@suveren/gateway 0.9.0 → 0.10.0

package/dist/control-plane/index.mjs

@@ -4,8 +4,8 @@ import {
 } from "./chunk-3BNWN6VP.mjs";
 
 // src/index.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync10, renameSync as renameSync2 } from "fs";
+import { randomBytes as randomBytes3 } from "crypto";
+import { existsSync as existsSync9, readFileSync as readFileSync11, renameSync as renameSync2 } from "fs";
 import { dirname as dirname8, join as join11 } from "path";
 import { homedir as homedir7 } from "os";
 import express from "express";
@@ -117,6 +117,13 @@ var Vault = class {
     this.clearKey();
     this.lockedReason = "as-key-mismatch";
   }
+  /** Lock because a pin-tls-enforced connection to the Authority Server
+   *  presented a certificate whose public key doesn't match the one pinned
+   *  at pairing — see as-tls-pin.ts. Mirrors lockAsKeyMismatch() exactly. */
+  lockAsTlsMismatch() {
+    this.clearKey();
+    this.lockedReason = "as-tls-mismatch";
+  }
   /**
    * Boot-time only: record that the gateway starts locked because the
    * resolved Authority Server URL differs from the one it was last paired
@@ -673,18 +680,38 @@ function readPairing(dataDir) {
   try {
     const data = JSON.parse(readFileSync3(path, "utf-8"));
     if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
-    return { asUrl: data.asUrl, publicKeyHex: data.publicKeyHex, pairedAt: data.pairedAt ?? "" };
+    return {
+      asUrl: data.asUrl,
+      publicKeyHex: data.publicKeyHex,
+      pairedAt: data.pairedAt ?? "",
+      ...typeof data.tlsSpkiPinHex === "string" ? { tlsSpkiPinHex: data.tlsSpkiPinHex } : {}
+    };
   } catch {
     return null;
   }
 }
-function writePairing(dataDir, asUrl, publicKeyHex) {
-  const pairing = { asUrl, publicKeyHex, pairedAt: (/* @__PURE__ */ new Date()).toISOString() };
+function writePairing(dataDir, asUrl, publicKeyHex, opts = {}) {
+  const pairing = {
+    asUrl,
+    publicKeyHex,
+    pairedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...opts.tlsSpkiPinHex ? { tlsSpkiPinHex: opts.tlsSpkiPinHex } : {}
+  };
   const path = pairingPath(dataDir);
   mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
   writeFileSync2(path, JSON.stringify(pairing, null, 2), { encoding: "utf-8", mode: 384 });
   return pairing;
 }
+function recordTlsPin(dataDir, asUrl, tlsSpkiPinHex) {
+  const existing = readPairing(dataDir);
+  if (!existing || existing.asUrl !== asUrl) return;
+  const path = pairingPath(dataDir);
+  writeFileSync2(
+    path,
+    JSON.stringify({ ...existing, tlsSpkiPinHex }, null, 2),
+    { encoding: "utf-8", mode: 384 }
+  );
+}
 function clearPairing(dataDir) {
   const path = pairingPath(dataDir);
   try {
@@ -698,46 +725,450 @@ function fingerprintOf(publicKeyHex) {
   return digest.match(/.{1,4}/g)?.join(":") ?? digest;
 }
 
+// src/lib/as-challenge.ts
+import { createPublicKey, randomBytes as randomBytes2, verify as cryptoVerify } from "crypto";
+import { canonicalize } from "@hap/core";
+
+// src/lib/as-tls-pin.ts
+import { createHash as createHash3 } from "crypto";
+import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
+import { Agent as HttpsAgent } from "https";
+import { readFileSync as readFileSync4 } from "fs";
+import { Agent, fetch as undiciFetch } from "undici";
+function effectiveCa() {
+  const path = process.env.NODE_EXTRA_CA_CERTS;
+  if (!path) return void 0;
+  try {
+    return [...rootCertificates, readFileSync4(path, "utf-8")];
+  } catch {
+    return void 0;
+  }
+}
+var PIN_CHECK_ERROR_CODE = "EAS_TLS_PIN_CHECK";
+function taggedCheckError(err) {
+  err.code = PIN_CHECK_ERROR_CODE;
+  return err;
+}
+function isPinCheckError(err) {
+  let cur = err;
+  for (let i = 0; i < 5 && cur; i++) {
+    if (cur instanceof Error && cur.code === PIN_CHECK_ERROR_CODE) return true;
+    cur = cur instanceof Error ? cur.cause : void 0;
+  }
+  return false;
+}
+var AsTlsMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsTlsMismatchError";
+  }
+};
+function spkiSha256Hex(cert) {
+  if (!cert.pubkey) {
+    throw new Error("peer certificate carries no pubkey (expected the detailed certificate object)");
+  }
+  return createHash3("sha256").update(cert.pubkey).digest("hex");
+}
+function formatPinFingerprint(hex) {
+  const upper = hex.toUpperCase();
+  return upper.match(/.{1,4}/g)?.join(":") ?? upper;
+}
+function pinnedCheckServerIdentity(pinnedSpkiHex) {
+  const wantHex = pinnedSpkiHex.toLowerCase();
+  return (hostname, cert) => {
+    const defaultErr = defaultCheckServerIdentity(hostname, cert);
+    if (defaultErr) return taggedCheckError(defaultErr);
+    let actualHex;
+    try {
+      actualHex = spkiSha256Hex(cert);
+    } catch (err) {
+      return taggedCheckError(new Error(
+        `could not read the server certificate's public key to check the TLS pin \u2014 ${err instanceof Error ? err.message : String(err)}`
+      ));
+    }
+    if (actualHex !== wantHex) {
+      return taggedCheckError(new Error(
+        `TLS certificate pin mismatch for ${hostname}: expected SPKI sha256 ${formatPinFingerprint(wantHex)}, got ${formatPinFingerprint(actualHex)}.`
+      ));
+    }
+    return void 0;
+  };
+}
+function buildPinnedDispatcher(pinnedSpkiHex) {
+  return new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
+    }
+  });
+}
+function buildCapturingDispatcher() {
+  let captured;
+  const dispatcher = new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: (hostname, cert) => {
+        captured = cert;
+        const defaultErr = defaultCheckServerIdentity(hostname, cert);
+        return defaultErr ? taggedCheckError(defaultErr) : void 0;
+      }
+    }
+  });
+  return { dispatcher, getCapturedCert: () => captured };
+}
+function buildPinnedHttpsAgent(getPinning) {
+  return new HttpsAgent({
+    checkServerIdentity: (hostname, cert) => {
+      const pinning = getPinning();
+      if (!pinning.enforce) return defaultCheckServerIdentity(hostname, cert);
+      if (!pinning.pinnedSpkiHex) {
+        return taggedCheckError(new Error(
+          `pin-tls is on but no certificate is pinned yet for ${hostname} \u2014 sign in again to establish it (re-pairing required).`
+        ));
+      }
+      return pinnedCheckServerIdentity(pinning.pinnedSpkiHex)(hostname, cert);
+    },
+    ca: effectiveCa()
+  });
+}
+async function fetchAs(url, init, pinning) {
+  if (!pinning.enforce && !pinning.capture) {
+    const res2 = await fetch(url, init);
+    return { res: res2 };
+  }
+  if (pinning.enforce && !pinning.capture && !pinning.pinnedSpkiHex) {
+    throw new AsTlsMismatchError(
+      `pin-tls is on but no certificate is pinned yet for ${url} \u2014 sign in again to establish it (re-pairing required).`
+    );
+  }
+  if (pinning.pinnedSpkiHex && (pinning.enforce || !pinning.capture)) {
+    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex);
+    try {
+      const res2 = await undiciFetch(url, { ...init, dispatcher: dispatcher2 });
+      return { res: res2 };
+    } catch (err) {
+      if (!isPinCheckError(err)) throw err;
+      throw new AsTlsMismatchError(
+        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. If the Authority Server's certificate changed intentionally (a new key, not just renewal), an operator must clear the pairing and sign in again to re-pin it.`
+      );
+    }
+  }
+  const { dispatcher, getCapturedCert } = buildCapturingDispatcher();
+  let res;
+  try {
+    res = await undiciFetch(url, { ...init, dispatcher });
+  } catch (err) {
+    if (!isPinCheckError(err)) throw err;
+    throw new AsTlsMismatchError(
+      `could not verify the Authority Server at ${url} while establishing its TLS pin \u2014 ${describeFetchError(err)}.`
+    );
+  }
+  const cert = getCapturedCert();
+  return { res, capturedSpkiHex: cert ? spkiSha256Hex(cert) : void 0 };
+}
+function describeFetchError(err) {
+  if (err instanceof Error) {
+    const cause = err.cause;
+    if (cause instanceof Error) return cause.message;
+    return err.message;
+  }
+  return String(err);
+}
+
+// src/lib/as-challenge.ts
+var AsChallengeUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsChallengeUnreachableError";
+  }
+};
+var AsChallengeInvalidError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsChallengeInvalidError";
+  }
+};
+var CHALLENGE_MAX_SKEW_SECONDS = 300;
+var CHALLENGE_TYPE = "hap-as-challenge";
+var CHALLENGE_DOMAIN_PREFIX = "hap-as-challenge\0";
+function challengeSigningBytes(unsigned) {
+  return Buffer.concat([
+    Buffer.from(CHALLENGE_DOMAIN_PREFIX, "utf-8"),
+    Buffer.from(canonicalize({ typ: unsigned.typ, nonce: unsigned.nonce, issuedAt: unsigned.issuedAt }), "utf-8")
+  ]);
+}
+function publicKeyFromHex(publicKeyHex) {
+  const raw = Buffer.from(publicKeyHex, "hex");
+  return createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") }, format: "jwk" });
+}
+function verifyChallengeSignature(publicKeyHex, unsigned, signature) {
+  try {
+    const base64 = signature.replace(/-/g, "+").replace(/_/g, "/");
+    const padding = base64.length % 4 === 0 ? "" : "=".repeat(4 - base64.length % 4);
+    const sigBytes = Buffer.from(base64 + padding, "base64");
+    const key = publicKeyFromHex(publicKeyHex);
+    return cryptoVerify(null, challengeSigningBytes(unsigned), key, sigBytes);
+  } catch {
+    return false;
+  }
+}
+async function verifyAsHoldsKey(asUrl, publicKeyHex, pinning = { enforce: false, capture: true }) {
+  const nonce = randomBytes2(32).toString("base64url");
+  let res;
+  let capturedSpkiHex;
+  try {
+    const result = await fetchAs(
+      `${asUrl}/api/as/challenge`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ nonce }),
+        signal: AbortSignal.timeout(5e3)
+      },
+      pinning
+    );
+    res = result.res;
+    capturedSpkiHex = result.capturedSpkiHex;
+  } catch (err) {
+    if (err instanceof AsTlsMismatchError) throw err;
+    throw new AsChallengeUnreachableError(
+      `could not reach the Authority Server at ${asUrl} to verify it holds its signing key \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!res.ok) {
+    throw new AsChallengeUnreachableError(
+      `the Authority Server at ${asUrl} answered its signing-key challenge with HTTP ${res.status}`
+    );
+  }
+  const body = await res.json().catch(() => null);
+  if (!body) {
+    throw new AsChallengeUnreachableError(
+      `the Authority Server at ${asUrl} returned a malformed response to its signing-key challenge`
+    );
+  }
+  if (body.typ !== CHALLENGE_TYPE) {
+    throw new AsChallengeInvalidError(
+      `the challenge response carries the wrong type ("${String(body.typ)}", expected "${CHALLENGE_TYPE}")`
+    );
+  }
+  if (body.nonce !== nonce) {
+    throw new AsChallengeInvalidError(
+      "the challenge response echoes a different nonce than the one sent"
+    );
+  }
+  if (typeof body.issuedAt !== "number" || !Number.isFinite(body.issuedAt)) {
+    throw new AsChallengeInvalidError("the challenge response carries no valid issuedAt");
+  }
+  const skew = Math.abs(Math.floor(Date.now() / 1e3) - body.issuedAt);
+  if (skew > CHALLENGE_MAX_SKEW_SECONDS) {
+    throw new AsChallengeInvalidError(
+      `the challenge response is timestamped ${skew}s away from now, beyond the ${CHALLENGE_MAX_SKEW_SECONDS}s tolerance`
+    );
+  }
+  if (typeof body.signature !== "string" || !body.signature) {
+    throw new AsChallengeInvalidError("the challenge response carries no signature");
+  }
+  if (!verifyChallengeSignature(publicKeyHex, { typ: body.typ, nonce: body.nonce, issuedAt: body.issuedAt }, body.signature)) {
+    throw new AsChallengeInvalidError(
+      "the challenge signature does not verify under the key being checked \u2014 this is exactly what the challenge exists to catch: something answered the request but does not hold the matching private key."
+    );
+  }
+  return { capturedTlsSpkiHex: capturedSpkiHex };
+}
+
+// src/lib/as-config.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+var DEFAULT_AS_URL = "https://www.suveren.ai";
+function configPath(dataDir) {
+  return join4(dataDir, "config.json");
+}
+function readAsConfigStrict(dataDir) {
+  const path = configPath(dataDir);
+  if (!existsSync3(path)) return {};
+  let data;
+  try {
+    data = JSON.parse(readFileSync5(path, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const out = {};
+  if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+  if (typeof data.caFile === "string") out.caFile = data.caFile;
+  if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+  if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+  return out;
+}
+function readAsConfig(dataDir) {
+  const path = configPath(dataDir);
+  if (!existsSync3(path)) return {};
+  try {
+    const data = JSON.parse(readFileSync5(path, "utf-8"));
+    const out = {};
+    if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+    if (typeof data.caFile === "string") out.caFile = data.caFile;
+    if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+    if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+    return out;
+  } catch {
+    return {};
+  }
+}
+function writeAsConfig(dataDir, patch) {
+  const merged = { ...readAsConfig(dataDir), ...patch };
+  const path = configPath(dataDir);
+  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  writeFileSync3(path, JSON.stringify(merged, null, 2), { encoding: "utf-8", mode: 384 });
+  return merged;
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function resolveAsUrl(dataDir, flag) {
+  if (flag) {
+    const v = validateAsUrl(flag);
+    if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
+    return v.url;
+  }
+  const envUrl = process.env.SUVEREN_AS_URL;
+  if (envUrl) {
+    const v = validateAsUrl(envUrl);
+    if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
+    return v.url;
+  }
+  const saved = readAsConfigStrict(dataDir).asUrl;
+  if (saved) {
+    const v = validateAsUrl(saved);
+    if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir}/config.json: ${v.error}`);
+    return v.url;
+  }
+  return DEFAULT_AS_URL;
+}
+function resolvePinTls(dataDir) {
+  return readAsConfig(dataDir).pinTls === true;
+}
+function validatePinTlsForUrl(pinTls, asUrl) {
+  if (!pinTls) return;
+  if (!asUrl.startsWith("https:")) {
+    throw new Error(
+      `config.json sets "pinTls": true, but the Authority Server URL (${asUrl}) is not https:// \u2014 there is no TLS certificate to pin. Fix the saved as-url, or turn pin-tls off: \`suveren-gateway config set pin-tls off\`.`
+    );
+  }
+}
+function resolvePinTlsExpectedFingerprint(dataDir) {
+  return readAsConfig(dataDir).pinTlsExpectedFingerprint;
+}
+function clearPinTlsExpectedFingerprint(dataDir) {
+  if (readAsConfig(dataDir).pinTlsExpectedFingerprint === void 0) return;
+  writeAsConfig(dataDir, { pinTlsExpectedFingerprint: void 0 });
+}
+
 // src/routes/auth.ts
 var DEFAULT_SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
-async function checkAsKeyBeforeLogin(asUrl, dataDir) {
-  let publicKeyHex;
+async function fetchAsPublicKey(asUrl) {
   try {
     const res = await fetch(`${asUrl}/api/as/pubkey`, { signal: AbortSignal.timeout(5e3) });
     if (!res.ok) {
       return {
         ok: false,
-        error: "as_unreachable",
-        message: `Could not reach the Authority Server at ${asUrl} to verify its signing key (HTTP ${res.status}). Refusing to sign in.`
+        message: `Could not reach the Authority Server at ${asUrl} to read its signing key (HTTP ${res.status}). Refusing to sign in.`
       };
     }
     const body = await res.json().catch(() => null);
     if (!body || typeof body.publicKey !== "string" || !body.publicKey) {
       return {
         ok: false,
-        error: "as_unreachable",
         message: `The Authority Server at ${asUrl} returned a malformed signing key. Refusing to sign in.`
       };
     }
-    publicKeyHex = body.publicKey;
+    return { ok: true, publicKeyHex: body.publicKey };
   } catch (err) {
     return {
       ok: false,
-      error: "as_unreachable",
-      message: `Could not reach the Authority Server at ${asUrl} to verify its signing key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
+      message: `Could not reach the Authority Server at ${asUrl} to read its signing key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to sign in.`
     };
   }
+}
+async function checkAsKeyBeforeLogin(asUrl, dataDir) {
   const existing = readPairing(dataDir);
-  if (existing && existing.asUrl === asUrl && existing.publicKeyHex !== publicKeyHex) {
-    return {
-      ok: false,
-      error: "as_key_mismatch",
-      message: `The Authority Server at ${asUrl} presented a signing key that does not match the one pinned when this gateway last signed in (pinned fingerprint ${fingerprintOf(existing.publicKeyHex)}, now seeing ${fingerprintOf(publicKeyHex)}). Refusing to sign in. If the AS's key changed intentionally, an operator must clear the old pairing before signing in again.`
-    };
+  const pinnedKey = existing && existing.asUrl === asUrl ? existing.publicKeyHex : void 0;
+  const existingTlsPin = (existing && existing.asUrl === asUrl ? existing.tlsSpkiPinHex : void 0) ?? resolvePinTlsExpectedFingerprint(dataDir);
+  let candidateKey;
+  if (pinnedKey) {
+    candidateKey = pinnedKey;
+  } else {
+    const fetched = await fetchAsPublicKey(asUrl);
+    if (!fetched.ok) {
+      return { ok: false, error: "as_unreachable", message: fetched.message };
+    }
+    candidateKey = fetched.publicKeyHex;
   }
-  return { ok: true, publicKeyHex };
+  const pinning = {
+    enforce: resolvePinTls(dataDir),
+    pinnedSpkiHex: existingTlsPin,
+    capture: true
+  };
+  let capturedTlsSpkiHex;
+  try {
+    const result = await verifyAsHoldsKey(asUrl, candidateKey, pinning);
+    capturedTlsSpkiHex = result.capturedTlsSpkiHex;
+  } catch (err) {
+    if (err instanceof AsTlsMismatchError) {
+      return { ok: false, error: "as_tls_mismatch", message: err.message };
+    }
+    if (err instanceof AsChallengeUnreachableError) {
+      return { ok: false, error: "as_unverified", message: `${err.message}. Refusing to sign in.` };
+    }
+    if (err instanceof AsChallengeInvalidError) {
+      if (pinnedKey) {
+        return {
+          ok: false,
+          error: "as_key_mismatch",
+          message: `The Authority Server at ${asUrl} does not match the one pinned when this gateway last signed in (pinned fingerprint ${fingerprintOf(pinnedKey)}) \u2014 its signing-key challenge did not verify (${err.message}). Refusing to sign in. If the AS's key changed intentionally, an operator must clear the old pairing before signing in again.`
+        };
+      }
+      return {
+        ok: false,
+        error: "as_unverified",
+        message: `The Authority Server at ${asUrl} could not prove it holds the signing key it presented \u2014 ${err.message}. Refusing to sign in.`
+      };
+    }
+    throw err;
+  }
+  return {
+    ok: true,
+    publicKeyHex: candidateKey,
+    // A fresh capture (always present for https, unless pin-tls is on and
+    // an existing pin was enforced instead — see fetchAs) wins; otherwise
+    // whatever was already on file carries through unchanged.
+    tlsSpkiPinHex: capturedTlsSpkiHex ?? existingTlsPin
+  };
 }
-function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished, pairing) {
+function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished, pairing, lockAsTlsMismatch2 = () => {
+}) {
   const router = Router();
   const SP_URL2 = pairing?.asUrl ?? DEFAULT_SP_URL;
   router.post("/login", loginRateLimit2, async (req, res) => {
@@ -752,24 +1183,43 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
       if (pairing) {
         keyCheck = await checkAsKeyBeforeLogin(pairing.asUrl, pairing.dataDir);
         if (!keyCheck.ok) {
-          res.status(keyCheck.error === "as_key_mismatch" ? 409 : 502).json({
+          const status = keyCheck.error === "as_key_mismatch" || keyCheck.error === "as_tls_mismatch" ? 409 : 502;
+          res.status(status).json({
             error: keyCheck.error,
             message: keyCheck.message
           });
           return;
         }
       }
-      const spRes = await fetch(`${SP_URL2}/api/auth/session`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "X-API-Key": apiKey,
-          // The AS grants a 30-day gateway session ONLY to a login that
-          // identifies itself this way; without it, a 24-hour browser
-          // session (see doc at the top of this file).
-          ...clientVersionHeaders()
+      const sessionPinning = {
+        enforce: Boolean(pairing && resolvePinTls(pairing.dataDir)),
+        pinnedSpkiHex: keyCheck?.tlsSpkiPinHex
+      };
+      let spRes;
+      try {
+        const result = await fetchAs(
+          `${SP_URL2}/api/auth/session`,
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "X-API-Key": apiKey,
+              // The AS grants a 30-day gateway session ONLY to a login that
+              // identifies itself this way; without it, a 24-hour browser
+              // session (see doc at the top of this file).
+              ...clientVersionHeaders()
+            }
+          },
+          sessionPinning
+        );
+        spRes = result.res;
+      } catch (err) {
+        if (err instanceof AsTlsMismatchError) {
+          res.status(409).json({ error: "as_tls_mismatch", message: err.message });
+          return;
         }
-      });
+        throw err;
+      }
       if (!spRes.ok) {
         const err = await spRes.json().catch(() => ({ error: "Invalid API key" }));
         res.status(spRes.status).json(err);
@@ -778,9 +1228,15 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
       if (pairing && keyCheck?.publicKeyHex) {
         const existing = readPairing(pairing.dataDir);
         if (!existing || existing.asUrl !== pairing.asUrl) {
-          writePairing(pairing.dataDir, pairing.asUrl, keyCheck.publicKeyHex);
+          writePairing(pairing.dataDir, pairing.asUrl, keyCheck.publicKeyHex, {
+            tlsSpkiPinHex: keyCheck.tlsSpkiPinHex
+          });
           console.error(`[Control Plane] Paired with Authority Server ${pairing.asUrl} (fingerprint ${fingerprintOf(keyCheck.publicKeyHex)})`);
+        } else if (keyCheck.tlsSpkiPinHex && keyCheck.tlsSpkiPinHex !== existing.tlsSpkiPinHex) {
+          recordTlsPin(pairing.dataDir, pairing.asUrl, keyCheck.tlsSpkiPinHex);
+          console.error(`[Control Plane] TLS pin for Authority Server ${pairing.asUrl} captured/updated.`);
         }
+        clearPinTlsExpectedFingerprint(pairing.dataDir);
       }
       const data = await spRes.json();
       const setCookieHeaders = spRes.headers.getSetCookie?.() ?? [];
@@ -828,10 +1284,11 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
           const kp = await loadOrGenerateKeyPair(vault2);
           const localPubkeyB64 = Buffer.from(kp.publicKey).toString("base64");
           const spCookie = vault2.getSpCookie();
-          const meKeyRes = await fetch(`${SP_URL2}/api/users/me/pubkey`, {
-            headers: spCookie ? { Cookie: spCookie } : {},
-            signal: AbortSignal.timeout(5e3)
-          });
+          const { res: meKeyRes } = await fetchAs(
+            `${SP_URL2}/api/users/me/pubkey`,
+            { headers: spCookie ? { Cookie: spCookie } : {}, signal: AbortSignal.timeout(5e3) },
+            sessionPinning
+          );
           let needsUpdate = false;
           if (meKeyRes.status === 404) {
             needsUpdate = true;
@@ -840,15 +1297,19 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
             needsUpdate = meKeyData.pubkey !== localPubkeyB64;
           }
           if (needsUpdate) {
-            const putRes = await fetch(`${SP_URL2}/api/users/me/pubkey`, {
-              method: "PUT",
-              headers: {
-                "Content-Type": "application/json",
-                ...spCookie ? { Cookie: spCookie } : {}
+            const { res: putRes } = await fetchAs(
+              `${SP_URL2}/api/users/me/pubkey`,
+              {
+                method: "PUT",
+                headers: {
+                  "Content-Type": "application/json",
+                  ...spCookie ? { Cookie: spCookie } : {}
+                },
+                body: JSON.stringify({ pubkey: localPubkeyB64 }),
+                signal: AbortSignal.timeout(5e3)
               },
-              body: JSON.stringify({ pubkey: localPubkeyB64 }),
-              signal: AbortSignal.timeout(5e3)
-            });
+              sessionPinning
+            );
             if (!putRes.ok) {
               console.error(`[Control Plane] E2EE pubkey registration failed: ${putRes.status}`);
             } else {
@@ -858,7 +1319,12 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
             console.error("[Control Plane] E2EE pubkey already up to date");
           }
         } catch (err) {
-          console.error("[Control Plane] E2EE pubkey auto-register failed:", err);
+          if (err instanceof AsTlsMismatchError) {
+            console.error("[Control Plane] E2EE pubkey auto-register aborted \u2014 TLS pin mismatch:", err.message);
+            lockAsTlsMismatch2();
+          } else {
+            console.error("[Control Plane] E2EE pubkey auto-register failed:", err);
+          }
         }
         for (const credId of vault2.listCredentials()) {
           try {
@@ -895,12 +1361,20 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablis
   router.post("/logout", logoutAuth, async (_req, res) => {
     const cookie = vault2.getSpCookie();
     vault2.clearKey();
+    const logoutPinning = pairing ? { enforce: resolvePinTls(pairing.dataDir), pinnedSpkiHex: readPairing(pairing.dataDir)?.tlsSpkiPinHex } : { enforce: false };
     await Promise.allSettled([
       unconfigureSession(),
-      cookie ? fetch(`${SP_URL2}/api/auth/logout`, {
-        method: "POST",
-        headers: { cookie, ...clientVersionHeaders() },
-        redirect: "manual"
+      cookie ? fetchAs(
+        `${SP_URL2}/api/auth/logout`,
+        { method: "POST", headers: { cookie, ...clientVersionHeaders() }, redirect: "manual" },
+        logoutPinning
+      ).catch((err) => {
+        if (err instanceof AsTlsMismatchError) {
+          console.error("[Control Plane] Logout: TLS pin mismatch talking to the Authority Server \u2014 local sign-out still applied:", err.message);
+          lockAsTlsMismatch2();
+        } else {
+          throw err;
+        }
       }) : Promise.resolve()
     ]);
     res.json({ ok: true });
@@ -1512,18 +1986,18 @@ async function testAIConnectivity(config) {
 }
 
 // src/lib/agent-brief-store.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
 function agentBriefPath() {
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join4(homedir2(), ".suveren");
-  return join4(dataDir, "context.md");
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
+  return join5(dataDir, "context.md");
 }
 function readAgentBrief() {
   const filePath = agentBriefPath();
-  if (!existsSync3(filePath)) return "";
-  return readFileSync4(filePath, "utf-8");
+  if (!existsSync4(filePath)) return "";
+  return readFileSync6(filePath, "utf-8");
 }
 
 // src/routes/ai.ts
@@ -1887,7 +2361,7 @@ function createMCPRouter() {
 // src/routes/autostart.ts
 import { Router as Router6 } from "express";
 import { execFile } from "child_process";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { dirname as pathDirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
@@ -1908,7 +2382,7 @@ function findCli(dirname9 = MODULE_DIR) {
     // resolves differently between a shell and a login service — and it would
     // mask a genuinely missing CLI whenever the cwd happened to be the repo.
   ];
-  return candidates.find(existsSync4) ?? null;
+  return candidates.find(existsSync5) ?? null;
 }
 async function cli(args) {
   const bin = findCli();
@@ -1989,17 +2463,17 @@ function createAutostartRouter() {
 import { spawn, spawnSync } from "child_process";
 
 // src/lib/notifier-icon.ts
-import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, existsSync as existsSync5 } from "fs";
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync6 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5, dirname as dirname3 } from "path";
+import { join as join6, dirname as dirname4 } from "path";
 var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
 function ensureNotifierIcon(dataDir) {
   try {
-    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join5(homedir3(), ".suveren");
-    const path = join5(dir, "notifier-icon.png");
-    if (!existsSync5(path)) {
-      mkdirSync3(dirname3(path), { recursive: true });
-      writeFileSync3(path, Buffer.from(ICON_BASE64, "base64"));
+    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
+    const path = join6(dir, "notifier-icon.png");
+    if (!existsSync6(path)) {
+      mkdirSync4(dirname4(path), { recursive: true });
+      writeFileSync4(path, Buffer.from(ICON_BASE64, "base64"));
     }
     return path;
   } catch {
@@ -2201,24 +2675,24 @@ import { Router as Router9 } from "express";
 
 // src/routes/approved-intents.ts
 import { Router as Router8 } from "express";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync7, mkdirSync as mkdirSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
-var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join6(homedir4(), ".suveren");
-var FILE_PATH = join6(SUVEREN_DATA_DIR, "approved-intents.enc.json");
+import { join as join7 } from "path";
+var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
+var FILE_PATH = join7(SUVEREN_DATA_DIR, "approved-intents.enc.json");
 function readFile() {
-  if (!existsSync6(FILE_PATH)) {
+  if (!existsSync7(FILE_PATH)) {
     return { version: 1, entries: {} };
   }
   try {
-    return JSON.parse(readFileSync5(FILE_PATH, "utf-8"));
+    return JSON.parse(readFileSync7(FILE_PATH, "utf-8"));
   } catch {
     return { version: 1, entries: {} };
   }
 }
 function writeFile(data) {
-  mkdirSync4(SUVEREN_DATA_DIR, { recursive: true });
-  writeFileSync4(FILE_PATH, JSON.stringify(data, null, 2), "utf-8");
+  mkdirSync5(SUVEREN_DATA_DIR, { recursive: true });
+  writeFileSync5(FILE_PATH, JSON.stringify(data, null, 2), "utf-8");
 }
 function readApprovedIntents(vault2) {
   const file = readFile();
@@ -2267,7 +2741,7 @@ function createApprovedIntentsRouter(vault2) {
 
 // src/routes/evidence-export.ts
 var AS_FETCH_TIMEOUT_MS = 2e4;
-function createEvidenceExportRouter(spUrl, vault2) {
+function createEvidenceExportRouter(spUrl, vault2, dataDir, lockAsTlsMismatch2) {
   const router = Router9();
   const getSpCookie = () => vault2.getSpCookie();
   router.get("/", async (_req, res) => {
@@ -2287,17 +2761,29 @@ function createEvidenceExportRouter(spUrl, vault2) {
       const controller = new AbortController();
       const timeout = setTimeout(() => controller.abort(), AS_FETCH_TIMEOUT_MS);
       try {
-        const asRes = await fetch(`${spUrl}/api/receipts/export`, {
-          headers: { Cookie: cookie },
-          signal: controller.signal
-        });
+        const pin = readPairing(dataDir);
+        const { res: asRes } = await fetchAs(
+          `${spUrl}/api/receipts/export`,
+          { headers: { Cookie: cookie }, signal: controller.signal },
+          {
+            enforce: resolvePinTls(dataDir),
+            pinnedSpkiHex: pin && pin.asUrl === spUrl ? pin.tlsSpkiPinHex : void 0
+            // Never capture here — only the sign-in challenge establishes or
+            // refreshes a pin (as-challenge.ts).
+          }
+        );
         if (asRes.ok) {
           authorityServer = await asRes.json();
         } else {
           asError = `Authority Server export failed: ${asRes.status}`;
         }
       } catch (err) {
-        asError = `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}`;
+        if (err instanceof AsTlsMismatchError) {
+          lockAsTlsMismatch2();
+          asError = err.message;
+        } else {
+          asError = `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}`;
+        }
       } finally {
         clearTimeout(timeout);
       }
@@ -2483,7 +2969,7 @@ function createDecryptIntentRouter(vault2) {
 
 // src/lib/update-checker.ts
 import { execSync } from "child_process";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var GHCR_IMAGE = "suverenai/suveren-gateway";
 var NPM_PACKAGE = "@suveren/gateway";
@@ -2549,7 +3035,7 @@ function compareSemver(a, b) {
   return 0;
 }
 function checkDev() {
-  const cwd = dirname4(fileURLToPath2(import.meta.url));
+  const cwd = dirname5(fileURLToPath2(import.meta.url));
   try {
     execSync("git fetch origin --quiet", { cwd, stdio: "ignore", timeout: 15e3 });
     const out = execSync("git rev-list HEAD..origin/main --count", {
@@ -2622,19 +3108,19 @@ data: ${data}
 import { Router as Router12 } from "express";
 
 // src/lib/gateway-settings.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join7, dirname as dirname5 } from "path";
+import { join as join8, dirname as dirname6 } from "path";
 var DEFAULT_SETTINGS = {
   desktopNotifications: true
 };
 function settingsPath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join7(homedir5(), ".suveren");
-  return join7(dir, "settings.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
+  return join8(dir, "settings.json");
 }
 function readSettings(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync6(settingsPath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync8(settingsPath(dataDir), "utf8"));
     return {
       desktopNotifications: typeof raw.desktopNotifications === "boolean" ? raw.desktopNotifications : DEFAULT_SETTINGS.desktopNotifications
     };
@@ -2648,8 +3134,8 @@ function writeSettings(patch, dataDir) {
     ...typeof patch.desktopNotifications === "boolean" ? { desktopNotifications: patch.desktopNotifications } : {}
   };
   const path = settingsPath(dataDir);
-  mkdirSync5(dirname5(path), { recursive: true });
-  writeFileSync5(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+  mkdirSync6(dirname6(path), { recursive: true });
+  writeFileSync6(path, JSON.stringify(next, null, 2) + "\n", "utf8");
   return next;
 }
 
@@ -2681,20 +3167,20 @@ function createGatewaySettingsRouter() {
 import { Router as Router13 } from "express";
 
 // src/lib/archived-mandates-store.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, renameSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join8, dirname as dirname6 } from "path";
+import { join as join9, dirname as dirname7 } from "path";
 var ID_PATTERN = /^[A-Za-z0-9_.:-]{1,200}$/;
 function isValidMandateId(id) {
   return typeof id === "string" && ID_PATTERN.test(id);
 }
 function storePath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join8(homedir6(), ".suveren");
-  return join8(dir, "archived-mandates.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
+  return join9(dir, "archived-mandates.json");
 }
 function readArchived(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync7(storePath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync9(storePath(dataDir), "utf8"));
     if (!Array.isArray(raw.archived)) return [];
     return [...new Set(raw.archived.filter(isValidMandateId))];
   } catch {
@@ -2704,9 +3190,9 @@ function readArchived(dataDir) {
 function writeArchived(ids, dataDir) {
   const next = [...new Set(ids.filter(isValidMandateId))].sort();
   const path = storePath(dataDir);
-  mkdirSync6(dirname6(path), { recursive: true });
+  mkdirSync7(dirname7(path), { recursive: true });
   const tmp = `${path}.tmp`;
-  writeFileSync6(tmp, JSON.stringify({ archived: next }, null, 2) + "\n", "utf8");
+  writeFileSync7(tmp, JSON.stringify({ archived: next }, null, 2) + "\n", "utf8");
   renameSync(tmp, path);
   return next;
 }
@@ -2748,6 +3234,7 @@ import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 var SESSION_EXPIRED = "session-expired";
 var AS_KEY_MISMATCH = "as-key-mismatch";
+var AS_TLS_MISMATCH = "as-tls-mismatch";
 function secretMatches(provided, expected) {
   if (!expected) return false;
   if (!provided) return false;
@@ -2756,7 +3243,7 @@ function secretMatches(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual2(a, b);
 }
-function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch) {
+function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch, onAsTlsMismatch) {
   const router = Router14();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
@@ -2774,6 +3261,11 @@ function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch
       res.json({ ok: true });
       return;
     }
+    if (type === AS_TLS_MISMATCH) {
+      onAsTlsMismatch?.();
+      res.json({ ok: true });
+      return;
+    }
     if (typeof type !== "string" || !ALLOWED.includes(type)) {
       res.status(400).json({ error: "Unsupported event type" });
       return;
@@ -2873,6 +3365,7 @@ function startNotificationDispatcher(opts = {}) {
 // src/lib/session-lock.ts
 var SESSION_LOCKED_MESSAGE = "Your sign-in ended after 30 days or was revoked. Sign in again.";
 var AS_KEY_MISMATCH_MESSAGE = "The Authority Server presented a signing key that does not match the one pinned at pairing. Sign in again to review.";
+var AS_TLS_MISMATCH_MESSAGE = "A connection to the Authority Server presented a TLS certificate that does not match the one pinned at pairing. The connection was refused before anything was sent. If the certificate changed intentionally (a new key, not just renewal), clear the pairing and sign in again to re-pin it.";
 function createSessionLock(deps) {
   const { vault: vault2, port: port2 } = deps;
   const notifyFn = deps.notifyFn ?? notify;
@@ -2907,6 +3400,23 @@ function createAsKeyMismatchLock(deps) {
     notifyFn(title, AS_KEY_MISMATCH_MESSAGE, process.platform, url);
   };
 }
+function createAsTlsMismatchLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockOnAsTlsMismatch() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockAsTlsMismatch();
+    console.error("[Control Plane] Authority Server TLS pin mismatch \u2014 gateway LOCKED");
+    void unconfigureSessionFn("as-tls-mismatch").catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "as-tls-mismatch", message: AS_TLS_MISMATCH_MESSAGE });
+    const { title, url } = sessionExpiredNotification(port2);
+    notifyFn(title, AS_TLS_MISMATCH_MESSAGE, process.platform, url);
+  };
+}
 
 // src/lib/session-expiry-scheduler.ts
 var MAX_TIMEOUT_MS = 2147483647;
@@ -2976,17 +3486,17 @@ function buildSessionHealth(vault2) {
 }
 
 // src/lib/denials-reader.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
+import { join as join10 } from "path";
 function loadDenials(dataDir, decrypt) {
-  const encPath = join9(dataDir, "denials.enc.json");
-  const plainPath = join9(dataDir, "denials.json");
-  if (existsSync7(encPath)) {
-    const { blob } = JSON.parse(readFileSync8(encPath, "utf-8"));
+  const encPath = join10(dataDir, "denials.enc.json");
+  const plainPath = join10(dataDir, "denials.json");
+  if (existsSync8(encPath)) {
+    const { blob } = JSON.parse(readFileSync10(encPath, "utf-8"));
     return JSON.parse(decrypt(blob)).records ?? [];
   }
-  if (existsSync7(plainPath)) {
-    return JSON.parse(readFileSync8(plainPath, "utf-8")).records ?? [];
+  if (existsSync8(plainPath)) {
+    return JSON.parse(readFileSync10(plainPath, "utf-8")).records ?? [];
   }
   return [];
 }
@@ -3000,74 +3510,6 @@ function selectDenials(records, opts = {}) {
   return { count, records: out };
 }
 
-// src/lib/as-config.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
-var DEFAULT_AS_URL = "https://www.suveren.ai";
-function configPath(dataDir) {
-  return join10(dataDir, "config.json");
-}
-function readAsConfigStrict(dataDir) {
-  const path = configPath(dataDir);
-  if (!existsSync8(path)) return {};
-  let data;
-  try {
-    data = JSON.parse(readFileSync9(path, "utf-8"));
-  } catch (err) {
-    throw new Error(
-      `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  const out = {};
-  if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
-  if (typeof data.caFile === "string") out.caFile = data.caFile;
-  return out;
-}
-function validateAsUrl(candidate) {
-  const trimmed = candidate.trim();
-  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
-  let parsed;
-  try {
-    parsed = new URL(trimmed);
-  } catch {
-    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
-  }
-  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
-  if (parsed.protocol !== "https:" && !isLocalHttp) {
-    return {
-      ok: false,
-      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
-    };
-  }
-  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
-  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
-    normalized = normalized.slice(0, -1);
-  } else if (normalized === `${parsed.origin}/`) {
-    normalized = parsed.origin;
-  }
-  return { ok: true, url: normalized };
-}
-function resolveAsUrl(dataDir, flag) {
-  if (flag) {
-    const v = validateAsUrl(flag);
-    if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
-    return v.url;
-  }
-  const envUrl = process.env.SUVEREN_AS_URL;
-  if (envUrl) {
-    const v = validateAsUrl(envUrl);
-    if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
-    return v.url;
-  }
-  const saved = readAsConfigStrict(dataDir).asUrl;
-  if (saved) {
-    const v = validateAsUrl(saved);
-    if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir}/config.json: ${v.error}`);
-    return v.url;
-  }
-  return DEFAULT_AS_URL;
-}
-
 // src/index.ts
 (function migrateDataDir() {
   if (process.env.SUVEREN_DATA_DIR) return;
@@ -3085,6 +3527,7 @@ function resolveAsUrl(dataDir, flag) {
 })();
 var DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join11(homedir7(), ".suveren");
 var SP_URL = resolveAsUrl(DATA_DIR);
+validatePinTlsForUrl(resolvePinTls(DATA_DIR), SP_URL);
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
 var UI_DIST = process.env.HAP_UI_DIST ?? join11(import.meta.dirname ?? __dirname, "../../ui/dist");
@@ -3099,7 +3542,7 @@ var vault = new Vault(DATA_DIR);
     vault.markBootLockedAsUrlChanged();
   }
 })();
-var internalSecret2 = process.env.SUVEREN_INTERNAL_SECRET ?? randomBytes2(32).toString("hex");
+var internalSecret2 = process.env.SUVEREN_INTERNAL_SECRET ?? randomBytes3(32).toString("hex");
 setInternalSecret(internalSecret2);
 var app = express();
 var jsonParser = express.json();
@@ -3123,6 +3566,7 @@ function loginRateLimit(req, res, next) {
 }
 var lockExpiredSession = createSessionLock({ vault, port });
 var lockAsKeyMismatch = createAsKeyMismatchLock({ vault, port });
+var lockAsTlsMismatch = createAsTlsMismatchLock({ vault, port });
 var sessionExpiryScheduler = new SessionExpiryScheduler(
   () => vault.getSessionExpiresAt(),
   lockExpiredSession
@@ -3339,7 +3783,7 @@ app.get("/auth/oauth/:integrationId/health", authGuard, async (req, res) => {
   }
 });
 app.get("/events", requireAllowedHost, requireAuthQueryOrHeader(vault), createEventsHandler());
-app.use("/internal", jsonParser, createInternalEventsRouter(() => internalSecret2, lockExpiredSession, lockAsKeyMismatch));
+app.use("/internal", jsonParser, createInternalEventsRouter(() => internalSecret2, lockExpiredSession, lockAsKeyMismatch, lockAsTlsMismatch));
 app.use("/vault", jsonParser, authGuard, createVaultRouter(vault));
 app.use("/ai", jsonParser, authGuard, createAIRouter(vault));
 app.use("/ai-prompts", jsonParser, authGuard, createAIPromptsRouter());
@@ -3348,7 +3792,7 @@ app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRouter());
 app.use("/api/archived-mandates", jsonParser, authGuard, createArchivedMandatesRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
-app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL, vault));
+app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL, vault, DATA_DIR, lockAsTlsMismatch));
 app.use("/api/evidence", authGuard, createEvidenceRouter());
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
 app.use("/api/approved-intents", jsonParser, authGuard, createApprovedIntentsRouter(vault));
@@ -3489,11 +3933,18 @@ app.get("/skipped-commitments", authGuard, async (_req, res) => {
 });
 app.get("/as-pairing", authGuard, (_req, res) => {
   const pairing = readPairing(DATA_DIR);
+  const paired = pairing !== null && pairing.asUrl === SP_URL;
   res.json({
     asUrl: SP_URL,
-    paired: pairing !== null && pairing.asUrl === SP_URL,
-    fingerprint: pairing && pairing.asUrl === SP_URL ? fingerprintOf(pairing.publicKeyHex) : null,
-    pairedAt: pairing && pairing.asUrl === SP_URL ? pairing.pairedAt : null
+    paired,
+    fingerprint: paired ? fingerprintOf(pairing.publicKeyHex) : null,
+    pairedAt: paired ? pairing.pairedAt : null,
+    // Opt-in TLS pinning (`config set pin-tls on`) — see as-tls-pin.ts.
+    // `tlsPinFingerprint` uses the SAME display convention as the signing
+    // key (formatPinFingerprint mirrors fingerprintOf's grouping), applied
+    // to the already-computed SPKI digest rather than re-hashing a key.
+    pinTlsEnabled: resolvePinTls(DATA_DIR),
+    tlsPinFingerprint: paired && pairing.tlsSpkiPinHex ? formatPinFingerprint(pairing.tlsSpkiPinHex) : null
   });
 });
 app.get("/denials", authGuard, (req, res) => {
@@ -3562,11 +4013,19 @@ app.put("/agent-brief/context", jsonParser, authGuard, async (req, res) => {
   }
 });
 app.use("/api", authGuard);
+var pinnedProxyAgent = SP_URL.startsWith("https:") ? buildPinnedHttpsAgent(() => {
+  const pin = readPairing(DATA_DIR);
+  return {
+    enforce: resolvePinTls(DATA_DIR),
+    pinnedSpkiHex: pin && pin.asUrl === SP_URL ? pin.tlsSpkiPinHex : void 0
+  };
+}) : void 0;
 app.use(
   createProxyMiddleware({
     target: SP_URL,
     changeOrigin: true,
     pathFilter: "/api",
+    ...pinnedProxyAgent ? { agent: pinnedProxyAgent } : {},
     on: {
       proxyReq: (proxyReq) => {
         const cookie = vault.getSpCookie();
@@ -3574,6 +4033,21 @@ app.use(
           proxyReq.setHeader("Cookie", cookie);
         }
       },
+      // A pin check failure means the connection never completed its TLS
+      // handshake — nothing (not even this call's own cookie) reached the
+      // network. Lock the gateway with the real reason, loudly; an ordinary
+      // network error (AS outage) is NOT a pin failure (see isPinCheckError
+      // / as-tls-pin.ts's module doc comment on outage misclassification)
+      // and falls through to http-proxy-middleware's default error handling.
+      error: (err, _req, res) => {
+        if (!isPinCheckError(err)) return;
+        console.error("[Control Plane] /api proxy: TLS pin mismatch \u2014 gateway LOCKED:", err.message);
+        lockAsTlsMismatch();
+        if (res && "writeHead" in res && !res.headersSent) {
+          res.writeHead(502, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "as_tls_mismatch", message: err.message }));
+        }
+      },
       proxyRes: (proxyRes, req) => {
         const status = proxyRes.statusCode ?? 0;
         if (status === 401 && vault.isUnlocked()) {
@@ -3627,7 +4101,7 @@ function detectRunningVersion() {
   const bundlePkg = join11(dir, "..", "..", "package.json");
   if (existsSync9(bundlePkg)) {
     try {
-      const pkg = JSON.parse(readFileSync10(bundlePkg, "utf8"));
+      const pkg = JSON.parse(readFileSync11(bundlePkg, "utf8"));
       if (pkg.name === "@suveren/gateway" && typeof pkg.version === "string") {
         return pkg.version;
       }