patchwork-os 1.2.0-beta.2.canary.651 → 1.2.0-beta.2.canary.652

package/dist/identity/authSeam.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The authentication seam — ADR-0020 Phase A, and the valuable half.
+ *
+ * One interface that answers "who is making this request?", with Phase A
+ * (local scrypt credentials against `members.json`) behind it today and Phase
+ * B (OIDC, mapped on `sub`) able to slot in later WITHOUT changing any
+ * consumer.
+ *
+ * Phase B is built in `patchwork-control-plane`, not here — ADR-0019 reserves
+ * organisation identity for the non-MIT repo, and the two ADRs were written in
+ * the same commit with this collision unexamined. The seam, `UNATTRIBUTED` and
+ * the fail-soft roster default are MIT and live here. Federation does not.
+ *
+ * ## UNATTRIBUTED is a value, not an absence
+ *
+ * The single most important rule in this file, and the one a reasonable
+ * implementation gets wrong: when nobody has authenticated, the answer is
+ * `UNATTRIBUTED` — never the implicit owner.
+ *
+ * The roster fails SOFT: a missing `members.json` yields one implicit owner so
+ * a single-user machine keeps working. That is right for "who may act on your
+ * own machine". It is catastrophic for "who did this", because defaulting an
+ * actor to the implicit owner writes a claim about a real person into an audit
+ * record on no evidence. An absent `actor` already means "nobody recorded
+ * this" and is never backfilled; a defaulted one is indistinguishable from a
+ * recorded one and is a lie the record cannot walk back.
+ *
+ * So `resolveActor` returns `UNATTRIBUTED` and callers must handle it. There
+ * is deliberately no `?? implicitOwner()` anywhere in this module, and a test
+ * asserts the string never appears.
+ */
+import type { Member } from "./members.js";
+import { type Roster } from "./roster.js";
+/**
+ * Nobody authenticated. Distinct from "authentication failed" only in that
+ * neither may ever be turned into a person.
+ */
+export declare const UNATTRIBUTED: "unattributed";
+export type Principal = {
+    kind: "member";
+    member: Member;
+    via: string;
+} | {
+    kind: typeof UNATTRIBUTED;
+};
+/** Credentials presented by a caller. Extended, never replaced, by Phase B. */
+export interface Presented {
+    memberId?: string;
+    password?: string;
+}
+/**
+ * One authentication method. Phase A is `LocalPasswordProvider` below; Phase B
+ * would add an OIDC provider behind this same shape.
+ *
+ * Returning `null` means "not my business" — no credentials of my kind were
+ * presented. Returning `UNATTRIBUTED` means "mine were, and they were wrong".
+ * The distinction matters: the first lets another provider try, the second
+ * must not.
+ */
+export interface AuthProvider {
+    readonly name: string;
+    authenticate(presented: Presented, roster: Roster): Promise<Principal | null>;
+}
+/** Phase A: member id + password, verified against the stored scrypt record. */
+export declare class LocalPasswordProvider implements AuthProvider {
+    private readonly credentialFor;
+    readonly name = "local-password";
+    /**
+     * `credentialFor` is injected rather than read from the Member type, because
+     * where a hash is STORED is a separate decision from how it is verified —
+     * and putting a password hash on the in-memory `Member` that decision
+     * records copy from is how a hash ends up in an audit log.
+     */
+    constructor(credentialFor: (memberId: string) => string | undefined);
+    authenticate(presented: Presented, roster: Roster): Promise<Principal | null>;
+}
+/**
+ * Try each provider in order; the first that claims the request decides.
+ *
+ * With no providers, or none claiming it, the answer is `UNATTRIBUTED`. That
+ * is the byte-identical status quo for a single-user machine with no
+ * credentials configured: nothing is denied here, because this module answers
+ * WHO, not WHETHER.
+ */
+export declare function resolveActor(presented: Presented, roster: Roster, providers: readonly AuthProvider[]): Promise<Principal>;
+/**
+ * The actor snapshot to stamp on a decision record, or undefined.
+ *
+ * Undefined, NOT a placeholder person. Decision records store the actor as a
+ * snapshot (id + kind + display name as it was) so a later rename cannot
+ * rewrite history; absence stays absence.
+ */
+export declare function actorSnapshot(principal: Principal): {
+    id: string;
+    kind: Member["kind"];
+    displayName: string;
+} | undefined;

package/dist/identity/authSeam.js

@@ -0,0 +1,107 @@
+/**
+ * The authentication seam — ADR-0020 Phase A, and the valuable half.
+ *
+ * One interface that answers "who is making this request?", with Phase A
+ * (local scrypt credentials against `members.json`) behind it today and Phase
+ * B (OIDC, mapped on `sub`) able to slot in later WITHOUT changing any
+ * consumer.
+ *
+ * Phase B is built in `patchwork-control-plane`, not here — ADR-0019 reserves
+ * organisation identity for the non-MIT repo, and the two ADRs were written in
+ * the same commit with this collision unexamined. The seam, `UNATTRIBUTED` and
+ * the fail-soft roster default are MIT and live here. Federation does not.
+ *
+ * ## UNATTRIBUTED is a value, not an absence
+ *
+ * The single most important rule in this file, and the one a reasonable
+ * implementation gets wrong: when nobody has authenticated, the answer is
+ * `UNATTRIBUTED` — never the implicit owner.
+ *
+ * The roster fails SOFT: a missing `members.json` yields one implicit owner so
+ * a single-user machine keeps working. That is right for "who may act on your
+ * own machine". It is catastrophic for "who did this", because defaulting an
+ * actor to the implicit owner writes a claim about a real person into an audit
+ * record on no evidence. An absent `actor` already means "nobody recorded
+ * this" and is never backfilled; a defaulted one is indistinguishable from a
+ * recorded one and is a lie the record cannot walk back.
+ *
+ * So `resolveActor` returns `UNATTRIBUTED` and callers must handle it. There
+ * is deliberately no `?? implicitOwner()` anywhere in this module, and a test
+ * asserts the string never appears.
+ */
+import { verifyPassword } from "./credentials.js";
+import { findMember } from "./roster.js";
+/**
+ * Nobody authenticated. Distinct from "authentication failed" only in that
+ * neither may ever be turned into a person.
+ */
+export const UNATTRIBUTED = "unattributed";
+/** Phase A: member id + password, verified against the stored scrypt record. */
+export class LocalPasswordProvider {
+    credentialFor;
+    name = "local-password";
+    /**
+     * `credentialFor` is injected rather than read from the Member type, because
+     * where a hash is STORED is a separate decision from how it is verified —
+     * and putting a password hash on the in-memory `Member` that decision
+     * records copy from is how a hash ends up in an audit log.
+     */
+    constructor(credentialFor) {
+        this.credentialFor = credentialFor;
+    }
+    async authenticate(presented, roster) {
+        const { memberId, password } = presented;
+        if (!memberId || !password)
+            return null; // not our business
+        const member = findMember(roster, memberId);
+        const record = this.credentialFor(memberId);
+        // Both branches do the same work whether or not the member exists, so
+        // "no such member" and "wrong password" cost the same. Otherwise the
+        // response time enumerates the roster.
+        const stored = record ?? DUMMY_RECORD;
+        const ok = await verifyPassword(password, stored);
+        if (!ok || !member || !member.active || !record) {
+            // A deactivated member keeps their record and history and may do
+            // nothing — including authenticate.
+            return { kind: UNATTRIBUTED };
+        }
+        return { kind: "member", member, via: this.name };
+    }
+}
+/**
+ * A syntactically valid record no password verifies against, so the unknown-
+ * member path performs a real scrypt derivation instead of returning early.
+ * The salt and hash are fixed and meaningless; the point is the CPU time.
+ */
+const DUMMY_RECORD = "scrypt$32768$8$1$AAAAAAAAAAAAAAAAAAAAAA==$" +
+    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+/**
+ * Try each provider in order; the first that claims the request decides.
+ *
+ * With no providers, or none claiming it, the answer is `UNATTRIBUTED`. That
+ * is the byte-identical status quo for a single-user machine with no
+ * credentials configured: nothing is denied here, because this module answers
+ * WHO, not WHETHER.
+ */
+export async function resolveActor(presented, roster, providers) {
+    for (const p of providers) {
+        const result = await p.authenticate(presented, roster);
+        if (result !== null)
+            return result;
+    }
+    return { kind: UNATTRIBUTED };
+}
+/**
+ * The actor snapshot to stamp on a decision record, or undefined.
+ *
+ * Undefined, NOT a placeholder person. Decision records store the actor as a
+ * snapshot (id + kind + display name as it was) so a later rename cannot
+ * rewrite history; absence stays absence.
+ */
+export function actorSnapshot(principal) {
+    if (principal.kind === UNATTRIBUTED)
+        return undefined;
+    const { id, kind, displayName } = principal.member;
+    return { id, kind, displayName };
+}
+//# sourceMappingURL=authSeam.js.map

package/dist/identity/authSeam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSeam.js","sourceRoot":"","sources":["../../src/identity/authSeam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAuB,CAAC;AA0BpD,gFAAgF;AAChF,MAAM,OAAO,qBAAqB;IAUb;IATV,IAAI,GAAG,gBAAgB,CAAC;IAEjC;;;;;OAKG;IACH,YACmB,aAAuD;QAAvD,kBAAa,GAAb,aAAa,CAA0C;IACvE,CAAC;IAEJ,KAAK,CAAC,YAAY,CAChB,SAAoB,EACpB,MAAc;QAEd,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;QACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;QAE5D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE5C,sEAAsE;QACtE,qEAAqE;QACrE,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,YAAY,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAElD,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAChD,iEAAiE;YACjE,oCAAoC;YACpC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,YAAY,GAChB,4CAA4C;IAC5C,sFAAsF,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAoB,EACpB,MAAc,EACd,SAAkC;IAElC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAoB;IAEpB,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC"}

package/dist/identity/credentials.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Per-member local credentials — ADR-0020 Phase A.
+ *
+ * ## Why this exists
+ *
+ * `canApproveAction` is referenced by nothing in production, and not because
+ * anyone forgot. The bridge authenticates ONE shared bearer token, and the
+ * dashboard session cookie's signed payload is literally `v1.${expiresAt}` —
+ * not "no subject field" but no field except expiry. Every approver is
+ * indistinguishable at the auth layer, so segregation of duties is
+ * unenforceable rather than merely unimplemented, and no decision record can
+ * honestly name a person.
+ *
+ * ## `crypto.scrypt`, from the standard library
+ *
+ * The dependency audit is unambiguous: no bcrypt, argon2, passport, next-auth
+ * or jose in this tree, direct or dev. Adding a native-compilation
+ * password-hashing dependency to a project that installs globally on macOS,
+ * Linux and Windows — and which already documents a macOS TCC symlink footgun
+ * around global installs — buys a marginally better KDF for a real
+ * cross-platform install risk. scrypt is memory-hard, in the standard library,
+ * and present in every runtime the bridge already targets.
+ *
+ * ## What this module does NOT do
+ *
+ * It does not read the roster, does not decide authorisation, and does not
+ * touch the dashboard cookie. Verifying a secret and deciding what somebody
+ * may do are different questions, and the cookie change touches ten consumers
+ * and wants its own review. This is the half with no blast radius.
+ */
+/**
+ * scrypt parameters, stored per-hash rather than assumed.
+ *
+ * Encoding them in the record is what makes them changeable later: a stored
+ * hash that does not say how it was derived can only be verified by a
+ * constant, so raising the cost would silently invalidate every existing
+ * credential instead of upgrading it.
+ *
+ * N=2^15 with r=8, p=1 is ~32 MB of memory per verification. `maxmem` must be
+ * raised above Node's 32 MB default or scrypt throws at these parameters —
+ * a footgun that presents as "the correct password is rejected".
+ */
+export declare const SCRYPT_PARAMS: {
+    readonly N: 32768;
+    readonly r: 8;
+    readonly p: 1;
+};
+/** Serialised credential: `scrypt$N$r$p$<saltB64>$<hashB64>`. */
+export type CredentialRecord = string;
+/** Hash a password for storage. A fresh 16-byte salt per call. */
+export declare function hashPassword(password: string, params?: {
+    N: number;
+    r: number;
+    p: number;
+}): Promise<CredentialRecord>;
+/**
+ * Verify a password against a stored record.
+ *
+ * Returns false for a malformed record rather than throwing: a corrupt
+ * credential must read as "this password is wrong", not as an exception a
+ * caller might catch and treat as a pass. It is the same fail-closed reasoning
+ * as ADR-0016 — deciding whether an action happens defaults to no.
+ *
+ * The comparison is `timingSafeEqual` on the derived key. Lengths are checked
+ * first because it throws on a length mismatch, and a thrown comparison is a
+ * timing signal of its own.
+ */
+export declare function verifyPassword(password: string, record: CredentialRecord): Promise<boolean>;
+/** True when a string is a well-formed credential record. */
+export declare function isCredentialRecord(value: unknown): value is CredentialRecord;

package/dist/identity/credentials.js

@@ -0,0 +1,140 @@
+/**
+ * Per-member local credentials — ADR-0020 Phase A.
+ *
+ * ## Why this exists
+ *
+ * `canApproveAction` is referenced by nothing in production, and not because
+ * anyone forgot. The bridge authenticates ONE shared bearer token, and the
+ * dashboard session cookie's signed payload is literally `v1.${expiresAt}` —
+ * not "no subject field" but no field except expiry. Every approver is
+ * indistinguishable at the auth layer, so segregation of duties is
+ * unenforceable rather than merely unimplemented, and no decision record can
+ * honestly name a person.
+ *
+ * ## `crypto.scrypt`, from the standard library
+ *
+ * The dependency audit is unambiguous: no bcrypt, argon2, passport, next-auth
+ * or jose in this tree, direct or dev. Adding a native-compilation
+ * password-hashing dependency to a project that installs globally on macOS,
+ * Linux and Windows — and which already documents a macOS TCC symlink footgun
+ * around global installs — buys a marginally better KDF for a real
+ * cross-platform install risk. scrypt is memory-hard, in the standard library,
+ * and present in every runtime the bridge already targets.
+ *
+ * ## What this module does NOT do
+ *
+ * It does not read the roster, does not decide authorisation, and does not
+ * touch the dashboard cookie. Verifying a secret and deciding what somebody
+ * may do are different questions, and the cookie change touches ten consumers
+ * and wants its own review. This is the half with no blast radius.
+ */
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+const scrypt = promisify(scryptCb);
+/**
+ * scrypt parameters, stored per-hash rather than assumed.
+ *
+ * Encoding them in the record is what makes them changeable later: a stored
+ * hash that does not say how it was derived can only be verified by a
+ * constant, so raising the cost would silently invalidate every existing
+ * credential instead of upgrading it.
+ *
+ * N=2^15 with r=8, p=1 is ~32 MB of memory per verification. `maxmem` must be
+ * raised above Node's 32 MB default or scrypt throws at these parameters —
+ * a footgun that presents as "the correct password is rejected".
+ */
+export const SCRYPT_PARAMS = { N: 32768, r: 8, p: 1 };
+const KEYLEN = 64;
+const MAXMEM = 192 * 1024 * 1024;
+const PREFIX = "scrypt";
+/** Hash a password for storage. A fresh 16-byte salt per call. */
+export async function hashPassword(password, params = SCRYPT_PARAMS) {
+    if (typeof password !== "string" || password.length === 0) {
+        throw new Error("password must be a non-empty string");
+    }
+    const salt = randomBytes(16);
+    const derived = await scrypt(password, salt, KEYLEN, {
+        ...params,
+        maxmem: MAXMEM,
+    });
+    return [
+        PREFIX,
+        params.N,
+        params.r,
+        params.p,
+        salt.toString("base64"),
+        derived.toString("base64"),
+    ].join("$");
+}
+/** Parsed form of a stored record, or null when it is not one. */
+function parseRecord(record) {
+    if (typeof record !== "string")
+        return null;
+    const parts = record.split("$");
+    if (parts.length !== 6 || parts[0] !== PREFIX)
+        return null;
+    const [, nRaw, rRaw, pRaw, saltRaw, hashRaw] = parts;
+    const N = Number(nRaw);
+    const r = Number(rRaw);
+    const p = Number(pRaw);
+    if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p)) {
+        return null;
+    }
+    // Bound the work a stored record can demand. Without this, anyone who can
+    // write members.json can make one verification consume unbounded CPU and
+    // memory — a denial of service authored in a config file.
+    if (N < 16384 || N > 1 << 20 || r < 1 || r > 32 || p < 1 || p > 16) {
+        return null;
+    }
+    let salt;
+    let hash;
+    try {
+        salt = Buffer.from(saltRaw ?? "", "base64");
+        hash = Buffer.from(hashRaw ?? "", "base64");
+    }
+    catch {
+        return null;
+    }
+    if (salt.length === 0 || hash.length !== KEYLEN)
+        return null;
+    return { N, r, p, salt, hash };
+}
+/**
+ * Verify a password against a stored record.
+ *
+ * Returns false for a malformed record rather than throwing: a corrupt
+ * credential must read as "this password is wrong", not as an exception a
+ * caller might catch and treat as a pass. It is the same fail-closed reasoning
+ * as ADR-0016 — deciding whether an action happens defaults to no.
+ *
+ * The comparison is `timingSafeEqual` on the derived key. Lengths are checked
+ * first because it throws on a length mismatch, and a thrown comparison is a
+ * timing signal of its own.
+ */
+export async function verifyPassword(password, record) {
+    const parsed = parseRecord(record);
+    if (!parsed)
+        return false;
+    if (typeof password !== "string" || password.length === 0)
+        return false;
+    let derived;
+    try {
+        derived = await scrypt(password, parsed.salt, KEYLEN, {
+            N: parsed.N,
+            r: parsed.r,
+            p: parsed.p,
+            maxmem: MAXMEM,
+        });
+    }
+    catch {
+        return false;
+    }
+    if (derived.length !== parsed.hash.length)
+        return false;
+    return timingSafeEqual(derived, parsed.hash);
+}
+/** True when a string is a well-formed credential record. */
+export function isCredentialRecord(value) {
+    return typeof value === "string" && parseRecord(value) !== null;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/identity/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/identity/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAKb,CAAC;AAErB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AAC/D,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAKjC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAA8C,aAAa;IAE3D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;QACnD,GAAG,MAAM;QACT,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,MAAM,CAAC,CAAC;QACR,MAAM,CAAC,CAAC;QACR,MAAM,CAAC,CAAC;QACR,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,MAAc;IAOjC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,MAAwB;IAExB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;YACpD,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "1.2.0-beta.2.canary.651",
+  "version": "1.2.0-beta.2.canary.652",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",