policy.json");
   }
   if (process.platform === "darwin") {
     return "/Library/Application Support/Suveren/gateway-policy.json";
@@ -258,10 +247,10 @@ function policyFilePath() {
 function readPolicyFile() {
   const path = policyFilePath();
   const source = `the policy file (${path})`;
-  if (!existsSync3(path)) return { values: {}, source };
+  if (!existsSync2(path)) return { values: {}, source };
   let data;
   try {
-    data = JSON.parse(readFileSync3(path, "utf8"));
+    data = JSON.parse(readFileSync2(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse policy file ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -365,14 +354,14 @@ function readPolicy() {
 // src/lib/as-config.ts
 var DEFAULT_AS_URL = "https://www.suveren.ai";
 function configPath(dataDir2) {
-  return join4(dataDir2, "config.json");
+  return join3(dataDir2, "config.json");
 }
 function readAsConfigStrict(dataDir2) {
   const path = configPath(dataDir2);
-  if (!existsSync4(path)) return {};
+  if (!existsSync3(path)) return {};
   let data;
   try {
-    data = JSON.parse(readFileSync4(path, "utf-8"));
+    data = JSON.parse(readFileSync3(path, "utf-8"));
   } catch (err) {
     throw new Error(
       `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -387,9 +376,9 @@ function readAsConfigStrict(dataDir2) {
 }
 function readAsConfig(dataDir2) {
   const path = configPath(dataDir2);
-  if (!existsSync4(path)) return {};
+  if (!existsSync3(path)) return {};
   try {
-    const data = JSON.parse(readFileSync4(path, "utf-8"));
+    const data = JSON.parse(readFileSync3(path, "utf-8"));
     const out = {};
     if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
     if (typeof data.caFile === "string") out.caFile = data.caFile;
@@ -461,10 +450,10 @@ function validatePinTlsForUrl(pinTls, asUrl) {
 }
 
 // src/lib/as-tls-pin.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
 import { Agent as HttpsAgent2 } from "https";
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { Agent, ProxyAgent, fetch as undiciFetch } from "undici";
 
 // src/lib/proxy-env.ts
@@ -514,7 +503,7 @@ function effectiveCa() {
   const path = process.env.NODE_EXTRA_CA_CERTS;
   if (!path) return void 0;
   try {
-    return [...rootCertificates, readFileSync5(path, "utf-8")];
+    return [...rootCertificates, readFileSync4(path, "utf-8")];
   } catch {
     return void 0;
   }
@@ -542,7 +531,7 @@ function spkiSha256Hex(cert) {
   if (!cert.pubkey) {
     throw new Error("peer certificate carries no pubkey (expected the detailed certificate object)");
   }
-  return createHash2("sha256").update(cert.pubkey).digest("hex");
+  return createHash("sha256").update(cert.pubkey).digest("hex");
 }
 function formatPinFingerprint(hex) {
   const upper = hex.toUpperCase();
@@ -1148,18 +1137,18 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync5, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync4, unlinkSync } from "fs";
 import { homedir } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join5(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join4(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname3(filePath);
+      this.baseDir = dirname2(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR;
     }
@@ -1170,13 +1159,13 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync5(this.encryptedFilePath)) {
+    if (existsSync4(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync5(this.plaintextFilePath)) {
+      if (existsSync4(this.plaintextFilePath)) {
         try {
-          unlinkSync2(this.plaintextFilePath);
+          unlinkSync(this.plaintextFilePath);
         } catch {
         }
       }
@@ -1212,11 +1201,11 @@ var GateStore = class {
   clearAll() {
     this.entries = /* @__PURE__ */ new Map();
     try {
-      if (existsSync5(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
+      if (existsSync4(this.plaintextFilePath)) unlinkSync(this.plaintextFilePath);
     } catch {
     }
     try {
-      if (existsSync5(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
+      if (existsSync4(this.encryptedFilePath)) unlinkSync(this.encryptedFilePath);
     } catch {
     }
   }
@@ -1249,19 +1238,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join5(this.baseDir, "gates.json");
+    return join4(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join5(this.baseDir, "gates.enc.json");
+    return join4(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync5(this.plaintextFilePath)) {
-      mkdirSync3(this.baseDir, { recursive: true });
+    if (!existsSync4(this.plaintextFilePath)) {
+      mkdirSync2(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -1270,9 +1259,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync5(this.encryptedFilePath)) return;
+    if (!existsSync4(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -1296,8 +1285,8 @@ var GateStore = class {
       version: 1,
       entries: Object.fromEntries(this.entries)
     };
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync2(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
@@ -1307,17 +1296,17 @@ var GateStore = class {
     for (const [key, entry] of this.entries) {
       data.entries[key] = this.encrypt(JSON.stringify(entry));
     }
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync2(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync5, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join6(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -1325,7 +1314,7 @@ var ExecutionLog = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname4(filePath);
+      this.baseDir = dirname3(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR2;
     }
@@ -1336,13 +1325,13 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync6(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync6(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
-          unlinkSync3(this.plaintextFilePath);
+          unlinkSync2(this.plaintextFilePath);
         } catch {
         }
       }
@@ -1444,19 +1433,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join6(this.baseDir, "execution-log.json");
+    return join5(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join6(this.baseDir, "execution-log.enc.json");
+    return join5(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync6(this.plaintextFilePath)) {
-      mkdirSync4(this.baseDir, { recursive: true });
+    if (!existsSync5(this.plaintextFilePath)) {
+      mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync7(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -1466,9 +1455,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync6(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync7(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -1488,8 +1477,8 @@ var ExecutionLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, entries: this.entries };
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, entries: this.entries };
@@ -1497,8 +1486,8 @@ var ExecutionLog = class {
       version: 1,
       blob: this.encrypt(JSON.stringify(logFile))
     };
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 function windowCutoff(window, now) {
@@ -1515,11 +1504,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync7, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join7 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join7(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -1527,18 +1516,18 @@ var DenialLog = class {
   baseDir;
   vaultKey = null;
   constructor(filePath) {
-    this.baseDir = filePath && filePath.endsWith(".json") ? dirname5(filePath) : filePath ?? DEFAULT_DIR3;
+    this.baseDir = filePath && filePath.endsWith(".json") ? dirname4(filePath) : filePath ?? DEFAULT_DIR3;
     this.loadPlaintext();
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync7(this.encryptedFilePath)) {
+    if (existsSync6(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync7(this.plaintextFilePath)) {
+      if (existsSync6(this.plaintextFilePath)) {
         try {
-          unlinkSync4(this.plaintextFilePath);
+          unlinkSync3(this.plaintextFilePath);
         } catch {
         }
       }
@@ -1586,18 +1575,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join7(this.baseDir, "denials.json");
+    return join6(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join7(this.baseDir, "denials.enc.json");
+    return join6(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync7(this.plaintextFilePath)) {
-      mkdirSync5(this.baseDir, { recursive: true });
+    if (!existsSync6(this.plaintextFilePath)) {
+      mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync8(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync7(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -1605,9 +1594,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync7(this.encryptedFilePath)) return;
+    if (!existsSync6(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync8(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync7(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -1621,23 +1610,23 @@ var DenialLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, records: this.records };
-    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync5(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, records: this.records };
     const data = { version: 1, blob: this.encrypt(JSON.stringify(logFile)) };
-    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync5(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync8, unlinkSync as unlinkSync5 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync7, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname6, join as join8 } from "path";
+import { dirname as dirname5, join as join7 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join8(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -1651,7 +1640,7 @@ var ReceiptArchive = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname6(filePath);
+      this.baseDir = dirname5(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR4;
     }
@@ -1662,13 +1651,13 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync8(this.encryptedFilePath)) {
+    if (existsSync7(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync8(this.plaintextFilePath)) {
+      if (existsSync7(this.plaintextFilePath)) {
         try {
-          unlinkSync5(this.plaintextFilePath);
+          unlinkSync4(this.plaintextFilePath);
         } catch {
         }
       }
@@ -1680,7 +1669,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync8(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync7(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -1688,8 +1677,8 @@ var ReceiptArchive = class {
    */
   record(entry, now = Math.floor(Date.now() / 1e3)) {
     let changed = false;
-    const receiptId = typeof entry.receipt?.id === "string" ? entry.receipt.id : void 0;
-    const alreadyArchived = receiptId !== void 0 && this.data.receipts.some((r) => r.receipt.id === receiptId);
+    const receiptId2 = typeof entry.receipt?.id === "string" ? entry.receipt.id : void 0;
+    const alreadyArchived = receiptId2 !== void 0 && this.data.receipts.some((r) => r.receipt.id === receiptId2);
     if (!alreadyArchived) {
       this.data.receipts.push({
         archivedAt: now,
@@ -1781,19 +1770,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join8(this.baseDir, "receipt-archive.json");
+    return join7(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join8(this.baseDir, "receipt-archive.enc.json");
+    return join7(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync8(this.plaintextFilePath)) {
-      mkdirSync6(this.baseDir, { recursive: true });
+    if (!existsSync7(this.plaintextFilePath)) {
+      mkdirSync5(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync9(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync8(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1803,18 +1792,18 @@ var ReceiptArchive = class {
     } catch {
       console.error(`[ReceiptArchive] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
       try {
-        writeFileSync6(
+        writeFileSync5(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync9(this.plaintextFilePath)
+          readFileSync8(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync8(this.encryptedFilePath)) return;
+    if (!existsSync7(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync9(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync8(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1826,9 +1815,9 @@ var ReceiptArchive = class {
     } catch (err) {
       console.error(`[ReceiptArchive] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
       try {
-        writeFileSync6(
+        writeFileSync5(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync9(this.encryptedFilePath)
+          readFileSync8(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1842,29 +1831,29 @@ var ReceiptArchive = class {
     }
   }
   persistPlaintext() {
-    mkdirSync6(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync6(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
       version: 1,
       blob: this.encrypt(JSON.stringify(this.data))
     };
-    mkdirSync6(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync6(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-journal.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7, existsSync as existsSync9, renameSync } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync8, renameSync } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname7, join as join9 } from "path";
-import { createHash as createHash3 } from "crypto";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join9(homedir5(), ".suveren");
+import { dirname as dirname6, join as join8 } from "path";
+import { createHash as createHash2 } from "crypto";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
 var FILE_NAME = "execution-journal.json";
 var MAX_AGE_SECONDS2 = 90 * 24 * 60 * 60;
 function hashToolArgs(args) {
-  return "sha256:" + createHash3("sha256").update(stableStringify(args)).digest("hex");
+  return "sha256:" + createHash2("sha256").update(stableStringify(args)).digest("hex");
 }
 function stableStringify(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
@@ -1876,8 +1865,8 @@ function stableStringify(value) {
 var ExecutionJournal = class {
   filePath;
   constructor(filePath) {
-    const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR5;
-    this.filePath = join9(baseDir, FILE_NAME);
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname6(filePath) : filePath ?? DEFAULT_DIR5;
+    this.filePath = join8(baseDir, FILE_NAME);
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
@@ -1916,9 +1905,9 @@ var ExecutionJournal = class {
   }
   // ─── Persistence ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync8(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync10(this.filePath, "utf8"));
+      const parsed = JSON.parse(readFileSync9(this.filePath, "utf8"));
       if (parsed?.version !== 1 || !Array.isArray(parsed.entries)) {
         throw new Error("unexpected shape");
       }
@@ -1932,9 +1921,9 @@ var ExecutionJournal = class {
   persist(file) {
     const cutoff = nowSec() - MAX_AGE_SECONDS2;
     file.entries = file.entries.filter((e) => e.startedAt >= cutoff);
-    mkdirSync7(dirname7(this.filePath), { recursive: true, mode: 448 });
+    mkdirSync6(dirname6(this.filePath), { recursive: true, mode: 448 });
     const tmp = this.filePath + ".tmp";
-    writeFileSync7(tmp, JSON.stringify(file, null, 2), { mode: 384 });
+    writeFileSync6(tmp, JSON.stringify(file, null, 2), { mode: 384 });
     renameSync(tmp, this.filePath);
   }
 };
@@ -1943,10 +1932,10 @@ function nowSec() {
 }
 
 // src/lib/proposal-submission-store.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync10, renameSync as renameSync2 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7, existsSync as existsSync9, renameSync as renameSync2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname8, join as join10 } from "path";
-var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join10(homedir6(), ".suveren");
+import { dirname as dirname7, join as join9 } from "path";
+var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
 var FILE_NAME2 = "proposal-submissions.json";
 var MAX_AGE_SECONDS3 = 90 * 24 * 60 * 60;
 function nowSec2() {
@@ -1955,8 +1944,8 @@ function nowSec2() {
 var ProposalSubmissionStore = class {
   filePath;
   constructor(filePath) {
-    const baseDir = filePath && filePath.endsWith(".json") ? dirname8(filePath) : filePath ?? DEFAULT_DIR6;
-    this.filePath = join10(baseDir, FILE_NAME2);
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR6;
+    this.filePath = join9(baseDir, FILE_NAME2);
   }
   /** Record what was submitted, right after a successful submitProposal(). */
   record(entry) {
@@ -1979,9 +1968,9 @@ var ProposalSubmissionStore = class {
     return this.load().entries.find((e) => e.proposalId === proposalId);
   }
   load() {
-    if (!existsSync10(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync11(this.filePath, "utf-8"));
+      const parsed = JSON.parse(readFileSync10(this.filePath, "utf-8"));
       const cutoff = nowSec2() - MAX_AGE_SECONDS3;
       parsed.entries = (parsed.entries ?? []).filter((e) => e.submittedAt >= cutoff);
       return parsed;
@@ -1990,9 +1979,9 @@ var ProposalSubmissionStore = class {
     }
   }
   persist(file) {
-    mkdirSync8(dirname8(this.filePath), { recursive: true, mode: 448 });
+    mkdirSync7(dirname7(this.filePath), { recursive: true, mode: 448 });
     const tmpPath = `${this.filePath}.tmp`;
-    writeFileSync8(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
+    writeFileSync7(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
     renameSync2(tmpPath, this.filePath);
   }
 };
@@ -2088,6 +2077,647 @@ var MCPGatekeeper = class {
   }
 };
 
+// src/lib/report/report-store.ts
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync10, unlinkSync as unlinkSync5 } from "fs";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname8, join as join10 } from "path";
+import { createCipheriv as createCipheriv5, createDecipheriv as createDecipheriv5, randomBytes as randomBytes5 } from "crypto";
+
+// src/lib/report-brief.ts
+var REPORT_ELEMENTS = [
+  "sv-ticket",
+  "sv-approval",
+  "sv-mandate",
+  "sv-record",
+  "sv-case",
+  "sv-metric"
+];
+var REPORT_BRIEF = `How to write the report
+
+Purpose: show the company's management what the AI achieved in this test \u2014 case by case, from the request that started it to the goal that completed it \u2014 with proof for every fact that matters.
+
+Who reads it: managers who are not technical. Plain words, short sentences, the result first.
+
+What you write: one HTML page (HTML, CSS and inline SVG only \u2014 no JavaScript, no external files or links except the check links the gateway adds). The layout, headings, charts, tables and your assessment are yours.
+
+It must read well everywhere: on a phone, in a narrow side panel (about 360 pixels wide) and on a large screen. Use fluid widths (no fixed page widths), let columns stack on narrow screens (CSS grid/flex with wrapping, or media queries), make wide tables scroll horizontally or turn into stacked rows, give SVG charts a viewBox so they scale, and keep text at a readable size.
+
+What you cannot write yourself: facts that need proof. Place these elements instead; the gateway looks the data up, checks it and draws the element. You give references, never the content:
+
+- <sv-ticket ref="TICKET_ID"></sv-ticket> \u2014 one action you took, with its signed ticket.
+- <sv-approval ticket="TICKET_ID"></sv-approval> \u2014 who approved that action, when, and how long it waited.
+- <sv-mandate ticket="TICKET_ID"></sv-mandate> \u2014 the authority the action ran under: limits, mode, intent.
+- <sv-record system="email|crm|erp" ref="RECORD_ID"></sv-record> \u2014 an email, CRM entry, quote or order.
+- <sv-case start="email:MESSAGE_ID" goal="ticket:TICKET_ID" steps="TICKET_ID TICKET_ID"></sv-case> \u2014 one business case: the incoming email that started it, the ticket that completed it, and the tickets in between.
+- <sv-metric kind="KIND" cases="all"></sv-metric> \u2014 a number the gateway computes over the cases you defined. KIND: completed, median-time, average-time, without-approval, approvals, median-approval-wait, tickets, refusals. cases is "all" or a space-separated list of case ids, e.g. cases="C1 C3".
+
+Rules:
+1. Define every case you worked on with sv-case \u2014 also the ones that did not reach their goal (omit goal, or say why in your text). The gateway shows management how many of the loaded cases your report covers and names the missing ones \u2014 and lists every ticket from the test period that your report does not reference, so name every step.
+2. Use sv-metric for every headline number. Numbers you compute yourself are shown as "AI analysis \u2014 not verified".
+3. A case's goal must be what actually completed it \u2014 for an email reply, the reply to the start email. The gateway checks this link.
+4. A wrong or unknown reference is shown as "not verifiable". Do not guess IDs \u2014 read them first.
+5. Never claim more than the elements prove. Say plainly what went wrong or waited for a person.
+
+Suggested structure:
+1. The result in one sentence, then 3\u20134 sv-metric figures (completed, median time, share without approval, approvals).
+2. All cases at a glance \u2014 a table with one row per case, linked to its sv-case below.
+3. Each case: sv-case, then the sv-ticket and sv-approval elements that explain it.
+4. What was stopped or needed a person, and why (sv-approval, refusals).
+5. Your assessment: what worked, what slowed things down, what a different mandate would change \u2014 marked as your view.
+
+Update the report whenever cases progress; each write replaces the previous report.`;
+
+// src/lib/report/sanitize.ts
+import sanitizeHtmlLib from "sanitize-html";
+var FORBIDDEN_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "link"]);
+function isUrlAttribute(name) {
+  const n = name.toLowerCase();
+  return n === "href" || n === "src" || n === "xlink:href" || n.endsWith(":href");
+}
+function isAllowedUrl(value) {
+  const v = value.trim();
+  if (v.startsWith("#")) return true;
+  if (/^data:image\//i.test(v)) return true;
+  return false;
+}
+function sanitizeReportHtml(html) {
+  return sanitizeHtmlLib(html, {
+    // Allow every tag/attribute by default — see module doc comment for why
+    // this is deny-by-name rather than allow-by-name. `transformTags['*']`
+    // below is then the ONLY attribute filter (allowedAttributes: false
+    // skips sanitize-html's own, so there is exactly one place attributes
+    // are decided, not two that could disagree). Logs a harmless warning for
+    // "script"/"style" on every call (sanitize-html's own vulnerable-tag
+    // notice, fired from its internal tag list even though we pass `false`,
+    // not an array containing them) — `allowVulnerableTags` is the
+    // documented way to accept that, and <script> is still removed, by
+    // `exclusiveFilter` below, regardless of this flag.
+    allowedTags: false,
+    allowedAttributes: false,
+    allowVulnerableTags: true,
+    // sanitize-html's OWN scheme check (independent of transformTags, and
+    // applied to it/src/cite only — NOT xlink:href, which is why the
+    // transformTags filter above is the one actually relied on for SVG) uses
+    // this list; it has no "data" scheme by default, which would undo our
+    // own decision to keep `data:image/*` sources. Nothing wider is opened:
+    // transformTags has already removed every href/src that isn't a
+    // fragment link or a data:image/* URI by the time this check runs.
+    allowedSchemes: [...sanitizeHtmlLib.defaults.allowedSchemes, "data"],
+    // Preserve attribute name casing — inline SVG uses camelCase attributes
+    // (viewBox, preserveAspectRatio, …) that lowercasing would silently
+    // break. Safe for the `on*`/url checks below: both compare case-folded.
+    parser: { lowerCaseAttributeNames: false },
+    // Removes the named tag AND all of its children/text — the only correct
+    // behaviour for <script>: dropping just the tag would leave its JS as
+    // visible text, but the content must not survive either.
+    exclusiveFilter: (frame) => {
+      const tag = frame.tag.toLowerCase();
+      if (FORBIDDEN_TAGS.has(tag)) return true;
+      if (tag === "meta" && Object.keys(frame.attribs).some((a) => a.toLowerCase() === "http-equiv")) {
+        return true;
+      }
+      return false;
+    },
+    transformTags: {
+      "*": (tagName, attribs) => {
+        const kept = {};
+        for (const [name, value] of Object.entries(attribs)) {
+          if (name.toLowerCase().startsWith("on")) continue;
+          if (isUrlAttribute(name) && !isAllowedUrl(value)) continue;
+          kept[name] = value;
+        }
+        return { tagName, attribs: kept };
+      }
+    }
+  });
+}
+
+// src/lib/report/record-resolvers.ts
+function findById(rows, id) {
+  return rows.find((r) => r.id === id);
+}
+function resolveEmailRecord(exportData, ref) {
+  const inInbox = findById(exportData.inbox, ref);
+  if (inInbox) return { status: "verified", data: { kind: "message", folder: "inbox", ...inInbox } };
+  const inSent = findById(exportData.sent, ref);
+  if (inSent) return { status: "verified", data: { kind: "message", folder: "sent", ...inSent } };
+  const change = findById(exportData.changes, ref);
+  if (change) return { status: "verified", data: { kind: "change", causingReceiptId: change.receipt_id ?? null, ...change } };
+  const refusal = findById(exportData.refusals, ref);
+  if (refusal) return { status: "verified", data: { kind: "refusal", ...refusal } };
+  return { status: "unverifiable", reason: `No email record "${ref}" in the simulator export.` };
+}
+function resolveErpRecord(exportData, ref) {
+  const quote = findById(exportData.quotes, ref) ?? exportData.quotes.find((q) => q.number === ref);
+  if (quote) return { status: "verified", data: { kind: "quote", ...quote } };
+  const order = findById(exportData.orders, ref) ?? exportData.orders.find((o) => o.number === ref);
+  if (order) return { status: "verified", data: { kind: "order", ...order } };
+  const change = findById(exportData.changes, ref);
+  if (change) return { status: "verified", data: { kind: "change", causingReceiptId: change.receipt_id ?? null, ...change } };
+  const refusal = findById(exportData.refusals, ref);
+  if (refusal) return { status: "verified", data: { kind: "refusal", ...refusal } };
+  return { status: "unverifiable", reason: `No ERP record "${ref}" in the simulator export.` };
+}
+function resolveCrmRecord(exportData, ref) {
+  for (const [kind, rows] of [
+    ["contact", exportData.contacts],
+    ["deal", exportData.deals],
+    ["task", exportData.tasks],
+    ["activity", exportData.activities]
+  ]) {
+    const row = findById(rows, ref);
+    if (row) return { status: "verified", data: { kind, ...row } };
+  }
+  const change = findById(exportData.changes, ref);
+  if (change) return { status: "verified", data: { kind: "change", causingReceiptId: change.receipt_id ?? null, ...change } };
+  const refusal = findById(exportData.refusals, ref);
+  if (refusal) return { status: "verified", data: { kind: "refusal", ...refusal } };
+  return { status: "unverifiable", reason: `No CRM record "${ref}" in the simulator export.` };
+}
+function resolveRecord(system, exportData, ref) {
+  if (system === "email") return resolveEmailRecord(exportData, ref);
+  if (system === "erp") return resolveErpRecord(exportData, ref);
+  return resolveCrmRecord(exportData, ref);
+}
+
+// src/lib/report/metric-resolvers.ts
+var METRIC_KINDS = [
+  "completed",
+  "median-time",
+  "average-time",
+  "without-approval",
+  "approvals",
+  "median-approval-wait",
+  "tickets",
+  "refusals"
+];
+var UnknownMetricKindError = class extends Error {
+  constructor(kind) {
+    super(`Unknown sv-metric kind "${kind}" \u2014 expected one of: ${METRIC_KINDS.join(", ")}.`);
+    this.name = "UnknownMetricKindError";
+  }
+};
+function median(values) {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const mid = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ? (sorted[mid - 1] + sorted[mid]) / 2 : sorted[mid];
+}
+function average(values) {
+  if (values.length === 0) return 0;
+  return values.reduce((a, b) => a + b, 0) / values.length;
+}
+function computeMetric(kind, cases, refusalTimes = []) {
+  switch (kind) {
+    case "completed":
+      return cases.length;
+    case "median-time":
+      return median(cases.map((c) => c.totalDurationSeconds));
+    case "average-time":
+      return average(cases.map((c) => c.totalDurationSeconds));
+    case "without-approval": {
+      if (cases.length === 0) return 0;
+      const withoutApproval = cases.filter((c) => c.approvals.length === 0).length;
+      return withoutApproval / cases.length;
+    }
+    case "approvals":
+      return cases.reduce((sum, c) => sum + c.approvals.length, 0);
+    case "median-approval-wait":
+      return median(cases.flatMap((c) => c.approvals.map((a) => a.waitSeconds).filter((w) => typeof w === "number")));
+    case "tickets": {
+      const ids = new Set(cases.flatMap((c) => c.ticketIds));
+      return ids.size;
+    }
+    case "refusals":
+      return cases.reduce(
+        (sum, c) => sum + refusalTimes.filter((t) => t >= c.startTime && t <= c.goalTime).length,
+        0
+      );
+    default:
+      throw new UnknownMetricKindError(kind);
+  }
+}
+
+// src/lib/report/types.ts
+function isEmailExport(v) {
+  const o = v;
+  return !!o && Array.isArray(o.inbox) && Array.isArray(o.sent) && Array.isArray(o.changes) && Array.isArray(o.refusals);
+}
+function isErpExport(v) {
+  const o = v;
+  return !!o && Array.isArray(o.quotes) && Array.isArray(o.orders) && Array.isArray(o.changes) && Array.isArray(o.refusals);
+}
+function isCrmExport(v) {
+  const o = v;
+  return !!o && Array.isArray(o.contacts) && Array.isArray(o.deals) && Array.isArray(o.changes) && Array.isArray(o.refusals);
+}
+
+// src/lib/report/verify-report.ts
+var KNOWN_KINDS = new Set(REPORT_ELEMENTS);
+async function verifyReport(html, sources) {
+  const sanitized = sanitizeReportHtml(html);
+  const parsed = parseElements(sanitized);
+  const exportCache = /* @__PURE__ */ new Map();
+  function getExport(system) {
+    let p = exportCache.get(system);
+    if (!p) {
+      p = sources.runExport(system).then(
+        (data) => ({ ok: true, data }),
+        (err) => ({ ok: false, reason: err instanceof Error ? err.message : String(err) })
+      );
+      exportCache.set(system, p);
+    }
+    return p;
+  }
+  const elements = [];
+  const caseElements = [];
+  const metricParsed = [];
+  async function resolveOne(p) {
+    try {
+      switch (p.kind) {
+        case "sv-ticket": {
+          const r = await resolveTicketElement(sources.archive, p.attrs.ref ?? "");
+          return { id: p.id, kind: p.kind, attrs: p.attrs, ...r };
+        }
+        case "sv-approval": {
+          const r = await resolveApprovalElement(sources.archive, p.attrs.ticket ?? "");
+          return { id: p.id, kind: p.kind, attrs: p.attrs, ...r };
+        }
+        case "sv-mandate": {
+          const r = await resolveMandateElement(sources.archive, p.attrs.ticket ?? "");
+          return { id: p.id, kind: p.kind, attrs: p.attrs, ...r };
+        }
+        case "sv-record": {
+          const system = p.attrs.system;
+          if (system !== "email" && system !== "crm" && system !== "erp") {
+            return { id: p.id, kind: p.kind, attrs: p.attrs, status: "unverifiable", reason: `Unknown system "${p.attrs.system ?? ""}".` };
+          }
+          const exp = await getExport(system);
+          if (!exp.ok) {
+            return { id: p.id, kind: p.kind, attrs: p.attrs, status: "unverifiable", reason: `Could not read the ${system} simulator export: ${exp.reason}` };
+          }
+          const r = resolveRecord(system, exp.data, p.attrs.ref ?? "");
+          return { id: p.id, kind: p.kind, attrs: p.attrs, ...r };
+        }
+        case "sv-case": {
+          const exp = await getExport("email");
+          if (!exp.ok || !isEmailExport(exp.data)) {
+            return {
+              id: p.id,
+              kind: p.kind,
+              attrs: p.attrs,
+              status: "unverifiable",
+              reason: `Could not read the email simulator export: ${!exp.ok ? exp.reason : "unexpected shape"}`
+            };
+          }
+          const resolution = await resolveCaseElement(sources.archive, exp.data, p.attrs);
+          const el = {
+            id: p.id,
+            kind: p.kind,
+            attrs: p.attrs,
+            status: resolution.status,
+            ...resolution.reason ? { reason: resolution.reason } : {},
+            ...resolution.data ? { data: resolution.data } : {}
+          };
+          caseElements.push({ el, resolution });
+          return el;
+        }
+        default:
+          return { id: p.id, kind: p.kind, attrs: p.attrs, status: "unverifiable", reason: "Unhandled element kind." };
+      }
+    } catch (err) {
+      return { id: p.id, kind: p.kind, attrs: p.attrs, status: "unverifiable", reason: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  for (const p of parsed) {
+    if (!KNOWN_KINDS.has(p.kind)) {
+      elements.push({
+        id: p.id,
+        kind: p.kind,
+        attrs: p.attrs,
+        status: "unverifiable",
+        reason: `Unknown element "${p.kind}" \u2014 not one of the six elements report-brief.ts defines.`
+      });
+      continue;
+    }
+    if (p.kind === "sv-metric") {
+      metricParsed.push(p);
+      continue;
+    }
+    elements.push(await resolveOne(p));
+  }
+  for (const p of metricParsed) {
+    try {
+      const kind = p.attrs.kind ?? "";
+      const casesAttr = (p.attrs.cases ?? "all").trim();
+      const requestedCount = casesAttr === "all" ? caseElements.length : new Set(casesAttr.split(/\s+/).filter(Boolean)).size;
+      let selected = caseElements.filter((c) => c.resolution.status !== "unverifiable" && c.resolution.data);
+      if (casesAttr !== "all") {
+        const wanted = new Set(casesAttr.split(/\s+/).filter(Boolean));
+        selected = selected.filter((c) => wanted.has(c.resolution.data.caseId));
+      }
+      const caseInputs = selected.map((c) => ({
+        caseId: c.resolution.data.caseId,
+        startTime: c.resolution.data.start.time,
+        goalTime: c.resolution.data.goal.time,
+        totalDurationSeconds: c.resolution.data.totalDurationSeconds,
+        ticketIds: [c.resolution.data.goal.ticketId, ...c.resolution.data.steps.map((s) => s.ticketId)],
+        approvals: c.resolution.data.approvals
+      }));
+      const verifiedCount = caseInputs.length;
+      if (verifiedCount === 0) {
+        elements.push({
+          id: p.id,
+          kind: p.kind,
+          attrs: p.attrs,
+          status: "unverifiable",
+          reason: requestedCount > 0 ? `No verified cases (0 of ${requestedCount} requested) \u2014 no figure.` : "No verified cases \u2014 no figure."
+        });
+        continue;
+      }
+      const refusalTimes = kind === "refusals" ? await collectRefusalTimes(getExport) : [];
+      const value = computeMetric(kind, caseInputs, refusalTimes);
+      const data = { kind, cases: casesAttr, value, caseCount: verifiedCount };
+      if (verifiedCount < requestedCount) {
+        elements.push({
+          id: p.id,
+          kind: p.kind,
+          attrs: p.attrs,
+          status: "warning",
+          reason: `Computed over ${verifiedCount} of ${requestedCount} requested cases \u2014 the rest did not verify.`,
+          data
+        });
+      } else {
+        elements.push({ id: p.id, kind: p.kind, attrs: p.attrs, status: "verified", data });
+      }
+    } catch (err) {
+      elements.push({ id: p.id, kind: p.kind, attrs: p.attrs, status: "unverifiable", reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  const proof = buildProof(elements, caseElements);
+  const coverage = await buildCoverage(caseElements, getExport, sources.archive, proof.ticketsReferenced);
+  return { html: sanitized, elements, proof, coverage };
+}
+async function collectRefusalTimes(getExport) {
+  const times = [];
+  for (const system of ["email", "crm", "erp"]) {
+    const exp = await getExport(system);
+    if (!exp.ok) throw new Error(`Could not read the ${system} simulator export: ${exp.reason}`);
+    const refusals = exp.data.refusals ?? [];
+    for (const r of refusals) {
+      const t = parseTimestampSeconds(r.at);
+      if (t !== void 0) times.push(t);
+    }
+  }
+  return times;
+}
+function summarize(el) {
+  const d = el.data ?? {};
+  switch (el.kind) {
+    case "sv-ticket": {
+      const actionLabel = typeof d.actionLabel === "string" ? d.actionLabel : formatActionLabel(d.action);
+      const timeLabel = typeof d.timeLabel === "string" ? d.timeLabel : formatDateTime(d.time);
+      return `${actionLabel} \u2014 ${timeLabel}`;
+    }
+    case "sv-approval": {
+      const who = typeof d.whoLabel === "string" ? d.whoLabel : d.who?.join(", ") ?? "unknown";
+      const waitLabel = typeof d.waitLabel === "string" ? d.waitLabel : typeof d.waitSeconds === "number" ? formatDuration(d.waitSeconds) : "unknown";
+      return `Approval by ${who} \u2014 waited ${waitLabel}`;
+    }
+    case "sv-mandate": {
+      const profileLabel = typeof d.profileLabel === "string" ? d.profileLabel : profileShortLabel(typeof d.profile === "string" ? d.profile : void 0);
+      const owners = Array.isArray(d.owners) && d.owners.length > 0 ? d.owners.join(", ") : "unknown owner";
+      return `Mandate: ${profileLabel} \xB7 ${owners}`;
+    }
+    case "sv-record":
+      return `${String(d.kind ?? "record")} record checked`;
+    case "sv-case": {
+      const steps = d.steps?.length ?? 0;
+      return `Case ${String(d.caseId)}: ${steps} ${steps === 1 ? "step" : "steps"}, ${formatDuration(d.totalDurationSeconds)}`;
+    }
+    case "sv-metric": {
+      const kind = String(d.kind ?? "");
+      const label = METRIC_LABELS[kind] ?? kind;
+      return `${label} = ${formatMetricValue(kind, d.value)}`;
+    }
+    default:
+      return el.id;
+  }
+}
+function buildProof(elements, caseElements) {
+  const ticketsReferenced = /* @__PURE__ */ new Set();
+  const signaturesValid = /* @__PURE__ */ new Set();
+  let recordsChecked = 0;
+  let unverifiableCount = 0;
+  const verifiedValues = [];
+  for (const el of elements) {
+    if (el.status === "unverifiable") unverifiableCount++;
+    if (el.status === "verified" || el.status === "warning") {
+      verifiedValues.push({ elementId: el.id, kind: el.kind, summary: summarize(el) });
+    }
+    if (el.kind === "sv-ticket" && el.attrs.ref) {
+      ticketsReferenced.add(el.attrs.ref);
+      if (el.status !== "unverifiable") signaturesValid.add(el.attrs.ref);
+    }
+    if ((el.kind === "sv-approval" || el.kind === "sv-mandate") && el.attrs.ticket) {
+      ticketsReferenced.add(el.attrs.ticket);
+      if (el.status !== "unverifiable") signaturesValid.add(el.attrs.ticket);
+    }
+    if (el.kind === "sv-record" && el.status === "verified") {
+      recordsChecked++;
+    }
+  }
+  for (const { el, resolution } of caseElements) {
+    const { goalId, stepIds } = parseCaseAttrs(el.attrs);
+    for (const id of [goalId, ...stepIds]) {
+      if (!id) continue;
+      ticketsReferenced.add(id);
+      if (resolution.status !== "unverifiable") signaturesValid.add(id);
+    }
+  }
+  return {
+    ticketsReferenced: [...ticketsReferenced],
+    signaturesValid: signaturesValid.size,
+    recordsChecked,
+    unverifiableCount,
+    verifiedValues
+  };
+}
+async function buildCoverage(caseElements, getExport, archive, referenced) {
+  const exp = await getExport("email");
+  const emailExportError = !exp.ok ? exp.reason : !isEmailExport(exp.data) ? "Email simulator export had an unexpected shape." : void 0;
+  const loadedCases = exp.ok && isEmailExport(exp.data) ? [...new Set(exp.data.inbox.map((m) => m.case_id).filter((c) => !!c))] : [];
+  const covered = new Set(
+    caseElements.map((c) => c.resolution.startCaseId).filter((c) => !!c)
+  );
+  const coveredCases = loadedCases.filter((c) => covered.has(c));
+  const missingCases = loadedCases.filter((c) => !covered.has(c));
+  const loadedAt = exp.ok && isEmailExport(exp.data) ? exp.data.simulation_load?.loaded_at : void 0;
+  const periodStart = loadedAt !== void 0 ? parseTimestampSeconds(loadedAt) ?? null : null;
+  const inPeriod = archive.getReceipts().map((r) => ({ id: String(r.receipt.id ?? ""), time: Number(r.receipt.timestamp ?? r.archivedAt) })).filter((t) => t.id && (periodStart === null || t.time >= periodStart)).sort((a, b) => a.time - b.time).map((t) => t.id);
+  const referencedSet = new Set(referenced);
+  const ticketsReferenced = inPeriod.filter((id) => referencedSet.has(id));
+  const ticketsNotReferenced = inPeriod.filter((id) => !referencedSet.has(id));
+  return {
+    ...emailExportError ? { emailExportError } : {},
+    loadedCases,
+    coveredCases,
+    missingCases,
+    periodStart,
+    ticketsInPeriod: inPeriod,
+    ticketsReferenced,
+    ticketsNotReferenced
+  };
+}
+
+// src/lib/report/report-store.ts
+var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join10(homedir7(), ".suveren");
+var ReportStore = class {
+  report = null;
+  baseDir;
+  vaultKey = null;
+  constructor(filePath) {
+    if (filePath && filePath.endsWith(".json")) {
+      this.baseDir = dirname8(filePath);
+    } else {
+      this.baseDir = filePath ?? DEFAULT_DIR7;
+    }
+    this.loadPlaintext();
+  }
+  /** Set the vault key for encryption. Triggers migration from plaintext if needed. */
+  setVaultKey(key) {
+    this.vaultKey = key;
+    if (existsSync10(this.encryptedFilePath)) {
+      this.loadEncrypted();
+    } else if (this.report !== null) {
+      this.persistEncrypted();
+      if (existsSync10(this.plaintextFilePath)) {
+        try {
+          unlinkSync5(this.plaintextFilePath);
+        } catch {
+        }
+      }
+    }
+  }
+  /**
+   * True when encrypted evidence exists on disk that this process cannot
+   * read yet (no vault key). Callers MUST NOT present the store as "no
+   * report yet" in this state — that would claim a different fact than
+   * "the report exists but is locked".
+   */
+  isLocked() {
+    return this.vaultKey === null && existsSync10(this.encryptedFilePath);
+  }
+  /** The stored, already-verified report — or null if none has been saved
+   *  (and the store is not locked; check `isLocked()` first). */
+  getReport() {
+    return this.report;
+  }
+  /**
+   * Replace the current report with `html`, verifying it ONCE against
+   * `sources` before storing. Always replaces — there is only ever one
+   * current report (plan decision).
+   */
+  async saveReport(html, sources, now = Math.floor(Date.now() / 1e3)) {
+    const result = await verifyReport(html, sources);
+    this.report = { html: result.html, savedAt: now, checkedAt: now, result };
+    this.persist();
+    return this.report;
+  }
+  /**
+   * Re-run verification against the CURRENTLY stored report's html — "Check
+   * again" in the UI. Does not change `savedAt` (the AI did not rewrite
+   * anything); only `checkedAt` and `result` move. Returns null if there is
+   * no report to recheck.
+   */
+  async recheck(sources, now = Math.floor(Date.now() / 1e3)) {
+    if (!this.report) return null;
+    const result = await verifyReport(this.report.html, sources);
+    this.report = { ...this.report, checkedAt: now, result };
+    this.persist();
+    return this.report;
+  }
+  // ─── Encryption helpers ─────────────────────────────────────────────────
+  encrypt(plaintext) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const iv = randomBytes5(12);
+    const cipher = createCipheriv5("aes-256-gcm", this.vaultKey, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return { iv: iv.toString("hex"), ciphertext: encrypted.toString("hex"), tag: tag.toString("hex") };
+  }
+  decrypt(blob) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const decipher = createDecipheriv5("aes-256-gcm", this.vaultKey, Buffer.from(blob.iv, "hex"));
+    decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
+    const decrypted = Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]);
+    return decrypted.toString("utf8");
+  }
+  // ─── File paths ─────────────────────────────────────────────────────────
+  get plaintextFilePath() {
+    return join10(this.baseDir, "report.json");
+  }
+  get encryptedFilePath() {
+    return join10(this.baseDir, "report.enc.json");
+  }
+  // ─── Load / Persist ─────────────────────────────────────────────────────
+  loadPlaintext() {
+    if (!existsSync10(this.plaintextFilePath)) {
+      mkdirSync8(this.baseDir, { recursive: true });
+      return;
+    }
+    try {
+      const raw = readFileSync11(this.plaintextFilePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      this.report = parsed.report ?? null;
+    } catch {
+      console.error(`[ReportStore] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
+      try {
+        writeFileSync8(`${this.plaintextFilePath}.corrupt-${Date.now()}`, readFileSync11(this.plaintextFilePath));
+      } catch {
+      }
+      this.report = null;
+    }
+  }
+  loadEncrypted() {
+    if (!existsSync10(this.encryptedFilePath)) return;
+    try {
+      const raw = readFileSync11(this.encryptedFilePath, "utf-8");
+      const data = JSON.parse(raw);
+      const decrypted = this.decrypt(data.blob);
+      const parsed = JSON.parse(decrypted);
+      this.report = parsed.report ?? null;
+    } catch (err) {
+      console.error(`[ReportStore] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
+      try {
+        writeFileSync8(`${this.encryptedFilePath}.corrupt-${Date.now()}`, readFileSync11(this.encryptedFilePath));
+      } catch {
+      }
+      this.report = null;
+    }
+  }
+  persist() {
+    if (this.vaultKey) {
+      this.persistEncrypted();
+    } else {
+      this.persistPlaintext();
+    }
+  }
+  persistPlaintext() {
+    const data = { version: 1, report: this.report };
+    mkdirSync8(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync8(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+  persistEncrypted() {
+    const data = {
+      version: 1,
+      blob: this.encrypt(JSON.stringify({ version: 1, report: this.report }))
+    };
+    mkdirSync8(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync8(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+};
+
 // src/lib/shared-state.ts
 var SharedState = class {
   spClient;
@@ -2096,6 +2726,9 @@ var SharedState = class {
   executionLog;
   denialLog;
   receiptArchive;
+  /** The one current evidence-backed report the user's AI has written —
+   *  see report/report-store.ts. Vault-encrypted, like the stores above. */
+  reportStore;
   /** Which tickets this Gatekeeper has executed — the "one execution per ticket" half of exactly-once. */
   executionJournal;
   /** What THIS gateway submitted for each review-mode proposal it created —
@@ -2116,6 +2749,7 @@ var SharedState = class {
     this.executionLog = new ExecutionLog(gateStorePath);
     this.denialLog = new DenialLog(gateStorePath);
     this.receiptArchive = new ReceiptArchive(gateStorePath);
+    this.reportStore = new ReportStore(gateStorePath);
     this.executionJournal = new ExecutionJournal(gateStorePath);
     this.proposalSubmissions = new ProposalSubmissionStore(gateStorePath);
     this.gatekeeper = new MCPGatekeeper(this.cache);
@@ -2271,12 +2905,12 @@ function formatConsumptionFull(entries) {
 
 // src/lib/context-loader.ts
 import { readFileSync as readFileSync12, existsSync as existsSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9, renameSync as renameSync3 } from "fs";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { join as join11, dirname as dirname9 } from "path";
-var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
+var DEFAULT_DIR8 = process.env.SUVEREN_DATA_DIR ?? join11(homedir8(), ".suveren");
 var CONTEXT_MAX_BYTES = 16 * 1024;
 function contextFilePath(dataDir2) {
-  return join11(dataDir2 ?? DEFAULT_DIR7, "context.md");
+  return join11(dataDir2 ?? DEFAULT_DIR8, "context.md");
 }
 function writeContextFile(content, dataDir2) {
   const bytes = Buffer.byteLength(content, "utf-8");
@@ -2381,8 +3015,8 @@ var FOOTER_RE = /\n*(?:—|--) (?:Sent|Published) by (?:an AI agent|[^\n]+?'s AI
 function shouldAttachFooter() {
   return true;
 }
-function receiptUrl(receiptId) {
-  return `${AS_BASE}/r/${receiptId}`;
+function receiptUrl(receiptId2) {
+  return `${AS_BASE}/r/${receiptId2}`;
 }
 function verbForProfile(profile) {
   return profile === "publish" ? "Published" : "Sent";
@@ -2390,11 +3024,11 @@ function verbForProfile(profile) {
 function hapLine() {
   return `-- ${OPERATOR_NAME} implements HAP, the open Human Agency Protocol: ${HAP_URL}`;
 }
-function footerText(receiptId, verb, subject) {
+function footerText(receiptId2, verb, subject) {
   const identity = deriveIdentityLine(subject, { operatorName: OPERATOR_NAME }).replace(/^Sent\b/, verb);
   return `
 
--- ${identity}. Receipt: ${receiptUrl(receiptId)}
+-- ${identity}. Receipt: ${receiptUrl(receiptId2)}
 
 ${hapLine()}`;
 }
@@ -2413,13 +3047,13 @@ function detectContentField(tool) {
 function stripFooter(value) {
   return value.replace(FOOTER_RE, "").replace(/\n+$/, "");
 }
-function appendVerificationFooter(tool, args, receiptId, subject) {
+function appendVerificationFooter(tool, args, receiptId2, subject) {
   const profile = tool.gating?.profile;
   if (!profile || !FOOTER_PROFILES.has(profile)) return args;
   const field = detectContentField(tool);
   if (!field) return args;
   const current = typeof args[field] === "string" ? args[field] : "";
-  return { ...args, [field]: stripFooter(current) + footerText(receiptId, verbForProfile(profile), subject) };
+  return { ...args, [field]: stripFooter(current) + footerText(receiptId2, verbForProfile(profile), subject) };
 }
 
 // src/lib/content-binding.ts
@@ -2472,10 +3106,10 @@ function computeContentBinding(profileId, tool, toolArgs, actionType) {
     boundContent
   };
 }
-function attachReceiptId(tool, args, receiptId) {
+function attachReceiptId(tool, args, receiptId2) {
   const schema = tool.inputSchema;
   if (!schema?.properties || !("receipt_id" in schema.properties)) return args;
-  return { ...args, receipt_id: receiptId };
+  return { ...args, receipt_id: receiptId2 };
 }
 
 // src/lib/ticket-verify.ts
@@ -3365,7 +3999,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           };
         }
       }
-      let receiptId;
+      let receiptId2;
       try {
         const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, args, actionType);
@@ -3387,7 +4021,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           // field by field rather than spread.
           ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
         });
-        receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+        receiptId2 = typeof receipt?.id === "string" ? receipt.id : void 0;
         await verifyTicket(state2.cache, receipt, {
           action: tool.namespacedName,
           executionContext: { ...execution },
@@ -3541,12 +4175,12 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
         execution: { ...execution },
         timestamp: Math.floor(Date.now() / 1e3)
       });
-      let outgoingArgs = shouldAttachFooter() && receiptId ? appendVerificationFooter(tool, args, receiptId, auth.subjects?.[0]) : args;
-      if (receiptId) outgoingArgs = attachReceiptId(tool, outgoingArgs, receiptId);
+      let outgoingArgs = shouldAttachFooter() && receiptId2 ? appendVerificationFooter(tool, args, receiptId2, auth.subjects?.[0]) : args;
+      if (receiptId2) outgoingArgs = attachReceiptId(tool, outgoingArgs, receiptId2);
       outgoingArgs = encodeOutgoingArgs(tool, outgoingArgs);
-      if (receiptId) {
+      if (receiptId2) {
         const begun = state2.executionJournal.begin({
-          ticketId: receiptId,
+          ticketId: receiptId2,
           tool: tool.namespacedName,
           argsHash: hashToolArgs(args)
         });
@@ -3554,17 +4188,17 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
           return {
             content: [{
               type: "text",
-              text: `Blocked: ticket ${receiptId} was already used to execute ${tool.namespacedName} (state: ${begun.existing.state}). Not running it again.`
+              text: `Blocked: ticket ${receiptId2} was already used to execute ${tool.namespacedName} (state: ${begun.existing.state}). Not running it again.`
             }],
             isError: true
           };
         }
         try {
           const result = await integrationManager2.callTool(tool.integrationId, tool.originalName, outgoingArgs);
-          state2.executionJournal.complete(receiptId, "done");
+          state2.executionJournal.complete(receiptId2, "done");
           return result;
         } catch (err) {
-          state2.executionJournal.complete(receiptId, "failed");
+          state2.executionJournal.complete(receiptId2, "failed");
           throw err;
         }
       }
@@ -4045,7 +4679,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       };
     }
   }
-  let receiptId;
+  let receiptId2;
   let replayed = false;
   try {
     const binding = computeContentBinding(
@@ -4078,7 +4712,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       // this machine — see the archive call below.
       ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
     });
-    receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+    receiptId2 = typeof receipt?.id === "string" ? receipt.id : void 0;
     replayed = idempotent;
     await verifyTicket(state2.cache, receipt, {
       action: proposal.tool,
@@ -4133,14 +4767,14 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       isError: true
     };
   }
-  if (!receiptId) {
+  if (!receiptId2) {
     return {
       text: `Proposal ${proposal.id}: the ticket carries no id \u2014 refusing to execute an action that could not be recorded.`,
       isError: true
     };
   }
   const begun = state2.executionJournal.begin({
-    ticketId: receiptId,
+    ticketId: receiptId2,
     proposalId: proposal.id,
     tool: proposal.tool,
     argsHash: hashToolArgs(proposal.toolArgs)
@@ -4150,36 +4784,36 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     const when = new Date(prior.startedAt * 1e3).toISOString();
     if (prior.state === "done") {
       return {
-        text: `Proposal ${proposal.id} was already executed under ticket ${receiptId} at ${when}. Not running it again.`
+        text: `Proposal ${proposal.id} was already executed under ticket ${receiptId2} at ${when}. Not running it again.`
       };
     }
     return {
-      text: `Proposal ${proposal.id}: an execution under ticket ${receiptId} started at ${when} (pid ${prior.pid}) and ${prior.state === "failed" ? "reported failure" : "never reported completion"}. Not re-running: the action may already have taken effect. Check the downstream system before deciding.`,
+      text: `Proposal ${proposal.id}: an execution under ticket ${receiptId2} started at ${when} (pid ${prior.pid}) and ${prior.state === "failed" ? "reported failure" : "never reported completion"}. Not re-running: the action may already have taken effect. Check the downstream system before deciding.`,
       isError: true
     };
   }
   if (replayed) {
     console.error(
-      `[Suveren MCP] Proposal ${proposal.id}: ticket ${receiptId} was replayed by the AS with no local execution record \u2014 executing once (lost-response recovery).`
+      `[Suveren MCP] Proposal ${proposal.id}: ticket ${receiptId2} was replayed by the AS with no local execution record \u2014 executing once (lost-response recovery).`
     );
   }
   try {
     let outgoingArgs = proposal.toolArgs;
-    if (discovered && receiptId) {
+    if (discovered && receiptId2) {
       if (shouldAttachFooter()) {
-        outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId, cachedAuth?.subjects?.[0]);
+        outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId2, cachedAuth?.subjects?.[0]);
       }
-      outgoingArgs = attachReceiptId(discovered, outgoingArgs, receiptId);
+      outgoingArgs = attachReceiptId(discovered, outgoingArgs, receiptId2);
       outgoingArgs = encodeOutgoingArgs(discovered, outgoingArgs);
     }
     let result;
     try {
       result = await integrationManager2.callTool(integrationId, toolName, outgoingArgs);
     } catch (err) {
-      state2.executionJournal.complete(receiptId, "failed");
+      state2.executionJournal.complete(receiptId2, "failed");
       throw err;
     }
-    state2.executionJournal.complete(receiptId, "done");
+    state2.executionJournal.complete(receiptId2, "done");
     state2.executionLog.record({
       profileId: proposal.profileId,
       path: proposal.path,
@@ -4512,9 +5146,9 @@ function verifyGateContentHashes(content, auth) {
 
 // src/lib/integration-registry.ts
 import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync12 } from "fs";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 import { dirname as dirname10, join as join12 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join12(homedir8(), ".suveren");
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join12(homedir9(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
@@ -4591,7 +5225,7 @@ var IntegrationRegistry = class {
 };
 
 // src/lib/integration-manager.ts
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 import { join as join14, delimiter } from "path";
 import { existsSync as existsSync14, writeFileSync as writeFileSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync15, rmSync } from "fs";
 import { execFile } from "child_process";
@@ -4730,7 +5364,7 @@ function safeHost(url) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join14(homedir9(), ".suveren");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join14(homedir10(), ".suveren");
 var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join14(DEFAULT_DATA_DIR2, "integrations");
 var OFFLINE_MODE = process.env.SUVEREN_OFFLINE === "1";
 var installLock = Promise.resolve();
@@ -4740,6 +5374,9 @@ function withInstallLock(task) {
   return run;
 }
 var INTEGRATIONS_BIN = join14(INTEGRATIONS_DIR, "node_modules", ".bin");
+function getIntegrationsBinDir() {
+  return INTEGRATIONS_BIN;
+}
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
@@ -5561,6 +6198,420 @@ var IntegrationManager = class {
   }
 };
 
+// src/lib/report/connector-export.ts
+import { execFile as execFile2 } from "child_process";
+import { delimiter as delimiter2 } from "path";
+var DEFAULT_BIN_NAMES = {
+  email: "email-mcp",
+  crm: "crm-mcp",
+  erp: "erp-mcp"
+};
+var ConnectorExportError = class extends Error {
+  constructor(message, system, cause) {
+    super(message);
+    this.system = system;
+    this.cause = cause;
+    this.name = "ConnectorExportError";
+  }
+};
+function execFileAsync(command, args, options) {
+  return new Promise((resolve3, reject) => {
+    execFile2(command, args, options, (err, stdout, stderr) => {
+      if (err) reject(Object.assign(err, { stdout, stderr }));
+      else resolve3({ stdout, stderr });
+    });
+  });
+}
+function createConnectorExportRunner(config) {
+  return async (system) => {
+    const bin = config.binNames?.[system] ?? DEFAULT_BIN_NAMES[system];
+    const env = {
+      ...process.env,
+      PATH: [config.integrationsBinDir, process.env.PATH ?? ""].join(delimiter2),
+      HAP_DATA_DIR: config.dataDir
+    };
+    let stdout;
+    try {
+      const result = await execFileAsync(bin, ["export"], {
+        env,
+        timeout: config.timeoutMs ?? 15e3,
+        maxBuffer: 64 * 1024 * 1024,
+        shell: process.platform === "win32"
+      });
+      stdout = result.stdout;
+    } catch (err) {
+      throw new ConnectorExportError(
+        `${bin} export failed: ${err instanceof Error ? err.message : String(err)}`,
+        system,
+        err
+      );
+    }
+    try {
+      return JSON.parse(stdout);
+    } catch (err) {
+      throw new ConnectorExportError(
+        `${bin} export did not print valid JSON on stdout`,
+        system,
+        err
+      );
+    }
+  };
+}
+
+// src/lib/report/render-report.ts
+import { Parser } from "htmlparser2";
+function findElementSpans(html) {
+  const spans = [];
+  const seenCount = /* @__PURE__ */ new Map();
+  const openStack = [];
+  let parserRef;
+  const parser = new Parser(
+    {
+      onparserinit(p) {
+        parserRef = p;
+      },
+      onopentag(name) {
+        if (!name.startsWith("sv-") || !parserRef) return;
+        const n = seenCount.get(name) ?? 0;
+        seenCount.set(name, n + 1);
+        openStack.push({ tag: name, id: `${name}-${n}`, start: parserRef.startIndex });
+      },
+      onclosetag(name) {
+        if (!name.startsWith("sv-") || !parserRef) return;
+        const idx = [...openStack].reverse().findIndex((o) => o.tag === name);
+        if (idx === -1) return;
+        const realIdx = openStack.length - 1 - idx;
+        const [open] = openStack.splice(realIdx, 1);
+        spans.push({ id: open.id, kind: open.tag, start: open.start, end: parserRef.endIndex + 1 });
+      }
+    },
+    { decodeEntities: true, recognizeSelfClosing: true }
+  );
+  parser.write(html);
+  parser.end();
+  return spans.sort((a, b) => a.start - b.start);
+}
+function escapeHtml(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function detailLink(id, ticketId) {
+  const qs = ticketId ? `?element=${encodeURIComponent(id)}&ticket=${encodeURIComponent(ticketId)}` : `?element=${encodeURIComponent(id)}`;
+  return `/reports${qs}`;
+}
+function badge(status, okLabel) {
+  if (status === "verified") return `<span class="sv-badge sv-badge-ok">\u2713 ${escapeHtml(okLabel)}</span>`;
+  if (status === "warning") return `<span class="sv-badge sv-badge-warn">\u26A0 verified with a note</span>`;
+  return `<span class="sv-badge sv-badge-bad">\u2717 not verifiable</span>`;
+}
+function unverifiableCard(el) {
+  return `<div class="sv-el sv-el-unverifiable" data-sv-id="${escapeHtml(el.id)}"><div class="sv-el-row"><b>Not verifiable</b>${badge("unverifiable", "")}</div><div class="sv-el-reason">${escapeHtml(el.reason ?? "This reference could not be checked.")}</div></div>`;
+}
+function renderTicket(el, interactive) {
+  if (el.status === "unverifiable" || !el.data) return unverifiableCard(el);
+  const d = el.data;
+  const href = typeof d.checkUrl === "string" ? d.checkUrl : void 0;
+  const actionLabel = typeof d.actionLabel === "string" ? d.actionLabel : formatActionLabel(d.action);
+  const timeLabel = typeof d.timeLabel === "string" ? d.timeLabel : formatDateTime(d.time);
+  const profileLabel = typeof d.profileLabel === "string" ? d.profileLabel : escapeHtml(d.profile ?? "");
+  const links = [
+    href ? `<a href="${escapeHtml(href)}" target="_blank" rel="noopener noreferrer">Check on suveren.ai \u2197</a>` : "",
+    interactive ? `<a href="${escapeHtml(detailLink(el.id))}" target="_top">Details</a>` : ""
+  ].filter(Boolean);
+  return `<div class="sv-el sv-el-${el.status}" data-sv-id="${escapeHtml(el.id)}"><div class="sv-el-row"><b>${escapeHtml(actionLabel)}</b>${badge(el.status, "signature valid")}</div><div class="sv-el-row"><span>${escapeHtml(profileLabel)} \xB7 ${escapeHtml(timeLabel)}</span></div>` + (links.length > 0 ? `<div class="sv-el-row"><span>${links.join(" \xB7 ")}</span></div>` : "") + `</div>`;
+}
+function renderApproval(el, interactive) {
+  if (el.status === "unverifiable" || !el.data) return unverifiableCard(el);
+  const d = el.data;
+  const who = typeof d.whoLabel === "string" ? d.whoLabel : Array.isArray(d.who) ? d.who.join(", ") : "unknown";
+  const asked = typeof d.createdAtLabel === "string" ? d.createdAtLabel : "unknown";
+  const approved = typeof d.decidedAtLabel === "string" ? d.decidedAtLabel : "unknown";
+  const waited = typeof d.waitLabel === "string" ? d.waitLabel : "unknown";
+  return `<div class="sv-el sv-el-${el.status}" data-sv-id="${escapeHtml(el.id)}"><div class="sv-el-row"><b>Approval</b>${badge(el.status, "from ticket archive")}</div><div class="sv-el-row"><span>asked ${escapeHtml(asked)} \xB7 approved ${escapeHtml(approved)} by ${escapeHtml(who)} (${escapeHtml(waited)})</span></div>` + (interactive ? `<div class="sv-el-row"><a href="${escapeHtml(detailLink(el.id, String(d.ticketId ?? "")))}" target="_top">Details</a></div>` : "") + `</div>`;
+}
+function renderMandate(el, interactive) {
+  if (el.status === "unverifiable" || !el.data) return unverifiableCard(el);
+  const d = el.data;
+  const profileLabel = typeof d.profileLabel === "string" ? d.profileLabel : String(d.profile ?? "");
+  const owners = Array.isArray(d.owners) && d.owners.length > 0 ? d.owners.join(", ") : "unknown owner";
+  const limits = Array.isArray(d.limits) && d.limits.length > 0 ? d.limits.join(" \xB7 ") : "";
+  return `<div class="sv-el sv-el-${el.status}" data-sv-id="${escapeHtml(el.id)}"><div class="sv-el-row"><b>${escapeHtml(profileLabel)} \xB7 ${escapeHtml(owners)}</b>${badge(el.status, "matches ticket")}</div>` + (limits ? `<div class="sv-el-row">${escapeHtml(limits)}${d.mode ? ` \xB7 ${escapeHtml(d.mode)}` : ""}</div>` : "") + (d.intent ? `<div class="sv-el-intent">Intent: \u201C${escapeHtml(d.intent)}\u201D</div>` : "") + (interactive ? `<div class="sv-el-row"><a href="${escapeHtml(detailLink(el.id))}" target="_top">Details</a></div>` : "") + `</div>`;
+}
+var RECORD_FIELD_ORDER = [
+  "subject",
+  "from_email",
+  "from_name",
+  "to_json",
+  "received_at",
+  "number",
+  "status",
+  "net_total",
+  "customer_id",
+  "causingReceiptId",
+  "message"
+];
+var RECORD_TIME_FIELDS = /* @__PURE__ */ new Set(["received_at", "created_at", "sent_at"]);
+function renderRecordField(key, d) {
+  if (key === "net_total") {
+    const currency = typeof d.currency === "string" ? d.currency : void 0;
+    return `<div class="sv-el-row"><span>Value</span><span>${escapeHtml(formatCurrency(d.net_total, currency))}</span></div>`;
+  }
+  if (RECORD_TIME_FIELDS.has(key)) {
+    const t = parseTimestampSeconds(d[key]);
+    const display = t !== void 0 ? formatDateTime(t) : d[key];
+    return `<div class="sv-el-row"><span>${escapeHtml(key)}</span><span>${escapeHtml(display)}</span></div>`;
+  }
+  return `<div class="sv-el-row"><span>${escapeHtml(key)}</span><span>${escapeHtml(d[key])}</span></div>`;
+}
+function renderRecord(el) {
+  if (el.status === "unverifiable" || !el.data) return unverifiableCard(el);
+  const d = el.data;
+  const kind = String(d.kind ?? "record");
+  const rows = RECORD_FIELD_ORDER.filter((k) => d[k] !== void 0 && d[k] !== null && d[k] !== "").slice(0, 5).map((k) => renderRecordField(k, d)).join("");
+  return `<div class="sv-el sv-el-${el.status}" data-sv-id="${escapeHtml(el.id)}"><div class="sv-el-row"><b>${escapeHtml(kind)} record</b>${badge(el.status, "in simulator database")}</div>` + rows + `</div>`;
+}
+function renderCaseTicketStep(caseElementId, node, isGoal, interactive) {
+  const cls = isGoal ? "sv-step sv-step-goal" : "sv-step";
+  const kind = isGoal ? "goal" : "ticket";
+  const inner = `<div class="sv-step-k">${kind}</div><div class="sv-step-t">${escapeHtml(formatActionLabel(node.action))}</div>${formatDateTime(node.time)}`;
+  if (!interactive) return `<div class="${cls}">${inner}</div>`;
+  return `<a class="${cls}" href="${escapeHtml(detailLink(caseElementId, node.ticketId))}" target="_top">${inner}</a>`;
+}
+function renderCaseApprovalStep(approval) {
+  const who = approval.whoLabel ?? (Array.isArray(approval.who) ? approval.who.join(", ") : "unknown");
+  const asked = approval.createdAtLabel ?? "unknown";
+  const decided = approval.decidedAtLabel ?? "unknown";
+  const waited = approval.waitLabel ?? "unknown";
+  return `<div class="sv-step sv-step-approval"><div class="sv-step-k">approval</div><div class="sv-step-t">Approval</div><div class="sv-step-sub">asked ${escapeHtml(asked)} \xB7 approved ${escapeHtml(decided)} by ${escapeHtml(who)} (${escapeHtml(waited)})</div></div>`;
+}
+function renderCase(el, interactive) {
+  if (el.status === "unverifiable" || !el.data) return unverifiableCard(el);
+  const d = el.data;
+  const steps = Array.isArray(d.steps) ? d.steps : [];
+  const goal = d.goal;
+  const approvalsByTicket = /* @__PURE__ */ new Map();
+  if (Array.isArray(d.approvals)) {
+    for (const a of d.approvals) {
+      approvalsByTicket.set(a.ticketId, a);
+    }
+  }
+  const start = d.start;
+  const startStep = start ? { time: start.time, html: `<div class="sv-step"><div class="sv-step-k">start</div><div class="sv-step-t">Email in</div>${formatDateTime(start.time)}</div>` } : void 0;
+  const ticketNodes = [
+    ...steps.map((s) => ({ node: s, isGoal: false })),
+    ...goal ? [{ node: goal, isGoal: true }] : []
+  ];
+  const items = [];
+  if (startStep) items.push(startStep);
+  for (const { node, isGoal } of ticketNodes) {
+    const approval = approvalsByTicket.get(node.ticketId);
+    if (approval) {
+      const approvalTime = Math.min(approval.decidedAt ?? approval.createdAt ?? node.time, node.time);
+      items.push({ time: approvalTime, html: renderCaseApprovalStep(approval) });
+    }
+    items.push({ time: node.time, html: renderCaseTicketStep(el.id, node, isGoal, interactive) });
+  }
+  items.sort((a, b) => a.time - b.time);
+  const stepHtml = items.map((i) => i.html).join("");
+  return `<div class="sv-el sv-el-${el.status}" data-sv-id="${escapeHtml(el.id)}"><div class="sv-el-row"><b>Case ${escapeHtml(d.caseId)} \xB7 ${formatDuration(d.totalDurationSeconds)}</b>${badge(el.status, "assembled by gateway")}</div>` + (el.status === "warning" && el.reason ? `<div class="sv-el-warn">${escapeHtml(el.reason)}</div>` : "") + `<div class="sv-tl">${stepHtml}</div>` + (interactive ? `<div class="sv-el-row"><a href="${escapeHtml(detailLink(el.id))}" target="_top">Case details</a></div>` : "") + `</div>`;
+}
+function renderMetric(el) {
+  if (el.status === "unverifiable" || !el.data) return unverifiableCard(el);
+  const d = el.data;
+  const kind = String(d.kind ?? "");
+  const label = METRIC_LABELS[kind] ?? kind;
+  const display = formatMetricValue(kind, d.value);
+  return `<div class="sv-el sv-el-${el.status} sv-el-metric" data-sv-id="${escapeHtml(el.id)}"><div class="sv-big">${escapeHtml(display)}</div><div class="sv-el-row"><span>${escapeHtml(label)} (${escapeHtml(d.caseCount ?? 0)} case${d.caseCount === 1 ? "" : "s"})</span>${badge(el.status, "computed by gateway")}</div>` + (el.status === "warning" && el.reason ? `<div class="sv-el-warn">${escapeHtml(el.reason)}</div>` : "") + `</div>`;
+}
+function renderElement(el, interactive) {
+  switch (el.kind) {
+    case "sv-ticket":
+      return renderTicket(el, interactive);
+    case "sv-approval":
+      return renderApproval(el, interactive);
+    case "sv-mandate":
+      return renderMandate(el, interactive);
+    case "sv-record":
+      return renderRecord(el);
+    case "sv-case":
+      return renderCase(el, interactive);
+    case "sv-metric":
+      return renderMetric(el);
+    default:
+      return unverifiableCard(el);
+  }
+}
+var DRAWN_ELEMENT_STYLES = `
+.sv-el { border:1px solid #e5e5e5; border-radius:10px; padding:10px 12px; margin:10px 0; font:13px/1.5 system-ui, sans-serif; background:#fff; }
+.sv-el-unverifiable { outline:2px solid #b91c1c; outline-offset:2px; }
+.sv-el-verified, .sv-el-warning { outline:2px solid #15803d; outline-offset:2px; }
+.sv-el-row { display:flex; justify-content:space-between; gap:10px; flex-wrap:wrap; margin:2px 0; }
+.sv-el-reason, .sv-el-warn { color:#b45309; font-size:12px; margin-top:4px; }
+.sv-el-intent { color:#666; font-size:12px; margin-top:4px; }
+.sv-badge { display:inline-flex; gap:4px; font-size:10.5px; font-weight:600; padding:1px 7px; border-radius:999px; white-space:nowrap; }
+.sv-badge-ok { color:#15803d; background:#ecfdf3; }
+.sv-badge-warn { color:#b45309; background:#fff7e6; }
+.sv-badge-bad { color:#b91c1c; background:#fdecea; }
+.sv-big { font-size:24px; font-weight:700; }
+.sv-tl { display:flex; flex-wrap:wrap; gap:10px 16px; padding:6px 0; }
+.sv-step { min-width:100px; border:1px solid #e5e5e5; border-radius:8px; padding:6px 8px; font-size:11.5px; text-decoration:none; color:inherit; flex-shrink:0; }
+.sv-step-k { font-size:9.5px; text-transform:uppercase; color:#666; }
+.sv-step-t { font-weight:600; font-size:12px; }
+.sv-step-sub { color:#666; white-space:normal; }
+/* The approval step's text ("asked ... approved ... by ... (duration)") is
+ * longer than a ticket step's \u2014 without a width to wrap against, a
+ * flex item with flex-shrink:0 takes its one-line content width instead of
+ * wrapping, which reads as the text being cut off at the container's visible
+ * edge (polish 2026-10-05, second pass). */
+.sv-step-approval { max-width:240px; white-space:normal; }
+@media (max-width: 480px) {
+  .sv-tl { flex-direction:column; overflow-x:visible; }
+  .sv-step { min-width:0; }
+  .sv-step-approval { max-width:none; }
+  .sv-el-row { flex-direction:column; gap:2px; }
+}
+`;
+function renderReportHtml(html, elements, interactive = true) {
+  const byId = new Map(elements.map((e) => [e.id, e]));
+  const spans = findElementSpans(html);
+  let out = "";
+  let cursor = 0;
+  for (const span of spans) {
+    out += html.slice(cursor, span.start);
+    const el = byId.get(span.id) ?? { id: span.id, kind: span.kind, attrs: {}, status: "unverifiable", reason: "No verification result for this element." };
+    out += renderElement(el, interactive);
+    cursor = span.end;
+  }
+  out += html.slice(cursor);
+  const styleTag = `<style data-sv-drawn-styles="1">${DRAWN_ELEMENT_STYLES}</style>`;
+  if (/<body[^>]*>/i.test(out)) {
+    return out.replace(/<body([^>]*)>/i, (m) => `${m}${styleTag}`);
+  }
+  return styleTag + out;
+}
+
+// src/lib/report/ticket-details.ts
+async function buildTicketDetails(archive, ticketIds) {
+  const out = {};
+  for (const id of ticketIds) {
+    const [ticket, approval, mandate] = await Promise.all([
+      resolveTicketElement(archive, id),
+      resolveApprovalElement(archive, id),
+      resolveMandateElement(archive, id)
+    ]);
+    out[id] = { ticket, approval, mandate };
+  }
+  return out;
+}
+
+// src/lib/report/export-report.ts
+function receiptId(receipt) {
+  return typeof receipt.id === "string" ? receipt.id : "";
+}
+function buildExportBundle(params) {
+  const { stored, archive, authorityServer, gatewayVersion, now = Math.floor(Date.now() / 1e3) } = params;
+  const proof = stored.result.proof;
+  const coverage = stored.result.coverage;
+  const ticketIdSet = /* @__PURE__ */ new Set([...proof.ticketsReferenced, ...coverage.ticketsInPeriod]);
+  const entries = archive.getReceipts().filter((r) => ticketIdSet.has(receiptId(r.receipt)));
+  const tickets = entries.map((r) => r.receipt);
+  const authorizationIds = new Set(entries.map((r) => r.authorizationId));
+  const authorizations = {};
+  for (const a of archive.getAuthorizations()) {
+    if (authorizationIds.has(a.authorizationId)) authorizations[a.authorizationId] = a;
+  }
+  return {
+    format: "suveren-report-export",
+    version: 1,
+    exportedAt: now,
+    gatewayVersion,
+    report: { html: stored.html, savedAt: stored.savedAt, checkedAt: stored.checkedAt },
+    proof,
+    coverage,
+    authorityServer,
+    tickets,
+    authorizations
+  };
+}
+function countLine(count, noneText = "none in this report") {
+  return count > 0 ? `${count} \u2713` : noneText;
+}
+function renderProofCoveragePanels(proof, coverage) {
+  const casesLine = coverage.emailExportError ? "unknown \u2014 the email simulator could not be read" : `${coverage.coveredCases.length} of ${coverage.loadedCases.length}`;
+  const periodNote = coverage.periodStart === null ? `<p class="sv-export-note">${coverage.emailExportError ? "Test period start unknown \u2014 the email simulator could not be read. All saved tickets were counted." : "Test period start unknown \u2014 all saved tickets were counted."}</p>` : "";
+  const missingParts = [];
+  if (coverage.missingCases.length > 0) missingParts.push(`cases ${coverage.missingCases.map(escapeHtml).join(", ")}`);
+  if (coverage.ticketsNotReferenced.length > 0) missingParts.push(`${coverage.ticketsNotReferenced.length} ticket${coverage.ticketsNotReferenced.length === 1 ? "" : "s"}`);
+  const missingLine = missingParts.length > 0 ? `<p class="sv-export-missing">Not in the report: ${missingParts.join(" \xB7 ")}</p>` : "";
+  const checkedValues = proof.verifiedValues.length > 0 ? `<div class="sv-export-card"><div class="sv-export-card-title">Checked values</div>${proof.verifiedValues.map((v) => `<div class="sv-export-row"><span>${escapeHtml(v.summary)}</span></div>`).join("")}</div>` : "";
+  return `<aside class="sv-export-side"><div class="sv-export-card"><div class="sv-export-card-title">Proof</div><div class="sv-export-row"><span>Tickets referenced</span><b>${proof.ticketsReferenced.length}</b></div><div class="sv-export-row"><span>Signatures valid</span><b>${escapeHtml(countLine(proof.signaturesValid))}</b></div><div class="sv-export-row"><span>Records checked</span><b>${escapeHtml(countLine(proof.recordsChecked))}</b></div><div class="sv-export-row"><span>Not verifiable</span><b>${proof.unverifiableCount}</b></div></div><div class="sv-export-card"><div class="sv-export-card-title">Coverage</div><div class="sv-export-row"><span>Cases</span><b>${casesLine}</b></div><div class="sv-export-row"><span>Tickets in test period</span><b>${coverage.ticketsReferenced.length} of ${coverage.ticketsInPeriod.length}</b></div>` + periodNote + missingLine + `</div>` + checkedValues + `</aside>`;
+}
+function ensureHtmlDocument(html) {
+  if (/<html[^>]*>/i.test(html)) return html;
+  return `<!doctype html><html><head><meta charset="utf-8"></head><body>${html}</body></html>`;
+}
+function injectIntoHead(html, insert) {
+  if (/<head[^>]*>/i.test(html)) return html.replace(/<head([^>]*)>/i, (m) => `${m}${insert}`);
+  if (/<html[^>]*>/i.test(html)) return html.replace(/<html([^>]*)>/i, (m) => `${m}<head>${insert}</head>`);
+  return `<head>${insert}</head>${html}`;
+}
+function injectAfterBodyOpen(html, insert) {
+  if (/<body[^>]*>/i.test(html)) return html.replace(/<body([^>]*)>/i, (m) => `${m}${insert}`);
+  return `${insert}${html}`;
+}
+function injectBeforeBodyClose(html, insert) {
+  if (/<\/body>/i.test(html)) return html.replace(/<\/body>/i, `${insert}</body>`);
+  return `${html}${insert}`;
+}
+var EXPORT_PAGE_STYLES = `
+.sv-export-header { font:13px/1.5 system-ui, sans-serif; background:#f6f6f4; border-bottom:1px solid #e5e5e5; padding:14px 20px; }
+.sv-export-meta { margin:0 0 6px 0; font-weight:600; }
+.sv-export-howto { margin:0; color:#444; }
+.sv-export-howto code { background:#eee; border-radius:4px; padding:1px 5px; font-size:12px; }
+.sv-export-layout { display:flex; gap:20px; align-items:flex-start; padding:20px; font:13px/1.5 system-ui, sans-serif; }
+.sv-export-main { flex:1 1 auto; min-width:0; }
+.sv-export-side { flex:0 0 260px; }
+.sv-export-card { border:1px solid #e5e5e5; border-radius:10px; padding:10px 12px; margin-bottom:12px; background:#fff; }
+.sv-export-card-title { font-weight:700; margin-bottom:6px; }
+.sv-export-row { display:flex; justify-content:space-between; gap:10px; margin:2px 0; }
+.sv-export-note, .sv-export-missing { color:#b45309; font-size:12px; margin:4px 0 0 0; }
+@media (max-width: 720px) {
+  .sv-export-layout { flex-direction:column; }
+  .sv-export-side { flex:1 1 auto; width:100%; }
+}
+`;
+function formatDateTimeWithYear(value) {
+  const base = formatDateTime(value);
+  const year = new Date(value * 1e3).getFullYear();
+  return base.replace(",", ` ${year},`);
+}
+function utcOffsetLabel(value) {
+  const offsetMin = -new Date(value * 1e3).getTimezoneOffset();
+  const sign = offsetMin >= 0 ? "+" : "-";
+  const abs = Math.abs(offsetMin);
+  const hh = Math.floor(abs / 60);
+  const mm = abs % 60;
+  return `UTC${sign}${hh}${mm ? ":" + String(mm).padStart(2, "0") : ""}`;
+}
+function buildExportDocument(params) {
+  const { bundle, renderedHtml } = params;
+  const exportedDate = new Date(bundle.exportedAt * 1e3).toISOString().slice(0, 10);
+  const exportedLabel = formatDateTimeWithYear(bundle.exportedAt);
+  const checkedLabel = formatDateTime(bundle.report.checkedAt);
+  const tzLabel = utcOffsetLabel(bundle.exportedAt);
+  const headerHtml = `<div class="sv-export-header"><p class="sv-export-meta">Suveren Gateway ${escapeHtml(bundle.gatewayVersion)} \u2014 exported ${escapeHtml(exportedLabel)} &middot; checked ${escapeHtml(checkedLabel)} (times in ${escapeHtml(tzLabel)})</p><p class="sv-export-howto">How to check this report: each ticket below links to its public record on suveren.ai ("Check on suveren.ai \u2197"). To verify this entire file offline (including every signature), run <code>suveren-gateway verify-report ${escapeHtml(suggestedFilename(bundle))}</code> from a terminal with the Suveren gateway CLI installed.</p></div>`;
+  const proofScriptJson = JSON.stringify(bundle).replace(/<\//g, "<\\/");
+  const proofScript = `<script type="application/json" id="suveren-proof">${proofScriptJson}</script>`;
+  let doc = ensureHtmlDocument(renderedHtml);
+  doc = injectIntoHead(doc, `<meta charset="utf-8"><title>Suveren report export \u2014 ${escapeHtml(exportedDate)}</title><style>${DRAWN_ELEMENT_STYLES}${EXPORT_PAGE_STYLES}</style>`);
+  doc = injectAfterBodyOpen(doc, headerHtml + `<div class="sv-export-layout"><div class="sv-export-main">`);
+  doc = injectBeforeBodyClose(doc, `</div>${renderProofCoveragePanels(bundle.proof, bundle.coverage)}</div>${proofScript}`);
+  return doc;
+}
+function suggestedFilename(bundle) {
+  const date = new Date(bundle.exportedAt * 1e3).toISOString().slice(0, 10);
+  return `suveren-report-${date}.html`;
+}
+
 // src/lib/profile-loader.ts
 import { readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
 import { join as join15, resolve as resolve2 } from "path";
@@ -5620,6 +6671,251 @@ function builtinText(text) {
   return { content: [{ type: "text", text }] };
 }
 
+// src/lib/builtins/report.ts
+var MAX_REPORT_HTML_BYTES = 512 * 1024;
+var READ_GATE = { category: "read", boundField: "read_access", requiredValue: "unlimited" };
+var EMAIL_RECORD_KINDS = ["inbox", "sent", "changes", "refusals"];
+var ERP_RECORD_KINDS = ["quotes", "orders", "changes", "refusals"];
+var CRM_RECORD_KINDS = ["contacts", "deals", "tasks", "activities", "changes", "refusals"];
+function errorText(text) {
+  return { content: [{ type: "text", text }], isError: true };
+}
+function listTicketsTool(deps) {
+  return {
+    name: "list_tickets",
+    description: "List tickets (signed executions) from the local receipt archive: id, time, action, action type, profile, authorizationId, the limits used, and whether an approval was archived for it. Optionally filter by since/until (unix seconds). Use the ids with get_ticket for full detail, and with <sv-ticket>, <sv-approval>, <sv-mandate> and <sv-case> in the report.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        since: { type: "number", description: "Only tickets timestamped at or after this unix-seconds value." },
+        until: { type: "number", description: "Only tickets timestamped at or before this unix-seconds value." }
+      }
+    },
+    handler: async (args) => {
+      const since = typeof args.since === "number" ? args.since : void 0;
+      const until = typeof args.until === "number" ? args.until : void 0;
+      const tickets = deps.reportSources.archive.getReceipts().map((entry) => {
+        const r = entry.receipt;
+        const time = typeof r.timestamp === "number" ? r.timestamp : void 0;
+        return {
+          id: typeof r.id === "string" ? r.id : String(r.id ?? ""),
+          time,
+          action: r.action,
+          actionType: r.actionType ?? null,
+          profile: r.profileId,
+          authorizationId: r.authorizationId,
+          limitsUsed: r.limits ?? r.executionContext ?? {},
+          hasApproval: Boolean(entry.proposal)
+        };
+      }).filter((t) => t.id !== "").filter((t) => since === void 0 || t.time !== void 0 && t.time >= since).filter((t) => until === void 0 || t.time !== void 0 && t.time <= until).sort((a, b) => (a.time ?? 0) - (b.time ?? 0));
+      return builtinText(JSON.stringify({ tickets }, null, 2));
+    }
+  };
+}
+function getTicketTool(deps) {
+  return {
+    name: "get_ticket",
+    description: 'Full detail for one ticket: the ticket itself (action, time, limits used, public-check link), its archived approval (who approved it, when it was requested and decided, how long it waited), and the mandate it ran under (limits, commitment mode, intent). Each part reports "unverifiable" on its own if it could not be checked \u2014 e.g. an automatic-mode ticket has no approval. Use this to decide what a ticket actually proves before referencing it in the report.',
+    inputSchema: {
+      type: "object",
+      properties: { id: { type: "string", description: "The ticket id, as listed by list_tickets." } },
+      required: ["id"]
+    },
+    handler: async (args) => {
+      const id = typeof args.id === "string" ? args.id.trim() : "";
+      if (!id) return errorText("id is required.");
+      const details = await buildTicketDetails(deps.reportSources.archive, [id]);
+      const detail = details[id];
+      if (!detail || detail.ticket.status !== "verified") {
+        return errorText(detail?.ticket.reason ?? `No ticket "${id}" in the local archive.`);
+      }
+      return builtinText(JSON.stringify({
+        ticket: detail.ticket.data,
+        approval: detail.approval.status === "verified" ? { verified: true, ...detail.approval.data } : { verified: false, reason: detail.approval.reason },
+        mandate: detail.mandate.status === "verified" ? { verified: true, ...detail.mandate.data } : { verified: false, reason: detail.mandate.reason }
+      }, null, 2));
+    }
+  };
+}
+function listCasesTool(deps) {
+  return {
+    name: "list_cases",
+    description: "Loaded business cases from the connected email system, plus every sent mail \u2014 so you can define sv-case elements without guessing ids. Returns: when the test data was loaded (testDataLoadedAt); cases (caseId, the starting inbox message id, sender, subject, received time); and sent mails (id, inReplyTo, the receiptId of the ticket that sent it, subject, sentAt) so you can confirm which ticket closed which case. Never includes the team's own reference replies \u2014 those are not part of this report.",
+    inputSchema: { type: "object", properties: {} },
+    handler: async () => {
+      let exported;
+      try {
+        exported = await deps.reportSources.runExport("email");
+      } catch (err) {
+        return errorText(`Could not read email records: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      if (!isEmailExport(exported)) return errorText("Email records were returned in an unexpected shape.");
+      const exp = exported;
+      const cases = exp.inbox.filter((m) => !!m.case_id).map((m) => ({
+        caseId: m.case_id,
+        startMessageId: m.id,
+        from: m.from_email,
+        subject: m.subject,
+        receivedAt: m.received_at
+      }));
+      const sent = exp.sent.map((m) => ({
+        id: m.id,
+        inReplyTo: m.in_reply_to ?? null,
+        receiptId: m.receipt_id ?? null,
+        subject: m.subject,
+        sentAt: m.received_at
+      }));
+      return builtinText(JSON.stringify({
+        testDataLoadedAt: exp.simulation_load?.loaded_at ?? null,
+        cases,
+        sent
+      }, null, 2));
+    }
+  };
+}
+function recordKindsFor(system) {
+  if (system === "email") return EMAIL_RECORD_KINDS;
+  if (system === "erp") return ERP_RECORD_KINDS;
+  return CRM_RECORD_KINDS;
+}
+function getRecordsTool(deps) {
+  return {
+    name: "get_records",
+    description: `Rows from one connected system (email, erp or crm) that you may reference with <sv-record system="..." ref="...">. Optionally narrow to one table via "kind" (email: inbox/sent/changes/refusals; erp: quotes/orders/changes/refusals; crm: contacts/deals/tasks/activities/changes/refusals) \u2014 omit it to get every table for that system. Never returns the team's own reference replies.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        system: { type: "string", enum: ["email", "erp", "crm"] },
+        kind: { type: "string", description: "Optional: one table name within that system's records." }
+      },
+      required: ["system"]
+    },
+    handler: async (args) => {
+      const system = args.system;
+      if (system !== "email" && system !== "erp" && system !== "crm") {
+        return errorText('system must be one of "email", "erp", "crm".');
+      }
+      let exported;
+      try {
+        exported = await deps.reportSources.runExport(system);
+      } catch (err) {
+        return errorText(`Could not read ${system} records: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      const ok = system === "email" ? isEmailExport(exported) : system === "erp" ? isErpExport(exported) : isCrmExport(exported);
+      if (!ok) return errorText(`${system} records were returned in an unexpected shape.`);
+      const allowedKinds = recordKindsFor(system);
+      const requestedKind = typeof args.kind === "string" ? args.kind : void 0;
+      if (requestedKind && !allowedKinds.includes(requestedKind)) {
+        return errorText(`kind must be one of ${allowedKinds.join(", ")} for system "${system}".`);
+      }
+      const kinds = requestedKind ? [requestedKind] : allowedKinds;
+      const records = {};
+      const exp = exported;
+      for (const kind of kinds) {
+        records[kind] = exp[kind] ?? [];
+      }
+      return builtinText(JSON.stringify({ system, records }, null, 2));
+    }
+  };
+}
+function summarizeWrite(result) {
+  const verified = result.elements.filter((e) => e.status === "verified");
+  const warnings = result.elements.filter((e) => e.status === "warning");
+  const unverifiable = result.elements.filter((e) => e.status === "unverifiable");
+  const lines = [];
+  lines.push(
+    `Report stored. ${verified.length} element(s) verified, ${warnings.length} warning(s), ${unverifiable.length} not verifiable.`
+  );
+  if (warnings.length > 0) {
+    lines.push("Warnings:");
+    for (const w of warnings) lines.push(`  - ${w.kind} (${w.id}): ${w.reason ?? "unspecified"}`);
+  }
+  if (unverifiable.length > 0) {
+    lines.push("Not verifiable \u2014 fix these references and write again:");
+    for (const u of unverifiable) lines.push(`  - ${u.kind} (${u.id}): ${u.reason ?? "unspecified"}`);
+  }
+  const cov = result.coverage;
+  if (cov.emailExportError) {
+    lines.push(`Coverage could not be checked: ${cov.emailExportError}`);
+  } else {
+    lines.push(`Coverage: ${cov.coveredCases.length} of ${cov.loadedCases.length} loaded case(s) covered.`);
+    if (cov.missingCases.length > 0) lines.push(`Missing cases (not defined with sv-case): ${cov.missingCases.join(", ")}`);
+    if (cov.ticketsNotReferenced.length > 0) {
+      lines.push(`Tickets from the test period not referenced anywhere in the report: ${cov.ticketsNotReferenced.join(", ")}`);
+    }
+  }
+  return lines.join("\n");
+}
+function writeReportRefusal(args) {
+  const html = typeof args.html === "string" ? args.html : "";
+  if (!html.trim()) return "`html` must be a non-empty string.";
+  const bytes = Buffer.byteLength(html, "utf8");
+  if (bytes > MAX_REPORT_HTML_BYTES) {
+    return `the report is ${bytes} bytes, over the ${MAX_REPORT_HTML_BYTES}-byte limit. Shorten it (the gateway draws the verifiable elements for you \u2014 you do not need to inline their data) and write again.`;
+  }
+  return void 0;
+}
+function writeReportTool(deps) {
+  return {
+    name: "write_report",
+    // The brief IS the description — this is how it reaches the AI (R3/R4 plan,
+    // the same pattern mail.json's load_simulation uses for its package guide).
+    description: REPORT_BRIEF,
+    inputSchema: {
+      type: "object",
+      properties: {
+        html: { type: "string", description: "The full report HTML \u2014 see the tool description for how to write it." },
+        receipt_id: { type: "string" }
+      },
+      required: ["html"]
+    },
+    // Empty/oversize html is refused here, BEFORE the gate requests a ticket
+    // (precheckBuiltin) — a refused write must not consume report_daily_max.
+    validate: writeReportRefusal,
+    handler: async (args) => {
+      const refusal = writeReportRefusal(args);
+      if (refusal) return errorText(`Refused: ${refusal}`);
+      const html = args.html;
+      if (deps.state.reportStore.isLocked()) {
+        return errorText("The report store is locked (the vault is not unlocked) \u2014 cannot save a report right now.");
+      }
+      try {
+        const stored = await deps.state.reportStore.saveReport(html, deps.reportSources);
+        return builtinText(summarizeWrite(stored.result));
+      } catch (err) {
+        return errorText(`Could not verify and store the report: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  };
+}
+var reportBuiltin = (deps) => ({
+  id: "report",
+  name: "Report",
+  // Short name — matches the real registration in profile-loader.ts (full id
+  // AND short name both registered); profileMatches() accepts either.
+  profile: "reporting",
+  // Touches no real system (reads the local archive + each simulator's own
+  // read-only export CLI; writes only the local, vault-encrypted report file)
+  // — safe during a simulation-mode test.
+  simulation: true,
+  toolGating: {
+    overrides: {
+      list_tickets: READ_GATE,
+      get_ticket: READ_GATE,
+      list_cases: READ_GATE,
+      get_records: READ_GATE,
+      write_report: { executionMapping: {}, staticExecution: { action_type: "report" } }
+    }
+  },
+  tools: [
+    listTicketsTool(deps),
+    getTicketTool(deps),
+    listCasesTool(deps),
+    getRecordsTool(deps),
+    writeReportTool(deps)
+  ]
+});
+
 // src/lib/cp-mandate.ts
 var CP_PORT2 = process.env.SUVEREN_CP_PORT ?? "3402";
 var CP_BASE2 = process.env.SUVEREN_CP_INTERNAL_URL ?? `http://127.0.0.1:${CP_PORT2}`;
@@ -5841,7 +7137,7 @@ ${guide.body.trim()}`);
         inputSchema: {
           type: "object",
           properties: {
-            team: { type: "string", description: "Team name or id. Omit for the personal workspace." },
+            team: { type: "string", description: 'Team name or id, or "personal". Omit to use the workspace of your Delegation mandate.' },
             profile: { type: "string", description: 'Profile, e.g. "sales" (newest version) or a full profile id.' },
             limits: { type: "object", description: "The limits (bounds) by field name, as the profile defines them." },
             scope: { type: "object", description: "The scope (context) by field name, as the profile defines it." },
@@ -5886,7 +7182,7 @@ function mandateRequest(args) {
 }
 
 // src/lib/builtins/index.ts
-var BUILTIN_FACTORIES = [setupBuiltin];
+var BUILTIN_FACTORIES = [setupBuiltin, reportBuiltin];
 function registerBuiltins(deps, factories = BUILTIN_FACTORIES) {
   const registered = [];
   for (const factory of factories) {
@@ -5985,7 +7281,7 @@ function isAlive(pid) {
 }
 
 // bin/http.ts
-import { homedir as homedir10 } from "os";
+import { homedir as homedir11 } from "os";
 import { join as join19 } from "path";
 
 // src/lib/mcp-as-tracker.ts
@@ -6011,12 +7307,16 @@ function writeMcpPairedAsUrl(dataDir2, asUrl) {
 }
 
 // bin/http.ts
-var dataDir = process.env.SUVEREN_DATA_DIR ?? join19(homedir10(), ".suveren");
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join19(homedir11(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
 validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
 setAsBaseUrl(spUrl);
 var state = new SharedState(spUrl, void 0, dataDir);
+var reportSources = {
+  archive: state.receiptArchive,
+  runExport: createConnectorExportRunner({ integrationsBinDir: getIntegrationsBinDir(), dataDir })
+};
 (function repairIfAsUrlChanged() {
   const lastKnown = readMcpPairedAsUrl(dataDir);
   if (lastKnown !== null && lastKnown !== spUrl) {
@@ -6092,7 +7392,8 @@ app.post("/internal/configure", internalOnly, (req, res) => {
     state.gateStore.setVaultKey(key);
     state.denialLog.setVaultKey(key);
     state.receiptArchive.setVaultKey(key);
-    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log + receipt archive encryption active");
+    state.reportStore.setVaultKey(key);
+    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log + receipt archive + report store encryption active");
   }
   if (apiKey) {
     state.spClient.setApiKey(apiKey);
@@ -6432,6 +7733,107 @@ app.get("/internal/evidence", internalOnly, (_req, res) => {
     gates: state.gateStore.getAll()
   });
 });
+async function reportResponsePayload(stored) {
+  const ticketDetails = await buildTicketDetails(state.receiptArchive, stored.result.proof.ticketsReferenced);
+  return {
+    savedAt: stored.savedAt,
+    checkedAt: stored.checkedAt,
+    renderedHtml: renderReportHtml(stored.result.html, stored.result.elements),
+    proof: stored.result.proof,
+    coverage: stored.result.coverage,
+    elements: stored.result.elements,
+    ticketDetails
+  };
+}
+app.get("/internal/report", internalOnly, async (_req, res) => {
+  if (state.reportStore.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 the report is encrypted until sign-in." });
+    return;
+  }
+  const stored = state.reportStore.getReport();
+  if (!stored) {
+    res.json({ report: null });
+    return;
+  }
+  res.json({ report: await reportResponsePayload(stored) });
+});
+app.post("/internal/report", internalOnly, async (req, res) => {
+  if (state.reportStore.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 cannot save a report until sign-in." });
+    return;
+  }
+  const html = req.body?.html;
+  if (typeof html !== "string" || !html.trim()) {
+    res.status(400).json({ error: "Missing required field: html (non-empty string)" });
+    return;
+  }
+  try {
+    const stored = await state.reportStore.saveReport(html, reportSources);
+    res.json({ report: await reportResponsePayload(stored) });
+  } catch (err) {
+    console.error("[Suveren MCP] /internal/report save failed:", err);
+    res.status(500).json({ error: err instanceof Error ? err.message : "Report verification failed" });
+  }
+});
+app.post("/internal/report/recheck", internalOnly, async (_req, res) => {
+  if (state.reportStore.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 cannot recheck until sign-in." });
+    return;
+  }
+  try {
+    const stored = await state.reportStore.recheck(reportSources);
+    if (!stored) {
+      res.json({ report: null });
+      return;
+    }
+    res.json({ report: await reportResponsePayload(stored) });
+  } catch (err) {
+    console.error("[Suveren MCP] /internal/report/recheck failed:", err);
+    res.status(500).json({ error: err instanceof Error ? err.message : "Recheck failed" });
+  }
+});
+function resolveExportAuthorityServer() {
+  const pin = readPairing(dataDir);
+  if (pin) return { url: pin.asUrl, publicKeyHex: pin.publicKeyHex };
+  const withKey = state.receiptArchive.getReceipts().filter((r) => !!r.asPublicKey).sort((a, b) => b.archivedAt - a.archivedAt);
+  if (withKey.length > 0) return { url: withKey[0].asUrl, publicKeyHex: withKey[0].asPublicKey };
+  return { url: spUrl, publicKeyHex: "" };
+}
+app.get("/internal/report/export", internalOnly, async (req, res) => {
+  if (state.reportStore.isLocked() || state.receiptArchive.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 the report is encrypted until sign-in." });
+    return;
+  }
+  let stored;
+  try {
+    stored = await state.reportStore.recheck(reportSources);
+  } catch (err) {
+    console.error("[Suveren MCP] /internal/report/export recheck failed:", err);
+    res.status(500).json({ error: err instanceof Error ? err.message : "Recheck failed" });
+    return;
+  }
+  if (!stored) {
+    res.status(404).json({ error: "No report to export yet \u2014 the AI writes it with the Reporting mandate." });
+    return;
+  }
+  const authorityServer = resolveExportAuthorityServer();
+  if (!authorityServer.publicKeyHex) {
+    res.status(503).json({
+      error: "No Authority Server key is available yet to anchor this export \u2014 sign in once, or execute at least one gated action, before exporting."
+    });
+    return;
+  }
+  const gatewayVersion = typeof req.query.gatewayVersion === "string" ? req.query.gatewayVersion : "unknown";
+  const bundle = buildExportBundle({
+    stored,
+    archive: state.receiptArchive,
+    authorityServer,
+    gatewayVersion
+  });
+  const renderedHtml = renderReportHtml(stored.result.html, stored.result.elements, false);
+  const document = buildExportDocument({ bundle, renderedHtml });
+  res.setHeader("Content-Type", "text/html; charset=utf-8").setHeader("Content-Disposition", `attachment; filename="${suggestedFilename(bundle)}"`).setHeader("Cache-Control", "no-store").send(document);
+});
 app.get("/internal/brief", internalOnly, (_req, res) => {
   try {
     const enriched = state.getEnrichedAuthorizations();
@@ -6502,7 +7904,7 @@ app.listen(port, "0.0.0.0", () => {
   console.error(`[Suveren MCP]   SP server:  ${spUrl}`);
   profilesLoaded = loadProfiles();
   loadManifests();
-  registerBuiltins({ state, integrationManager });
+  registerBuiltins({ state, integrationManager, reportSources });
   if (process.env.SUVEREN_DISABLE_AUTO_INTEGRATIONS !== "1" && integrationRegistry.getEnabled().length === 0) {
     const personalManifests = getAllManifests().filter((m) => m.personalDefault);
     for (const manifest of personalManifests) {
@@ -6545,7 +7947,7 @@ app.listen(port, "0.0.0.0", () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join19(homedir10(), ".suveren");
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join19(homedir11(), ".suveren");
   const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {