@askexenow/exe-os 0.9.303 → 0.9.310

package/dist/chunk-7ODTYODO.js

@@ -0,0 +1,350 @@
+// src/lib/preflight-checks.ts
+import { readFileSync, existsSync } from "fs";
+import path from "path";
+var REQUIRED_INFRA = {
+  postgres: ["exe-db", "postgres", "db", "exe-db-jkt"],
+  redis: ["redis"],
+  clickhouse: ["clickhouse"],
+  "exe-sso-edge": ["exe-sso-edge", "sso-edge"],
+  cloudflared: ["cloudflared"]
+};
+var FORBIDDEN_HOST_SUBSTRINGS = ["askexe.com", "askexenow.com"];
+var CLIENT_FACING_HOST_FIELDS = ["healthHost", "healthUrl"];
+var BYOK_ENFORCEMENT_VARS = ["EXE_ALLOW_DIRECT_PROVIDER_KEYS", "EXE_BILLING_MODE"];
+var BYOK_LEGACY_VARS = ["BYOK_ENABLED"];
+function resolveDefaultManifest() {
+  let dir = path.dirname(new URL(import.meta.url).pathname);
+  for (let i = 0; i < 6; i++) {
+    const candidate = path.join(dir, "deploy", "stack-manifests", "v0.9.json");
+    if (existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return path.join(process.cwd(), "deploy", "stack-manifests", "v0.9.json");
+}
+function parseImageRef(image) {
+  const hasDigest = /@sha256:[0-9a-f]{64}/i.test(image);
+  const withoutDigest = image.replace(/@sha256:[0-9a-f]{64}/i, "");
+  const lastSlash = withoutDigest.lastIndexOf("/");
+  const namePart = lastSlash >= 0 ? withoutDigest.slice(lastSlash + 1) : withoutDigest;
+  const colonIdx = namePart.indexOf(":");
+  const hasTag = colonIdx >= 0;
+  const tag = hasTag ? namePart.slice(colonIdx + 1) : "";
+  return { hasDigest, hasTag, tag };
+}
+function loadEnvLikeFile(filePath) {
+  const vars = /* @__PURE__ */ new Set();
+  if (!filePath || !existsSync(filePath)) return { vars, exists: false };
+  const raw = readFileSync(filePath, "utf8");
+  for (const line of raw.split("\n")) {
+    const m = line.match(/^\s*#?\s*([A-Z][A-Z0-9_]+)\s*=/);
+    if (m) vars.add(m[1]);
+  }
+  return { vars, exists: true };
+}
+function readComposeText(composePath) {
+  if (!composePath || !existsSync(composePath)) return { text: "", exists: false };
+  return { text: readFileSync(composePath, "utf8"), exists: true };
+}
+function resolveStack(manifest, requested) {
+  if (manifest.services && !manifest.stacks) {
+    return { version: manifest.version ?? "(single)", services: manifest.services };
+  }
+  if (!manifest.stacks) return { version: "(none)", services: {} };
+  const version = requested ?? manifest.latest ?? Object.keys(manifest.stacks).sort().pop() ?? "";
+  const entry = manifest.stacks[version];
+  return { version, services: entry?.services ?? {} };
+}
+function checkDigestPinning(services) {
+  const bug = "ee16e7ef (digest-pinning)";
+  const offenders = [];
+  for (const [name, svc] of Object.entries(services)) {
+    if (!svc.image) continue;
+    const { hasDigest } = parseImageRef(svc.image);
+    if (!hasDigest) offenders.push(`${name}=${svc.image}`);
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "digest-pinning",
+      status: "fail",
+      bug,
+      offenders,
+      message: `${offenders.length} image(s) tag-pinned WITHOUT @sha256 digest (release claims digest-pinning): ${offenders.join(", ")}`
+    };
+  }
+  return { check: "digest-pinning", status: "pass", bug, message: "all images @sha256 digest-pinned" };
+}
+function checkNoLatest(services) {
+  const bug = "monitor :latest / no-:latest";
+  const offenders = [];
+  for (const [name, svc] of Object.entries(services)) {
+    if (!svc.image) continue;
+    const { hasDigest, hasTag, tag } = parseImageRef(svc.image);
+    if (tag === "latest") offenders.push(`${name}=${svc.image}`);
+    else if (!hasTag && !hasDigest) offenders.push(`${name}=${svc.image} (untagged \u2192 implicit :latest)`);
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "no-latest",
+      status: "fail",
+      bug,
+      offenders,
+      message: `${offenders.length} image(s) use :latest / are untagged: ${offenders.join(", ")}`
+    };
+  }
+  return { check: "no-latest", status: "pass", bug, message: "no :latest / untagged images" };
+}
+function checkDependencyClosure(services) {
+  const bug = "4948fc48 (dependency-closure)";
+  const present = /* @__PURE__ */ new Set();
+  for (const [name, svc] of Object.entries(services)) {
+    present.add(name);
+    if (svc.composeService) present.add(svc.composeService);
+  }
+  const missing = [];
+  for (const [canonical, aliases] of Object.entries(REQUIRED_INFRA)) {
+    if (!aliases.some((a) => present.has(a))) missing.push(canonical);
+  }
+  if (missing.length > 0) {
+    return {
+      check: "dependency-closure",
+      status: "fail",
+      bug,
+      offenders: missing,
+      message: `manifest missing required infra dependency closure \u2014 selected/fresh installs would skip: ${missing.join(", ")}`
+    };
+  }
+  return { check: "dependency-closure", status: "pass", bug, message: `all required infra present (${Object.keys(REQUIRED_INFRA).join(", ")})` };
+}
+function checkNoHardcodedHost(services) {
+  const bug = "ERP white-label-leak (no-hardcoded-askexe-host)";
+  const offenders = [];
+  for (const [name, svc] of Object.entries(services)) {
+    for (const field of CLIENT_FACING_HOST_FIELDS) {
+      const val = svc[field];
+      if (typeof val !== "string") continue;
+      const hit = FORBIDDEN_HOST_SUBSTRINGS.find((h) => val.includes(h));
+      if (hit) offenders.push(`${name}.${field}=${val}`);
+    }
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "no-hardcoded-askexe-host",
+      status: "fail",
+      bug,
+      offenders,
+      message: `client-facing field(s) hardcode an AskExe host (white-label leak): ${offenders.join(", ")}`
+    };
+  }
+  return { check: "no-hardcoded-askexe-host", status: "pass", bug, message: "no hardcoded AskExe hosts in client-facing fields" };
+}
+function checkEnvContract(env, compose) {
+  const bug = "BYOK env-contract-mismatch";
+  if (!env.exists && !compose.exists) {
+    return {
+      check: "env-contract",
+      status: "warn",
+      bug,
+      message: "env example + compose not provided \u2014 BYOK enforcement contract not verified (pass --env / --compose to enforce)"
+    };
+  }
+  const declared = new Set(env.vars);
+  if (compose.exists) {
+    for (const m of compose.text.matchAll(/\$\{?([A-Z][A-Z0-9_]+)/g)) declared.add(m[1]);
+  }
+  const missingEnforcement = BYOK_ENFORCEMENT_VARS.filter((v) => !declared.has(v));
+  const exposedLegacy = BYOK_LEGACY_VARS.filter((v) => declared.has(v));
+  if (missingEnforcement.length > 0 && exposedLegacy.length > 0) {
+    return {
+      check: "env-contract",
+      status: "fail",
+      bug,
+      offenders: [...exposedLegacy.map((v) => `exposes ${v}`), ...missingEnforcement.map((v) => `missing ${v}`)],
+      message: `BYOK env-contract mismatch \u2014 customer surface exposes ${exposedLegacy.join("/")} but billing enforcement reads ${BYOK_ENFORCEMENT_VARS.join("+")} (absent). BYOK can bypass billing.`
+    };
+  }
+  if (missingEnforcement.length > 0) {
+    return {
+      check: "env-contract",
+      status: "warn",
+      bug,
+      offenders: missingEnforcement.map((v) => `missing ${v}`),
+      message: `billing enforcement vars not declared: ${missingEnforcement.join(", ")}`
+    };
+  }
+  return { check: "env-contract", status: "pass", bug, message: `BYOK enforcement vars present (${BYOK_ENFORCEMENT_VARS.join(", ")})` };
+}
+function checkNoHostNet(composeTexts) {
+  const bug = "monitor host-networking (no-host-net)";
+  const available = composeTexts.filter((c) => c.exists);
+  if (available.length === 0) {
+    return {
+      check: "no-host-net",
+      status: "warn",
+      bug,
+      message: "no compose file provided \u2014 host-networking not verified (pass --compose / --monitor-compose to enforce)"
+    };
+  }
+  const HOST_NET = /^\s*network_mode\s*:\s*["']?host["']?\s*$/;
+  const HOST_NET_FLAG = /--network(?:=|\s+)["']?host["']?/;
+  const offenders = [];
+  for (const compose of available) {
+    const lines = compose.text.split("\n");
+    let currentService = null;
+    let serviceIndent = -1;
+    for (const rawLine of lines) {
+      const line = rawLine.replace(/\r$/, "");
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const indent = line.match(/^(\s*)/)?.[1]?.length ?? 0;
+      const headerMatch = line.match(/^(\s+)([A-Za-z0-9._-]+):\s*$/);
+      if (headerMatch && (currentService === null || indent <= serviceIndent)) {
+        currentService = headerMatch[2];
+        serviceIndent = headerMatch[1].length;
+      }
+      if (HOST_NET.test(line) || HOST_NET_FLAG.test(line)) {
+        const where = currentService ? `${compose.label}:${currentService}` : compose.label;
+        offenders.push(`${where} (${trimmed})`);
+      }
+    }
+  }
+  if (offenders.length > 0) {
+    return {
+      check: "no-host-net",
+      status: "fail",
+      bug,
+      offenders,
+      message: `compose service(s) use host networking (network_mode: host) \u2014 bypasses Docker isolation + SSO edge: ${offenders.join(", ")}`
+    };
+  }
+  return { check: "no-host-net", status: "pass", bug, message: "no host networking (network_mode: host) in compose" };
+}
+function runChecks(services, env, compose, monitorCompose, customerComposeLabel) {
+  return [
+    checkDigestPinning(services),
+    checkNoLatest(services),
+    checkDependencyClosure(services),
+    checkNoHardcodedHost(services),
+    checkEnvContract(env, compose),
+    checkNoHostNet([
+      { label: customerComposeLabel, text: compose.text, exists: compose.exists },
+      monitorCompose
+    ])
+  ];
+}
+function tally(findings) {
+  const passed = findings.filter((f) => f.status === "pass").length;
+  const warned = findings.filter((f) => f.status === "warn").length;
+  const failed = findings.filter((f) => f.status === "fail").length;
+  const verdict = failed > 0 ? "RED" : warned > 0 ? "YELLOW" : "GREEN";
+  return { verdict, passed, warned, failed };
+}
+function runPreflight(options) {
+  const manifestPath = options?.manifestPath ?? resolveDefaultManifest();
+  if (!existsSync(manifestPath)) {
+    return {
+      verdict: "RED",
+      manifestPath,
+      stackVersion: "(missing)",
+      findings: [{ check: "manifest-load", status: "fail", bug: "preflight", message: `manifest not found: ${manifestPath}` }],
+      passed: 0,
+      warned: 0,
+      failed: 1
+    };
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (err) {
+    return {
+      verdict: "RED",
+      manifestPath,
+      stackVersion: "(parse-error)",
+      findings: [{ check: "manifest-load", status: "fail", bug: "preflight", message: `manifest parse error: ${err instanceof Error ? err.message : String(err)}` }],
+      passed: 0,
+      warned: 0,
+      failed: 1
+    };
+  }
+  const { version, services } = resolveStack(manifest, options?.stackVersion);
+  const repoRoot = path.resolve(path.dirname(manifestPath), "..", "..");
+  const envExamplePath = options?.envExamplePath ?? path.join(repoRoot, "deploy", "compose", ".env.example");
+  const composePath = options?.composePath ?? path.join(repoRoot, "deploy", "compose", "docker-compose.yml");
+  const monitorComposePath = options?.monitorComposePath ?? path.join(repoRoot, "deploy", "monitor", "docker-compose.hub.yml");
+  const env = loadEnvLikeFile(envExamplePath);
+  const compose = readComposeText(composePath);
+  const monitorComposeRead = readComposeText(monitorComposePath);
+  const monitorCompose = { label: "monitor-compose", text: monitorComposeRead.text, exists: monitorComposeRead.exists };
+  const findings = runChecks(services, env, compose, monitorCompose, "customer-compose");
+  const { verdict, passed, warned, failed } = tally(findings);
+  return { verdict, manifestPath, stackVersion: version, findings, passed, warned, failed };
+}
+function runPreflightOnManifest(input) {
+  const label = input.label ?? "(in-memory manifest)";
+  const { version, services } = resolveStack(input.manifest, input.stackVersion);
+  const env = loadEnvLikeFile(input.envExamplePath);
+  const compose = readComposeText(input.composePath);
+  const monitorComposeRead = readComposeText(input.monitorComposePath);
+  const monitorCompose = { label: "monitor-compose", text: monitorComposeRead.text, exists: monitorComposeRead.exists };
+  const findings = runChecks(services, env, compose, monitorCompose, "customer-compose");
+  const { verdict, passed, warned, failed } = tally(findings);
+  return { verdict, manifestPath: label, stackVersion: version, findings, passed, warned, failed };
+}
+var ICONS = { pass: "\u{1F7E2}", warn: "\u{1F7E0}", fail: "\u{1F534}" };
+function formatPreflightFindings(report, all = false) {
+  const lines = [];
+  for (const f of report.findings) {
+    if (!all && f.status === "pass") continue;
+    lines.push(`  ${ICONS[f.status]} ${f.check} [guards ${f.bug}]: ${f.message}`);
+  }
+  return lines.join("\n");
+}
+function isPreflightOverrideEnabled(env = process.env) {
+  return /^(1|true|yes|on)$/i.test((env.EXE_PREFLIGHT_OVERRIDE ?? "").trim());
+}
+function assertPreflightGate(report, options = {}) {
+  const ctx = options.context ? `[${options.context}] ` : "";
+  const log = options.log ?? ((m) => console.log(m));
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const override = options.allowRed === true || isPreflightOverrideEnabled();
+  if (report.verdict === "GREEN") {
+    log(`${ctx}\u{1F7E2} preflight GREEN (pass ${report.passed} / warn ${report.warned} / fail ${report.failed}) \u2014 stack ${report.stackVersion}`);
+    return report;
+  }
+  if (report.verdict === "YELLOW") {
+    warn(`${ctx}\u{1F7E0} preflight YELLOW (${report.warned} warning(s)) \u2014 stack ${report.stackVersion}. Proceeding; warnings are non-blocking:`);
+    warn(formatPreflightFindings(report));
+    return report;
+  }
+  const findings = formatPreflightFindings(report);
+  if (override) {
+    warn(`${ctx}\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557`);
+    warn(`${ctx}\u2551  \u26A0\uFE0F  BREAK-GLASS: preflight is RED but override is engaged       \u2551`);
+    warn(`${ctx}\u2551  A RED manifest is shipping INTENTIONALLY. This is logged.       \u2551`);
+    warn(`${ctx}\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D`);
+    warn(`${ctx}RED findings (overridden):
+${findings}`);
+    warn(`${ctx}Override via: ${options.allowRed === true ? "--allow-red flag" : "EXE_PREFLIGHT_OVERRIDE env"}. Remediate the manifest immediately after.`);
+    return report;
+  }
+  throw new Error(
+    `${ctx}Preflight gate FAILED (RED) \u2014 stack ${report.stackVersion}. Company procedure: no manifest published or stack-update applied until preflight is GREEN.
+${findings}
+Break-glass: re-run with --allow-red or EXE_PREFLIGHT_OVERRIDE=1 to ship a RED manifest intentionally (LOUDLY logged).`
+  );
+}
+
+export {
+  resolveDefaultManifest,
+  resolveStack,
+  checkDigestPinning,
+  checkNoLatest,
+  checkDependencyClosure,
+  checkNoHardcodedHost,
+  checkEnvContract,
+  checkNoHostNet,
+  runPreflight,
+  runPreflightOnManifest,
+  assertPreflightGate
+};

package/dist/{chunk-YLAYKXX3.js → chunk-7WDIGRSO.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-YH2IYVPW.js";
+} from "./chunk-AE74NOE6.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-CTUQZ7LF.js → chunk-AC6DKMVS.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-ERAHOO7R.js";
+} from "./chunk-2NS3QRMJ.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-2DDRLHWF.js → chunk-B2J3BBJC.js}

@@ -7,14 +7,14 @@ import {
 } from "./chunk-PROQW3NL.js";
 import {
   vectorToBlob
-} from "./chunk-X37ENEN5.js";
+} from "./chunk-WBJXJ2R4.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-N5G4T47B.js";
+} from "./chunk-SCYWCWKY.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-HU5SQUZX.js → chunk-BUOMSIXH.js}

@@ -9,7 +9,7 @@ import {
   getCoordinatorEmployee,
   getEmployee,
   loadEmployeesSync
-} from "./chunk-N5G4T47B.js";
+} from "./chunk-SCYWCWKY.js";
 import {
   EXE_AI_DIR
 } from "./chunk-DFIOOK5R.js";

package/dist/{chunk-PY6RG2DV.js → chunk-DFUCFLZH.js}

@@ -1,6 +1,6 @@
 import {
   listBehaviors
-} from "./chunk-CCYRCRLW.js";
+} from "./chunk-PMEOSD6S.js";
 import {
   loadConfigSync
 } from "./chunk-DFIOOK5R.js";

package/dist/{chunk-PNYUSBLA.js → chunk-DKHBMIVE.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-UN6KSHLI.js";
+} from "./chunk-JV225JBX.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";

package/dist/{chunk-4VHQ6QQ3.js → chunk-DNFU56ZS.js}

@@ -6,7 +6,7 @@ import {
   connectEmbedDaemon,
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-JBWYZAQE.js";
+} from "./chunk-PPXQE7AS.js";
 
 // src/lib/db-daemon-client.ts
 function normalizeStatement(stmt) {

package/dist/{chunk-PRU6NRJY.js → chunk-EOS7VPVT.js}

@@ -2,7 +2,7 @@ import {
   dispatchTaskToEmployee,
   markTaskNotificationsRead,
   notifyTaskDone
-} from "./chunk-OVQDDRGZ.js";
+} from "./chunk-TN2YCFQE.js";
 import {
   cleanupReviewFile,
   createTaskCore,
@@ -11,7 +11,7 @@ import {
   sessionScopeFilter,
   updateTaskStatus,
   writeNotification
-} from "./chunk-FMJ4D5G6.js";
+} from "./chunk-HED6D5KR.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -19,7 +19,7 @@ import {
   getClient,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-N5G4T47B.js";
+} from "./chunk-SCYWCWKY.js";
 import {
   EXE_AI_DIR
 } from "./chunk-DFIOOK5R.js";
@@ -61,7 +61,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
   }
   if (unblockedRows.rows.length > 0 && !process.env.VITEST) {
     try {
-      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-3W3YIVF4.js");
+      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-LAIU7UUI.js");
       const dispatched = /* @__PURE__ */ new Set();
       for (const ur of unblockedRows.rows) {
         const assignee = String(ur.assigned_to);
@@ -333,7 +333,7 @@ async function updateTask(input) {
     await markTaskNotificationsRead(taskFile);
     if (isCompletionReviewTransition && !isCoordinator && row.reviewer) {
       try {
-        const { writeNotification: writeNotification2 } = await import("./notifications-FAHXEFR2.js");
+        const { writeNotification: writeNotification2 } = await import("./notifications-UP7WQGG4.js");
         const reviewer = String(row.reviewer);
         await writeNotification2({
           agentId: reviewer,

package/dist/{chunk-BM3YRAE5.js → chunk-FM7XZDZI.js}

@@ -1,6 +1,6 @@
 import {
   writeMemoryViaDaemon
-} from "./chunk-KLAVORDC.js";
+} from "./chunk-NCC3F6GM.js";
 
 // src/lib/auto-checkpoint.ts
 var FILE_RE = /(?:^|\s)([\w./-]+\.(?:ts|tsx|js|jsx|json|md|yml|yaml|sql|go|py|css|scss|html|sh))(?:\b|$)/g;

package/dist/chunk-G6EJKYK3.js

@@ -0,0 +1,33 @@
+// src/lib/providers/billing-mode.ts
+function isTrue(v) {
+  return typeof v === "string" && v.trim().toLowerCase() === "true";
+}
+function resolveBillingMode(env = process.env) {
+  const rawMode = (env.EXE_BILLING_MODE ?? "").trim().toLowerCase();
+  const explicitAllow = isTrue(env.EXE_ALLOW_DIRECT_PROVIDER_KEYS);
+  const byokAlias = isTrue(env.BYOK_ENABLED);
+  if (rawMode === "metered") {
+    return {
+      mode: "metered",
+      allowDirectKeys: false,
+      reason: byokAlias || explicitAllow ? "EXE_BILLING_MODE=metered overrides BYOK opt-in \u2014 metering enforced, direct keys rejected" : "EXE_BILLING_MODE=metered \u2014 metering enforced"
+    };
+  }
+  const byokRequested = rawMode === "byok" || byokAlias || explicitAllow;
+  if (!byokRequested) {
+    return {
+      mode: "metered",
+      allowDirectKeys: false,
+      reason: "no BYOK opt-in (EXE_BILLING_MODE/EXE_ALLOW_DIRECT_PROVIDER_KEYS/BYOK_ENABLED unset) \u2014 metering enforced"
+    };
+  }
+  return {
+    mode: "byok",
+    allowDirectKeys: true,
+    reason: "BYOK explicitly enabled \u2014 direct provider keys accepted, billing not metered"
+  };
+}
+
+export {
+  resolveBillingMode
+};

package/dist/{chunk-C5CR4XDV.js → chunk-GMZMBLHT.js}

@@ -119,7 +119,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-ZGFHVDG5.js");
+  const { sessionScopeFilter } = await import("./task-scope-P5STKYAC.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/{chunk-JLOB72OV.js → chunk-GSY6HL3T.js}

@@ -1,24 +1,24 @@
 import {
   recordSessionKill
-} from "./chunk-NME5E325.js";
+} from "./chunk-LMX7UKGX.js";
 import {
   sessionScopeFilter,
   verifyPaneAtCapacity,
   writeNotification
-} from "./chunk-FMJ4D5G6.js";
+} from "./chunk-HED6D5KR.js";
 import {
   listSessions
-} from "./chunk-G4SVYLPT.js";
+} from "./chunk-WJ2PZGRV.js";
 import {
   getTransport
 } from "./chunk-KOO3J5PV.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-P4WXINQT.js";
+} from "./chunk-OR3TAZL3.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-N5G4T47B.js";
+} from "./chunk-SCYWCWKY.js";
 
 // src/lib/capacity-monitor.ts
 var CAPACITY_PATTERNS = [

package/dist/{chunk-FMJ4D5G6.js → chunk-HED6D5KR.js}

@@ -2,11 +2,7 @@ import {
   ensureWorktree,
   getGitRoot,
   isWorktreeDirty
-} from "./chunk-5SYMJCBM.js";
-import {
-  LEASE_MINUTES,
-  leaseExpiryIso
-} from "./chunk-E23LNUWJ.js";
+} from "./chunk-RZJ6DXVE.js";
 import {
   buildTaskResult,
   serializeMessage
@@ -15,17 +11,21 @@ import {
   queueIntercom
 } from "./chunk-4FVVJ7ME.js";
 import {
-  registerSession
-} from "./chunk-G4SVYLPT.js";
+  LEASE_MINUTES,
+  leaseExpiryIso
+} from "./chunk-E23LNUWJ.js";
 import {
-  getTransport
-} from "./chunk-KOO3J5PV.js";
+  registerSession
+} from "./chunk-WJ2PZGRV.js";
 import {
   listTmuxSessions
 } from "./chunk-SSTLTIF3.js";
+import {
+  getTransport
+} from "./chunk-KOO3J5PV.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-P4WXINQT.js";
+} from "./chunk-OR3TAZL3.js";
 import {
   getAgentRuntime,
   normalizeCcModelName
@@ -36,7 +36,7 @@ import {
 import {
   PlanLimitError,
   assertEmployeeLimitSync
-} from "./chunk-VTMPER4B.js";
+} from "./chunk-XYG722JW.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -51,7 +51,7 @@ import {
 } from "./chunk-MP2AFCGL.js";
 import {
   ensureAgentSymlink
-} from "./chunk-HDCP6CGI.js";
+} from "./chunk-NIZQ3CIS.js";
 import {
   expandDualPrefixTools
 } from "./chunk-HYZV25LY.js";
@@ -63,10 +63,10 @@ import {
   isCoordinatorName,
   loadEmployees,
   loadEmployeesSync
-} from "./chunk-N5G4T47B.js";
+} from "./chunk-SCYWCWKY.js";
 import {
   loadDeviceId
-} from "./chunk-UN6KSHLI.js";
+} from "./chunk-JV225JBX.js";
 import {
   EXE_AI_DIR
 } from "./chunk-DFIOOK5R.js";
@@ -673,7 +673,7 @@ async function createTaskCore(input) {
         if (isCoordinatorSession) {
           earlySessionScope = resolved;
         } else {
-          const { getSessionProject } = await import("./session-scope-PPGKSJEL.js");
+          const { getSessionProject } = await import("./session-scope-JGDYAMJO.js");
           const sessionProject = getSessionProject(resolved);
           if (sessionProject && sessionProject !== input.projectName) {
             scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
@@ -922,7 +922,7 @@ async function queryTaskRows(opts) {
   }
   if (opts.founderId !== null) {
     try {
-      const { founderScopeFilter } = await import("./founder-context-6KTVHGVC.js");
+      const { founderScopeFilter } = await import("./founder-context-QCTMEK66.js");
       const founderFilter = founderScopeFilter(opts.founderId);
       const cleaned = founderFilter.sql.replace(/^\s*AND\s+/, "");
       conditions.push(cleaned);
@@ -1154,7 +1154,7 @@ async function updateTaskStatus(input) {
     } catch {
     }
     try {
-      const { writeNotification: writeNotification2 } = await import("./notifications-FAHXEFR2.js");
+      const { writeNotification: writeNotification2 } = await import("./notifications-UP7WQGG4.js");
       await writeNotification2({
         agentId: reviewer,
         agentRole: isCoordinatorName(reviewer) ? "COO" : "manager",
@@ -1574,7 +1574,7 @@ ${input.result ?? ""}`;
   }
   if (shouldWriteCompletionMemory && input.result) {
     try {
-      const { writeMemoryViaDaemon } = await import("./memory-queue-client-2NURVA62.js");
+      const { writeMemoryViaDaemon } = await import("./memory-queue-client-HLURQEV6.js");
       await writeMemoryViaDaemon({
         raw_text: input.result,
         agent_id: String(row.assigned_to),
@@ -1677,7 +1677,7 @@ ${input.result ?? ""}`;
   }
   if (input.status === "done" || input.status === "needs_review") {
     try {
-      const { incrementSkillSuccess } = await import("./skill-refinement-KITOKH6T.js");
+      const { incrementSkillSuccess } = await import("./skill-refinement-DUOO6B7V.js");
       await incrementSkillSuccess(
         String(row.assigned_to),
         row.project_name ? String(row.project_name) : null
@@ -3315,7 +3315,7 @@ async function verifyPaneAtCapacity(sessionName) {
       reason: `capture-pane failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
-  const { isAtCapacity } = await import("./capacity-monitor-G4XO7GNU.js");
+  const { isAtCapacity } = await import("./capacity-monitor-BUKYPSWR.js");
   if (!isAtCapacity(pane)) {
     return {
       atCapacity: false,