patchwork-os 1.2.3 → 1.2.5

package/dist/governance/effectivePolicy.js

@@ -362,6 +362,13 @@ export function formatEffectivePolicy(input, result) {
     lines.push(`TOOL RISK: ${input.tool.tier.toUpperCase()}${input.tool.tierDeclared ? "" : " (inferred from name)"}${input.tool.isWrite ? " · WRITE" : ""}`);
     if (input.worker)
         lines.push(`WORKER: ${input.worker.id}`);
+    if (input.tool.id === "http.post" && input.privateNetwork) {
+        lines.push(`PRIVATE NETWORK: ${input.privateNetwork.recipeBypassHonoured
+            ? "a step's allowPrivate: true is honoured (loopback / LAN reachable)"
+            : input.profile.privateNetworkBypass === "refuse"
+                ? "a step's allowPrivate: true is NOT honoured (governed)"
+                : "a step's allowPrivate: true is NOT honoured (block-recipe-allow-private)"}`);
+    }
     lines.push("");
     for (const s of result.stages) {
         lines.push(`${s.stage.padEnd(22)} ${s.verdict.padEnd(9)} ${s.reason}`);
@@ -375,6 +382,17 @@ export function formatEffectivePolicy(input, result) {
     lines.push(`FINAL RESULT: ${label}`);
     return lines.join("\n");
 }
+/**
+ * May a recipe's own `allowPrivate: true` skip the SSRF guard's private-range
+ * refusal? Governed: never. Compat: unless `block-recipe-allow-private` is on.
+ * Shared by `http.post`, `patchwork doctor` and `policy explain`, so the three
+ * cannot disagree. A run-level grant (`operatorAllowsPrivateNetwork`) is
+ * checked by the caller, because it belongs to the code building the run, not
+ * to the profile.
+ */
+export function recipePrivateBypassHonoured(profile, blockFlagOn) {
+    return profile.privateNetworkBypass !== "refuse" && !blockFlagOn;
+}
 /**
  * Is a recipe's write acknowledgement ENFORCED under this profile? Governed:
  * always. Compat: only when `FLAG_ENFORCE_ALLOWWRITES` is on. Shared by the

package/dist/governance/effectivePolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"effectivePolicy.js","sourceRoot":"","sources":["../../src/governance/effectivePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsBH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4B,EAC5B,KAAiC;IAEjC,MAAM,YAAY,GAAG,QAAQ,IAAI,QAAQ,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC7C,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAkGD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAQrC;IACC,MAAM,EACJ,OAAO,EACP,OAAO,EACP,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,GACnB,GAAG,IAAI,CAAC;IACT,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,KAAK,QAAQ,CAAC;IACvC,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,IAAI,kBAAkB,CAAC;IACtE,IAAI,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,WAAW,OAAO,kDAAkD;SAC7E,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,KAAK,KAAK,EAAE,CAAC;QACpC,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EACJ,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,6DAA6D;aACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,2CAA2C;SACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,SAAS;YACf,CAAC,CAAC,WAAW,OAAO,0BAA0B;YAC9C,CAAC,CAAC,YAAY;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAA0B,EAC1B,IAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAClC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC7E,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,cAAc;gBACxB,CAAC,CAAC;oBACE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;oBAC3D,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM;wBACjC,CAAC,CAAC,mCAAmC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACtE,CAAC,CAAC,8DAA8D;iBACnE;gBACH,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAClE,CAAC;QACD,kEAAkE;QAClE,OAAO,IAAI,KAAK,KAAK;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE;YACvD,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAChB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QACtB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3D,oEAAoE;IACpE,sEAAsE;IACtE,0EAA0E;IAC1E,IACE,OAAO,CAAC,iBAAiB,KAAK,MAAM;QACpC,IAAI,CAAC,OAAO,KAAK,IAAI;QACrB,IAAI,CAAC,aAAa,KAAK,SAAS;QAChC,IAAI,CAAC,aAAa,KAAK,YAAY,EACnC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,wCAAwC,IAAI,CAAC,IAAI,QAAQ;SACvF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,iBAAiB,KAAK,MAAM;QACpC,IAAI,CAAC,OAAO,KAAK,KAAK;QACtB,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,EAClD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,IAAI,CAAC,UAAU;gBACrB,CAAC,CAAC,4DAA4D;gBAC9D,CAAC,CAAC,yDAAyD;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,IAAI,kBAAkB,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAA2B;IAE3B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,6BAA6B;IAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;KAChC,CAAC,CAAC;IAEH,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,iEAAiE;aACzF,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,yEAAyE;SACjG,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,iCAAiC;aACzD,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,yBAAyB,IAAI,CAAC,EAAE,0DAA0D,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;SACjK,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,8FAA8F;SACjH,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,MAAM,IAAI,aAAa,+BAA+B;aACxG,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,6BAA6B;iBACpD,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,uBAAuB,CAAC,CAAC,oBAAoB,wBAAwB;iBAC9E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC,MAAM,IAAI,uBAAuB,GAAG;iBAC7F,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,MAAM,IAAI,QAAQ,GAAG;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;IAChB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC;QACV,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,OAAO,GAAG,qBAAqB,CAAC;QACpC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QACnD,kBAAkB,EAChB,KAAK,CAAC,IAAI,EAAE,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAC9D,kBAAkB,EAChB,KAAK,CAAC,IAAI,EAAE,kBAAkB;YAC9B,CAAC,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;KACjE,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC;QACV,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,mEAAmE;IACnE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC,WAAW,UAAU;aACzD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;aACnG,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,CAAC,WAAW;gBACtB,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,sBAAsB;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GACjB,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO;QAC1D,MAAM;QACN,gBAAgB,EAAE,OAAO,CAAC,OAAO;KAClC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CACnC,KAA2B,EAC3B,MAAuB;IAEvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CACR,YAAY,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAChH,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,KAAK,CAAC,IAAI,CACR,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9I,CAAC;IACF,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,KAAK,OAAO;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,yBAAyB;YAC1C,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,SAAS,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,MAAe;IAEf,OAAO,OAAO,CAAC,oBAAoB,KAAK,SAAS,IAAI,MAAM,CAAC;AAC9D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,SAA6B,EAC7B,WAA0C;IAE1C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,CACL,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"effectivePolicy.js","sourceRoot":"","sources":["../../src/governance/effectivePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsBH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4B,EAC5B,KAAiC;IAEjC,MAAM,YAAY,GAAG,QAAQ,IAAI,QAAQ,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC7C,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwGD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAQrC;IACC,MAAM,EACJ,OAAO,EACP,OAAO,EACP,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,GACnB,GAAG,IAAI,CAAC;IACT,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,KAAK,QAAQ,CAAC;IACvC,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,IAAI,kBAAkB,CAAC;IACtE,IAAI,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,WAAW,OAAO,kDAAkD;SAC7E,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,KAAK,KAAK,EAAE,CAAC;QACpC,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EACJ,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,6DAA6D;aACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,2CAA2C;SACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,SAAS;YACf,CAAC,CAAC,WAAW,OAAO,0BAA0B;YAC9C,CAAC,CAAC,YAAY;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAA0B,EAC1B,IAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAClC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC7E,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,cAAc;gBACxB,CAAC,CAAC;oBACE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;oBAC3D,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM;wBACjC,CAAC,CAAC,mCAAmC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACtE,CAAC,CAAC,8DAA8D;iBACnE;gBACH,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAClE,CAAC;QACD,kEAAkE;QAClE,OAAO,IAAI,KAAK,KAAK;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE;YACvD,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAChB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QACtB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3D,oEAAoE;IACpE,sEAAsE;IACtE,0EAA0E;IAC1E,IACE,OAAO,CAAC,iBAAiB,KAAK,MAAM;QACpC,IAAI,CAAC,OAAO,KAAK,IAAI;QACrB,IAAI,CAAC,aAAa,KAAK,SAAS;QAChC,IAAI,CAAC,aAAa,KAAK,YAAY,EACnC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,wCAAwC,IAAI,CAAC,IAAI,QAAQ;SACvF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,iBAAiB,KAAK,MAAM;QACpC,IAAI,CAAC,OAAO,KAAK,KAAK;QACtB,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,EAClD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,IAAI,CAAC,UAAU;gBACrB,CAAC,CAAC,4DAA4D;gBAC9D,CAAC,CAAC,yDAAyD;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,IAAI,kBAAkB,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAA2B;IAE3B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,6BAA6B;IAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;KAChC,CAAC,CAAC;IAEH,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,iEAAiE;aACzF,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,yEAAyE;SACjG,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,iCAAiC;aACzD,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,yBAAyB,IAAI,CAAC,EAAE,0DAA0D,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;SACjK,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,8FAA8F;SACjH,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,MAAM,IAAI,aAAa,+BAA+B;aACxG,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,6BAA6B;iBACpD,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,uBAAuB,CAAC,CAAC,oBAAoB,wBAAwB;iBAC9E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC,MAAM,IAAI,uBAAuB,GAAG;iBAC7F,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,MAAM,IAAI,QAAQ,GAAG;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;IAChB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC;QACV,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,OAAO,GAAG,qBAAqB,CAAC;QACpC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;QACnD,kBAAkB,EAChB,KAAK,CAAC,IAAI,EAAE,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAC9D,kBAAkB,EAChB,KAAK,CAAC,IAAI,EAAE,kBAAkB;YAC9B,CAAC,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;KACjE,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC;QACV,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,mEAAmE;IACnE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC,WAAW,UAAU;aACzD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;aACnG,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,CAAC,WAAW;gBACtB,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,sBAAsB;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GACjB,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO;QAC1D,MAAM;QACN,gBAAgB,EAAE,OAAO,CAAC,OAAO;KAClC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CACnC,KAA2B,EAC3B,MAAuB;IAEvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CACR,YAAY,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAChH,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,KAAK,CAAC,IAAI,CACR,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9I,CAAC;IACF,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,WAAW,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,oBACE,KAAK,CAAC,cAAc,CAAC,oBAAoB;YACvC,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,KAAK,QAAQ;gBAC/C,CAAC,CAAC,wDAAwD;gBAC1D,CAAC,CAAC,0EACR,EAAE,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,KAAK,OAAO;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,yBAAyB;YAC1C,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,SAAS,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA0B,EAC1B,WAAoB;IAEpB,OAAO,OAAO,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,MAAe;IAEf,OAAO,OAAO,CAAC,oBAAoB,KAAK,SAAS,IAAI,MAAM,CAAC;AAC9D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,SAA6B,EAC7B,WAA0C;IAE1C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,CACL,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC"}

package/dist/governance/profile.d.ts

@@ -96,6 +96,16 @@ export interface GovernanceProfile {
      * decides, byte-identical to before.
      */
     writeAcknowledgement: "enforce" | "flag";
+    /**
+     * Whether a recipe's own `allowPrivate: true` on `http.post` may skip the
+     * SSRF guard's private-range refusal. Governed: `refuse` — a recipe cannot
+     * opt itself into loopback / LAN hosts, the same rule as
+     * `recipeOptOutHonoured`. Compat: `flag` — honoured unless the operator sets
+     * `block-recipe-allow-private`, byte-identical to before. Code that BUILDS a
+     * run (never a recipe) can still grant it via
+     * `RunnerDeps.operatorAllowsPrivateNetwork`.
+     */
+    privateNetworkBypass: "refuse" | "flag";
 }
 export interface ProfileConfigInput {
     profile?: unknown;

package/dist/governance/profile.js

@@ -111,6 +111,7 @@ export function resolveProfile(cfg) {
             untrustedEnvelope: false,
             recipeOptOutHonoured: true,
             writeAcknowledgement: "flag",
+            privateNetworkBypass: "flag",
         };
     }
     return {
@@ -128,6 +129,7 @@ export function resolveProfile(cfg) {
         untrustedEnvelope: true,
         recipeOptOutHonoured: false,
         writeAcknowledgement: "enforce",
+        privateNetworkBypass: "refuse",
     };
 }
 export const COMPAT_PROFILE = Object.freeze(resolveProfile(undefined));

package/dist/governance/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/governance/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AA+E7D;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAY,UAAkB,EAAE,KAAc;QAC5C,KAAK,CACH,kBAAkB,UAAU,+BAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,wEAAwE;YACtE,mEAAmE;YACnE,iCAAiC,CACpC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,CACL,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wBAAwB;QACzE,wEAAwE;QACxE,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgC,EAAE;IAIlE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnD,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,UAAU,CAAuB,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAgB,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,MAAM,cAAc,GAClB,GAAG,EAAE,YAAY,KAAK,MAAM;QAC5B,GAAG,EAAE,YAAY,KAAK,KAAK;QAC3B,GAAG,EAAE,YAAY,KAAK,KAAK;QACzB,CAAC,CAAC,GAAG,CAAC,YAAY;QAClB,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,YAAY,EAAE,cAAc;YAC5B,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,QAAQ;YAC1B,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,OAAO;YAC1B,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,KAAK;YACxB,oBAAoB,EAAE,IAAI;YAC1B,oBAAoB,EAAE,MAAM;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,YAAY,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACvD,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,UAAU;QAC5B,YAAY,EAAE,WAAW;QACzB,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;QAC3B,oBAAoB,EAAE,SAAS;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAC5D,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAC9D,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CACxC,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,CAAgC;IACzD,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,6BAA6B;AAC7B,8EAA8E;AAE9E,IAAI,MAAM,GAAsB,cAAc,CAAC;AAE/C,MAAM,UAAU,gBAAgB,CAAC,CAAoB;IACnD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,cAAc,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,OAAO;IACP,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,UAAU;IACV,WAAW;IACX,MAAM;IACN,GAAG,2BAA2B;CAC/B,CAAC,CAAC;AAqCH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QACvC,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI;YAClC,SAAS;SACV,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,6BAA6B,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;IAC7D,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,6EAA6E;QAC7E,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,IAAI,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;QAClB,SAAS;QACT,SAAS;QACT,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/governance/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AAyF7D;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAY,UAAkB,EAAE,KAAc;QAC5C,KAAK,CACH,kBAAkB,UAAU,+BAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,wEAAwE;YACtE,mEAAmE;YACnE,iCAAiC,CACpC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,CACL,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wBAAwB;QACzE,wEAAwE;QACxE,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgC,EAAE;IAIlE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnD,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,UAAU,CAAuB,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAgB,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,MAAM,cAAc,GAClB,GAAG,EAAE,YAAY,KAAK,MAAM;QAC5B,GAAG,EAAE,YAAY,KAAK,KAAK;QAC3B,GAAG,EAAE,YAAY,KAAK,KAAK;QACzB,CAAC,CAAC,GAAG,CAAC,YAAY;QAClB,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,YAAY,EAAE,cAAc;YAC5B,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,QAAQ;YAC1B,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,OAAO;YAC1B,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,KAAK;YACxB,oBAAoB,EAAE,IAAI;YAC1B,oBAAoB,EAAE,MAAM;YAC5B,oBAAoB,EAAE,MAAM;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,YAAY,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACvD,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,UAAU;QAC5B,YAAY,EAAE,WAAW;QACzB,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;QAC3B,oBAAoB,EAAE,SAAS;QAC/B,oBAAoB,EAAE,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAC5D,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAC9D,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CACxC,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,CAAgC;IACzD,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,6BAA6B;AAC7B,8EAA8E;AAE9E,IAAI,MAAM,GAAsB,cAAc,CAAC;AAE/C,MAAM,UAAU,gBAAgB,CAAC,CAAoB;IACnD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,cAAc,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,OAAO;IACP,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,UAAU;IACV,WAAW;IACX,MAAM;IACN,GAAG,2BAA2B;CAC/B,CAAC,CAAC;AAqCH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QACvC,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI;YAClC,SAAS;SACV,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,6BAA6B,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;IAC7D,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,6EAA6E;QAC7E,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,IAAI,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;QAClB,SAAS;QACT,SAAS;QACT,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC"}

package/dist/governance/secretPathDenies.d.ts

@@ -28,7 +28,17 @@ export declare function toAbsoluteRulePath(p: string): string;
 /** The secret-bearing paths (files, and directories as `<dir>/**`). */
 export declare function secretStorePaths(): string[];
 /**
- * `Read(...)` and `Edit(...)` deny rules for every secret store. Read rules
+ * Files that DEFINE governance (audit M4). Not secrets — an agent may read
+ * them — but an agent step allowed to write files (compat, or a governed
+ * write widening) could otherwise switch governance off by editing them:
+ * the kill switch (`config/flags.json`), the profile (`config.json`), the
+ * roster, worker manifests and trust checkpoints, installed recipes (their
+ * own `allowWrites` / `requireApproval`), and the evidence ledgers.
+ */
+export declare function governanceStatePaths(): string[];
+/**
+ * `Read(...)` and `Edit(...)` deny rules for every secret store, plus
+ * `Edit(...)` only for governance state. Read rules
  * also govern Glob, Grep and LS; Edit rules govern every write built-in.
  * Read per call, never cached: PATCHWORK_HOME is changed at runtime by the
  * CLI and by tests.

package/dist/governance/secretPathDenies.js

@@ -83,7 +83,33 @@ export function secretStorePaths() {
     return [...out];
 }
 /**
- * `Read(...)` and `Edit(...)` deny rules for every secret store. Read rules
+ * Files that DEFINE governance (audit M4). Not secrets — an agent may read
+ * them — but an agent step allowed to write files (compat, or a governed
+ * write widening) could otherwise switch governance off by editing them:
+ * the kill switch (`config/flags.json`), the profile (`config.json`), the
+ * roster, worker manifests and trust checkpoints, installed recipes (their
+ * own `allowWrites` / `requireApproval`), and the evidence ledgers.
+ */
+export function governanceStatePaths() {
+    const out = new Set();
+    for (const r of [patchworkHome(), legacyPatchworkHome()]) {
+        for (const home of new Set([r, realOrSelf(r)])) {
+            out.add(join(home, "config.json"));
+            out.add(join(home, "config", "**"));
+            out.add(join(home, "members.json"));
+            out.add(join(home, "workers", "**"));
+            out.add(join(home, "worker_trust", "**"));
+            out.add(join(home, "recipes", "**"));
+            out.add(join(home, "*.jsonl"));
+            out.add(join(home, "*.jsonl.*"));
+            out.add(join(home, "run-ledgers", "**"));
+        }
+    }
+    return [...out];
+}
+/**
+ * `Read(...)` and `Edit(...)` deny rules for every secret store, plus
+ * `Edit(...)` only for governance state. Read rules
  * also govern Glob, Grep and LS; Edit rules govern every write built-in.
  * Read per call, never cached: PATCHWORK_HOME is changed at runtime by the
  * CLI and by tests.
@@ -94,6 +120,9 @@ export function secretPathDenyRules() {
         const rp = toAbsoluteRulePath(p);
         rules.push(`Read(${rp})`, `Edit(${rp})`);
     }
+    for (const p of governanceStatePaths()) {
+        rules.push(`Edit(${toAbsoluteRulePath(p)})`);
+    }
     return rules;
 }
 //# sourceMappingURL=secretPathDenies.js.map

package/dist/governance/secretPathDenies.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretPathDenies.js","sourceRoot":"","sources":["../../src/governance/secretPathDenies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1E,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,CAAC,6DAA6D;IACzE,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,oEAAoE;IACpE,mDAAmD;IACnD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC;QACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,yBAAyB;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,2BAA2B;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC;QAC3B,eAAe,EAAE;QACjB,UAAU,CAAC,eAAe,EAAE,CAAC;KAC9B,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,wBAAwB;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"secretPathDenies.js","sourceRoot":"","sources":["../../src/governance/secretPathDenies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1E,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,CAAC,6DAA6D;IACzE,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,oEAAoE;IACpE,mDAAmD;IACnD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC;QACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,yBAAyB;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,2BAA2B;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC;QAC3B,eAAe,EAAE;QACjB,UAAU,CAAC,eAAe,EAAE,CAAC;KAC9B,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,wBAAwB;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.js

@@ -294,7 +294,7 @@ if (process.argv[2] === "--help" ||
         `Recipes\n` +
         `  recipe new <name> [-i]                    Scaffold a recipe\n` +
         `  recipe list                               List installed recipes\n` +
-        `  recipe run <name> [--vars k=v]            Run a recipe by name\n` +
+        `  recipe run <name> [--var k=v]...          Run a recipe by name\n` +
         `  recipe install <source>                   Install from a path or GitHub source\n` +
         `  recipe --help                             Full recipe subcommand index\n\n` +
         `Connectors\n` +
@@ -339,7 +339,7 @@ if (process.argv[2] === "--help" ||
         `Daemon (no subcommand)\n` +
         `  --workspace <dir>                         Start the bridge in foreground\n` +
         `  --watch                                   Auto-restart supervisor\n` +
-        `  --slim                                    27 IDE-only tools (default: full)\n\n` +
+        `  --slim                                    IDE-only tools (default: full)\n\n` +
         `Other\n` +
         `  --version, -v                             Print package version\n` +
         `  shim                                      stdio↔WebSocket shim (used by MCP clients)\n` +
@@ -405,7 +405,7 @@ Options:
   --dashboard-port <N>  Dashboard port (default: 3200)
   --notify <topic>      Push notifications via ntfy.sh
   --vps <user@host>     SSH reverse tunnel for stable claude.ai URL
-  --slim                Slim mode (27 IDE-exclusive tools only — overrides default)
+  --slim                Slim mode (IDE-exclusive tools only — overrides default)
   --help, -h            Show this help
 
 This is a thin wrapper over \`start-all\`. For advanced flags see:
@@ -841,7 +841,9 @@ if (process.argv[2] === "gen-plugin-stub") {
         description: "A Claude IDE Bridge plugin",
         entrypoint: "./index.mjs",
         toolNamePrefix: toolPrefix,
-        minBridgeVersion: "2.1.24",
+        // The bridge that generated the stub. A hardcoded "2.1.24" from an
+        // older version line made every scaffolded plugin warn on load.
+        minBridgeVersion: PACKAGE_VERSION.split("-")[0],
     };
     writeFileSync(path.join(outDir, "claude-ide-bridge-plugin.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");
     // ── shared tool body — same logic, different surface syntax ──
@@ -871,11 +873,22 @@ export function register(ctx) {
               name: { type: "string", description: "Name to greet" },
             },
           },
+          // Declare the shape you return; the bridge validates
+          // structuredContent against it. Built-in tools are required to.
+          outputSchema: {
+            type: "object",
+            properties: { greeting: { type: "string" } },
+            required: ["greeting"],
+          },
           annotations: { readOnlyHint: true },
         },
-        handler: async (args, _signal) => ({
-          content: [{ type: "text", text: "Hello from " + ${JSON.stringify(pluginName)} + ", " + args.name + "!" }],
-        }),
+        handler: async (args, _signal) => {
+          const greeting = "Hello from " + ${JSON.stringify(pluginName)} + ", " + args.name + "!";
+          return {
+            content: [{ type: "text", text: greeting }],
+            structuredContent: { greeting },
+          };
+        },
       },
     ],
   };
@@ -911,16 +924,22 @@ export function register(ctx: PluginContext) {
               name: { type: "string" as const, description: "Name to greet" },
             },
           },
+          // Declare the shape you return; the bridge validates
+          // structuredContent against it. Built-in tools are required to.
+          outputSchema: {
+            type: "object" as const,
+            properties: { greeting: { type: "string" as const } },
+            required: ["greeting"],
+          },
           annotations: { readOnlyHint: true },
         },
-        handler: async (args: HelloArgs) => ({
-          content: [
-            {
-              type: "text" as const,
-              text: \`Hello from ${pluginName}, \${args.name}!\`,
-            },
-          ],
-        }),
+        handler: async (args: HelloArgs) => {
+          const greeting = \`Hello from ${pluginName}, \${args.name}!\`;
+          return {
+            content: [{ type: "text" as const, text: greeting }],
+            structuredContent: { greeting },
+          };
+        },
       },
     ],
   };
@@ -1517,9 +1536,13 @@ if (process.argv[2] === "suggest") {
             for (let i = 0; i < args.length; i++) {
                 const a = args[i];
                 if (a === "--since-days") {
-                    const next = args[i + 1];
-                    if (next)
-                        sinceDays = Number.parseInt(next, 10);
+                    const { parseSinceDays } = await import("./commands/sinceDays.js");
+                    const parsed = parseSinceDays(args.slice(i, i + 2));
+                    if (!parsed.ok) {
+                        process.stderr.write(`patchwork suggest: ${parsed.error}\n`);
+                        process.exit(2);
+                    }
+                    sinceDays = parsed.days;
                     i++;
                 }
                 else if (a === "--help" || a === "-h") {
@@ -5350,11 +5373,25 @@ if (process.argv[2] === "privacy") {
                 destinationFactsByDriver,
                 ...(cfg.privacy?.notes && { notes: cfg.privacy.notes }),
             });
+            const { describeOrchestratorPath } = await import("./privacy/describeDestinations.js");
+            const orchestrator = describeOrchestratorPath(cfg.privacy
+                ?.orchestrator?.classification);
             if (args.includes("--json")) {
+                // The array shape is unchanged for existing readers; what it cannot
+                // carry goes to stderr so it is never silent (audit M9).
                 process.stdout.write(`${JSON.stringify(described, null, 2)}\n`);
+                for (const i of registry.invalid) {
+                    process.stderr.write(`[privacy] destination "${i.id}" could not be parsed and is not used: ${i.reason}\n`);
+                }
+                if (orchestrator.state === "malformed") {
+                    process.stderr.write(`[privacy] privacy.orchestrator.classification is ${orchestrator.raw}: not a known classification, so orchestrator tasks are NOT enforced\n`);
+                }
             }
             else {
-                process.stdout.write(`${formatDestinationsReport(described)}\n`);
+                process.stdout.write(`${formatDestinationsReport(described, {
+                    invalid: registry.invalid,
+                    orchestrator,
+                })}\n`);
             }
             // Always 0: an inert boundary and a wide-open one are both legitimate
             // operator states, and exiting non-zero on either would make a correct
@@ -5394,10 +5431,14 @@ if (process.argv[2] === "privacy") {
             // do" — the question the boundary was built to make answerable, and the
             // one nothing in this repo could answer until now (ADR-0019:88-92).
             const { summariseBoundaryReceipts, formatBoundaryReceipts } = await import("./privacy/boundaryReceipts.js");
-            const i = args.indexOf("--since-days");
-            const n = i !== -1 ? Number(args[i + 1]) : undefined;
-            const summary = summariseBoundaryReceipts(n !== undefined && Number.isFinite(n) && n > 0
-                ? { since: Date.now() - n * 86_400_000 }
+            const { parseSinceDays } = await import("./commands/sinceDays.js");
+            const since = parseSinceDays(args);
+            if (!since.ok) {
+                process.stderr.write(`patchwork privacy receipts: ${since.error}\n`);
+                process.exit(2);
+            }
+            const summary = summariseBoundaryReceipts(since.days !== undefined
+                ? { since: Date.now() - since.days * 86_400_000 }
                 : {});
             if (args.includes("--json")) {
                 process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
@@ -5411,6 +5452,8 @@ if (process.argv[2] === "privacy") {
             process.stderr.write("Usage: patchwork privacy receipts [--since-days N] [--json]\n" +
                 "       patchwork privacy shadow [--since-days N] [--json]\n" +
                 "       patchwork privacy suggest [--json]\n" +
+                "       patchwork privacy destinations [--json]\n" +
+                "       patchwork privacy undeclared [--dir <path>] [--json]\n" +
                 "\n" +
                 "  Observes boundary decisions WITHOUT enforcing them. Configure a\n" +
                 "  candidate policy under `privacy.shadow.destinations` in config.json;\n" +
@@ -5418,10 +5461,14 @@ if (process.argv[2] === "privacy") {
             process.exit(2);
         }
         const { summarisePrivacyShadow, formatPrivacyShadow } = await import("./privacy/shadowLog.js");
-        const idx = args.indexOf("--since-days");
-        const days = idx !== -1 ? Number(args[idx + 1]) : undefined;
-        const summary = summarisePrivacyShadow(days !== undefined && Number.isFinite(days) && days > 0
-            ? { since: Date.now() - days * 86_400_000 }
+        const { parseSinceDays } = await import("./commands/sinceDays.js");
+        const since = parseSinceDays(args);
+        if (!since.ok) {
+            process.stderr.write(`patchwork privacy shadow: ${since.error}\n`);
+            process.exit(2);
+        }
+        const summary = summarisePrivacyShadow(since.days !== undefined
+            ? { since: Date.now() - since.days * 86_400_000 }
             : {});
         if (args.includes("--json")) {
             process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);