@suveren/gateway 0.8.7 → 0.10.0

package/dist/control-plane/index.mjs

@@ -4,9 +4,9 @@ import {
 } from "./chunk-3BNWN6VP.mjs";
 
 // src/index.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync8, renameSync as renameSync2 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
+import { randomBytes as randomBytes3 } from "crypto";
+import { existsSync as existsSync9, readFileSync as readFileSync11, renameSync as renameSync2 } from "fs";
+import { dirname as dirname8, join as join11 } from "path";
 import { homedir as homedir7 } from "os";
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
@@ -110,6 +110,31 @@ var Vault = class {
     this.clearKey();
     this.lockedReason = "expired";
   }
+  /** Lock because the live Authority Server key no longer matches the one
+   *  pinned at pairing — see as-pairing.ts / gatekeeper.ts. Mirrors
+   *  lockExpired() exactly; the only difference callers care about is WHY. */
+  lockAsKeyMismatch() {
+    this.clearKey();
+    this.lockedReason = "as-key-mismatch";
+  }
+  /** Lock because a pin-tls-enforced connection to the Authority Server
+   *  presented a certificate whose public key doesn't match the one pinned
+   *  at pairing — see as-tls-pin.ts. Mirrors lockAsKeyMismatch() exactly. */
+  lockAsTlsMismatch() {
+    this.clearKey();
+    this.lockedReason = "as-tls-mismatch";
+  }
+  /**
+   * Boot-time only: record that the gateway starts locked because the
+   * resolved Authority Server URL differs from the one it was last paired
+   * with. Deliberately does NOT call clearKey() — the vault always boots
+   * locked already (nothing has been unlocked yet in this process), so there
+   * is no session to end; this only attaches the reason so /health and the
+   * locked-agent notice can explain it instead of defaulting to "restart".
+   */
+  markBootLockedAsUrlChanged() {
+    this.lockedReason = "as-url-changed";
+  }
   /** What locked the vault, if known. `null` covers both "still unlocked"
    *  and the default boot-locked case — callers that care about the
    *  difference should check `isUnlocked()` first. */
@@ -300,10 +325,11 @@ async function configure(sessionCookie, vaultKeyHex) {
     clearTimeout(timeout);
   }
 }
-async function unconfigureSession() {
+async function unconfigureSession(reason) {
   const res = await fetch(`${MCP_BASE}/internal/clear-session`, {
     method: "POST",
-    headers: internalHeaders()
+    headers: internalHeaders(),
+    body: JSON.stringify({ reason })
   });
   if (!res.ok) {
     throw new Error(`MCP clear-session failed: ${res.status}`);
@@ -465,6 +491,13 @@ async function getEnrichedAuthorizations() {
   if (!res.ok) throw new Error("Failed to fetch authorizations");
   return res.json();
 }
+async function getSkippedCommitments() {
+  const res = await fetch(`${MCP_BASE}/internal/skipped-commitments`, {
+    headers: internalHeaders()
+  });
+  if (!res.ok) throw new Error("Failed to fetch skipped commitments");
+  return res.json();
+}
 async function getLocalEvidence() {
   const res = await fetch(`${MCP_BASE}/internal/evidence`, {
     headers: internalHeaders()
@@ -634,10 +667,510 @@ function clientVersionHeaders() {
   };
 }
 
+// src/lib/as-pairing.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+function pairingPath(dataDir) {
+  return join3(dataDir, "as-pairing.json");
+}
+function readPairing(dataDir) {
+  const path = pairingPath(dataDir);
+  if (!existsSync2(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync3(path, "utf-8"));
+    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
+    return {
+      asUrl: data.asUrl,
+      publicKeyHex: data.publicKeyHex,
+      pairedAt: data.pairedAt ?? "",
+      ...typeof data.tlsSpkiPinHex === "string" ? { tlsSpkiPinHex: data.tlsSpkiPinHex } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function writePairing(dataDir, asUrl, publicKeyHex, opts = {}) {
+  const pairing = {
+    asUrl,
+    publicKeyHex,
+    pairedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...opts.tlsSpkiPinHex ? { tlsSpkiPinHex: opts.tlsSpkiPinHex } : {}
+  };
+  const path = pairingPath(dataDir);
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  writeFileSync2(path, JSON.stringify(pairing, null, 2), { encoding: "utf-8", mode: 384 });
+  return pairing;
+}
+function recordTlsPin(dataDir, asUrl, tlsSpkiPinHex) {
+  const existing = readPairing(dataDir);
+  if (!existing || existing.asUrl !== asUrl) return;
+  const path = pairingPath(dataDir);
+  writeFileSync2(
+    path,
+    JSON.stringify({ ...existing, tlsSpkiPinHex }, null, 2),
+    { encoding: "utf-8", mode: 384 }
+  );
+}
+function clearPairing(dataDir) {
+  const path = pairingPath(dataDir);
+  try {
+    if (existsSync2(path)) unlinkSync(path);
+  } catch {
+  }
+}
+function fingerprintOf(publicKeyHex) {
+  const raw = Buffer.from(publicKeyHex, "hex");
+  const digest = createHash2("sha256").update(raw).digest("hex").toUpperCase();
+  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
+}
+
+// src/lib/as-challenge.ts
+import { createPublicKey, randomBytes as randomBytes2, verify as cryptoVerify } from "crypto";
+import { canonicalize } from "@hap/core";
+
+// src/lib/as-tls-pin.ts
+import { createHash as createHash3 } from "crypto";
+import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
+import { Agent as HttpsAgent } from "https";
+import { readFileSync as readFileSync4 } from "fs";
+import { Agent, fetch as undiciFetch } from "undici";
+function effectiveCa() {
+  const path = process.env.NODE_EXTRA_CA_CERTS;
+  if (!path) return void 0;
+  try {
+    return [...rootCertificates, readFileSync4(path, "utf-8")];
+  } catch {
+    return void 0;
+  }
+}
+var PIN_CHECK_ERROR_CODE = "EAS_TLS_PIN_CHECK";
+function taggedCheckError(err) {
+  err.code = PIN_CHECK_ERROR_CODE;
+  return err;
+}
+function isPinCheckError(err) {
+  let cur = err;
+  for (let i = 0; i < 5 && cur; i++) {
+    if (cur instanceof Error && cur.code === PIN_CHECK_ERROR_CODE) return true;
+    cur = cur instanceof Error ? cur.cause : void 0;
+  }
+  return false;
+}
+var AsTlsMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsTlsMismatchError";
+  }
+};
+function spkiSha256Hex(cert) {
+  if (!cert.pubkey) {
+    throw new Error("peer certificate carries no pubkey (expected the detailed certificate object)");
+  }
+  return createHash3("sha256").update(cert.pubkey).digest("hex");
+}
+function formatPinFingerprint(hex) {
+  const upper = hex.toUpperCase();
+  return upper.match(/.{1,4}/g)?.join(":") ?? upper;
+}
+function pinnedCheckServerIdentity(pinnedSpkiHex) {
+  const wantHex = pinnedSpkiHex.toLowerCase();
+  return (hostname, cert) => {
+    const defaultErr = defaultCheckServerIdentity(hostname, cert);
+    if (defaultErr) return taggedCheckError(defaultErr);
+    let actualHex;
+    try {
+      actualHex = spkiSha256Hex(cert);
+    } catch (err) {
+      return taggedCheckError(new Error(
+        `could not read the server certificate's public key to check the TLS pin \u2014 ${err instanceof Error ? err.message : String(err)}`
+      ));
+    }
+    if (actualHex !== wantHex) {
+      return taggedCheckError(new Error(
+        `TLS certificate pin mismatch for ${hostname}: expected SPKI sha256 ${formatPinFingerprint(wantHex)}, got ${formatPinFingerprint(actualHex)}.`
+      ));
+    }
+    return void 0;
+  };
+}
+function buildPinnedDispatcher(pinnedSpkiHex) {
+  return new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
+    }
+  });
+}
+function buildCapturingDispatcher() {
+  let captured;
+  const dispatcher = new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: (hostname, cert) => {
+        captured = cert;
+        const defaultErr = defaultCheckServerIdentity(hostname, cert);
+        return defaultErr ? taggedCheckError(defaultErr) : void 0;
+      }
+    }
+  });
+  return { dispatcher, getCapturedCert: () => captured };
+}
+function buildPinnedHttpsAgent(getPinning) {
+  return new HttpsAgent({
+    checkServerIdentity: (hostname, cert) => {
+      const pinning = getPinning();
+      if (!pinning.enforce) return defaultCheckServerIdentity(hostname, cert);
+      if (!pinning.pinnedSpkiHex) {
+        return taggedCheckError(new Error(
+          `pin-tls is on but no certificate is pinned yet for ${hostname} \u2014 sign in again to establish it (re-pairing required).`
+        ));
+      }
+      return pinnedCheckServerIdentity(pinning.pinnedSpkiHex)(hostname, cert);
+    },
+    ca: effectiveCa()
+  });
+}
+async function fetchAs(url, init, pinning) {
+  if (!pinning.enforce && !pinning.capture) {
+    const res2 = await fetch(url, init);
+    return { res: res2 };
+  }
+  if (pinning.enforce && !pinning.capture && !pinning.pinnedSpkiHex) {
+    throw new AsTlsMismatchError(
+      `pin-tls is on but no certificate is pinned yet for ${url} \u2014 sign in again to establish it (re-pairing required).`
+    );
+  }
+  if (pinning.pinnedSpkiHex && (pinning.enforce || !pinning.capture)) {
+    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex);
+    try {
+      const res2 = await undiciFetch(url, { ...init, dispatcher: dispatcher2 });
+      return { res: res2 };
+    } catch (err) {
+      if (!isPinCheckError(err)) throw err;
+      throw new AsTlsMismatchError(
+        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. If the Authority Server's certificate changed intentionally (a new key, not just renewal), an operator must clear the pairing and sign in again to re-pin it.`
+      );
+    }
+  }
+  const { dispatcher, getCapturedCert } = buildCapturingDispatcher();
+  let res;
+  try {
+    res = await undiciFetch(url, { ...init, dispatcher });
+  } catch (err) {
+    if (!isPinCheckError(err)) throw err;
+    throw new AsTlsMismatchError(
+      `could not verify the Authority Server at ${url} while establishing its TLS pin \u2014 ${describeFetchError(err)}.`
+    );
+  }
+  const cert = getCapturedCert();
+  return { res, capturedSpkiHex: cert ? spkiSha256Hex(cert) : void 0 };
+}
+function describeFetchError(err) {
+  if (err instanceof Error) {
+    const cause = err.cause;
+    if (cause instanceof Error) return cause.message;
+    return err.message;
+  }
+  return String(err);
+}
+
+// src/lib/as-challenge.ts
+var AsChallengeUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsChallengeUnreachableError";
+  }
+};
+var AsChallengeInvalidError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsChallengeInvalidError";
+  }
+};
+var CHALLENGE_MAX_SKEW_SECONDS = 300;
+var CHALLENGE_TYPE = "hap-as-challenge";
+var CHALLENGE_DOMAIN_PREFIX = "hap-as-challenge\0";
+function challengeSigningBytes(unsigned) {
+  return Buffer.concat([
+    Buffer.from(CHALLENGE_DOMAIN_PREFIX, "utf-8"),
+    Buffer.from(canonicalize({ typ: unsigned.typ, nonce: unsigned.nonce, issuedAt: unsigned.issuedAt }), "utf-8")
+  ]);
+}
+function publicKeyFromHex(publicKeyHex) {
+  const raw = Buffer.from(publicKeyHex, "hex");
+  return createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") }, format: "jwk" });
+}
+function verifyChallengeSignature(publicKeyHex, unsigned, signature) {
+  try {
+    const base64 = signature.replace(/-/g, "+").replace(/_/g, "/");
+    const padding = base64.length % 4 === 0 ? "" : "=".repeat(4 - base64.length % 4);
+    const sigBytes = Buffer.from(base64 + padding, "base64");
+    const key = publicKeyFromHex(publicKeyHex);
+    return cryptoVerify(null, challengeSigningBytes(unsigned), key, sigBytes);
+  } catch {
+    return false;
+  }
+}
+async function verifyAsHoldsKey(asUrl, publicKeyHex, pinning = { enforce: false, capture: true }) {
+  const nonce = randomBytes2(32).toString("base64url");
+  let res;
+  let capturedSpkiHex;
+  try {
+    const result = await fetchAs(
+      `${asUrl}/api/as/challenge`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ nonce }),
+        signal: AbortSignal.timeout(5e3)
+      },
+      pinning
+    );
+    res = result.res;
+    capturedSpkiHex = result.capturedSpkiHex;
+  } catch (err) {
+    if (err instanceof AsTlsMismatchError) throw err;
+    throw new AsChallengeUnreachableError(
+      `could not reach the Authority Server at ${asUrl} to verify it holds its signing key \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!res.ok) {
+    throw new AsChallengeUnreachableError(
+      `the Authority Server at ${asUrl} answered its signing-key challenge with HTTP ${res.status}`
+    );
+  }
+  const body = await res.json().catch(() => null);
+  if (!body) {
+    throw new AsChallengeUnreachableError(
+      `the Authority Server at ${asUrl} returned a malformed response to its signing-key challenge`
+    );
+  }
+  if (body.typ !== CHALLENGE_TYPE) {
+    throw new AsChallengeInvalidError(
+      `the challenge response carries the wrong type ("${String(body.typ)}", expected "${CHALLENGE_TYPE}")`
+    );
+  }
+  if (body.nonce !== nonce) {
+    throw new AsChallengeInvalidError(
+      "the challenge response echoes a different nonce than the one sent"
+    );
+  }
+  if (typeof body.issuedAt !== "number" || !Number.isFinite(body.issuedAt)) {
+    throw new AsChallengeInvalidError("the challenge response carries no valid issuedAt");
+  }
+  const skew = Math.abs(Math.floor(Date.now() / 1e3) - body.issuedAt);
+  if (skew > CHALLENGE_MAX_SKEW_SECONDS) {
+    throw new AsChallengeInvalidError(
+      `the challenge response is timestamped ${skew}s away from now, beyond the ${CHALLENGE_MAX_SKEW_SECONDS}s tolerance`
+    );
+  }
+  if (typeof body.signature !== "string" || !body.signature) {
+    throw new AsChallengeInvalidError("the challenge response carries no signature");
+  }
+  if (!verifyChallengeSignature(publicKeyHex, { typ: body.typ, nonce: body.nonce, issuedAt: body.issuedAt }, body.signature)) {
+    throw new AsChallengeInvalidError(
+      "the challenge signature does not verify under the key being checked \u2014 this is exactly what the challenge exists to catch: something answered the request but does not hold the matching private key."
+    );
+  }
+  return { capturedTlsSpkiHex: capturedSpkiHex };
+}
+
+// src/lib/as-config.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+var DEFAULT_AS_URL = "https://www.suveren.ai";
+function configPath(dataDir) {
+  return join4(dataDir, "config.json");
+}
+function readAsConfigStrict(dataDir) {
+  const path = configPath(dataDir);
+  if (!existsSync3(path)) return {};
+  let data;
+  try {
+    data = JSON.parse(readFileSync5(path, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const out = {};
+  if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+  if (typeof data.caFile === "string") out.caFile = data.caFile;
+  if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+  if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+  return out;
+}
+function readAsConfig(dataDir) {
+  const path = configPath(dataDir);
+  if (!existsSync3(path)) return {};
+  try {
+    const data = JSON.parse(readFileSync5(path, "utf-8"));
+    const out = {};
+    if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+    if (typeof data.caFile === "string") out.caFile = data.caFile;
+    if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+    if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+    return out;
+  } catch {
+    return {};
+  }
+}
+function writeAsConfig(dataDir, patch) {
+  const merged = { ...readAsConfig(dataDir), ...patch };
+  const path = configPath(dataDir);
+  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  writeFileSync3(path, JSON.stringify(merged, null, 2), { encoding: "utf-8", mode: 384 });
+  return merged;
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function resolveAsUrl(dataDir, flag) {
+  if (flag) {
+    const v = validateAsUrl(flag);
+    if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
+    return v.url;
+  }
+  const envUrl = process.env.SUVEREN_AS_URL;
+  if (envUrl) {
+    const v = validateAsUrl(envUrl);
+    if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
+    return v.url;
+  }
+  const saved = readAsConfigStrict(dataDir).asUrl;
+  if (saved) {
+    const v = validateAsUrl(saved);
+    if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir}/config.json: ${v.error}`);
+    return v.url;
+  }
+  return DEFAULT_AS_URL;
+}
+function resolvePinTls(dataDir) {
+  return readAsConfig(dataDir).pinTls === true;
+}
+function validatePinTlsForUrl(pinTls, asUrl) {
+  if (!pinTls) return;
+  if (!asUrl.startsWith("https:")) {
+    throw new Error(
+      `config.json sets "pinTls": true, but the Authority Server URL (${asUrl}) is not https:// \u2014 there is no TLS certificate to pin. Fix the saved as-url, or turn pin-tls off: \`suveren-gateway config set pin-tls off\`.`
+    );
+  }
+}
+function resolvePinTlsExpectedFingerprint(dataDir) {
+  return readAsConfig(dataDir).pinTlsExpectedFingerprint;
+}
+function clearPinTlsExpectedFingerprint(dataDir) {
+  if (readAsConfig(dataDir).pinTlsExpectedFingerprint === void 0) return;
+  writeAsConfig(dataDir, { pinTlsExpectedFingerprint: void 0 });
+}
+
 // src/routes/auth.ts
-var SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
-function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished) {
+var DEFAULT_SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
+async function fetchAsPublicKey(asUrl) {
+  try {
+    const res = await fetch(`${asUrl}/api/as/pubkey`, { signal: AbortSignal.timeout(5e3) });
+    if (!res.ok) {
+      return {
+        ok: false,
+        message: `Could not reach the Authority Server at ${asUrl} to read its signing key (HTTP ${res.status}). Refusing to sign in.`
+      };
+    }
+    const body = await res.json().catch(() => null);
+    if (!body || typeof body.publicKey !== "string" || !body.publicKey) {
+      return {
+        ok: false,
+        message: `The Authority Server at ${asUrl} returned a malformed signing key. Refusing to sign in.`
+      };
+    }
+    return { ok: true, publicKeyHex: body.publicKey };
+  } catch (err) {
+    return {
+      ok: false,
+      message: `Could not reach the Authority Server at ${asUrl} to read its signing key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
+    };
+  }
+}
+async function checkAsKeyBeforeLogin(asUrl, dataDir) {
+  const existing = readPairing(dataDir);
+  const pinnedKey = existing && existing.asUrl === asUrl ? existing.publicKeyHex : void 0;
+  const existingTlsPin = (existing && existing.asUrl === asUrl ? existing.tlsSpkiPinHex : void 0) ?? resolvePinTlsExpectedFingerprint(dataDir);
+  let candidateKey;
+  if (pinnedKey) {
+    candidateKey = pinnedKey;
+  } else {
+    const fetched = await fetchAsPublicKey(asUrl);
+    if (!fetched.ok) {
+      return { ok: false, error: "as_unreachable", message: fetched.message };
+    }
+    candidateKey = fetched.publicKeyHex;
+  }
+  const pinning = {
+    enforce: resolvePinTls(dataDir),
+    pinnedSpkiHex: existingTlsPin,
+    capture: true
+  };
+  let capturedTlsSpkiHex;
+  try {
+    const result = await verifyAsHoldsKey(asUrl, candidateKey, pinning);
+    capturedTlsSpkiHex = result.capturedTlsSpkiHex;
+  } catch (err) {
+    if (err instanceof AsTlsMismatchError) {
+      return { ok: false, error: "as_tls_mismatch", message: err.message };
+    }
+    if (err instanceof AsChallengeUnreachableError) {
+      return { ok: false, error: "as_unverified", message: `${err.message}. Refusing to sign in.` };
+    }
+    if (err instanceof AsChallengeInvalidError) {
+      if (pinnedKey) {
+        return {
+          ok: false,
+          error: "as_key_mismatch",
+          message: `The Authority Server at ${asUrl} does not match the one pinned when this gateway last signed in (pinned fingerprint ${fingerprintOf(pinnedKey)}) \u2014 its signing-key challenge did not verify (${err.message}). Refusing to sign in. If the AS's key changed intentionally, an operator must clear the old pairing before signing in again.`
+        };
+      }
+      return {
+        ok: false,
+        error: "as_unverified",
+        message: `The Authority Server at ${asUrl} could not prove it holds the signing key it presented \u2014 ${err.message}. Refusing to sign in.`
+      };
+    }
+    throw err;
+  }
+  return {
+    ok: true,
+    publicKeyHex: candidateKey,
+    // A fresh capture (always present for https, unless pin-tls is on and
+    // an existing pin was enforced instead — see fetchAs) wins; otherwise
+    // whatever was already on file carries through unchanged.
+    tlsSpkiPinHex: capturedTlsSpkiHex ?? existingTlsPin
+  };
+}
+function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished, pairing, lockAsTlsMismatch2 = () => {
+}) {
   const router = Router();
+  const SP_URL2 = pairing?.asUrl ?? DEFAULT_SP_URL;
   router.post("/login", loginRateLimit2, async (req, res) => {
     const apiKey = req.headers["x-api-key"] || req.body?.apiKey;
     const confirmWipe = req.body?.confirmWipe === true;
@@ -646,22 +1179,65 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
       return;
     }
     try {
-      const spRes = await fetch(`${SP_URL}/api/auth/session`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "X-API-Key": apiKey,
-          // The AS grants a 30-day gateway session ONLY to a login that
-          // identifies itself this way; without it, a 24-hour browser
-          // session (see doc at the top of this file).
-          ...clientVersionHeaders()
+      let keyCheck = null;
+      if (pairing) {
+        keyCheck = await checkAsKeyBeforeLogin(pairing.asUrl, pairing.dataDir);
+        if (!keyCheck.ok) {
+          const status = keyCheck.error === "as_key_mismatch" || keyCheck.error === "as_tls_mismatch" ? 409 : 502;
+          res.status(status).json({
+            error: keyCheck.error,
+            message: keyCheck.message
+          });
+          return;
         }
-      });
+      }
+      const sessionPinning = {
+        enforce: Boolean(pairing && resolvePinTls(pairing.dataDir)),
+        pinnedSpkiHex: keyCheck?.tlsSpkiPinHex
+      };
+      let spRes;
+      try {
+        const result = await fetchAs(
+          `${SP_URL2}/api/auth/session`,
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "X-API-Key": apiKey,
+              // The AS grants a 30-day gateway session ONLY to a login that
+              // identifies itself this way; without it, a 24-hour browser
+              // session (see doc at the top of this file).
+              ...clientVersionHeaders()
+            }
+          },
+          sessionPinning
+        );
+        spRes = result.res;
+      } catch (err) {
+        if (err instanceof AsTlsMismatchError) {
+          res.status(409).json({ error: "as_tls_mismatch", message: err.message });
+          return;
+        }
+        throw err;
+      }
       if (!spRes.ok) {
         const err = await spRes.json().catch(() => ({ error: "Invalid API key" }));
         res.status(spRes.status).json(err);
         return;
       }
+      if (pairing && keyCheck?.publicKeyHex) {
+        const existing = readPairing(pairing.dataDir);
+        if (!existing || existing.asUrl !== pairing.asUrl) {
+          writePairing(pairing.dataDir, pairing.asUrl, keyCheck.publicKeyHex, {
+            tlsSpkiPinHex: keyCheck.tlsSpkiPinHex
+          });
+          console.error(`[Control Plane] Paired with Authority Server ${pairing.asUrl} (fingerprint ${fingerprintOf(keyCheck.publicKeyHex)})`);
+        } else if (keyCheck.tlsSpkiPinHex && keyCheck.tlsSpkiPinHex !== existing.tlsSpkiPinHex) {
+          recordTlsPin(pairing.dataDir, pairing.asUrl, keyCheck.tlsSpkiPinHex);
+          console.error(`[Control Plane] TLS pin for Authority Server ${pairing.asUrl} captured/updated.`);
+        }
+        clearPinTlsExpectedFingerprint(pairing.dataDir);
+      }
       const data = await spRes.json();
       const setCookieHeaders = spRes.headers.getSetCookie?.() ?? [];
       const sessionCookie = setCookieHeaders.join("; ");
@@ -708,10 +1284,11 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
           const kp = await loadOrGenerateKeyPair(vault2);
           const localPubkeyB64 = Buffer.from(kp.publicKey).toString("base64");
           const spCookie = vault2.getSpCookie();
-          const meKeyRes = await fetch(`${SP_URL}/api/users/me/pubkey`, {
-            headers: spCookie ? { Cookie: spCookie } : {},
-            signal: AbortSignal.timeout(5e3)
-          });
+          const { res: meKeyRes } = await fetchAs(
+            `${SP_URL2}/api/users/me/pubkey`,
+            { headers: spCookie ? { Cookie: spCookie } : {}, signal: AbortSignal.timeout(5e3) },
+            sessionPinning
+          );
           let needsUpdate = false;
           if (meKeyRes.status === 404) {
             needsUpdate = true;
@@ -720,15 +1297,19 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
             needsUpdate = meKeyData.pubkey !== localPubkeyB64;
           }
           if (needsUpdate) {
-            const putRes = await fetch(`${SP_URL}/api/users/me/pubkey`, {
-              method: "PUT",
-              headers: {
-                "Content-Type": "application/json",
-                ...spCookie ? { Cookie: spCookie } : {}
+            const { res: putRes } = await fetchAs(
+              `${SP_URL2}/api/users/me/pubkey`,
+              {
+                method: "PUT",
+                headers: {
+                  "Content-Type": "application/json",
+                  ...spCookie ? { Cookie: spCookie } : {}
+                },
+                body: JSON.stringify({ pubkey: localPubkeyB64 }),
+                signal: AbortSignal.timeout(5e3)
               },
-              body: JSON.stringify({ pubkey: localPubkeyB64 }),
-              signal: AbortSignal.timeout(5e3)
-            });
+              sessionPinning
+            );
             if (!putRes.ok) {
               console.error(`[Control Plane] E2EE pubkey registration failed: ${putRes.status}`);
             } else {
@@ -738,7 +1319,12 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
             console.error("[Control Plane] E2EE pubkey already up to date");
           }
         } catch (err) {
-          console.error("[Control Plane] E2EE pubkey auto-register failed:", err);
+          if (err instanceof AsTlsMismatchError) {
+            console.error("[Control Plane] E2EE pubkey auto-register aborted \u2014 TLS pin mismatch:", err.message);
+            lockAsTlsMismatch2();
+          } else {
+            console.error("[Control Plane] E2EE pubkey auto-register failed:", err);
+          }
         }
         for (const credId of vault2.listCredentials()) {
           try {
@@ -775,12 +1361,20 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
   router.post("/logout", logoutAuth, async (_req, res) => {
     const cookie = vault2.getSpCookie();
     vault2.clearKey();
+    const logoutPinning = pairing ? { enforce: resolvePinTls(pairing.dataDir), pinnedSpkiHex: readPairing(pairing.dataDir)?.tlsSpkiPinHex } : { enforce: false };
     await Promise.allSettled([
       unconfigureSession(),
-      cookie ? fetch(`${SP_URL}/api/auth/logout`, {
-        method: "POST",
-        headers: { cookie, ...clientVersionHeaders() },
-        redirect: "manual"
+      cookie ? fetchAs(
+        `${SP_URL2}/api/auth/logout`,
+        { method: "POST", headers: { cookie, ...clientVersionHeaders() }, redirect: "manual" },
+        logoutPinning
+      ).catch((err) => {
+        if (err instanceof AsTlsMismatchError) {
+          console.error("[Control Plane] Logout: TLS pin mismatch talking to the Authority Server \u2014 local sign-out still applied:", err.message);
+          lockAsTlsMismatch2();
+        } else {
+          throw err;
+        }
       }) : Promise.resolve()
     ]);
     res.json({ ok: true });
@@ -1392,18 +1986,18 @@ async function testAIConnectivity(config) {
 }
 
 // src/lib/agent-brief-store.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { join as join5 } from "path";
 var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
 function agentBriefPath() {
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join3(homedir2(), ".suveren");
-  return join3(dataDir, "context.md");
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
+  return join5(dataDir, "context.md");
 }
 function readAgentBrief() {
   const filePath = agentBriefPath();
-  if (!existsSync2(filePath)) return "";
-  return readFileSync3(filePath, "utf-8");
+  if (!existsSync4(filePath)) return "";
+  return readFileSync6(filePath, "utf-8");
 }
 
 // src/routes/ai.ts
@@ -1767,28 +2361,28 @@ function createMCPRouter() {
 // src/routes/autostart.ts
 import { Router as Router6 } from "express";
 import { execFile } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { dirname as pathDirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
 var run = promisify(execFile);
 var SUPPORTED = /* @__PURE__ */ new Set(["darwin", "win32", "linux"]);
 var MODULE_DIR = pathDirname(fileURLToPath(import.meta.url));
-function findCli(dirname7 = MODULE_DIR) {
+function findCli(dirname9 = MODULE_DIR) {
   const candidates = [
     // Bundled (the shipped layout): dist/control-plane → dist → root → bin
-    resolve(dirname7, "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname9, "..", "..", "bin", "suveren-gateway.js"),
     // Bundled, were the routes/ directory ever preserved.
-    resolve(dirname7, "..", "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname9, "..", "..", "..", "bin", "suveren-gateway.js"),
     // Dev, running from source: the repo's own bundle directory.
-    resolve(dirname7, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
-    resolve(dirname7, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
+    resolve(dirname9, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
+    resolve(dirname9, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
     // Deliberately NO process.cwd() fallback: it makes the result depend on
     // where the process happened to be launched from, so the same install
     // resolves differently between a shell and a login service — and it would
     // mask a genuinely missing CLI whenever the cwd happened to be the repo.
   ];
-  return candidates.find(existsSync3) ?? null;
+  return candidates.find(existsSync5) ?? null;
 }
 async function cli(args) {
   const bin = findCli();
@@ -1869,17 +2463,17 @@ function createAutostartRouter() {
 import { spawn, spawnSync } from "child_process";
 
 // src/lib/notifier-icon.ts
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync6 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join4, dirname as dirname2 } from "path";
+import { join as join6, dirname as dirname4 } from "path";
 var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
 function ensureNotifierIcon(dataDir) {
   try {
-    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join4(homedir3(), ".suveren");
-    const path = join4(dir, "notifier-icon.png");
-    if (!existsSync4(path)) {
-      mkdirSync2(dirname2(path), { recursive: true });
-      writeFileSync2(path, Buffer.from(ICON_BASE64, "base64"));
+    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
+    const path = join6(dir, "notifier-icon.png");
+    if (!existsSync6(path)) {
+      mkdirSync4(dirname4(path), { recursive: true });
+      writeFileSync4(path, Buffer.from(ICON_BASE64, "base64"));
     }
     return path;
   } catch {
@@ -2081,24 +2675,24 @@ import { Router as Router9 } from "express";
 
 // src/routes/approved-intents.ts
 import { Router as Router8 } from "express";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync7, mkdirSync as mkdirSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
-var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join5(homedir4(), ".suveren");
-var FILE_PATH = join5(SUVEREN_DATA_DIR, "approved-intents.enc.json");
+import { join as join7 } from "path";
+var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
+var FILE_PATH = join7(SUVEREN_DATA_DIR, "approved-intents.enc.json");
 function readFile() {
-  if (!existsSync5(FILE_PATH)) {
+  if (!existsSync7(FILE_PATH)) {
     return { version: 1, entries: {} };
   }
   try {
-    return JSON.parse(readFileSync4(FILE_PATH, "utf-8"));
+    return JSON.parse(readFileSync7(FILE_PATH, "utf-8"));
   } catch {
     return { version: 1, entries: {} };
   }
 }
 function writeFile(data) {
-  mkdirSync3(SUVEREN_DATA_DIR, { recursive: true });
-  writeFileSync3(FILE_PATH, JSON.stringify(data, null, 2), "utf-8");
+  mkdirSync5(SUVEREN_DATA_DIR, { recursive: true });
+  writeFileSync5(FILE_PATH, JSON.stringify(data, null, 2), "utf-8");
 }
 function readApprovedIntents(vault2) {
   const file = readFile();
@@ -2147,7 +2741,7 @@ function createApprovedIntentsRouter(vault2) {
 
 // src/routes/evidence-export.ts
 var AS_FETCH_TIMEOUT_MS = 2e4;
-function createEvidenceExportRouter(spUrl, vault2) {
+function createEvidenceExportRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2) {
   const router = Router9();
   const getSpCookie = () => vault2.getSpCookie();
   router.get("/", async (_req, res) => {
@@ -2167,17 +2761,29 @@ function createEvidenceExportRouter(spUrl, vault2) {
       const controller = new AbortController();
       const timeout = setTimeout(() => controller.abort(), AS_FETCH_TIMEOUT_MS);
       try {
-        const asRes = await fetch(`${spUrl}/api/receipts/export`, {
-          headers: { Cookie: cookie },
-          signal: controller.signal
-        });
+        const pin = readPairing(dataDir);
+        const { res: asRes } = await fetchAs(
+          `${spUrl}/api/receipts/export`,
+          { headers: { Cookie: cookie }, signal: controller.signal },
+          {
+            enforce: resolvePinTls(dataDir),
+            pinnedSpkiHex: pin && pin.asUrl === spUrl ? pin.tlsSpkiPinHex : void 0
+            // Never capture here — only the sign-in challenge establishes or
+            // refreshes a pin (as-challenge.ts).
+          }
+        );
         if (asRes.ok) {
           authorityServer = await asRes.json();
         } else {
           asError = `Authority Server export failed: ${asRes.status}`;
         }
       } catch (err) {
-        asError = `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}`;
+        if (err instanceof AsTlsMismatchError) {
+          lockAsTlsMismatch2();
+          asError = err.message;
+        } else {
+          asError = `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}`;
+        }
       } finally {
         clearTimeout(timeout);
       }
@@ -2363,7 +2969,7 @@ function createDecryptIntentRouter(vault2) {
 
 // src/lib/update-checker.ts
 import { execSync } from "child_process";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var GHCR_IMAGE = "suverenai/suveren-gateway";
 var NPM_PACKAGE = "@suveren/gateway";
@@ -2429,7 +3035,7 @@ function compareSemver(a, b) {
   return 0;
 }
 function checkDev() {
-  const cwd = dirname3(fileURLToPath2(import.meta.url));
+  const cwd = dirname5(fileURLToPath2(import.meta.url));
   try {
     execSync("git fetch origin --quiet", { cwd, stdio: "ignore", timeout: 15e3 });
     const out = execSync("git rev-list HEAD..origin/main --count", {
@@ -2502,19 +3108,19 @@ data: ${data}
 import { Router as Router12 } from "express";
 
 // src/lib/gateway-settings.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join6, dirname as dirname4 } from "path";
+import { join as join8, dirname as dirname6 } from "path";
 var DEFAULT_SETTINGS = {
   desktopNotifications: true
 };
 function settingsPath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
-  return join6(dir, "settings.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
+  return join8(dir, "settings.json");
 }
 function readSettings(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync5(settingsPath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync8(settingsPath(dataDir), "utf8"));
     return {
       desktopNotifications: typeof raw.desktopNotifications === "boolean" ? raw.desktopNotifications : DEFAULT_SETTINGS.desktopNotifications
     };
@@ -2528,8 +3134,8 @@ function writeSettings(patch, dataDir) {
     ...typeof patch.desktopNotifications === "boolean" ? { desktopNotifications: patch.desktopNotifications } : {}
   };
   const path = settingsPath(dataDir);
-  mkdirSync4(dirname4(path), { recursive: true });
-  writeFileSync4(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+  mkdirSync6(dirname6(path), { recursive: true });
+  writeFileSync6(path, JSON.stringify(next, null, 2) + "\n", "utf8");
   return next;
 }
 
@@ -2561,20 +3167,20 @@ function createGatewaySettingsRouter() {
 import { Router as Router13 } from "express";
 
 // src/lib/archived-mandates-store.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, renameSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join7, dirname as dirname5 } from "path";
+import { join as join9, dirname as dirname7 } from "path";
 var ID_PATTERN = /^[A-Za-z0-9_.:-]{1,200}$/;
 function isValidMandateId(id) {
   return typeof id === "string" && ID_PATTERN.test(id);
 }
 function storePath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
-  return join7(dir, "archived-mandates.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
+  return join9(dir, "archived-mandates.json");
 }
 function readArchived(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync6(storePath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync9(storePath(dataDir), "utf8"));
     if (!Array.isArray(raw.archived)) return [];
     return [...new Set(raw.archived.filter(isValidMandateId))];
   } catch {
@@ -2584,9 +3190,9 @@ function readArchived(dataDir) {
 function writeArchived(ids, dataDir) {
   const next = [...new Set(ids.filter(isValidMandateId))].sort();
   const path = storePath(dataDir);
-  mkdirSync5(dirname5(path), { recursive: true });
+  mkdirSync7(dirname7(path), { recursive: true });
   const tmp = `${path}.tmp`;
-  writeFileSync5(tmp, JSON.stringify({ archived: next }, null, 2) + "\n", "utf8");
+  writeFileSync7(tmp, JSON.stringify({ archived: next }, null, 2) + "\n", "utf8");
   renameSync(tmp, path);
   return next;
 }
@@ -2627,6 +3233,8 @@ import { Router as Router14 } from "express";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 var SESSION_EXPIRED = "session-expired";
+var AS_KEY_MISMATCH = "as-key-mismatch";
+var AS_TLS_MISMATCH = "as-tls-mismatch";
 function secretMatches(provided, expected) {
   if (!expected) return false;
   if (!provided) return false;
@@ -2635,7 +3243,7 @@ function secretMatches(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual2(a, b);
 }
-function createInternalEventsRouter(getSecret, onSessionExpired) {
+function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch, onAsTlsMismatch) {
   const router = Router14();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
@@ -2648,6 +3256,16 @@ function createInternalEventsRouter(getSecret, onSessionExpired) {
       res.json({ ok: true });
       return;
     }
+    if (type === AS_KEY_MISMATCH) {
+      onAsKeyMismatch?.();
+      res.json({ ok: true });
+      return;
+    }
+    if (type === AS_TLS_MISMATCH) {
+      onAsTlsMismatch?.();
+      res.json({ ok: true });
+      return;
+    }
     if (typeof type !== "string" || !ALLOWED.includes(type)) {
       res.status(400).json({ error: "Unsupported event type" });
       return;
@@ -2746,6 +3364,8 @@ function startNotificationDispatcher(opts = {}) {
 
 // src/lib/session-lock.ts
 var SESSION_LOCKED_MESSAGE = "Your sign-in ended after 30 days or was revoked. Sign in again.";
+var AS_KEY_MISMATCH_MESSAGE = "The Authority Server presented a signing key that does not match the one pinned at pairing. Sign in again to review.";
+var AS_TLS_MISMATCH_MESSAGE = "A connection to the Authority Server presented a TLS certificate that does not match the one pinned at pairing. The connection was refused before anything was sent. If the certificate changed intentionally (a new key, not just renewal), clear the pairing and sign in again to re-pin it.";
 function createSessionLock(deps) {
   const { vault: vault2, port: port2 } = deps;
   const notifyFn = deps.notifyFn ?? notify;
@@ -2763,6 +3383,40 @@ function createSessionLock(deps) {
     notifyFn(title, message, process.platform, url);
   };
 }
+function createAsKeyMismatchLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnAsKeyMismatch() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockAsKeyMismatch();
+    console.error("[Control Plane] Authority Server key mismatch \u2014 gateway LOCKED");
+    void unconfigureSessionFn("as-key-mismatch").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "as-key-mismatch", message: AS_KEY_MISMATCH_MESSAGE });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, AS_KEY_MISMATCH_MESSAGE, process.platform, url);
+  };
+}
+function createAsTlsMismatchLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnAsTlsMismatch() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockAsTlsMismatch();
+    console.error("[Control Plane] Authority Server TLS pin mismatch \u2014 gateway LOCKED");
+    void unconfigureSessionFn("as-tls-mismatch").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "as-tls-mismatch", message: AS_TLS_MISMATCH_MESSAGE });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, AS_TLS_MISMATCH_MESSAGE, process.platform, url);
+  };
+}
 
 // src/lib/session-expiry-scheduler.ts
 var MAX_TIMEOUT_MS = 2147483647;
@@ -2832,17 +3486,17 @@ function buildSessionHealth(vault2) {
 }
 
 // src/lib/denials-reader.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
+import { join as join10 } from "path";
 function loadDenials(dataDir, decrypt) {
-  const encPath = join8(dataDir, "denials.enc.json");
-  const plainPath = join8(dataDir, "denials.json");
-  if (existsSync6(encPath)) {
-    const { blob } = JSON.parse(readFileSync7(encPath, "utf-8"));
+  const encPath = join10(dataDir, "denials.enc.json");
+  const plainPath = join10(dataDir, "denials.json");
+  if (existsSync8(encPath)) {
+    const { blob } = JSON.parse(readFileSync10(encPath, "utf-8"));
     return JSON.parse(decrypt(blob)).records ?? [];
   }
-  if (existsSync6(plainPath)) {
-    return JSON.parse(readFileSync7(plainPath, "utf-8")).records ?? [];
+  if (existsSync8(plainPath)) {
+    return JSON.parse(readFileSync10(plainPath, "utf-8")).records ?? [];
   }
   return [];
 }
@@ -2859,9 +3513,9 @@ function selectDenials(records, opts = {}) {
 // src/index.ts
 (function migrateDataDir() {
   if (process.env.SUVEREN_DATA_DIR) return;
-  const oldDir = join9(homedir7(), ".hap");
-  const newDir = join9(homedir7(), ".suveren");
-  if (!existsSync7(newDir) && existsSync7(oldDir)) {
+  const oldDir = join11(homedir7(), ".hap");
+  const newDir = join11(homedir7(), ".suveren");
+  if (!existsSync9(newDir) && existsSync9(oldDir)) {
     try {
       renameSync2(oldDir, newDir);
       console.error(`[Control Plane] Migrated data directory: ${oldDir} \u2192 ${newDir}`);
@@ -2871,12 +3525,24 @@ function selectDenials(records, opts = {}) {
     }
   }
 })();
-var SP_URL2 = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
+var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
+var SP_URL = resolveAsUrl(DATA_DIR);
+validatePinTlsForUrl(resolvePinTls(DATA_DIR), SP_URL);
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
-var UI_DIST = process.env.HAP_UI_DIST ?? join9(import.meta.dirname ?? __dirname, "../../ui/dist");
-var vault = new Vault();
-var internalSecret2 = process.env.SUVEREN_INTERNAL_SECRET ?? randomBytes2(32).toString("hex");
+var UI_DIST = process.env.HAP_UI_DIST ?? join11(import.meta.dirname ?? __dirname, "../../ui/dist");
+var vault = new Vault(DATA_DIR);
+(function repairIfAsUrlChanged() {
+  const pairing = readPairing(DATA_DIR);
+  if (pairing && pairing.asUrl !== SP_URL) {
+    console.error(
+      `[Control Plane] Authority Server changed (${pairing.asUrl} \u2192 ${SP_URL}) \u2014 clearing the old pairing. Sign in again to re-pair.`
+    );
+    clearPairing(DATA_DIR);
+    vault.markBootLockedAsUrlChanged();
+  }
+})();
+var internalSecret2 = process.env.SUVEREN_INTERNAL_SECRET ?? randomBytes3(32).toString("hex");
 setInternalSecret(internalSecret2);
 var app = express();
 var jsonParser = express.json();
@@ -2899,6 +3565,8 @@ function loginRateLimit(req, res, next) {
   next();
 }
 var lockExpiredSession = createSessionLock({ vault, port });
+var lockAsKeyMismatch = createAsKeyMismatchLock({ vault, port });
+var lockAsTlsMismatch = createAsTlsMismatchLock({ vault, port });
 var sessionExpiryScheduler = new SessionExpiryScheduler(
   () => vault.getSessionExpiresAt(),
   lockExpiredSession
@@ -2907,7 +3575,8 @@ app.use("/auth", jsonParser, createAuthRouter(
   vault,
   requireAuth(vault),
   loginRateLimit,
-  () => sessionExpiryScheduler.reschedule()
+  () => sessionExpiryScheduler.reschedule(),
+  { asUrl: SP_URL, dataDir: DATA_DIR }
 ));
 function resolveOrigin(req) {
   const fwdHost = req.get("x-forwarded-host");
@@ -3114,7 +3783,7 @@ app.get("/auth/oauth/:integrationId/health", authGuard, async (req, res) => {
   }
 });
 app.get("/events", requireAllowedHost, requireAuthQueryOrHeader(vault), createEventsHandler());
-app.use("/internal", jsonParser, createInternalEventsRouter(() => internalSecret2, lockExpiredSession));
+app.use("/internal", jsonParser, createInternalEventsRouter(() => internalSecret2, lockExpiredSession, lockAsKeyMismatch, lockAsTlsMismatch));
 app.use("/vault", jsonParser, authGuard, createVaultRouter(vault));
 app.use("/ai", jsonParser, authGuard, createAIRouter(vault));
 app.use("/ai-prompts", jsonParser, authGuard, createAIPromptsRouter());
@@ -3123,7 +3792,7 @@ app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRouter());
 app.use("/api/archived-mandates", jsonParser, authGuard, createArchivedMandatesRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
-app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL2, vault));
+app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL, vault, DATA_DIR, lockAsTlsMismatch));
 app.use("/api/evidence", authGuard, createEvidenceRouter());
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
 app.use("/api/approved-intents", jsonParser, authGuard, createApprovedIntentsRouter(vault));
@@ -3253,9 +3922,34 @@ app.get("/active-authorizations", authGuard, async (_req, res) => {
     res.status(500).json({ error: "Failed to fetch authorizations from MCP server" });
   }
 });
+app.get("/skipped-commitments", authGuard, async (_req, res) => {
+  try {
+    const data = await getSkippedCommitments();
+    res.json(data);
+  } catch (err) {
+    console.error("[Control Plane] Skipped-commitments retrieval error:", err);
+    res.status(500).json({ error: "Failed to fetch skipped commitments from MCP server" });
+  }
+});
+app.get("/as-pairing", authGuard, (_req, res) => {
+  const pairing = readPairing(DATA_DIR);
+  const paired = pairing !== null && pairing.asUrl === SP_URL;
+  res.json({
+    asUrl: SP_URL,
+    paired,
+    fingerprint: paired ? fingerprintOf(pairing.publicKeyHex) : null,
+    pairedAt: paired ? pairing.pairedAt : null,
+    // Opt-in TLS pinning (`config set pin-tls on`) — see as-tls-pin.ts.
+    // `tlsPinFingerprint` uses the SAME display convention as the signing
+    // key (formatPinFingerprint mirrors fingerprintOf's grouping), applied
+    // to the already-computed SPKI digest rather than re-hashing a key.
+    pinTlsEnabled: resolvePinTls(DATA_DIR),
+    tlsPinFingerprint: paired && pairing.tlsSpkiPinHex ? formatPinFingerprint(pairing.tlsSpkiPinHex) : null
+  });
+});
 app.get("/denials", authGuard, (req, res) => {
   try {
-    const dataDir = process.env.SUVEREN_DATA_DIR ?? join9(homedir7(), ".suveren");
+    const dataDir = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
     const all = loadDenials(dataDir, (blob) => vault.decrypt(blob));
     const since = Number(req.query.since);
     const limit = Number(req.query.limit);
@@ -3306,11 +4000,11 @@ app.put("/agent-brief/context", jsonParser, authGuard, async (req, res) => {
       res.status(413).json({ error: `Context exceeds ${AGENT_CONTEXT_MAX_BYTES}-byte cap` });
       return;
     }
-    const { mkdirSync: mkdirSync6, writeFileSync: writeFileSync6, renameSync: renameSync3 } = await import("fs");
+    const { mkdirSync: mkdirSync8, writeFileSync: writeFileSync8, renameSync: renameSync3 } = await import("fs");
     const filePath = agentBriefPath();
-    mkdirSync6(dirname6(filePath), { recursive: true });
+    mkdirSync8(dirname8(filePath), { recursive: true });
     const tmpPath = `${filePath}.tmp`;
-    writeFileSync6(tmpPath, content, "utf-8");
+    writeFileSync8(tmpPath, content, "utf-8");
     renameSync3(tmpPath, filePath);
     res.json({ ok: true });
   } catch (err) {
@@ -3319,11 +4013,19 @@ app.put("/agent-brief/context", jsonParser, authGuard, async (req, res) => {
   }
 });
 app.use("/api", authGuard);
+var pinnedProxyAgent = SP_URL.startsWith("https:") ? buildPinnedHttpsAgent(() => {
+  const pin = readPairing(DATA_DIR);
+  return {
+    enforce: resolvePinTls(DATA_DIR),
+    pinnedSpkiHex: pin && pin.asUrl === SP_URL ? pin.tlsSpkiPinHex : void 0
+  };
+}) : void 0;
 app.use(
   createProxyMiddleware({
-    target: SP_URL2,
+    target: SP_URL,
     changeOrigin: true,
     pathFilter: "/api",
+    ...pinnedProxyAgent ? { agent: pinnedProxyAgent } : {},
     on: {
       proxyReq: (proxyReq) => {
         const cookie = vault.getSpCookie();
@@ -3331,6 +4033,21 @@ app.use(
           proxyReq.setHeader("Cookie", cookie);
         }
       },
+      // A pin check failure means the connection never completed its TLS
+      // handshake — nothing (not even this call's own cookie) reached the
+      // network. Lock the gateway with the real reason, loudly; an ordinary
+      // network error (AS outage) is NOT a pin failure (see isPinCheckError
+      // / as-tls-pin.ts's module doc comment on outage misclassification)
+      // and falls through to http-proxy-middleware's default error handling.
+      error: (err, _req, res) => {
+        if (!isPinCheckError(err)) return;
+        console.error("[Control Plane] /api proxy: TLS pin mismatch \u2014 gateway LOCKED:", err.message);
+        lockAsTlsMismatch();
+        if (res && "writeHead" in res && !res.headersSent) {
+          res.writeHead(502, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "as_tls_mismatch", message: err.message }));
+        }
+      },
       proxyRes: (proxyRes, req) => {
         const status = proxyRes.statusCode ?? 0;
         if (status === 401 && vault.isUnlocked()) {
@@ -3363,13 +4080,13 @@ app.use(
   })
 );
 function detectInstallMethod() {
-  if (existsSync7("/.dockerenv")) return "docker";
+  if (existsSync9("/.dockerenv")) return "docker";
   const dir = import.meta.dirname ?? __dirname;
   if (dir.includes("/node_modules/@suveren/gateway/")) return "npm";
   let cursor = dir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync7(join9(cursor, ".git"))) return "dev";
-    const parent = dirname6(cursor);
+    if (existsSync9(join11(cursor, ".git"))) return "dev";
+    const parent = dirname8(cursor);
     if (parent === cursor) break;
     cursor = parent;
   }
@@ -3381,10 +4098,10 @@ function detectRunningVersion() {
     return process.env.HAP_BUILD_SHA ?? "dev";
   }
   const dir = import.meta.dirname ?? __dirname;
-  const bundlePkg = join9(dir, "..", "..", "package.json");
-  if (existsSync7(bundlePkg)) {
+  const bundlePkg = join11(dir, "..", "..", "package.json");
+  if (existsSync9(bundlePkg)) {
     try {
-      const pkg = JSON.parse(readFileSync8(bundlePkg, "utf8"));
+      const pkg = JSON.parse(readFileSync11(bundlePkg, "utf8"));
       if (pkg.name === "@suveren/gateway" && typeof pkg.version === "string") {
         return pkg.version;
       }
@@ -3406,14 +4123,14 @@ app.get("/health", async (req, res) => {
     latestVersion: update.latestVersion,
     updateAvailable: update.updateAvailable,
     installMethod: INSTALL_METHOD,
-    spUrl: SP_URL2,
+    spUrl: SP_URL,
     session: buildSessionHealth(vault),
     security: {
       note: "Gateway secures tool execution. Agent host isolation is the user's responsibility."
     }
   });
 });
-if (existsSync7(UI_DIST)) {
+if (existsSync9(UI_DIST)) {
   app.use(express.static(UI_DIST, {
     setHeaders: (res, filePath) => {
       if (filePath.endsWith("index.html")) {
@@ -3423,7 +4140,7 @@ if (existsSync7(UI_DIST)) {
   }));
   app.get("*", (_req, res) => {
     res.setHeader("Cache-Control", "no-store, must-revalidate");
-    res.sendFile(join9(UI_DIST, "index.html"));
+    res.sendFile(join11(UI_DIST, "index.html"));
   });
 } else {
   app.get("/", (_req, res) => {
@@ -3441,7 +4158,7 @@ app.listen(port, "0.0.0.0", () => {
   }
   startNotificationDispatcher({ url: `http://localhost:${port}` });
   sessionExpiryScheduler.start();
-  console.error(`[Control Plane]   SP proxy: ${SP_URL2}`);
+  console.error(`[Control Plane]   SP proxy: ${SP_URL}`);
   console.error(`[Control Plane]   UI dist:  ${UI_DIST}`);
   console.error(`[Control Plane]   Internal secret: configured`);
   console.error(`[Control Plane]   MCP server: ${MCP_BASE}`);