progmune-runtime 3.7.64 → 3.7.65

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [3.7.65] — 2026-10-11
+
+### 队列/定时/事件处理器无请求面豁免（修冤枉第六刀：授权族告警的「作业处理器不是请求面」根因）
+
+**根因**：docmost 补标注里队列作业/定时任务类 FP 占授权族 FP 的
+10/111——鉴权发生在入队侧（controller 把任务塞进队列时已鉴权），
+BullMQ 处理器 / NestJS Schedule / EventEmitter 监听器的函数体
+不面向 HTTP 请求，「缺鉴权/缺属主校验」的提问在处理器层不适用。
+
+- **机制**：提取器注入 `__progmune_no_request_surface__` 标记——
+  类级 `@Processor(队列名)`（BullMQ，该类全部方法）、方法级
+  `@Interval/@Cron/@Timeout/@OnEvent`（须带实参）；规则侧仅授权族
+  四条（Unauthenticated Access/Mutation + Ownership Check + Resource
+  Ownership）在 safeguard 位接受该标记（与 E2 同款「只做减法」）
+- **反例挡住（是请求面，不注入）**：@Sse（HTTP SSE）、
+  @SubscribeMessage（WebSocket）、@MessagePattern/@EventPattern
+  （微服务 RPC）；`@Processor()` 空实参不是 BullMQ 形态不注入
+- **同条件 A/B（docmost 双扫描，fresh IR 各自重提）**：主告警流
+  748→720（−28 = Ownership Check 10 + Unauthenticated Access 9 +
+  Unauthenticated Mutation 9），**主路径 violations 11=11 内容级零差 /
+  score 84=84 / suppressed 117=117**；注入关对照 = 748 与 3.7.64 时代
+  基线一致 ⇒ 压降完全归因本刀，非扫描间抖动
+- **可压名单交叉核对**：28 条被压告警逐条列函数/文件，全部命中
+  @Processor（FileTask/Notification/History/GeneralQueue ×4 类）或
+  @Interval（cleanupSessions/cleanupOldTrash/sendTelemetry）或
+  @OnEvent（Page/Space/Workspace Listener）形态，TP 0
+- **回归锁定**：提取器测试 4 例（类级全方法/方法级四种/反例四种/
+  空实参边界）+ 规则侧测试 5 例（四族抑制 + 非授权族不受影响）；
+  TS 盲测 119 项目零漂移（LOST 0/ADDED 0——generated 语料无装饰器
+  形状，此门对本改动是空过，真实门=docmost A/B + 定向测试，如实记录）
+- **⚠ 过程教训（TSError 型 toggle）**：上一会话用 `return [];` 做
+  A/B 开关——unreachable 代码中 TS 控制流分析不执行收窄，`name`
+  保持 `string | undefined` 编译失败，对照扫描 0 字节静默中断两轮。
+  toggle 必须用环境变量分支，且对照扫描前必须删 ir.json（IR-STALE
+  复用含标记缓存会让「对照」跑在注入开的数据上）
+
 ## [3.7.64] — 2026-10-10
 
 ### 守卫沿调用链传播（修冤枉第五刀：授权族告警的「守卫在 controller 层」根因）

package/dist/extract-ir-no-request-surface.test.js

@@ -0,0 +1,142 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_1 = require("./extract-ir");
+/**
+ * 修冤枉第六刀（2026-10-10）：队列/定时/事件处理器 → 无请求面标记锁定。
+ *
+ * 数据：docmost 补标注 111 条授权族 FP 里 10 条是队列作业/定时任务——
+ * 鉴权发生在入队侧，处理器函数不面向 HTTP 请求，授权族规则按「请求面
+ * 缺鉴权」提问时结论不适用。
+ *
+ * 注入形态：@Processor(队列名) 类级（BullMQ，全方法）；
+ * @Interval/@Cron/@Timeout/@OnEvent 方法级（须带实参）。
+ * 反例（是请求面，不注入）：@Sse / @SubscribeMessage / @MessagePattern。
+ */
+const MARK = "__progmune_no_request_surface__";
+const TSCONFIG = JSON.stringify({
+    compilerOptions: { target: "ES2020", module: "commonjs", strict: false, skipLibCheck: true, noEmit: true },
+    include: ["**/*.ts"],
+});
+function makeProject(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-nosurface-"));
+    fs.writeFileSync(path.join(dir, "tsconfig.json"), TSCONFIG);
+    fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: "fixture", version: "0.0.0", private: true }));
+    for (const [rel, body] of Object.entries(files)) {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    }
+    return dir;
+}
+function callsOf(dir, fnName) {
+    const fns = (0, extract_ir_1.extractIR)(dir);
+    const f = fns.find((x) => x.name === fnName);
+    return f ? (f.calls ?? []) : [];
+}
+(0, vitest_1.describe)("extractIR：无请求面标记（修冤枉第六刀）", () => {
+    (0, vitest_1.it)("@Processor(队列名) 类级 ⇒ 全部方法注入", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const Processor: any;
+@Processor("notification-queue")
+export class NotificationProcessor {
+  process() { this.markAsEmailed(); }
+  onCompleted() {}
+}
+`,
+        });
+        (0, vitest_1.expect)(callsOf(dir, "NotificationProcessor.process")).toContain(MARK);
+        (0, vitest_1.expect)(callsOf(dir, "NotificationProcessor.onCompleted")).toContain(MARK);
+    });
+    (0, vitest_1.it)("@Interval/@Cron/@Timeout/@OnEvent 方法级 ⇒ 仅该方法注入", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const Interval: any; declare const Cron: any; declare const Timeout: any; declare const OnEvent: any;
+export class SessionService {
+  @Interval("session-cleanup", 86400000)
+  cleanupSessions() {}
+  @Cron("0 0 * * *")
+  dailyJob() {}
+  @Timeout(5000)
+  delayedJob() {}
+  @OnEvent("user.created")
+  onUserCreated() {}
+  normalMethod() {}
+}
+`,
+        });
+        for (const fn of ["SessionService.cleanupSessions", "SessionService.dailyJob", "SessionService.delayedJob", "SessionService.onUserCreated"]) {
+            (0, vitest_1.expect)(callsOf(dir, fn)).toContain(MARK);
+        }
+        (0, vitest_1.expect)(callsOf(dir, "SessionService.normalMethod")).not.toContain(MARK);
+    });
+    (0, vitest_1.it)("反例：@Sse/@SubscribeMessage/@MessagePattern/@EventPattern 是请求面，不注入", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const Sse: any; declare const SubscribeMessage: any; declare const MessagePattern: any; declare const EventPattern: any;
+export class Gateway {
+  @Sse("events")
+  events() {}
+  @SubscribeMessage("chat")
+  onMessage() {}
+  @MessagePattern("orders.get")
+  getOrder() {}
+  @EventPattern("orders.created")
+  onOrderCreated() {}
+}
+`,
+        });
+        for (const fn of ["Gateway.events", "Gateway.onMessage", "Gateway.getOrder", "Gateway.onOrderCreated"]) {
+            (0, vitest_1.expect)(callsOf(dir, fn)).not.toContain(MARK);
+        }
+    });
+    (0, vitest_1.it)("边界：@Processor() 空实参不注入（非 BullMQ 形态）", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const Processor: any;
+@Processor()
+export class Odd {
+  run() {}
+}
+`,
+        });
+        (0, vitest_1.expect)(callsOf(dir, "Odd.run")).not.toContain(MARK);
+    });
+});

package/dist/extract-ir.js

@@ -462,6 +462,44 @@ function authMachineryFromDecorators(decorators) {
     return auth && !skip ? [AUTH_MACHINERY_MARKER] : [];
 }
 // ═══════════════════════════════════════════════════════════════
+// 修冤枉第六刀（2026-10-10）：队列/定时/事件处理器 → 无请求面标记
+//
+// 数据：docmost 补标注 111 条授权族 FP 里 10 条是队列作业/定时任务——
+// 鉴权发生在入队侧（controller 层），处理器函数本身不面向 HTTP 请求，
+// 授权族规则按「请求面缺鉴权」提问时结论不适用。
+// 当前流量化：44 个队列/定时函数命中 19 条授权族告警（全 FP 类）。
+//
+// 形态：@Processor(队列名) 类级（BullMQ，该类全部方法都是作业）；
+// @Interval/@Cron/@Timeout 方法级（NestJS Schedule）；
+// @OnEvent 方法级（NestJS EventEmitter2）。
+// ⚠ 反例（是请求面，不注入）：@Sse（HTTP SSE）、@SubscribeMessage
+//   （WebSocket 消息）、@MessagePattern/@EventPattern（微服务 RPC）。
+// ═══════════════════════════════════════════════════════════════
+const NO_REQUEST_SURFACE_MARKER = "__progmune_no_request_surface__";
+/** 队列/定时/事件装饰器 —— 出现即注入无请求面标记（须带实参：@Interval('name', ms) 等） */
+const NO_SURFACE_CLASS_DECORATOR = /^Processor$/i;
+const NO_SURFACE_METHOD_DECORATOR = /^(?:Interval|Cron|Timeout|OnEvent)$/i;
+/**
+ * 由类/方法装饰器判定是否注入无请求面标记（与 authMachineryFromDecorators 同款文本匹配）。
+ * @returns [] 或 [NO_REQUEST_SURFACE_MARKER]
+ */
+function noRequestSurfaceFromDecorators(decorators) {
+    let noSurface = false;
+    for (const d of decorators) {
+        const text = (d?.getText?.() ?? "").trim();
+        const name = /^@([A-Za-z_$][\w$]*)/.exec(text)?.[1];
+        if (!name)
+            continue;
+        if (!NO_SURFACE_CLASS_DECORATOR.test(name) && !NO_SURFACE_METHOD_DECORATOR.test(name))
+            continue;
+        // 须带实参（@Processor() 空参不是 BullMQ 形态；@Interval 必带名字+毫秒）
+        if (!/^@[\w$]*\([^)]+\)/.test(text))
+            continue;
+        noSurface = true;
+    }
+    return noSurface ? [NO_REQUEST_SURFACE_MARKER] : [];
+}
+// ═══════════════════════════════════════════════════════════════
 // E3（2026-09-22）：TS 侧「入参已按 schema 校验」语义标记
 //
 // 判据（先抄准再写 expect，R22）：
@@ -3256,6 +3294,15 @@ function _extractSingleProject(absRoot, tsconfigPath) {
                     if (!mCalls.includes(mk))
                         mCalls.push(mk);
                 }
+                // 修冤枉第六刀：队列/定时/事件处理器 → 无请求面标记（与 E2 并列，
+                // 语义相反——E2 是「有鉴权」，本标记是「鉴权问题不适用」）
+                for (const mk of noRequestSurfaceFromDecorators([
+                    ...(cls.getDecorators?.() ?? []),
+                    ...(m.getDecorators?.() ?? []),
+                ])) {
+                    if (!mCalls.includes(mk))
+                        mCalls.push(mk);
+                }
                 funcs.push({
                     name: `${cn}.${mn}`,
                     params: mParams.map((p) => ({ name: p.getName(), type: getParamType(p), typeDetail: getParamTypeDetail(p) })),

package/dist/protocol-detector-no-request-surface.test.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const protocol_detector_1 = require("./protocol-detector");
+/**
+ * 修冤枉第六刀（2026-10-10）：无请求面标记的规则侧接受位锁定。
+ *
+ * 语义：队列/定时/事件处理器不面向 HTTP 请求，鉴权发生在入队侧——
+ * 授权族四条的「缺鉴权/缺属主校验」提问在处理器层不适用（N/A 抑制）。
+ * 只抑制 authorization 类；其他族规则不受标记影响。
+ */
+const M = "__progmune_no_request_surface__";
+const has = (vs, rule) => vs.some((v) => v.rule === rule);
+(0, vitest_1.describe)("no_request_surface 标记：授权族四条接受、其他族不受影响", () => {
+    const calls = ["getWorkspaceUrl", M];
+    (0, vitest_1.it)("Unauthenticated Access 被抑制", () => {
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["getWorkspaceUrl"], "NotificationProcessor.getWorkspaceUrl", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Unauthenticated Access)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(calls, "NotificationProcessor.getWorkspaceUrl", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Unauthenticated Access)")).toBe(false);
+    });
+    (0, vitest_1.it)("Unauthenticated Mutation 被抑制", () => {
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["updateTable"], "HistoryProcessor.process", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Unauthenticated Mutation)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(["updateTable", M], "HistoryProcessor.process", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Unauthenticated Mutation)")).toBe(false);
+    });
+    (0, vitest_1.it)("Ownership Check 被抑制（queue job 的属主校验提问不适用）", () => {
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["deleteSessions"], "SessionService.cleanupSessions", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Ownership Check)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(["deleteSessions", M], "SessionService.cleanupSessions", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Ownership Check)")).toBe(false);
+    });
+    (0, vitest_1.it)("Resource Ownership 被抑制", () => {
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["removeIcon"], "AttachmentProcessor.process", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Resource Ownership)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(["removeIcon", M], "AttachmentProcessor.process", "typescript", ["job"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Resource Ownership)")).toBe(false);
+    });
+    (0, vitest_1.it)("非授权族规则不受标记影响（渲染 sink 照报）", () => {
+        const vs = (0, protocol_detector_1.detectSafeguardViolations)(["render", M], "EmailProcessor.renderTemplate", "typescript");
+        (0, vitest_1.expect)(has(vs, "No Input Sanitization")).toBe(true);
+    });
+});

package/dist/protocol-detector.js

@@ -385,6 +385,9 @@ const SAFEGUARD_RULES = [
         safeguards: [
             { pattern: /\b(checkOwner|isOwner|ownerId\s*[!=]==?|authorId\s*[!=]==?|userId\s*[!=]==?|createdBy\s*[!=]==?|\.owner\s*[!=]==?|\.user\s*[!=]==?)\b/i, label: "ownership_check" },
             { pattern: /\b(hasPermission|checkPermission|checkAccess|isAuthorized|checkRole|requireRole|adminCheck|isAdmin|canModify|canDelete|canEdit)\b/i, label: "authz_check" },
+            // 修冤枉第六刀：队列/定时/事件处理器不面向请求面——鉴权发生在入队侧，
+            // 「改资源没查属主」的提问在处理器层不适用（docmost 补标注 FP 类）
+            { pattern: /\b(__progmune_no_request_surface__)\b/, label: "no_request_surface" },
             { pattern: /\b(__progmune_ownership_checked__)\b/, label: "inline_ownership_check" },
             // §46 ②：资源属主被**赋值为当前主体**（`{ userId: user.id }` / `where:{userId: user.id}`）。
             // 这类函数的被操作对象就是（或已被限定在）主体自己，谈不上「改别人的东西」。
@@ -428,7 +431,7 @@ const SAFEGUARD_RULES = [
         paramTypeSafeguards: [SESSION_BEARING_TYPE_RE],
         trigger: /\b(list|download|view|fetch)(?:[A-Z]\w*|_\w+)|get(?:[A-Z]\w+|_\w+)/i,
         safeguards: [
-            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|jwt\.decode|decode_token|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__)\b/i, label: "auth_check" },
+            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|jwt\.decode|decode_token|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__|__progmune_no_request_surface__)\b/i, label: "auth_check" },
             // §40 C1：裸 can —— verdaccio 的 can('publish') 中间件就是这里的授权判定
             { pattern: exports.AUTHZ_BARE_CAN_RE, label: "bare_can", callsOnly: true },
         ],
@@ -464,7 +467,7 @@ const SAFEGUARD_RULES = [
         // (listPosts/getPost/deletePost fire via identifier-parsed words).
         trigger: /\b(add|create|update|set|publish|insert|submit)(?:[A-Z]\w*|_\w+)|(?:[A-Z]\w*|_\w+)(Add|Create|Update|Set|Publish|Insert|Submit)\b/i,
         safeguards: [
-            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__)\b/i, label: "auth_check" },
+            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__|__progmune_no_request_surface__)\b/i, label: "auth_check" },
             // §40 C1：裸 can —— 同上
             { pattern: exports.AUTHZ_BARE_CAN_RE, label: "bare_can", callsOnly: true },
             // §46 ①：凭签发入口豁免 —— 独立 safeguard，**不并入 auth_check**。
@@ -624,6 +627,8 @@ const SAFEGUARD_RULES = [
         safeguards: [
             { pattern: /\b(ownerId\s*[!=]==?|authorId\s*[!=]==?|userId\s*[!=]==?|createdBy|\.owner\s*[!=]==?)/i, label: "ownership_comparison" },
             { pattern: /\b(__progmune_ownership_checked__)\b/, label: "inline_ownership_check" },
+            // 修冤枉第六刀：同上（无请求面 ⇒ 属主校验提问不适用）
+            { pattern: /\b(__progmune_no_request_surface__)\b/, label: "no_request_surface" },
             // §38：同 Ownership Check，组合式谓语一并接上（这条规则更严，更需要）
             { pattern: exports.AUTHZ_PREDICATE_RE, label: "casl_predicate" },
             { pattern: exports.AUTHZ_CAN_HELPER_RE, label: "can_helper" },

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.64";
+exports.RUNTIME_VERSION = "3.7.65";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.64",
+  "version": "3.7.65",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",