specky-sdd 3.4.0 → 3.5.0

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.5.0] - 2026-07-02
+
+Enterprise mode — an **opt-in configuration profile** of the same 100%
+open-source (MIT) package. Every control below ships in `specky-sdd` for
+everyone, default-OFF, and the standard profile is byte-for-byte the same
+experience as 3.4.0. See `docs/ENTERPRISE-DEPLOYMENT.md`.
+
+### Added
+
+- **Enterprise profile.** `profile: enterprise` in `.specky/config.yml` — or `SPECKY_PROFILE=enterprise`, the `SPECKY_ENTERPRISE=1` shorthand, or `specky serve --profile=enterprise` (flag > env > file) — flips the *defaults* of `audit_enabled`, `rbac.enabled`, `rate_limit.enabled`, and the new `audit.fail_closed` to ON. Explicit config values always win, so any control can still be switched off individually. The server logs the resolved posture at startup.
+- **Identity-based RBAC over HTTP.** `SDD_HTTP_TOKENS_FILE` points at a YAML token table (kept outside the workspace) mapping bearer tokens — plaintext or `token_sha256` — to a named `principal` and RBAC `role`. Tokens are constant-time compared; loading is fail-closed (a malformed table aborts startup instead of accepting everyone). Role precedence is now **authenticated token role > `SDD_ROLE` > `rbac.default_role`** — an authenticated request ignores `SDD_ROLE`, so a remote caller cannot out-vote its token. `sdd_check_access` and `access_denied` responses report the principal and role source. The legacy shared `SDD_HTTP_TOKEN` continues to work unchanged when no table is configured.
+- **Tamper-evident audit trail.** With `SDD_AUDIT_HMAC_KEY` (or `SDD_AUDIT_HMAC_KEY_FILE`, key held outside the workspace) every audit entry is signed with HMAC-SHA256 over its serialized form — `previous_hash` included, so signatures chain. `sdd_verify_audit` now verifies both the hash chain and the signatures and reports `hmac_checked` / `signed_entries`; a workspace writer who rewrites the log and recomputes the plain chain is detected. Audit entries also record the authenticated `principal`. (Documented limit: tail truncation needs external anchoring of `current_hash`.)
+- **Fail-closed auditing.** `audit.fail_closed: true` (enterprise default) refuses tool execution with `audit_unavailable` when the pre-execution audit entry cannot be written — no unaudited actions. Post-execution audit failures are surfaced on stderr without masking the tool result. Standard profile keeps the historical fail-open behavior.
+- **`docs/ENTERPRISE-DEPLOYMENT.md`** — profiles, token table setup (with token/hash generation commands), HMAC audit + verification, hosted `serve --http` behind TLS (systemd/container examples), air-gapped tarball + private-registry installs, CI enforcement, the full enterprise env-var/config reference, and an honest out-of-scope list (no in-process TLS, no SSO yet, stdio has no auth layer).
+- Tests: `config-profile` (profile precedence + explicit-wins), `audit-hmac` (signing, forged-rewrite detection, fail-closed, key resolution), `token-table` (load validation + identity resolution), and identity/fail-closed cases in `tool-enforcement`.
+
+### Changed
+
+- `AuditLogger` accepts an options object (`{ exportFormat, maxFileSizeMb, hmacKey, failClosed }`); the old positional signature still works.
+- RBAC denial responses and audit entries include the caller's `principal` when authenticated.
+- README, SECURITY.md, CLI.md, INSTALL.md, and ENTERPRISE-CONTROLS.md updated for the profile, token table, and HMAC audit; API reference regenerated.
+
 ## [3.4.0] - 2026-07-02
 
 First stable `3.4.0` (supersedes the `3.4.0-rc.*` prereleases). Consolidates the

package/README.md

@@ -57,7 +57,7 @@
 | **Enterprise** | [Compliance Frameworks](#compliance-frameworks) | HIPAA, SOC2, GDPR, PCI-DSS, ISO 27001 |
 | | [Enterprise Ready](#enterprise-ready) | Security, audit trail, quality gates |
 | **Platform** | [The SDD Platform](#the-spec-driven-development-platform) | Built on Spec-Kit, everything included |
-| | [Roadmap](#roadmap) | v3.4 current, v3.5+ planned |
+| | [Roadmap](#roadmap) | v3.5 current, v3.6+ planned |
 
 
 ## What is Specky?
@@ -199,7 +199,7 @@ cd your-project
 specky install
 ```
 
-That's it. The CLI auto-detects Claude Code and/or GitHub Copilot and installs the 13 agents, 22 prompts, 8 skills, 16 hooks, the MCP server registration, and pre-authorizes all required tools.
+That's it. The CLI auto-detects Claude Code and/or GitHub Copilot and installs the 13 agents, 22 prompts, 8 skills, 16 hooks, the MCP server registration, and pre-authorizes a least-privilege set of tools (the Specky MCP tools plus scoped `git`/`npm`/`npx` and file editing — not arbitrary shell or network).
 
 **Other install modes:**
 
@@ -887,13 +887,19 @@ Create `.specky/config.yml` in your project root to customize Specky:
 
 ```yaml
 # .specky/config.yml
+profile: standard                    # standard | enterprise (flips security defaults ON)
 templates_path: ./my-templates       # Override built-in templates
 default_framework: vitest            # Default test framework
 compliance_frameworks: [hipaa, soc2] # Frameworks to check
 audit_enabled: true                  # Enable audit trail
+rbac:
+  enabled: false                     # Role checks (viewer/contributor/admin)
+  default_role: contributor
+rate_limit:
+  enabled: false                     # HTTP token bucket (60 rpm, burst 10)
 ```
 
-When `templates_path` is set, Specky uses your custom templates instead of the built-in ones. When `audit_enabled` is true, tool invocations are logged locally.
+When `templates_path` is set, Specky uses your custom templates instead of the built-in ones. When `audit_enabled` is true, tool invocations are logged locally. `profile: enterprise` turns audit, RBAC, rate limiting, and fail-closed auditing on by default (explicit values win) — see [docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md).
 
 
 ## MCP Integration Architecture
@@ -982,6 +988,12 @@ From any [input](#input-methods-6-ways-to-start) to production -- fully automate
 
 Specky is built with enterprise adoption in mind.
 
+### Enterprise profile (opt-in)
+
+Specky is 100% open source (MIT) — enterprise mode is just an opt-in configuration profile of the same package: `profile: enterprise` (or `SPECKY_PROFILE=enterprise`, or `specky serve --profile=enterprise`) flips the governance defaults ON — hash-chained **audit trail** (fail-closed), **RBAC**, and HTTP **rate limiting** — while explicit config values still win. Add `SDD_HTTP_TOKENS_FILE` for **identity-based roles** (each bearer token maps to a named principal + role; audit entries record who did what) and `SDD_AUDIT_HMAC_KEY[_FILE]` for a **tamper-evident audit log** signed with a key the workspace never sees. The standard profile is untouched — all of this stays off unless you opt in.
+
+→ Full guide: [docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md) (hosted HTTP, tokens, HMAC audit, air-gapped installs, containers, CI gates)
+
 ### Security Posture
 
 - **3 runtime dependencies** — minimal attack surface (`@modelcontextprotocol/sdk`, `zod`, `yaml`)
@@ -993,6 +1005,7 @@ Specky is built with enterprise adoption in mind.
 - See [SECURITY.md](SECURITY.md) for full OWASP Top 10 coverage
 - See [docs/SYSTEM-DESIGN.md](docs/SYSTEM-DESIGN.md) for complete security architecture
 - See [docs/ENTERPRISE-CONTROLS.md](docs/ENTERPRISE-CONTROLS.md) for RBAC, audit trail, and tool-enforcement controls
+- See [docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md) for the enterprise profile, identity tokens, HMAC audit, and hosted/air-gapped deployment
 - See [docs/DETERMINISM.md](docs/DETERMINISM.md) for reproducible-output guarantees
 - See [docs/BRANCH-GOVERNANCE.md](docs/BRANCH-GOVERNANCE.md) for branch and release governance
 - See [docs/EVIDENCE.md](docs/EVIDENCE.md) for the validation evidence pack
@@ -1004,7 +1017,7 @@ When using Specky, follow these practices to protect your data:
 | Practice | Why | How |
 |----------|-----|-----|
 | **Use stdio mode for local development** | No network exposure | `npx specky-sdd` (default) |
-| **Never expose HTTP mode to public networks without TLS** | HTTP has optional bearer-token auth but no TLS | `--http` binds to `127.0.0.1` by default; set `SDD_HTTP_TOKEN` for bearer auth. For remote access, add a reverse proxy (nginx, Caddy) terminating TLS |
+| **Never expose HTTP mode to public networks without TLS** | HTTP has optional bearer-token auth but no TLS | `--http` binds to `127.0.0.1` by default; set `SDD_HTTP_TOKEN` (shared) or `SDD_HTTP_TOKENS_FILE` (per-user identity + role) for bearer auth. For remote access, add a reverse proxy (nginx, Caddy) terminating TLS |
 | **Protect the `.specs/` directory** | Contains your specification artifacts (architecture, API contracts, business logic) | Add `.specs/` to `.gitignore` if specs contain sensitive IP, or use a private repo |
 | **Protect checkpoints** | `.specs/{feature}/.checkpoints/` stores full artifact snapshots | Same as above — treat checkpoints like source code |
 | **Review auto-generated specs before committing** | Turnkey and auto-pipeline generate from natural language — may capture sensitive details | Review SPECIFICATION.md and DESIGN.md before `git add` |
@@ -1086,7 +1099,7 @@ curl http://localhost:3200/health
 
 ## Roadmap
 
-### v3.4 (current)
+### v3.5 (current)
 
 | Capability | Status |
 |------------|--------|
@@ -1118,17 +1131,20 @@ curl http://localhost:3200/health
 | RBAC foundation (opt-in role-based access control) | Stable |
 | Rate limiting for HTTP transport (opt-in) | Stable |
 | HTTP transport: loopback bind by default, bearer-token auth (`SDD_HTTP_TOKEN`), DNS-rebinding protection | Stable |
+| Enterprise profile (`profile: enterprise` — audit/RBAC/rate-limit defaults ON, opt-in) | Stable |
+| Identity-based RBAC over HTTP (`SDD_HTTP_TOKENS_FILE`: token → principal + role) | Stable |
+| Tamper-evident audit trail (HMAC-signed entries, fail-closed mode, `sdd_verify_audit`) | Stable |
 
-### v3.5+ (planned)
+### v3.6+ (planned)
 
 | Feature | Description |
 |---------|-------------|
 | Observability | OpenTelemetry metrics and structured logging |
 | Internationalization | Spec templates in PT-BR, ES, FR, DE, JA |
 | Automated shrinking | fast-check/Hypothesis shrinking feedback into spec refinement |
-| Centralized audit log | SIEM-integrated tamper-evident audit trail |
+| Centralized audit log | SIEM export (syslog shipping, OTLP) of the tamper-evident audit trail |
 | Multi-tenant | Isolated workspaces for multiple teams |
-| SSO / SAML | Federated identity for enterprise auth |
+| SSO / SAML | Federated identity for enterprise auth (beyond the static token table) |
 
 Have a feature request? [Open an issue](https://github.com/paulasilvatech/specky/issues).
 

package/SECURITY.md

@@ -4,10 +4,10 @@
 
 | Version | Supported |
 | --- | --- |
-| 3.3.x | ✅ Active |
-| 3.0.x–3.2.x | ✅ Security fixes only |
-| 2.3.x | ❌ End of life |
-| 2.0.x | ❌ End of life |
+| 3.5.x | ✅ Active |
+| 3.4.x | ✅ Security fixes only |
+| 3.0.x–3.3.x | ❌ End of life |
+| 2.x | ❌ End of life |
 | 1.0.x | ❌ End of life |
 
 ## Reporting a Vulnerability
@@ -78,7 +78,7 @@ Runtime dependencies are kept intentionally small and are audited in CI.
 | A04 Insecure Design | State machine enforces phase ordering; thin tools / fat services separation |
 | A05 Security Misconfiguration | Minimal config surface; no default credentials; no admin endpoints |
 | A06 Vulnerable Components | 3 runtime deps only; Dependabot enabled; regular audits |
-| A07 Authentication Failures | stdio mode is process-isolated (no network). HTTP mode binds to `127.0.0.1` by default and supports optional bearer-token auth (`SDD_HTTP_TOKEN`, constant-time compared) plus DNS-rebinding protection |
+| A07 Authentication Failures | stdio mode is process-isolated (no network). HTTP mode binds to `127.0.0.1` by default and supports optional bearer-token auth — a shared token (`SDD_HTTP_TOKEN`) or a named token table (`SDD_HTTP_TOKENS_FILE`, principal + RBAC role per token, sha256 storage supported) — all constant-time compared, plus DNS-rebinding protection |
 | A08 Data Integrity Failures | Atomic file writes via FileManager; Zod schema enforcement |
 | A09 Logging Failures | Structured stderr logging; no stdout pollution |
 | A10 SSRF | Zero outbound network requests |
@@ -101,8 +101,15 @@ We run `npm audit` in CI on every pull request. Any `high` or `critical` vulnera
 | --- | --- | --- |
 | `SDD_WORKSPACE` | Restricts file operations to this directory | Current working directory |
 | `PORT` | HTTP transport port (when using `--http` mode) | 3200 |
+| `SPECKY_PROFILE` | `enterprise` flips audit/RBAC/rate-limit defaults to ON (explicit config wins) | `standard` |
+| `SDD_HTTP_TOKEN` | Shared bearer token for `--http` (no identity) | unset (auth off) |
+| `SDD_HTTP_TOKENS_FILE` | Named token table → principal + RBAC role (identity-based auth) | unset |
+| `SDD_AUDIT_HMAC_KEY` / `SDD_AUDIT_HMAC_KEY_FILE` | Sign audit entries (tamper evidence); keep the key outside the workspace | unset (chain only) |
+| `SDD_ROLE` | Local RBAC role for stdio use — ignored on authenticated HTTP requests | `rbac.default_role` |
 
-HTTP transport (`--http`) binds to `127.0.0.1` by default. Binding to a non-loopback address requires an explicit `--host` and prints a warning. Set `SDD_HTTP_TOKEN` to require an `Authorization: Bearer <token>` header on every `/mcp` request (the `/health` probe stays open). Even so, do not expose Specky to public networks without a TLS-terminating reverse proxy.
+HTTP transport (`--http`) binds to `127.0.0.1` by default. Binding to a non-loopback address requires an explicit `--host` and prints a warning. Set `SDD_HTTP_TOKEN` (shared token) or `SDD_HTTP_TOKENS_FILE` (named tokens mapping to principal + role) to require an `Authorization: Bearer <token>` header on every `/mcp` request (the `/health` probe stays open). Even so, do not expose Specky to public networks without a TLS-terminating reverse proxy. Hosted, air-gapped, and container deployment patterns: [docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md).
+
+The audit trail's plain hash chain detects corruption but not deliberate rewriting by a workspace writer; configure an HMAC key (held outside the workspace) to make entries tamper-evident, and anchor the `current_hash` from `sdd_verify_audit` externally to detect tail truncation.
 
 ## Secure Development Practices
 
@@ -119,7 +126,7 @@ HTTP transport (`--http`) binds to `127.0.0.1` by default. Binding to a non-loop
 | Practice | Details |
 | --- | --- |
 | **Use stdio mode by default** | `specky-sdd` (global install) — no network exposure, process-level isolation |
-| **Never expose HTTP mode publicly without TLS** | `--http` supports bearer-token auth (`SDD_HTTP_TOKEN`) and binds to `127.0.0.1` by default, but has no TLS. For remote access, set a token AND place it behind a reverse proxy (nginx, Caddy, Traefik) terminating TLS |
+| **Never expose HTTP mode publicly without TLS** | `--http` supports bearer-token auth (`SDD_HTTP_TOKEN`, or `SDD_HTTP_TOKENS_FILE` for per-user identity + role) and binds to `127.0.0.1` by default, but has no TLS. For remote access, set tokens AND place it behind a reverse proxy (nginx, Caddy, Traefik) terminating TLS |
 | **Protect `.specs/` directory** | Contains architecture details, API contracts, security models. Add to `.gitignore` for sensitive projects, or use a private repository |
 | **Protect `.checkpoints/`** | Contains full copies of all spec artifacts. Treat like source code |
 | **Keep security-scan hook active** | `.claude/hooks/security-scan.sh` scans for hardcoded secrets and blocks commits (exit 2). Do not disable |
@@ -205,7 +212,7 @@ Running `npx -y specky-sdd@latest` without a pinned version downloads the latest
 
 ```bash
 # Install into a local vendor directory — no global write permissions needed
-npm install specky-sdd@3.4.0 --prefix ./vendor --ignore-scripts
+npm install specky-sdd@3.5.0 --prefix ./vendor --ignore-scripts
 ./vendor/node_modules/.bin/specky install
 ./vendor/node_modules/.bin/specky doctor     # integrity check
 ```

package/apm.yml

@@ -1,5 +1,5 @@
 name: specky-sdd
-version: 3.4.0
+version: 3.5.0
 description: "Agentic Spec-Driven Development — 10-phase pipeline with 58 MCP tools, 13 agents, 22 prompts, 8 skills, 16 hooks, EARS notation, model routing, and enterprise security"
 author: Paula Silva
 license: MIT

package/config.yml

@@ -1,5 +1,5 @@
 audit_enabled: true
-version: "3.4.0"
+version: "3.5.0"
 pipeline:
   phases: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
   phase_names:

package/dist/cli/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAalE"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAclE"}

package/dist/cli/commands/serve.js

@@ -7,8 +7,9 @@
  */
 export async function runServe(opts) {
     // We simply import the existing entry point which starts the MCP server.
-    // Flags like --http are read from process.argv by the server module itself,
-    // so we just set them back into argv for compatibility.
+    // Flags like --http, --host= and --profile= are read from process.argv by
+    // the server module itself, so we just set them back into argv for
+    // compatibility.
     const extra = [];
     if (opts.http)
         extra.push("--http");

package/dist/cli/commands/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,yEAAyE;IACzE,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,6CAA6C;IAC7C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAE5B,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/B,2CAA2C;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,yEAAyE;IACzE,0EAA0E;IAC1E,mEAAmE;IACnE,iBAAiB;IACjB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,6CAA6C;IAC7C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAE5B,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/B,2CAA2C;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/index.js

@@ -8,7 +8,7 @@
  *   specky status
  *   specky upgrade
  *   specky hooks  <list|test|run NAME>
- *   specky serve  [--http] [--port=N]
+ *   specky serve  [--http] [--port=N] [--profile=enterprise]
  *   specky --version | -v
  *   specky --help  | -h
  *
@@ -70,6 +70,8 @@ Commands:
     --port=<N>                          HTTP port (default 3200)
     --host=<addr>                       HTTP bind address (default 127.0.0.1;
                                         set 0.0.0.0 only behind an auth proxy)
+    --profile=<standard|enterprise>     Config profile (enterprise defaults
+                                        audit/RBAC/rate-limit to ON)
 
   --version, -v          Print version
   --help, -h             Print this help

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiC/B,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAc;IACrD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE/C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiD,CAAC,CAAC,CAAC,MAAM,CAAC;YACrG,OAAO,OAAO,CAAC;gBACb,GAAG;gBACH,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;gBAC9B,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;aAClC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC3D,OAAO,SAAS,CAAC;gBACf,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;gBAC1B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;aACnC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC3D,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7D,OAAO,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,MAAM,CAA4B,CAAC;YACpE,OAAO,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,QAAQ,CAAC;gBACd,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI;gBAC5B,IAAI,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE/E,mFAAmF;IACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO;QAClE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;KAC1C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,eAAe,GAAG,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9E,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IACnB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,GAAG,QAAS,CAAC;QACpB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;SAAM,IAAI,WAAW,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChD,kCAAkC;QAClC,OAAO,GAAG,OAAO,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,QAAQ,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmC/B,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAc;IACrD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE/C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiD,CAAC,CAAC,CAAC,MAAM,CAAC;YACrG,OAAO,OAAO,CAAC;gBACb,GAAG;gBACH,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;gBAC9B,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;aAClC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC3D,OAAO,SAAS,CAAC;gBACf,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;gBAC1B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;aACnC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC3D,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7D,OAAO,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,MAAM,CAA4B,CAAC;YACpE,OAAO,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,QAAQ,CAAC;gBACd,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI;gBAC5B,IAAI,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE/E,mFAAmF;IACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO;QAClE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;KAC1C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,eAAe,GAAG,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9E,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IACnB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,GAAG,QAAS,CAAC;QACpB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;SAAM,IAAI,WAAW,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChD,kCAAkC;QAClC,OAAO,GAAG,OAAO,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,QAAQ,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/config.d.ts

@@ -1,5 +1,9 @@
 import { z } from "zod";
 declare const configSchema: z.ZodObject<{
+    profile: z.ZodDefault<z.ZodEnum<{
+        standard: "standard";
+        enterprise: "enterprise";
+    }>>;
     templates_path: z.ZodDefault<z.ZodString>;
     default_framework: z.ZodDefault<z.ZodString>;
     compliance_frameworks: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -16,6 +20,7 @@ declare const configSchema: z.ZodObject<{
             otlp: "otlp";
         }>>;
         max_file_size_mb: z.ZodDefault<z.ZodNumber>;
+        fail_closed: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
     rbac: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -27,11 +32,26 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type SpeckyConfig = z.infer<typeof configSchema>;
+export type SpeckyProfile = SpeckyConfig["profile"];
+/** Inputs that can force the profile from outside config.yml (flag > env). */
+export interface ProfileOverrides {
+    argv?: readonly string[];
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Resolve the active profile. Precedence: `--profile=` flag > `SPECKY_PROFILE`
+ * env > `SPECKY_ENTERPRISE=1` shorthand > config.yml `profile:` > standard.
+ * Unknown values are ignored with a stderr warning (never crash the server).
+ */
+export declare function resolveProfile(configProfile: SpeckyProfile, overrides?: ProfileOverrides): SpeckyProfile;
 /**
  * Load `.specky/config.yml` from workspace root. Returns defaults if the file
  * is absent, unparseable, or fails validation (a bad value never crashes the
  * server — it falls back to the safe defaults, with a stderr warning).
+ *
+ * `overrides` lets the server entry point (and tests) inject argv/env for
+ * profile resolution instead of reading globals.
  */
-export declare function loadConfig(workspaceRoot: string): SpeckyConfig;
+export declare function loadConfig(workspaceRoot: string, overrides?: ProfileOverrides): SpeckyConfig;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BR,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIxD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,YAAY,CAyB9D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BR,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAIpD,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAMD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,aAAa,EAC5B,SAAS,GAAE,gBAAqB,GAC/B,aAAa,CAsBf;AAgCD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,GAAE,gBAAqB,GAAG,YAAY,CAyBhG"}

package/dist/config.js

@@ -5,6 +5,15 @@
  * Parsing uses the `yaml` library (safe by default — no code execution) and a
  * Zod schema for validation, replacing a hand-rolled line parser that could not
  * handle nested lists/quoting and did no validation.
+ *
+ * Profiles: `standard` (default) keeps every enterprise control opt-in and
+ * off. `enterprise` flips the *defaults* of audit_enabled, rbac.enabled,
+ * rate_limit.enabled, and audit.fail_closed to true — an explicit value in
+ * config.yml always wins over the profile default, so an enterprise deployment
+ * can still switch an individual control off. The profile itself can come from
+ * config.yml (`profile: enterprise`), the `SPECKY_PROFILE` env var, the
+ * `SPECKY_ENTERPRISE=1` shorthand, or the server's `--profile=enterprise` flag
+ * (flag > env > config file).
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -19,6 +28,7 @@ const safeRelativePath = z.string().refine((p) => p === "" ||
         !p.includes("\0")), { message: "templates_path must be a workspace-relative path (no absolute paths, no '..')." });
 const configSchema = z
     .object({
+    profile: z.enum(["standard", "enterprise"]).default("standard"),
     templates_path: safeRelativePath.default(""),
     default_framework: z.string().default("vitest"),
     compliance_frameworks: z.array(z.string()).default(["general"]),
@@ -34,8 +44,9 @@ const configSchema = z
         .object({
         export_format: z.enum(["jsonl", "syslog", "otlp"]).default("jsonl"),
         max_file_size_mb: z.number().positive().default(10),
+        fail_closed: z.boolean().default(false),
     })
-        .default({ export_format: "jsonl", max_file_size_mb: 10 }),
+        .default({ export_format: "jsonl", max_file_size_mb: 10, fail_closed: false }),
     rbac: z
         .object({
         enabled: z.boolean().default(false),
@@ -45,19 +56,79 @@ const configSchema = z
 })
     .strip();
 const DEFAULT_CONFIG = configSchema.parse({});
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Resolve the active profile. Precedence: `--profile=` flag > `SPECKY_PROFILE`
+ * env > `SPECKY_ENTERPRISE=1` shorthand > config.yml `profile:` > standard.
+ * Unknown values are ignored with a stderr warning (never crash the server).
+ */
+export function resolveProfile(configProfile, overrides = {}) {
+    const argv = overrides.argv ?? process.argv;
+    const env = overrides.env ?? process.env;
+    const flagValue = argv
+        .filter((a) => a.startsWith("--profile="))
+        .at(-1)
+        ?.slice("--profile=".length);
+    const candidates = [
+        flagValue,
+        env["SPECKY_PROFILE"],
+        env["SPECKY_ENTERPRISE"] === "1" ? "enterprise" : undefined,
+    ];
+    for (const candidate of candidates) {
+        if (candidate === undefined)
+            continue;
+        if (candidate === "standard" || candidate === "enterprise")
+            return candidate;
+        console.error(`[specky] Ignoring unknown profile "${candidate}" (valid: standard, enterprise).`);
+    }
+    return configProfile;
+}
+/**
+ * Enterprise profile flips the *defaults* of the security controls to ON.
+ * A value explicitly present in config.yml always wins, so `rawConfig` (the
+ * parsed YAML before Zod defaults) is consulted to tell "user said false"
+ * apart from "user said nothing".
+ */
+function applyEnterpriseDefaults(config, rawConfig) {
+    const raw = isRecord(rawConfig) ? rawConfig : {};
+    const rawRbac = isRecord(raw["rbac"]) ? raw["rbac"] : {};
+    const rawRateLimit = isRecord(raw["rate_limit"]) ? raw["rate_limit"] : {};
+    const rawAudit = isRecord(raw["audit"]) ? raw["audit"] : {};
+    return {
+        ...config,
+        audit_enabled: "audit_enabled" in raw ? config.audit_enabled : true,
+        rbac: {
+            ...config.rbac,
+            enabled: "enabled" in rawRbac ? config.rbac.enabled : true,
+        },
+        rate_limit: {
+            ...config.rate_limit,
+            enabled: "enabled" in rawRateLimit ? config.rate_limit.enabled : true,
+        },
+        audit: {
+            ...config.audit,
+            fail_closed: "fail_closed" in rawAudit ? config.audit.fail_closed : true,
+        },
+    };
+}
 /**
  * Load `.specky/config.yml` from workspace root. Returns defaults if the file
  * is absent, unparseable, or fails validation (a bad value never crashes the
  * server — it falls back to the safe defaults, with a stderr warning).
+ *
+ * `overrides` lets the server entry point (and tests) inject argv/env for
+ * profile resolution instead of reading globals.
  */
-export function loadConfig(workspaceRoot) {
+export function loadConfig(workspaceRoot, overrides = {}) {
     const configPath = join(workspaceRoot, ".specky", "config.yml");
     let raw;
     try {
         raw = readFileSync(configPath, "utf-8");
     }
     catch {
-        return { ...DEFAULT_CONFIG };
+        return finalizeConfig({ ...DEFAULT_CONFIG }, {}, overrides);
     }
     let parsed;
     try {
@@ -65,13 +136,18 @@ export function loadConfig(workspaceRoot) {
     }
     catch (err) {
         console.error(`[specky] Ignoring malformed .specky/config.yml: ${err.message}`);
-        return { ...DEFAULT_CONFIG };
+        return finalizeConfig({ ...DEFAULT_CONFIG }, {}, overrides);
     }
     const result = configSchema.safeParse(parsed);
     if (!result.success) {
         console.error(`[specky] Ignoring invalid .specky/config.yml: ${result.error.issues.map((i) => i.message).join("; ")}`);
-        return { ...DEFAULT_CONFIG };
+        return finalizeConfig({ ...DEFAULT_CONFIG }, {}, overrides);
     }
-    return result.data;
+    return finalizeConfig(result.data, parsed, overrides);
+}
+function finalizeConfig(config, rawConfig, overrides) {
+    const profile = resolveProfile(config.profile, overrides);
+    const resolved = { ...config, profile };
+    return profile === "enterprise" ? applyEnterpriseDefaults(resolved, rawConfig) : resolved;
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,EAAE;IACR,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACnB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACtB,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAC9F,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/C,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC/C,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtE,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACpD,CAAC;SACD,OAAO,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;IAC5D,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;KAChF,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;CAC5D,CAAC;KACD,KAAK,EAAE,CAAC;AAIX,MAAM,cAAc,GAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,aAAqB;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAoD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iDAAiD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;QACF,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,EAAE;IACR,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACnB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACtB,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAC9F,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/D,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/C,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC/C,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtE,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACxC,CAAC;SACD,OAAO,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChF,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;KAChF,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;CAC5D,CAAC;KACD,KAAK,EAAE,CAAC;AAKX,MAAM,cAAc,GAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAQ5D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,aAA4B,EAC5B,YAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEzC,MAAM,SAAS,GAAG,IAAI;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;SACzC,EAAE,CAAC,CAAC,CAAC,CAAC;QACP,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,UAAU,GAA8B;QAC5C,SAAS;QACT,GAAG,CAAC,gBAAgB,CAAC;QACrB,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QAC7E,OAAO,CAAC,KAAK,CACX,sCAAsC,SAAS,kCAAkC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,MAAoB,EAAE,SAAkB;IACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE,eAAe,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QACnE,IAAI,EAAE;YACJ,GAAG,MAAM,CAAC,IAAI;YACd,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SAC3D;QACD,UAAU,EAAE;YACV,GAAG,MAAM,CAAC,UAAU;YACpB,OAAO,EAAE,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACtE;QACD,KAAK,EAAE;YACL,GAAG,MAAM,CAAC,KAAK;YACf,WAAW,EAAE,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;SACzE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,aAAqB,EAAE,YAA8B,EAAE;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC,EAAE,GAAG,cAAc,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAoD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,cAAc,CAAC,EAAE,GAAG,cAAc,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iDAAiD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;QACF,OAAO,cAAc,CAAC,EAAE,GAAG,cAAc,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,MAAoB,EACpB,SAAkB,EAClB,SAA2B;IAE3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IACxC,OAAO,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5F,CAAC"}

package/dist/index.js

@@ -9,7 +9,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { randomUUID } from "node:crypto";
-import { isBearerAuthorized } from "./utils/http-auth.js";
 import { VERSION, SERVER_NAME, DEFAULT_HTTP_PORT } from "./constants.js";
 import { FileManager } from "./services/file-manager.js";
 import { StateMachine } from "./services/state-machine.js";
@@ -45,7 +44,8 @@ import { registerTurnkeyTools } from "./tools/turnkey.js";
 import { PbtGenerator } from "./services/pbt-generator.js";
 import { registerPbtTools } from "./tools/pbt.js";
 import { loadConfig } from "./config.js";
-import { AuditLogger } from "./services/audit-logger.js";
+import { AuditLogger, resolveAuditHmacKey } from "./services/audit-logger.js";
+import { loadTokenTable, resolveBearerIdentity, sha256Hex } from "./utils/token-table.js";
 import { MetricsGenerator } from "./services/metrics-generator.js";
 import { registerMetricsTools } from "./tools/metrics.js";
 import { ModelRoutingEngine } from "./services/model-routing-engine.js";
@@ -64,12 +64,26 @@ import { registerAuditTools } from "./tools/audit.js";
 // Resolve workspace root
 const workspaceRoot = process.env["SDD_WORKSPACE"] || process.cwd();
 console.error(`[specky] Workspace root: ${workspaceRoot}`);
-// Load optional project config (.specky/config.yml)
+// Load optional project config (.specky/config.yml). The profile may be
+// forced from outside the workspace: --profile=enterprise flag, SPECKY_PROFILE
+// env, or SPECKY_ENTERPRISE=1 shorthand.
 const config = loadConfig(workspaceRoot);
+const auditHmacKey = resolveAuditHmacKey();
 if (config.templates_path)
     console.error(`[specky] Custom templates: ${config.templates_path}`);
-if (config.audit_enabled)
-    console.error(`[specky] Audit trail: enabled`);
+if (config.profile === "enterprise") {
+    console.error(`[specky] Profile: enterprise — audit=${config.audit_enabled ? "on" : "off"}` +
+        ` (fail_closed=${config.audit.fail_closed ? "on" : "off"}, hmac=${auditHmacKey ? "on" : "off"})` +
+        `, rbac=${config.rbac.enabled ? "on" : "off"} (default_role=${config.rbac.default_role})` +
+        `, rate_limit=${config.rate_limit.enabled ? "on" : "off"}`);
+    if (config.audit_enabled && !auditHmacKey) {
+        console.error("[specky] WARNING: enterprise audit is hash-chained but NOT tamper-evident — " +
+            "set SDD_AUDIT_HMAC_KEY or SDD_AUDIT_HMAC_KEY_FILE (key stored outside the workspace) to sign entries.");
+    }
+}
+else if (config.audit_enabled) {
+    console.error(`[specky] Audit trail: enabled${auditHmacKey ? " (HMAC-signed)" : ""}`);
+}
 // Initialize MCP server
 const server = new McpServer({
     name: SERVER_NAME,
@@ -109,7 +123,12 @@ const docGenerator = new DocGenerator(fileManager, stateMachine);
 const gitManager = new GitManager(fileManager);
 const testGenerator = new TestGenerator(fileManager);
 const pbtGenerator = new PbtGenerator(fileManager);
-const auditLogger = new AuditLogger(workspaceRoot, config.audit_enabled, config.audit.export_format, config.audit.max_file_size_mb);
+const auditLogger = new AuditLogger(workspaceRoot, config.audit_enabled, {
+    exportFormat: config.audit.export_format,
+    maxFileSizeMb: config.audit.max_file_size_mb,
+    hmacKey: auditHmacKey,
+    failClosed: config.audit.fail_closed,
+});
 const rbacEngine = new RbacEngine(config.rbac.enabled ?? false, config.rbac.default_role ?? "contributor");
 const metricsGenerator = new MetricsGenerator(fileManager);
 const modelRoutingEngine = new ModelRoutingEngine();
@@ -174,18 +193,36 @@ async function main() {
         const hostArg = args.find((a) => a.startsWith("--host="))?.slice("--host=".length);
         const host = hostArg || process.env["SDD_HTTP_HOST"] || "127.0.0.1";
         const isLoopback = host === "127.0.0.1" || host === "::1" || host === "localhost";
-        // Optional bearer-token auth. When SDD_HTTP_TOKEN is set, every /mcp request
-        // must present `Authorization: Bearer <token>`. Compared in constant time.
+        // Optional bearer-token auth, two flavors:
+        //   - SDD_HTTP_TOKEN: one shared token (no identity — RBAC falls back to
+        //     SDD_ROLE / default_role).
+        //   - SDD_HTTP_TOKENS_FILE: named tokens mapping to principal + role
+        //     (identity-based RBAC). Fail-closed: a broken tokens file aborts startup.
         const authToken = process.env["SDD_HTTP_TOKEN"] || "";
-        const requireAuth = authToken.length > 0;
-        if (requireAuth) {
-            console.error("[specky] HTTP bearer-token authentication enabled.");
+        const tokensFile = process.env["SDD_HTTP_TOKENS_FILE"] || "";
+        let tokenTable = [];
+        if (tokensFile) {
+            try {
+                tokenTable = loadTokenTable(tokensFile);
+                console.error(`[specky] HTTP token table loaded: ${tokenTable.length} principal(s) from ${tokensFile}`);
+            }
+            catch (err) {
+                console.error(`[specky] FATAL: ${err.message}`);
+                process.exit(1);
+            }
+        }
+        else if (authToken) {
+            console.error("[specky] HTTP bearer-token authentication enabled (shared token).");
         }
+        const requireAuth = tokenTable.length > 0 || authToken.length > 0;
         if (!isLoopback && !requireAuth) {
             console.error(`[specky] WARNING: HTTP transport bound to non-loopback host "${host}" WITHOUT authentication. ` +
-                "Set SDD_HTTP_TOKEN and put it behind a TLS-terminating reverse proxy, or bind to 127.0.0.1.");
+                "Set SDD_HTTP_TOKEN or SDD_HTTP_TOKENS_FILE and put it behind a TLS-terminating reverse proxy, or bind to 127.0.0.1.");
+        }
+        if (config.profile === "enterprise" && config.rbac.enabled && tokenTable.length === 0) {
+            console.error("[specky] NOTE: RBAC is on but no SDD_HTTP_TOKENS_FILE is configured — roles come from " +
+                "SDD_ROLE/default_role (self-asserted). Configure a token table for identity-based roles.");
         }
-        const isAuthorized = (header) => isBearerAuthorized(header, authToken);
         const { StreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/streamableHttp.js");
         const http = await import("node:http");
         const transport = new StreamableHTTPServerTransport({
@@ -206,7 +243,8 @@ async function main() {
         const httpServer = http.createServer(async (req, res) => {
             if (req.url === "/mcp") {
                 // Authenticate before doing any work.
-                if (!isAuthorized(req.headers["authorization"])) {
+                const identity = resolveBearerIdentity(req.headers["authorization"], tokenTable, authToken);
+                if (!identity.authorized) {
                     res.writeHead(401, {
                         "Content-Type": "application/json",
                         "WWW-Authenticate": "Bearer",
@@ -214,6 +252,17 @@ async function main() {
                     res.end(JSON.stringify({ error: "Unauthorized" }));
                     return;
                 }
+                // Attach the authenticated identity so the transport propagates it to
+                // tool handlers as extra.authInfo (consumed by the RBAC enforcement
+                // wrapper). `token` carries a fingerprint, never the secret itself.
+                if (identity.principal) {
+                    req.auth = {
+                        token: sha256Hex(req.headers["authorization"] ?? ""),
+                        clientId: identity.principal,
+                        scopes: identity.role ? [`role:${identity.role}`] : [],
+                        extra: { principal: identity.principal, role: identity.role },
+                    };
+                }
                 // Apply rate limiting before forwarding to MCP handler
                 if (rateLimiter) {
                     const clientId = req.socket.remoteAddress ?? "unknown";