@suveren/gateway 0.7.3 → 0.7.6

package/dist/mcp-server/http.mjs

@@ -55,6 +55,10 @@ var SPClient = class {
   sessionCookie = "";
   apiKey = "";
   receiptRetry;
+  /** The AS base URL this client talks to (for provenance records). */
+  get url() {
+    return this.baseUrl;
+  }
   setApiKey(key) {
     this.apiKey = key;
   }
@@ -137,7 +141,7 @@ var SPClient = class {
    */
   async postReceipt(data) {
     const body = JSON.stringify(data);
-    const maxAttempts = data.idempotencyKey ? this.receiptRetry.maxAttempts : 1;
+    const maxAttempts = data.idempotencyKey || data.proposalId ? this.receiptRetry.maxAttempts : 1;
     let lastError;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       const isLast = attempt === maxAttempts;
@@ -825,6 +829,229 @@ var DenialLog = class {
   }
 };
 
+// src/lib/receipt-archive.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync4, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname4, join as join4 } from "path";
+import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
+function stripPreviews(proposal) {
+  const args = proposal.toolArgs;
+  if (!args || typeof args !== "object") return proposal;
+  const { _imagePreview, ...rest } = args;
+  if (_imagePreview === void 0) return proposal;
+  return { ...proposal, toolArgs: rest };
+}
+var ReceiptArchive = class {
+  data = { version: 1, authorizations: {}, receipts: [] };
+  baseDir;
+  vaultKey = null;
+  constructor(filePath) {
+    if (filePath && filePath.endsWith(".json")) {
+      this.baseDir = dirname4(filePath);
+    } else {
+      this.baseDir = filePath ?? DEFAULT_DIR4;
+    }
+    this.loadPlaintext();
+  }
+  /**
+   * Set the vault key for encryption. Triggers migration from plaintext if needed.
+   */
+  setVaultKey(key) {
+    this.vaultKey = key;
+    if (existsSync4(this.encryptedFilePath)) {
+      this.loadEncrypted();
+    } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
+      this.persistEncrypted();
+      if (existsSync4(this.plaintextFilePath)) {
+        try {
+          unlinkSync4(this.plaintextFilePath);
+        } catch {
+        }
+      }
+    }
+  }
+  /**
+   * True when encrypted evidence exists on disk that this process cannot read
+   * yet (no vault key). Callers MUST NOT present the archive as "empty" in
+   * this state — that would report a hollow success over unreadable evidence.
+   */
+  isLocked() {
+    return this.vaultKey === null && existsSync4(this.encryptedFilePath);
+  }
+  /**
+   * Archive a signed receipt (and the grant it was issued under).
+   * Idempotent on receipt id — a replayed receipt is recorded once.
+   */
+  record(entry, now = Math.floor(Date.now() / 1e3)) {
+    let changed = false;
+    const receiptId = typeof entry.receipt?.id === "string" ? entry.receipt.id : void 0;
+    const alreadyArchived = receiptId !== void 0 && this.data.receipts.some((r) => r.receipt.id === receiptId);
+    if (!alreadyArchived) {
+      this.data.receipts.push({
+        archivedAt: now,
+        authorizationId: entry.authorizationId,
+        asUrl: entry.asUrl,
+        asPublicKey: entry.asPublicKey,
+        receipt: entry.receipt,
+        ...entry.proposal ? { proposal: stripPreviews(entry.proposal) } : {},
+        ...entry.boundContent !== void 0 ? { boundContent: entry.boundContent } : {}
+      });
+      changed = true;
+    }
+    if (entry.authorization) {
+      const existing = this.data.authorizations[entry.authorizationId];
+      if (!existing) {
+        this.data.authorizations[entry.authorizationId] = {
+          authorizationId: entry.authorizationId,
+          profileId: entry.authorization.profileId,
+          boundsHash: entry.authorization.boundsHash,
+          contextHash: entry.authorization.contextHash,
+          bounds: entry.authorization.bounds,
+          context: entry.authorization.context,
+          intent: entry.authorization.intent,
+          attestations: [...entry.authorization.attestations],
+          archivedAt: now
+        };
+        changed = true;
+      } else {
+        for (const att of entry.authorization.attestations) {
+          const seen = existing.attestations.some(
+            (a) => a.domain === att.domain && a.blob === att.blob
+          );
+          if (!seen) {
+            existing.attestations.push(att);
+            changed = true;
+          }
+        }
+        if (!existing.bounds && entry.authorization.bounds) {
+          existing.bounds = entry.authorization.bounds;
+          changed = true;
+        }
+        if (!existing.context && entry.authorization.context) {
+          existing.context = entry.authorization.context;
+          changed = true;
+        }
+        if (!existing.intent && entry.authorization.intent) {
+          existing.intent = entry.authorization.intent;
+          changed = true;
+        }
+      }
+    }
+    if (changed) this.persist();
+  }
+  getReceipts() {
+    return [...this.data.receipts];
+  }
+  getAuthorizations() {
+    return Object.values(this.data.authorizations);
+  }
+  get size() {
+    return this.data.receipts.length;
+  }
+  // ─── Encryption helpers ─────────────────────────────────────────────────
+  encrypt(plaintext) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const iv = randomBytes4(12);
+    const cipher = createCipheriv4("aes-256-gcm", this.vaultKey, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+      iv: iv.toString("hex"),
+      ciphertext: encrypted.toString("hex"),
+      tag: tag.toString("hex")
+    };
+  }
+  decrypt(blob) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const decipher = createDecipheriv4(
+      "aes-256-gcm",
+      this.vaultKey,
+      Buffer.from(blob.iv, "hex")
+    );
+    decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
+    const decrypted = Buffer.concat([
+      decipher.update(Buffer.from(blob.ciphertext, "hex")),
+      decipher.final()
+    ]);
+    return decrypted.toString("utf8");
+  }
+  // ─── File paths ─────────────────────────────────────────────────────────
+  get plaintextFilePath() {
+    return join4(this.baseDir, "receipt-archive.json");
+  }
+  get encryptedFilePath() {
+    return join4(this.baseDir, "receipt-archive.enc.json");
+  }
+  // ─── Load / Persist ─────────────────────────────────────────────────────
+  loadPlaintext() {
+    if (!existsSync4(this.plaintextFilePath)) {
+      mkdirSync4(this.baseDir, { recursive: true });
+      return;
+    }
+    try {
+      const raw = readFileSync4(this.plaintextFilePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      this.data = {
+        version: 1,
+        authorizations: parsed.authorizations ?? {},
+        receipts: parsed.receipts ?? []
+      };
+    } catch {
+      console.error(`[ReceiptArchive] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
+      try {
+        writeFileSync4(
+          `${this.plaintextFilePath}.corrupt-${Date.now()}`,
+          readFileSync4(this.plaintextFilePath)
+        );
+      } catch {
+      }
+    }
+  }
+  loadEncrypted() {
+    if (!existsSync4(this.encryptedFilePath)) return;
+    try {
+      const raw = readFileSync4(this.encryptedFilePath, "utf-8");
+      const data = JSON.parse(raw);
+      const decrypted = this.decrypt(data.blob);
+      const parsed = JSON.parse(decrypted);
+      this.data = {
+        version: 1,
+        authorizations: parsed.authorizations ?? {},
+        receipts: parsed.receipts ?? []
+      };
+    } catch (err) {
+      console.error(`[ReceiptArchive] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
+      try {
+        writeFileSync4(
+          `${this.encryptedFilePath}.corrupt-${Date.now()}`,
+          readFileSync4(this.encryptedFilePath)
+        );
+      } catch {
+      }
+    }
+  }
+  persist() {
+    if (this.vaultKey) {
+      this.persistEncrypted();
+    } else {
+      this.persistPlaintext();
+    }
+  }
+  persistPlaintext() {
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+  persistEncrypted() {
+    const data = {
+      version: 1,
+      blob: this.encrypt(JSON.stringify(this.data))
+    };
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+};
+
 // src/lib/gatekeeper.ts
 import { verify } from "@hap/core";
 var MCPGatekeeper = class {
@@ -898,6 +1125,7 @@ var SharedState = class {
   gateStore;
   executionLog;
   denialLog;
+  receiptArchive;
   gatekeeper;
   constructor(spUrl2, gateStorePath) {
     this.spClient = new SPClient(spUrl2);
@@ -905,8 +1133,50 @@ var SharedState = class {
     this.gateStore = new GateStore(gateStorePath);
     this.executionLog = new ExecutionLog(gateStorePath);
     this.denialLog = new DenialLog(gateStorePath);
+    this.receiptArchive = new ReceiptArchive(gateStorePath);
     this.gatekeeper = new MCPGatekeeper(this.cache, this.executionLog);
   }
+  /**
+   * Archive a signed receipt into the local receipt archive — the subject's
+   * own durable copy of the evidence (see receipt-archive.ts).
+   *
+   * Best-effort by contract: the AS has already issued the receipt and holds
+   * the authoritative copy, so an archive failure logs loudly but MUST NOT
+   * block the execution it documents.
+   */
+  async archiveReceipt(receipt, opts) {
+    try {
+      let asPublicKey;
+      try {
+        asPublicKey = await this.cache.getPublicKey();
+      } catch {
+      }
+      this.receiptArchive.record({
+        receipt,
+        authorizationId: opts.authorizationId,
+        asUrl: this.spClient.url,
+        asPublicKey,
+        proposal: opts.proposal,
+        boundContent: opts.boundContent,
+        authorization: opts.profileId ? {
+          profileId: opts.profileId,
+          boundsHash: opts.boundsHash,
+          contextHash: opts.contextHash ?? this.gateStore.get(opts.authorizationId)?.contextHash,
+          bounds: opts.bounds,
+          context: opts.context,
+          // Fall back to the gate store — the review path's cached auth
+          // carries no gate content.
+          intent: opts.intent ?? this.gateStore.get(opts.authorizationId)?.gateContent?.intent,
+          attestations: opts.attestations ?? []
+        } : void 0
+      });
+    } catch (err) {
+      console.error(
+        "[Suveren MCP] Receipt archive write failed (execution proceeds \u2014 AS retains authoritative copy):",
+        err
+      );
+    }
+  }
   setGateContent(path, authorizationId, profileId, content, opts) {
     this.gateStore.set(authorizationId, {
       authorizationId,
@@ -1012,17 +1282,17 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
+import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir) {
-  const dir = dataDir ?? DEFAULT_DIR4;
-  const filePath = join4(dir, "context.md");
-  if (!existsSync4(filePath)) return null;
+  const dir = dataDir ?? DEFAULT_DIR5;
+  const filePath = join5(dir, "context.md");
+  if (!existsSync5(filePath)) return null;
   try {
-    const content = readFileSync4(filePath, "utf-8").trim();
+    const content = readFileSync5(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -1192,7 +1462,7 @@ function appendVerificationFooter(tool, args, receiptId, subject) {
 // src/lib/content-binding.ts
 import {
   computeContentHash,
-  computeFieldsContentHash,
+  selectBoundFields,
   isFieldBinding,
   bindingAppliesTo,
   getProfile as getProfile2
@@ -1212,14 +1482,18 @@ function computeContentBinding(profileId, tool, toolArgs, actionType) {
       }
       return void 0;
     }
+    const bound = selectBoundFields(binding, toolArgs);
     return {
-      contentHash: computeFieldsContentHash(binding, toolArgs),
-      contentBinding: { version: binding.version, kind: binding.kind, fields: binding.fields }
+      contentHash: computeContentHash(binding, bound),
+      contentBinding: { version: binding.version, kind: binding.kind, fields: binding.fields },
+      boundContent: bound
     };
   }
   let contentHash;
+  let boundContent;
   if (binding.kind === "jcs") {
     contentHash = computeContentHash(binding, toolArgs);
+    boundContent = toolArgs;
   } else {
     const declared = tool?.gating?.contentField;
     const field = declared ?? (tool ? detectContentField(tool) : null);
@@ -1227,10 +1501,12 @@ function computeContentBinding(profileId, tool, toolArgs, actionType) {
     const raw = typeof toolArgs[field] === "string" ? toolArgs[field] : "";
     if (raw === "") return void 0;
     contentHash = computeContentHash(binding, raw);
+    boundContent = raw;
   }
   return {
     contentHash,
-    contentBinding: { version: binding.version, kind: binding.kind }
+    contentBinding: { version: binding.version, kind: binding.kind },
+    boundContent
   };
 }
 function attachReceiptId(tool, args, receiptId) {
@@ -1849,6 +2125,29 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
         }
       }
     }
+    const declaredActionType = typeof execution.action_type === "string" && execution.action_type.length > 0 ? execution.action_type : void 0;
+    if (!declaredActionType) {
+      return {
+        content: [{
+          type: "text",
+          text: `Blocked by Gatekeeper: tool ${tool.namespacedName} declares no action_type in its manifest's staticExecution. A write cannot be bounds-checked without its action type \u2014 fix the integration manifest.`
+        }],
+        isError: true
+      };
+    }
+    {
+      const profileDef = getProfile3(profile);
+      const registry = profileDef?.boundsSchema?.actionTypes;
+      if (Array.isArray(registry) && registry.length > 0 && !registry.includes(declaredActionType)) {
+        return {
+          content: [{
+            type: "text",
+            text: `Blocked by Gatekeeper: action_type "${declaredActionType}" is not in profile ${profile}'s actionTypes registry (${registry.join(", ")}). Fix the integration manifest.`
+          }],
+          isError: true
+        };
+      }
+    }
     const auths = state2.getEnrichedAuthorizations();
     const matchingAuths = auths.filter(
       (a) => a.complete && profileMatches(a.profileId, profile)
@@ -1946,12 +2245,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
       }
       let receiptId;
       try {
-        const actionType = typeof execution.action_type === "string" ? execution.action_type : void 0;
-        if (!actionType) {
-          console.error(
-            `[Suveren MCP] Warning: tool ${tool.namespacedName} has no action_type in staticExecution. Bounds check may be skipped. Fix the integration manifest.`
-          );
-        }
+        const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, args, actionType);
         const { receipt } = await state2.spClient.postReceipt({
           authorizationId: authzId,
@@ -1966,6 +2260,19 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           ...binding ?? {}
         });
         receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+        await state2.archiveReceipt(receipt, {
+          authorizationId: authzId,
+          profileId: auth.profileId,
+          boundsHash: auth.boundsHash,
+          contextHash: auth.contextHash,
+          bounds: auth.bounds ?? auth.frame,
+          context: auth.context,
+          intent: auth.gateContent?.intent,
+          attestations: auth.attestations,
+          // Automatic path has no proposal, so without this the archive
+          // would hold a hash of content it cannot reproduce.
+          boundContent: binding?.boundContent
+        });
       } catch (err) {
         if (err instanceof ContentBindingError) {
           return {
@@ -2403,6 +2710,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       `[Suveren MCP] Warning: proposal ${proposal.id} has no action_type in executionContext. Bounds check may be skipped. Fix the integration manifest for ${proposal.tool}.`
     );
   }
+  const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
   let receiptId;
   try {
     const binding = computeContentBinding(
@@ -2413,6 +2721,9 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     );
     const { receipt } = await state2.spClient.postReceipt({
       authorizationId: proposal.authorizationId,
+      // Optional cross-check — the AS fails closed on a mismatch. Parity
+      // with the automatic path (tool-proxy.ts).
+      boundsHash: cachedAuth?.boundsHash,
       profileId: proposal.profileId,
       action: proposal.tool,
       actionType: proposalActionType,
@@ -2420,9 +2731,29 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       amount: typeof proposal.executionContext.amount === "number" ? proposal.executionContext.amount : void 0,
       proposalId: proposal.id,
       toolArgs: proposal.toolArgs,
+      // Deliberately NO idempotencyKey: the spec has review-mode commits carry
+      // a proposalId INSTEAD of a key — the proposal's committed→executed
+      // transition is their replay protection, and the AS replays the ORIGINAL
+      // receipt to the same caller if a retry arrives after it committed.
+      // SPClient therefore treats proposalId as retry-safe on its own; a
+      // PROPOSAL_ALREADY_EXECUTED answer is still a definitive rejection
+      // (never retried) and means a *different* caller consumed the proposal.
       ...binding ?? {}
     });
     receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+    await state2.archiveReceipt(receipt, {
+      authorizationId: proposal.authorizationId,
+      profileId: proposal.profileId,
+      boundsHash: cachedAuth?.boundsHash,
+      contextHash: cachedAuth?.contextHash,
+      bounds: cachedAuth?.bounds ?? cachedAuth?.frame,
+      context: cachedAuth?.context,
+      attestations: cachedAuth?.attestations,
+      // What the human actually approved, kept next to the receipt that cites
+      // it — otherwise `proposalId` is a pointer to a server we may not have.
+      proposal,
+      boundContent: binding?.boundContent
+    });
   } catch (err) {
     if (err instanceof ContentBindingError2) {
       return {
@@ -2451,7 +2782,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     let outgoingArgs = proposal.toolArgs;
     if (discovered && receiptId) {
       if (shouldAttachFooter()) {
-        outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId);
+        outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId, cachedAuth?.subjects?.[0]);
       }
       outgoingArgs = attachReceiptId(discovered, outgoingArgs, receiptId);
       outgoingArgs = encodeOutgoingArgs(discovered, outgoingArgs);
@@ -2672,7 +3003,12 @@ function createMcpServer(state2, integrationManager2) {
       }
     }
     for (const tool of allTools) {
-      if (proxiedTools.has(tool.namespacedName)) continue;
+      const existing = proxiedTools.get(tool.namespacedName);
+      if (existing) {
+        if (existing.tool === tool) continue;
+        existing.registered.remove();
+        proxiedTools.delete(tool.namespacedName);
+      }
       const handler = createGatedToolHandler(tool, integrationManager2, state2);
       const zodShape = jsonSchemaToZodShape(tool.inputSchema);
       const description = buildProxiedToolDescription(tool, state2);
@@ -2740,16 +3076,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname5, join as join6 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join6(homedir6(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir) {
     const dir = dataDir ?? DEFAULT_DATA_DIR;
-    this.filePath = join5(dir, "integrations.json");
+    this.filePath = join6(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -2780,12 +3116,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync5(this.filePath)) {
-      mkdirSync4(dirname4(this.filePath), { recursive: true });
+    if (!existsSync6(this.filePath)) {
+      mkdirSync5(dirname5(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync5(this.filePath, "utf-8");
+      const raw = readFileSync6(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -2814,33 +3150,33 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync4(dirname4(this.filePath), { recursive: true });
-    writeFileSync4(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync5(dirname5(this.filePath), { recursive: true });
+    writeFileSync5(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
-import { homedir as homedir6 } from "os";
-import { join as join6, delimiter } from "path";
-import { existsSync as existsSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join7, delimiter } from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join6(homedir6(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join6(DEFAULT_DATA_DIR2, "integrations");
-var INTEGRATIONS_BIN = join6(INTEGRATIONS_DIR, "node_modules", ".bin");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join7(homedir7(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join7(DEFAULT_DATA_DIR2, "integrations");
+var INTEGRATIONS_BIN = join7(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync6(INTEGRATIONS_DIR)) {
-    mkdirSync5(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync7(INTEGRATIONS_DIR)) {
+    mkdirSync6(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join6(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync6(pkgPath)) {
-    writeFileSync5(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join7(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync7(pkgPath)) {
+    writeFileSync6(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -2869,6 +3205,24 @@ var IntegrationManager = class {
   }
   running = /* @__PURE__ */ new Map();
   onToolsChanged = null;
+  /**
+   * Per-integration operation queue. Start/stop for one id are serialized
+   * through here; without it, a second start issued while the first is still
+   * installing/handshaking sees `running.has(id) === false`, skips the stop,
+   * and both children come up — last `running.set` wins, the loser's process
+   * leaks, and the surviving GATING is whichever start happened to finish
+   * last. That last-writer-wins gating is a fail-open: a permissive manifest
+   * config can silently replace a stricter explicit one (observed as the
+   * read-gate value-mismatch flake).
+   */
+  opQueues = /* @__PURE__ */ new Map();
+  /** Run `task` after every previously queued operation for `id` has settled. */
+  runExclusive(id, task) {
+    const prev = this.opQueues.get(id) ?? Promise.resolve();
+    const run = prev.then(task, task);
+    this.opQueues.set(id, run.then(() => void 0, () => void 0));
+    return run;
+  }
   /**
    * Register a callback invoked when the tool set changes
    * (integration started, stopped, or crashed).
@@ -2888,19 +3242,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join6(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join6(pkgDir, "package.json");
-    if (!existsSync6(pkgDir) || !existsSync6(pkgJson)) return false;
+    const pkgDir = join7(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join7(pkgDir, "package.json");
+    if (!existsSync7(pkgDir) || !existsSync7(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync6(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync7(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync6(join6(pkgDir, target))) return false;
+        if (!existsSync7(join7(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync6(join6(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync7(join7(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -2914,7 +3268,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync6(join6(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync7(join7(INTEGRATIONS_BIN, c)));
   }
   /**
    * Install an npm package into the managed integrations directory if not
@@ -2931,8 +3285,8 @@ var IntegrationManager = class {
   async ensureInstalled(npmPackage) {
     ensureIntegrationsDir();
     if (this.isUsableInstall(npmPackage)) return;
-    const pkgDir = join6(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync6(pkgDir)) {
+    const pkgDir = join7(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (existsSync7(pkgDir)) {
       console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -3018,10 +3372,19 @@ var IntegrationManager = class {
    * Start a downstream MCP server integration.
    * Installs npm package on-demand if needed, resolves envKeys,
    * spawns the process, connects as MCP client, and discovers tools.
+   *
+   * Serialized per id: a start issued while another start/stop for the same
+   * id is in flight waits for it, then applies its own semantics (restart, or
+   * keep-if-running with `skipIfRunning`). See `opQueues`.
    */
-  async startIntegration(config) {
-    if (this.running.has(config.id)) {
-      await this.stopIntegration(config.id);
+  async startIntegration(config, opts = {}) {
+    return this.runExclusive(config.id, () => this.startIntegrationLocked(config, opts));
+  }
+  async startIntegrationLocked(config, opts) {
+    const existing = this.running.get(config.id);
+    if (existing) {
+      if (opts.skipIfRunning) return existing.tools;
+      await this.stopIntegrationLocked(config.id);
     }
     if (config.npmPackage) {
       await this.ensureInstalled(config.npmPackage);
@@ -3076,6 +3439,7 @@ var IntegrationManager = class {
     };
     this.running.set(config.id, entry);
     transport.onclose = () => {
+      if (this.running.get(config.id)?.transport !== transport) return;
       console.error(`[IntegrationManager] Transport closed for ${config.id}`);
       this.handleCrash(config.id);
     };
@@ -3084,8 +3448,15 @@ var IntegrationManager = class {
   }
   /**
    * Stop a running integration, closing its transport and removing its tools.
+   *
+   * Serialized per id: a stop issued while a start is in flight waits and
+   * then stops the just-started instance, instead of silently doing nothing
+   * because the entry wasn't in `running` yet.
    */
   async stopIntegration(id) {
+    return this.runExclusive(id, () => this.stopIntegrationLocked(id));
+  }
+  async stopIntegrationLocked(id) {
     const entry = this.running.get(id);
     if (!entry) return;
     entry.transport.onclose = void 0;
@@ -3308,7 +3679,7 @@ var IntegrationManager = class {
     console.error(`[IntegrationManager] ${id} crashed, respawning in ${delay}ms (attempt ${attempts + 1}/${MAX_RESPAWN_ATTEMPTS})`);
     setTimeout(async () => {
       try {
-        await this.startIntegration(entry.config);
+        await this.startIntegration(entry.config, { skipIfRunning: true });
         const newEntry = this.running.get(id);
         if (newEntry) {
           newEntry.respawnAttempts = attempts + 1;
@@ -3330,28 +3701,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
-import { join as join7, resolve } from "path";
+import { readFileSync as readFileSync8, existsSync as existsSync8 } from "fs";
+import { join as join8, resolve } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join7(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join7(dir, "index.json");
-  if (!existsSync7(indexPath)) {
+  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join8(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join8(dir, "index.json");
+  if (!existsSync8(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync7(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync8(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join7(dir, relativePath);
+    const profilePath = join8(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync7(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync8(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -3384,30 +3755,30 @@ function warnNoProfiles(reason) {
 }
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync8, existsSync as existsSync8 } from "fs";
-import { join as join8, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
+import { join as join9, resolve as resolve2 } from "path";
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve2(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join8(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join9(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join8(dir, "index.json");
-  if (!existsSync8(indexPath)) {
+  const indexPath = join9(dir, "index.json");
+  if (!existsSync9(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync8(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync9(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join8(dir, relativePath);
+    const manifestPath = join9(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync8(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync9(manifestPath, "utf-8"));
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -3425,6 +3796,7 @@ function getAllManifests() {
 }
 
 // bin/http.ts
+import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 var spUrl = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
 var state = new SharedState(spUrl);
@@ -3488,7 +3860,8 @@ app.post("/internal/configure", internalOnly, (req, res) => {
     const key = Buffer.from(vaultKeyHex, "hex");
     state.gateStore.setVaultKey(key);
     state.denialLog.setVaultKey(key);
-    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log encryption active");
+    state.receiptArchive.setVaultKey(key);
+    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log + receipt archive encryption active");
   }
   if (apiKey) {
     state.spClient.setApiKey(apiKey);
@@ -3785,6 +4158,27 @@ app.get("/internal/authorizations", internalOnly, (_req, res) => {
 app.get("/internal/manifests", internalOnly, (_req, res) => {
   res.json({ manifests: getAllManifests() });
 });
+app.get("/internal/evidence", internalOnly, (_req, res) => {
+  if (state.receiptArchive.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 the evidence archive is encrypted until sign-in." });
+    return;
+  }
+  const authorizations = state.receiptArchive.getAuthorizations().map((a) => ({
+    ...a,
+    attestations: a.attestations.map((att) => {
+      try {
+        return { ...att, decoded: decodeAttestationBlob3(att.blob) };
+      } catch {
+        return att;
+      }
+    })
+  }));
+  res.json({
+    receipts: state.receiptArchive.getReceipts(),
+    authorizations,
+    gates: state.gateStore.getAll()
+  });
+});
 app.get("/internal/brief", internalOnly, (_req, res) => {
   try {
     const enriched = state.getEnrichedAuthorizations();
@@ -3833,7 +4227,7 @@ async function startOneIntegration(config) {
   const manifest = getManifest(config.id);
   const effectiveConfig = manifest ? { ...config, toolGating: manifest.toolGating, npmPackage: manifest.npmPackage ?? config.npmPackage } : config;
   try {
-    await integrationManager.startIntegration(effectiveConfig);
+    await integrationManager.startIntegration(effectiveConfig, { skipIfRunning: true });
   } catch (err) {
     console.error(`[Suveren MCP] Failed to start integration ${config.id}:`, err);
   }