@suveren/gateway 0.8.7 → 0.10.0

package/dist/mcp-server/http.mjs

@@ -112,6 +112,262 @@ function clientVersionHeaders() {
   };
 }
 
+// src/lib/as-pairing.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
+import { dirname, join as join2 } from "path";
+function pairingPath(dataDir2) {
+  return join2(dataDir2, "as-pairing.json");
+}
+function readPairing(dataDir2) {
+  const path = pairingPath(dataDir2);
+  if (!existsSync2(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync2(path, "utf-8"));
+    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
+    return {
+      asUrl: data.asUrl,
+      publicKeyHex: data.publicKeyHex,
+      pairedAt: data.pairedAt ?? "",
+      ...typeof data.tlsSpkiPinHex === "string" ? { tlsSpkiPinHex: data.tlsSpkiPinHex } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function fingerprintOf(publicKeyHex) {
+  const raw = Buffer.from(publicKeyHex, "hex");
+  const digest = createHash("sha256").update(raw).digest("hex").toUpperCase();
+  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
+}
+
+// src/lib/as-config.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+var DEFAULT_AS_URL = "https://www.suveren.ai";
+function configPath(dataDir2) {
+  return join3(dataDir2, "config.json");
+}
+function readAsConfigStrict(dataDir2) {
+  const path = configPath(dataDir2);
+  if (!existsSync3(path)) return {};
+  let data;
+  try {
+    data = JSON.parse(readFileSync3(path, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const out = {};
+  if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+  if (typeof data.caFile === "string") out.caFile = data.caFile;
+  if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+  if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+  return out;
+}
+function readAsConfig(dataDir2) {
+  const path = configPath(dataDir2);
+  if (!existsSync3(path)) return {};
+  try {
+    const data = JSON.parse(readFileSync3(path, "utf-8"));
+    const out = {};
+    if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+    if (typeof data.caFile === "string") out.caFile = data.caFile;
+    if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+    if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+    return out;
+  } catch {
+    return {};
+  }
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function resolveAsUrl(dataDir2, flag) {
+  if (flag) {
+    const v = validateAsUrl(flag);
+    if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
+    return v.url;
+  }
+  const envUrl = process.env.SUVEREN_AS_URL;
+  if (envUrl) {
+    const v = validateAsUrl(envUrl);
+    if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
+    return v.url;
+  }
+  const saved = readAsConfigStrict(dataDir2).asUrl;
+  if (saved) {
+    const v = validateAsUrl(saved);
+    if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir2}/config.json: ${v.error}`);
+    return v.url;
+  }
+  return DEFAULT_AS_URL;
+}
+function resolvePinTls(dataDir2) {
+  return readAsConfig(dataDir2).pinTls === true;
+}
+function validatePinTlsForUrl(pinTls, asUrl) {
+  if (!pinTls) return;
+  if (!asUrl.startsWith("https:")) {
+    throw new Error(
+      `config.json sets "pinTls": true, but the Authority Server URL (${asUrl}) is not https:// \u2014 there is no TLS certificate to pin. Fix the saved as-url, or turn pin-tls off: \`suveren-gateway config set pin-tls off\`.`
+    );
+  }
+}
+
+// src/lib/as-tls-pin.ts
+import { createHash as createHash2 } from "crypto";
+import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
+import { Agent as HttpsAgent } from "https";
+import { readFileSync as readFileSync4 } from "fs";
+import { Agent, fetch as undiciFetch } from "undici";
+function effectiveCa() {
+  const path = process.env.NODE_EXTRA_CA_CERTS;
+  if (!path) return void 0;
+  try {
+    return [...rootCertificates, readFileSync4(path, "utf-8")];
+  } catch {
+    return void 0;
+  }
+}
+var PIN_CHECK_ERROR_CODE = "EAS_TLS_PIN_CHECK";
+function taggedCheckError(err) {
+  err.code = PIN_CHECK_ERROR_CODE;
+  return err;
+}
+function isPinCheckError(err) {
+  let cur = err;
+  for (let i = 0; i < 5 && cur; i++) {
+    if (cur instanceof Error && cur.code === PIN_CHECK_ERROR_CODE) return true;
+    cur = cur instanceof Error ? cur.cause : void 0;
+  }
+  return false;
+}
+var AsTlsMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsTlsMismatchError";
+  }
+};
+function spkiSha256Hex(cert) {
+  if (!cert.pubkey) {
+    throw new Error("peer certificate carries no pubkey (expected the detailed certificate object)");
+  }
+  return createHash2("sha256").update(cert.pubkey).digest("hex");
+}
+function formatPinFingerprint(hex) {
+  const upper = hex.toUpperCase();
+  return upper.match(/.{1,4}/g)?.join(":") ?? upper;
+}
+function pinnedCheckServerIdentity(pinnedSpkiHex) {
+  const wantHex = pinnedSpkiHex.toLowerCase();
+  return (hostname, cert) => {
+    const defaultErr = defaultCheckServerIdentity(hostname, cert);
+    if (defaultErr) return taggedCheckError(defaultErr);
+    let actualHex;
+    try {
+      actualHex = spkiSha256Hex(cert);
+    } catch (err) {
+      return taggedCheckError(new Error(
+        `could not read the server certificate's public key to check the TLS pin \u2014 ${err instanceof Error ? err.message : String(err)}`
+      ));
+    }
+    if (actualHex !== wantHex) {
+      return taggedCheckError(new Error(
+        `TLS certificate pin mismatch for ${hostname}: expected SPKI sha256 ${formatPinFingerprint(wantHex)}, got ${formatPinFingerprint(actualHex)}.`
+      ));
+    }
+    return void 0;
+  };
+}
+function buildPinnedDispatcher(pinnedSpkiHex) {
+  return new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
+    }
+  });
+}
+function buildCapturingDispatcher() {
+  let captured;
+  const dispatcher = new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: (hostname, cert) => {
+        captured = cert;
+        const defaultErr = defaultCheckServerIdentity(hostname, cert);
+        return defaultErr ? taggedCheckError(defaultErr) : void 0;
+      }
+    }
+  });
+  return { dispatcher, getCapturedCert: () => captured };
+}
+async function fetchAs(url, init, pinning) {
+  if (!pinning.enforce && !pinning.capture) {
+    const res2 = await fetch(url, init);
+    return { res: res2 };
+  }
+  if (pinning.enforce && !pinning.capture && !pinning.pinnedSpkiHex) {
+    throw new AsTlsMismatchError(
+      `pin-tls is on but no certificate is pinned yet for ${url} \u2014 sign in again to establish it (re-pairing required).`
+    );
+  }
+  if (pinning.pinnedSpkiHex && (pinning.enforce || !pinning.capture)) {
+    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex);
+    try {
+      const res2 = await undiciFetch(url, { ...init, dispatcher: dispatcher2 });
+      return { res: res2 };
+    } catch (err) {
+      if (!isPinCheckError(err)) throw err;
+      throw new AsTlsMismatchError(
+        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. If the Authority Server's certificate changed intentionally (a new key, not just renewal), an operator must clear the pairing and sign in again to re-pin it.`
+      );
+    }
+  }
+  const { dispatcher, getCapturedCert } = buildCapturingDispatcher();
+  let res;
+  try {
+    res = await undiciFetch(url, { ...init, dispatcher });
+  } catch (err) {
+    if (!isPinCheckError(err)) throw err;
+    throw new AsTlsMismatchError(
+      `could not verify the Authority Server at ${url} while establishing its TLS pin \u2014 ${describeFetchError(err)}.`
+    );
+  }
+  const cert = getCapturedCert();
+  return { res, capturedSpkiHex: cert ? spkiSha256Hex(cert) : void 0 };
+}
+function describeFetchError(err) {
+  if (err instanceof Error) {
+    const cause = err.cause;
+    if (cause instanceof Error) return cause.message;
+    return err.message;
+  }
+  return String(err);
+}
+
 // src/lib/sp-client.ts
 var SPReceiptError = class extends Error {
   constructor(message, statusCode, body) {
@@ -127,8 +383,9 @@ var DEFAULT_RECEIPT_RETRY = {
 };
 var sleep = (ms) => ms > 0 ? new Promise((resolve3) => setTimeout(resolve3, ms)) : Promise.resolve();
 var SPClient = class {
-  constructor(baseUrl, receiptRetry = {}) {
+  constructor(baseUrl, receiptRetry = {}, dataDir2) {
     this.baseUrl = baseUrl;
+    this.dataDir = dataDir2;
     this.receiptRetry = { ...DEFAULT_RECEIPT_RETRY, ...receiptRetry };
   }
   sessionCookie = "";
@@ -141,6 +398,22 @@ var SPClient = class {
    *  was active tells the control plane. Concurrent in-flight calls that were
    *  all sent under the same now-dead cookie would otherwise all report it. */
   sessionExpiredNotified = false;
+  /** Same single-flight shape, for a TLS pin mismatch (as-tls-pin.ts). */
+  tlsMismatchNotified = false;
+  /** Opt-in TLS pinning (as-tls-pin.ts) for every call THIS client makes.
+   *  Re-read live on each call rather than cached — same reasoning as
+   *  AttestationCache.getPublicKey's pin check: a pin or setting change
+   *  must take effect on the very next call, not the next restart. Never
+   *  allowed to CAPTURE a new pin here — only the control plane's sign-in
+   *  exchange (as-challenge.ts) does that; this client only enforces. */
+  tlsPinning() {
+    if (!this.dataDir) return { enforce: false };
+    const pin = readPairing(this.dataDir);
+    return {
+      enforce: resolvePinTls(this.dataDir),
+      pinnedSpkiHex: pin && pin.asUrl === this.baseUrl ? pin.tlsSpkiPinHex : void 0
+    };
+  }
   /** The AS base URL this client talks to (for provenance records). */
   get url() {
     return this.baseUrl;
@@ -152,15 +425,23 @@ var SPClient = class {
     this.sessionCookie = cookie;
     this.lockReason = null;
     this.sessionExpiredNotified = false;
+    this.tlsMismatchNotified = false;
   }
   /**
    * Drop the session because the control plane learned (by whatever path —
-   * one of OUR calls 401ing, or its own AS proxy 401ing) that it ended.
-   * Idempotent: safe to call redundantly from the control-plane's push.
+   * one of OUR calls 401ing, its own AS proxy 401ing, or an AS key mismatch)
+   * that it ended. Idempotent: safe to call redundantly from the
+   * control-plane's push.
+   *
+   * @param reason Defaults to 'expired' for the original caller (a 401 really
+   *   does mean the session ended) — but the control plane's own lock
+   *   procedures (session-lock.ts) know the REAL reason and must pass it, or
+   *   an agent told "your sign-in ended, sign in again" for an AS key
+   *   mismatch would be sent to a sign-in that is itself refused.
    */
-  clearSession() {
+  clearSession(reason = "expired") {
     this.sessionCookie = "";
-    this.lockReason = "expired";
+    this.lockReason = reason;
   }
   /** Why we are currently locked, if known. `null` means the default
    *  boot-locked case (nobody has signed in yet this run). */
@@ -198,10 +479,21 @@ var SPClient = class {
       headers["X-API-Key"] = this.apiKey;
     }
     const hadSession = this.sessionCookie !== "";
-    const res = await globalThis.fetch(url, {
-      ...init,
-      headers
-    });
+    let res;
+    try {
+      const result = await fetchAs(url, { ...init, headers }, this.tlsPinning());
+      res = result.res;
+    } catch (err) {
+      if (err instanceof AsTlsMismatchError) {
+        this.sessionCookie = "";
+        this.lockReason = "as-tls-mismatch";
+        if (!this.tlsMismatchNotified) {
+          this.tlsMismatchNotified = true;
+          void notifyControlPlane("as-tls-mismatch");
+        }
+      }
+      throw err;
+    }
     if (res.status === 401 && hadSession) {
       this.sessionCookie = "";
       this.lockReason = "expired";
@@ -364,13 +656,26 @@ var SPClient = class {
 
 // src/lib/attestation-cache.ts
 import { decodeAttestationBlob } from "@hap/core";
+var AsKeyMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsKeyMismatchError";
+  }
+};
 function isCommitmentDowngrade(auth) {
   const requiresReview = auth.signedCommitmentMode === "review" || auth.signedCommitmentMode === "review_above_cap";
   return requiresReview && (auth.deferredCommitmentDomains ?? []).length === 0;
 }
 var AttestationCache = class {
-  constructor(spClient) {
+  /**
+   * @param dataDir Where to look for a pinned key (as-pairing.json). Optional
+   *   and defaults to "no pin enforced" — kept optional so existing
+   *   constructions (and this class's own unit tests) that pass only an
+   *   SPClient keep working unpinned, exactly as before pinning existed.
+   */
+  constructor(spClient, dataDir2) {
     this.spClient = spClient;
+    this.dataDir = dataDir2;
   }
   spPublicKey = null;
   spPublicKeyFetchedAt = 0;
@@ -380,15 +685,29 @@ var AttestationCache = class {
   authorizations = /* @__PURE__ */ new Map();
   lastSync = 0;
   /**
-   * Get the SP public key, fetching from SP if not cached or expired.
+   * Get the SP public key, fetching from SP if not cached or expired, then —
+   * when a pin exists for this exact AS URL — verifying the live key still
+   * matches it.
+   *
+   * Trust-on-first-use before any pairing exists (or when no `dataDir` was
+   * given): the fetched key is cached and returned, same as before pinning.
+   * Once paired, a live key that differs from the pin throws
+   * {@link AsKeyMismatchError} — fail closed, never silently re-pin.
    */
   async getPublicKey() {
     const now = Math.floor(Date.now() / 1e3);
-    if (this.spPublicKey && now - this.spPublicKeyFetchedAt < this.SP_PUBKEY_TTL) {
-      return this.spPublicKey;
+    if (!(this.spPublicKey && now - this.spPublicKeyFetchedAt < this.SP_PUBKEY_TTL)) {
+      this.spPublicKey = await this.spClient.getPublicKey();
+      this.spPublicKeyFetchedAt = now;
+    }
+    if (this.dataDir) {
+      const pin = readPairing(this.dataDir);
+      if (pin && pin.asUrl === this.spClient.url && pin.publicKeyHex !== this.spPublicKey) {
+        throw new AsKeyMismatchError(
+          `The Authority Server at ${this.spClient.url} presented a signing key that does not match the one pinned at pairing (pinned fingerprint ${fingerprintOf(pin.publicKeyHex)}). Refusing to trust it. Re-pair (sign in again) only if you expect this key to have changed.`
+        );
+      }
     }
-    this.spPublicKey = await this.spClient.getPublicKey();
-    this.spPublicKeyFetchedAt = now;
     return this.spPublicKey;
   }
   /**
@@ -498,18 +817,18 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync, readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, unlinkSync } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync2 } from "fs";
 import { homedir } from "os";
-import { dirname, join as join2 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join2(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join4(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname(filePath);
+      this.baseDir = dirname3(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR;
     }
@@ -520,13 +839,13 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync2(this.encryptedFilePath)) {
+    if (existsSync4(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync2(this.plaintextFilePath)) {
+      if (existsSync4(this.plaintextFilePath)) {
         try {
-          unlinkSync(this.plaintextFilePath);
+          unlinkSync2(this.plaintextFilePath);
         } catch {
         }
       }
@@ -546,6 +865,30 @@ var GateStore = class {
     this.entries.delete(path);
     this.persist();
   }
+  /**
+   * Wipe every locally cached gate. Used when the Authority Server this
+   * gateway points at changes (re-pairing, see as-pairing.ts): a stored
+   * authorization id and its intent/context are meaningless against a
+   * different AS's grants, and keeping them around risks a `getAll()` caller
+   * (e.g. list-authorizations) advertising authority that no longer exists.
+   *
+   * Removes BOTH the plaintext and encrypted files, not just the one
+   * currently active — this runs at boot, before any vault key is set, so
+   * `persist()` would otherwise only touch `gates.json` and leave a stale
+   * `gates.enc.json` in place for `setVaultKey()` to resurrect on the next
+   * unlock.
+   */
+  clearAll() {
+    this.entries = /* @__PURE__ */ new Map();
+    try {
+      if (existsSync4(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
+    } catch {
+    }
+    try {
+      if (existsSync4(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
+    } catch {
+    }
+  }
   // ─── Encryption helpers ─────────────────────────────────────────────────
   encrypt(plaintext) {
     if (!this.vaultKey) throw new Error("No vault key");
@@ -575,19 +918,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join2(this.baseDir, "gates.json");
+    return join4(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join2(this.baseDir, "gates.enc.json");
+    return join4(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync2(this.plaintextFilePath)) {
-      mkdirSync(this.baseDir, { recursive: true });
+    if (!existsSync4(this.plaintextFilePath)) {
+      mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -596,9 +939,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync2(this.encryptedFilePath)) return;
+    if (!existsSync4(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -622,8 +965,8 @@ var GateStore = class {
       version: 1,
       entries: Object.fromEntries(this.entries)
     };
-    mkdirSync(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
@@ -633,17 +976,17 @@ var GateStore = class {
     for (const [key, entry] of this.entries) {
       data.entries[key] = this.encrypt(JSON.stringify(entry));
     }
-    mkdirSync(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join3(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -651,7 +994,7 @@ var ExecutionLog = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname2(filePath);
+      this.baseDir = dirname4(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR2;
     }
@@ -662,13 +1005,13 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync3(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync3(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
-          unlinkSync2(this.plaintextFilePath);
+          unlinkSync3(this.plaintextFilePath);
         } catch {
         }
       }
@@ -690,14 +1033,23 @@ var ExecutionLog = class {
    * @param field - The execution field to sum ("_count" for plain counting)
    * @param window - Time window (daily, weekly, monthly)
    * @param now - Current timestamp in seconds (for testing)
+   * @param actionTypes - Only count entries whose `execution.action_type` is one
+   *   of these (omitted → all). Consumption is partitioned by action type, as at
+   *   the Authority Server: without it, the usage shown for sales' "orders per
+   *   day" counted every quote and send. An entry with no action_type counts against every filter —
+   *   an unknown action is not evidence of headroom.
    */
-  sumByWindow(profileId, path, field, window, now = Math.floor(Date.now() / 1e3)) {
+  sumByWindow(profileId, path, field, window, now = Math.floor(Date.now() / 1e3), actionTypes) {
     const cutoff = windowCutoff(window, now);
     let total = 0;
     for (const entry of this.entries) {
       if (entry.profileId !== profileId) continue;
       if (entry.path !== path) continue;
       if (entry.timestamp < cutoff) continue;
+      if (actionTypes) {
+        const at = entry.execution.action_type;
+        if (typeof at === "string" && !actionTypes.includes(at)) continue;
+      }
       if (field === "_count") {
         total += 1;
       } else {
@@ -761,19 +1113,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join3(this.baseDir, "execution-log.json");
+    return join5(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join3(this.baseDir, "execution-log.enc.json");
+    return join5(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync3(this.plaintextFilePath)) {
-      mkdirSync2(this.baseDir, { recursive: true });
+    if (!existsSync5(this.plaintextFilePath)) {
+      mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync3(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -783,9 +1135,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync3(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync3(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -805,8 +1157,8 @@ var ExecutionLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, entries: this.entries };
-    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync2(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, entries: this.entries };
@@ -814,8 +1166,8 @@ var ExecutionLog = class {
       version: 1,
       blob: this.encrypt(JSON.stringify(logFile))
     };
-    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync2(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 function windowCutoff(window, now) {
@@ -832,11 +1184,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync6, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname5, join as join6 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join4(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -844,18 +1196,18 @@ var DenialLog = class {
   baseDir;
   vaultKey = null;
   constructor(filePath) {
-    this.baseDir = filePath && filePath.endsWith(".json") ? dirname3(filePath) : filePath ?? DEFAULT_DIR3;
+    this.baseDir = filePath && filePath.endsWith(".json") ? dirname5(filePath) : filePath ?? DEFAULT_DIR3;
     this.loadPlaintext();
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync4(this.encryptedFilePath)) {
+    if (existsSync6(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync4(this.plaintextFilePath)) {
+      if (existsSync6(this.plaintextFilePath)) {
         try {
-          unlinkSync3(this.plaintextFilePath);
+          unlinkSync4(this.plaintextFilePath);
         } catch {
         }
       }
@@ -903,18 +1255,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join4(this.baseDir, "denials.json");
+    return join6(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join4(this.baseDir, "denials.enc.json");
+    return join6(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync4(this.plaintextFilePath)) {
-      mkdirSync3(this.baseDir, { recursive: true });
+    if (!existsSync6(this.plaintextFilePath)) {
+      mkdirSync5(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync4(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync7(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -922,9 +1274,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync4(this.encryptedFilePath)) return;
+    if (!existsSync6(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync4(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync7(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -938,23 +1290,23 @@ var DenialLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, records: this.records };
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, records: this.records };
     const data = { version: 1, blob: this.encrypt(JSON.stringify(logFile)) };
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname6, join as join7 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join5(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -968,7 +1320,7 @@ var ReceiptArchive = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname4(filePath);
+      this.baseDir = dirname6(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR4;
     }
@@ -979,13 +1331,13 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync5(this.encryptedFilePath)) {
+    if (existsSync7(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync5(this.plaintextFilePath)) {
+      if (existsSync7(this.plaintextFilePath)) {
         try {
-          unlinkSync4(this.plaintextFilePath);
+          unlinkSync5(this.plaintextFilePath);
         } catch {
         }
       }
@@ -997,7 +1349,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync5(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync7(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -1098,19 +1450,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join5(this.baseDir, "receipt-archive.json");
+    return join7(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join5(this.baseDir, "receipt-archive.enc.json");
+    return join7(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync5(this.plaintextFilePath)) {
-      mkdirSync4(this.baseDir, { recursive: true });
+    if (!existsSync7(this.plaintextFilePath)) {
+      mkdirSync6(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync8(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1120,18 +1472,18 @@ var ReceiptArchive = class {
     } catch {
       console.error(`[ReceiptArchive] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
       try {
-        writeFileSync4(
+        writeFileSync6(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync5(this.plaintextFilePath)
+          readFileSync8(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync5(this.encryptedFilePath)) return;
+    if (!existsSync7(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync8(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1143,9 +1495,9 @@ var ReceiptArchive = class {
     } catch (err) {
       console.error(`[ReceiptArchive] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
       try {
-        writeFileSync4(
+        writeFileSync6(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync5(this.encryptedFilePath)
+          readFileSync8(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1159,29 +1511,29 @@ var ReceiptArchive = class {
     }
   }
   persistPlaintext() {
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync6(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync6(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
       version: 1,
       blob: this.encrypt(JSON.stringify(this.data))
     };
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync6(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync6(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-journal.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, renameSync } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7, existsSync as existsSync8, renameSync } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname5, join as join6 } from "path";
-import { createHash } from "crypto";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
+import { dirname as dirname7, join as join8 } from "path";
+import { createHash as createHash3 } from "crypto";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
 var FILE_NAME = "execution-journal.json";
 var MAX_AGE_SECONDS2 = 90 * 24 * 60 * 60;
 function hashToolArgs(args) {
-  return "sha256:" + createHash("sha256").update(stableStringify(args)).digest("hex");
+  return "sha256:" + createHash3("sha256").update(stableStringify(args)).digest("hex");
 }
 function stableStringify(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
@@ -1193,8 +1545,8 @@ function stableStringify(value) {
 var ExecutionJournal = class {
   filePath;
   constructor(filePath) {
-    const baseDir = filePath && filePath.endsWith(".json") ? dirname5(filePath) : filePath ?? DEFAULT_DIR5;
-    this.filePath = join6(baseDir, FILE_NAME);
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR5;
+    this.filePath = join8(baseDir, FILE_NAME);
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
@@ -1233,9 +1585,9 @@ var ExecutionJournal = class {
   }
   // ─── Persistence ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync6(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync8(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync6(this.filePath, "utf8"));
+      const parsed = JSON.parse(readFileSync9(this.filePath, "utf8"));
       if (parsed?.version !== 1 || !Array.isArray(parsed.entries)) {
         throw new Error("unexpected shape");
       }
@@ -1249,9 +1601,9 @@ var ExecutionJournal = class {
   persist(file) {
     const cutoff = nowSec() - MAX_AGE_SECONDS2;
     file.entries = file.entries.filter((e) => e.startedAt >= cutoff);
-    mkdirSync5(dirname5(this.filePath), { recursive: true, mode: 448 });
+    mkdirSync7(dirname7(this.filePath), { recursive: true, mode: 448 });
     const tmp = this.filePath + ".tmp";
-    writeFileSync5(tmp, JSON.stringify(file, null, 2), { mode: 384 });
+    writeFileSync7(tmp, JSON.stringify(file, null, 2), { mode: 384 });
     renameSync(tmp, this.filePath);
   }
 };
@@ -1259,6 +1611,61 @@ function nowSec() {
   return Math.floor(Date.now() / 1e3);
 }
 
+// src/lib/proposal-submission-store.ts
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync9, renameSync as renameSync2 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname8, join as join9 } from "path";
+var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
+var FILE_NAME2 = "proposal-submissions.json";
+var MAX_AGE_SECONDS3 = 90 * 24 * 60 * 60;
+function nowSec2() {
+  return Math.floor(Date.now() / 1e3);
+}
+var ProposalSubmissionStore = class {
+  filePath;
+  constructor(filePath) {
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname8(filePath) : filePath ?? DEFAULT_DIR6;
+    this.filePath = join9(baseDir, FILE_NAME2);
+  }
+  /** Record what was submitted, right after a successful submitProposal(). */
+  record(entry) {
+    const file = this.load();
+    file.entries = file.entries.filter((e) => e.proposalId !== entry.proposalId);
+    file.entries.push({
+      proposalId: entry.proposalId,
+      tool: entry.tool,
+      toolArgsHash: hashToolArgs(entry.toolArgs),
+      executionContextHash: hashToolArgs(entry.executionContext),
+      authorizationId: entry.authorizationId,
+      profileId: entry.profileId,
+      submittedAt: nowSec2()
+    });
+    this.persist(file);
+  }
+  /** Always reads from disk — another process (the poll loop lives in the
+   *  same process, but this stays consistent with execution-journal.ts). */
+  get(proposalId) {
+    return this.load().entries.find((e) => e.proposalId === proposalId);
+  }
+  load() {
+    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
+    try {
+      const parsed = JSON.parse(readFileSync10(this.filePath, "utf-8"));
+      const cutoff = nowSec2() - MAX_AGE_SECONDS3;
+      parsed.entries = (parsed.entries ?? []).filter((e) => e.submittedAt >= cutoff);
+      return parsed;
+    } catch {
+      return { version: 1, entries: [] };
+    }
+  }
+  persist(file) {
+    mkdirSync8(dirname8(this.filePath), { recursive: true, mode: 448 });
+    const tmpPath = `${this.filePath}.tmp`;
+    writeFileSync8(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
+    renameSync2(tmpPath, this.filePath);
+  }
+};
+
 // src/lib/gatekeeper.ts
 import { verify } from "@hap/core";
 var MCPGatekeeper = class {
@@ -1309,7 +1716,26 @@ var MCPGatekeeper = class {
         authorization: auth
       };
     }
-    const publicKeyHex = await this.cache.getPublicKey();
+    let publicKeyHex;
+    try {
+      publicKeyHex = await this.cache.getPublicKey();
+    } catch (err) {
+      if (err instanceof AsKeyMismatchError) {
+        void notifyControlPlane("as-key-mismatch");
+        return {
+          result: {
+            approved: false,
+            // No dedicated GatekeeperError code exists for this (hap-core's
+            // union predates gateway-side key pinning) — INVALID_SIGNATURE is
+            // the closest fit: it's exactly the claim being made here ("we
+            // will not trust a signature made under this key").
+            errors: [{ code: "INVALID_SIGNATURE", message: err.message }]
+          },
+          authorization: auth
+        };
+      }
+      throw err;
+    }
     const resolvedBounds = override?.bounds ?? auth.bounds ?? auth.frame;
     const resolvedContext = override?.context ?? auth.context;
     const frame = { ...resolvedBounds, profile: auth.profileId };
@@ -1341,15 +1767,26 @@ var SharedState = class {
   receiptArchive;
   /** Which tickets this Gatekeeper has executed — the "one execution per ticket" half of exactly-once. */
   executionJournal;
+  /** What THIS gateway submitted for each review-mode proposal it created —
+   *  see ticket-verify.ts / commitments.ts. */
+  proposalSubmissions;
   gatekeeper;
-  constructor(spUrl2, gateStorePath) {
-    this.spClient = new SPClient(spUrl2);
-    this.cache = new AttestationCache(this.spClient);
+  /**
+   * @param dataDir Passed to the AttestationCache so it can enforce AS key
+   *   pinning (as-pairing.ts), and to the SPClient so it can enforce opt-in
+   *   TLS pinning (as-tls-pin.ts). Optional for backward compat with
+   *   existing constructions/tests that pass only a URL — those get
+   *   unpinned trust-on-first-use behavior, same as before pinning existed.
+   */
+  constructor(spUrl2, gateStorePath, dataDir2) {
+    this.spClient = new SPClient(spUrl2, void 0, dataDir2);
+    this.cache = new AttestationCache(this.spClient, dataDir2);
     this.gateStore = new GateStore(gateStorePath);
     this.executionLog = new ExecutionLog(gateStorePath);
     this.denialLog = new DenialLog(gateStorePath);
     this.receiptArchive = new ReceiptArchive(gateStorePath);
     this.executionJournal = new ExecutionJournal(gateStorePath);
+    this.proposalSubmissions = new ProposalSubmissionStore(gateStorePath);
     this.gatekeeper = new MCPGatekeeper(this.cache);
   }
   /**
@@ -1365,7 +1802,8 @@ var SharedState = class {
       let asPublicKey;
       try {
         asPublicKey = await this.cache.getPublicKey();
-      } catch {
+      } catch (err) {
+        if (err instanceof AsKeyMismatchError) throw err;
       }
       this.receiptArchive.record({
         receipt,
@@ -1387,6 +1825,7 @@ var SharedState = class {
         } : void 0
       });
     } catch (err) {
+      if (err instanceof AsKeyMismatchError) throw err;
       console.error(
         "[Suveren MCP] Receipt archive write failed (execution proceeds \u2014 AS retains authoritative copy):",
         err
@@ -1435,6 +1874,7 @@ import { z } from "zod";
 import { getProfile } from "@hap/core";
 
 // src/lib/consumption.ts
+import { boundActionTypes } from "@hap/core";
 function getConsumptionState(auth, executionLog, profile) {
   if (!profile?.boundsSchema?.fields) return [];
   const entries = [];
@@ -1454,7 +1894,8 @@ function getConsumptionState(auth, executionLog, profile) {
       auth.path,
       cumulativeField,
       bt.window,
-      now
+      now,
+      boundActionTypes(fieldName, fieldDef)
     );
     entries.push({
       // displayName FIRST: description is prose meant for a human reading the
@@ -1498,24 +1939,24 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
-var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
+import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join10 } from "path";
+var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join10(homedir7(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
-function readContextFile(dataDir) {
-  const dir = dataDir ?? DEFAULT_DIR6;
-  const filePath = join7(dir, "context.md");
-  if (!existsSync7(filePath)) return null;
+function readContextFile(dataDir2) {
+  const dir = dataDir2 ?? DEFAULT_DIR7;
+  const filePath = join10(dir, "context.md");
+  if (!existsSync10(filePath)) return null;
   try {
-    const content = readFileSync7(filePath, "utf-8").trim();
+    const content = readFileSync11(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
   }
 }
-function getContextForBrief(dataDir) {
-  const full = readContextFile(dataDir);
+function getContextForBrief(dataDir2) {
+  const full = readContextFile(dataDir2);
   if (!full) return { brief: null, truncated: false };
   if (full.length <= BRIEF_MAX_CHARS) {
     return { brief: full, truncated: false };
@@ -1623,9 +2064,35 @@ function expiredSessionNotice(what) {
 
 TELL THE USER: open ${uiUrl()} and enter your Suveren API key to sign in again. Your mandates are safe; nothing ran.`;
 }
+function asKeyMismatchNotice(what) {
+  return `${what} Suveren gateway is LOCKED because the Authority Server it is configured to use presented a signing key that does not match the one pinned when this gateway last signed in. This is NOT an ended sign-in \u2014 signing in again will be refused until the mismatch is resolved.
+
+TELL THE USER: this needs an operator to check whether the Authority Server's key changed intentionally (e.g. a reinstall) or something else is answering at that address, at ${uiUrl()}. Nothing ran under the unrecognized key.`;
+}
+function asTlsMismatchNotice(what) {
+  return `${what} Suveren gateway is LOCKED because a connection to the Authority Server presented a TLS certificate that does not match the one pinned when this gateway last signed in (opt-in pin-tls). This is NOT an ended sign-in \u2014 signing in again will be refused until the mismatch is resolved.
+
+TELL THE USER: this needs an operator to check whether the Authority Server's certificate changed intentionally (e.g. a new TLS key, not just a renewal) or something else is answering at that address, at ${uiUrl()}. Nothing was sent under the unrecognized certificate.`;
+}
+function asUrlChangedNotice(what) {
+  return `${what} Suveren gateway is LOCKED because the Authority Server it points at has changed since it last signed in. Cached mandates from the old server were cleared.
+
+TELL THE USER: open ${uiUrl()} and sign in again to pair with the new Authority Server.`;
+}
 function lockedNotice(action, reason = "restart") {
   const what = action ? `Cannot ${action}: the` : "The";
-  return reason === "expired" ? expiredSessionNotice(what) : bootLockedNotice(what);
+  switch (reason) {
+    case "expired":
+      return expiredSessionNotice(what);
+    case "as-key-mismatch":
+      return asKeyMismatchNotice(what);
+    case "as-tls-mismatch":
+      return asTlsMismatchNotice(what);
+    case "as-url-changed":
+      return asUrlChangedNotice(what);
+    default:
+      return bootLockedNotice(what);
+  }
 }
 
 // src/tools/authorizations.ts
@@ -1634,6 +2101,9 @@ import { getProfile as getProfile4 } from "@hap/core";
 // src/lib/receipt-footer.ts
 import { deriveIdentityLine } from "@hap/core";
 var AS_BASE = (process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai").replace(/\/$/, "");
+function setAsBaseUrl(url) {
+  AS_BASE = url.replace(/\/$/, "");
+}
 var OPERATOR_NAME = process.env.SUVEREN_OPERATOR_NAME ?? "Suveren";
 var HAP_URL = "https://www.humanagencyprotocol.org/";
 var FOOTER_PROFILES = /* @__PURE__ */ new Set(["email", "calendar", "publish"]);
@@ -1739,6 +2209,88 @@ function attachReceiptId(tool, args, receiptId) {
   return { ...args, receipt_id: receiptId };
 }
 
+// src/lib/ticket-verify.ts
+import { verifyReceiptSignature } from "@hap/core";
+var TicketBindingMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TicketBindingMismatchError";
+  }
+};
+var TICKET_MAX_AGE_SECONDS = 5 * 60;
+var TICKET_MAX_CLOCK_SKEW_SECONDS = 30;
+async function verifyTicket(cache, receipt, expected) {
+  const publicKeyHex = await cache.getPublicKey();
+  if (typeof receipt.signature !== "string" || !receipt.signature) {
+    throw new AsKeyMismatchError("Ticket carries no signature \u2014 refusing to trust it.");
+  }
+  try {
+    await verifyReceiptSignature(receipt, publicKeyHex);
+  } catch (err) {
+    throw new AsKeyMismatchError(
+      `Ticket signature does not verify against the pinned Authority Server key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to execute.`
+    );
+  }
+  if (receipt.action !== expected.action) {
+    throw new TicketBindingMismatchError(
+      `Ticket action "${String(receipt.action)}" does not match the requested action "${expected.action}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.executionContext !== void 0 && hashToolArgs(receipt.executionContext ?? {}) !== hashToolArgs(expected.executionContext)) {
+    throw new TicketBindingMismatchError(
+      "Ticket executionContext does not match what this call requested \u2014 refusing to execute."
+    );
+  }
+  if (expected.authorizationId !== void 0 && receipt.authorizationId !== expected.authorizationId) {
+    throw new TicketBindingMismatchError(
+      `Ticket authorizationId "${String(receipt.authorizationId)}" does not match the requested grant "${expected.authorizationId}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.profileId !== void 0 && receipt.profileId !== expected.profileId) {
+    throw new TicketBindingMismatchError(
+      `Ticket profileId "${String(receipt.profileId)}" does not match the requested profile "${expected.profileId}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.proposalId !== void 0 && receipt.proposalId !== expected.proposalId) {
+    throw new TicketBindingMismatchError(
+      `Ticket proposalId "${String(receipt.proposalId)}" does not match the proposal being executed "${expected.proposalId}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.idempotencyKey !== void 0 && receipt.idempotencyKey !== expected.idempotencyKey) {
+    throw new TicketBindingMismatchError(
+      `Ticket idempotencyKey "${String(receipt.idempotencyKey)}" does not match the one this call sent "${expected.idempotencyKey}" \u2014 refusing to execute.`
+    );
+  }
+  if (expected.contentHash !== void 0) {
+    if (receipt.contentHash !== expected.contentHash) {
+      throw new TicketBindingMismatchError(
+        "Ticket contentHash does not match the content this call is bound to \u2014 refusing to execute."
+      );
+    }
+    if (expected.contentBinding !== void 0 && hashToolArgs(receipt.contentBinding ?? {}) !== hashToolArgs(expected.contentBinding)) {
+      throw new TicketBindingMismatchError(
+        "Ticket contentBinding does not match what this call requested \u2014 refusing to execute."
+      );
+    }
+  }
+  const timestamp = receipt.timestamp;
+  if (typeof timestamp !== "number" || !Number.isFinite(timestamp)) {
+    throw new TicketBindingMismatchError("Ticket carries no valid timestamp \u2014 refusing to execute.");
+  }
+  const nowSec3 = Math.floor(Date.now() / 1e3);
+  const ageSec = nowSec3 - timestamp;
+  if (ageSec > TICKET_MAX_AGE_SECONDS) {
+    throw new TicketBindingMismatchError(
+      `Ticket is ${ageSec}s old, older than the ${TICKET_MAX_AGE_SECONDS}s freshness window \u2014 refusing to execute.`
+    );
+  }
+  if (ageSec < -TICKET_MAX_CLOCK_SKEW_SECONDS) {
+    throw new TicketBindingMismatchError(
+      `Ticket is timestamped ${-ageSec}s in the future, beyond the ${TICKET_MAX_CLOCK_SKEW_SECONDS}s clock-skew tolerance \u2014 refusing to execute.`
+    );
+  }
+}
+
 // src/lib/arg-encoding.ts
 function rfc2047Encode(value) {
   if (!/[^\x00-\x7F]/.test(value)) return value;
@@ -2454,6 +3006,14 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             toolArgs: enrichedArgs,
             executionContext: { ...execution }
           });
+          state2.proposalSubmissions.record({
+            proposalId: proposal.id,
+            tool: tool.namespacedName,
+            toolArgs: enrichedArgs,
+            executionContext: { ...execution },
+            authorizationId: authzId,
+            profileId: auth.profileId
+          });
           return {
             content: [{
               type: "text",
@@ -2478,6 +3038,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
       try {
         const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, args, actionType);
+        const idempotencyKey = randomUUID();
         const { receipt } = await state2.spClient.postReceipt({
           authorizationId: authzId,
           // Optional cross-check — the AS fails closed on a mismatch.
@@ -2487,7 +3048,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           actionType,
           executionContext: { ...execution },
           amount: typeof execution.amount === "number" ? execution.amount : void 0,
-          idempotencyKey: randomUUID(),
+          idempotencyKey,
           // Privacy: send the hash and how to reproduce it — never the
           // preimage. `binding` also carries `boundContent`, the plaintext
           // that was hashed (an email's to/cc/subject/body); it stays on
@@ -2496,6 +3057,15 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
         });
         receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+        await verifyTicket(state2.cache, receipt, {
+          action: tool.namespacedName,
+          executionContext: { ...execution },
+          authorizationId: authzId,
+          profileId: auth.profileId,
+          idempotencyKey,
+          contentHash: binding?.contentHash,
+          contentBinding: binding?.contentBinding
+        });
         await state2.archiveReceipt(receipt, {
           authorizationId: authzId,
           profileId: auth.profileId,
@@ -2510,6 +3080,13 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           boundContent: binding?.boundContent
         });
       } catch (err) {
+        if (err instanceof AsKeyMismatchError || err instanceof TicketBindingMismatchError) {
+          void notifyControlPlane("as-key-mismatch");
+          return {
+            content: [{ type: "text", text: `Blocked: ${err.message}` }],
+            isError: true
+          };
+        }
         if (err instanceof ContentBindingError) {
           return {
             content: [{
@@ -2555,6 +3132,14 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               executionContext: { ...execution },
               pendingApprovers: uniqueApprovers
             });
+            state2.proposalSubmissions.record({
+              proposalId: proposal.id,
+              tool: tool.namespacedName,
+              toolArgs: enrichedArgs,
+              executionContext: { ...execution },
+              authorizationId: authzId,
+              profileId: auth.profileId
+            });
             return {
               content: [{
                 type: "text",
@@ -2962,6 +3547,9 @@ function listIntegrationsHandler(state2, integrationManager2) {
 
 // src/tools/commitments.ts
 import { ContentBindingError as ContentBindingError2 } from "@hap/core";
+function buildSkippedProposalNote(proposalId) {
+  return `Proposal ${proposalId} was approved, but was submitted from another device/installation of this operator (or one whose local record is gone) \u2014 this gateway will not execute it. Re-run the same request here to execute it from this gateway.`;
+}
 var installedExecutor = null;
 function installCommittedExecutor(executor) {
   installedExecutor = executor;
@@ -2987,6 +3575,28 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     );
   }
   const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
+  const submitted = state2.proposalSubmissions.get(proposal.id);
+  if (!submitted) {
+    console.error(
+      `[Suveren MCP] Proposal ${proposal.id} is committed but has no local submission record on this gateway \u2014 leaving it for whichever gateway submitted it (this is normal for a different device of the same operator, or the AS lists a proposal we never submitted).`
+    );
+    return { text: buildSkippedProposalNote(proposal.id) };
+  }
+  {
+    const mismatches = [];
+    if (submitted.tool !== proposal.tool) mismatches.push("tool");
+    if (submitted.toolArgsHash !== hashToolArgs(proposal.toolArgs)) mismatches.push("arguments");
+    if (submitted.executionContextHash !== hashToolArgs(proposal.executionContext)) mismatches.push("executionContext");
+    if (submitted.authorizationId !== proposal.authorizationId) mismatches.push("authorizationId");
+    if (submitted.profileId !== proposal.profileId) mismatches.push("profileId");
+    if (mismatches.length > 0) {
+      void notifyControlPlane("as-key-mismatch");
+      return {
+        text: `Blocked: proposal ${proposal.id} no longer matches what this gateway submitted (${mismatches.join(", ")} differ) \u2014 refusing to execute.`,
+        isError: true
+      };
+    }
+  }
   let receiptId;
   let replayed = false;
   try {
@@ -3022,6 +3632,15 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     });
     receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
     replayed = idempotent;
+    await verifyTicket(state2.cache, receipt, {
+      action: proposal.tool,
+      executionContext: proposal.executionContext,
+      authorizationId: proposal.authorizationId,
+      profileId: proposal.profileId,
+      proposalId: proposal.id,
+      contentHash: binding?.contentHash,
+      contentBinding: binding?.contentBinding
+    });
     await state2.archiveReceipt(receipt, {
       authorizationId: proposal.authorizationId,
       profileId: proposal.profileId,
@@ -3036,6 +3655,13 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       boundContent: binding?.boundContent
     });
   } catch (err) {
+    if (err instanceof AsKeyMismatchError || err instanceof TicketBindingMismatchError) {
+      void notifyControlPlane("as-key-mismatch");
+      return {
+        text: `Proposal ${proposal.id}: blocked \u2014 ${err.message}`,
+        isError: true
+      };
+    }
     if (err instanceof ContentBindingError2) {
       return {
         text: `Proposal ${proposal.id}: blocked \u2014 the approved content cannot be bound to the receipt. ${err.message}`,
@@ -3195,9 +3821,13 @@ Wait for the human to approve; do not re-submit the tool call.`
           }]
         };
       }
-      const lines = committed.map(
-        (p) => `${p.id}: tool=${p.tool}, status=${p.status}, committed=[${Object.keys(p.committedBy).join(",")}]`
-      );
+      const lines = committed.map((p) => {
+        const base = `${p.id}: tool=${p.tool}, status=${p.status}, committed=[${Object.keys(p.committedBy).join(",")}]`;
+        if (p.status === "committed" && !state2.proposalSubmissions.get(p.id)) {
+          return `${base} \u2014 SKIPPED HERE: ${buildSkippedProposalNote(p.id)}`;
+        }
+        return base;
+      });
       return {
         content: [{
           type: "text",
@@ -3394,16 +4024,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname6, join as join8 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join8(homedir7(), ".suveren");
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync11 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname9, join as join11 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join11(homedir8(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
-  constructor(dataDir) {
-    const dir = dataDir ?? DEFAULT_DATA_DIR;
-    this.filePath = join8(dir, "integrations.json");
+  constructor(dataDir2) {
+    const dir = dataDir2 ?? DEFAULT_DATA_DIR;
+    this.filePath = join11(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -3434,12 +4064,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync8(this.filePath)) {
-      mkdirSync6(dirname6(this.filePath), { recursive: true });
+    if (!existsSync11(this.filePath)) {
+      mkdirSync9(dirname9(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync8(this.filePath, "utf-8");
+      const raw = readFileSync12(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -3468,45 +4098,45 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync6(dirname6(this.filePath), { recursive: true });
-    writeFileSync6(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync9(dirname9(this.filePath), { recursive: true });
+    writeFileSync9(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
-import { homedir as homedir8 } from "os";
-import { join as join10, delimiter } from "path";
-import { existsSync as existsSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync10, rmSync } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join13, delimiter } from "path";
+import { existsSync as existsSync13, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
-import { join as join9, resolve } from "path";
+import { readFileSync as readFileSync13, existsSync as existsSync12 } from "fs";
+import { join as join12, resolve } from "path";
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join9(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join12(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join9(dir, "index.json");
-  if (!existsSync9(indexPath)) {
+  const indexPath = join12(dir, "index.json");
+  if (!existsSync12(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync9(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync13(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join9(dir, relativePath);
+    const manifestPath = join12(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync9(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync13(manifestPath, "utf-8"));
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -3594,26 +4224,26 @@ function safeHost(url) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join10(homedir8(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join10(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join13(DEFAULT_DATA_DIR2, "integrations");
 var installLock = Promise.resolve();
 function withInstallLock(task) {
   const run = installLock.then(task, task);
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join10(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join13(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync10(INTEGRATIONS_DIR)) {
-    mkdirSync7(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync13(INTEGRATIONS_DIR)) {
+    mkdirSync10(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join10(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync10(pkgPath)) {
-    writeFileSync7(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join13(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync13(pkgPath)) {
+    writeFileSync10(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -3679,19 +4309,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join10(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join10(pkgDir, "package.json");
-    if (!existsSync10(pkgDir) || !existsSync10(pkgJson)) return false;
+    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join13(pkgDir, "package.json");
+    if (!existsSync13(pkgDir) || !existsSync13(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync10(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync14(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync10(join10(pkgDir, target))) return false;
+        if (!existsSync13(join13(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync10(join10(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync13(join13(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -3705,7 +4335,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync10(join10(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync13(join13(INTEGRATIONS_BIN, c)));
   }
   /**
    * Install an npm package into the managed integrations directory if not
@@ -3729,8 +4359,8 @@ var IntegrationManager = class {
   }
   /** The actual install. Callers MUST hold the install lock. */
   async installNow(npmPackage) {
-    const pkgDir = join10(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync10(pkgDir)) {
+    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (existsSync13(pkgDir)) {
       console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -3844,6 +4474,11 @@ var IntegrationManager = class {
     const transport = new StdioClientTransport({
       command: config.command,
       args,
+      // `...process.env` is also how a saved `--ca-file` reaches an
+      // integration: NODE_EXTRA_CA_CERTS (read by Node only at process
+      // start) is already set on THIS process by bundle/server.js before
+      // the MCP server ever starts, so every integration this manager spawns
+      // inherits it here for free — no separate handling needed.
       env: {
         ...process.env,
         PATH: buildPath(),
@@ -4160,28 +4795,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
-import { join as join11, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { join as join14, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join11(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join11(dir, "index.json");
-  if (!existsSync11(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join14(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join14(dir, "index.json");
+  if (!existsSync14(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync11(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync15(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join11(dir, relativePath);
+    const profilePath = join14(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync11(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync15(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -4217,8 +4852,8 @@ function warnNoProfiles(reason) {
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync12, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join12 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync16, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname10, join as join15 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -4245,8 +4880,8 @@ var CommittedExecutor = class {
 var ExecutorLock = class {
   path;
   held = false;
-  constructor(dataDir) {
-    this.path = join12(dataDir, "executor.lock");
+  constructor(dataDir2) {
+    this.path = join15(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -4254,9 +4889,9 @@ var ExecutorLock = class {
     if (current && current.pid !== process.pid && isAlive(current.pid)) {
       return { held: false, holderPid: current.pid };
     }
-    mkdirSync8(dirname7(this.path), { recursive: true, mode: 448 });
+    mkdirSync11(dirname10(this.path), { recursive: true, mode: 448 });
     const lock = { pid: process.pid, startedAt: Math.floor(Date.now() / 1e3) };
-    writeFileSync8(this.path, JSON.stringify(lock), { mode: 384 });
+    writeFileSync11(this.path, JSON.stringify(lock), { mode: 384 });
     this.held = true;
     return { held: true };
   }
@@ -4272,15 +4907,15 @@ var ExecutorLock = class {
     const current = this.read();
     if (current?.pid === process.pid) {
       try {
-        unlinkSync5(this.path);
+        unlinkSync6(this.path);
       } catch {
       }
     }
   }
   read() {
-    if (!existsSync12(this.path)) return null;
+    if (!existsSync15(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync12(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync16(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -4297,11 +4932,48 @@ function isAlive(pid) {
 }
 
 // bin/http.ts
-import { homedir as homedir9 } from "os";
-import { join as join13 } from "path";
-var spUrl = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
+import { homedir as homedir10 } from "os";
+import { join as join17 } from "path";
+
+// src/lib/mcp-as-tracker.ts
+import { existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11, join as join16 } from "path";
+function trackerPath(dataDir2) {
+  return join16(dataDir2, "mcp-as-pairing.json");
+}
+function readMcpPairedAsUrl(dataDir2) {
+  const path = trackerPath(dataDir2);
+  if (!existsSync16(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync17(path, "utf-8"));
+    return typeof data.asUrl === "string" ? data.asUrl : null;
+  } catch {
+    return null;
+  }
+}
+function writeMcpPairedAsUrl(dataDir2, asUrl) {
+  const path = trackerPath(dataDir2);
+  mkdirSync12(dirname11(path), { recursive: true, mode: 448 });
+  writeFileSync12(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
+}
+
+// bin/http.ts
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+var spUrl = resolveAsUrl(dataDir);
+validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
-var state = new SharedState(spUrl);
+setAsBaseUrl(spUrl);
+var state = new SharedState(spUrl, void 0, dataDir);
+(function repairIfAsUrlChanged() {
+  const lastKnown = readMcpPairedAsUrl(dataDir);
+  if (lastKnown !== null && lastKnown !== spUrl) {
+    console.error(
+      `[Suveren MCP] Authority Server changed (${lastKnown} \u2192 ${spUrl}) \u2014 clearing cached mandates. Sign in again to re-pair.`
+    );
+    state.gateStore.clearAll();
+  }
+  writeMcpPairedAsUrl(dataDir, spUrl);
+})();
 var spApiKey = process.env.SUVEREN_AS_API_KEY ?? "";
 if (spApiKey) {
   state.spClient.setApiKey(spApiKey);
@@ -4371,9 +5043,11 @@ app.post("/internal/configure", internalOnly, (req, res) => {
   }
   res.json({ ok: true });
 });
-app.post("/internal/clear-session", internalOnly, (_req, res) => {
-  state.spClient.clearSession();
-  console.error("[Suveren MCP] Session cleared by control-plane (AS session ended)");
+app.post("/internal/clear-session", internalOnly, (req, res) => {
+  const reason = req.body?.reason;
+  const validReason = reason === "as-key-mismatch" || reason === "as-tls-mismatch" || reason === "as-url-changed" ? reason : void 0;
+  state.spClient.clearSession(validReason);
+  console.error(`[Suveren MCP] Session cleared by control-plane (${validReason ?? "expired"})`);
   res.json({ ok: true });
 });
 app.post("/internal/gate-content", internalOnly, async (req, res) => {
@@ -4665,6 +5339,15 @@ app.get("/internal/authorizations", internalOnly, (_req, res) => {
 app.get("/internal/manifests", internalOnly, (_req, res) => {
   res.json({ manifests: getAllManifests() });
 });
+app.get("/internal/skipped-commitments", internalOnly, async (_req, res) => {
+  try {
+    const committed = await state.spClient.getCommittedProposals();
+    const skipped = committed.filter((p) => !state.proposalSubmissions.get(p.id)).map((p) => ({ id: p.id, tool: p.tool, note: buildSkippedProposalNote(p.id) }));
+    res.json({ skipped });
+  } catch (err) {
+    res.status(502).json({ error: err instanceof Error ? err.message : "Could not reach the Authority Server" });
+  }
+});
 app.get("/internal/evidence", internalOnly, (_req, res) => {
   if (state.receiptArchive.isLocked()) {
     res.status(503).json({ error: "Vault locked \u2014 the evidence archive is encrypted until sign-in." });
@@ -4798,12 +5481,12 @@ app.listen(port, "0.0.0.0", () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
-  const executorLock = new ExecutorLock(dataDir);
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
+  const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {
     console.error(
-      `[Suveren MCP] Committed-proposal execution is DISABLED in this process: pid ${lock.holderPid} holds ${dataDir}/executor.lock. Approved proposals will run there. Stop that gateway if this one should execute.`
+      `[Suveren MCP] Committed-proposal execution is DISABLED in this process: pid ${lock.holderPid} holds ${dataDir2}/executor.lock. Approved proposals will run there. Stop that gateway if this one should execute.`
     );
   }
   for (const sig of ["SIGINT", "SIGTERM", "exit"]) {