patchwork-os 1.2.0-beta.3.canary.862 → 1.2.0-beta.3.canary.864

package/dist/identity/approverFromSession.js

@@ -40,7 +40,7 @@
  * both processes the same secret.
  */
 import { verifySession } from "./dashboardSession.js";
-import { findMember, loadRoster } from "./roster.js";
+import { loadRoster, resolveSessionMember } from "./roster.js";
 /**
  * Resolve the human behind a forwarded dashboard session cookie.
  *
@@ -61,18 +61,12 @@ export function createApproverResolver(opts = {}) {
             // name. This is the branch a `?? implicitOwner()` would ruin.
             if (!valid || !memberId)
                 return undefined;
-            const roster = rosterFor();
-            // An IMPLICIT roster means no members.json exists — the single-owner
-            // degraded default. A cookie naming a member cannot be honoured against
-            // a roster that was synthesised rather than read: `findMember` would
-            // match only the literal id `local-owner`, and attributing to an owner
-            // nobody configured is exactly the defaulting this ADR forbids.
-            if (roster.implicit)
-                return undefined;
-            const member = findMember(roster, memberId);
-            // Gone from the roster, or deactivated. A deactivated member keeps their
-            // history and may do nothing — including approve.
-            if (!member?.active)
+            // Implicit roster, gone, or deactivated ⇒ nobody. The rule lives in
+            // `resolveSessionMember` so the dashboard's session gate applies the
+            // SAME one — a member this declines to name must also not hold a
+            // session, or they can act unattributed.
+            const member = resolveSessionMember(rosterFor(), memberId);
+            if (!member)
                 return undefined;
             return {
                 id: member.id,

package/dist/identity/approverFromSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"approverFromSession.js","sourceRoot":"","sources":["../../src/identity/approverFromSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AAkBlE;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA6B,EAAE;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzD,OAAO,KAAK,EAAE,aAAsB,EAAE,EAAE;QACtC,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YAC/D,wEAAwE;YACxE,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAE1C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAE3B,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,MAAM,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEtC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC5C,yEAAyE;YACzE,kDAAkD;YAClD,IAAI,CAAC,MAAM,EAAE,MAAM;gBAAE,OAAO,SAAS,CAAC;YAEtC,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,mBAAmB;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"approverFromSession.js","sourceRoot":"","sources":["../../src/identity/approverFromSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAe,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAkB5E;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA6B,EAAE;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzD,OAAO,KAAK,EAAE,aAAsB,EAAE,EAAE;QACtC,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YAC/D,wEAAwE;YACxE,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAE1C,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,yCAAyC;YACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAE9B,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,mBAAmB;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/identity/roster.d.ts

@@ -89,6 +89,33 @@ export declare function loadRoster(path?: string): Roster;
 export declare function describeRoster(roster: Roster): string;
 /** Look a member up by id. */
 export declare function findMember(roster: Roster, id: string): Member | null;
+/**
+ * May a SESSION that names `memberId` act as that member right now?
+ *
+ * The one rule, used by both the bridge (attributing an approval to the
+ * member a v2 cookie names — `approverFromSession.ts`) and the dashboard
+ * (deciding whether that cookie is still a session at all — `middleware.ts`).
+ * It was inline in the first and absent from the second, which is how a
+ * deactivated member kept a working dashboard for up to 30 days and could
+ * still approve a gated action, unattributed, because attribution is resolved
+ * AFTER the approval lands and declines to name anyone it cannot verify.
+ *
+ * - IMPLICIT roster (no members.json): null. A cookie naming a member cannot
+ *   be honoured against a roster that was synthesised rather than read —
+ *   `findMember` would match only the literal implicit-owner id, and acting as
+ *   an owner nobody configured is exactly the defaulting ADR-0020 forbids.
+ * - UNREADABLE roster: null — `members` is empty, so this falls out of the
+ *   lookup, but it is named here because it is the fail-CLOSED case: a
+ *   membership decision exists and we cannot read it.
+ * - Not on the roster, or deactivated: null. A deactivated member keeps their
+ *   history and may do nothing.
+ *
+ * `null`, never a fallback. Callers decide what "nobody" means for them: the
+ * bridge records no actor, the dashboard treats the request as having no
+ * session. A v1 cookie never reaches this function — it names nobody, so
+ * there is nobody to check.
+ */
+export declare function resolveSessionMember(roster: Roster, memberId: string): Member | null;
 /**
  * Which member a request is acting as.
  *

package/dist/identity/roster.js

@@ -160,6 +160,38 @@ export function describeRoster(roster) {
 export function findMember(roster, id) {
     return roster.members.find((m) => m.id === id) ?? null;
 }
+/**
+ * May a SESSION that names `memberId` act as that member right now?
+ *
+ * The one rule, used by both the bridge (attributing an approval to the
+ * member a v2 cookie names — `approverFromSession.ts`) and the dashboard
+ * (deciding whether that cookie is still a session at all — `middleware.ts`).
+ * It was inline in the first and absent from the second, which is how a
+ * deactivated member kept a working dashboard for up to 30 days and could
+ * still approve a gated action, unattributed, because attribution is resolved
+ * AFTER the approval lands and declines to name anyone it cannot verify.
+ *
+ * - IMPLICIT roster (no members.json): null. A cookie naming a member cannot
+ *   be honoured against a roster that was synthesised rather than read —
+ *   `findMember` would match only the literal implicit-owner id, and acting as
+ *   an owner nobody configured is exactly the defaulting ADR-0020 forbids.
+ * - UNREADABLE roster: null — `members` is empty, so this falls out of the
+ *   lookup, but it is named here because it is the fail-CLOSED case: a
+ *   membership decision exists and we cannot read it.
+ * - Not on the roster, or deactivated: null. A deactivated member keeps their
+ *   history and may do nothing.
+ *
+ * `null`, never a fallback. Callers decide what "nobody" means for them: the
+ * bridge records no actor, the dashboard treats the request as having no
+ * session. A v1 cookie never reaches this function — it names nobody, so
+ * there is nobody to check.
+ */
+export function resolveSessionMember(roster, memberId) {
+    if (roster.implicit)
+        return null;
+    const member = findMember(roster, memberId);
+    return member?.active ? member : null;
+}
 /**
  * Which member a request is acting as.
  *

package/dist/identity/roster.js.map

@@ -1 +1 @@
-{"version":3,"file":"roster.js","sourceRoot":"","sources":["../../src/identity/roster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAe,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGnE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AA6B/C,2EAA2E;AAC3E,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,iBAAiB;QAC9B,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,OAAO,CAAC;QAChB,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO;QACL,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC;QAC1B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,UAAoB,EAAE;IAC9C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,IAAI,GAAG,iBAAiB,EAAE;IACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,EAAE,CAAC;IAE/C,8DAA8D;IAC9D,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,MAAgC,EAAE,OAAO,CAAC;YACzD,CAAC,CAAE,MAAiC,CAAC,OAAO;YAC5C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,EAAE,CAAC;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,4CAA4C;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,KAAK,GACT,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,uCAAuC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CACL,4CAA4C,KAAK,IAAI;YACrD,wEAAwE;YACxE,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,GAAG,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KACtC,yBAAyB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC;AAC/F,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,EAAU;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAAiB;IAEjB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAC1B,SAAwB,EACxB,UAAsB;IAEtB,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"roster.js","sourceRoot":"","sources":["../../src/identity/roster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAe,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGnE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AA6B/C,2EAA2E;AAC3E,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,iBAAiB;QAC9B,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,OAAO,CAAC;QAChB,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO;QACL,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC;QAC1B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,UAAoB,EAAE;IAC9C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,IAAI,GAAG,iBAAiB,EAAE;IACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,EAAE,CAAC;IAE/C,8DAA8D;IAC9D,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,MAAgC,EAAE,OAAO,CAAC;YACzD,CAAC,CAAE,MAAiC,CAAC,OAAO;YAC5C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,GAAG;QAAE,OAAO,gBAAgB,EAAE,CAAC;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,4CAA4C;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,KAAK,GACT,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,uCAAuC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CACL,4CAA4C,KAAK,IAAI;YACrD,wEAAwE;YACxE,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,GAAG,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KACtC,yBAAyB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC;AAC/F,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,EAAU;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAAiB;IAEjB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAC1B,SAAwB,EACxB,UAAsB;IAEtB,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "1.2.0-beta.3.canary.862",
+  "version": "1.2.0-beta.3.canary.864",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",