specky-sdd 3.4.0 → 3.5.0

package/dist/tools/tool-enforcement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-enforcement.d.ts","sourceRoot":"","sources":["../../src/tools/tool-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAiB,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AASjE,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,CAAC;CACf;AA+BD,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIhD;AAqJD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CASN"}
+{"version":3,"file":"tool-enforcement.d.ts","sourceRoot":"","sources":["../../src/tools/tool-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AASjE,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,CAAC;CACf;AAWD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAuBD,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIhD;AAwBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,CAajE;AAqLD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CASN"}

package/dist/tools/tool-enforcement.js

@@ -37,11 +37,40 @@ function getToolInput(args) {
     const firstArg = args[0];
     return isRecord(firstArg) ? firstArg : {};
 }
-function getActiveRole(rbacEngine) {
+function isRbacRole(value) {
+    return value === "viewer" || value === "contributor" || value === "admin";
+}
+/**
+ * Extract the authenticated identity from the MCP request extra (second
+ * handler argument). The HTTP transport propagates `req.auth` as
+ * `extra.authInfo`; the principal/role live in `authInfo.extra`.
+ */
+export function getCallerIdentity(args) {
+    const extra = args[1];
+    if (!isRecord(extra) || !isRecord(extra["authInfo"]))
+        return {};
+    const authInfo = extra["authInfo"];
+    const authExtra = isRecord(authInfo["extra"]) ? authInfo["extra"] : {};
+    const principal = typeof authExtra["principal"] === "string" && authExtra["principal"]
+        ? authExtra["principal"]
+        : typeof authInfo["clientId"] === "string" && authInfo["clientId"]
+            ? authInfo["clientId"]
+            : undefined;
+    const role = isRbacRole(authExtra["role"]) ? authExtra["role"] : undefined;
+    return { principal, role };
+}
+/**
+ * Role precedence: authenticated identity (token table) > SDD_ROLE env
+ * (local/stdio convenience — the launcher owns the process anyway) > config
+ * default_role. When a request carries an authenticated identity, the env var
+ * is deliberately ignored: a remote caller must not out-vote its token.
+ */
+function getActiveRole(rbacEngine, identity) {
+    if (identity.role)
+        return identity.role;
     const envRole = process.env["SDD_ROLE"];
-    if (envRole === "viewer" || envRole === "contributor" || envRole === "admin") {
+    if (isRbacRole(envRole))
         return envRole;
-    }
     return rbacEngine.roleDefault;
 }
 function buildDeniedResponse(payload) {
@@ -58,6 +87,7 @@ async function auditStart(auditLogger, context, phase) {
         feature_number: context.featureNumber,
         phase,
         role: context.activeRole,
+        principal: context.principal,
         result: "success",
         summary: "Execution started",
         input_hash: context.inputHash,
@@ -72,6 +102,7 @@ async function auditSuccess(auditLogger, context, output, phase) {
         feature_number: context.featureNumber,
         phase,
         role: context.activeRole,
+        principal: context.principal,
         result: "success",
         summary: "Execution completed",
         input_hash: context.inputHash,
@@ -87,38 +118,56 @@ async function auditError(auditLogger, context, summary, phase) {
         feature_number: context.featureNumber,
         phase,
         role: context.activeRole,
+        principal: context.principal,
         result: "error",
         summary,
         input_hash: context.inputHash,
         previous_hash: auditLogger.currentHash,
     });
 }
+/**
+ * Post-execution audit failures cannot un-run the tool; even in fail-closed
+ * mode the result is returned and the failure is surfaced on stderr. Only the
+ * pre-execution entry gates execution.
+ */
+async function auditBestEffort(write, toolName) {
+    try {
+        await write;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`[specky] Post-execution audit write failed for ${toolName}: ${message}`);
+    }
+}
 function wrapToolHandler(toolName, handler, options) {
     return async (...args) => {
         const input = getToolInput(args);
         const specDir = getSpecDir(input);
-        const activeRole = getActiveRole(options.rbacEngine);
+        const identity = getCallerIdentity(args);
+        const activeRole = getActiveRole(options.rbacEngine, identity);
         const context = {
             toolName,
             specDir,
             featureNumber: getFeatureNumber(input),
             activeRole,
+            principal: identity.principal,
             inputHash: hashValue(input),
         };
         const rbac = options.rbacEngine.checkAccess(activeRole, toolName);
         if (!rbac.allowed) {
-            await auditError(options.auditLogger, context, rbac.reason ?? "RBAC access denied");
+            await auditBestEffort(auditError(options.auditLogger, context, rbac.reason ?? "RBAC access denied"), toolName);
             return buildDeniedResponse({
                 error: "access_denied",
                 tool: toolName,
                 active_role: activeRole,
+                ...(identity.principal ? { principal: identity.principal } : {}),
                 message: rbac.reason ?? `Role ${activeRole} cannot invoke ${toolName}.`,
             });
         }
         const phaseCheck = await options.stateMachine.validatePhaseForTool(specDir, toolName);
         if (!phaseCheck.allowed) {
             const message = phaseCheck.error_message ?? `Tool ${toolName} is not allowed in phase ${phaseCheck.current_phase}.`;
-            await auditError(options.auditLogger, context, message, phaseCheck.current_phase);
+            await auditBestEffort(auditError(options.auditLogger, context, message, phaseCheck.current_phase), toolName);
             return buildDeniedResponse({
                 error: "phase_validation_failed",
                 tool: toolName,
@@ -127,15 +176,27 @@ function wrapToolHandler(toolName, handler, options) {
                 message,
             });
         }
-        await auditStart(options.auditLogger, context, phaseCheck.current_phase);
+        // Fail-closed gate: if the pre-execution audit entry cannot be written,
+        // the tool does not run (no unaudited actions in enterprise mode).
+        try {
+            await auditStart(options.auditLogger, context, phaseCheck.current_phase);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return buildDeniedResponse({
+                error: "audit_unavailable",
+                tool: toolName,
+                message: `Refusing to execute: the audit trail could not be written and audit.fail_closed is on. (${message})`,
+            });
+        }
         try {
             const result = await handler(...args);
-            await auditSuccess(options.auditLogger, context, result, phaseCheck.current_phase);
+            await auditBestEffort(auditSuccess(options.auditLogger, context, result, phaseCheck.current_phase), toolName);
             return result;
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            await auditError(options.auditLogger, context, message, phaseCheck.current_phase);
+            await auditBestEffort(auditError(options.auditLogger, context, message, phaseCheck.current_phase), toolName);
             throw error;
         }
     };

package/dist/tools/tool-enforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-enforcement.js","sourceRoot":"","sources":["../../src/tools/tool-enforcement.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA+BnD,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAE5E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aACtB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aAClC,MAAM,CAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;SAC/C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,gBAAgB,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgB;IACxC,OAAO,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,IAAe;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,UAAsB;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAwB,EACxB,OAA6B,EAC7B,KAAc;IAEd,MAAM,WAAW,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,KAAK;QACL,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,mBAAmB;QAC5B,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,aAAa,EAAE,WAAW,CAAC,WAAW;KACvC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,WAAwB,EACxB,OAA6B,EAC7B,MAAe,EACf,KAAc;IAEd,MAAM,WAAW,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,KAAK;QACL,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC;QAC9B,aAAa,EAAE,WAAW,CAAC,WAAW;KACvC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAwB,EACxB,OAA6B,EAC7B,OAAe,EACf,KAAc;IAEd,MAAM,WAAW,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,KAAK;QACL,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,MAAM,EAAE,OAAO;QACf,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,aAAa,EAAE,WAAW,CAAC,WAAW;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,OAAoB,EACpB,OAA+B;IAE/B,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,GAAyB;YACpC,QAAQ;YACR,OAAO;YACP,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC;YACtC,UAAU;YACV,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC;QAEF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;YACpF,OAAO,mBAAmB,CAAC;gBACzB,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,UAAU;gBACvB,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ,UAAU,kBAAkB,QAAQ,GAAG;aACxE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,IAAI,QAAQ,QAAQ,4BAA4B,UAAU,CAAC,aAAa,GAAG,CAAC;YACpH,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YAClF,OAAO,mBAAmB,CAAC;gBACzB,KAAK,EAAE,yBAAyB;gBAChC,IAAI,EAAE,QAAQ;gBACd,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACtC,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YACnF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YAClF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiB,EACjB,OAA+B;IAE/B,MAAM,MAAM,GAAG,MAA+E,CAAC;IAC/F,IAAI,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO;IAE1C,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,YAAY,GAAG,CAAC,IAAY,EAAE,MAAe,EAAE,OAAoB,EAAE,EAAE;QAC5E,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC;IACF,MAAM,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC;AACvC,CAAC"}
+{"version":3,"file":"tool-enforcement.js","sourceRoot":"","sources":["../../src/tools/tool-enforcement.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAyCnD,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAE5E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aACtB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aAClC,MAAM,CAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;SAC/C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,gBAAgB,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgB;IACxC,OAAO,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,IAAe;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,OAAO,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,SAAS,GACb,OAAO,SAAS,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,WAAW,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC;QACxB,CAAC,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC;YAChE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,UAAsB,EAAE,QAAwB;IACrE,IAAI,QAAQ,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,UAAU,CAAC,WAAW,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAwB,EACxB,OAA6B,EAC7B,KAAc;IAEd,MAAM,WAAW,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,KAAK;QACL,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,mBAAmB;QAC5B,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,aAAa,EAAE,WAAW,CAAC,WAAW;KACvC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,WAAwB,EACxB,OAA6B,EAC7B,MAAe,EACf,KAAc;IAEd,MAAM,WAAW,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,KAAK;QACL,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC;QAC9B,aAAa,EAAE,WAAW,CAAC,WAAW;KACvC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAwB,EACxB,OAA6B,EAC7B,OAAe,EACf,KAAc;IAEd,MAAM,WAAW,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,KAAK;QACL,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO;QACf,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,aAAa,EAAE,WAAW,CAAC,WAAW;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,KAAoB,EAAE,QAAgB;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,kDAAkD,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,OAAoB,EACpB,OAA+B;IAE/B,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAyB;YACpC,QAAQ;YACR,OAAO;YACP,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC;YACtC,UAAU;YACV,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC;QAEF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,eAAe,CACnB,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,EAC7E,QAAQ,CACT,CAAC;YACF,OAAO,mBAAmB,CAAC;gBACzB,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,UAAU;gBACvB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ,UAAU,kBAAkB,QAAQ,GAAG;aACxE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,IAAI,QAAQ,QAAQ,4BAA4B,UAAU,CAAC,aAAa,GAAG,CAAC;YACpH,MAAM,eAAe,CACnB,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,EAC3E,QAAQ,CACT,CAAC;YACF,OAAO,mBAAmB,CAAC;gBACzB,KAAK,EAAE,yBAAyB;gBAChC,IAAI,EAAE,QAAQ;gBACd,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,mBAAmB,CAAC;gBACzB,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2FAA2F,OAAO,GAAG;aACxG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACtC,MAAM,eAAe,CACnB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAC5E,QAAQ,CACT,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,eAAe,CACnB,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,EAC3E,QAAQ,CACT,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiB,EACjB,OAA+B;IAE/B,MAAM,MAAM,GAAG,MAA+E,CAAC;IAC/F,IAAI,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO;IAE1C,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,YAAY,GAAG,CAAC,IAAY,EAAE,MAAe,EAAE,OAAoB,EAAE,EAAE;QAC5E,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC;IACF,MAAM,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC;AACvC,CAAC"}

package/dist/utils/token-table.d.ts

@@ -0,0 +1,41 @@
+import { z } from "zod";
+import type { RbacRole } from "../services/rbac-engine.js";
+declare const tokenEntrySchema: z.ZodObject<{
+    principal: z.ZodString;
+    role: z.ZodEnum<{
+        viewer: "viewer";
+        contributor: "contributor";
+        admin: "admin";
+    }>;
+    token: z.ZodOptional<z.ZodString>;
+    token_sha256: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type TokenTableEntry = z.infer<typeof tokenEntrySchema>;
+export interface BearerIdentity {
+    authorized: boolean;
+    /** Set when the token table matched a named token. */
+    principal?: string;
+    /** Set when the token table matched a named token. */
+    role?: RbacRole;
+}
+/**
+ * Load and validate the tokens file. Throws on any problem — the caller must
+ * treat a configured-but-broken tokens file as fatal (fail-closed).
+ */
+export declare function loadTokenTable(filePath: string): TokenTableEntry[];
+export declare function sha256Hex(value: string): string;
+/**
+ * Resolve the identity behind an Authorization header.
+ *
+ * - Token table configured → the presented token must match a named entry;
+ *   returns its principal + role. The shared token is ignored in this mode
+ *   (named identities only).
+ * - Only SDD_HTTP_TOKEN configured → legacy single shared token; authorized
+ *   requests get principal "shared-token" and no role (RBAC falls back to
+ *   SDD_ROLE / default_role).
+ * - Neither configured → authorized (auth disabled; loopback bind is the
+ *   remaining guard).
+ */
+export declare function resolveBearerIdentity(authorizationHeader: string | undefined, table: readonly TokenTableEntry[], sharedToken: string): BearerIdentity;
+export {};
+//# sourceMappingURL=token-table.d.ts.map

package/dist/utils/token-table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-table.d.ts","sourceRoot":"","sources":["../../src/utils/token-table.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAG3D,QAAA,MAAM,gBAAgB;;;;;;;;;kBAalB,CAAC;AAQL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE,CAYlE;AAQD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,WAAW,EAAE,MAAM,GAClB,cAAc,CAuBhB"}

package/dist/utils/token-table.js

@@ -0,0 +1,103 @@
+/**
+ * token-table.ts — named bearer tokens for the HTTP transport.
+ *
+ * Enterprise deployments map each token to an authenticated principal and an
+ * RBAC role via a YAML file referenced by SDD_HTTP_TOKENS_FILE. The file must
+ * live OUTSIDE the workspace (e.g. /etc/specky/tokens.yml, mode 0600) — the
+ * whole point is that workspace writers cannot mint themselves a role.
+ *
+ *   tokens:
+ *     - principal: alice
+ *       role: admin
+ *       token_sha256: "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
+ *     - principal: ci-bot
+ *       role: viewer
+ *       token: "plaintext-also-works"   # sha256 form is recommended
+ *
+ * Loading is fail-closed: a configured file that is missing or malformed
+ * throws, so the server refuses to start with broken auth instead of silently
+ * accepting everyone.
+ */
+import { readFileSync } from "node:fs";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { parse } from "yaml";
+import { z } from "zod";
+import { isBearerAuthorized } from "./http-auth.js";
+const tokenEntrySchema = z
+    .object({
+    principal: z.string().min(1),
+    role: z.enum(["viewer", "contributor", "admin"]),
+    token: z.string().min(8).optional(),
+    token_sha256: z
+        .string()
+        .regex(/^[0-9a-fA-F]{64}$/, "token_sha256 must be a 64-char hex SHA-256")
+        .optional(),
+})
+    .strict()
+    .refine((e) => Boolean(e.token) !== Boolean(e.token_sha256), {
+    message: "each token entry needs exactly one of `token` or `token_sha256`",
+});
+const tokenTableSchema = z
+    .object({
+    tokens: z.array(tokenEntrySchema).min(1),
+})
+    .strict();
+/**
+ * Load and validate the tokens file. Throws on any problem — the caller must
+ * treat a configured-but-broken tokens file as fatal (fail-closed).
+ */
+export function loadTokenTable(filePath) {
+    const raw = readFileSync(filePath, "utf-8");
+    const parsed = parse(raw) ?? {};
+    const result = tokenTableSchema.safeParse(parsed);
+    if (!result.success) {
+        throw new Error(`Invalid tokens file ${filePath}: ${result.error.issues
+            .map((i) => (i.path.length ? `${i.path.join(".")}: ${i.message}` : i.message))
+            .join("; ")}`);
+    }
+    return result.data.tokens;
+}
+function constantTimeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    return bufA.length === bufB.length && timingSafeEqual(bufA, bufB);
+}
+export function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+/**
+ * Resolve the identity behind an Authorization header.
+ *
+ * - Token table configured → the presented token must match a named entry;
+ *   returns its principal + role. The shared token is ignored in this mode
+ *   (named identities only).
+ * - Only SDD_HTTP_TOKEN configured → legacy single shared token; authorized
+ *   requests get principal "shared-token" and no role (RBAC falls back to
+ *   SDD_ROLE / default_role).
+ * - Neither configured → authorized (auth disabled; loopback bind is the
+ *   remaining guard).
+ */
+export function resolveBearerIdentity(authorizationHeader, table, sharedToken) {
+    if (table.length === 0) {
+        return { authorized: isBearerAuthorized(authorizationHeader, sharedToken) };
+    }
+    const prefix = "Bearer ";
+    if (!authorizationHeader || !authorizationHeader.startsWith(prefix)) {
+        return { authorized: false };
+    }
+    const presented = authorizationHeader.slice(prefix.length);
+    const presentedSha = sha256Hex(presented);
+    // Evaluate every entry (no early exit) to keep timing independent of match position.
+    let matched;
+    for (const entry of table) {
+        const hit = entry.token_sha256
+            ? constantTimeEqual(presentedSha, entry.token_sha256.toLowerCase())
+            : constantTimeEqual(presented, entry.token ?? "");
+        if (hit && !matched)
+            matched = entry;
+    }
+    if (!matched)
+        return { authorized: false };
+    return { authorized: true, principal: matched.principal, role: matched.role };
+}
+//# sourceMappingURL=token-table.js.map

package/dist/utils/token-table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-table.js","sourceRoot":"","sources":["../../src/utils/token-table.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;SACxE,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;IAC3D,OAAO,EAAE,iEAAiE;CAC3E,CAAC,CAAC;AAEL,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAYZ;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAY,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;aACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;aAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,mBAAuC,EACvC,KAAiC,EACjC,WAAmB;IAEnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,mBAAmB,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAE1C,qFAAqF;IACrF,IAAI,OAAoC,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY;YAC5B,CAAC,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACnE,CAAC,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,KAAK,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC3C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAChF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specky-sdd",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Specky — Spec-Driven Development CLI toolkit. 58 MCP tools, 13 agents, 22 prompts, 8 skills, 16 hooks. Unified `specky` CLI installs to Claude Code or GitHub Copilot on macOS, Linux, and Windows.",
   "type": "module",
   "main": "dist/index.js",