@cleocode/core 2026.10.18 → 2026.10.19

package/dist/security/override-cap-setting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"override-cap-setting.js","sourceRoot":"","sources":["../../src/security/override-cap-setting.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAE/D,6DAA6D;AAC7D,MAAM,SAAS,GACb,qIAAqI,CAAC;AAwGxI,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD,kEAAkE;AAClE,MAAM,YAAY,GAAG,iCAAiC,CAAC;AAEvD,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,MAAM,GAAG,GAAG,2BAA2B,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAgC,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;gBACpC,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/D,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3C,OAAO;YACL,GAAG,GAAG,4IAA4I;SACnJ,CAAC;IACJ,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE;QACrD,OAAO;YACL,GAAG,GAAG,yFAAyF;SAChG,CAAC;IACJ,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAC7D,OAAO;YACL,GAAG,GAAG,oGAAoG;SAC3G,CAAC;IACJ,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,GAAG,GAAG,CAAC,IAAc,EAAiB,EAAE;QAC5C,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/B,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC;QACd,KAAK;QACL,OAAO;QACP,UAAU;QACV,aAAa;QACb,IAAI;QACJ,GAAG;QACH,IAAI;QACJ,2BAA2B;KAC5B,CAAC,CAAC;IACH,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACvC,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,wBAAwB,CAAC,CAAC;AACvD,CAAC;AAED,0EAA0E;AAC1E,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,EAAE,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,QAAQ,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,WAAW,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CACnB,WAAmB;IAKnB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,YAAY,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CACnB,CAAC;QAChC,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,8BAA8B,EAAE,CAAC;QAC/D,OAAO;YACL,KAAK,EAAE,MAAM;YACb,IAAI,EAAE;gBACJ,aAAa,EAAE,CAAC;gBAChB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;gBACnC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;aAC9B;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAE5D,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACrC,OAAO,aAAa,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1D,CAAC;AAED,oCAAoC;AACpC,SAAS,WAAW,CAClB,GAAW,EACX,KAAa,EACb,KAAa,EACb,IAAY,EACZ,WAAmB;IAEnB,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,IAAY;IACpD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACvE,OAAO,aAAa,CAAC,QAAQ,CAC3B,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,SAAwB;IAC1C,MAAM,EAAE,GAAG,CAAC,IAAc,EAAiB,EAAE;QAC3C,IAAI,CAAC;YACH,OAAO,CACL,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;gBACvB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAClB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS;QACT,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CACZ,WAAmB,EACnB,MAAc,EACd,MAA+F;IAE/F,wBAAwB,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,oBAAoB;QAC1B,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;QACnD,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,eAAe,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI;QACnC,WAAW,EAAE,YAAY,EAAE;QAC3B,cAAc,EAAE,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,oBAAoB;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB;IAMnB,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QACzB,OAAO,MAAM;YACX,CAAC,CAAC;gBACE,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,gFAAgF,MAAM,CAAC,WAAW,mFAAmF,oBAAoB,aAAa;aAC5N;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;QACtB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,4CAA4C,IAAI,CAAC,GAAG,0DAA0D,oBAAoB,YAAY;SACpJ,CAAC;IACJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QACT,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,6CAA6C,EAAE,iFAAiF;SACtI,CAAC;IACJ,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACzC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,6CAA6C,EAAE,mCAAmC,MAAM,CAAC,WAAW,mBAAmB;SAC7H,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACzE,MAAM,KAAK,GACT,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,KAAK,CAAC,KAAK,IAAI,CAAC;QAChB,KAAK,CAAC,KAAK,IAAI,4BAA4B;QAC3C,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,CAAC,MAAM,eAAe,CACpB,WAAW,CAAC,oBAAoB,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,EACxF,KAAK,CAAC,GAAG,EACT,IAAI,CAAC,WAAW,CACjB,CAAC,CAAC;IACL,IAAI,CAAC,KAAK;QACR,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,GAAG,oBAAoB,yFAAyF;SACtH,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,4EAA4E;IAC5E,iDAAiD;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,MAAM,CAAC,WAAW,wEAAwE,KAAK,CAAC,MAAM,CAAC,SAAS,MAAM,oBAAoB,kBAAkB,gCAAgC,YAAY,oBAAoB,eAAe,CAAC;QAC/Q,yDAAyD;QACzD,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACpG,IAAI,KAAK,CAAC,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACjD,KAAK,CAAC,WAAW,EAAE,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACvF,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE;gBAClC,aAAa,EAAE,CAAC;gBAChB,QAAQ,EAAE;oBACR,GAAG,aAAa,EAAE;oBAClB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE;iBAC7E;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClG,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAC3B,OAAO,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,oBAAoB,kBAAkB,gCAAgC,GAAG,CAAC;IAC3G,KAAK,CAAC,WAAW,EAAE,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QACvB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0CAA0C,oBAAoB,OAAO,gCAAgC,GAAG;YACjH,GAAG,EAAE,gCAAgC;YACrC,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAC3B,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,2BAA2B,KAAK,CAAC,GAAG,KAAK,oBAAoB,OAAO,gCAAgC,GAAG;YAChH,GAAG,EAAE,gCAAgC;YACrC,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC;IAC1D,IAAI,CAAC,CAAC,SAAS;QACb,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,aAAa,CAAC,CAAC,WAAW,sEAAsE;gBAChG,IAAI,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,UAAU,gBAAgB,CAAC,CAAC,SAAS,IAAI,SAAS,WAAW,CAAC,CAAC,GAAG,IAAI,SAAS,GAAG;gBAC3G,WAAW,CAAC,CAAC,MAAM,IAAI,SAAS,MAAM,oBAAoB,UAAU,gCAAgC,qDAAqD;gBACzJ,KAAK,oBAAoB,kFAAkF;gBAC3G,wFAAwF;YAC1F,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,EAAE,gCAAgC;YACrC,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,oBAAoB;YAC/E,CAAC,CAAC;gBACE,aAAa,CAAC,CAAC,WAAW,oCAAoC,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC,SAAS,IAAI,SAAS,SAAS,CAAC,CAAC,GAAG,IAAI,SAAS,YAAY,CAAC,CAAC,MAAM,IAAI,SAAS,uBAAuB;aACnM;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACzC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,MAAM,8CAA8C,CAAC;YAC7F,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,gBAAgB,CAAC,WAAW,CAAC;KACjC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,UAAU;QAClB,OAAO,EACL,aAAa,CAAC,CAAC,WAAW,aAAa,CAAC,CAAC,UAAU,eAAe,CAAC,CAAC,SAAS,IAAI,SAAS,GAAG;YAC7F,UAAU,CAAC,CAAC,GAAG,IAAI,SAAS,YAAY,CAAC,CAAC,MAAM,IAAI,SAAS,MAAM,oBAAoB,MAAM,GAAG,IAAI;YACpG,4EAA4E;QAC9E,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CACjB,MAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB,CAAC,wBAAwB;YACtD,OAAO,EAAE,4CAA4C;SACtD,CAAC;IACJ,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB,CAAC,wBAAwB;YACtD,OAAO,EACL,+IAA+I;SAClJ,CAAC;IACJ,MAAM,IAAI,GAAG,qBAAqB,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,QAAQ;QACzC,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,OAAO;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,oBAAoB;YAC5C,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,UAAU;SACzC,CAAC;IACJ,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC;QACrF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB,CAAC,wBAAwB;YACtD,OAAO,EAAE,mEAAmE;SAC7E,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB,EAAE,KAAc;IAC9E,MAAM,QAAQ,GAAG,CAAC,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,OAAO,GAAG,GAAG,oBAAoB,4FAA4F,0BAA0B,OAAO,SAAS,GAAG,CAAC;IACjL,KAAK,CAAC,WAAW,EAAE,0BAA0B,EAAE;QAC7C,SAAS,EAAE,IAAI;QACf,GAAG,EAAE,QAAQ;QACb,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,EAAE,4BAA4B;KACrC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAmB,EACnB,MAAmB,EACnB,OAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,OAAe,EAAqB,EAAE;QAClE,KAAK,CAAC,WAAW,EAAE,sBAAsB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,+BAA+B,SAAS,GAAG,EAAE,CAAC;IAC7F,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;IAC/D,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;QAChD,OAAO,MAAM;QACX,mHAAmH;QACnH,0BAA0B,EAC1B,gDAAgD,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,oBAAoB,aAAa,CAC5J,CAAC;IACJ,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,SAAwC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI;gBACb,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;oBACtE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAChB,CAAC,CAAC,SAAS,CAAC,CAAC;YACjB,MAAM,MAAM,GACV,OAAO,KAAK,SAAS;gBACrB,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,WAAW,CAAC;YAChF,IAAI,CAAC,MAAM;gBACT,OAAO,MAAM;gBACX,mHAAmH;gBACnH,yBAAyB,EACzB,qDAAqD,QAAQ,CAAC,WAAW,kOAAkO,CAC5S,CAAC;QACN,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS,GAAG,qBAAqB,CAAC;aACxD,IAAI,OAAO,KAAK,aAAa;YAAE,SAAS,GAAG,qBAAqB,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,IAAI,GAAsB;QAC9B,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,SAAS;QAC1B,IAAI;QACJ,QAAQ,EAAE,EAAE;QACZ,GAAG,IAAI;KACR,CAAC;IACF,MAAM,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE;QAClC,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE;YACR,GAAG,aAAa,EAAE;YAClB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE;gBACzB,WAAW,EAAE,GAAG,CAAC,SAAS;gBAC1B,WAAW;gBACX,WAAW;gBACX,IAAI;gBACJ,GAAG,IAAI;gBACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC;SACF;KACF,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc,EAAE;QAC9E,SAAS;QACT,EAAE,EAAE,IAAI;QACR,MAAM,EACJ,IAAI,CAAC,KAAK,KAAK,IAAI;YACjB,CAAC,CAAC,sBAAsB,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,WAAW,wBAAwB,CAAC,CAAC,CAAC,uCAAuC,SAAS,GAAG,gCAAgC,IAAI,CAAC,GAAG,IAAI,SAAS,YAAY,IAAI,CAAC,MAAM,IAAI,SAAS,GAAG;YACxP,CAAC,CAAC,aAAa,WAAW,kBAAkB,IAAI,CAAC,GAAG,IAAI,SAAS,YAAY,IAAI,CAAC,MAAM,IAAI,SAAS,GAAG;KAC7G,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,MAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,OAAe,EAAqB,EAAE;QAClE,KAAK,CAAC,WAAW,EAAE,8BAA8B,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,gCAAgC,SAAS,GAAG,EAAE,CAAC;IAC9F,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO,MAAM;QACX,mHAAmH;QACnH,2BAA2B,EAC3B,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,wCAAwC,CACvF,CAAC;IACJ,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QACzF,OAAO,MAAM,CACX,uBAAuB,CAAC,wBAAwB,EAChD,sEAAsE,CACvE,CAAC;IACJ,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IACtD,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE;QAClC,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE;YACR,GAAG,aAAa,EAAE;YAClB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SAC9E;KACF,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,EAAE,sBAAsB,EAAE;QACzC,SAAS;QACT,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,uBAAuB,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KACxI,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,KAAsC;IAEtC,MAAM,QAAQ,GAAG,CAAC,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,OAAe,EAAwB,EAAE;QACrE,KAAK,CAAC,WAAW,EAAE,0BAA0B,EAAE;YAC7C,SAAS;YACT,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,KAAK,CAAC,KAAK;YACjB,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,OAAO,EAAE,GAAG,OAAO,8BAA8B,oBAAoB,KAAK,SAAS,GAAG;SACvF,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;QACnD,+EAA+E;QAC/E,OAAO,MAAM,CAAC,cAAc,EAAE,GAAG,oBAAoB,8BAA8B,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM;QACpC,OAAO,MAAM;QACX,mHAAmH;QACnH,sBAAsB,EACtB,yEAAyE,oBAAoB,KAAK,CACnG,CAAC;IACJ,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO,MAAM;QACX,mHAAmH;QACnH,2BAA2B,EAC3B,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,+BAA+B,GAAG,CAC9E,CAAC;IACJ,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW;QACpC,OAAO,MAAM,CACX,uBAAuB,CAAC,wBAAwB,EAChD,sEAAsE,CACvE,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,WAAW,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAC7E,CAAC;IACF,MAAM,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE;QAC/C,GAAG,IAAI;QACP,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;KAC9E,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,EAAE,kBAAkB,EAAE;QACrC,SAAS;QACT,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;AACvE,CAAC"}

package/dist/security/override-cap.d.ts

@@ -1,14 +1,12 @@
 /**
- * Per-session CLEO_OWNER_OVERRIDE cap with waiver-doc requirement (T1501 / P0-5).
+ * Per-session CLEO_OWNER_OVERRIDE cap (T1501 / P0-5).
  *
- * Enforces a hard cap (default: 10) on how many times `CLEO_OWNER_OVERRIDE` may
- * be used within a single session.  Above the cap the call is rejected with
- * `E_OVERRIDE_CAP_EXCEEDED` unless the operator sets:
- *
- *   `CLEO_OWNER_OVERRIDE_WAIVER=<absolute path to waiver doc>`
- *
- * The waiver file must exist and contain `cap-waiver: true` (YAML front-matter
- * or a plain line in the file).
+ * Enforces a hard cap (default: 10, or the owner's sealed
+ * `evidence.overrideCapPerSession`, T13787) on how many times
+ * `CLEO_OWNER_OVERRIDE` may be used within a single session. Above the cap the
+ * call is rejected with `E_OVERRIDE_CAP_EXCEEDED`. The former
+ * `CLEO_OWNER_OVERRIDE_WAIVER` file no longer lifts the cap (T13787): any agent
+ * could write one; a set waiver is ignored and audited.
  *
  * The running count is persisted in
  * `.cleo/audit/session-override-count.<sessionId>.json` so it survives across
@@ -36,6 +34,15 @@
  * workers that each re-verify, so the original 3 was too low.
  */
 export declare const DEFAULT_OVERRIDE_CAP_PER_SESSION = 10;
+/**
+ * The per-project setting that replaces the default cap (T13787). Only the
+ * owner path in `override-cap-setting.ts` may change it.
+ */
+export declare const OVERRIDE_CAP_SETTING = "evidence.overrideCapPerSession";
+/** The largest cap the owner may set; a larger value is clamped to it (T13787). */
+export declare const MAX_OVERRIDE_CAP_PER_SESSION = 100;
+/** The owner command that changes the cap, named in every refusal (T13787). */
+export declare const OVERRIDE_CAP_OWNER_COMMAND = "cleo config set evidence.overrideCapPerSession <n>";
 /**
  * Canonical worktree path segment used to detect worktree-orchestrate context
  * (T1504 / ADR-059 §D3).
@@ -114,23 +121,6 @@ export declare function writeSessionOverrideCount(projectRoot: string, sessionId
  * @task T9505
  */
 export declare function clearSessionOverrideCount(projectRoot: string, sessionId: string): void;
-/**
- * Validate that a waiver document exists and contains the required marker.
- *
- * The waiver file must:
- *   1. Exist at the absolute path specified by `CLEO_OWNER_OVERRIDE_WAIVER`.
- *   2. Contain the string `cap-waiver: true` (any position in the file).
- *
- * @param waiverPath - Absolute path to the waiver document.
- * @returns `{ valid: true }` when the waiver is accepted, or
- *          `{ valid: false, reason: string }` when it is rejected.
- *
- * @task T1501
- */
-export declare function validateWaiverDoc(waiverPath: string): {
-    valid: boolean;
-    reason?: string;
-};
 /** Result of the override cap check. */
 export interface OverrideCapResult {
     /** Whether the override is permitted. */
@@ -152,8 +142,8 @@ export interface OverrideCapResult {
 /**
  * Check and enforce the per-session CLEO_OWNER_OVERRIDE cap.
  *
- * Reads the persisted count, checks it against the cap, validates the waiver
- * doc when required, increments the count on success, and returns the ordinal.
+ * Reads the persisted count, checks it against the cap, increments the count
+ * on success, and returns the ordinal.
  *
  * ## Worktree-context exemption (T1504 / ADR-059 §D3)
  *
@@ -163,7 +153,8 @@ export interface OverrideCapResult {
  *
  * @param projectRoot - Absolute path to the project root.
  * @param sessionId - Active session ID ("global" when no session is active).
- * @param cap - Maximum overrides allowed per session (default: 10).
+ * @param cap - Maximum overrides allowed per session (default: 10); callers pass
+ *   the project's owner setting from `resolveOverrideCap` (T13787).
  * @param command - CLI command string used for worktree-context detection (optional).
  * @returns `OverrideCapResult` indicating whether the override is permitted.
  *

package/dist/security/override-cap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"override-cap.d.ts","sourceRoot":"","sources":["../../src/security/override-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAWH;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAIpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAMD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG1F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAiBvF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,IAAI,CAUN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAStF;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BzF;AAMD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAyC,EAC9C,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,CA6CnB"}
+{"version":3,"file":"override-cap.d.ts","sourceRoot":"","sources":["../../src/security/override-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAYH;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,mCAAmC,CAAC;AAErE,mFAAmF;AACnF,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,uDAAgD,CAAC;AAExF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAIpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAMD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG1F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAiBvF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,IAAI,CAUN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAStF;AAMD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAyC,EAC9C,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,CAqDnB"}

package/dist/security/override-cap.js

@@ -1,14 +1,12 @@
 /**
- * Per-session CLEO_OWNER_OVERRIDE cap with waiver-doc requirement (T1501 / P0-5).
+ * Per-session CLEO_OWNER_OVERRIDE cap (T1501 / P0-5).
  *
- * Enforces a hard cap (default: 10) on how many times `CLEO_OWNER_OVERRIDE` may
- * be used within a single session.  Above the cap the call is rejected with
- * `E_OVERRIDE_CAP_EXCEEDED` unless the operator sets:
- *
- *   `CLEO_OWNER_OVERRIDE_WAIVER=<absolute path to waiver doc>`
- *
- * The waiver file must exist and contain `cap-waiver: true` (YAML front-matter
- * or a plain line in the file).
+ * Enforces a hard cap (default: 10, or the owner's sealed
+ * `evidence.overrideCapPerSession`, T13787) on how many times
+ * `CLEO_OWNER_OVERRIDE` may be used within a single session. Above the cap the
+ * call is rejected with `E_OVERRIDE_CAP_EXCEEDED`. The former
+ * `CLEO_OWNER_OVERRIDE_WAIVER` file no longer lifts the cap (T13787): any agent
+ * could write one; a set waiver is ignored and audited.
  *
  * The running count is persisted in
  * `.cleo/audit/session-override-count.<sessionId>.json` so it survives across
@@ -32,6 +30,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { BRANCH_LOCK_ERROR_CODES } from '@cleocode/contracts/branch-lock.js';
+import { appendOwnerOverrideAudit, isTtyPresent } from './owner-override-auth.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -42,6 +41,15 @@ import { BRANCH_LOCK_ERROR_CODES } from '@cleocode/contracts/branch-lock.js';
  * workers that each re-verify, so the original 3 was too low.
  */
 export const DEFAULT_OVERRIDE_CAP_PER_SESSION = 10;
+/**
+ * The per-project setting that replaces the default cap (T13787). Only the
+ * owner path in `override-cap-setting.ts` may change it.
+ */
+export const OVERRIDE_CAP_SETTING = 'evidence.overrideCapPerSession';
+/** The largest cap the owner may set; a larger value is clamped to it (T13787). */
+export const MAX_OVERRIDE_CAP_PER_SESSION = 100;
+/** The owner command that changes the cap, named in every refusal (T13787). */
+export const OVERRIDE_CAP_OWNER_COMMAND = `cleo config set ${OVERRIDE_CAP_SETTING} <n>`;
 /**
  * Canonical worktree path segment used to detect worktree-orchestrate context
  * (T1504 / ADR-059 §D3).
@@ -169,54 +177,11 @@ export function clearSessionOverrideCount(projectRoot, sessionId) {
         // Non-fatal — clearing the counter file must never block session end.
     }
 }
-// ---------------------------------------------------------------------------
-// Waiver validation
-// ---------------------------------------------------------------------------
-/**
- * Validate that a waiver document exists and contains the required marker.
- *
- * The waiver file must:
- *   1. Exist at the absolute path specified by `CLEO_OWNER_OVERRIDE_WAIVER`.
- *   2. Contain the string `cap-waiver: true` (any position in the file).
- *
- * @param waiverPath - Absolute path to the waiver document.
- * @returns `{ valid: true }` when the waiver is accepted, or
- *          `{ valid: false, reason: string }` when it is rejected.
- *
- * @task T1501
- */
-export function validateWaiverDoc(waiverPath) {
-    if (!waiverPath) {
-        return { valid: false, reason: 'CLEO_OWNER_OVERRIDE_WAIVER is empty' };
-    }
-    if (!existsSync(waiverPath)) {
-        return {
-            valid: false,
-            reason: `Waiver document not found at: ${waiverPath}`,
-        };
-    }
-    let content;
-    try {
-        content = readFileSync(waiverPath, 'utf-8');
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        return { valid: false, reason: `Cannot read waiver document: ${msg}` };
-    }
-    if (!content.includes('cap-waiver: true')) {
-        return {
-            valid: false,
-            reason: "Waiver document must contain 'cap-waiver: true' (YAML front-matter or plain line). " +
-                `File: ${waiverPath}`,
-        };
-    }
-    return { valid: true };
-}
 /**
  * Check and enforce the per-session CLEO_OWNER_OVERRIDE cap.
  *
- * Reads the persisted count, checks it against the cap, validates the waiver
- * doc when required, increments the count on success, and returns the ordinal.
+ * Reads the persisted count, checks it against the cap, increments the count
+ * on success, and returns the ordinal.
  *
  * ## Worktree-context exemption (T1504 / ADR-059 §D3)
  *
@@ -226,7 +191,8 @@ export function validateWaiverDoc(waiverPath) {
  *
  * @param projectRoot - Absolute path to the project root.
  * @param sessionId - Active session ID ("global" when no session is active).
- * @param cap - Maximum overrides allowed per session (default: 10).
+ * @param cap - Maximum overrides allowed per session (default: 10); callers pass
+ *   the project's owner setting from `resolveOverrideCap` (T13787).
  * @param command - CLI command string used for worktree-context detection (optional).
  * @returns `OverrideCapResult` indicating whether the override is permitted.
  *
@@ -256,22 +222,32 @@ export function checkAndIncrementOverrideCap(projectRoot, sessionId, cap = DEFAU
         writeSessionOverrideCount(projectRoot, sessionId, ordinal);
         return { allowed: true, sessionOverrideOrdinal: ordinal };
     }
-    // Above cap — check for waiver.
+    // T13787: the waiver file is gone — any agent could write one, a back door
+    // around a cap only the owner may raise. A set waiver is ignored, and audited.
     const waiverPath = (process.env['CLEO_OWNER_OVERRIDE_WAIVER'] ?? '').trim();
-    const waiver = validateWaiverDoc(waiverPath);
-    if (!waiver.valid) {
-        return {
-            allowed: false,
-            errorCode: BRANCH_LOCK_ERROR_CODES.E_OVERRIDE_CAP_EXCEEDED,
-            errorMessage: `Per-session CLEO_OWNER_OVERRIDE cap exceeded: ${current} of ${cap} overrides used. ` +
-                `To proceed above the cap, set CLEO_OWNER_OVERRIDE_WAIVER=<path> to a file containing ` +
-                `'cap-waiver: true'. ` +
-                (waiver.reason ? `Waiver rejected: ${waiver.reason}` : ''),
-        };
-    }
-    // Waiver accepted — permit and increment beyond cap.
-    const ordinal = current + 1;
-    writeSessionOverrideCount(projectRoot, sessionId, ordinal);
-    return { allowed: true, sessionOverrideOrdinal: ordinal };
+    if (waiverPath)
+        appendOwnerOverrideAudit(projectRoot, {
+            timestamp: new Date().toISOString(),
+            taskId: '*',
+            gate: OVERRIDE_CAP_SETTING,
+            action: 'override-waiver-ignored',
+            agent_id: process.env['CLEO_AGENT_ID'] ?? 'unknown',
+            session_id: sessionId,
+            token_validated: false,
+            tty_present: isTtyPresent(),
+            override_count: current,
+            reason: `CLEO_OWNER_OVERRIDE_WAIVER=${waiverPath} no longer lifts the cap (removed by T13787)`,
+            pid: process.pid,
+            setting: OVERRIDE_CAP_SETTING,
+        });
+    return {
+        allowed: false,
+        errorCode: BRANCH_LOCK_ERROR_CODES.E_OVERRIDE_CAP_EXCEEDED,
+        errorMessage: `Per-session CLEO_OWNER_OVERRIDE cap exceeded: ${current} of ${cap} overrides used ` +
+            `(${OVERRIDE_CAP_SETTING} = ${cap}). Only the owner can raise it, with ` +
+            `\`${OVERRIDE_CAP_OWNER_COMMAND}\` in an interactive terminal, in a session started ` +
+            `with \`cleo session start --scope global --name owner --owner-auth\` (T13787). ` +
+            `CLEO_OWNER_OVERRIDE_WAIVER no longer lifts the cap.`,
+    };
 }
 //# sourceMappingURL=override-cap.js.map

package/dist/security/override-cap.js.map

@@ -1 +1 @@
-{"version":3,"file":"override-cap.js","sourceRoot":"","sources":["../../src/security/override-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtF,uDAAuD;IACvD,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAiB;IAChF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,MAAM,OAAO,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;IAC7E,MAAM,IAAI,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,OAAO,IAAI,MAAM;YACjB,OAAQ,MAAkC,CAAC,OAAO,CAAC,KAAK,QAAQ,EAChE,CAAC;YACD,OAAQ,MAA4B,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAmB,EACnB,SAAiB,EACjB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE;YAC7F,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB,EAAE,SAAiB;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAiC,UAAU,EAAE;SACtD,CAAC;IACJ,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,GAAG,EAAE,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,qFAAqF;gBACrF,SAAS,UAAU,EAAE;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAyBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmB,EACnB,SAAiB,EACjB,MAAc,gCAAgC,EAC9C,OAAgB;IAEhB,uEAAuE;IACvE,yEAAyE;IACzE,mFAAmF;IACnF,IAAI,OAAO,KAAK,SAAS,IAAI,0BAA0B,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,sBAAsB,EAAE,OAAO,GAAG,CAAC,EAAE,oCAAoC;YACzE,eAAe,EAAE,IAAI;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAEjE,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;QAClB,qCAAqC;QACrC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,CAAC;QAC5B,yBAAyB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB,CAAC,uBAAuB;YAC1D,YAAY,EACV,iDAAiD,OAAO,OAAO,GAAG,mBAAmB;gBACrF,uFAAuF;gBACvF,sBAAsB;gBACtB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,CAAC;IAC5B,yBAAyB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"override-cap.js","sourceRoot":"","sources":["../../src/security/override-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAElF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAErE,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,oBAAoB,MAAM,CAAC;AAExF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtF,uDAAuD;IACvD,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAiB;IAChF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,MAAM,OAAO,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;IAC7E,MAAM,IAAI,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,OAAO,IAAI,MAAM;YACjB,OAAQ,MAAkC,CAAC,OAAO,CAAC,KAAK,QAAQ,EAChE,CAAC;YACD,OAAQ,MAA4B,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAmB,EACnB,SAAiB,EACjB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE;YAC7F,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB,EAAE,SAAiB;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAyBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmB,EACnB,SAAiB,EACjB,MAAc,gCAAgC,EAC9C,OAAgB;IAEhB,uEAAuE;IACvE,yEAAyE;IACzE,mFAAmF;IACnF,IAAI,OAAO,KAAK,SAAS,IAAI,0BAA0B,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,sBAAsB,EAAE,OAAO,GAAG,CAAC,EAAE,oCAAoC;YACzE,eAAe,EAAE,IAAI;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAEjE,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;QAClB,qCAAqC;QACrC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,CAAC;QAC5B,yBAAyB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,UAAU;QACZ,wBAAwB,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;YACnD,UAAU,EAAE,SAAS;YACrB,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,YAAY,EAAE;YAC3B,cAAc,EAAE,OAAO;YACvB,MAAM,EAAE,8BAA8B,UAAU,8CAA8C;YAC9F,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAC;IACL,OAAO;QACL,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,uBAAuB,CAAC,uBAAuB;QAC1D,YAAY,EACV,iDAAiD,OAAO,OAAO,GAAG,kBAAkB;YACpF,IAAI,oBAAoB,MAAM,GAAG,uCAAuC;YACxE,KAAK,0BAA0B,sDAAsD;YACrF,iFAAiF;YACjF,qDAAqD;KACxD,CAAC;AACJ,CAAC"}

package/dist/security/owner-override-auth.d.ts

@@ -56,6 +56,64 @@ export declare function deriveOwnerAuthToken(sessionId: string, password: string
  * @task T1123
  */
 export declare function verifyOwnerAuthToken(callerToken: string, storedToken: string): boolean;
+/**
+ * The owner mark of `cleo session start --owner` (T13790), stored in
+ * `sessions.owner_auth_token`: alone, or as `<mark>|<verifier>` when the
+ * session was also started with `--owner-auth`. Password-free; only the
+ * interactive session start writes it.
+ */
+export declare const OWNER_SESSION_MARK = "owner-mark$v1";
+/**
+ * Whether a stored `sessions.owner_auth_token` carries the owner mark
+ * ({@link OWNER_SESSION_MARK}); an `--owner-auth` verifier alone does not.
+ *
+ * @param stored - The stored value, or null.
+ * @returns True for an owner-marked session.
+ * @task T13790
+ */
+export declare function isOwnerSessionMark(stored: string | null | undefined): boolean;
+/**
+ * Why this process may not mark its session as the owner's, or null (T13790):
+ * `cleo session start --owner` is password-free, so it is refused when any
+ * `CLEO_AGENT_ROLE` is set or stdin/stderr are not an interactive terminal.
+ *
+ * @param env - Process env.
+ * @returns The refusal, or null when the mark may be set.
+ * @task T13790
+ */
+export declare function ownerMarkRefusal(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * scrypt cost for the owner-auth password (T13787 review MEDIUM 4): ~0.1 s per
+ * guess, against ~1M/s for the bare HMAC token it replaces.
+ */
+export declare const OWNER_SCRYPT_PARAMS: {
+    readonly N: number;
+    readonly r: 8;
+    readonly p: 1;
+    readonly maxmem: number;
+};
+/**
+ * A slow verifier for the owner-auth password, stored in
+ * `sessions.owner_auth_token` by `cleo session start --owner-auth` in place of
+ * the bare `HMAC(password, name)` (T13787): `scrypt$v1$<salt>$<hash>`.
+ *
+ * @param password - The password the owner typed.
+ * @returns The verifier record.
+ * @task T13787
+ */
+export declare function createOwnerAuthVerifier(password: string): string;
+/**
+ * Whether `password` matches a session's stored owner-auth record: a
+ * {@link createOwnerAuthVerifier} verifier, or a legacy `HMAC(password, name)`
+ * token from sessions started before T13787.
+ *
+ * @param password - The password typed now.
+ * @param stored - `sessions.owner_auth_token`.
+ * @param sessionName - The session's name (the legacy HMAC key).
+ * @returns True when it matches.
+ * @task T13787
+ */
+export declare function verifyOwnerAuthPassword(password: string, stored: string, sessionName: string): boolean;
 /**
  * Check that stdin and stderr are both connected to a TTY.
  *

package/dist/security/owner-override-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-override-auth.d.ts","sourceRoot":"","sources":["../../src/security/owner-override-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAqBpE;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAe9C;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAatF;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AASD;;;GAGG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,aAAa,GAAE,MAAyC,GACvD,OAAO,CAKT;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE1D;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,wBAAwB,GAC/B,IAAI,CAQN;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAelB;AAMD,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,wBAAwB,CAsD3B"}
+{"version":3,"file":"owner-override-auth.d.ts","sourceRoot":"","sources":["../../src/security/owner-override-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAqBpE;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAe9C;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAatF;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAMpF;AAKD;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;CAAgE,CAAC;AAEjG;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAqBT;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AASD;;;GAGG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,aAAa,GAAE,MAAyC,GACvD,OAAO,CAKT;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE1D;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,wBAAwB,GAC/B,IAAI,CAQN;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAelB;AAMD,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,wBAAwB,CAsD3B"}

package/dist/security/owner-override-auth.js

@@ -15,7 +15,7 @@
  * @task T1123
  * @adr ADR-055
  */
-import { createHmac } from 'node:crypto';
+import { createHmac, randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
 import { appendFileSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { BRANCH_LOCK_ERROR_CODES } from '@cleocode/contracts/branch-lock.js';
@@ -104,6 +104,87 @@ export function verifyOwnerAuthToken(callerToken, storedToken) {
     }
     return diff === 0;
 }
+/**
+ * The owner mark of `cleo session start --owner` (T13790), stored in
+ * `sessions.owner_auth_token`: alone, or as `<mark>|<verifier>` when the
+ * session was also started with `--owner-auth`. Password-free; only the
+ * interactive session start writes it.
+ */
+export const OWNER_SESSION_MARK = 'owner-mark$v1';
+/**
+ * Whether a stored `sessions.owner_auth_token` carries the owner mark
+ * ({@link OWNER_SESSION_MARK}); an `--owner-auth` verifier alone does not.
+ *
+ * @param stored - The stored value, or null.
+ * @returns True for an owner-marked session.
+ * @task T13790
+ */
+export function isOwnerSessionMark(stored) {
+    return stored === OWNER_SESSION_MARK || (stored ?? '').startsWith(`${OWNER_SESSION_MARK}|`);
+}
+/**
+ * Why this process may not mark its session as the owner's, or null (T13790):
+ * `cleo session start --owner` is password-free, so it is refused when any
+ * `CLEO_AGENT_ROLE` is set or stdin/stderr are not an interactive terminal.
+ *
+ * @param env - Process env.
+ * @returns The refusal, or null when the mark may be set.
+ * @task T13790
+ */
+export function ownerMarkRefusal(env = process.env) {
+    if ((env['CLEO_AGENT_ROLE'] ?? '').trim() !== '')
+        return `--owner is refused: CLEO_AGENT_ROLE is set (${env['CLEO_AGENT_ROLE']}); only the owner, in their own terminal, marks a session.`;
+    if (!isTtyPresent())
+        return '--owner is refused: stdin and stderr must be an interactive terminal; only the owner, in their own terminal, marks a session.';
+    return null;
+}
+/** Prefix of a {@link createOwnerAuthVerifier} record. */
+const VERIFIER_PREFIX = 'scrypt$v1$';
+/**
+ * scrypt cost for the owner-auth password (T13787 review MEDIUM 4): ~0.1 s per
+ * guess, against ~1M/s for the bare HMAC token it replaces.
+ */
+export const OWNER_SCRYPT_PARAMS = { N: 2 ** 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+/**
+ * A slow verifier for the owner-auth password, stored in
+ * `sessions.owner_auth_token` by `cleo session start --owner-auth` in place of
+ * the bare `HMAC(password, name)` (T13787): `scrypt$v1$<salt>$<hash>`.
+ *
+ * @param password - The password the owner typed.
+ * @returns The verifier record.
+ * @task T13787
+ */
+export function createOwnerAuthVerifier(password) {
+    const salt = randomBytes(16);
+    const hash = scryptSync(password, salt, 32, OWNER_SCRYPT_PARAMS);
+    return `${VERIFIER_PREFIX}${salt.toString('hex')}$${hash.toString('hex')}`;
+}
+/**
+ * Whether `password` matches a session's stored owner-auth record: a
+ * {@link createOwnerAuthVerifier} verifier, or a legacy `HMAC(password, name)`
+ * token from sessions started before T13787.
+ *
+ * @param password - The password typed now.
+ * @param stored - `sessions.owner_auth_token`.
+ * @param sessionName - The session's name (the legacy HMAC key).
+ * @returns True when it matches.
+ * @task T13787
+ */
+export function verifyOwnerAuthPassword(password, stored, sessionName) {
+    // T13790: an owner-marked session stores `<mark>|<verifier>`; a bare mark has no password.
+    if (stored.startsWith(`${OWNER_SESSION_MARK}|`))
+        return verifyOwnerAuthPassword(password, stored.slice(OWNER_SESSION_MARK.length + 1), sessionName);
+    if (stored === OWNER_SESSION_MARK)
+        return false;
+    if (!stored.startsWith(VERIFIER_PREFIX))
+        return verifyOwnerAuthToken(deriveOwnerAuthToken(sessionName, password), stored);
+    const [saltHex, hashHex] = stored.slice(VERIFIER_PREFIX.length).split('$');
+    if (!saltHex || !hashHex)
+        return false;
+    const expected = Buffer.from(hashHex, 'hex');
+    const actual = scryptSync(password, Buffer.from(saltHex, 'hex'), expected.length, OWNER_SCRYPT_PARAMS);
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
 // ---------------------------------------------------------------------------
 // L4c — TTY requirement
 // ---------------------------------------------------------------------------

package/dist/security/owner-override-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-override-auth.js","sourceRoot":"","sources":["../../src/security/owner-override-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAuB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAEhF,+DAA+D;AAC/D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEnD,wEAAwE;IACxE,IAAI,oBAAoB,IAAI,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,sDAAsD;IACtD,IAAI,oBAAoB,KAAK,WAAW,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,QAAgB;IACtE,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,WAAmB;IAC3E,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE5D,gDAAgD;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,sDAAsD;AACtD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,gBAAwB,gCAAgC;IAExD,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,aAAa;QAAE,OAAO,KAAK,CAAC;IAC3C,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,MAAgC;IAEhC,MAAM,UAAU,GAAG,GAAG,WAAW,iCAAiC,CAAC;IACnE,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,MAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAE,CAAC;YAC5D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAOrC;IACC,oBAAoB;IACpB,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB,CAAC,+BAA+B;YAClE,YAAY,EACV,gEAAgE;gBAChE,oEAAoE;SACvE,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB,CAAC,oBAAoB;YACvD,YAAY,EACV,wCAAwC;gBACxC,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,uBAAuB,CAAC,wBAAwB;gBAC3D,YAAY,EACV,8DAA8D;oBAC9D,8DAA8D;aACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,WAAW,GAAG,2BAA2B,CAC7C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,IAAI,gCAAgC,CACvD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB,CAAC,qBAAqB;YACxD,YAAY,EACV,iCAAiC,KAAK,OAAO,IAAI,CAAC,aAAa,IAAI,gCAAgC,GAAG;gBACtG,+DAA+D;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"owner-override-auth.js","sourceRoot":"","sources":["../../src/security/owner-override-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAuB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAEhF,+DAA+D;AAC/D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEnD,wEAAwE;IACxE,IAAI,oBAAoB,IAAI,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,sDAAsD;IACtD,IAAI,oBAAoB,KAAK,WAAW,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,QAAgB;IACtE,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,WAAmB;IAC3E,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE5D,gDAAgD;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiC;IAClE,OAAO,MAAM,KAAK,kBAAkB,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAC9C,OAAO,+CAA+C,GAAG,CAAC,iBAAiB,CAAC,4DAA4D,CAAC;IAC3I,IAAI,CAAC,YAAY,EAAE;QACjB,OAAO,+HAA+H,CAAC;IACzI,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0DAA0D;AAC1D,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAW,CAAC;AAEjG;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO,GAAG,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,MAAc,EACd,WAAmB;IAEnB,2FAA2F;IAC3F,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC;QAC7C,OAAO,uBAAuB,CAC5B,QAAQ,EACR,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,EAC3C,WAAW,CACZ,CAAC;IACJ,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;QACrC,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACnF,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,UAAU,CACvB,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAC3B,QAAQ,CAAC,MAAM,EACf,mBAAmB,CACpB,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,sDAAsD;AACtD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,gBAAwB,gCAAgC;IAExD,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,aAAa;QAAE,OAAO,KAAK,CAAC;IAC3C,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,MAAgC;IAEhC,MAAM,UAAU,GAAG,GAAG,WAAW,iCAAiC,CAAC;IACnE,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,MAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAE,CAAC;YAC5D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAOrC;IACC,oBAAoB;IACpB,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB,CAAC,+BAA+B;YAClE,YAAY,EACV,gEAAgE;gBAChE,oEAAoE;SACvE,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB,CAAC,oBAAoB;YACvD,YAAY,EACV,wCAAwC;gBACxC,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,uBAAuB,CAAC,wBAAwB;gBAC3D,YAAY,EACV,8DAA8D;oBAC9D,8DAA8D;aACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,WAAW,GAAG,2BAA2B,CAC7C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,IAAI,gCAAgC,CACvD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,uBAAuB,CAAC,qBAAqB;YACxD,YAAY,EACV,iCAAiC,KAAK,OAAO,IAAI,CAAC,aAAa,IAAI,gCAAgC,GAAG;gBACtG,+DAA+D;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/security/owner-override-authority.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Who may use `CLEO_OWNER_OVERRIDE=1` (T13790, owner decision 2026-10-16).
+ *
+ * The override stays an env var with no password prompt of its own, but it is
+ * honoured only for the owner:
+ *  1. **Role fence** (T1118 L4b): a process whose `CLEO_AGENT_ROLE` was
+ *     `worker`, `lead` or `subagent` at bootstrap, or changed since, is refused.
+ *  2. **Owner-marked session**: the bound session was started interactively
+ *     with `cleo session start --scope global --name <n> --owner` — no
+ *     password (owner decision: lighter), but refused unless stdin and stderr
+ *     are a terminal and no `CLEO_AGENT_ROLE` is set ({@link ownerMarkRefusal}).
+ *     No env var marks a session as the owner's, so a parent cannot hand the
+ *     mark down. An agent session with no `CLEO_AGENT_ROLE` is therefore
+ *     fenced like a worker: it has no mark. (`--owner-auth` and its password
+ *     are only for the T13787 cap enrollment; they do not mark a session.)
+ *  3. **The owner's own terminal**: the override call itself runs on a TTY
+ *     (stdin and stderr). An agent spawned from the owner's session binds to
+ *     that same session (it inherits the harness session id or
+ *     `CLEO_SESSION_ID`), but its tool shell has no TTY, so it is not the owner
+ *     by default.
+ * Every refusal is appended to `.cleo/audit/force-bypass.jsonl`.
+ *
+ * Limits: these are same-OS-user checks. They fence default and accidental
+ * agent use; a process that emulates a terminal (`script`, `expect`) can mark a
+ * session and pass the TTY check, and a process that writes the session row
+ * directly is not stopped. The owner accepted that trade-off for a
+ * password-free switch.
+ *
+ * @task T13790
+ */
+/** How the owner marks a session, named in every refusal. */
+export declare const OWNER_SESSION_COMMAND = "cleo session start --scope global --name owner --owner";
+export { ownerMarkRefusal } from './owner-override-auth.js';
+/** Whether `CLEO_OWNER_OVERRIDE` asks for an override. */
+export declare function isOwnerOverrideRequested(env?: NodeJS.ProcessEnv): boolean;
+/** What {@link resolveOwnerOverride} decided. */
+export type OwnerOverrideAuthority = {
+    requested: false;
+} | {
+    requested: true;
+    allowed: true;
+    /** `CLEO_OWNER_OVERRIDE_REASON`, or `unspecified`. */
+    reason: string;
+    /** The owner-marked session. */
+    sessionId: string;
+} | {
+    requested: true;
+    allowed: false;
+    code: string;
+    message: string;
+};
+/**
+ * Decide whether this process may use `CLEO_OWNER_OVERRIDE=1` (see the module
+ * doc), auditing a refusal.
+ *
+ * @param projectRoot - Project root (session store and audit log).
+ * @param opts - The surface asking (named in the audit line), and the session
+ *   the caller already resolved; otherwise the bound session is resolved.
+ * @returns Not requested, allowed with the reason, or refused with why.
+ * @task T13790
+ */
+export declare function resolveOwnerOverride(projectRoot: string, opts: {
+    surface: string;
+    taskId?: string;
+    sessionId?: string | null;
+}): Promise<OwnerOverrideAuthority>;
+//# sourceMappingURL=owner-override-authority.d.ts.map

package/dist/security/owner-override-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-override-authority.d.ts","sourceRoot":"","sources":["../../src/security/owner-override-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAUH,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,2DAA2D,CAAC;AAE9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,0DAA0D;AAC1D,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAGtF;AAED,iDAAiD;AACjD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,GACpB;IACE,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpE,OAAO,CAAC,sBAAsB,CAAC,CAwDjC"}