@suveren/gateway 0.9.0 → 0.10.1

package/dist/mcp-server/http.mjs

@@ -112,6 +112,279 @@ function clientVersionHeaders() {
   };
 }
 
+// src/lib/as-pairing.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
+import { dirname, join as join2 } from "path";
+function pairingPath(dataDir2) {
+  return join2(dataDir2, "as-pairing.json");
+}
+function readPairing(dataDir2) {
+  const path = pairingPath(dataDir2);
+  if (!existsSync2(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync2(path, "utf-8"));
+    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
+    return {
+      asUrl: data.asUrl,
+      publicKeyHex: data.publicKeyHex,
+      pairedAt: data.pairedAt ?? "",
+      ...typeof data.tlsSpkiPinHex === "string" ? { tlsSpkiPinHex: data.tlsSpkiPinHex } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function fingerprintOf(publicKeyHex) {
+  const raw = Buffer.from(publicKeyHex, "hex");
+  const digest = createHash("sha256").update(raw).digest("hex").toUpperCase();
+  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
+}
+
+// src/lib/as-config.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+var DEFAULT_AS_URL = "https://www.suveren.ai";
+function configPath(dataDir2) {
+  return join3(dataDir2, "config.json");
+}
+function readAsConfigStrict(dataDir2) {
+  const path = configPath(dataDir2);
+  if (!existsSync3(path)) return {};
+  let data;
+  try {
+    data = JSON.parse(readFileSync3(path, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const out = {};
+  if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+  if (typeof data.caFile === "string") out.caFile = data.caFile;
+  if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+  if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+  return out;
+}
+function readAsConfig(dataDir2) {
+  const path = configPath(dataDir2);
+  if (!existsSync3(path)) return {};
+  try {
+    const data = JSON.parse(readFileSync3(path, "utf-8"));
+    const out = {};
+    if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
+    if (typeof data.caFile === "string") out.caFile = data.caFile;
+    if (typeof data.pinTls === "boolean") out.pinTls = data.pinTls;
+    if (typeof data.pinTlsExpectedFingerprint === "string") out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
+    return out;
+  } catch {
+    return {};
+  }
+}
+function validateAsUrl(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
+  }
+  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+  if (parsed.protocol !== "https:" && !isLocalHttp) {
+    return {
+      ok: false,
+      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
+    };
+  }
+  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
+    normalized = normalized.slice(0, -1);
+  } else if (normalized === `${parsed.origin}/`) {
+    normalized = parsed.origin;
+  }
+  return { ok: true, url: normalized };
+}
+function resolveAsUrl(dataDir2, flag) {
+  if (flag) {
+    const v = validateAsUrl(flag);
+    if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
+    return v.url;
+  }
+  const envUrl = process.env.SUVEREN_AS_URL;
+  if (envUrl) {
+    const v = validateAsUrl(envUrl);
+    if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
+    return v.url;
+  }
+  const saved = readAsConfigStrict(dataDir2).asUrl;
+  if (saved) {
+    const v = validateAsUrl(saved);
+    if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir2}/config.json: ${v.error}`);
+    return v.url;
+  }
+  return DEFAULT_AS_URL;
+}
+function resolvePinTls(dataDir2) {
+  return readAsConfig(dataDir2).pinTls === true;
+}
+function validatePinTlsForUrl(pinTls, asUrl) {
+  if (!pinTls) return;
+  if (!asUrl.startsWith("https:")) {
+    throw new Error(
+      `config.json sets "pinTls": true, but the Authority Server URL (${asUrl}) is not https:// \u2014 there is no TLS certificate to pin. Fix the saved as-url, or turn pin-tls off: \`suveren-gateway config set pin-tls off\`.`
+    );
+  }
+}
+
+// src/lib/as-tls-pin.ts
+import { createHash as createHash2 } from "crypto";
+import { checkServerIdentity as defaultCheckServerIdentity, rootCertificates } from "tls";
+import { Agent as HttpsAgent } from "https";
+import { readFileSync as readFileSync4 } from "fs";
+import { Agent, fetch as undiciFetch } from "undici";
+function effectiveCa() {
+  const path = process.env.NODE_EXTRA_CA_CERTS;
+  if (!path) return void 0;
+  try {
+    return [...rootCertificates, readFileSync4(path, "utf-8")];
+  } catch {
+    return void 0;
+  }
+}
+var PIN_CHECK_ERROR_CODE = "EAS_TLS_PIN_CHECK";
+function taggedCheckError(err) {
+  err.code = PIN_CHECK_ERROR_CODE;
+  return err;
+}
+function isPinCheckError(err) {
+  let cur = err;
+  for (let i = 0; i < 5 && cur; i++) {
+    if (cur instanceof Error && cur.code === PIN_CHECK_ERROR_CODE) return true;
+    cur = cur instanceof Error ? cur.cause : void 0;
+  }
+  return false;
+}
+var AsTlsMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AsTlsMismatchError";
+  }
+};
+function spkiSha256Hex(cert) {
+  if (!cert.pubkey) {
+    throw new Error("peer certificate carries no pubkey (expected the detailed certificate object)");
+  }
+  return createHash2("sha256").update(cert.pubkey).digest("hex");
+}
+function formatPinFingerprint(hex) {
+  const upper = hex.toUpperCase();
+  return upper.match(/.{1,4}/g)?.join(":") ?? upper;
+}
+function pinnedCheckServerIdentity(pinnedSpkiHex) {
+  const wantHex = pinnedSpkiHex.toLowerCase();
+  return (hostname, cert) => {
+    const defaultErr = defaultCheckServerIdentity(hostname, cert);
+    if (defaultErr) return taggedCheckError(defaultErr);
+    let actualHex;
+    try {
+      actualHex = spkiSha256Hex(cert);
+    } catch (err) {
+      return taggedCheckError(new Error(
+        `could not read the server certificate's public key to check the TLS pin \u2014 ${err instanceof Error ? err.message : String(err)}`
+      ));
+    }
+    if (actualHex !== wantHex) {
+      return taggedCheckError(new Error(
+        `TLS certificate pin mismatch for ${hostname}: expected SPKI sha256 ${formatPinFingerprint(wantHex)}, got ${formatPinFingerprint(actualHex)}.`
+      ));
+    }
+    return void 0;
+  };
+}
+function buildPinnedDispatcher(pinnedSpkiHex) {
+  return new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: pinnedCheckServerIdentity(pinnedSpkiHex)
+    }
+  });
+}
+function buildCapturingDispatcher() {
+  let captured;
+  const dispatcher = new Agent({
+    connect: {
+      ca: effectiveCa(),
+      checkServerIdentity: (hostname, cert) => {
+        captured = cert;
+        const defaultErr = defaultCheckServerIdentity(hostname, cert);
+        return defaultErr ? taggedCheckError(defaultErr) : void 0;
+      }
+    }
+  });
+  return { dispatcher, getCapturedCert: () => captured };
+}
+var DEFAULT_AS_FETCH_TIMEOUT_MS = 15e3;
+function withBoundedSignal(init) {
+  const timeout = AbortSignal.timeout(DEFAULT_AS_FETCH_TIMEOUT_MS);
+  const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+  return { ...init, signal };
+}
+function closeAfter(dispatcher, pending) {
+  pending.catch(() => {
+  }).finally(() => {
+    void dispatcher.close().catch(() => {
+    });
+  });
+}
+async function fetchAs(url, init, pinning) {
+  if (!pinning.enforce && !pinning.capture) {
+    const res2 = await fetch(url, withBoundedSignal(init));
+    return { res: res2 };
+  }
+  if (pinning.enforce && !pinning.capture && !pinning.pinnedSpkiHex) {
+    throw new AsTlsMismatchError(
+      `pin-tls is on but no certificate is pinned yet for ${url} \u2014 sign in again to establish it (re-pairing required).`
+    );
+  }
+  if (pinning.pinnedSpkiHex && (pinning.enforce || !pinning.capture)) {
+    const dispatcher2 = buildPinnedDispatcher(pinning.pinnedSpkiHex);
+    const pending2 = undiciFetch(url, { ...withBoundedSignal(init), dispatcher: dispatcher2 });
+    closeAfter(dispatcher2, pending2);
+    try {
+      const res2 = await pending2;
+      return { res: res2 };
+    } catch (err) {
+      if (!isPinCheckError(err)) throw err;
+      throw new AsTlsMismatchError(
+        `TLS pin check failed for ${url} \u2014 ${describeFetchError(err)}. Refusing the connection; the API key / session cookie were never sent. If the Authority Server's certificate changed intentionally (a new key, not just renewal), an operator must clear the pairing and sign in again to re-pin it.`
+      );
+    }
+  }
+  const { dispatcher, getCapturedCert } = buildCapturingDispatcher();
+  const pending = undiciFetch(url, { ...withBoundedSignal(init), dispatcher });
+  closeAfter(dispatcher, pending);
+  let res;
+  try {
+    res = await pending;
+  } catch (err) {
+    if (!isPinCheckError(err)) throw err;
+    throw new AsTlsMismatchError(
+      `could not verify the Authority Server at ${url} while establishing its TLS pin \u2014 ${describeFetchError(err)}.`
+    );
+  }
+  const cert = getCapturedCert();
+  return { res, capturedSpkiHex: cert ? spkiSha256Hex(cert) : void 0 };
+}
+function describeFetchError(err) {
+  if (err instanceof Error) {
+    const cause = err.cause;
+    if (cause instanceof Error) return cause.message;
+    return err.message;
+  }
+  return String(err);
+}
+
 // src/lib/sp-client.ts
 var SPReceiptError = class extends Error {
   constructor(message, statusCode, body) {
@@ -127,8 +400,9 @@ var DEFAULT_RECEIPT_RETRY = {
 };
 var sleep = (ms) => ms > 0 ? new Promise((resolve3) => setTimeout(resolve3, ms)) : Promise.resolve();
 var SPClient = class {
-  constructor(baseUrl, receiptRetry = {}) {
+  constructor(baseUrl, receiptRetry = {}, dataDir2) {
     this.baseUrl = baseUrl;
+    this.dataDir = dataDir2;
     this.receiptRetry = { ...DEFAULT_RECEIPT_RETRY, ...receiptRetry };
   }
   sessionCookie = "";
@@ -141,6 +415,22 @@ var SPClient = class {
    *  was active tells the control plane. Concurrent in-flight calls that were
    *  all sent under the same now-dead cookie would otherwise all report it. */
   sessionExpiredNotified = false;
+  /** Same single-flight shape, for a TLS pin mismatch (as-tls-pin.ts). */
+  tlsMismatchNotified = false;
+  /** Opt-in TLS pinning (as-tls-pin.ts) for every call THIS client makes.
+   *  Re-read live on each call rather than cached — same reasoning as
+   *  AttestationCache.getPublicKey's pin check: a pin or setting change
+   *  must take effect on the very next call, not the next restart. Never
+   *  allowed to CAPTURE a new pin here — only the control plane's sign-in
+   *  exchange (as-challenge.ts) does that; this client only enforces. */
+  tlsPinning() {
+    if (!this.dataDir) return { enforce: false };
+    const pin = readPairing(this.dataDir);
+    return {
+      enforce: resolvePinTls(this.dataDir),
+      pinnedSpkiHex: pin && pin.asUrl === this.baseUrl ? pin.tlsSpkiPinHex : void 0
+    };
+  }
   /** The AS base URL this client talks to (for provenance records). */
   get url() {
     return this.baseUrl;
@@ -152,6 +442,7 @@ var SPClient = class {
     this.sessionCookie = cookie;
     this.lockReason = null;
     this.sessionExpiredNotified = false;
+    this.tlsMismatchNotified = false;
   }
   /**
    * Drop the session because the control plane learned (by whatever path —
@@ -205,10 +496,21 @@ var SPClient = class {
       headers["X-API-Key"] = this.apiKey;
     }
     const hadSession = this.sessionCookie !== "";
-    const res = await globalThis.fetch(url, {
-      ...init,
-      headers
-    });
+    let res;
+    try {
+      const result = await fetchAs(url, { ...init, headers }, this.tlsPinning());
+      res = result.res;
+    } catch (err) {
+      if (err instanceof AsTlsMismatchError) {
+        this.sessionCookie = "";
+        this.lockReason = "as-tls-mismatch";
+        if (!this.tlsMismatchNotified) {
+          this.tlsMismatchNotified = true;
+          void notifyControlPlane("as-tls-mismatch");
+        }
+      }
+      throw err;
+    }
     if (res.status === 401 && hadSession) {
       this.sessionCookie = "";
       this.lockReason = "expired";
@@ -371,32 +673,6 @@ var SPClient = class {
 
 // src/lib/attestation-cache.ts
 import { decodeAttestationBlob } from "@hap/core";
-
-// src/lib/as-pairing.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
-import { dirname, join as join2 } from "path";
-function pairingPath(dataDir2) {
-  return join2(dataDir2, "as-pairing.json");
-}
-function readPairing(dataDir2) {
-  const path = pairingPath(dataDir2);
-  if (!existsSync2(path)) return null;
-  try {
-    const data = JSON.parse(readFileSync2(path, "utf-8"));
-    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
-    return { asUrl: data.asUrl, publicKeyHex: data.publicKeyHex, pairedAt: data.pairedAt ?? "" };
-  } catch {
-    return null;
-  }
-}
-function fingerprintOf(publicKeyHex) {
-  const raw = Buffer.from(publicKeyHex, "hex");
-  const digest = createHash("sha256").update(raw).digest("hex").toUpperCase();
-  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
-}
-
-// src/lib/attestation-cache.ts
 var AsKeyMismatchError = class extends Error {
   constructor(message) {
     super(message);
@@ -558,18 +834,18 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync2 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join3(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join4(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname2(filePath);
+      this.baseDir = dirname3(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR;
     }
@@ -580,11 +856,11 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync3(this.encryptedFilePath)) {
+    if (existsSync4(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync3(this.plaintextFilePath)) {
+      if (existsSync4(this.plaintextFilePath)) {
         try {
           unlinkSync2(this.plaintextFilePath);
         } catch {
@@ -622,11 +898,11 @@ var GateStore = class {
   clearAll() {
     this.entries = /* @__PURE__ */ new Map();
     try {
-      if (existsSync3(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
+      if (existsSync4(this.plaintextFilePath)) unlinkSync2(this.plaintextFilePath);
     } catch {
     }
     try {
-      if (existsSync3(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
+      if (existsSync4(this.encryptedFilePath)) unlinkSync2(this.encryptedFilePath);
     } catch {
     }
   }
@@ -659,19 +935,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join3(this.baseDir, "gates.json");
+    return join4(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join3(this.baseDir, "gates.enc.json");
+    return join4(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync3(this.plaintextFilePath)) {
-      mkdirSync2(this.baseDir, { recursive: true });
+    if (!existsSync4(this.plaintextFilePath)) {
+      mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync3(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -680,9 +956,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync3(this.encryptedFilePath)) return;
+    if (!existsSync4(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync3(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -706,8 +982,8 @@ var GateStore = class {
       version: 1,
       entries: Object.fromEntries(this.entries)
     };
-    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync2(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
@@ -717,17 +993,17 @@ var GateStore = class {
     for (const [key, entry] of this.entries) {
       data.entries[key] = this.encrypt(JSON.stringify(entry));
     }
-    mkdirSync2(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync2(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join4(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join5(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -735,7 +1011,7 @@ var ExecutionLog = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname3(filePath);
+      this.baseDir = dirname4(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR2;
     }
@@ -746,11 +1022,11 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync4(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync4(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
           unlinkSync3(this.plaintextFilePath);
         } catch {
@@ -854,19 +1130,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join4(this.baseDir, "execution-log.json");
+    return join5(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join4(this.baseDir, "execution-log.enc.json");
+    return join5(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync4(this.plaintextFilePath)) {
-      mkdirSync3(this.baseDir, { recursive: true });
+    if (!existsSync5(this.plaintextFilePath)) {
+      mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync4(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -876,9 +1152,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync4(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync4(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -898,8 +1174,8 @@ var ExecutionLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, entries: this.entries };
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, entries: this.entries };
@@ -907,8 +1183,8 @@ var ExecutionLog = class {
       version: 1,
       blob: this.encrypt(JSON.stringify(logFile))
     };
-    mkdirSync3(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync3(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 function windowCutoff(window, now) {
@@ -925,11 +1201,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync6, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname5, join as join6 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join5(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join6(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -937,16 +1213,16 @@ var DenialLog = class {
   baseDir;
   vaultKey = null;
   constructor(filePath) {
-    this.baseDir = filePath && filePath.endsWith(".json") ? dirname4(filePath) : filePath ?? DEFAULT_DIR3;
+    this.baseDir = filePath && filePath.endsWith(".json") ? dirname5(filePath) : filePath ?? DEFAULT_DIR3;
     this.loadPlaintext();
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync5(this.encryptedFilePath)) {
+    if (existsSync6(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync5(this.plaintextFilePath)) {
+      if (existsSync6(this.plaintextFilePath)) {
         try {
           unlinkSync4(this.plaintextFilePath);
         } catch {
@@ -996,18 +1272,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join5(this.baseDir, "denials.json");
+    return join6(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join5(this.baseDir, "denials.enc.json");
+    return join6(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync5(this.plaintextFilePath)) {
-      mkdirSync4(this.baseDir, { recursive: true });
+    if (!existsSync6(this.plaintextFilePath)) {
+      mkdirSync5(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync5(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync7(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -1015,9 +1291,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync5(this.encryptedFilePath)) return;
+    if (!existsSync6(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync5(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync7(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -1031,23 +1307,23 @@ var DenialLog = class {
   }
   persistPlaintext() {
     const data = { version: 1, records: this.records };
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const logFile = { version: 1, records: this.records };
     const data = { version: 1, blob: this.encrypt(JSON.stringify(logFile)) };
-    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync5(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, unlinkSync as unlinkSync5 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname5, join as join6 } from "path";
+import { dirname as dirname6, join as join7 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join6(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -1061,7 +1337,7 @@ var ReceiptArchive = class {
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname5(filePath);
+      this.baseDir = dirname6(filePath);
     } else {
       this.baseDir = filePath ?? DEFAULT_DIR4;
     }
@@ -1072,11 +1348,11 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync6(this.encryptedFilePath)) {
+    if (existsSync7(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync6(this.plaintextFilePath)) {
+      if (existsSync7(this.plaintextFilePath)) {
         try {
           unlinkSync5(this.plaintextFilePath);
         } catch {
@@ -1090,7 +1366,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync6(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync7(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -1191,19 +1467,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join6(this.baseDir, "receipt-archive.json");
+    return join7(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join6(this.baseDir, "receipt-archive.enc.json");
+    return join7(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync6(this.plaintextFilePath)) {
-      mkdirSync5(this.baseDir, { recursive: true });
+    if (!existsSync7(this.plaintextFilePath)) {
+      mkdirSync6(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync6(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync8(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1213,18 +1489,18 @@ var ReceiptArchive = class {
     } catch {
       console.error(`[ReceiptArchive] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
       try {
-        writeFileSync5(
+        writeFileSync6(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync6(this.plaintextFilePath)
+          readFileSync8(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync6(this.encryptedFilePath)) return;
+    if (!existsSync7(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync6(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync8(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1236,9 +1512,9 @@ var ReceiptArchive = class {
     } catch (err) {
       console.error(`[ReceiptArchive] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
       try {
-        writeFileSync5(
+        writeFileSync6(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync6(this.encryptedFilePath)
+          readFileSync8(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1252,29 +1528,29 @@ var ReceiptArchive = class {
     }
   }
   persistPlaintext() {
-    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync5(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync6(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync6(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
       version: 1,
       blob: this.encrypt(JSON.stringify(this.data))
     };
-    mkdirSync5(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync5(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync6(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync6(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
 // src/lib/execution-journal.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync7, renameSync } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7, existsSync as existsSync8, renameSync } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname6, join as join7 } from "path";
-import { createHash as createHash2 } from "crypto";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join7(homedir5(), ".suveren");
+import { dirname as dirname7, join as join8 } from "path";
+import { createHash as createHash3 } from "crypto";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join8(homedir5(), ".suveren");
 var FILE_NAME = "execution-journal.json";
 var MAX_AGE_SECONDS2 = 90 * 24 * 60 * 60;
 function hashToolArgs(args) {
-  return "sha256:" + createHash2("sha256").update(stableStringify(args)).digest("hex");
+  return "sha256:" + createHash3("sha256").update(stableStringify(args)).digest("hex");
 }
 function stableStringify(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
@@ -1286,8 +1562,8 @@ function stableStringify(value) {
 var ExecutionJournal = class {
   filePath;
   constructor(filePath) {
-    const baseDir = filePath && filePath.endsWith(".json") ? dirname6(filePath) : filePath ?? DEFAULT_DIR5;
-    this.filePath = join7(baseDir, FILE_NAME);
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR5;
+    this.filePath = join8(baseDir, FILE_NAME);
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
@@ -1326,9 +1602,9 @@ var ExecutionJournal = class {
   }
   // ─── Persistence ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync7(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync8(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync7(this.filePath, "utf8"));
+      const parsed = JSON.parse(readFileSync9(this.filePath, "utf8"));
       if (parsed?.version !== 1 || !Array.isArray(parsed.entries)) {
         throw new Error("unexpected shape");
       }
@@ -1342,9 +1618,9 @@ var ExecutionJournal = class {
   persist(file) {
     const cutoff = nowSec() - MAX_AGE_SECONDS2;
     file.entries = file.entries.filter((e) => e.startedAt >= cutoff);
-    mkdirSync6(dirname6(this.filePath), { recursive: true, mode: 448 });
+    mkdirSync7(dirname7(this.filePath), { recursive: true, mode: 448 });
     const tmp = this.filePath + ".tmp";
-    writeFileSync6(tmp, JSON.stringify(file, null, 2), { mode: 384 });
+    writeFileSync7(tmp, JSON.stringify(file, null, 2), { mode: 384 });
     renameSync(tmp, this.filePath);
   }
 };
@@ -1353,10 +1629,10 @@ function nowSec() {
 }
 
 // src/lib/proposal-submission-store.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync7, existsSync as existsSync8, renameSync as renameSync2 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync9, renameSync as renameSync2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname7, join as join8 } from "path";
-var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join8(homedir6(), ".suveren");
+import { dirname as dirname8, join as join9 } from "path";
+var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join9(homedir6(), ".suveren");
 var FILE_NAME2 = "proposal-submissions.json";
 var MAX_AGE_SECONDS3 = 90 * 24 * 60 * 60;
 function nowSec2() {
@@ -1365,8 +1641,8 @@ function nowSec2() {
 var ProposalSubmissionStore = class {
   filePath;
   constructor(filePath) {
-    const baseDir = filePath && filePath.endsWith(".json") ? dirname7(filePath) : filePath ?? DEFAULT_DIR6;
-    this.filePath = join8(baseDir, FILE_NAME2);
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname8(filePath) : filePath ?? DEFAULT_DIR6;
+    this.filePath = join9(baseDir, FILE_NAME2);
   }
   /** Record what was submitted, right after a successful submitProposal(). */
   record(entry) {
@@ -1389,9 +1665,9 @@ var ProposalSubmissionStore = class {
     return this.load().entries.find((e) => e.proposalId === proposalId);
   }
   load() {
-    if (!existsSync8(this.filePath)) return { version: 1, entries: [] };
+    if (!existsSync9(this.filePath)) return { version: 1, entries: [] };
     try {
-      const parsed = JSON.parse(readFileSync8(this.filePath, "utf-8"));
+      const parsed = JSON.parse(readFileSync10(this.filePath, "utf-8"));
       const cutoff = nowSec2() - MAX_AGE_SECONDS3;
       parsed.entries = (parsed.entries ?? []).filter((e) => e.submittedAt >= cutoff);
       return parsed;
@@ -1400,9 +1676,9 @@ var ProposalSubmissionStore = class {
     }
   }
   persist(file) {
-    mkdirSync7(dirname7(this.filePath), { recursive: true, mode: 448 });
+    mkdirSync8(dirname8(this.filePath), { recursive: true, mode: 448 });
     const tmpPath = `${this.filePath}.tmp`;
-    writeFileSync7(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
+    writeFileSync8(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
     renameSync2(tmpPath, this.filePath);
   }
 };
@@ -1514,12 +1790,13 @@ var SharedState = class {
   gatekeeper;
   /**
    * @param dataDir Passed to the AttestationCache so it can enforce AS key
-   *   pinning (as-pairing.ts). Optional for backward compat with existing
-   *   constructions/tests that pass only a URL — those get unpinned
-   *   trust-on-first-use behavior, same as before pinning existed.
+   *   pinning (as-pairing.ts), and to the SPClient so it can enforce opt-in
+   *   TLS pinning (as-tls-pin.ts). Optional for backward compat with
+   *   existing constructions/tests that pass only a URL — those get
+   *   unpinned trust-on-first-use behavior, same as before pinning existed.
    */
   constructor(spUrl2, gateStorePath, dataDir2) {
-    this.spClient = new SPClient(spUrl2);
+    this.spClient = new SPClient(spUrl2, void 0, dataDir2);
     this.cache = new AttestationCache(this.spClient, dataDir2);
     this.gateStore = new GateStore(gateStorePath);
     this.executionLog = new ExecutionLog(gateStorePath);
@@ -1679,17 +1956,17 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
+import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join9 } from "path";
-var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join9(homedir7(), ".suveren");
+import { join as join10 } from "path";
+var DEFAULT_DIR7 = process.env.SUVEREN_DATA_DIR ?? join10(homedir7(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir2) {
   const dir = dataDir2 ?? DEFAULT_DIR7;
-  const filePath = join9(dir, "context.md");
-  if (!existsSync9(filePath)) return null;
+  const filePath = join10(dir, "context.md");
+  if (!existsSync10(filePath)) return null;
   try {
-    const content = readFileSync9(filePath, "utf-8").trim();
+    const content = readFileSync11(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -1809,6 +2086,11 @@ function asKeyMismatchNotice(what) {
 
 TELL THE USER: this needs an operator to check whether the Authority Server's key changed intentionally (e.g. a reinstall) or something else is answering at that address, at ${uiUrl()}. Nothing ran under the unrecognized key.`;
 }
+function asTlsMismatchNotice(what) {
+  return `${what} Suveren gateway is LOCKED because a connection to the Authority Server presented a TLS certificate that does not match the one pinned when this gateway last signed in (opt-in pin-tls). This is NOT an ended sign-in \u2014 signing in again will be refused until the mismatch is resolved.
+
+TELL THE USER: this needs an operator to check whether the Authority Server's certificate changed intentionally (e.g. a new TLS key, not just a renewal) or something else is answering at that address, at ${uiUrl()}. Nothing was sent under the unrecognized certificate.`;
+}
 function asUrlChangedNotice(what) {
   return `${what} Suveren gateway is LOCKED because the Authority Server it points at has changed since it last signed in. Cached mandates from the old server were cleared.
 
@@ -1821,6 +2103,8 @@ function lockedNotice(action, reason = "restart") {
       return expiredSessionNotice(what);
     case "as-key-mismatch":
       return asKeyMismatchNotice(what);
+    case "as-tls-mismatch":
+      return asTlsMismatchNotice(what);
     case "as-url-changed":
       return asUrlChangedNotice(what);
     default:
@@ -1989,6 +2273,11 @@ async function verifyTicket(cache, receipt, expected) {
       `Ticket proposalId "${String(receipt.proposalId)}" does not match the proposal being executed "${expected.proposalId}" \u2014 refusing to execute.`
     );
   }
+  if (expected.idempotencyKey !== void 0 && receipt.idempotencyKey !== expected.idempotencyKey) {
+    throw new TicketBindingMismatchError(
+      `Ticket idempotencyKey "${String(receipt.idempotencyKey)}" does not match the one this call sent "${expected.idempotencyKey}" \u2014 refusing to execute.`
+    );
+  }
   if (expected.contentHash !== void 0) {
     if (receipt.contentHash !== expected.contentHash) {
       throw new TicketBindingMismatchError(
@@ -2766,6 +3055,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
       try {
         const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, args, actionType);
+        const idempotencyKey = randomUUID();
         const { receipt } = await state2.spClient.postReceipt({
           authorizationId: authzId,
           // Optional cross-check — the AS fails closed on a mismatch.
@@ -2775,7 +3065,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           actionType,
           executionContext: { ...execution },
           amount: typeof execution.amount === "number" ? execution.amount : void 0,
-          idempotencyKey: randomUUID(),
+          idempotencyKey,
           // Privacy: send the hash and how to reproduce it — never the
           // preimage. `binding` also carries `boundContent`, the plaintext
           // that was hashed (an email's to/cc/subject/body); it stays on
@@ -2789,6 +3079,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           executionContext: { ...execution },
           authorizationId: authzId,
           profileId: auth.profileId,
+          idempotencyKey,
           contentHash: binding?.contentHash,
           contentBinding: binding?.contentBinding
         });
@@ -3750,16 +4041,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync10 } from "fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync11 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname8, join as join10 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join10(homedir8(), ".suveren");
+import { dirname as dirname9, join as join11 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join11(homedir8(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir2) {
     const dir = dataDir2 ?? DEFAULT_DATA_DIR;
-    this.filePath = join10(dir, "integrations.json");
+    this.filePath = join11(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -3790,12 +4081,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync10(this.filePath)) {
-      mkdirSync8(dirname8(this.filePath), { recursive: true });
+    if (!existsSync11(this.filePath)) {
+      mkdirSync9(dirname9(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync10(this.filePath, "utf-8");
+      const raw = readFileSync12(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -3824,45 +4115,45 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync8(dirname8(this.filePath), { recursive: true });
-    writeFileSync8(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync9(dirname9(this.filePath), { recursive: true });
+    writeFileSync9(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
 import { homedir as homedir9 } from "os";
-import { join as join12, delimiter } from "path";
-import { existsSync as existsSync12, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync12, rmSync } from "fs";
+import { join as join13, delimiter } from "path";
+import { existsSync as existsSync13, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
-import { join as join11, resolve } from "path";
+import { readFileSync as readFileSync13, existsSync as existsSync12 } from "fs";
+import { join as join12, resolve } from "path";
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join11(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join12(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join11(dir, "index.json");
-  if (!existsSync11(indexPath)) {
+  const indexPath = join12(dir, "index.json");
+  if (!existsSync12(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync11(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync13(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join11(dir, relativePath);
+    const manifestPath = join12(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync11(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync13(manifestPath, "utf-8"));
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -3950,26 +4241,26 @@ function safeHost(url) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join12(homedir9(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join12(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join13(DEFAULT_DATA_DIR2, "integrations");
 var installLock = Promise.resolve();
 function withInstallLock(task) {
   const run = installLock.then(task, task);
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join12(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join13(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync12(INTEGRATIONS_DIR)) {
-    mkdirSync9(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync13(INTEGRATIONS_DIR)) {
+    mkdirSync10(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join12(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync12(pkgPath)) {
-    writeFileSync9(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join13(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync13(pkgPath)) {
+    writeFileSync10(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -4035,19 +4326,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join12(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join12(pkgDir, "package.json");
-    if (!existsSync12(pkgDir) || !existsSync12(pkgJson)) return false;
+    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join13(pkgDir, "package.json");
+    if (!existsSync13(pkgDir) || !existsSync13(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync12(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync14(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync12(join12(pkgDir, target))) return false;
+        if (!existsSync13(join13(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync12(join12(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync13(join13(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -4061,7 +4352,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync12(join12(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync13(join13(INTEGRATIONS_BIN, c)));
   }
   /**
    * Install an npm package into the managed integrations directory if not
@@ -4085,8 +4376,8 @@ var IntegrationManager = class {
   }
   /** The actual install. Callers MUST hold the install lock. */
   async installNow(npmPackage) {
-    const pkgDir = join12(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync12(pkgDir)) {
+    const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (existsSync13(pkgDir)) {
       console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -4521,28 +4812,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync13, existsSync as existsSync13 } from "fs";
-import { join as join13, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { join as join14, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join13(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join13(dir, "index.json");
-  if (!existsSync13(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join14(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join14(dir, "index.json");
+  if (!existsSync14(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync13(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync15(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join13(dir, relativePath);
+    const profilePath = join14(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync13(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync15(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -4578,8 +4869,8 @@ function warnNoProfiles(reason) {
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync14, unlinkSync as unlinkSync6, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname9, join as join14 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync16, unlinkSync as unlinkSync6, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname10, join as join15 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -4607,7 +4898,7 @@ var ExecutorLock = class {
   path;
   held = false;
   constructor(dataDir2) {
-    this.path = join14(dataDir2, "executor.lock");
+    this.path = join15(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -4615,9 +4906,9 @@ var ExecutorLock = class {
     if (current && current.pid !== process.pid && isAlive(current.pid)) {
       return { held: false, holderPid: current.pid };
     }
-    mkdirSync10(dirname9(this.path), { recursive: true, mode: 448 });
+    mkdirSync11(dirname10(this.path), { recursive: true, mode: 448 });
     const lock = { pid: process.pid, startedAt: Math.floor(Date.now() / 1e3) };
-    writeFileSync10(this.path, JSON.stringify(lock), { mode: 384 });
+    writeFileSync11(this.path, JSON.stringify(lock), { mode: 384 });
     this.held = true;
     return { held: true };
   }
@@ -4639,9 +4930,9 @@ var ExecutorLock = class {
     }
   }
   read() {
-    if (!existsSync14(this.path)) return null;
+    if (!existsSync15(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync14(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync16(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -4661,76 +4952,8 @@ function isAlive(pid) {
 import { homedir as homedir10 } from "os";
 import { join as join17 } from "path";
 
-// src/lib/as-config.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname10, join as join15 } from "path";
-var DEFAULT_AS_URL = "https://www.suveren.ai";
-function configPath(dataDir2) {
-  return join15(dataDir2, "config.json");
-}
-function readAsConfigStrict(dataDir2) {
-  const path = configPath(dataDir2);
-  if (!existsSync15(path)) return {};
-  let data;
-  try {
-    data = JSON.parse(readFileSync15(path, "utf-8"));
-  } catch (err) {
-    throw new Error(
-      `Could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  const out = {};
-  if (typeof data.asUrl === "string") out.asUrl = data.asUrl;
-  if (typeof data.caFile === "string") out.caFile = data.caFile;
-  return out;
-}
-function validateAsUrl(candidate) {
-  const trimmed = candidate.trim();
-  if (!trimmed) return { ok: false, error: "The Authority Server URL is empty." };
-  let parsed;
-  try {
-    parsed = new URL(trimmed);
-  } catch {
-    return { ok: false, error: `"${trimmed}" is not a valid URL.` };
-  }
-  const isLocalHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
-  if (parsed.protocol !== "https:" && !isLocalHttp) {
-    return {
-      ok: false,
-      error: `"${trimmed}" must use https:// (http:// is only allowed for http://localhost or http://127.0.0.1).`
-    };
-  }
-  let normalized = `${parsed.origin}${parsed.pathname}${parsed.search}${parsed.hash}`;
-  if (normalized.endsWith("/") && normalized !== `${parsed.origin}/`) {
-    normalized = normalized.slice(0, -1);
-  } else if (normalized === `${parsed.origin}/`) {
-    normalized = parsed.origin;
-  }
-  return { ok: true, url: normalized };
-}
-function resolveAsUrl(dataDir2, flag) {
-  if (flag) {
-    const v = validateAsUrl(flag);
-    if (!v.ok) throw new Error(`Invalid --as-url: ${v.error}`);
-    return v.url;
-  }
-  const envUrl = process.env.SUVEREN_AS_URL;
-  if (envUrl) {
-    const v = validateAsUrl(envUrl);
-    if (!v.ok) throw new Error(`Invalid SUVEREN_AS_URL: ${v.error}`);
-    return v.url;
-  }
-  const saved = readAsConfigStrict(dataDir2).asUrl;
-  if (saved) {
-    const v = validateAsUrl(saved);
-    if (!v.ok) throw new Error(`Invalid saved as-url "${saved}" in ${dataDir2}/config.json: ${v.error}`);
-    return v.url;
-  }
-  return DEFAULT_AS_URL;
-}
-
 // src/lib/mcp-as-tracker.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync16, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname11, join as join16 } from "path";
 function trackerPath(dataDir2) {
   return join16(dataDir2, "mcp-as-pairing.json");
@@ -4739,7 +4962,7 @@ function readMcpPairedAsUrl(dataDir2) {
   const path = trackerPath(dataDir2);
   if (!existsSync16(path)) return null;
   try {
-    const data = JSON.parse(readFileSync16(path, "utf-8"));
+    const data = JSON.parse(readFileSync17(path, "utf-8"));
     return typeof data.asUrl === "string" ? data.asUrl : null;
   } catch {
     return null;
@@ -4754,6 +4977,7 @@ function writeMcpPairedAsUrl(dataDir2, asUrl) {
 // bin/http.ts
 var dataDir = process.env.SUVEREN_DATA_DIR ?? join17(homedir10(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
+validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
 setAsBaseUrl(spUrl);
 var state = new SharedState(spUrl, void 0, dataDir);
@@ -4838,7 +5062,7 @@ app.post("/internal/configure", internalOnly, (req, res) => {
 });
 app.post("/internal/clear-session", internalOnly, (req, res) => {
   const reason = req.body?.reason;
-  const validReason = reason === "as-key-mismatch" || reason === "as-url-changed" ? reason : void 0;
+  const validReason = reason === "as-key-mismatch" || reason === "as-tls-mismatch" || reason === "as-url-changed" ? reason : void 0;
   state.spClient.clearSession(validReason);
   console.error(`[Suveren MCP] Session cleared by control-plane (${validReason ?? "expired"})`);
   res.json({ ok: true });