@suveren/gateway 0.25.1 → 0.27.0

package/dist/control-plane/index.mjs

@@ -127,6 +127,13 @@ var Vault = class {
     this.clearKey();
     this.lockedReason = "as-tls-mismatch";
   }
+  /** Lock because this is a managed gateway (IT policy `Team`) and the
+   *  signed-in account's active workspace is no longer that team — see
+   *  lib/managed-team.ts. Mirrors lockAsKeyMismatch() exactly. */
+  lockManagedWrongTeam() {
+    this.clearKey();
+    this.lockedReason = "managed-wrong-team";
+  }
   /**
    * Boot-time only: record that the gateway starts locked because the
    * resolved Authority Server URL differs from the one it was last paired
@@ -1299,7 +1306,7 @@ import { dirname as dirname4, join as join6 } from "path";
 import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { join as join5 } from "path";
 import { spawnSync } from "child_process";
-var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
+var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod", "Team"];
 var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
 function registryKeyPath(hive) {
   const baseKey = process.env.SUVEREN_POLICY_REGISTRY_KEY || DEFAULT_REGISTRY_BASE_KEY;
@@ -1335,6 +1342,11 @@ function validateCaFile(candidate) {
   if (!existsSync4(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
   return { ok: true, path: trimmed };
 }
+function validateTeamId(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The team id is empty." };
+  return { ok: true, id: trimmed };
+}
 function validateProxyUrl(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The proxy URL is empty." };
@@ -1508,6 +1520,14 @@ function readPolicy() {
     policy.installMethod = "managed";
     locked.add("installMethod");
   }
+  if (merged.Team !== void 0) {
+    const v = validateTeamId(String(merged.Team));
+    if (!v.ok) {
+      throw new Error(`Invalid policy Team ("${String(merged.Team)}") from ${sourceOf.Team}: ${v.error}`);
+    }
+    policy.team = v.id;
+    locked.add("team");
+  }
   cached = { policy, locked };
   return cached;
 }
@@ -1624,151 +1644,443 @@ function clearPinTlsExpectedFingerprint(dataDir) {
   writeAsConfig(dataDir, { pinTlsExpectedFingerprint: void 0 });
 }
 
-// src/routes/auth.ts
-var DEFAULT_SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
-async function fetchAsPublicKey(asUrl) {
-  try {
-    const { res } = await fetchAs(`${asUrl}/api/as/pubkey`, { signal: AbortSignal.timeout(5e3) }, { enforce: false });
-    if (!res.ok) {
-      return {
-        ok: false,
-        message: `Could not reach the Authority Server at ${asUrl} to read its signing key (HTTP ${res.status}). Refusing to sign in.`
-      };
-    }
-    const body = await res.json().catch(() => null);
-    if (!body || typeof body.publicKey !== "string" || !body.publicKey) {
-      return {
-        ok: false,
-        message: `The Authority Server at ${asUrl} returned a malformed signing key. Refusing to sign in.`
-      };
-    }
-    return { ok: true, publicKeyHex: body.publicKey };
-  } catch (err) {
-    return {
-      ok: false,
-      message: `Could not reach the Authority Server at ${asUrl} to read its signing key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
+// src/lib/managed-team.ts
+async function activeTeamId(asUrl, cookie, pinning) {
+  const { res } = await fetchAs(
+    `${asUrl}/api/groups/me`,
+    { headers: { Cookie: cookie }, signal: AbortSignal.timeout(1e4) },
+    pinning
+  );
+  if (!res.ok) throw new Error(`GET /api/groups/me answered ${res.status}`);
+  const data = await res.json();
+  return data.group?.id ?? null;
+}
+var ManagedTeamScheduler = class {
+  constructor(check2, opts = {}) {
+    this.check = check2;
+    this.setIntervalFn = opts.setIntervalFn ?? setInterval;
+    this.clearIntervalFn = opts.clearIntervalFn ?? clearInterval;
+    this.intervalMs = opts.intervalMs ?? 5 * 6e4;
+  }
+  timer = null;
+  setIntervalFn;
+  clearIntervalFn;
+  intervalMs;
+  start() {
+    if (this.timer) return;
+    this.timer = this.setIntervalFn(() => {
+      void this.check();
+    }, this.intervalMs);
+  }
+  stop() {
+    if (this.timer) this.clearIntervalFn(this.timer);
+    this.timer = null;
+  }
+  /** Test-only: run the check immediately, bypassing the timer. */
+  runNow() {
+    return this.check();
+  }
+};
+
+// src/lib/event-bus.ts
+var EventBus = class {
+  listeners = /* @__PURE__ */ new Set();
+  /**
+   * Subscribe to all bus events.
+   * Returns an unsubscribe function — callers MUST call it on disconnect / unmount
+   * to avoid listener leaks.
+   */
+  subscribe(handler) {
+    this.listeners.add(handler);
+    return () => {
+      this.listeners.delete(handler);
     };
   }
-}
-async function checkAsKeyBeforeLogin(asUrl, dataDir) {
-  const existing = readPairing(dataDir);
-  const pinnedKey = existing && existing.asUrl === asUrl ? existing.publicKeyHex : void 0;
-  const existingTlsPin = (existing && existing.asUrl === asUrl ? existing.tlsSpkiPinHex : void 0) ?? resolvePinTlsExpectedFingerprint(dataDir);
-  let candidateKey;
-  if (pinnedKey) {
-    candidateKey = pinnedKey;
-  } else {
-    const fetched = await fetchAsPublicKey(asUrl);
-    if (!fetched.ok) {
-      return { ok: false, error: "as_unreachable", message: fetched.message };
+  emit(type, payload) {
+    const event = { type, payload };
+    for (const handler of this.listeners) {
+      try {
+        handler(event);
+      } catch (err) {
+        console.error("[EventBus] subscriber threw:", err);
+      }
     }
-    candidateKey = fetched.publicKeyHex;
   }
-  const pinning = {
-    enforce: resolvePinTls(dataDir),
-    pinnedSpkiHex: existingTlsPin,
-    capture: true
-  };
-  let capturedTlsSpkiHex;
+  /** How many listeners are currently subscribed. Useful for tests and health checks. */
+  get listenerCount() {
+    return this.listeners.size;
+  }
+};
+var eventBus = new EventBus();
+
+// src/lib/desktop-notify.ts
+import { spawn, spawnSync as spawnSync2 } from "child_process";
+
+// src/lib/notifier-icon.ts
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync6 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join7, dirname as dirname5 } from "path";
+var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
+function ensureNotifierIcon(dataDir) {
   try {
-    const result = await verifyAsHoldsKey(asUrl, candidateKey, pinning);
-    capturedTlsSpkiHex = result.capturedTlsSpkiHex;
-  } catch (err) {
-    if (err instanceof AsTlsMismatchError) {
-      return { ok: false, error: "as_tls_mismatch", message: err.message };
-    }
-    if (err instanceof AsChallengeUnreachableError) {
-      return { ok: false, error: "as_unverified", message: `${err.message}. Refusing to sign in.` };
+    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join7(homedir2(), ".suveren");
+    const path = join7(dir, "notifier-icon.png");
+    if (!existsSync6(path)) {
+      mkdirSync4(dirname5(path), { recursive: true });
+      writeFileSync4(path, Buffer.from(ICON_BASE64, "base64"));
     }
-    if (err instanceof AsChallengeInvalidError) {
-      if (pinnedKey) {
+    return path;
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/desktop-notify.ts
+function osaQuote(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function psQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+var WINDOWS_AUMID = "Suveren.Gateway";
+function windowsToastScript(title, message, url, iconPath) {
+  const toastXml = `<toast${url ? ` activationType="protocol" launch="${xmlEscape(url)}"` : ""}><visual><binding template="ToastGeneric"><text>${xmlEscape(title)}</text><text>${xmlEscape(message)}</text>` + (iconPath ? `<image placement="appLogoOverride" src="${xmlEscape(iconPath)}"/>` : "") + `</binding></visual><audio src="ms-winsoundevent:Notification.Default"/></toast>`;
+  return `$ErrorActionPreference='SilentlyContinue'; $aumid=${psQuote(WINDOWS_AUMID)}; $reg="HKCU:\\Software\\Classes\\AppUserModelId\\$aumid"; if (-not (Test-Path $reg)) { New-Item -Path $reg -Force | Out-Null }; New-ItemProperty -Path $reg -Name DisplayName -Value 'Suveren' -PropertyType String -Force | Out-Null; ` + (iconPath ? `New-ItemProperty -Path $reg -Name IconUri -Value ${psQuote(iconPath)} -PropertyType String -Force | Out-Null; ` : "") + `[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType=WindowsRuntime] | Out-Null; [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom, ContentType=WindowsRuntime] | Out-Null; $doc = New-Object Windows.Data.Xml.Dom.XmlDocument; $doc.LoadXml(${psQuote(toastXml)}); $toast = New-Object Windows.UI.Notifications.ToastNotification $doc; [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($aumid).Show($toast)`;
+}
+var MAC_SOUND = "Glass";
+function buildNotifyCommand(platform, title, message, options = {}) {
+  const { url, hasTerminalNotifier: hasTerminalNotifier2 = false, iconPath } = options;
+  switch (platform) {
+    case "darwin":
+      if (url && hasTerminalNotifier2) {
         return {
-          ok: false,
-          error: "as_key_mismatch",
-          message: `The Authority Server at ${asUrl} does not match the one pinned when this gateway last signed in (pinned fingerprint ${fingerprintOf(pinnedKey)}) \u2014 its signing-key challenge did not verify (${err.message}). Refusing to sign in. If the AS's key changed intentionally, an operator must clear the old pairing before signing in again.`
+          cmd: "terminal-notifier",
+          args: [
+            "-title",
+            title,
+            "-message",
+            message,
+            "-open",
+            url,
+            "-sound",
+            MAC_SOUND,
+            ...iconPath ? ["-appIcon", iconPath] : [],
+            "-group",
+            "ai.suveren.gateway"
+          ]
         };
       }
       return {
-        ok: false,
-        error: "as_unverified",
-        message: `The Authority Server at ${asUrl} could not prove it holds the signing key it presented \u2014 ${err.message}. Refusing to sign in.`
+        cmd: "osascript",
+        args: [
+          "-e",
+          `display notification ${osaQuote(message)} with title ${osaQuote(title)} sound name ${osaQuote(MAC_SOUND)}`
+        ]
       };
-    }
-    throw err;
+    case "win32":
+      return {
+        cmd: "powershell",
+        args: ["-NoProfile", "-NonInteractive", "-Command", windowsToastScript(title, message, url, iconPath)]
+      };
+    case "linux":
+      return {
+        cmd: "notify-send",
+        args: [
+          "--app-name=Suveren",
+          ...iconPath ? ["-i", iconPath] : [],
+          title,
+          message
+        ]
+      };
+    default:
+      return null;
   }
+}
+function lockedNotification(port2) {
+  const url = `http://localhost:${port2}`;
   return {
-    ok: true,
-    publicKeyHex: candidateKey,
-    // A fresh capture (always present for https, unless pin-tls is on and
-    // an existing pin was enforced instead — see fetchAs) wins; otherwise
-    // whatever was already on file carries through unchanged.
-    tlsSpkiPinHex: capturedTlsSpkiHex ?? existingTlsPin
+    title: "Suveren is running but locked",
+    message: `Your agent has no authority until you unlock it. Open ${url} and enter your API key.`,
+    url
   };
 }
-function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished, pairing, lockAsTlsMismatch2 = () => {
-}) {
-  const router = Router();
-  const SP_URL2 = pairing?.asUrl ?? DEFAULT_SP_URL;
-  router.post("/login", loginRateLimit2, async (req, res) => {
-    const apiKey = req.headers["x-api-key"] || req.body?.apiKey;
-    const confirmWipe = req.body?.confirmWipe === true;
-    if (!apiKey) {
-      res.status(400).json({ error: "Missing API key (X-API-Key header or body.apiKey)" });
-      return;
-    }
-    try {
-      let keyCheck = null;
-      if (pairing) {
-        keyCheck = await checkAsKeyBeforeLogin(pairing.asUrl, pairing.dataDir);
-        if (!keyCheck.ok) {
-          const status = keyCheck.error === "as_key_mismatch" || keyCheck.error === "as_tls_mismatch" ? 409 : 502;
-          res.status(status).json({
-            error: keyCheck.error,
-            message: keyCheck.message
-          });
-          return;
-        }
-      }
-      const sessionPinning = {
-        enforce: Boolean(pairing && resolvePinTls(pairing.dataDir)),
-        pinnedSpkiHex: keyCheck?.tlsSpkiPinHex
-      };
-      let spRes;
-      try {
-        const result = await fetchAs(
-          `${SP_URL2}/api/auth/session`,
-          {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "X-API-Key": apiKey,
-              // The AS grants a 30-day gateway session ONLY to a login that
-              // identifies itself this way; without it, a 24-hour browser
-              // session (see doc at the top of this file).
-              ...clientVersionHeaders()
-            },
-            // Belt-and-suspenders on top of fetchAs's own default bound
-            // (as-tls-pin.ts): this is the exact call that hung in
-            // production (2026-10-02) with NO timeout at all — a dead
-            // keep-alive socket left the whole login request stuck forever.
-            signal: AbortSignal.timeout(1e4)
-          },
-          sessionPinning
-        );
-        spRes = result.res;
-      } catch (err) {
-        if (err instanceof AsTlsMismatchError) {
-          res.status(409).json({ error: "as_tls_mismatch", message: err.message });
-          return;
-        }
-        res.status(502).json({
-          error: "as_unreachable",
-          message: `Could not reach the Authority Server at ${SP_URL2} to sign in \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
-        });
-        return;
-      }
-      if (!spRes.ok) {
-        const err = await spRes.json().catch(() => ({ error: "Invalid API key" }));
+function sessionExpiredNotification(port2) {
+  const url = `http://localhost:${port2}`;
+  return {
+    title: "Suveren Gateway locked",
+    message: "Your sign-in has ended. Sign in again so your agents can act.",
+    url
+  };
+}
+var terminalNotifierCache = null;
+function hasTerminalNotifier() {
+  if (terminalNotifierCache !== null) return terminalNotifierCache;
+  try {
+    const probe = spawnSync2("terminal-notifier", ["-help"], { stdio: "ignore" });
+    terminalNotifierCache = probe.error === void 0;
+  } catch {
+    terminalNotifierCache = false;
+  }
+  return terminalNotifierCache;
+}
+function notifySpawnOptions(platform) {
+  return {
+    detached: platform !== "win32",
+    stdio: ["ignore", "ignore", "pipe"]
+  };
+}
+function notify(title, message, platform = process.platform, url) {
+  const command = buildNotifyCommand(platform, title, message, {
+    url,
+    hasTerminalNotifier: platform === "darwin" ? hasTerminalNotifier() : false,
+    // Windows and Linux show it on the toast itself; macOS only via
+    // terminal-notifier. Failure to write it must never block the sound.
+    iconPath: ensureNotifierIcon()
+  });
+  if (!command) return;
+  try {
+    const child = spawn(command.cmd, command.args, notifySpawnOptions(platform));
+    let stderr = "";
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString().slice(0, 500);
+    });
+    child.on("close", (code) => {
+      if (code !== 0) {
+        console.error(`[notify] ${command.cmd} exited ${code}${stderr ? `: ${stderr.trim()}` : ""}`);
+      }
+    });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+// src/lib/session-lock.ts
+var SESSION_LOCKED_MESSAGE = "Your sign-in ended after 30 days or was revoked. Sign in again.";
+var AS_KEY_MISMATCH_MESSAGE = "The Authority Server presented a signing key that does not match the one pinned at pairing. Sign in again to review.";
+var AS_TLS_MISMATCH_MESSAGE = "A connection to the Authority Server presented a TLS certificate that does not match the one pinned at pairing. The connection was refused before anything was sent. If the certificate changed intentionally (a new key, not just renewal), clear the pairing and sign in again to re-pin it.";
+function managedWrongTeamMessage(team) {
+  return `This gateway is set up by your IT for team ${team}. Your account is no longer in this team. Sign in with your team account, or ask your IT.`;
+}
+function createSessionLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockExpiredSession2() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockExpired();
+    console.error("[Control Plane] Authority Server session ended \u2014 gateway LOCKED");
+    void unconfigureSessionFn().catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "expired", message: SESSION_LOCKED_MESSAGE });
+    const { title, message, url } = sessionExpiredNotification(port2);
+    notifyFn(title, message, process.platform, url);
+  };
+}
+function createAsKeyMismatchLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnAsKeyMismatch() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockAsKeyMismatch();
+    console.error("[Control Plane] Authority Server key mismatch \u2014 gateway LOCKED");
+    void unconfigureSessionFn("as-key-mismatch").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "as-key-mismatch", message: AS_KEY_MISMATCH_MESSAGE });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, AS_KEY_MISMATCH_MESSAGE, process.platform, url);
+  };
+}
+function createAsTlsMismatchLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnAsTlsMismatch() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockAsTlsMismatch();
+    console.error("[Control Plane] Authority Server TLS pin mismatch \u2014 gateway LOCKED");
+    void unconfigureSessionFn("as-tls-mismatch").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "as-tls-mismatch", message: AS_TLS_MISMATCH_MESSAGE });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, AS_TLS_MISMATCH_MESSAGE, process.platform, url);
+  };
+}
+function createManagedWrongTeamLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnManagedWrongTeam(team) {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockManagedWrongTeam();
+    console.error("[Control Plane] Managed gateway: signed-in account is no longer in the locked team \u2014 gateway LOCKED");
+    const message = managedWrongTeamMessage(team);
+    void unconfigureSessionFn("managed-wrong-team").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "managed-wrong-team", message });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, message, process.platform, url);
+  };
+}
+
+// src/routes/auth.ts
+var DEFAULT_SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
+async function fetchAsPublicKey(asUrl) {
+  try {
+    const { res } = await fetchAs(`${asUrl}/api/as/pubkey`, { signal: AbortSignal.timeout(5e3) }, { enforce: false });
+    if (!res.ok) {
+      return {
+        ok: false,
+        message: `Could not reach the Authority Server at ${asUrl} to read its signing key (HTTP ${res.status}). Refusing to sign in.`
+      };
+    }
+    const body = await res.json().catch(() => null);
+    if (!body || typeof body.publicKey !== "string" || !body.publicKey) {
+      return {
+        ok: false,
+        message: `The Authority Server at ${asUrl} returned a malformed signing key. Refusing to sign in.`
+      };
+    }
+    return { ok: true, publicKeyHex: body.publicKey };
+  } catch (err) {
+    return {
+      ok: false,
+      message: `Could not reach the Authority Server at ${asUrl} to read its signing key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
+    };
+  }
+}
+async function checkAsKeyBeforeLogin(asUrl, dataDir) {
+  const existing = readPairing(dataDir);
+  const pinnedKey = existing && existing.asUrl === asUrl ? existing.publicKeyHex : void 0;
+  const existingTlsPin = (existing && existing.asUrl === asUrl ? existing.tlsSpkiPinHex : void 0) ?? resolvePinTlsExpectedFingerprint(dataDir);
+  let candidateKey;
+  if (pinnedKey) {
+    candidateKey = pinnedKey;
+  } else {
+    const fetched = await fetchAsPublicKey(asUrl);
+    if (!fetched.ok) {
+      return { ok: false, error: "as_unreachable", message: fetched.message };
+    }
+    candidateKey = fetched.publicKeyHex;
+  }
+  const pinning = {
+    enforce: resolvePinTls(dataDir),
+    pinnedSpkiHex: existingTlsPin,
+    capture: true
+  };
+  let capturedTlsSpkiHex;
+  try {
+    const result = await verifyAsHoldsKey(asUrl, candidateKey, pinning);
+    capturedTlsSpkiHex = result.capturedTlsSpkiHex;
+  } catch (err) {
+    if (err instanceof AsTlsMismatchError) {
+      return { ok: false, error: "as_tls_mismatch", message: err.message };
+    }
+    if (err instanceof AsChallengeUnreachableError) {
+      return { ok: false, error: "as_unverified", message: `${err.message}. Refusing to sign in.` };
+    }
+    if (err instanceof AsChallengeInvalidError) {
+      if (pinnedKey) {
+        return {
+          ok: false,
+          error: "as_key_mismatch",
+          message: `The Authority Server at ${asUrl} does not match the one pinned when this gateway last signed in (pinned fingerprint ${fingerprintOf(pinnedKey)}) \u2014 its signing-key challenge did not verify (${err.message}). Refusing to sign in. If the AS's key changed intentionally, an operator must clear the old pairing before signing in again.`
+        };
+      }
+      return {
+        ok: false,
+        error: "as_unverified",
+        message: `The Authority Server at ${asUrl} could not prove it holds the signing key it presented \u2014 ${err.message}. Refusing to sign in.`
+      };
+    }
+    throw err;
+  }
+  return {
+    ok: true,
+    publicKeyHex: candidateKey,
+    // A fresh capture (always present for https, unless pin-tls is on and
+    // an existing pin was enforced instead — see fetchAs) wins; otherwise
+    // whatever was already on file carries through unchanged.
+    tlsSpkiPinHex: capturedTlsSpkiHex ?? existingTlsPin
+  };
+}
+function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished, pairing, lockAsTlsMismatch2 = () => {
+}, managedTeamId) {
+  const router = Router();
+  const SP_URL2 = pairing?.asUrl ?? DEFAULT_SP_URL;
+  router.post("/login", loginRateLimit2, async (req, res) => {
+    const apiKey = req.headers["x-api-key"] || req.body?.apiKey;
+    const confirmWipe = req.body?.confirmWipe === true;
+    if (!apiKey) {
+      res.status(400).json({ error: "Missing API key (X-API-Key header or body.apiKey)" });
+      return;
+    }
+    try {
+      let keyCheck = null;
+      if (pairing) {
+        keyCheck = await checkAsKeyBeforeLogin(pairing.asUrl, pairing.dataDir);
+        if (!keyCheck.ok) {
+          const status = keyCheck.error === "as_key_mismatch" || keyCheck.error === "as_tls_mismatch" ? 409 : 502;
+          res.status(status).json({
+            error: keyCheck.error,
+            message: keyCheck.message
+          });
+          return;
+        }
+      }
+      const sessionPinning = {
+        enforce: Boolean(pairing && resolvePinTls(pairing.dataDir)),
+        pinnedSpkiHex: keyCheck?.tlsSpkiPinHex
+      };
+      let spRes;
+      try {
+        const result = await fetchAs(
+          `${SP_URL2}/api/auth/session`,
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "X-API-Key": apiKey,
+              // The AS grants a 30-day gateway session ONLY to a login that
+              // identifies itself this way; without it, a 24-hour browser
+              // session (see doc at the top of this file).
+              ...clientVersionHeaders()
+            },
+            // Belt-and-suspenders on top of fetchAs's own default bound
+            // (as-tls-pin.ts): this is the exact call that hung in
+            // production (2026-10-02) with NO timeout at all — a dead
+            // keep-alive socket left the whole login request stuck forever.
+            signal: AbortSignal.timeout(1e4)
+          },
+          sessionPinning
+        );
+        spRes = result.res;
+      } catch (err) {
+        if (err instanceof AsTlsMismatchError) {
+          res.status(409).json({ error: "as_tls_mismatch", message: err.message });
+          return;
+        }
+        res.status(502).json({
+          error: "as_unreachable",
+          message: `Could not reach the Authority Server at ${SP_URL2} to sign in \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
+        });
+        return;
+      }
+      if (!spRes.ok) {
+        const err = await spRes.json().catch(() => ({ error: "Invalid API key" }));
         res.status(spRes.status).json(err);
         return;
       }
@@ -1788,6 +2100,25 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
       const data = await spRes.json();
       const setCookieHeaders = spRes.headers.getSetCookie?.() ?? [];
       const sessionCookie = setCookieHeaders.join("; ");
+      if (managedTeamId) {
+        let activeTeam;
+        try {
+          activeTeam = await activeTeamId(SP_URL2, sessionCookie, sessionPinning);
+        } catch (err) {
+          res.status(502).json({
+            error: "as_unreachable",
+            message: `Could not confirm your team membership with the Authority Server \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
+          });
+          return;
+        }
+        if (activeTeam !== managedTeamId) {
+          res.status(403).json({
+            error: "managed_wrong_team",
+            message: managedWrongTeamMessage(managedTeamId)
+          });
+          return;
+        }
+      }
       vault2.setSpCookie(sessionCookie);
       await vault2.deriveAndSetKey(apiKey);
       if (vault2.isVaultFromDifferentKey()) {
@@ -2561,17 +2892,17 @@ async function testAIConnectivity(config) {
 }
 
 // src/lib/agent-brief-store.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join8 } from "path";
 var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
 function agentBriefPath() {
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join7(homedir2(), ".suveren");
-  return join7(dataDir, "context.md");
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join8(homedir3(), ".suveren");
+  return join8(dataDir, "context.md");
 }
 function readAgentBrief() {
   const filePath = agentBriefPath();
-  if (!existsSync6(filePath)) return "";
+  if (!existsSync7(filePath)) return "";
   return readFileSync8(filePath, "utf-8");
 }
 
@@ -2853,39 +3184,6 @@ async function backfillReadPolicyDefaults(data) {
 
 // src/routes/mcp.ts
 import { Router as Router5 } from "express";
-
-// src/lib/event-bus.ts
-var EventBus = class {
-  listeners = /* @__PURE__ */ new Set();
-  /**
-   * Subscribe to all bus events.
-   * Returns an unsubscribe function — callers MUST call it on disconnect / unmount
-   * to avoid listener leaks.
-   */
-  subscribe(handler) {
-    this.listeners.add(handler);
-    return () => {
-      this.listeners.delete(handler);
-    };
-  }
-  emit(type, payload) {
-    const event = { type, payload };
-    for (const handler of this.listeners) {
-      try {
-        handler(event);
-      } catch (err) {
-        console.error("[EventBus] subscriber threw:", err);
-      }
-    }
-  }
-  /** How many listeners are currently subscribed. Useful for tests and health checks. */
-  get listenerCount() {
-    return this.listeners.size;
-  }
-};
-var eventBus = new EventBus();
-
-// src/routes/mcp.ts
 function createMCPRouter() {
   const router = Router5();
   router.get("/health", async (_req, res) => {
@@ -2958,7 +3256,7 @@ function createMCPRouter() {
 // src/routes/autostart.ts
 import { Router as Router6 } from "express";
 import { execFile } from "child_process";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { dirname as pathDirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
@@ -2979,7 +3277,7 @@ function findCli(dirname10 = MODULE_DIR) {
     // resolves differently between a shell and a login service — and it would
     // mask a genuinely missing CLI whenever the cwd happened to be the repo.
   ];
-  return candidates.find(existsSync7) ?? null;
+  return candidates.find(existsSync8) ?? null;
 }
 async function cli(args) {
   const bin = findCli();
@@ -2998,208 +3296,62 @@ async function cli(args) {
 function safe(handler) {
   return (req, res) => {
     handler(req, res).catch((err) => {
-      const message = err instanceof Error ? err.message : String(err);
-      console.error("[Autostart] handler failed:", message);
-      if (!res.headersSent) res.status(500).json({ error: "autostart_failed", message });
-    });
-  };
-}
-function createAutostartRouter() {
-  const router = Router6();
-  router.get("/", safe(async (_req, res) => {
-    const platform = process.platform;
-    const supported = SUPPORTED.has(platform);
-    const bin = findCli();
-    if (!supported || !bin) {
-      res.json({
-        supported: false,
-        installed: false,
-        platform,
-        // Be specific about WHICH of the two reasons applies — "unavailable"
-        // with no cause is the kind of dead end that generates support mail.
-        reason: !supported ? `Autostart is not available on ${platform}.` : "Autostart needs the packaged gateway; it is unavailable when running from source."
-      });
-      return;
-    }
-    const { output } = await cli(["service", "status"]);
-    res.json({
-      supported: true,
-      installed: /Login service:\s*installed/i.test(output),
-      platform,
-      detail: output
-    });
-  }));
-  router.post("/", safe(async (_req, res) => {
-    if (!SUPPORTED.has(process.platform) || !findCli()) {
-      res.status(400).json({ error: "unsupported", message: "Autostart is not available here." });
-      return;
-    }
-    const { ok, output } = await cli(["service", "install"]);
-    if (!ok) {
-      res.status(500).json({ error: "install_failed", message: output });
-      return;
-    }
-    res.json({ ok: true, installed: true, detail: output });
-  }));
-  router.delete("/", safe(async (_req, res) => {
-    if (!SUPPORTED.has(process.platform) || !findCli()) {
-      res.status(400).json({ error: "unsupported", message: "Autostart is not available here." });
-      return;
-    }
-    const { ok, output } = await cli(["service", "uninstall"]);
-    if (!ok) {
-      res.status(500).json({ error: "uninstall_failed", message: output });
-      return;
-    }
-    res.json({ ok: true, installed: false, detail: output });
-  }));
-  return router;
-}
-
-// src/lib/desktop-notify.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
-
-// src/lib/notifier-icon.ts
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync8 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join8, dirname as dirname5 } from "path";
-var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
-function ensureNotifierIcon(dataDir) {
-  try {
-    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join8(homedir3(), ".suveren");
-    const path = join8(dir, "notifier-icon.png");
-    if (!existsSync8(path)) {
-      mkdirSync4(dirname5(path), { recursive: true });
-      writeFileSync4(path, Buffer.from(ICON_BASE64, "base64"));
-    }
-    return path;
-  } catch {
-    return null;
-  }
-}
-
-// src/lib/desktop-notify.ts
-function osaQuote(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-function psQuote(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-function xmlEscape(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
-}
-var WINDOWS_AUMID = "Suveren.Gateway";
-function windowsToastScript(title, message, url, iconPath) {
-  const toastXml = `<toast${url ? ` activationType="protocol" launch="${xmlEscape(url)}"` : ""}><visual><binding template="ToastGeneric"><text>${xmlEscape(title)}</text><text>${xmlEscape(message)}</text>` + (iconPath ? `<image placement="appLogoOverride" src="${xmlEscape(iconPath)}"/>` : "") + `</binding></visual><audio src="ms-winsoundevent:Notification.Default"/></toast>`;
-  return `$ErrorActionPreference='SilentlyContinue'; $aumid=${psQuote(WINDOWS_AUMID)}; $reg="HKCU:\\Software\\Classes\\AppUserModelId\\$aumid"; if (-not (Test-Path $reg)) { New-Item -Path $reg -Force | Out-Null }; New-ItemProperty -Path $reg -Name DisplayName -Value 'Suveren' -PropertyType String -Force | Out-Null; ` + (iconPath ? `New-ItemProperty -Path $reg -Name IconUri -Value ${psQuote(iconPath)} -PropertyType String -Force | Out-Null; ` : "") + `[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType=WindowsRuntime] | Out-Null; [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom, ContentType=WindowsRuntime] | Out-Null; $doc = New-Object Windows.Data.Xml.Dom.XmlDocument; $doc.LoadXml(${psQuote(toastXml)}); $toast = New-Object Windows.UI.Notifications.ToastNotification $doc; [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($aumid).Show($toast)`;
-}
-var MAC_SOUND = "Glass";
-function buildNotifyCommand(platform, title, message, options = {}) {
-  const { url, hasTerminalNotifier: hasTerminalNotifier2 = false, iconPath } = options;
-  switch (platform) {
-    case "darwin":
-      if (url && hasTerminalNotifier2) {
-        return {
-          cmd: "terminal-notifier",
-          args: [
-            "-title",
-            title,
-            "-message",
-            message,
-            "-open",
-            url,
-            "-sound",
-            MAC_SOUND,
-            ...iconPath ? ["-appIcon", iconPath] : [],
-            "-group",
-            "ai.suveren.gateway"
-          ]
-        };
-      }
-      return {
-        cmd: "osascript",
-        args: [
-          "-e",
-          `display notification ${osaQuote(message)} with title ${osaQuote(title)} sound name ${osaQuote(MAC_SOUND)}`
-        ]
-      };
-    case "win32":
-      return {
-        cmd: "powershell",
-        args: ["-NoProfile", "-NonInteractive", "-Command", windowsToastScript(title, message, url, iconPath)]
-      };
-    case "linux":
-      return {
-        cmd: "notify-send",
-        args: [
-          "--app-name=Suveren",
-          ...iconPath ? ["-i", iconPath] : [],
-          title,
-          message
-        ]
-      };
-    default:
-      return null;
-  }
-}
-function lockedNotification(port2) {
-  const url = `http://localhost:${port2}`;
-  return {
-    title: "Suveren is running but locked",
-    message: `Your agent has no authority until you unlock it. Open ${url} and enter your API key.`,
-    url
-  };
-}
-function sessionExpiredNotification(port2) {
-  const url = `http://localhost:${port2}`;
-  return {
-    title: "Suveren Gateway locked",
-    message: "Your sign-in has ended. Sign in again so your agents can act.",
-    url
-  };
-}
-var terminalNotifierCache = null;
-function hasTerminalNotifier() {
-  if (terminalNotifierCache !== null) return terminalNotifierCache;
-  try {
-    const probe = spawnSync2("terminal-notifier", ["-help"], { stdio: "ignore" });
-    terminalNotifierCache = probe.error === void 0;
-  } catch {
-    terminalNotifierCache = false;
-  }
-  return terminalNotifierCache;
-}
-function notifySpawnOptions(platform) {
-  return {
-    detached: platform !== "win32",
-    stdio: ["ignore", "ignore", "pipe"]
-  };
-}
-function notify(title, message, platform = process.platform, url) {
-  const command = buildNotifyCommand(platform, title, message, {
-    url,
-    hasTerminalNotifier: platform === "darwin" ? hasTerminalNotifier() : false,
-    // Windows and Linux show it on the toast itself; macOS only via
-    // terminal-notifier. Failure to write it must never block the sound.
-    iconPath: ensureNotifierIcon()
-  });
-  if (!command) return;
-  try {
-    const child = spawn(command.cmd, command.args, notifySpawnOptions(platform));
-    let stderr = "";
-    child.stderr?.on("data", (d) => {
-      stderr += d.toString().slice(0, 500);
-    });
-    child.on("close", (code) => {
-      if (code !== 0) {
-        console.error(`[notify] ${command.cmd} exited ${code}${stderr ? `: ${stderr.trim()}` : ""}`);
-      }
+      const message = err instanceof Error ? err.message : String(err);
+      console.error("[Autostart] handler failed:", message);
+      if (!res.headersSent) res.status(500).json({ error: "autostart_failed", message });
     });
-    child.on("error", () => {
+  };
+}
+function createAutostartRouter() {
+  const router = Router6();
+  router.get("/", safe(async (_req, res) => {
+    const platform = process.platform;
+    const supported = SUPPORTED.has(platform);
+    const bin = findCli();
+    if (!supported || !bin) {
+      res.json({
+        supported: false,
+        installed: false,
+        platform,
+        // Be specific about WHICH of the two reasons applies — "unavailable"
+        // with no cause is the kind of dead end that generates support mail.
+        reason: !supported ? `Autostart is not available on ${platform}.` : "Autostart needs the packaged gateway; it is unavailable when running from source."
+      });
+      return;
+    }
+    const { output } = await cli(["service", "status"]);
+    res.json({
+      supported: true,
+      installed: /Login service:\s*installed/i.test(output),
+      platform,
+      detail: output
     });
-    child.unref();
-  } catch {
-  }
+  }));
+  router.post("/", safe(async (_req, res) => {
+    if (!SUPPORTED.has(process.platform) || !findCli()) {
+      res.status(400).json({ error: "unsupported", message: "Autostart is not available here." });
+      return;
+    }
+    const { ok, output } = await cli(["service", "install"]);
+    if (!ok) {
+      res.status(500).json({ error: "install_failed", message: output });
+      return;
+    }
+    res.json({ ok: true, installed: true, detail: output });
+  }));
+  router.delete("/", safe(async (_req, res) => {
+    if (!SUPPORTED.has(process.platform) || !findCli()) {
+      res.status(400).json({ error: "unsupported", message: "Autostart is not available here." });
+      return;
+    }
+    const { ok, output } = await cli(["service", "uninstall"]);
+    if (!ok) {
+      res.status(500).json({ error: "uninstall_failed", message: output });
+      return;
+    }
+    res.json({ ok: true, installed: false, detail: output });
+  }));
+  return router;
 }
 
 // src/routes/encrypt-intent.ts
@@ -3426,6 +3578,106 @@ function createEvidenceExportRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2)
 // src/routes/proposal-preview.ts
 import { Router as Router10 } from "express";
 
+// src/lib/content-crypto.ts
+import { createHash as createHash4 } from "crypto";
+import { canonicalize as canonicalize2 } from "@hap/core";
+var CONTENT_ALG = "HPKE-X25519-HKDF-SHA256-AES256GCM";
+function computeProposalContentHash(toolArgs) {
+  return `sha256:${createHash4("sha256").update(canonicalize2(toolArgs)).digest("hex")}`;
+}
+function toB64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function keysToWire(encryptedKeys) {
+  const keys = {};
+  for (const [userId, wrap] of Object.entries(encryptedKeys)) {
+    keys[userId] = { ct: toB64(wrap.ct), enc: toB64(wrap.enc) };
+  }
+  return keys;
+}
+async function fetchUserPubkey(userId, deps) {
+  const pin = readPairing(deps.dataDir);
+  const pinning = {
+    enforce: resolvePinTls(deps.dataDir),
+    pinnedSpkiHex: pin && pin.asUrl === deps.spUrl ? pin.tlsSpkiPinHex : void 0
+  };
+  try {
+    const { res } = await fetchAs(
+      `${deps.spUrl}/api/users/${encodeURIComponent(userId)}/pubkey`,
+      { headers: { Cookie: deps.cookie }, signal: AbortSignal.timeout(5e3) },
+      pinning
+    );
+    if (!res.ok) return null;
+    const data = await res.json().catch(() => ({}));
+    return typeof data.pubkey === "string" ? data.pubkey : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveRecipientPubkeys(recipientUserIds, deps) {
+  const ids = Array.from(/* @__PURE__ */ new Set([deps.selfUserId, ...recipientUserIds]));
+  const resolved = [];
+  const unreadableFor = [];
+  for (const userId of ids) {
+    const pubkeyB64 = await fetchUserPubkey(userId, deps);
+    if (!pubkeyB64) {
+      unreadableFor.push(userId);
+      continue;
+    }
+    try {
+      const bytes = new Uint8Array(Buffer.from(pubkeyB64, "base64"));
+      if (bytes.length !== 32) {
+        unreadableFor.push(userId);
+        continue;
+      }
+      resolved.push({ userId, publicKey: bytes });
+    } catch {
+      unreadableFor.push(userId);
+    }
+  }
+  return { resolved, unreadableFor };
+}
+async function encryptProposalContent(toolArgs, recipientUserIds, deps) {
+  const canonical = canonicalize2(toolArgs);
+  const hash = computeProposalContentHash(toolArgs);
+  const { resolved, unreadableFor } = await resolveRecipientPubkeys(recipientUserIds, deps);
+  if (resolved.length === 0) {
+    throw new Error("No recipient (including the submitter) has a registered end-to-end key \u2014 cannot encrypt this proposal.");
+  }
+  const encrypted = await encryptForRecipients(canonical, resolved);
+  return {
+    content: { v: 1, alg: CONTENT_ALG, ciphertext: toB64(encrypted.intentCiphertext), keys: keysToWire(encrypted.encryptedKeys), hash },
+    unreadableFor
+  };
+}
+async function encryptProposalNote(note, recipientUserIds, deps) {
+  const { resolved, unreadableFor } = await resolveRecipientPubkeys(recipientUserIds, deps);
+  if (resolved.length === 0) {
+    throw new Error("No recipient (including the submitter) has a registered end-to-end key \u2014 cannot encrypt this note.");
+  }
+  const encrypted = await encryptForRecipients(note, resolved);
+  return {
+    noteEncrypted: { ciphertext: toB64(encrypted.intentCiphertext), keys: keysToWire(encrypted.encryptedKeys) },
+    unreadableFor
+  };
+}
+async function decryptProposalContent(wire, myUserId, myPrivateKey) {
+  const wrap = wire.keys[myUserId];
+  if (!wrap) {
+    throw new Error("No key wrap for this account in this content \u2014 this device cannot read it.");
+  }
+  const encrypted = {
+    intentCiphertext: new Uint8Array(Buffer.from(wire.ciphertext, "base64")),
+    encryptedKeys: {
+      [myUserId]: {
+        ct: new Uint8Array(Buffer.from(wrap.ct, "base64")),
+        enc: new Uint8Array(Buffer.from(wrap.enc, "base64"))
+      }
+    }
+  };
+  return decryptIntent(encrypted, myUserId, myPrivateKey);
+}
+
 // src/lib/execution-journal-reader.ts
 import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
 import { join as join10 } from "path";
@@ -3492,8 +3744,25 @@ function createProposalStatusRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2)
       res.status(502).json({ error: `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}` });
       return;
     }
+    let toolArgs;
+    if (proposal.toolArgs) {
+      toolArgs = proposal.toolArgs;
+    } else if (proposal.content) {
+      try {
+        const kp = await loadOrGenerateKeyPair(vault2);
+        const me = vault2.getSessionUser();
+        const plaintext = await decryptProposalContent(proposal.content, me?.id ?? "", kp.privateKey);
+        toolArgs = JSON.parse(plaintext);
+      } catch (err) {
+        res.json({ status: "unavailable", reason: "connector_error", message: `Could not decrypt this proposal's content on this device: ${err instanceof Error ? err.message : String(err)}` });
+        return;
+      }
+    } else {
+      res.status(502).json({ error: `Proposal ${proposalId} carries neither tool_args nor content.` });
+      return;
+    }
     try {
-      const result = await getToolPreview({ proposalId, tool: proposal.tool, toolArgs: proposal.toolArgs });
+      const result = await getToolPreview({ proposalId, tool: proposal.tool, toolArgs });
       if (result.status !== "ok") {
         res.json(result);
         return;
@@ -3539,7 +3808,7 @@ function createProposalStatusRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2)
 // src/routes/evidence.ts
 import { Router as Router11 } from "express";
 import { createPublicKey as createPublicKey2, verify as verifyEd25519 } from "crypto";
-import { verifyTicketSignature, encodeDidKey, canonicalize as canonicalize2 } from "@hap/core";
+import { verifyTicketSignature, encodeDidKey, canonicalize as canonicalize3 } from "@hap/core";
 function issuerFromPublicKeyHex(publicKeyHex) {
   return encodeDidKey(Buffer.from(publicKeyHex, "hex"));
 }
@@ -3558,7 +3827,7 @@ function verifyPreV07TicketSignature(receipt, asPublicKeyHex) {
     });
     const sig = Buffer.from(signature, "base64");
     if (sig.length !== 64) return false;
-    return verifyEd25519(null, Buffer.from(canonicalize2(signed), "utf8"), key, sig);
+    return verifyEd25519(null, Buffer.from(canonicalize3(signed), "utf8"), key, sig);
   } catch {
     return false;
   }
@@ -3770,6 +4039,161 @@ function createDecryptIntentRouter(vault2) {
   return router;
 }
 
+// src/routes/decrypt-proposal-content.ts
+import { Router as Router14 } from "express";
+function createDecryptProposalContentRouter(vault2) {
+  const router = Router14();
+  router.post("/", async (req, res) => {
+    const { ciphertext, keys } = req.body;
+    if (typeof ciphertext !== "string" || ciphertext.length === 0) {
+      res.status(400).json({ error: "Missing or invalid field: ciphertext (base64 string)" });
+      return;
+    }
+    if (typeof keys !== "object" || keys === null) {
+      res.status(400).json({ error: "Missing or invalid field: keys (object)" });
+      return;
+    }
+    const me = vault2.getSessionUser();
+    if (!me) {
+      res.status(401).json({ error: "No Authority Server session." });
+      return;
+    }
+    try {
+      const kp = await loadOrGenerateKeyPair(vault2);
+      const plaintext = await decryptProposalContent(
+        { ciphertext, keys },
+        me.id,
+        kp.privateKey
+      );
+      res.json({ plaintext });
+    } catch (err) {
+      console.error("[Control Plane] decrypt-proposal-content error:", err);
+      const msg = err instanceof Error ? err.message : "Decryption failed";
+      res.status(msg.includes("No key wrap") ? 403 : 500).json({ error: msg });
+    }
+  });
+  return router;
+}
+
+// src/routes/encrypt-proposal-note.ts
+import { Router as Router15 } from "express";
+var MAX_NOTE_LENGTH = 500;
+function createEncryptProposalNoteRouter(vault2, spUrl, dataDir) {
+  const router = Router15();
+  router.post("/", async (req, res) => {
+    const { note, recipientUserIds } = req.body;
+    if (typeof note !== "string" || note.length === 0 || note.length > MAX_NOTE_LENGTH) {
+      res.status(400).json({ error: `note must be a non-empty string up to ${MAX_NOTE_LENGTH} characters` });
+      return;
+    }
+    if (!Array.isArray(recipientUserIds) || !recipientUserIds.every((id) => typeof id === "string")) {
+      res.status(400).json({ error: "recipientUserIds must be a string array" });
+      return;
+    }
+    const me = vault2.getSessionUser();
+    const cookie = vault2.getSpCookie();
+    if (!me || !cookie) {
+      res.status(401).json({ error: "No Authority Server session." });
+      return;
+    }
+    try {
+      const { noteEncrypted, unreadableFor } = await encryptProposalNote(
+        note,
+        recipientUserIds,
+        { spUrl, cookie, dataDir, selfUserId: me.id }
+      );
+      res.json({ noteEncrypted, unreadableFor });
+    } catch (err) {
+      console.error("[Control Plane] encrypt-proposal-note error:", err);
+      res.status(500).json({ error: err instanceof Error ? err.message : "Encryption failed" });
+    }
+  });
+  return router;
+}
+
+// src/routes/internal-content-crypto.ts
+import { Router as Router16 } from "express";
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+var MAX_RECIPIENTS = 50;
+function secretMatches(provided, expected) {
+  if (!expected || !provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual2(a, b);
+}
+function createInternalContentCryptoRouter(getSecret, vault2, spUrl, dataDir) {
+  const router = Router16();
+  router.post("/encrypt-content", async (req, res) => {
+    if (!secretMatches(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
+      res.status(401).json({ error: "unauthorized" });
+      return;
+    }
+    const { toolArgs, recipientUserIds } = req.body ?? {};
+    if (typeof toolArgs !== "object" || toolArgs === null || Array.isArray(toolArgs)) {
+      res.status(400).json({ error: "toolArgs must be an object" });
+      return;
+    }
+    if (!Array.isArray(recipientUserIds) || !recipientUserIds.every((id) => typeof id === "string")) {
+      res.status(400).json({ error: "recipientUserIds must be a string array" });
+      return;
+    }
+    if (recipientUserIds.length > MAX_RECIPIENTS) {
+      res.status(400).json({ error: `too many recipients (max ${MAX_RECIPIENTS})` });
+      return;
+    }
+    const me = vault2.getSessionUser();
+    const cookie = vault2.getSpCookie();
+    if (!me || !cookie) {
+      res.status(401).json({ error: "no Authority Server session" });
+      return;
+    }
+    try {
+      const { content, unreadableFor } = await encryptProposalContent(
+        toolArgs,
+        recipientUserIds,
+        { spUrl, cookie, dataDir, selfUserId: me.id }
+      );
+      res.json({ content, unreadableFor });
+    } catch (err) {
+      console.error("[Control Plane] /internal/encrypt-content failed:", err);
+      res.status(500).json({ error: err instanceof Error ? err.message : "encryption failed" });
+    }
+  });
+  router.post("/decrypt-content", async (req, res) => {
+    if (!secretMatches(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
+      res.status(401).json({ error: "unauthorized" });
+      return;
+    }
+    const { ciphertext, keys } = req.body ?? {};
+    if (typeof ciphertext !== "string" || ciphertext.length === 0) {
+      res.status(400).json({ error: "ciphertext (base64 string) is required" });
+      return;
+    }
+    if (typeof keys !== "object" || keys === null) {
+      res.status(400).json({ error: "keys (object) is required" });
+      return;
+    }
+    const me = vault2.getSessionUser();
+    if (!me) {
+      res.status(401).json({ error: "no Authority Server session" });
+      return;
+    }
+    try {
+      const kp = await loadOrGenerateKeyPair(vault2);
+      const plaintext = await decryptProposalContent(
+        { ciphertext, keys },
+        me.id,
+        kp.privateKey
+      );
+      res.json({ plaintext });
+    } catch (err) {
+      console.error("[Control Plane] /internal/decrypt-content failed:", err);
+      res.status(500).json({ error: err instanceof Error ? err.message : "decryption failed" });
+    }
+  });
+  return router;
+}
+
 // src/lib/update-checker.ts
 import { execSync } from "child_process";
 import { dirname as dirname6 } from "path";
@@ -3908,7 +4332,7 @@ data: ${data}
 }
 
 // src/routes/gateway-settings.ts
-import { Router as Router14 } from "express";
+import { Router as Router17 } from "express";
 
 // src/lib/gateway-settings.ts
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
@@ -3944,7 +4368,7 @@ function writeSettings(patch, dataDir) {
 
 // src/routes/gateway-settings.ts
 function createGatewaySettingsRouter() {
-  const router = Router14();
+  const router = Router17();
   router.get("/", (_req, res) => {
     res.json(readSettings());
   });
@@ -3967,7 +4391,7 @@ function createGatewaySettingsRouter() {
 }
 
 // src/routes/archived-mandates.ts
-import { Router as Router15 } from "express";
+import { Router as Router18 } from "express";
 
 // src/lib/archived-mandates-store.ts
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
@@ -4010,7 +4434,7 @@ function unarchiveMandate(id, dataDir) {
 
 // src/routes/archived-mandates.ts
 function createArchivedMandatesRouter(dataDir) {
-  const router = Router15();
+  const router = Router18();
   router.get("/", (_req, res) => {
     res.json({ archived: readArchived(dataDir) });
   });
@@ -4032,24 +4456,24 @@ function createArchivedMandatesRouter(dataDir) {
 }
 
 // src/routes/internal-events.ts
-import { Router as Router16 } from "express";
-import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { Router as Router19 } from "express";
+import { timingSafeEqual as timingSafeEqual3 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 var SESSION_EXPIRED = "session-expired";
 var AS_KEY_MISMATCH = "as-key-mismatch";
 var AS_TLS_MISMATCH = "as-tls-mismatch";
-function secretMatches(provided, expected) {
+function secretMatches2(provided, expected) {
   if (!expected) return false;
   if (!provided) return false;
   const a = Buffer.from(provided);
   const b = Buffer.from(expected);
   if (a.length !== b.length) return false;
-  return timingSafeEqual2(a, b);
+  return timingSafeEqual3(a, b);
 }
 function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch, onAsTlsMismatch) {
-  const router = Router16();
+  const router = Router19();
   router.post("/event", (req, res) => {
-    if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
+    if (!secretMatches2(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
       return;
     }
@@ -4081,8 +4505,8 @@ function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch
 }
 
 // src/routes/internal-mandate.ts
-import { Router as Router17 } from "express";
-import { timingSafeEqual as timingSafeEqual3, randomUUID } from "crypto";
+import { Router as Router20 } from "express";
+import { timingSafeEqual as timingSafeEqual4, randomUUID } from "crypto";
 
 // src/lib/mandate-ceremony.ts
 import {
@@ -4256,16 +4680,16 @@ async function createMandate(req, deps) {
 }
 
 // src/routes/internal-mandate.ts
-function secretMatches2(provided, expected) {
+function secretMatches3(provided, expected) {
   if (!expected || !provided) return false;
   const a = Buffer.from(provided);
   const b = Buffer.from(expected);
-  return a.length === b.length && timingSafeEqual3(a, b);
+  return a.length === b.length && timingSafeEqual4(a, b);
 }
 function createInternalMandateRouter(getSecret, deps) {
-  const router = Router17();
+  const router = Router20();
   router.post("/mandate", async (req, res) => {
-    if (!secretMatches2(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
+    if (!secretMatches3(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
       res.status(401).json({ error: "unauthorized" });
       return;
     }
@@ -4380,62 +4804,6 @@ function startNotificationDispatcher(opts = {}) {
   return new NotificationDispatcher(opts).start();
 }
 
-// src/lib/session-lock.ts
-var SESSION_LOCKED_MESSAGE = "Your sign-in ended after 30 days or was revoked. Sign in again.";
-var AS_KEY_MISMATCH_MESSAGE = "The Authority Server presented a signing key that does not match the one pinned at pairing. Sign in again to review.";
-var AS_TLS_MISMATCH_MESSAGE = "A connection to the Authority Server presented a TLS certificate that does not match the one pinned at pairing. The connection was refused before anything was sent. If the certificate changed intentionally (a new key, not just renewal), clear the pairing and sign in again to re-pin it.";
-function createSessionLock(deps) {
-  const { vault: vault2, port: port2 } = deps;
-  const notifyFn = deps.notifyFn ?? notify;
-  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
-  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
-  return function lockExpiredSession2() {
-    if (!vault2.isUnlocked()) return;
-    vault2.lockExpired();
-    console.error("[Control Plane] Authority Server session ended \u2014 gateway LOCKED");
-    void unconfigureSessionFn().catch((err) => {
-      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
-    });
-    emit("session-locked", { reason: "expired", message: SESSION_LOCKED_MESSAGE });
-    const { title, message, url } = sessionExpiredNotification(port2);
-    notifyFn(title, message, process.platform, url);
-  };
-}
-function createAsKeyMismatchLock(deps) {
-  const { vault: vault2, port: port2 } = deps;
-  const notifyFn = deps.notifyFn ?? notify;
-  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
-  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
-  return function lockOnAsKeyMismatch() {
-    if (!vault2.isUnlocked()) return;
-    vault2.lockAsKeyMismatch();
-    console.error("[Control Plane] Authority Server key mismatch \u2014 gateway LOCKED");
-    void unconfigureSessionFn("as-key-mismatch").catch((err) => {
-      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
-    });
-    emit("session-locked", { reason: "as-key-mismatch", message: AS_KEY_MISMATCH_MESSAGE });
-    const { title, url } = sessionExpiredNotification(port2);
-    notifyFn(title, AS_KEY_MISMATCH_MESSAGE, process.platform, url);
-  };
-}
-function createAsTlsMismatchLock(deps) {
-  const { vault: vault2, port: port2 } = deps;
-  const notifyFn = deps.notifyFn ?? notify;
-  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
-  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
-  return function lockOnAsTlsMismatch() {
-    if (!vault2.isUnlocked()) return;
-    vault2.lockAsTlsMismatch();
-    console.error("[Control Plane] Authority Server TLS pin mismatch \u2014 gateway LOCKED");
-    void unconfigureSessionFn("as-tls-mismatch").catch((err) => {
-      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
-    });
-    emit("session-locked", { reason: "as-tls-mismatch", message: AS_TLS_MISMATCH_MESSAGE });
-    const { title, url } = sessionExpiredNotification(port2);
-    notifyFn(title, AS_TLS_MISMATCH_MESSAGE, process.platform, url);
-  };
-}
-
 // src/lib/session-expiry-scheduler.ts
 var MAX_TIMEOUT_MS = 2147483647;
 var SessionExpiryScheduler = class {
@@ -4555,6 +4923,7 @@ var SP_URL = resolveAsUrl(DATA_DIR);
 validatePinTlsForUrl(resolvePinTls(DATA_DIR), SP_URL);
 var POLICY_LOCKED = [...readPolicy().locked];
 var POLICY_LOCKED_INSTALL_METHOD = readPolicy().policy.installMethod;
+var POLICY_LOCKED_TEAM = readPolicy().policy.team;
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
 var UI_DIST = process.env.HAP_UI_DIST ?? join14(import.meta.dirname ?? __dirname, "../../ui/dist");
@@ -4594,6 +4963,7 @@ function loginRateLimit(req, res, next) {
 var lockExpiredSession = createSessionLock({ vault, port });
 var lockAsKeyMismatch = createAsKeyMismatchLock({ vault, port });
 var lockAsTlsMismatch = createAsTlsMismatchLock({ vault, port });
+var lockManagedWrongTeam = createManagedWrongTeamLock({ vault, port });
 var sessionExpiryScheduler = new SessionExpiryScheduler(
   () => vault.getSessionExpiresAt(),
   lockExpiredSession
@@ -4603,8 +4973,26 @@ app.use("/auth", jsonParser, createAuthRouter(
   requireAuth(vault),
   loginRateLimit,
   () => sessionExpiryScheduler.reschedule(),
-  { asUrl: SP_URL, dataDir: DATA_DIR }
+  { asUrl: SP_URL, dataDir: DATA_DIR },
+  lockAsTlsMismatch,
+  POLICY_LOCKED_TEAM
 ));
+var managedTeamScheduler = POLICY_LOCKED_TEAM ? new ManagedTeamScheduler(async () => {
+  if (!vault.isUnlocked()) return;
+  const cookie = vault.getSpCookie();
+  if (!cookie) return;
+  try {
+    const pin = readPairing(DATA_DIR);
+    const team = await activeTeamId(SP_URL, cookie, {
+      enforce: resolvePinTls(DATA_DIR),
+      pinnedSpkiHex: pin && pin.asUrl === SP_URL ? pin.tlsSpkiPinHex : void 0
+    });
+    if (team !== POLICY_LOCKED_TEAM) lockManagedWrongTeam(POLICY_LOCKED_TEAM);
+  } catch (err) {
+    console.error("[Control Plane] Managed-team check failed (will retry):", err);
+  }
+}) : null;
+managedTeamScheduler?.start();
 function resolveOrigin(req) {
   const fwdHost = req.get("x-forwarded-host");
   if (fwdHost) return `${req.protocol}://${fwdHost}`;
@@ -4838,6 +5226,7 @@ app.use("/internal", jsonParser, createInternalMandateRouter(() => internalSecre
   encrypt: encryptIntentForRecipients,
   deliverGateContent: (args) => pushGateContent(args)
 })));
+app.use("/internal", jsonParser, createInternalContentCryptoRouter(() => internalSecret2, vault, SP_URL, DATA_DIR));
 app.use("/vault", jsonParser, authGuard, createVaultRouter(vault));
 app.use("/ai", jsonParser, authGuard, createAIRouter(vault));
 app.use("/ai-prompts", jsonParser, authGuard, createAIPromptsRouter());
@@ -4851,6 +5240,8 @@ app.use("/proposal-status", authGuard, createProposalStatusRouter(SP_URL, vault,
 app.use("/api/evidence", authGuard, createEvidenceRouter());
 app.use("/api/report", jsonParser, authGuard, createReportRouter(() => RUNNING_VERSION));
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
+app.use("/api/decrypt-proposal-content", jsonParser, authGuard, createDecryptProposalContentRouter(vault));
+app.use("/api/encrypt-proposal-note", jsonParser, authGuard, createEncryptProposalNoteRouter(vault, SP_URL, DATA_DIR));
 app.use("/api/approved-intents", jsonParser, authGuard, createApprovedIntentsRouter(vault));
 app.put("/integrations/:id/read-policy", jsonParser, authGuard, async (req, res) => {
   const id = req.params.id;
@@ -5141,8 +5532,13 @@ app.use(
           eventBus.emit("proposal-approved");
         } else if (method === "POST" && /^\/api\/proposals\/[^/]+\/reject$/.test(path)) {
           eventBus.emit("proposal-rejected");
-        } else if (method === "POST" && (path === "/api/groups" || path === "/api/groups/join" || /^\/api\/groups\/[^/]+\/(leave|disable|reactivate|admin-transfer)$/.test(path))) {
+        } else if (method === "POST" && (path === "/api/groups" || path === "/api/groups/join" || /^\/api\/groups\/[^/]+\/(leave|disable|reactivate|admin-transfer)$/.test(path)) || // WS0 (work-plan "Added 2026-10-11"): withdrawing a pending join
+        // request — the account stays Personal, but the onboarding UI's
+        // waiting state ends, same as every other membership-affecting
+        // call here.
+        method === "DELETE" && path === "/api/groups/join") {
           eventBus.emit("team-membership-changed");
+          if (managedTeamScheduler) void managedTeamScheduler.runNow();
         }
       }
     }