@suveren/gateway 0.7.6 → 0.8.0

package/dist/mcp-server/http.mjs

@@ -33,6 +33,85 @@ async function notifyControlPlane(type) {
   }
 }
 
+// src/lib/client-version.ts
+import { createRequire } from "module";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var UNKNOWN = "unknown";
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function detectGatewayVersion() {
+  const override = process.env.SUVEREN_GATEWAY_VERSION;
+  if (override) return override;
+  const start = import.meta.dirname ?? process.cwd();
+  let dir = start;
+  for (let up = 0; up < 6; up++) {
+    const pkg = readJson(join(dir, "package.json"));
+    const name = pkg?.name;
+    const version = pkg?.version;
+    if (typeof version === "string" && (name === "@suveren/gateway" || name === "suveren-gateway")) {
+      return version;
+    }
+    const parent = join(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.env.HAP_BUILD_SHA ?? UNKNOWN;
+}
+function findPackageVersion(entry, wantName) {
+  let dir = join(entry, "..");
+  for (let up = 0; up < 6; up++) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      const pkg = readJson(candidate);
+      if (typeof pkg?.version === "string" && (pkg.name === wantName || pkg.name === "@hap/core")) {
+        return pkg.name === wantName ? pkg.version : null;
+      }
+    }
+    const parent = join(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function detectHapCoreVersion() {
+  const CORE = "@humanagencyp/hap-core";
+  let req;
+  try {
+    req = createRequire(import.meta.url);
+  } catch {
+    return UNKNOWN;
+  }
+  try {
+    const v = findPackageVersion(req.resolve(CORE), CORE);
+    if (v) return v;
+  } catch {
+  }
+  try {
+    const wrapperEntry = req.resolve("@hap/core");
+    const v = findPackageVersion(wrapperEntry, CORE);
+    if (v) return v;
+    const wrapperReq = createRequire(wrapperEntry);
+    const v2 = findPackageVersion(wrapperReq.resolve(CORE), CORE);
+    if (v2) return v2;
+  } catch {
+  }
+  return UNKNOWN;
+}
+var GATEWAY_VERSION = detectGatewayVersion();
+var HAP_CORE_VERSION = detectHapCoreVersion();
+function clientVersionHeaders() {
+  return {
+    "x-suveren-gateway-version": GATEWAY_VERSION,
+    "x-hap-core-version": HAP_CORE_VERSION
+  };
+}
+
 // src/lib/sp-client.ts
 var SPReceiptError = class extends Error {
   constructor(message, statusCode, body) {
@@ -82,6 +161,11 @@ var SPClient = class {
     const url = `${this.baseUrl}${path}`;
     const headers = {
       "Content-Type": "application/json",
+      // Identify the caller so the AS can answer "what is deployed against
+      // me?" and name a version in an upgrade instruction. Advisory only —
+      // never used for authorization. Sent on every call, not just receipts,
+      // so the picture is not skewed toward one endpoint.
+      ...clientVersionHeaders(),
       ...init?.headers
     };
     if (this.sessionCookie) {
@@ -378,11 +462,11 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync } from "fs";
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, unlinkSync } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join2(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
@@ -400,11 +484,11 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync(this.encryptedFilePath)) {
+    if (existsSync2(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync(this.plaintextFilePath)) {
+      if (existsSync2(this.plaintextFilePath)) {
         try {
           unlinkSync(this.plaintextFilePath);
         } catch {
@@ -455,19 +539,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join(this.baseDir, "gates.json");
+    return join2(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join(this.baseDir, "gates.enc.json");
+    return join2(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync(this.plaintextFilePath)) {
+    if (!existsSync2(this.plaintextFilePath)) {
       mkdirSync(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -476,9 +560,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync(this.encryptedFilePath)) return;
+    if (!existsSync2(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -519,11 +603,11 @@ var GateStore = class {
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join2(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join3(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -542,11 +626,11 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync2(this.encryptedFilePath)) {
+    if (existsSync3(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync2(this.plaintextFilePath)) {
+      if (existsSync3(this.plaintextFilePath)) {
         try {
           unlinkSync2(this.plaintextFilePath);
         } catch {
@@ -641,19 +725,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join2(this.baseDir, "execution-log.json");
+    return join3(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join2(this.baseDir, "execution-log.enc.json");
+    return join3(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync2(this.plaintextFilePath)) {
+    if (!existsSync3(this.plaintextFilePath)) {
       mkdirSync2(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync3(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -663,9 +747,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync2(this.encryptedFilePath)) return;
+    if (!existsSync3(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync3(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -712,11 +796,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join3(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join4(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -729,11 +813,11 @@ var DenialLog = class {
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync3(this.encryptedFilePath)) {
+    if (existsSync4(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync3(this.plaintextFilePath)) {
+      if (existsSync4(this.plaintextFilePath)) {
         try {
           unlinkSync3(this.plaintextFilePath);
         } catch {
@@ -783,18 +867,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join3(this.baseDir, "denials.json");
+    return join4(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join3(this.baseDir, "denials.enc.json");
+    return join4(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync3(this.plaintextFilePath)) {
+    if (!existsSync4(this.plaintextFilePath)) {
       mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync3(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync4(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -802,9 +886,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync3(this.encryptedFilePath)) return;
+    if (!existsSync4(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync3(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync4(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -830,11 +914,11 @@ var DenialLog = class {
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync4, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join5(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -859,11 +943,11 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync4(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync4(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
           unlinkSync4(this.plaintextFilePath);
         } catch {
@@ -877,7 +961,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync4(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync5(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -978,19 +1062,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join4(this.baseDir, "receipt-archive.json");
+    return join5(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join4(this.baseDir, "receipt-archive.enc.json");
+    return join5(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync4(this.plaintextFilePath)) {
+    if (!existsSync5(this.plaintextFilePath)) {
       mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync4(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1002,16 +1086,16 @@ var ReceiptArchive = class {
       try {
         writeFileSync4(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync4(this.plaintextFilePath)
+          readFileSync5(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync4(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync4(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1025,7 +1109,7 @@ var ReceiptArchive = class {
       try {
         writeFileSync4(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync4(this.encryptedFilePath)
+          readFileSync5(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1055,9 +1139,16 @@ var ReceiptArchive = class {
 // src/lib/gatekeeper.ts
 import { verify } from "@hap/core";
 var MCPGatekeeper = class {
-  constructor(cache, executionLog) {
+  /**
+   * No ExecutionLog dependency by construction. The local record is
+   * display-only (protocol.md → "Executor Gating, Context vs Bounds,
+   * Display-Only Logs"), so the Gatekeeper must not be able to read it: with
+   * no log in scope, a local cumulative check cannot be reintroduced by
+   * accident. `SharedState.executionLog` stays — it feeds the UI's consumption
+   * display and nothing else.
+   */
+  constructor(cache) {
     this.cache = cache;
-    this.executionLog = executionLog;
   }
   /**
    * Verify an execution request against a cached authorization.
@@ -1104,16 +1195,15 @@ var MCPGatekeeper = class {
       attestations: auth.attestations.map((a) => a.blob),
       execution,
       context: resolvedContext,
-      // Scopes the local cumulative check to the same (profileId, path) key the
-      // ExecutionLog records under (see tool-proxy's record call). It cannot go
-      // inside `frame`: that is validated against the profile's boundsSchema,
-      // which declares no `path` field in any shipped profile, so an extra key
-      // there fails verification with "Unknown field". Omitting it entirely —
-      // the previous behaviour — made every cumulative lookup return zero, so
-      // the local gate never fired and the AS was doing all the enforcing.
+      // Identifies the grant whose bounds are being checked. hap-core reads it
+      // only to scope a cumulative lookup, which no longer happens here (see
+      // below); it is kept because it belongs to the request, not to the
+      // dropped check. It cannot go inside `frame`: that is validated against
+      // the profile's boundsSchema, which declares no `path` field in any
+      // shipped profile, so an extra key there fails with "Unknown field".
       path: auth.path
     };
-    const result = await verify(request, publicKeyHex, void 0, this.executionLog);
+    const result = await verify(request, publicKeyHex);
     return { result, authorization: auth };
   }
 };
@@ -1134,7 +1224,7 @@ var SharedState = class {
     this.executionLog = new ExecutionLog(gateStorePath);
     this.denialLog = new DenialLog(gateStorePath);
     this.receiptArchive = new ReceiptArchive(gateStorePath);
-    this.gatekeeper = new MCPGatekeeper(this.cache, this.executionLog);
+    this.gatekeeper = new MCPGatekeeper(this.cache);
   }
   /**
    * Archive a signed receipt into the local receipt archive — the subject's
@@ -1282,17 +1372,17 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
+import { join as join6 } from "path";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir) {
   const dir = dataDir ?? DEFAULT_DIR5;
-  const filePath = join5(dir, "context.md");
-  if (!existsSync5(filePath)) return null;
+  const filePath = join6(dir, "context.md");
+  if (!existsSync6(filePath)) return null;
   try {
-    const content = readFileSync5(filePath, "utf-8").trim();
+    const content = readFileSync6(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -1933,10 +2023,11 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
     return inner(args);
   };
   if (category === "disabled") {
+    const reason = tool.gating.disabledReason;
     return async () => ({
       content: [{
         type: "text",
-        text: `Tool "${tool.namespacedName}" is disabled by the integration manifest and cannot be used.`
+        text: reason ? `Tool "${tool.namespacedName}" is refused: ${reason}. A tool that no manifest entry describes cannot be gated \u2014 there is nothing declaring which action type it performs or how its arguments map to the bounds. Add an entry for "${tool.originalName}" under this integration's toolGating.overrides (with "category": "read" for a read-only tool) before it can be used.` : `Tool "${tool.namespacedName}" is disabled by the integration manifest and cannot be used.`
       }],
       isError: true
     });
@@ -2257,7 +2348,12 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           executionContext: { ...execution },
           amount: typeof execution.amount === "number" ? execution.amount : void 0,
           idempotencyKey: randomUUID(),
-          ...binding ?? {}
+          // Privacy: send the hash and how to reproduce it — never the
+          // preimage. `binding` also carries `boundContent`, the plaintext
+          // that was hashed (an email's to/cc/subject/body); it stays on
+          // this machine for the local archive, so it must be picked out
+          // field by field rather than spread.
+          ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
         });
         receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
         await state2.archiveReceipt(receipt, {
@@ -2407,7 +2503,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
   const shortName = shortProfileName2(profileId);
   const gated = [];
   const readOnly = [];
-  const defaultGated = [];
+  const undescribed = [];
   for (const tool of allTools) {
     if (!tool.gating || !tool.gating.profile) {
       continue;
@@ -2429,12 +2525,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
       const actionType = override.staticExecution?.action_type ?? "unknown";
       gated.push(`      - ${tool.originalName}: ${actionType}${mappingDesc ? `, ${mappingDesc}` : ""}`);
     } else {
-      const defaultAction = toolGating.default.staticExecution?.action_type;
-      if (defaultAction === "read" && Object.keys(toolGating.default.executionMapping ?? {}).length === 0) {
-        defaultGated.push(tool.originalName);
-      } else {
-        gated.push(`      - ${tool.originalName}: ${defaultAction ?? "default"} (default gating)`);
-      }
+      undescribed.push(tool.originalName);
     }
   }
   const lines = [];
@@ -2446,10 +2537,12 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
   if (readOnly.length > 0) {
     lines.push(`    Read-only (no authorization needed): ${readOnly.join(", ")}`);
   }
-  if (defaultGated.length > 0) {
-    lines.push(`    Default-gated (action_type: ${toolGating.default.staticExecution?.action_type ?? "read"}): ${defaultGated.join(", ")}`);
+  if (undescribed.length > 0) {
+    lines.push(
+      `    Refused (no manifest entry \u2014 do not call): ${undescribed.join(", ")}`
+    );
   }
-  if (gated.length === 0 && readOnly.length === 0 && defaultGated.length === 0) {
+  if (gated.length === 0 && readOnly.length === 0 && undescribed.length === 0) {
     lines.push("    No tools discovered for this profile.");
   }
   return lines.join("\n");
@@ -2738,7 +2831,10 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       // SPClient therefore treats proposalId as retry-safe on its own; a
       // PROPOSAL_ALREADY_EXECUTED answer is still a definitive rejection
       // (never retried) and means a *different* caller consumed the proposal.
-      ...binding ?? {}
+      // Privacy: hash + how to reproduce it only. `binding.boundContent` is
+      // the plaintext preimage (what the human approved) and never leaves
+      // this machine — see the archive call below.
+      ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
     });
     receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
     await state2.archiveReceipt(receipt, {
@@ -3076,16 +3172,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname5, join as join6 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join6(homedir6(), ".suveren");
+import { dirname as dirname5, join as join7 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir) {
     const dir = dataDir ?? DEFAULT_DATA_DIR;
-    this.filePath = join6(dir, "integrations.json");
+    this.filePath = join7(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -3116,12 +3212,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync6(this.filePath)) {
+    if (!existsSync7(this.filePath)) {
       mkdirSync5(dirname5(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync6(this.filePath, "utf-8");
+      const raw = readFileSync7(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -3157,25 +3253,31 @@ var IntegrationRegistry = class {
 
 // src/lib/integration-manager.ts
 import { homedir as homedir7 } from "os";
-import { join as join7, delimiter } from "path";
-import { existsSync as existsSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync } from "fs";
+import { join as join8, delimiter } from "path";
+import { existsSync as existsSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync8, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join7(homedir7(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join7(DEFAULT_DATA_DIR2, "integrations");
-var INTEGRATIONS_BIN = join7(INTEGRATIONS_DIR, "node_modules", ".bin");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join8(homedir7(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join8(DEFAULT_DATA_DIR2, "integrations");
+var installLock = Promise.resolve();
+function withInstallLock(task) {
+  const run = installLock.then(task, task);
+  installLock = run.then(() => void 0, () => void 0);
+  return run;
+}
+var INTEGRATIONS_BIN = join8(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync7(INTEGRATIONS_DIR)) {
+  if (!existsSync8(INTEGRATIONS_DIR)) {
     mkdirSync6(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join7(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync7(pkgPath)) {
+  const pkgPath = join8(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync8(pkgPath)) {
     writeFileSync6(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
@@ -3242,19 +3344,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join7(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join7(pkgDir, "package.json");
-    if (!existsSync7(pkgDir) || !existsSync7(pkgJson)) return false;
+    const pkgDir = join8(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join8(pkgDir, "package.json");
+    if (!existsSync8(pkgDir) || !existsSync8(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync7(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync8(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync7(join7(pkgDir, target))) return false;
+        if (!existsSync8(join8(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync7(join7(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync8(join8(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -3268,7 +3370,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync7(join7(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync8(join8(INTEGRATIONS_BIN, c)));
   }
   /**
    * Install an npm package into the managed integrations directory if not
@@ -3285,8 +3387,15 @@ var IntegrationManager = class {
   async ensureInstalled(npmPackage) {
     ensureIntegrationsDir();
     if (this.isUsableInstall(npmPackage)) return;
-    const pkgDir = join7(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync7(pkgDir)) {
+    return withInstallLock(async () => {
+      if (this.isUsableInstall(npmPackage)) return;
+      await this.installNow(npmPackage);
+    });
+  }
+  /** The actual install. Callers MUST hold the install lock. */
+  async installNow(npmPackage) {
+    const pkgDir = join8(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (existsSync8(pkgDir)) {
       console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -3658,8 +3767,9 @@ var IntegrationManager = class {
     }
     return {
       profile: profileId,
-      executionMapping: profileGating.default.executionMapping,
-      staticExecution: profileGating.default.staticExecution
+      executionMapping: {},
+      category: "disabled",
+      disabledReason: "not described in manifest"
     };
   }
   /**
@@ -3701,28 +3811,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync8, existsSync as existsSync8 } from "fs";
-import { join as join8, resolve } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
+import { join as join9, resolve } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join8(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join8(dir, "index.json");
-  if (!existsSync8(indexPath)) {
+  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join9(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join9(dir, "index.json");
+  if (!existsSync9(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync8(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync9(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join8(dir, relativePath);
+    const profilePath = join9(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync8(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync9(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -3755,30 +3865,30 @@ function warnNoProfiles(reason) {
 }
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
-import { join as join9, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
+import { join as join10, resolve as resolve2 } from "path";
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve2(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join9(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join10(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join9(dir, "index.json");
-  if (!existsSync9(indexPath)) {
+  const indexPath = join10(dir, "index.json");
+  if (!existsSync10(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync9(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync10(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join9(dir, relativePath);
+    const manifestPath = join10(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync9(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync10(manifestPath, "utf-8"));
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {