@suveren/gateway 0.8.6 → 0.9.0

package/dist/mcp-server/http.mjs

@@ -134,6 +134,13 @@ var SPClient = class {
   sessionCookie = "";
   apiKey = "";
   receiptRetry;
+  /** Set when a call comes back 401 while we held a session — distinct from
+   *  never having logged in. Cleared the moment a fresh cookie is configured. */
+  lockReason = null;
+  /** Single-flight per client instance: only the FIRST 401 after a session
+   *  was active tells the control plane. Concurrent in-flight calls that were
+   *  all sent under the same now-dead cookie would otherwise all report it. */
+  sessionExpiredNotified = false;
   /** The AS base URL this client talks to (for provenance records). */
   get url() {
     return this.baseUrl;
@@ -143,6 +150,29 @@ var SPClient = class {
   }
   setSessionCookie(cookie) {
     this.sessionCookie = cookie;
+    this.lockReason = null;
+    this.sessionExpiredNotified = false;
+  }
+  /**
+   * Drop the session because the control plane learned (by whatever path —
+   * one of OUR calls 401ing, its own AS proxy 401ing, or an AS key mismatch)
+   * that it ended. Idempotent: safe to call redundantly from the
+   * control-plane's push.
+   *
+   * @param reason Defaults to 'expired' for the original caller (a 401 really
+   *   does mean the session ended) — but the control plane's own lock
+   *   procedures (session-lock.ts) know the REAL reason and must pass it, or
+   *   an agent told "your sign-in ended, sign in again" for an AS key
+   *   mismatch would be sent to a sign-in that is itself refused.
+   */
+  clearSession(reason = "expired") {
+    this.sessionCookie = "";
+    this.lockReason = reason;
+  }
+  /** Why we are currently locked, if known. `null` means the default
+   *  boot-locked case (nobody has signed in yet this run). */
+  getLockReason() {
+    return this.sessionCookie === "" ? this.lockReason : null;
   }
   /**
    * Has anyone signed in yet this run?
@@ -174,10 +204,20 @@ var SPClient = class {
     if (this.apiKey) {
       headers["X-API-Key"] = this.apiKey;
     }
-    return globalThis.fetch(url, {
+    const hadSession = this.sessionCookie !== "";
+    const res = await globalThis.fetch(url, {
       ...init,
       headers
     });
+    if (res.status === 401 && hadSession) {
+      this.sessionCookie = "";
+      this.lockReason = "expired";
+      if (!this.sessionExpiredNotified) {
+        this.sessionExpiredNotified = true;
+        void notifyControlPlane("session-expired");
+      }
+    }
+    return res;
   }
   /**
    * Get SP public key.
@@ -331,13 +371,52 @@ var SPClient = class {
 
 // src/lib/attestation-cache.ts
 import { decodeAttestationBlob } from "@hap/core";
+
+// src/lib/as-pairing.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
+import { dirname, join as join2 } from "path";
+function pairingPath(dataDir2) {
+  return join2(dataDir2, "as-pairing.json");
+}
+function readPairing(dataDir2) {
+  const path = pairingPath(dataDir2);
+  if (!existsSync2(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync2(path, "utf-8"));
+    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
+    return { asUrl: data.asUrl, publicKeyHex: data.publicKeyHex, pairedAt: data.pairedAt ?? "" };
+  } catch {
+    return null;
+  }
+}
+function fingerprintOf(publicKeyHex) {
+  const raw = Buffer.from(publicKeyHex, "hex");
+  const digest = createHash("sha256").update(raw).digest("hex").toUpperCase();
+  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
+}
+
+// src/lib/attestation-cache.ts
+var AsKeyMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsKeyMismatchError";
+  }
+};
 function isCommitmentDowngrade(auth) {
   const requiresReview = auth.signedCommitmentMode === "review" || auth.signedCommitmentMode === "review_above_cap";
   return requiresReview && (auth.deferredCommitmentDomains ?? []).length === 0;
 }
 var AttestationCache = class {
-  constructor(spClient) {
+  /**
+   * @param dataDir Where to look for a pinned key (as-pairing.json). Optional
+   *   and defaults to "no pin enforced" — kept optional so existing
+   *   constructions (and this class's own unit tests) that pass only an
+   *   SPClient keep working unpinned, exactly as before pinning existed.
+   */
+  constructor(spClient, dataDir2) {
     this.spClient = spClient;
+    this.dataDir = dataDir2;
   }
   spPublicKey = null;
   spPublicKeyFetchedAt = 0;
@@ -347,15 +426,29 @@ var AttestationCache = class {
   authorizations = /* @__PURE__ */ new Map();
   lastSync = 0;
   /**
-   * Get the SP public key, fetching from SP if not cached or expired.
+   * Get the SP public key, fetching from SP if not cached or expired, then —
+   * when a pin exists for this exact AS URL — verifying the live key still
+   * matches it.
+   *
+   * Trust-on-first-use before any pairing exists (or when no `dataDir` was
+   * given): the fetched key is cached and returned, same as before pinning.
+   * Once paired, a live key that differs from the pin throws
+   * {@link AsKeyMismatchError} — fail closed, never silently re-pin.
    */
   async getPublicKey() {
     const now = Math.floor(Date.now() / 1e3);
-    if (this.spPublicKey && now - this.spPublicKeyFetchedAt < this.SP_PUBKEY_TTL) {
-      return this.spPublicKey;
+    if (!(this.spPublicKey && now - this.spPublicKeyFetchedAt < this.SP_PUBKEY_TTL)) {
+      this.spPublicKey = await this.spClient.getPublicKey();
+      this.spPublicKeyFetchedAt = now;
+    }
+    if (this.dataDir) {
+      const pin = readPairing(this.dataDir);
+      if (pin && pin.asUrl === this.spClient.url && pin.publicKeyHex !== this.spPublicKey) {
+        throw new AsKeyMismatchError(
+          `The Authority Server at ${this.spClient.url} presented a signing key that does not match the one pinned at pairing (pinned fingerprint ${fingerprintOf(pin.publicKeyHex)}). Refusing to trust it. Re-pair (sign in again) only if you expect this key to have changed.`
+        );
+      }
     }
-    this.spPublicKey = await this.spClient.getPublicKey();
-    this.spPublicKeyFetchedAt = now;
     return this.spPublicKey;
   }
   /**
@@ -465,18 +558,18 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync, readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, unlinkSync } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
 import { homedir } from "os";
-import { dirname, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join2(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join3(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname(filePath);
+      this.baseDir = dirname2(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR;
     }
@@ -487,13 +580,13 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync2(this.encryptedFilePath)) {
+    if (existsSync3(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync2(this.plaintextFilePath)) {
+      if (existsSync3(this.plaintextFilePath)) {
         try {
-          unlinkSync(this.plaintextFilePath);
+          unlinkSync2(this.plaintextFilePath);
         } catch {
         }
       }
@@ -513,6 +606,30 @@ var GateStore = class {
     this.entries.delete(path);
     this.persist();
   }
+  /**
+   * Wipe every locally cached gate. Used when the Authority Server this
+   * gateway points at changes (re-pairing, see as-pairing.ts): a stored
+   * authorization id and its intent/context are meaningless against a
+   * different AS's grants, and keeping them around risks a `getAll()` caller
+   * (e.g. list-authorizations) advertising authority that no longer exists.
+   *
+   * Removes BOTH the plaintext and encrypted files, not just the one
+   * currently active — this runs at boot, before any vault key is set, so
+   * `persist()` would otherwise only touch `gates.json` and leave a stale
+   * `gates.enc.json` in place for `setVaultKey()` to resurrect on the next
+   * unlock.
+   */
+  clearAll() {
+    this.entries = /* @__PURE__ */ new Map();
+    try {
+      if (existsSync3(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
+    } catch {
+    }
+    try {
+      if (existsSync3(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
+    } catch {
+    }
+  }
   // ─── Encryption helpers ─────────────────────────────────────────────────
   encrypt(plaintext) {
     if (!this.vaultKey) throw new Error("No vault key");
@@ -542,19 +659,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join2(this.baseDir, "gates.json");
+    return join3(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join2(this.baseDir, "gates.enc.json");
+    return join3(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync2(this.plaintextFilePath)) {
-      mkdirSync(this.baseDir, { recursive: true });
+    if (!existsSync3(this.plaintextFilePath)) {
+      mkdirSync2(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync3(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -563,9 +680,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync2(this.encryptedFilePath)) return;
+    if (!existsSync3(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync3(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -589,8 +706,8 @@ var GateStore = class {
       version: 1,
       entries: Object.fromEntries(this.entries)
     };
-    mkdirSync(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync2(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
@@ -600,17 +717,17 @@ var GateStore = class {
     for (const [key, entry] of this.entries) {
       data.entries[key] = this.encrypt(JSON.stringify(entry));
     }
-    mkdirSync(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync2(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join3(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join4(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -618,7 +735,7 @@ var ExecutionLog = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname2(filePath);
+      this.baseDir = dirname3(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR2;
     }
@@ -629,13 +746,13 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync3(this.encryptedFilePath)) {
+    if (existsSync4(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync3(this.plaintextFilePath)) {
+      if (existsSync4(this.plaintextFilePath)) {
         try {
-          unlinkSync2(this.plaintextFilePath);
+          unlinkSync3(this.plaintextFilePath);
         } catch {
         }
       }
@@ -657,14 +774,23 @@ var ExecutionLog = class {
    * @param field - The execution field to sum ("_count" for plain counting)
    * @param window - Time window (daily, weekly, monthly)
    * @param now - Current timestamp in seconds (for testing)
+   * @param actionTypes - Only count entries whose `execution.action_type` is one
+   *   of these (omitted → all). Consumption is partitioned by action type, as at
+   *   the Authority Server: without it, the usage shown for sales' "orders per
+   *   day" counted every quote and send. An entry with no action_type counts against every filter —
+   *   an unknown action is not evidence of headroom.
    */
-  sumByWindow(profileId, path, field, window, now = Math.floor(Date.now() / 1e3)) {
+  sumByWindow(profileId, path, field, window, now = Math.floor(Date.now() / 1e3), actionTypes) {
     const cutoff = windowCutoff(window, now);
     let total = 0;
     for (const entry of this.entries) {
       if (entry.profileId !== profileId) continue;
       if (entry.path !== path) continue;
       if (entry.timestamp < cutoff) continue;
+      if (actionTypes) {
+        const at = entry.execution.action_type;
+        if (typeof at === "string" && !actionTypes.includes(at)) continue;
+      }
       if (field === "_count") {
         total += 1;
       } else {
@@ -728,19 +854,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join3(this.baseDir, "execution-log.json");
+    return join4(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join3(this.baseDir, "execution-log.enc.json");
+    return join4(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync3(this.plaintextFilePath)) {
-      mkdirSync2(this.baseDir, { recursive: true });
+    if (!existsSync4(this.plaintextFilePath)) {
+      mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync3(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync4(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -750,9 +876,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync3(this.encryptedFilePath)) return;
+    if (!existsSync4(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync3(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync4(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -772,8 +898,8 @@ var ExecutionLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, entries: this.entries };
-    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync2(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, entries: this.entries };
@@ -781,8 +907,8 @@ var ExecutionLog = class {
       version: 1,
       blob: this.encrypt(JSON.stringify(logFile))
     };
-    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync2(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 function windowCutoff(window, now) {
@@ -799,11 +925,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join4(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join5(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -811,18 +937,18 @@ var DenialLog = class {
   baseDir;
   vaultKey = null;
   constructor(filePath) {
-    this.baseDir = filePath && filePath.endsWith(".json") ? dirname3(filePath) : filePath ?? DEFAULT_DIR3;
+    this.baseDir = filePath && filePath.endsWith(".json") ? dirname4(filePath) : filePath ?? DEFAULT_DIR3;
     this.loadPlaintext();
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync4(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync4(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
-          unlinkSync3(this.plaintextFilePath);
+          unlinkSync4(this.plaintextFilePath);
         } catch {
         }
       }
@@ -870,18 +996,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join4(this.baseDir, "denials.json");
+    return join5(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join4(this.baseDir, "denials.enc.json");
+    return join5(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync4(this.plaintextFilePath)) {
-      mkdirSync3(this.baseDir, { recursive: true });
+    if (!existsSync5(this.plaintextFilePath)) {
+      mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync4(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync5(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -889,9 +1015,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync4(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync4(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync5(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -905,23 +1031,23 @@ var DenialLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, records: this.records };
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, records: this.records };
     const data = { version: 1, blob: this.encrypt(JSON.stringify(logFile)) };
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname5, join as join6 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join5(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join6(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -935,7 +1061,7 @@ var ReceiptArchive = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname4(filePath);
+      this.baseDir = dirname5(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR4;
     }
@@ -946,13 +1072,13 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync5(this.encryptedFilePath)) {
+    if (existsSync6(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync5(this.plaintextFilePath)) {
+      if (existsSync6(this.plaintextFilePath)) {
         try {
-          unlinkSync4(this.plaintextFilePath);
+          unlinkSync5(this.plaintextFilePath);
         } catch {
         }
       }
@@ -964,7 +1090,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync5(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync6(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -1065,19 +1191,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join5(this.baseDir, "receipt-archive.json");
+    return join6(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join5(this.baseDir, "receipt-archive.enc.json");
+    return join6(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync5(this.plaintextFilePath)) {
-      mkdirSync4(this.baseDir, { recursive: true });
+    if (!existsSync6(this.plaintextFilePath)) {
+      mkdirSync5(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1087,18 +1213,18 @@ var ReceiptArchive = class {
     } catch {
       console.error(`[ReceiptArchive] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
       try {
-        writeFileSync4(
+        writeFileSync5(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync5(this.plaintextFilePath)
+          readFileSync6(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync5(this.encryptedFilePath)) return;
+    if (!existsSync6(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1110,9 +1236,9 @@ var ReceiptArchive = class {
     } catch (err) {
       console.error(`[ReceiptArchive] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
       try {
-        writeFileSync4(
+        writeFileSync5(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync5(this.encryptedFilePath)
+          readFileSync6(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1126,29 +1252,29 @@ var ReceiptArchive = class {
     }
   }
   persistPlaintext() {
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
       version: 1,
       blob: this.encrypt(JSON.stringify(this.data))
     };
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-journal.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, renameSync } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync7, renameSync } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname5, join as join6 } from "path";
-import { createHash } from "crypto";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
+import { dirname as dirname6, join as join7 } from "path";
+import { createHash as createHash2 } from "crypto";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join7(homedir5(), ".suveren");
 var FILE_NAME = "execution-journal.json";
 var MAX_AGE_SECONDS2 = 90 * 24 * 60 * 60;
 function hashToolArgs(args) {
-  return "sha256:" + createHash("sha256").update(stableStringify(args)).digest("hex");
+  return "sha256:" + createHash2("sha256").update(stableStringify(args)).digest("hex");
 }
 function stableStringify(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
@@ -1160,8 +1286,8 @@ function stableStringify(value) {
 var ExecutionJournal = class {
   filePath;
   constructor(filePath) {
-    const baseDir = filePath && filePath.endsWith(".json") ? dirname5(filePath) : filePath ?? DEFAULT_DIR5;
-    this.filePath = join6(baseDir, FILE_NAME);
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname6(filePath) : filePath ?? DEFAULT_DIR5;
+    this.filePath = join7(baseDir, FILE_NAME);
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
@@ -1200,9 +1326,9 @@ var ExecutionJournal = class {
   }
   // ─── Persistence ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync6(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync7(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync6(this.filePath, "utf8"));
+      const parsed = JSON.parse(readFileSync7(this.filePath, "utf8"));
       if (parsed?.version !== 1 || !Array.isArray(parsed.entries)) {
         throw new Error("unexpected shape");
       }
@@ -1216,9 +1342,9 @@ var ExecutionJournal = class {
   persist(file) {
     const cutoff = nowSec() - MAX_AGE_SECONDS2;
     file.entries = file.entries.filter((e) => e.startedAt >= cutoff);
-    mkdirSync5(dirname5(this.filePath), { recursive: true, mode: 448 });
+    mkdirSync6(dirname6(this.filePath), { recursive: true, mode: 448 });
     const tmp = this.filePath + ".tmp";
-    writeFileSync5(tmp, JSON.stringify(file, null, 2), { mode: 384 });
+    writeFileSync6(tmp, JSON.stringify(file, null, 2), { mode: 384 });
     renameSync(tmp, this.filePath);
   }
 };
@@ -1226,6 +1352,61 @@ function nowSec() {
   return Math.floor(Date.now() / 1e3);
 }
 
+// src/lib/proposal-submission-store.ts
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync7, existsSync as existsSync8, renameSync as renameSync2 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname7, join as join8 } from "path";
+var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join8(homedir6(), ".suveren");
+var FILE_NAME2 = "proposal-submissions.json";
+var MAX_AGE_SECONDS3 = 90 * 24 * 60 * 60;
+function nowSec2() {
+  return Math.floor(Date.now() / 1e3);
+}
+var ProposalSubmissionStore = class {
+  filePath;
+  constructor(filePath) {
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR6;
+    this.filePath = join8(baseDir, FILE_NAME2);
+  }
+  /** Record what was submitted, right after a successful submitProposal(). */
+  record(entry) {
+    const file = this.load();
+    file.entries = file.entries.filter((e) => e.proposalId !== entry.proposalId);
+    file.entries.push({
+      proposalId: entry.proposalId,
+      tool: entry.tool,
+      toolArgsHash: hashToolArgs(entry.toolArgs),
+      executionContextHash: hashToolArgs(entry.executionContext),
+      authorizationId: entry.authorizationId,
+      profileId: entry.profileId,
+      submittedAt: nowSec2()
+    });
+    this.persist(file);
+  }
+  /** Always reads from disk — another process (the poll loop lives in the
+   *  same process, but this stays consistent with execution-journal.ts). */
+  get(proposalId) {
+    return this.load().entries.find((e) => e.proposalId === proposalId);
+  }
+  load() {
+    if (!existsSync8(this.filePath)) return { version: 1, entries: [] };
+    try {
+      const parsed = JSON.parse(readFileSync8(this.filePath, "utf-8"));
+      const cutoff = nowSec2() - MAX_AGE_SECONDS3;
+      parsed.entries = (parsed.entries ?? []).filter((e) => e.submittedAt >= cutoff);
+      return parsed;
+    } catch {
+      return { version: 1, entries: [] };
+    }
+  }
+  persist(file) {
+    mkdirSync7(dirname7(this.filePath), { recursive: true, mode: 448 });
+    const tmpPath = `${this.filePath}.tmp`;
+    writeFileSync7(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
+    renameSync2(tmpPath, this.filePath);
+  }
+};
+
 // src/lib/gatekeeper.ts
 import { verify } from "@hap/core";
 var MCPGatekeeper = class {
@@ -1276,7 +1457,26 @@ var MCPGatekeeper = class {
         authorization: auth
       };
     }
-    const publicKeyHex = await this.cache.getPublicKey();
+    let publicKeyHex;
+    try {
+      publicKeyHex = await this.cache.getPublicKey();
+    } catch (err) {
+      if (err instanceof AsKeyMismatchError) {
+        void notifyControlPlane("as-key-mismatch");
+        return {
+          result: {
+            approved: false,
+            // No dedicated GatekeeperError code exists for this (hap-core's
+            // union predates gateway-side key pinning) — INVALID_SIGNATURE is
+            // the closest fit: it's exactly the claim being made here ("we
+            // will not trust a signature made under this key").
+            errors: [{ code: "INVALID_SIGNATURE", message: err.message }]
+          },
+          authorization: auth
+        };
+      }
+      throw err;
+    }
     const resolvedBounds = override?.bounds ?? auth.bounds ?? auth.frame;
     const resolvedContext = override?.context ?? auth.context;
     const frame = { ...resolvedBounds, profile: auth.profileId };
@@ -1308,15 +1508,25 @@ var SharedState = class {
   receiptArchive;
   /** Which tickets this Gatekeeper has executed — the "one execution per ticket" half of exactly-once. */
   executionJournal;
+  /** What THIS gateway submitted for each review-mode proposal it created —
+   *  see ticket-verify.ts / commitments.ts. */
+  proposalSubmissions;
   gatekeeper;
-  constructor(spUrl2, gateStorePath) {
+  /**
+   * @param dataDir Passed to the AttestationCache so it can enforce AS key
+   *   pinning (as-pairing.ts). Optional for backward compat with existing
+   *   constructions/tests that pass only a URL — those get unpinned
+   *   trust-on-first-use behavior, same as before pinning existed.
+   */
+  constructor(spUrl2, gateStorePath, dataDir2) {
     this.spClient = new SPClient(spUrl2);
-    this.cache = new AttestationCache(this.spClient);
+    this.cache = new AttestationCache(this.spClient, dataDir2);
     this.gateStore = new GateStore(gateStorePath);
     this.executionLog = new ExecutionLog(gateStorePath);
     this.denialLog = new DenialLog(gateStorePath);
     this.receiptArchive = new ReceiptArchive(gateStorePath);
     this.executionJournal = new ExecutionJournal(gateStorePath);
+    this.proposalSubmissions = new ProposalSubmissionStore(gateStorePath);
     this.gatekeeper = new MCPGatekeeper(this.cache);
   }
   /**
@@ -1332,7 +1542,8 @@ var SharedState = class {
       let asPublicKey;
       try {
         asPublicKey = await this.cache.getPublicKey();
-      } catch {
+      } catch (err) {
+        if (err instanceof AsKeyMismatchError) throw err;
       }
       this.receiptArchive.record({
         receipt,
@@ -1354,6 +1565,7 @@ var SharedState = class {
         } : void 0
       });
     } catch (err) {
+      if (err instanceof AsKeyMismatchError) throw err;
       console.error(
         "[Suveren MCP] Receipt archive write failed (execution proceeds \u2014 AS retains authoritative copy):",
         err
@@ -1402,6 +1614,7 @@ import { z } from "zod";
 import { getProfile } from "@hap/core";
 
 // src/lib/consumption.ts
+import { boundActionTypes } from "@hap/core";
 function getConsumptionState(auth, executionLog, profile) {
   if (!profile?.boundsSchema?.fields) return [];
   const entries = [];
@@ -1421,7 +1634,8 @@ function getConsumptionState(auth, executionLog, profile) {
       auth.path,
       cumulativeField,
       bt.window,
-      now
+      now,
+      boundActionTypes(fieldName, fieldDef)
     );
     entries.push({
       // displayName FIRST: description is prose meant for a human reading the
@@ -1465,24 +1679,24 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
-var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
+import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join9 } from "path";
+var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join9(homedir7(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
-function readContextFile(dataDir) {
-  const dir = dataDir ?? DEFAULT_DIR6;
-  const filePath = join7(dir, "context.md");
-  if (!existsSync7(filePath)) return null;
+function readContextFile(dataDir2) {
+  const dir = dataDir2 ?? DEFAULT_DIR7;
+  const filePath = join9(dir, "context.md");
+  if (!existsSync9(filePath)) return null;
   try {
-    const content = readFileSync7(filePath, "utf-8").trim();
+    const content = readFileSync9(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
   }
 }
-function getContextForBrief(dataDir) {
-  const full = readContextFile(dataDir);
+function getContextForBrief(dataDir2) {
+  const full = readContextFile(dataDir2);
   if (!full) return { brief: null, truncated: false };
   if (full.length <= BRIEF_MAX_CHARS) {
     return { brief: full, truncated: false };
@@ -1578,14 +1792,41 @@ function uiUrl() {
   const port2 = process.env.SUVEREN_CP_PORT ?? "3400";
   return `http://localhost:${port2}`;
 }
-function lockedNotice(action) {
-  const what = action ? `Cannot ${action}: the` : "The";
-  return `${what} Suveren gateway is running but LOCKED, so it cannot read any authorizations or credentials.
+function bootLockedNotice(what) {
+  return `${what} Suveren gateway is running but LOCKED, so it cannot read any mandates or credentials.
 
-This is not the same as having no authorizations \u2014 yours are on disk, encrypted, and unreadable until someone unlocks them.
+This is not the same as having no mandates \u2014 yours are on disk, encrypted, and unreadable until someone unlocks them.
 
 TELL THE USER: open ${uiUrl()} and enter your Suveren API key to unlock the gateway. It boots locked by design after every restart; the key is never stored.`;
 }
+function expiredSessionNotice(what) {
+  return `${what} Suveren gateway's sign-in has ended (sign-ins last 30 days, or it was revoked), so it is now LOCKED.
+
+TELL THE USER: open ${uiUrl()} and enter your Suveren API key to sign in again. Your mandates are safe; nothing ran.`;
+}
+function asKeyMismatchNotice(what) {
+  return `${what} Suveren gateway is LOCKED because the Authority Server it is configured to use presented a signing key that does not match the one pinned when this gateway last signed in. This is NOT an ended sign-in \u2014 signing in again will be refused until the mismatch is resolved.
+
+TELL THE USER: this needs an operator to check whether the Authority Server's key changed intentionally (e.g. a reinstall) or something else is answering at that address, at ${uiUrl()}. Nothing ran under the unrecognized key.`;
+}
+function asUrlChangedNotice(what) {
+  return `${what} Suveren gateway is LOCKED because the Authority Server it points at has changed since it last signed in. Cached mandates from the old server were cleared.
+
+TELL THE USER: open ${uiUrl()} and sign in again to pair with the new Authority Server.`;
+}
+function lockedNotice(action, reason = "restart") {
+  const what = action ? `Cannot ${action}: the` : "The";
+  switch (reason) {
+    case "expired":
+      return expiredSessionNotice(what);
+    case "as-key-mismatch":
+      return asKeyMismatchNotice(what);
+    case "as-url-changed":
+      return asUrlChangedNotice(what);
+    default:
+      return bootLockedNotice(what);
+  }
+}
 
 // src/tools/authorizations.ts
 import { getProfile as getProfile4 } from "@hap/core";
@@ -1593,6 +1834,9 @@ import { getProfile as getProfile4 } from "@hap/core";
 // src/lib/receipt-footer.ts
 import { deriveIdentityLine } from "@hap/core";
 var AS_BASE = (process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai").replace(/\/$/, "");
+function setAsBaseUrl(url) {
+  AS_BASE = url.replace(/\/$/, "");
+}
 var OPERATOR_NAME = process.env.SUVEREN_OPERATOR_NAME ?? "Suveren";
 var HAP_URL = "https://www.humanagencyprotocol.org/";
 var FOOTER_PROFILES = /* @__PURE__ */ new Set(["email", "calendar", "publish"]);
@@ -1698,6 +1942,83 @@ function attachReceiptId(tool, args, receiptId) {
   return { ...args, receipt_id: receiptId };
 }
 
+// src/lib/ticket-verify.ts
+import { verifyReceiptSignature } from "@hap/core";
+var TicketBindingMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TicketBindingMismatchError";
+  }
+};
+var TICKET_MAX_AGE_SECONDS = 5 * 60;
+var TICKET_MAX_CLOCK_SKEW_SECONDS = 30;
+async function verifyTicket(cache, receipt, expected) {
+  const publicKeyHex = await cache.getPublicKey();
+  if (typeof receipt.signature !== "string" || !receipt.signature) {
+    throw new AsKeyMismatchError("Ticket carries no signature \u2014 refusing to trust it.");
+  }
+  try {
+    await verifyReceiptSignature(receipt, publicKeyHex);
+  } catch (err) {
+    throw new AsKeyMismatchError(
+      `Ticket signature does not verify against the pinned Authority Server key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to execute.`
+    );
+  }
+  if (receipt.action !== expected.action) {
+    throw new TicketBindingMismatchError(
+      `Ticket action "${String(receipt.action)}" does not match the requested action "${expected.action}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.executionContext !== void 0 && hashToolArgs(receipt.executionContext ?? {}) !== hashToolArgs(expected.executionContext)) {
+    throw new TicketBindingMismatchError(
+      "Ticket executionContext does not match what this call requested \u2014 refusing to execute."
+    );
+  }
+  if (expected.authorizationId !== void 0 && receipt.authorizationId !== expected.authorizationId) {
+    throw new TicketBindingMismatchError(
+      `Ticket authorizationId "${String(receipt.authorizationId)}" does not match the requested grant "${expected.authorizationId}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.profileId !== void 0 && receipt.profileId !== expected.profileId) {
+    throw new TicketBindingMismatchError(
+      `Ticket profileId "${String(receipt.profileId)}" does not match the requested profile "${expected.profileId}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.proposalId !== void 0 && receipt.proposalId !== expected.proposalId) {
+    throw new TicketBindingMismatchError(
+      `Ticket proposalId "${String(receipt.proposalId)}" does not match the proposal being executed "${expected.proposalId}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.contentHash !== void 0) {
+    if (receipt.contentHash !== expected.contentHash) {
+      throw new TicketBindingMismatchError(
+        "Ticket contentHash does not match the content this call is bound to \u2014 refusing to execute."
+      );
+    }
+    if (expected.contentBinding !== void 0 && hashToolArgs(receipt.contentBinding ?? {}) !== hashToolArgs(expected.contentBinding)) {
+      throw new TicketBindingMismatchError(
+        "Ticket contentBinding does not match what this call requested \u2014 refusing to execute."
+      );
+    }
+  }
+  const timestamp = receipt.timestamp;
+  if (typeof timestamp !== "number" || !Number.isFinite(timestamp)) {
+    throw new TicketBindingMismatchError("Ticket carries no valid timestamp \u2014 refusing to execute.");
+  }
+  const nowSec3 = Math.floor(Date.now() / 1e3);
+  const ageSec = nowSec3 - timestamp;
+  if (ageSec > TICKET_MAX_AGE_SECONDS) {
+    throw new TicketBindingMismatchError(
+      `Ticket is ${ageSec}s old, older than the ${TICKET_MAX_AGE_SECONDS}s freshness window \u2014 refusing to execute.`
+    );
+  }
+  if (ageSec < -TICKET_MAX_CLOCK_SKEW_SECONDS) {
+    throw new TicketBindingMismatchError(
+      `Ticket is timestamped ${-ageSec}s in the future, beyond the ${TICKET_MAX_CLOCK_SKEW_SECONDS}s clock-skew tolerance \u2014 refusing to execute.`
+    );
+  }
+}
+
 // src/lib/arg-encoding.ts
 function rfc2047Encode(value) {
   if (!/[^\x00-\x7F]/.test(value)) return value;
@@ -2109,7 +2430,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
   const lockedGuard = (inner) => async (args) => {
     if (!state2.spClient.isUnlocked()) {
       return {
-        content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`) }],
+        content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, state2.spClient.getLockReason() ?? "restart") }],
         isError: true
       };
     }
@@ -2413,6 +2734,14 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             toolArgs: enrichedArgs,
             executionContext: { ...execution }
           });
+          state2.proposalSubmissions.record({
+            proposalId: proposal.id,
+            tool: tool.namespacedName,
+            toolArgs: enrichedArgs,
+            executionContext: { ...execution },
+            authorizationId: authzId,
+            profileId: auth.profileId
+          });
           return {
             content: [{
               type: "text",
@@ -2421,6 +2750,12 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             }]
           };
         } catch (err) {
+          if (!state2.spClient.isUnlocked()) {
+            return {
+              content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, "expired") }],
+              isError: true
+            };
+          }
           return {
             content: [{ type: "text", text: `Failed to submit proposal: ${err instanceof Error ? err.message : String(err)}` }],
             isError: true
@@ -2449,6 +2784,14 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
         });
         receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+        await verifyTicket(state2.cache, receipt, {
+          action: tool.namespacedName,
+          executionContext: { ...execution },
+          authorizationId: authzId,
+          profileId: auth.profileId,
+          contentHash: binding?.contentHash,
+          contentBinding: binding?.contentBinding
+        });
         await state2.archiveReceipt(receipt, {
           authorizationId: authzId,
           profileId: auth.profileId,
@@ -2463,6 +2806,13 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           boundContent: binding?.boundContent
         });
       } catch (err) {
+        if (err instanceof AsKeyMismatchError || err instanceof TicketBindingMismatchError) {
+          void notifyControlPlane("as-key-mismatch");
+          return {
+            content: [{ type: "text", text: `Blocked: ${err.message}` }],
+            isError: true
+          };
+        }
         if (err instanceof ContentBindingError) {
           return {
             content: [{
@@ -2508,6 +2858,14 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               executionContext: { ...execution },
               pendingApprovers: uniqueApprovers
             });
+            state2.proposalSubmissions.record({
+              proposalId: proposal.id,
+              tool: tool.namespacedName,
+              toolArgs: enrichedArgs,
+              executionContext: { ...execution },
+              authorizationId: authzId,
+              profileId: auth.profileId
+            });
             return {
               content: [{
                 type: "text",
@@ -2516,6 +2874,12 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
               }]
             };
           } catch (proposalErr) {
+            if (!state2.spClient.isUnlocked()) {
+              return {
+                content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, "expired") }],
+                isError: true
+              };
+            }
             return {
               content: [{ type: "text", text: `Failed to submit approval proposal: ${proposalErr instanceof Error ? proposalErr.message : String(proposalErr)}` }],
               isError: true
@@ -2537,6 +2901,12 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
             isError: true
           };
         }
+        if (!state2.spClient.isUnlocked()) {
+          return {
+            content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, "expired") }],
+            isError: true
+          };
+        }
         return {
           content: [{ type: "text", text: `SP unavailable \u2014 tool call blocked. ${err instanceof Error ? err.message : ""}` }],
           isError: true
@@ -2667,7 +3037,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
 function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
   return async (args) => {
     if (!state2.spClient.isUnlocked()) {
-      return { content: [{ type: "text", text: lockedNotice("list authorizations") }] };
+      return { content: [{ type: "text", text: lockedNotice("list authorizations", state2.spClient.getLockReason() ?? "restart") }] };
     }
     const authorizations = state2.getEnrichedAuthorizations();
     const now = Math.floor(Date.now() / 1e3);
@@ -2861,7 +3231,7 @@ function shortProfileName3(profileId) {
 function listIntegrationsHandler(state2, integrationManager2) {
   return async () => {
     if (!state2.spClient.isUnlocked()) {
-      return { content: [{ type: "text", text: lockedNotice("list integrations") }] };
+      return { content: [{ type: "text", text: lockedNotice("list integrations", state2.spClient.getLockReason() ?? "restart") }] };
     }
     if (!integrationManager2) {
       return { content: [{ type: "text", text: "No integration manager available." }] };
@@ -2903,6 +3273,9 @@ function listIntegrationsHandler(state2, integrationManager2) {
 
 // src/tools/commitments.ts
 import { ContentBindingError as ContentBindingError2 } from "@hap/core";
+function buildSkippedProposalNote(proposalId) {
+  return `Proposal ${proposalId} was approved, but was submitted from another device/installation of this operator (or one whose local record is gone) \u2014 this gateway will not execute it. Re-run the same request here to execute it from this gateway.`;
+}
 var installedExecutor = null;
 function installCommittedExecutor(executor) {
   installedExecutor = executor;
@@ -2928,6 +3301,28 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     );
   }
   const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
+  const submitted = state2.proposalSubmissions.get(proposal.id);
+  if (!submitted) {
+    console.error(
+      `[Suveren MCP] Proposal ${proposal.id} is committed but has no local submission record on this gateway \u2014 leaving it for whichever gateway submitted it (this is normal for a different device of the same operator, or the AS lists a proposal we never submitted).`
+    );
+    return { text: buildSkippedProposalNote(proposal.id) };
+  }
+  {
+    const mismatches = [];
+    if (submitted.tool !== proposal.tool) mismatches.push("tool");
+    if (submitted.toolArgsHash !== hashToolArgs(proposal.toolArgs)) mismatches.push("arguments");
+    if (submitted.executionContextHash !== hashToolArgs(proposal.executionContext)) mismatches.push("executionContext");
+    if (submitted.authorizationId !== proposal.authorizationId) mismatches.push("authorizationId");
+    if (submitted.profileId !== proposal.profileId) mismatches.push("profileId");
+    if (mismatches.length > 0) {
+      void notifyControlPlane("as-key-mismatch");
+      return {
+        text: `Blocked: proposal ${proposal.id} no longer matches what this gateway submitted (${mismatches.join(", ")} differ) \u2014 refusing to execute.`,
+        isError: true
+      };
+    }
+  }
   let receiptId;
   let replayed = false;
   try {
@@ -2963,6 +3358,15 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     });
     receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
     replayed = idempotent;
+    await verifyTicket(state2.cache, receipt, {
+      action: proposal.tool,
+      executionContext: proposal.executionContext,
+      authorizationId: proposal.authorizationId,
+      profileId: proposal.profileId,
+      proposalId: proposal.id,
+      contentHash: binding?.contentHash,
+      contentBinding: binding?.contentBinding
+    });
     await state2.archiveReceipt(receipt, {
       authorizationId: proposal.authorizationId,
       profileId: proposal.profileId,
@@ -2977,6 +3381,13 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       boundContent: binding?.boundContent
     });
   } catch (err) {
+    if (err instanceof AsKeyMismatchError || err instanceof TicketBindingMismatchError) {
+      void notifyControlPlane("as-key-mismatch");
+      return {
+        text: `Proposal ${proposal.id}: blocked \u2014 ${err.message}`,
+        isError: true
+      };
+    }
     if (err instanceof ContentBindingError2) {
       return {
         text: `Proposal ${proposal.id}: blocked \u2014 the approved content cannot be bound to the receipt. ${err.message}`,
@@ -3067,7 +3478,7 @@ Result: ${resultText}` };
 function checkPendingCommitmentsHandler(state2, integrationManager2) {
   return async (args) => {
     if (!state2.spClient.isUnlocked()) {
-      return { content: [{ type: "text", text: lockedNotice("check commitments") }] };
+      return { content: [{ type: "text", text: lockedNotice("check commitments", state2.spClient.getLockReason() ?? "restart") }] };
     }
     try {
       if (args.proposal_id) {
@@ -3136,9 +3547,13 @@ Wait for the human to approve; do not re-submit the tool call.`
           }]
         };
       }
-      const lines = committed.map(
-        (p) => `${p.id}: tool=${p.tool}, status=${p.status}, committed=[${Object.keys(p.committedBy).join(",")}]`
-      );
+      const lines = committed.map((p) => {
+        const base = `${p.id}: tool=${p.tool}, status=${p.status}, committed=[${Object.keys(p.committedBy).join(",")}]`;
+        if (p.status === "committed" && !state2.proposalSubmissions.get(p.id)) {
+          return `${base} \u2014 SKIPPED HERE: ${buildSkippedProposalNote(p.id)}`;
+        }
+        return base;
+      });
       return {
         content: [{
           type: "text",
@@ -3335,16 +3750,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname6, join as join8 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join8(homedir7(), ".suveren");
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync10 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname8, join as join10 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join10(homedir8(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
-  constructor(dataDir) {
-    const dir = dataDir ?? DEFAULT_DATA_DIR;
-    this.filePath = join8(dir, "integrations.json");
+  constructor(dataDir2) {
+    const dir = dataDir2 ?? DEFAULT_DATA_DIR;
+    this.filePath = join10(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -3375,12 +3790,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync8(this.filePath)) {
-      mkdirSync6(dirname6(this.filePath), { recursive: true });
+    if (!existsSync10(this.filePath)) {
+      mkdirSync8(dirname8(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync8(this.filePath, "utf-8");
+      const raw = readFileSync10(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -3409,45 +3824,45 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync6(dirname6(this.filePath), { recursive: true });
-    writeFileSync6(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync8(dirname8(this.filePath), { recursive: true });
+    writeFileSync8(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
-import { homedir as homedir8 } from "os";
-import { join as join10, delimiter } from "path";
-import { existsSync as existsSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync10, rmSync } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join12, delimiter } from "path";
+import { existsSync as existsSync12, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync12, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
-import { join as join9, resolve } from "path";
+import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
+import { join as join11, resolve } from "path";
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join9(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join11(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join9(dir, "index.json");
-  if (!existsSync9(indexPath)) {
+  const indexPath = join11(dir, "index.json");
+  if (!existsSync11(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync9(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync11(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join9(dir, relativePath);
+    const manifestPath = join11(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync9(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync11(manifestPath, "utf-8"));
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -3535,26 +3950,26 @@ function safeHost(url) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join10(homedir8(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join10(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join12(homedir9(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join12(DEFAULT_DATA_DIR2, "integrations");
 var installLock = Promise.resolve();
 function withInstallLock(task) {
   const run = installLock.then(task, task);
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join10(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join12(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync10(INTEGRATIONS_DIR)) {
-    mkdirSync7(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync12(INTEGRATIONS_DIR)) {
+    mkdirSync9(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join10(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync10(pkgPath)) {
-    writeFileSync7(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join12(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync12(pkgPath)) {
+    writeFileSync9(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -3620,19 +4035,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join10(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join10(pkgDir, "package.json");
-    if (!existsSync10(pkgDir) || !existsSync10(pkgJson)) return false;
+    const pkgDir = join12(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join12(pkgDir, "package.json");
+    if (!existsSync12(pkgDir) || !existsSync12(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync10(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync12(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync10(join10(pkgDir, target))) return false;
+        if (!existsSync12(join12(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync10(join10(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync12(join12(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -3646,7 +4061,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync10(join10(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync12(join12(INTEGRATIONS_BIN, c)));
   }
   /**
    * Install an npm package into the managed integrations directory if not
@@ -3670,8 +4085,8 @@ var IntegrationManager = class {
   }
   /** The actual install. Callers MUST hold the install lock. */
   async installNow(npmPackage) {
-    const pkgDir = join10(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync10(pkgDir)) {
+    const pkgDir = join12(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (existsSync12(pkgDir)) {
       console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -3785,6 +4200,11 @@ var IntegrationManager = class {
     const transport = new StdioClientTransport({
       command: config.command,
       args,
+      // `...process.env` is also how a saved `--ca-file` reaches an
+      // integration: NODE_EXTRA_CA_CERTS (read by Node only at process
+      // start) is already set on THIS process by bundle/server.js before
+      // the MCP server ever starts, so every integration this manager spawns
+      // inherits it here for free — no separate handling needed.
       env: {
         ...process.env,
         PATH: buildPath(),
@@ -4101,28 +4521,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
-import { join as join11, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync13, existsSync as existsSync13 } from "fs";
+import { join as join13, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join11(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join11(dir, "index.json");
-  if (!existsSync11(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join13(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join13(dir, "index.json");
+  if (!existsSync13(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync11(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync13(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join11(dir, relativePath);
+    const profilePath = join13(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync11(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync13(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -4158,8 +4578,8 @@ function warnNoProfiles(reason) {
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync12, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join12 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync14, unlinkSync as unlinkSync6, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname9, join as join14 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -4186,8 +4606,8 @@ var CommittedExecutor = class {
 var ExecutorLock = class {
   path;
   held = false;
-  constructor(dataDir) {
-    this.path = join12(dataDir, "executor.lock");
+  constructor(dataDir2) {
+    this.path = join14(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -4195,9 +4615,9 @@ var ExecutorLock = class {
     if (current && current.pid !== process.pid && isAlive(current.pid)) {
       return { held: false, holderPid: current.pid };
     }
-    mkdirSync8(dirname7(this.path), { recursive: true, mode: 448 });
+    mkdirSync10(dirname9(this.path), { recursive: true, mode: 448 });
     const lock = { pid: process.pid, startedAt: Math.floor(Date.now() / 1e3) };
-    writeFileSync8(this.path, JSON.stringify(lock), { mode: 384 });
+    writeFileSync10(this.path, JSON.stringify(lock), { mode: 384 });
     this.held = true;
     return { held: true };
   }
@@ -4213,15 +4633,15 @@ var ExecutorLock = class {
     const current = this.read();
     if (current?.pid === process.pid) {
       try {
-        unlinkSync5(this.path);
+        unlinkSync6(this.path);
       } catch {
       }
     }
   }
   read() {
-    if (!existsSync12(this.path)) return null;
+    if (!existsSync14(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync12(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync14(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -4238,11 +4658,115 @@ function isAlive(pid) {
 }
 
 // bin/http.ts
-import { homedir as homedir9 } from "os";
-import { join as join13 } from "path";
-var spUrl = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
+import { homedir as homedir10 } from "os";
+import { join as join17 } from "path";
+
+// src/lib/as-config.ts
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname10, join as join15 } from "path";
+var DEFAULT_AS_URL = "https://www.suveren.ai";
+function configPath(dataDir2) {
+  return join15(dataDir2, "config.json");
+}
+function readAsConfigStrict(dataDir2) {
+  const path = configPath(dataDir2);
+  if (!existsSync15(path)) return {};
+  let data;
+  try {
+    data = JSON.parse(readFileSync15(path, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const out = {};
+  if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+  if (typeof data.caFile === "string") out.caFile = data.caFile;
+  return out;
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function resolveAsUrl(dataDir2, flag) {
+  if (flag) {
+    const v = validateAsUrl(flag);
+    if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
+    return v.url;
+  }
+  const envUrl = process.env.SUVEREN_AS_URL;
+  if (envUrl) {
+    const v = validateAsUrl(envUrl);
+    if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
+    return v.url;
+  }
+  const saved = readAsConfigStrict(dataDir2).asUrl;
+  if (saved) {
+    const v = validateAsUrl(saved);
+    if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir2}/config.json: ${v.error}`);
+    return v.url;
+  }
+  return DEFAULT_AS_URL;
+}
+
+// src/lib/mcp-as-tracker.ts
+import { existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync16, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11, join as join16 } from "path";
+function trackerPath(dataDir2) {
+  return join16(dataDir2, "mcp-as-pairing.json");
+}
+function readMcpPairedAsUrl(dataDir2) {
+  const path = trackerPath(dataDir2);
+  if (!existsSync16(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync16(path, "utf-8"));
+    return typeof data.asUrl === "string" ? data.asUrl : null;
+  } catch {
+    return null;
+  }
+}
+function writeMcpPairedAsUrl(dataDir2, asUrl) {
+  const path = trackerPath(dataDir2);
+  mkdirSync12(dirname11(path), { recursive: true, mode: 448 });
+  writeFileSync12(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
+}
+
+// bin/http.ts
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+var spUrl = resolveAsUrl(dataDir);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
-var state = new SharedState(spUrl);
+setAsBaseUrl(spUrl);
+var state = new SharedState(spUrl, void 0, dataDir);
+(function repairIfAsUrlChanged() {
+  const lastKnown = readMcpPairedAsUrl(dataDir);
+  if (lastKnown !== null && lastKnown !== spUrl) {
+    console.error(
+      `[Suveren MCP] Authority Server changed (${lastKnown} \u2192 ${spUrl}) \u2014 clearing cached mandates. Sign in again to re-pair.`
+    );
+    state.gateStore.clearAll();
+  }
+  writeMcpPairedAsUrl(dataDir, spUrl);
+})();
 var spApiKey = process.env.SUVEREN_AS_API_KEY ?? "";
 if (spApiKey) {
   state.spClient.setApiKey(spApiKey);
@@ -4312,6 +4836,13 @@ app.post("/internal/configure", internalOnly, (req, res) => {
   }
   res.json({ ok: true });
 });
+app.post("/internal/clear-session", internalOnly, (req, res) => {
+  const reason = req.body?.reason;
+  const validReason = reason === "as-key-mismatch" || reason === "as-url-changed" ? reason : void 0;
+  state.spClient.clearSession(validReason);
+  console.error(`[Suveren MCP] Session cleared by control-plane (${validReason ?? "expired"})`);
+  res.json({ ok: true });
+});
 app.post("/internal/gate-content", internalOnly, async (req, res) => {
   try {
     const { authorizationId, boundsHash, contextHash, context, contextLabels, path: rawPath, gateContent } = req.body;
@@ -4601,6 +5132,15 @@ app.get("/internal/authorizations", internalOnly, (_req, res) => {
 app.get("/internal/manifests", internalOnly, (_req, res) => {
   res.json({ manifests: getAllManifests() });
 });
+app.get("/internal/skipped-commitments", internalOnly, async (_req, res) => {
+  try {
+    const committed = await state.spClient.getCommittedProposals();
+    const skipped = committed.filter((p) => !state.proposalSubmissions.get(p.id)).map((p) => ({ id: p.id, tool: p.tool, note: buildSkippedProposalNote(p.id) }));
+    res.json({ skipped });
+  } catch (err) {
+    res.status(502).json({ error: err instanceof Error ? err.message : "Could not reach the Authority Server" });
+  }
+});
 app.get("/internal/evidence", internalOnly, (_req, res) => {
   if (state.receiptArchive.isLocked()) {
     res.status(503).json({ error: "Vault locked \u2014 the evidence archive is encrypted until sign-in." });
@@ -4734,12 +5274,12 @@ app.listen(port, "0.0.0.0", () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
-  const executorLock = new ExecutorLock(dataDir);
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+  const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {
     console.error(
-      `[Suveren MCP] Committed-proposal execution is DISABLED in this process: pid ${lock.holderPid} holds ${dataDir}/executor.lock. Approved proposals will run there. Stop that gateway if this one should execute.`
+      `[Suveren MCP] Committed-proposal execution is DISABLED in this process: pid ${lock.holderPid} holds ${dataDir2}/executor.lock. Approved proposals will run there. Stop that gateway if this one should execute.`
     );
   }
   for (const sig of ["SIGINT", "SIGTERM", "exit"]) {