@suveren/gateway 0.25.1 → 0.26.0

package/dist/control-plane/index.mjs

@@ -127,6 +127,13 @@ var Vault = class {
     this.clearKey();
     this.lockedReason = "as-tls-mismatch";
   }
+  /** Lock because this is a managed gateway (IT policy `Team`) and the
+   *  signed-in account's active workspace is no longer that team — see
+   *  lib/managed-team.ts. Mirrors lockAsKeyMismatch() exactly. */
+  lockManagedWrongTeam() {
+    this.clearKey();
+    this.lockedReason = "managed-wrong-team";
+  }
   /**
    * Boot-time only: record that the gateway starts locked because the
    * resolved Authority Server URL differs from the one it was last paired
@@ -1299,7 +1306,7 @@ import { dirname as dirname4, join as join6 } from "path";
 import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { join as join5 } from "path";
 import { spawnSync } from "child_process";
-var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
+var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod", "Team"];
 var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
 function registryKeyPath(hive) {
   const baseKey = process.env.SUVEREN_POLICY_REGISTRY_KEY || DEFAULT_REGISTRY_BASE_KEY;
@@ -1335,6 +1342,11 @@ function validateCaFile(candidate) {
   if (!existsSync4(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
   return { ok: true, path: trimmed };
 }
+function validateTeamId(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The team id is empty." };
+  return { ok: true, id: trimmed };
+}
 function validateProxyUrl(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The proxy URL is empty." };
@@ -1508,6 +1520,14 @@ function readPolicy() {
     policy.installMethod = "managed";
     locked.add("installMethod");
   }
+  if (merged.Team !== void 0) {
+    const v = validateTeamId(String(merged.Team));
+    if (!v.ok) {
+      throw new Error(`Invalid policy Team ("${String(merged.Team)}") from ${sourceOf.Team}: ${v.error}`);
+    }
+    policy.team = v.id;
+    locked.add("team");
+  }
   cached = { policy, locked };
   return cached;
 }
@@ -1624,6 +1644,298 @@ function clearPinTlsExpectedFingerprint(dataDir) {
   writeAsConfig(dataDir, { pinTlsExpectedFingerprint: void 0 });
 }
 
+// src/lib/managed-team.ts
+async function activeTeamId(asUrl, cookie, pinning) {
+  const { res } = await fetchAs(
+    `${asUrl}/api/groups/me`,
+    { headers: { Cookie: cookie }, signal: AbortSignal.timeout(1e4) },
+    pinning
+  );
+  if (!res.ok) throw new Error(`GET /api/groups/me answered ${res.status}`);
+  const data = await res.json();
+  return data.group?.id ?? null;
+}
+var ManagedTeamScheduler = class {
+  constructor(check2, opts = {}) {
+    this.check = check2;
+    this.setIntervalFn = opts.setIntervalFn ?? setInterval;
+    this.clearIntervalFn = opts.clearIntervalFn ?? clearInterval;
+    this.intervalMs = opts.intervalMs ?? 5 * 6e4;
+  }
+  timer = null;
+  setIntervalFn;
+  clearIntervalFn;
+  intervalMs;
+  start() {
+    if (this.timer) return;
+    this.timer = this.setIntervalFn(() => {
+      void this.check();
+    }, this.intervalMs);
+  }
+  stop() {
+    if (this.timer) this.clearIntervalFn(this.timer);
+    this.timer = null;
+  }
+  /** Test-only: run the check immediately, bypassing the timer. */
+  runNow() {
+    return this.check();
+  }
+};
+
+// src/lib/event-bus.ts
+var EventBus = class {
+  listeners = /* @__PURE__ */ new Set();
+  /**
+   * Subscribe to all bus events.
+   * Returns an unsubscribe function — callers MUST call it on disconnect / unmount
+   * to avoid listener leaks.
+   */
+  subscribe(handler) {
+    this.listeners.add(handler);
+    return () => {
+      this.listeners.delete(handler);
+    };
+  }
+  emit(type, payload) {
+    const event = { type, payload };
+    for (const handler of this.listeners) {
+      try {
+        handler(event);
+      } catch (err) {
+        console.error("[EventBus] subscriber threw:", err);
+      }
+    }
+  }
+  /** How many listeners are currently subscribed. Useful for tests and health checks. */
+  get listenerCount() {
+    return this.listeners.size;
+  }
+};
+var eventBus = new EventBus();
+
+// src/lib/desktop-notify.ts
+import { spawn, spawnSync as spawnSync2 } from "child_process";
+
+// src/lib/notifier-icon.ts
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync6 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join7, dirname as dirname5 } from "path";
+var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
+function ensureNotifierIcon(dataDir) {
+  try {
+    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join7(homedir2(), ".suveren");
+    const path = join7(dir, "notifier-icon.png");
+    if (!existsSync6(path)) {
+      mkdirSync4(dirname5(path), { recursive: true });
+      writeFileSync4(path, Buffer.from(ICON_BASE64, "base64"));
+    }
+    return path;
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/desktop-notify.ts
+function osaQuote(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function psQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+var WINDOWS_AUMID = "Suveren.Gateway";
+function windowsToastScript(title, message, url, iconPath) {
+  const toastXml = `<toast${url ? ` activationType="protocol" launch="${xmlEscape(url)}"` : ""}><visual><binding template="ToastGeneric"><text>${xmlEscape(title)}</text><text>${xmlEscape(message)}</text>` + (iconPath ? `<image placement="appLogoOverride" src="${xmlEscape(iconPath)}"/>` : "") + `</binding></visual><audio src="ms-winsoundevent:Notification.Default"/></toast>`;
+  return `$ErrorActionPreference='SilentlyContinue'; $aumid=${psQuote(WINDOWS_AUMID)}; $reg="HKCU:\\Software\\Classes\\AppUserModelId\\$aumid"; if (-not (Test-Path $reg)) { New-Item -Path $reg -Force | Out-Null }; New-ItemProperty -Path $reg -Name DisplayName -Value 'Suveren' -PropertyType String -Force | Out-Null; ` + (iconPath ? `New-ItemProperty -Path $reg -Name IconUri -Value ${psQuote(iconPath)} -PropertyType String -Force | Out-Null; ` : "") + `[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType=WindowsRuntime] | Out-Null; [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom, ContentType=WindowsRuntime] | Out-Null; $doc = New-Object Windows.Data.Xml.Dom.XmlDocument; $doc.LoadXml(${psQuote(toastXml)}); $toast = New-Object Windows.UI.Notifications.ToastNotification $doc; [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($aumid).Show($toast)`;
+}
+var MAC_SOUND = "Glass";
+function buildNotifyCommand(platform, title, message, options = {}) {
+  const { url, hasTerminalNotifier: hasTerminalNotifier2 = false, iconPath } = options;
+  switch (platform) {
+    case "darwin":
+      if (url && hasTerminalNotifier2) {
+        return {
+          cmd: "terminal-notifier",
+          args: [
+            "-title",
+            title,
+            "-message",
+            message,
+            "-open",
+            url,
+            "-sound",
+            MAC_SOUND,
+            ...iconPath ? ["-appIcon", iconPath] : [],
+            "-group",
+            "ai.suveren.gateway"
+          ]
+        };
+      }
+      return {
+        cmd: "osascript",
+        args: [
+          "-e",
+          `display notification ${osaQuote(message)} with title ${osaQuote(title)} sound name ${osaQuote(MAC_SOUND)}`
+        ]
+      };
+    case "win32":
+      return {
+        cmd: "powershell",
+        args: ["-NoProfile", "-NonInteractive", "-Command", windowsToastScript(title, message, url, iconPath)]
+      };
+    case "linux":
+      return {
+        cmd: "notify-send",
+        args: [
+          "--app-name=Suveren",
+          ...iconPath ? ["-i", iconPath] : [],
+          title,
+          message
+        ]
+      };
+    default:
+      return null;
+  }
+}
+function lockedNotification(port2) {
+  const url = `http://localhost:${port2}`;
+  return {
+    title: "Suveren is running but locked",
+    message: `Your agent has no authority until you unlock it. Open ${url} and enter your API key.`,
+    url
+  };
+}
+function sessionExpiredNotification(port2) {
+  const url = `http://localhost:${port2}`;
+  return {
+    title: "Suveren Gateway locked",
+    message: "Your sign-in has ended. Sign in again so your agents can act.",
+    url
+  };
+}
+var terminalNotifierCache = null;
+function hasTerminalNotifier() {
+  if (terminalNotifierCache !== null) return terminalNotifierCache;
+  try {
+    const probe = spawnSync2("terminal-notifier", ["-help"], { stdio: "ignore" });
+    terminalNotifierCache = probe.error === void 0;
+  } catch {
+    terminalNotifierCache = false;
+  }
+  return terminalNotifierCache;
+}
+function notifySpawnOptions(platform) {
+  return {
+    detached: platform !== "win32",
+    stdio: ["ignore", "ignore", "pipe"]
+  };
+}
+function notify(title, message, platform = process.platform, url) {
+  const command = buildNotifyCommand(platform, title, message, {
+    url,
+    hasTerminalNotifier: platform === "darwin" ? hasTerminalNotifier() : false,
+    // Windows and Linux show it on the toast itself; macOS only via
+    // terminal-notifier. Failure to write it must never block the sound.
+    iconPath: ensureNotifierIcon()
+  });
+  if (!command) return;
+  try {
+    const child = spawn(command.cmd, command.args, notifySpawnOptions(platform));
+    let stderr = "";
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString().slice(0, 500);
+    });
+    child.on("close", (code) => {
+      if (code !== 0) {
+        console.error(`[notify] ${command.cmd} exited ${code}${stderr ? `: ${stderr.trim()}` : ""}`);
+      }
+    });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+// src/lib/session-lock.ts
+var SESSION_LOCKED_MESSAGE = "Your sign-in ended after 30 days or was revoked. Sign in again.";
+var AS_KEY_MISMATCH_MESSAGE = "The Authority Server presented a signing key that does not match the one pinned at pairing. Sign in again to review.";
+var AS_TLS_MISMATCH_MESSAGE = "A connection to the Authority Server presented a TLS certificate that does not match the one pinned at pairing. The connection was refused before anything was sent. If the certificate changed intentionally (a new key, not just renewal), clear the pairing and sign in again to re-pin it.";
+function managedWrongTeamMessage(team) {
+  return `This gateway is set up by your IT for team ${team}. Your account is no longer in this team. Sign in with your team account, or ask your IT.`;
+}
+function createSessionLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockExpiredSession2() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockExpired();
+    console.error("[Control Plane] Authority Server session ended \u2014 gateway LOCKED");
+    void unconfigureSessionFn().catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "expired", message: SESSION_LOCKED_MESSAGE });
+    const { title, message, url } = sessionExpiredNotification(port2);
+    notifyFn(title, message, process.platform, url);
+  };
+}
+function createAsKeyMismatchLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnAsKeyMismatch() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockAsKeyMismatch();
+    console.error("[Control Plane] Authority Server key mismatch \u2014 gateway LOCKED");
+    void unconfigureSessionFn("as-key-mismatch").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "as-key-mismatch", message: AS_KEY_MISMATCH_MESSAGE });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, AS_KEY_MISMATCH_MESSAGE, process.platform, url);
+  };
+}
+function createAsTlsMismatchLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnAsTlsMismatch() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockAsTlsMismatch();
+    console.error("[Control Plane] Authority Server TLS pin mismatch \u2014 gateway LOCKED");
+    void unconfigureSessionFn("as-tls-mismatch").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "as-tls-mismatch", message: AS_TLS_MISMATCH_MESSAGE });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, AS_TLS_MISMATCH_MESSAGE, process.platform, url);
+  };
+}
+function createManagedWrongTeamLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnManagedWrongTeam(team) {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockManagedWrongTeam();
+    console.error("[Control Plane] Managed gateway: signed-in account is no longer in the locked team \u2014 gateway LOCKED");
+    const message = managedWrongTeamMessage(team);
+    void unconfigureSessionFn("managed-wrong-team").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "managed-wrong-team", message });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, message, process.platform, url);
+  };
+}
+
 // src/routes/auth.ts
 var DEFAULT_SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
 async function fetchAsPublicKey(asUrl) {
@@ -1706,7 +2018,7 @@ async function checkAsKeyBeforeLogin(asUrl, dataDir) {
   };
 }
 function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished, pairing, lockAsTlsMismatch2 = () => {
-}) {
+}, managedTeamId) {
   const router = Router();
   const SP_URL2 = pairing?.asUrl ?? DEFAULT_SP_URL;
   router.post("/login", loginRateLimit2, async (req, res) => {
@@ -1788,6 +2100,25 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
       const data = await spRes.json();
       const setCookieHeaders = spRes.headers.getSetCookie?.() ?? [];
       const sessionCookie = setCookieHeaders.join("; ");
+      if (managedTeamId) {
+        let activeTeam;
+        try {
+          activeTeam = await activeTeamId(SP_URL2, sessionCookie, sessionPinning);
+        } catch (err) {
+          res.status(502).json({
+            error: "as_unreachable",
+            message: `Could not confirm your team membership with the Authority Server \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
+          });
+          return;
+        }
+        if (activeTeam !== managedTeamId) {
+          res.status(403).json({
+            error: "managed_wrong_team",
+            message: managedWrongTeamMessage(managedTeamId)
+          });
+          return;
+        }
+      }
       vault2.setSpCookie(sessionCookie);
       await vault2.deriveAndSetKey(apiKey);
       if (vault2.isVaultFromDifferentKey()) {
@@ -2561,17 +2892,17 @@ async function testAIConnectivity(config) {
 }
 
 // src/lib/agent-brief-store.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join8 } from "path";
 var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
 function agentBriefPath() {
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join7(homedir2(), ".suveren");
-  return join7(dataDir, "context.md");
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join8(homedir3(), ".suveren");
+  return join8(dataDir, "context.md");
 }
 function readAgentBrief() {
   const filePath = agentBriefPath();
-  if (!existsSync6(filePath)) return "";
+  if (!existsSync7(filePath)) return "";
   return readFileSync8(filePath, "utf-8");
 }
 
@@ -2853,39 +3184,6 @@ async function backfillReadPolicyDefaults(data) {
 
 // src/routes/mcp.ts
 import { Router as Router5 } from "express";
-
-// src/lib/event-bus.ts
-var EventBus = class {
-  listeners = /* @__PURE__ */ new Set();
-  /**
-   * Subscribe to all bus events.
-   * Returns an unsubscribe function — callers MUST call it on disconnect / unmount
-   * to avoid listener leaks.
-   */
-  subscribe(handler) {
-    this.listeners.add(handler);
-    return () => {
-      this.listeners.delete(handler);
-    };
-  }
-  emit(type, payload) {
-    const event = { type, payload };
-    for (const handler of this.listeners) {
-      try {
-        handler(event);
-      } catch (err) {
-        console.error("[EventBus] subscriber threw:", err);
-      }
-    }
-  }
-  /** How many listeners are currently subscribed. Useful for tests and health checks. */
-  get listenerCount() {
-    return this.listeners.size;
-  }
-};
-var eventBus = new EventBus();
-
-// src/routes/mcp.ts
 function createMCPRouter() {
   const router = Router5();
   router.get("/health", async (_req, res) => {
@@ -2958,7 +3256,7 @@ function createMCPRouter() {
 // src/routes/autostart.ts
 import { Router as Router6 } from "express";
 import { execFile } from "child_process";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { dirname as pathDirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
@@ -2979,7 +3277,7 @@ function findCli(dirname10 = MODULE_DIR) {
     // resolves differently between a shell and a login service — and it would
     // mask a genuinely missing CLI whenever the cwd happened to be the repo.
   ];
-  return candidates.find(existsSync7) ?? null;
+  return candidates.find(existsSync8) ?? null;
 }
 async function cli(args) {
   const bin = findCli();
@@ -3056,152 +3354,6 @@ function createAutostartRouter() {
   return router;
 }
 
-// src/lib/desktop-notify.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
-
-// src/lib/notifier-icon.ts
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync8 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join8, dirname as dirname5 } from "path";
-var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
-function ensureNotifierIcon(dataDir) {
-  try {
-    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join8(homedir3(), ".suveren");
-    const path = join8(dir, "notifier-icon.png");
-    if (!existsSync8(path)) {
-      mkdirSync4(dirname5(path), { recursive: true });
-      writeFileSync4(path, Buffer.from(ICON_BASE64, "base64"));
-    }
-    return path;
-  } catch {
-    return null;
-  }
-}
-
-// src/lib/desktop-notify.ts
-function osaQuote(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-function psQuote(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-function xmlEscape(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
-}
-var WINDOWS_AUMID = "Suveren.Gateway";
-function windowsToastScript(title, message, url, iconPath) {
-  const toastXml = `<toast${url ? ` activationType="protocol" launch="${xmlEscape(url)}"` : ""}><visual><binding template="ToastGeneric"><text>${xmlEscape(title)}</text><text>${xmlEscape(message)}</text>` + (iconPath ? `<image placement="appLogoOverride" src="${xmlEscape(iconPath)}"/>` : "") + `</binding></visual><audio src="ms-winsoundevent:Notification.Default"/></toast>`;
-  return `$ErrorActionPreference='SilentlyContinue'; $aumid=${psQuote(WINDOWS_AUMID)}; $reg="HKCU:\\Software\\Classes\\AppUserModelId\\$aumid"; if (-not (Test-Path $reg)) { New-Item -Path $reg -Force | Out-Null }; New-ItemProperty -Path $reg -Name DisplayName -Value 'Suveren' -PropertyType String -Force | Out-Null; ` + (iconPath ? `New-ItemProperty -Path $reg -Name IconUri -Value ${psQuote(iconPath)} -PropertyType String -Force | Out-Null; ` : "") + `[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType=WindowsRuntime] | Out-Null; [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom, ContentType=WindowsRuntime] | Out-Null; $doc = New-Object Windows.Data.Xml.Dom.XmlDocument; $doc.LoadXml(${psQuote(toastXml)}); $toast = New-Object Windows.UI.Notifications.ToastNotification $doc; [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($aumid).Show($toast)`;
-}
-var MAC_SOUND = "Glass";
-function buildNotifyCommand(platform, title, message, options = {}) {
-  const { url, hasTerminalNotifier: hasTerminalNotifier2 = false, iconPath } = options;
-  switch (platform) {
-    case "darwin":
-      if (url && hasTerminalNotifier2) {
-        return {
-          cmd: "terminal-notifier",
-          args: [
-            "-title",
-            title,
-            "-message",
-            message,
-            "-open",
-            url,
-            "-sound",
-            MAC_SOUND,
-            ...iconPath ? ["-appIcon", iconPath] : [],
-            "-group",
-            "ai.suveren.gateway"
-          ]
-        };
-      }
-      return {
-        cmd: "osascript",
-        args: [
-          "-e",
-          `display notification ${osaQuote(message)} with title ${osaQuote(title)} sound name ${osaQuote(MAC_SOUND)}`
-        ]
-      };
-    case "win32":
-      return {
-        cmd: "powershell",
-        args: ["-NoProfile", "-NonInteractive", "-Command", windowsToastScript(title, message, url, iconPath)]
-      };
-    case "linux":
-      return {
-        cmd: "notify-send",
-        args: [
-          "--app-name=Suveren",
-          ...iconPath ? ["-i", iconPath] : [],
-          title,
-          message
-        ]
-      };
-    default:
-      return null;
-  }
-}
-function lockedNotification(port2) {
-  const url = `http://localhost:${port2}`;
-  return {
-    title: "Suveren is running but locked",
-    message: `Your agent has no authority until you unlock it. Open ${url} and enter your API key.`,
-    url
-  };
-}
-function sessionExpiredNotification(port2) {
-  const url = `http://localhost:${port2}`;
-  return {
-    title: "Suveren Gateway locked",
-    message: "Your sign-in has ended. Sign in again so your agents can act.",
-    url
-  };
-}
-var terminalNotifierCache = null;
-function hasTerminalNotifier() {
-  if (terminalNotifierCache !== null) return terminalNotifierCache;
-  try {
-    const probe = spawnSync2("terminal-notifier", ["-help"], { stdio: "ignore" });
-    terminalNotifierCache = probe.error === void 0;
-  } catch {
-    terminalNotifierCache = false;
-  }
-  return terminalNotifierCache;
-}
-function notifySpawnOptions(platform) {
-  return {
-    detached: platform !== "win32",
-    stdio: ["ignore", "ignore", "pipe"]
-  };
-}
-function notify(title, message, platform = process.platform, url) {
-  const command = buildNotifyCommand(platform, title, message, {
-    url,
-    hasTerminalNotifier: platform === "darwin" ? hasTerminalNotifier() : false,
-    // Windows and Linux show it on the toast itself; macOS only via
-    // terminal-notifier. Failure to write it must never block the sound.
-    iconPath: ensureNotifierIcon()
-  });
-  if (!command) return;
-  try {
-    const child = spawn(command.cmd, command.args, notifySpawnOptions(platform));
-    let stderr = "";
-    child.stderr?.on("data", (d) => {
-      stderr += d.toString().slice(0, 500);
-    });
-    child.on("close", (code) => {
-      if (code !== 0) {
-        console.error(`[notify] ${command.cmd} exited ${code}${stderr ? `: ${stderr.trim()}` : ""}`);
-      }
-    });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-
 // src/routes/encrypt-intent.ts
 import { Router as Router7 } from "express";
 
@@ -4380,62 +4532,6 @@ function startNotificationDispatcher(opts = {}) {
   return new NotificationDispatcher(opts).start();
 }
 
-// src/lib/session-lock.ts
-var SESSION_LOCKED_MESSAGE = "Your sign-in ended after 30 days or was revoked. Sign in again.";
-var AS_KEY_MISMATCH_MESSAGE = "The Authority Server presented a signing key that does not match the one pinned at pairing. Sign in again to review.";
-var AS_TLS_MISMATCH_MESSAGE = "A connection to the Authority Server presented a TLS certificate that does not match the one pinned at pairing. The connection was refused before anything was sent. If the certificate changed intentionally (a new key, not just renewal), clear the pairing and sign in again to re-pin it.";
-function createSessionLock(deps) {
-  const { vault: vault2, port: port2 } = deps;
-  const notifyFn = deps.notifyFn ?? notify;
-  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
-  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
-  return function lockExpiredSession2() {
-    if (!vault2.isUnlocked()) return;
-    vault2.lockExpired();
-    console.error("[Control Plane] Authority Server session ended \u2014 gateway LOCKED");
-    void unconfigureSessionFn().catch((err) => {
-      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
-    });
-    emit("session-locked", { reason: "expired", message: SESSION_LOCKED_MESSAGE });
-    const { title, message, url } = sessionExpiredNotification(port2);
-    notifyFn(title, message, process.platform, url);
-  };
-}
-function createAsKeyMismatchLock(deps) {
-  const { vault: vault2, port: port2 } = deps;
-  const notifyFn = deps.notifyFn ?? notify;
-  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
-  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
-  return function lockOnAsKeyMismatch() {
-    if (!vault2.isUnlocked()) return;
-    vault2.lockAsKeyMismatch();
-    console.error("[Control Plane] Authority Server key mismatch \u2014 gateway LOCKED");
-    void unconfigureSessionFn("as-key-mismatch").catch((err) => {
-      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
-    });
-    emit("session-locked", { reason: "as-key-mismatch", message: AS_KEY_MISMATCH_MESSAGE });
-    const { title, url } = sessionExpiredNotification(port2);
-    notifyFn(title, AS_KEY_MISMATCH_MESSAGE, process.platform, url);
-  };
-}
-function createAsTlsMismatchLock(deps) {
-  const { vault: vault2, port: port2 } = deps;
-  const notifyFn = deps.notifyFn ?? notify;
-  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
-  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
-  return function lockOnAsTlsMismatch() {
-    if (!vault2.isUnlocked()) return;
-    vault2.lockAsTlsMismatch();
-    console.error("[Control Plane] Authority Server TLS pin mismatch \u2014 gateway LOCKED");
-    void unconfigureSessionFn("as-tls-mismatch").catch((err) => {
-      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
-    });
-    emit("session-locked", { reason: "as-tls-mismatch", message: AS_TLS_MISMATCH_MESSAGE });
-    const { title, url } = sessionExpiredNotification(port2);
-    notifyFn(title, AS_TLS_MISMATCH_MESSAGE, process.platform, url);
-  };
-}
-
 // src/lib/session-expiry-scheduler.ts
 var MAX_TIMEOUT_MS = 2147483647;
 var SessionExpiryScheduler = class {
@@ -4555,6 +4651,7 @@ var SP_URL = resolveAsUrl(DATA_DIR);
 validatePinTlsForUrl(resolvePinTls(DATA_DIR), SP_URL);
 var POLICY_LOCKED = [...readPolicy().locked];
 var POLICY_LOCKED_INSTALL_METHOD = readPolicy().policy.installMethod;
+var POLICY_LOCKED_TEAM = readPolicy().policy.team;
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
 var UI_DIST = process.env.HAP_UI_DIST ?? join14(import.meta.dirname ?? __dirname, "../../ui/dist");
@@ -4594,6 +4691,7 @@ function loginRateLimit(req, res, next) {
 var lockExpiredSession = createSessionLock({ vault, port });
 var lockAsKeyMismatch = createAsKeyMismatchLock({ vault, port });
 var lockAsTlsMismatch = createAsTlsMismatchLock({ vault, port });
+var lockManagedWrongTeam = createManagedWrongTeamLock({ vault, port });
 var sessionExpiryScheduler = new SessionExpiryScheduler(
   () => vault.getSessionExpiresAt(),
   lockExpiredSession
@@ -4603,8 +4701,26 @@ app.use("/auth", jsonParser, createAuthRouter(
   requireAuth(vault),
   loginRateLimit,
   () => sessionExpiryScheduler.reschedule(),
-  { asUrl: SP_URL, dataDir: DATA_DIR }
+  { asUrl: SP_URL, dataDir: DATA_DIR },
+  lockAsTlsMismatch,
+  POLICY_LOCKED_TEAM
 ));
+var managedTeamScheduler = POLICY_LOCKED_TEAM ? new ManagedTeamScheduler(async () => {
+  if (!vault.isUnlocked()) return;
+  const cookie = vault.getSpCookie();
+  if (!cookie) return;
+  try {
+    const pin = readPairing(DATA_DIR);
+    const team = await activeTeamId(SP_URL, cookie, {
+      enforce: resolvePinTls(DATA_DIR),
+      pinnedSpkiHex: pin && pin.asUrl === SP_URL ? pin.tlsSpkiPinHex : void 0
+    });
+    if (team !== POLICY_LOCKED_TEAM) lockManagedWrongTeam(POLICY_LOCKED_TEAM);
+  } catch (err) {
+    console.error("[Control Plane] Managed-team check failed (will retry):", err);
+  }
+}) : null;
+managedTeamScheduler?.start();
 function resolveOrigin(req) {
   const fwdHost = req.get("x-forwarded-host");
   if (fwdHost) return `${req.protocol}://${fwdHost}`;
@@ -5141,8 +5257,13 @@ app.use(
           eventBus.emit("proposal-approved");
         } else if (method === "POST" && /^\/api\/proposals\/[^/]+\/reject$/.test(path)) {
           eventBus.emit("proposal-rejected");
-        } else if (method === "POST" && (path === "/api/groups" || path === "/api/groups/join" || /^\/api\/groups\/[^/]+\/(leave|disable|reactivate|admin-transfer)$/.test(path))) {
+        } else if (method === "POST" && (path === "/api/groups" || path === "/api/groups/join" || /^\/api\/groups\/[^/]+\/(leave|disable|reactivate|admin-transfer)$/.test(path)) || // WS0 (work-plan "Added 2026-10-11"): withdrawing a pending join
+        // request — the account stays Personal, but the onboarding UI's
+        // waiting state ends, same as every other membership-affecting
+        // call here.
+        method === "DELETE" && path === "/api/groups/join") {
           eventBus.emit("team-membership-changed");
+          if (managedTeamScheduler) void managedTeamScheduler.runNow();
         }
       }
     }