@askexenow/exe-os 0.9.312 → 0.9.313

package/dist/{stack-release-XYMKU7NT.js → stack-release-TOCCJQOF.js}

@@ -2,7 +2,7 @@
 import {
   assertPreflightGate,
   runPreflightOnManifest
-} from "./chunk-7ODTYODO.js";
+} from "./chunk-3LGID56M.js";
 import "./chunk-MLKGABMK.js";
 
 // src/bin/stack-release.ts
@@ -247,6 +247,13 @@ async function detectChanges(repos) {
   }
   return changes;
 }
+function rebaseImageTag(image, newVersion) {
+  if (/@sha256:[0-9a-f]{64}/i.test(image)) return image;
+  if (/:v[^:/]+$/.test(image)) {
+    return `${image.replace(/:v[^:/]+$/, "")}:v${newVersion}`;
+  }
+  return `${image}:v${newVersion}`;
+}
 async function bumpVersions(changes, mode, dryRun) {
   for (const change of changes) {
     const newVersion = bumpVersion(change.currentVersion, mode);
@@ -265,21 +272,18 @@ async function bumpVersions(changes, mode, dryRun) {
       srf.version = newVersion;
       srf.sourceVersion = newVersion;
       if (typeof srf.image === "string") {
-        const imageBase = srf.image.replace(/:v[^:]+$/, "");
-        srf.image = `${imageBase}:v${newVersion}`;
+        srf.image = rebaseImageTag(srf.image, newVersion);
       }
       if (srf.components && typeof srf.components === "object") {
         const components = srf.components;
         for (const key of Object.keys(components)) {
           const val = components[key];
           if (typeof val === "string") {
-            const base = val.replace(/:v[^:]+$/, "");
-            components[key] = `${base}:v${newVersion}`;
+            components[key] = rebaseImageTag(val, newVersion);
           } else if (val && typeof val === "object" && "image" in val) {
             const obj = val;
             if (typeof obj.image === "string") {
-              const base = obj.image.replace(/:v[^:]+$/, "");
-              obj.image = `${base}:v${newVersion}`;
+              obj.image = rebaseImageTag(obj.image, newVersion);
             }
           }
         }
@@ -291,8 +295,7 @@ async function bumpVersions(changes, mode, dryRun) {
     }
     await git(change.repo.localPath, "add", "package.json", "stack.release.json");
     await git(change.repo.localPath, "commit", "-m", `chore: bump v${newVersion} for stack release`);
-    await git(change.repo.localPath, "push", "origin", change.repo.defaultBranch);
-    log("ok", `${change.repo.serviceKey}: bumped ${change.currentVersion} -> ${newVersion}`);
+    log("ok", `${change.repo.serviceKey}: bumped ${change.currentVersion} -> ${newVersion} (local commit, push deferred)`);
   }
 }
 async function tagAndTriggerCI(changes, dryRun) {
@@ -302,8 +305,43 @@ async function tagAndTriggerCI(changes, dryRun) {
       continue;
     }
     await git(change.repo.localPath, "tag", change.tag);
-    await git(change.repo.localPath, "push", "origin", change.tag);
-    log("ok", `Tagged ${change.repo.serviceKey} ${change.tag} \u2014 CI triggered`);
+    try {
+      await git(change.repo.localPath, "push", "--atomic", "origin", change.repo.defaultBranch, change.tag);
+    } catch {
+      log("warn", `Atomic push not supported for ${change.repo.serviceKey} \u2014 falling back to sequential push`);
+      await git(change.repo.localPath, "push", "origin", change.repo.defaultBranch);
+      await git(change.repo.localPath, "push", "origin", change.tag);
+    }
+    log("ok", `Pushed ${change.repo.serviceKey} ${change.tag} (bump + tag) \u2014 CI triggered`);
+  }
+}
+async function rollbackFailedReleases(changes, ciStatuses, dryRun) {
+  if (dryRun) return;
+  const failed = changes.filter((c) => {
+    const ci = ciStatuses.find((s) => s.repo.serviceKey === c.repo.serviceKey);
+    return ci && (ci.status !== "completed" || ci.conclusion !== "success");
+  });
+  if (failed.length === 0) return;
+  log("warn", `Rolling back ${failed.length} failed release(s)...`);
+  for (const change of failed) {
+    const name = repoName(change.repo);
+    try {
+      await git(change.repo.localPath, "push", "origin", `:refs/tags/${change.tag}`);
+      log("ok", `Deleted remote tag ${change.tag} from ${name}`);
+    } catch (err) {
+      log("warn", `Could not delete remote tag ${change.tag} from ${name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+      await git(change.repo.localPath, "tag", "-d", change.tag);
+    } catch {
+    }
+    try {
+      await git(change.repo.localPath, "revert", "--no-edit", "HEAD");
+      await git(change.repo.localPath, "push", "origin", change.repo.defaultBranch);
+      log("ok", `Reverted bump commit for ${name} on ${change.repo.defaultBranch}`);
+    } catch (err) {
+      log("fail", `Could not revert bump commit for ${name}: ${err instanceof Error ? err.message : String(err)}. Manual cleanup required.`);
+    }
   }
 }
 async function waitForCI(changes, dryRun) {
@@ -381,7 +419,13 @@ async function checkRegistryManifest(registry, repo, tag, token) {
   const url = `https://${registry}/v2/${repo}/manifests/${tag}`;
   const headers = [
     "-H",
-    "Accept: application/vnd.oci.image.index.v1+json"
+    "Accept: application/vnd.oci.image.index.v1+json",
+    // Also accept legacy Docker v2 manifest list / single manifest so the
+    // registry returns a Docker-Content-Digest for non-OCI images too.
+    "-H",
+    "Accept: application/vnd.docker.distribution.manifest.list.v2+json",
+    "-H",
+    "Accept: application/vnd.docker.distribution.manifest.v2+json"
   ];
   if (token) {
     headers.push("-H", `Authorization: Bearer ${token}`);
@@ -391,15 +435,15 @@ async function checkRegistryManifest(registry, repo, tag, token) {
       "-sS",
       "-m",
       "30",
-      "-o",
-      "/dev/null",
-      "-w",
-      "%{http_code}",
+      "-I",
       ...headers,
       url
     ]);
-    const code = parseInt(stdout.trim(), 10);
-    return { status: code, ok: code >= 200 && code < 300 };
+    const statusMatch = stdout.match(/^HTTP\/[\d.]+\s+(\d{3})/m);
+    const code = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+    const digestMatch = stdout.match(/^docker-content-digest:\s*(sha256:[0-9a-f]{64})/im);
+    const digest = digestMatch ? digestMatch[1] : void 0;
+    return { status: code, ok: code >= 200 && code < 300, digest };
   } catch {
     return { status: 0, ok: false };
   }
@@ -412,6 +456,45 @@ async function warmProxyCache(imageRef) {
     return false;
   }
 }
+async function resolveDigestViaInspect(imageName, tag) {
+  const shortName = shortImageName(imageName);
+  const refs = [
+    `${GHCR_REGISTRY}/askexe/${shortName}:${tag}`,
+    `${PROXY_REGISTRY}/askexe/${shortName}:${tag}`
+  ];
+  for (const ref of refs) {
+    try {
+      const { stdout } = await execFile("docker", ["manifest", "inspect", ref, "--verbose"], {
+        timeout: 6e4
+      });
+      const parsed = JSON.parse(stdout);
+      let digest;
+      if (Array.isArray(parsed)) {
+        digest = parsed[0]?.Descriptor?.digest;
+      } else {
+        digest = parsed.Descriptor?.digest;
+      }
+      if (digest && /^sha256:[0-9a-f]{64}$/i.test(digest)) {
+        log("ok", `Resolved digest via docker manifest inspect: ${shortName}:${tag} -> ${digest.slice(0, 19)}...`);
+        return digest;
+      }
+    } catch {
+    }
+  }
+  try {
+    const ghcrRef = `${GHCR_REGISTRY}/askexe/${shortName}:${tag}`;
+    const { stdout } = await execFile("docker", ["manifest", "inspect", ghcrRef], {
+      timeout: 6e4
+    });
+    const parsed = JSON.parse(stdout);
+    if (parsed.digest && /^sha256:[0-9a-f]{64}$/i.test(parsed.digest)) {
+      log("ok", `Resolved digest via docker manifest inspect (non-verbose): ${shortName}:${tag} -> ${parsed.digest.slice(0, 19)}...`);
+      return parsed.digest;
+    }
+  } catch {
+  }
+  return void 0;
+}
 async function verifyImages(changes, ciStatuses, dryRun) {
   if (dryRun) {
     return changes.map((c) => ({
@@ -423,7 +506,16 @@ async function verifyImages(changes, ciStatuses, dryRun) {
   }
   const proxyToken = process.env.EXE_REGISTRY_PROXY_PULL_TOKEN ?? void 0;
   const results = [];
-  log("info", "Verifying Docker images are pullable...");
+  let ghcrToken = process.env.GHCR_TOKEN?.trim() || void 0;
+  if (!ghcrToken) {
+    try {
+      const { stdout } = await execFile("gh", ["auth", "token"]);
+      ghcrToken = stdout.trim();
+    } catch {
+    }
+  }
+  const ghcrBearer = ghcrToken ? Buffer.from(ghcrToken).toString("base64") : void 0;
+  log("info", "Verifying Docker images are pullable (with retry for digest resolution)...");
   for (const change of changes) {
     const ci = ciStatuses.find((s) => s.repo.serviceKey === change.repo.serviceKey);
     if (!ci || ci.status !== "completed" || ci.conclusion !== "success") continue;
@@ -437,31 +529,59 @@ async function verifyImages(changes, ciStatuses, dryRun) {
       ghcr: "error",
       proxy: "error"
     };
-    const proxyCheck = await checkRegistryManifest(PROXY_REGISTRY, proxyRepo, tag, proxyToken);
-    if (proxyCheck.ok) {
-      result.proxy = "ok";
-    } else {
-      result.proxy = "pending";
-    }
-    let ghcrToken = process.env.GHCR_TOKEN?.trim() || void 0;
-    if (!ghcrToken) {
-      try {
-        const { stdout } = await execFile("gh", ["auth", "token"]);
-        ghcrToken = stdout.trim();
-      } catch {
+    const GHCR_RETRY_DELAYS = [5e3, 1e4, 2e4, 4e4];
+    let ghcrCheck = { status: 0, ok: false };
+    for (let attempt = 0; attempt <= GHCR_RETRY_DELAYS.length; attempt++) {
+      ghcrCheck = await checkRegistryManifest(GHCR_REGISTRY, ghcrRepo, tag, ghcrBearer);
+      if (ghcrCheck.ok && ghcrCheck.digest) {
+        break;
+      }
+      if (ghcrCheck.status === 401 || ghcrCheck.status === 403) {
+        break;
+      }
+      if (attempt < GHCR_RETRY_DELAYS.length) {
+        const delayMs = GHCR_RETRY_DELAYS[attempt];
+        log("info", `${shortName}:${tag} not yet available on GHCR (HTTP ${ghcrCheck.status}) \u2014 retry in ${delayMs / 1e3}s (${attempt + 1}/${GHCR_RETRY_DELAYS.length})`);
+        await sleep(delayMs);
       }
     }
-    const ghcrBearer = ghcrToken ? Buffer.from(ghcrToken).toString("base64") : void 0;
-    const ghcrCheck = await checkRegistryManifest(GHCR_REGISTRY, ghcrRepo, tag, ghcrBearer);
     if (ghcrCheck.ok) {
       result.ghcr = "ok";
+      result.digest = ghcrCheck.digest;
+      if (!ghcrCheck.digest) {
+        log("warn", `${shortName}:${tag} is on GHCR but Docker-Content-Digest header missing \u2014 trying docker manifest inspect fallback`);
+        const inspectDigest = await resolveDigestViaInspect(change.repo.imageName, tag);
+        if (inspectDigest) {
+          result.digest = inspectDigest;
+        } else {
+          log("warn", `${shortName}:${tag} \u2014 docker manifest inspect also failed to resolve digest. Manifest entry will be tag-only.`);
+        }
+      }
     } else if (ghcrCheck.status === 401 || ghcrCheck.status === 403) {
-      result.ghcr = "error";
-      result.detail = `GHCR auth failed (${ghcrCheck.status}) \u2014 cannot verify image. Fix gh auth or GHCR_TOKEN.`;
-      log("fail", `GHCR auth returned ${ghcrCheck.status} for ${shortName}:${tag} \u2014 cannot verify, treating as error`);
+      log("warn", `GHCR auth returned ${ghcrCheck.status} for ${shortName}:${tag} \u2014 trying docker manifest inspect fallback`);
+      const inspectDigest = await resolveDigestViaInspect(change.repo.imageName, tag);
+      if (inspectDigest) {
+        result.ghcr = "ok";
+        result.digest = inspectDigest;
+        log("ok", `${shortName}:${tag} \u2014 digest resolved via docker manifest inspect despite GHCR HEAD ${ghcrCheck.status}`);
+      } else {
+        result.ghcr = "error";
+        result.detail = `GHCR auth failed (${ghcrCheck.status}) and docker manifest inspect failed \u2014 cannot verify image. Fix gh auth or GHCR_TOKEN.`;
+        log("fail", `GHCR auth returned ${ghcrCheck.status} for ${shortName}:${tag} and inspect fallback failed \u2014 cannot verify`);
+      }
     } else {
       result.ghcr = "missing";
-      result.detail = `GHCR returned ${ghcrCheck.status} for ${ghcrRepo}:${tag}`;
+      result.detail = `GHCR returned ${ghcrCheck.status} for ${ghcrRepo}:${tag} after ${GHCR_RETRY_DELAYS.length} retries`;
+      log("fail", `Image NOT FOUND on GHCR after retries: ${shortName}:${tag} \u2014 release may be broken!`);
+    }
+    const proxyCheck = await checkRegistryManifest(PROXY_REGISTRY, proxyRepo, tag, proxyToken);
+    if (proxyCheck.ok) {
+      result.proxy = "ok";
+      if (!result.digest && proxyCheck.digest) {
+        result.digest = proxyCheck.digest;
+      }
+    } else {
+      result.proxy = "pending";
     }
     if (result.ghcr === "ok" && result.proxy !== "ok") {
       log("info", `Warming proxy cache for ${shortName}:${tag}...`);
@@ -476,11 +596,10 @@ async function verifyImages(changes, ciStatuses, dryRun) {
       }
     }
     if (result.ghcr === "ok" && result.proxy === "ok") {
-      log("ok", `Image verified: ${shortName}:${tag} (GHCR + proxy)`);
+      const digestSuffix = result.digest ? ` [${result.digest.slice(0, 19)}...]` : "";
+      log("ok", `Image verified: ${shortName}:${tag} (GHCR + proxy)${digestSuffix}`);
     } else if (result.ghcr === "ok" && result.proxy === "pending") {
       log("warn", `Image on GHCR only: ${shortName}:${tag} (proxy will cache on first pull)`);
-    } else if (result.ghcr === "missing") {
-      log("fail", `Image NOT FOUND on GHCR: ${shortName}:${tag} \u2014 release may be broken!`);
     }
     results.push(result);
   }
@@ -500,7 +619,7 @@ function printImageVerification(results) {
   }
   console.log("");
 }
-function updateStackManifest(changes, ciStatuses, dryRun, imageResults) {
+async function updateStackManifest(changes, ciStatuses, dryRun, imageResults) {
   const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8"));
   const currentLatest = manifest.latest;
   const currentParts = currentLatest.split(".").map(Number);
@@ -518,9 +637,17 @@ function updateStackManifest(changes, ciStatuses, dryRun, imageResults) {
       successfulChanges.push(change);
       const svc = services[change.repo.serviceKey];
       if (svc) {
-        const imageTag = `${change.repo.imageName}:v${change.newVersion}`;
-        const imgResult = imageResults?.find((r) => r.repo.serviceKey === change.repo.serviceKey);
-        svc.image = imgResult?.digest ? `${imageTag}@${imgResult.digest}` : imageTag;
+        const tag = `v${change.newVersion}`;
+        const imageTag = `${change.repo.imageName}:${tag}`;
+        let digest = imageResults?.find((r) => r.repo.serviceKey === change.repo.serviceKey)?.digest;
+        if (!digest && !dryRun) {
+          log("info", `No digest from image verification for ${imageTag} \u2014 trying docker manifest inspect fallback (bug 85034df0)`);
+          digest = await resolveDigestViaInspect(change.repo.imageName, tag);
+        }
+        if (!digest && !dryRun) {
+          log("warn", `No content digest resolved for ${imageTag} \u2014 manifest entry will be tag-only and the digest-pinning gate will reject it.`);
+        }
+        svc.image = digest ? `${imageTag}@${digest}` : imageTag;
       }
     }
   }
@@ -590,6 +717,63 @@ function gatePublishWithPreflight(newStackVersion, dryRun, allowRed) {
     warn: (m) => log("warn", m.replace(/^\[stack-release\]\s*/, ""))
   });
 }
+function gatePreMutationStructure(changes, dryRun, allowRed) {
+  let baseManifest;
+  try {
+    baseManifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8"));
+  } catch (err) {
+    throw new Error(`Pre-mutation gate: cannot read manifest ${MANIFEST_PATH}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const currentLatest = baseManifest.latest ?? "";
+  const baseServices = baseManifest.stacks?.[currentLatest]?.services ?? {};
+  const services = {};
+  for (const [key, svc] of Object.entries(baseServices)) services[key] = { ...svc };
+  for (const change of changes) {
+    const svc = services[change.repo.serviceKey];
+    if (svc) svc.image = `${change.repo.imageName}:v${change.newVersion}`;
+  }
+  const currentParts = currentLatest.split(".").map(Number);
+  const simVersion = `${currentParts[0] ?? 0}.${currentParts[1] ?? 9}.${(currentParts[2] ?? 0) + 1}`;
+  const simManifest = {
+    schemaVersion: 1,
+    latest: simVersion,
+    stacks: { [simVersion]: { version: simVersion, services } }
+  };
+  const composeDir = path.join(EXE_OS_ROOT, "deploy", "compose");
+  const report = runPreflightOnManifest({
+    manifest: simManifest,
+    stackVersion: simVersion,
+    label: `pre-mutation simulated manifest (stack ${simVersion})`,
+    envExamplePath: path.join(composeDir, ".env.example"),
+    composePath: path.join(composeDir, "docker-compose.yml"),
+    monitorComposePath: path.join(EXE_OS_ROOT, "deploy", "monitor", "docker-compose.hub.yml")
+  });
+  const adjusted = {
+    ...report,
+    findings: report.findings.map(
+      (f) => f.check === "digest-pinning" && f.status === "fail" ? { ...f, status: "warn", message: `${f.message} (pending image build \u2014 enforced after build)` } : f
+    )
+  };
+  const failed = adjusted.findings.filter((f) => f.status === "fail").length;
+  const warned = adjusted.findings.filter((f) => f.status === "warn").length;
+  const passed = adjusted.findings.filter((f) => f.status === "pass").length;
+  const verdict = failed > 0 ? "RED" : warned > 0 ? "YELLOW" : "GREEN";
+  const adjustedReport = { ...adjusted, verdict, failed, warned, passed };
+  log("info", "Running pre-mutation structural gate (before any remote push)...");
+  if (dryRun) {
+    console.log(`  [dry-run] pre-mutation verdict: ${adjustedReport.verdict} (pass ${passed} / warn ${warned} / fail ${failed})`);
+    for (const f of adjustedReport.findings) {
+      if (f.status !== "pass") log(f.status === "fail" ? "fail" : "warn", `${f.check}: ${f.message}`);
+    }
+    return;
+  }
+  assertPreflightGate(adjustedReport, {
+    context: "stack-release:pre-mutation",
+    allowRed,
+    log: (m) => log("ok", m.replace(/^\[stack-release:pre-mutation\]\s*/, "")),
+    warn: (m) => log("warn", m.replace(/^\[stack-release:pre-mutation\]\s*/, ""))
+  });
+}
 async function commitAndTagExeOs(newStackVersion, _exeOsChange, dryRun) {
   if (dryRun) {
     log("dry", `Would commit manifest + tag exe-os stack-v${newStackVersion}`);
@@ -724,6 +908,7 @@ async function runStackRelease(flags) {
       `    ${change.repo.serviceKey.padEnd(14)} ${change.currentVersion} -> ${change.newVersion}  (${change.commits.length} commit${change.commits.length === 1 ? "" : "s"})`
     );
   }
+  gatePreMutationStructure(changes, flags.dryRun, flags.allowRed);
   if (!flags.yes && !flags.dryRun) {
     const ok = await confirm("Proceed with release?");
     if (!ok) {
@@ -735,6 +920,20 @@ async function runStackRelease(flags) {
   log("info", "Tagging repos and triggering CI...");
   await tagAndTriggerCI(changes, flags.dryRun);
   const ciStatuses = await waitForCI(changes, flags.dryRun);
+  const ciFailures = ciStatuses.filter(
+    (s) => s.status !== "completed" || s.conclusion !== "success"
+  );
+  if (ciFailures.length > 0 && !flags.dryRun) {
+    await rollbackFailedReleases(changes, ciStatuses, flags.dryRun);
+    const ciSuccesses = ciStatuses.filter(
+      (s) => s.status === "completed" && s.conclusion === "success"
+    );
+    if (ciSuccesses.length === 0) {
+      log("fail", "All CI builds failed. Release aborted, all bumps rolled back.");
+      process.exit(1);
+    }
+    log("warn", `${ciFailures.length} CI build(s) failed and were rolled back. Continuing with ${ciSuccesses.length} successful build(s).`);
+  }
   let imageResults = [];
   if (flags.skipImageVerify) {
     log("warn", "Image verification skipped (--skip-image-verify)");
@@ -761,7 +960,7 @@ async function runStackRelease(flags) {
     printImageVerification(imageResults);
   }
   log("info", "Updating stack manifest...");
-  const newStackVersion = updateStackManifest(changes, ciStatuses, flags.dryRun, imageResults);
+  const newStackVersion = await updateStackManifest(changes, ciStatuses, flags.dryRun, imageResults);
   gatePublishWithPreflight(newStackVersion, flags.dryRun, flags.allowRed);
   const exeOsChange = changes.find((c) => c.repo.serviceKey === "exe-os");
   await commitAndTagExeOs(newStackVersion, exeOsChange, flags.dryRun);

package/dist/{stack-update-TUBZTY7Z.js → stack-update-MRNVHUZZ.js}

@@ -22,13 +22,16 @@ import {
   findLatestBackupEnvFile,
   hardenHost,
   httpStatus,
+  isCloudflaredTunnelMisconfigured,
   isExecFormMigration,
   isStrictDigestEnabled,
+  isUsableTunnelToken,
   listAvailableVersions,
   loadServiceSelection,
   loadStackManifest,
   pairMonitorAgent,
   parseComposeDependsOn,
+  parseComposeServiceNames,
   parseEnv,
   parseRequiredEnvRefs,
   parseStackManifest,
@@ -50,11 +53,11 @@ import {
   verifyReleaseHealth,
   verifyStackManifestSignature,
   waitForHttpOk
-} from "./chunk-KMIAYKIH.js";
-import "./chunk-JV225JBX.js";
-import "./chunk-2EJ636HI.js";
-import "./chunk-DFIOOK5R.js";
-import "./chunk-65DBIEM2.js";
+} from "./chunk-K5C6LC2G.js";
+import "./chunk-I6RHLHVW.js";
+import "./chunk-UST3MKK7.js";
+import "./chunk-WCES22KG.js";
+import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
 export {
   ProgressReporter,
@@ -80,13 +83,16 @@ export {
   findLatestBackupEnvFile,
   hardenHost,
   httpStatus,
+  isCloudflaredTunnelMisconfigured,
   isExecFormMigration,
   isStrictDigestEnabled,
+  isUsableTunnelToken,
   listAvailableVersions,
   loadServiceSelection,
   loadStackManifest,
   pairMonitorAgent,
   parseComposeDependsOn,
+  parseComposeServiceNames,
   parseEnv,
   parseRequiredEnvRefs,
   parseStackManifest,

package/dist/{steward-gate-6NWRDLX2.js → steward-gate-JEVUDTBI.js}

@@ -1,15 +1,15 @@
 import {
   StewardGate
-} from "./chunk-IRIPGGGL.js";
-import "./chunk-SCYWCWKY.js";
+} from "./chunk-4UHQYBMQ.js";
+import "./chunk-VG4ZH2Z3.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-GWPICNSO.js";
+import "./chunk-CSTL7BMK.js";
 import "./chunk-PNQDP3OA.js";
-import "./chunk-VQRTO7IS.js";
+import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-DFIOOK5R.js";
-import "./chunk-65DBIEM2.js";
+import "./chunk-WCES22KG.js";
+import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
 export {
   StewardGate

package/dist/{task-enforcement-UOULTGFB.js → task-enforcement-VFSAAZUN.js}

@@ -1,40 +1,40 @@
 import {
   sendIntercom,
   updateTaskStatus
-} from "./chunk-HED6D5KR.js";
-import "./chunk-RZJ6DXVE.js";
+} from "./chunk-MMNMQNLD.js";
+import "./chunk-L6QI2NNG.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-4FVVJ7ME.js";
 import "./chunk-E23LNUWJ.js";
-import "./chunk-WJ2PZGRV.js";
+import "./chunk-ZAA344BL.js";
 import "./chunk-SSTLTIF3.js";
 import "./chunk-KOO3J5PV.js";
 import "./chunk-22TVSRQQ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OR3TAZL3.js";
-import "./chunk-QB5JOGPK.js";
+} from "./chunk-P4ULFI2N.js";
+import "./chunk-2PI6JBJL.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-XYG722JW.js";
+import "./chunk-JIJKUZIO.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-OPU3NYOO.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-NIZQ3CIS.js";
+import "./chunk-3AMGSCRH.js";
 import "./chunk-HYZV25LY.js";
 import {
   isCoordinatorName
-} from "./chunk-SCYWCWKY.js";
+} from "./chunk-VG4ZH2Z3.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-GWPICNSO.js";
+import "./chunk-CSTL7BMK.js";
 import "./chunk-PNQDP3OA.js";
-import "./chunk-VQRTO7IS.js";
+import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-JV225JBX.js";
-import "./chunk-2EJ636HI.js";
-import "./chunk-DFIOOK5R.js";
-import "./chunk-65DBIEM2.js";
+import "./chunk-I6RHLHVW.js";
+import "./chunk-UST3MKK7.js";
+import "./chunk-WCES22KG.js";
+import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
 
 // src/lib/task-enforcement.ts

package/dist/{task-scope-P5STKYAC.js → task-scope-P4VLIQNP.js}

@@ -2,36 +2,36 @@ import {
   getCurrentSessionScope,
   sessionScopeFilter,
   strictSessionScopeFilter
-} from "./chunk-HED6D5KR.js";
-import "./chunk-RZJ6DXVE.js";
+} from "./chunk-MMNMQNLD.js";
+import "./chunk-L6QI2NNG.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-4FVVJ7ME.js";
 import "./chunk-E23LNUWJ.js";
-import "./chunk-WJ2PZGRV.js";
+import "./chunk-ZAA344BL.js";
 import "./chunk-SSTLTIF3.js";
 import "./chunk-KOO3J5PV.js";
 import "./chunk-22TVSRQQ.js";
-import "./chunk-OR3TAZL3.js";
-import "./chunk-QB5JOGPK.js";
+import "./chunk-P4ULFI2N.js";
+import "./chunk-2PI6JBJL.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-XYG722JW.js";
+import "./chunk-JIJKUZIO.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-OPU3NYOO.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-NIZQ3CIS.js";
+import "./chunk-3AMGSCRH.js";
 import "./chunk-HYZV25LY.js";
-import "./chunk-SCYWCWKY.js";
+import "./chunk-VG4ZH2Z3.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-GWPICNSO.js";
+import "./chunk-CSTL7BMK.js";
 import "./chunk-PNQDP3OA.js";
-import "./chunk-VQRTO7IS.js";
+import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-JV225JBX.js";
-import "./chunk-2EJ636HI.js";
-import "./chunk-DFIOOK5R.js";
-import "./chunk-65DBIEM2.js";
+import "./chunk-I6RHLHVW.js";
+import "./chunk-UST3MKK7.js";
+import "./chunk-WCES22KG.js";
+import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
 export {
   getCurrentSessionScope,

package/dist/{tasks-crud-24HMTULR.js → tasks-crud-SC3ERIUR.js}

@@ -25,36 +25,36 @@ import {
   slugify,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-HED6D5KR.js";
-import "./chunk-RZJ6DXVE.js";
+} from "./chunk-MMNMQNLD.js";
+import "./chunk-L6QI2NNG.js";
 import "./chunk-4JERP7NT.js";
 import "./chunk-4FVVJ7ME.js";
 import "./chunk-E23LNUWJ.js";
-import "./chunk-WJ2PZGRV.js";
+import "./chunk-ZAA344BL.js";
 import "./chunk-SSTLTIF3.js";
 import "./chunk-KOO3J5PV.js";
 import "./chunk-22TVSRQQ.js";
-import "./chunk-OR3TAZL3.js";
-import "./chunk-QB5JOGPK.js";
+import "./chunk-P4ULFI2N.js";
+import "./chunk-2PI6JBJL.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-XYG722JW.js";
+import "./chunk-JIJKUZIO.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-OPU3NYOO.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-NIZQ3CIS.js";
+import "./chunk-3AMGSCRH.js";
 import "./chunk-HYZV25LY.js";
-import "./chunk-SCYWCWKY.js";
+import "./chunk-VG4ZH2Z3.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-GWPICNSO.js";
+import "./chunk-CSTL7BMK.js";
 import "./chunk-PNQDP3OA.js";
-import "./chunk-VQRTO7IS.js";
+import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-JV225JBX.js";
-import "./chunk-2EJ636HI.js";
-import "./chunk-DFIOOK5R.js";
-import "./chunk-65DBIEM2.js";
+import "./chunk-I6RHLHVW.js";
+import "./chunk-UST3MKK7.js";
+import "./chunk-WCES22KG.js";
+import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
 export {
   DEFAULT_TASK_PRIORITY,