@askexenow/exe-os 0.9.359 → 0.9.361

package/deploy/compose/docker-compose.yml

@@ -902,6 +902,12 @@ services:
       EXE_REGISTRY_PROXY_UPSTREAM_TOKEN: "${EXE_REGISTRY_PROXY_UPSTREAM_TOKEN:-}"
       EXE_REGISTRY_PROXY_PULL_TOKENS: "${EXE_REGISTRY_PROXY_PULL_TOKENS:-}"
       EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE: "${EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE:-askexe}"
+      # Bug 2b8eaf16: the packaged exe-update needs the billing DB URL to validate
+      # license-key pulls against billing.stack_releases (registry-proxy reads
+      # EXE_REGISTRY_PROXY_DATABASE_URL, falling back to DATABASE_URL). Because this
+      # service takes NO blanket env_file (bug 67d62490), the URL must be passed
+      # explicitly here or license-based pull auth silently degrades to token-only.
+      EXE_REGISTRY_PROXY_DATABASE_URL: "${EXE_REGISTRY_PROXY_DATABASE_URL:-${DATABASE_URL:-}}"
     ports:
       - "127.0.0.1:${EXE_UPDATE_HOST_PORT:-3200}:${EXE_REGISTRY_PROXY_PORT:-3200}"
     networks:
@@ -1006,7 +1012,7 @@ services:
   #   wiki.<domain>    → http://exe-sso-edge:80   (NOT exe-wiki:3001)
   #   erp.<domain>     → http://exe-sso-edge:80   (NOT exe-erp / exe-erp-nginx)
   #   gateway.<domain> → http://exe-gateway:3100  (routed directly — no SSO gate)
-  #   dashboard.askexe.com → http://exe-dashboard:80
+  #   dashboard.<domain> → http://exe-sso-edge:80   (NOT exe-dashboard:80 — gated)
   #   monitor.<domain> → http://exe-monitor-hub:8090
   #   auth.<domain>    → http://exe-sso-edge:80  (auth UI + real /health proxy)
   #   api.<domain>     → http://exe-os:8765

package/deploy/compose/generate-env.ts

@@ -60,12 +60,26 @@ export interface GenerateEnvOptions {
   clientName: string;
   domain: string;
   licenseKey?: string;
+  /**
+   * Whether registration is closed (invite-only). Bug d6f980c1: this used to be
+   * a HARDCODED `GOTRUE_DISABLE_SIGNUP=true` literal, so every regenerate of the
+   * .env re-closed signup — a redeploy silently reverted an operator who had
+   * opened registration against the live stack. It is now an option so the
+   * redeploy path can thread the CURRENT live value through instead of clobbering
+   * it. Default is `true`: invite-only is the intended production posture (the
+   * whole stack ships invite-only, see AUTH_DEFAULT_PRODUCT / bug 5960ebb1), so
+   * a fresh deploy and the checked-in .env.example are unchanged.
+   */
+  disableSignup?: boolean;
 }
 
 export function generateEnv(options: GenerateEnvOptions): string {
   const normalizedDomain = normalizeDomain(options.domain);
   const normalizedClientName = normalizeClientName(options.clientName);
   const gatewayWsAuthToken = randomSecret(RANDOM_SECRET_48);
+  // Default to the production posture (invite-only). A redeploy passes the live
+  // value so it is preserved rather than reset to true.
+  const disableSignup = options.disableSignup ?? true;
 
   return joinEnvLines([
     "# --- Domain ---",
@@ -114,7 +128,11 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "# Bug 80a15e36: pin the JWT audience so issued tokens carry aud=authenticated",
     "# (GoTrue defaults aud to empty); apps validating aud reject empty-aud tokens.",
     "GOTRUE_JWT_AUD=authenticated",
-    "GOTRUE_DISABLE_SIGNUP=true",
+    "# Bug d6f980c1: registration posture is CONFIGURABLE (default invite-only)",
+    "# rather than a hardcoded literal, so a redeploy no longer silently re-closes",
+    "# signup an operator had opened. compose reads ${GOTRUE_DISABLE_SIGNUP:-true},",
+    "# so removing this line still fails closed.",
+    `GOTRUE_DISABLE_SIGNUP=${disableSignup}`,
     "GOTRUE_MAILER_AUTOCONFIRM=false",
     "# Auth emails (confirm/reset/magic-link) send From this customer-domain",
     "# address — not noreply@askexe.com (bug 133c9d5b). Configure SPF/DKIM/DMARC",
@@ -141,10 +159,11 @@ export function generateEnv(options: GenerateEnvOptions): string {
     `AUTH_SERVER_NAME=auth.${normalizedDomain}`,
     `AUTH_CORS_ORIGIN=https://${normalizedDomain}`,
     "AUTH_DEFAULT_PRODUCT=AUTH",
-    "# Bug 5960ebb1: invite-only posture. GOTRUE_DISABLE_SIGNUP=true already blocks",
+    "# Bug 5960ebb1: invite-only posture. GOTRUE_DISABLE_SIGNUP already blocks",
     "# signup server-side; mirror it here so the auth SPA hides the sign-up UI/route",
-    "# instead of showing a form that always fails. Keep these two in lockstep.",
-    "AUTH_DISABLE_SIGNUP=true",
+    "# instead of showing a form that always fails. Kept in lockstep with the",
+    "# resolved GOTRUE_DISABLE_SIGNUP value above (bug d6f980c1).",
+    `AUTH_DISABLE_SIGNUP=${disableSignup}`,
     "",
     "# --- CRM ---",
     `CRM_IMAGE_TAG=${CRM_IMAGE_TAG}`,

package/deploy/compose/sso-edge/default.conf.template

@@ -21,6 +21,10 @@ upstream sso_wiki { server exe-wiki:3001; }
 upstream sso_auth { server exe-auth:80; }
 # ERP must be reached through its own nginx (gunicorn can't serve /assets/ — bug 6776edf0)
 upstream sso_erp  { server exe-erp-nginx:80; }
+# Dashboard — must be on the same docker network as exe-sso-edge.
+# If the dashboard uses a separate compose (dashboard-page/docker-compose.yml),
+# ensure it joins exe-os_backend or exe-os_frontend (not the legacy exe-net).
+upstream sso_dashboard { server exe-dashboard:80; }
 # Shared GoTrue — the sso-redirect snippet's /_sso_gate validates ?access_token=
 # against GET /user here instead of trusting its presence (P0 bug 462d3273).
 upstream sso_gotrue { server gotrue:9999; }
@@ -33,6 +37,17 @@ map $request_uri $sso_uri_access_token {
     "~[?&]access_token=(?<tok>[^&]+)" $tok;
 }
 
+# Extract the shared GoTrue session cookie (exe-auth, domain .${DOMAIN}) from
+# the Cookie header. Cross-app logout: GoTrue POST /logout clears this cookie
+# on the parent domain, so its absence signals a globally-revoked session.
+# The gate checks this alongside the app-native cookie — if the app cookie is
+# present but the GoTrue cookie is gone, the session was revoked on another app
+# and the edge forces re-auth (return 401 → login redirect).
+map $http_cookie $sso_gotrue_cookie {
+    default "";
+    "~(?:^|;\s*)exe-auth=([^\s;]+)" $1;
+}
+
 map $http_upgrade $sso_conn_upgrade {
     default upgrade;
     ''      close;
@@ -124,6 +139,26 @@ server {
     location / { proxy_pass http://sso_erp; }
 }
 
+# ── Dashboard ────────────────────────────────────────────────────────────────
+server {
+    listen 80;
+    server_name dashboard.${DOMAIN};
+
+    set $sso_auth_base      "https://auth.${DOMAIN}";
+    set $sso_app_url        "https://dashboard.${DOMAIN}";
+    set $sso_product        "Dashboard";
+    # The dashboard stores its access token in localStorage AND sets a cookie
+    # named exe_access_token on the parent domain so the SSO edge can gate on
+    # it (same cookie name as the Wiki — both are canonical SSO consumers).
+    set $sso_session_cookie $cookie_exe_access_token;
+    include /etc/nginx/snippets/sso-redirect.conf;
+
+    location = /health  { auth_request off; proxy_pass http://sso_dashboard/health; }
+    location = /healthz { auth_request off; proxy_pass http://sso_dashboard/health; }
+
+    location / { proxy_pass http://sso_dashboard; }
+}
+
 # Default — unknown host → 404 (no open proxy).
 server {
     listen 80 default_server;

package/deploy/compose/sso-edge/sso-redirect.conf

@@ -10,7 +10,10 @@
 #  1. Every request runs the edge auth gate (auth_request → /_sso_gate).
 #  2. If the app session cookie is present the request passes (the app validates
 #     its own session server-side — the cookie name differs per app; set it via
-#     $sso_session_cookie below).
+#     $sso_session_cookie below). Cross-app logout: the edge also checks for the
+#     shared GoTrue cookie (exe-auth on .${DOMAIN}); if the app cookie is present
+#     but the GoTrue cookie is gone, the session was revoked on another app and
+#     the edge forces re-auth.
 #  3. If the request carries ?access_token= (the SSO callback), the edge
 #     VALIDATES the token against the shared GoTrue (`GET /user` with
 #     `Authorization: Bearer <token>`) before letting it through. P0 bug
@@ -67,6 +70,9 @@
 # are app-native sessions the edge cannot verify against GoTrue); each app fully
 # validates its own session server-side. The edge gate's job is the login funnel
 # plus never letting an unvalidated bearer token skip it (bug 462d3273).
+# Cross-app logout adds a GoTrue-cookie check: if the app-native cookie is present
+# but the shared GoTrue cookie is absent, the edge 401s — the session was revoked
+# on another app and the app-native cookie is stale.
 # ─────────────────────────────────────────────────────────────────────────────
 
 # Run the gate for every request on this vhost. The gate is a zero-cost local
@@ -87,8 +93,23 @@ location = /_sso_gate {
     # which auth_request rejects ("auth request unexpected status: 302").
     error_page 401 = @sso_gate_deny;
 
-    # 1. App session cookie present → authenticated (app re-validates it).
+    # 1. App session cookie present → check for cross-app logout.
+    #    The GoTrue cookie (exe-auth, domain .${DOMAIN}) is shared across all
+    #    subdomains. GoTrue POST /logout clears it globally. If the app-native
+    #    cookie is present but the GoTrue cookie is gone, the session was
+    #    revoked on another app — force re-auth instead of trusting the stale
+    #    app cookie.
+    set $sso_auth_check "";
     if ($sso_session_cookie) {
+        set $sso_auth_check "app";
+    }
+    if ($sso_gotrue_cookie = "") {
+        set $sso_auth_check "${sso_auth_check}nogotrue";
+    }
+    if ($sso_auth_check = "appnogotrue") {
+        return 401;
+    }
+    if ($sso_auth_check = "app") {
         return 204;
     }
 

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.31",
+  "latest": "0.9.32",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -2233,11 +2233,122 @@
         }
       },
       "rolloutStage": "ga"
+    },
+    "0.9.32": {
+      "version": "0.9.32",
+      "releasedAt": "2026-08-01T05:27:33Z",
+      "notes": "exe-auth v0.4.0 SECURITY: reconciled diverged main + complete password-recovery flow (set-password screen, OTP, /verify route) + redirect-leak P0 fix (9a18355c) + provenance /__version endpoint. Replaces the stale v0.3.0 image that carried v0.1.0 frontend with live token leaks (bug 1ed281c4). First release carrying a gitSha provenance field (G3).",
+      "npmVersion": "0.9.324",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v0.9.28@sha256:b3ab35cf00490711c4ae945d06da042cb285ca1c07902ea1c2e28ca540741a5d",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — CRM bridge fix, BYOK alias, SQL race fix, Baileys WA version floor. Pinned by digest only because tag v0.9.28 was overwritten upstream (bug b817e34c)."
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v0.9.4@sha256:9ca4e75577b2ff2abb754140ccfaf8df19161bcef601faf37d1fce743fe814fc",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v0.9.4@sha256:d593bec5a4b248388d0d85353fae1ba8f93cab628a03833aa79acd0632fd11cb",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.4.0@sha256:d92b50e812ca3dbd5e3a828be3cdd7a7b73967f00f53640f09288d44a8ea1716",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth",
+          "description": "Corrects the 0.9.29 exe-auth downgrade regression to v0.1.0; pins v0.3.0 (bug 5f5b4795).",
+          "gitSha": "72475df3d19f9614897910bae90550a414604954"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.2.0-final8@sha256:15bb6020b109b4dfd51d245273ffa88bbfbaf0de09da05a09e6b6f9344b00c46",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        }
+      },
+      "rolloutStage": "ga"
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "YgJ9ufYBTe171Q6VXTvFwsf3W/dMZjVDIU/nseT+uefBcFZPLTafoPhcQO67+OmvGfJpGsjmCXDhsxDGpkNsCQ=="
+    "signature": "LXmoj/aIGw51dU0im6l/Ld9lU+rDE+qk0DV2OU4Yl1GpVlBhRpDx8pF5w77ihyNuj0S4z8hkFCjZVIK7Zm+AAQ=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-07-30T11:42:15.564Z",
-  "manifest_sha256": "e29e4f05c270765128bbc6f21092a966352f089db6b7364ea7e03838f279285f",
-  "package_version": "0.9.359"
+  "verified_at": "2026-08-06T14:27:17.876Z",
+  "manifest_sha256": "ad6a43182c45556c9b401c9f40ea9127c0e107f28d55bc0895a55aac501b863b",
+  "package_version": "0.9.361"
 }

package/dist/{active-agent-Y3DCBD7J.js → active-agent-5RXOXM47.js}

@@ -5,21 +5,22 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-WRP5AG4D.js";
+} from "./chunk-AUSKITKI.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-EA5FVACM.js";
-import "./chunk-2I23RPSI.js";
-import "./chunk-5YEUPUV4.js";
-import "./chunk-Z2PAVJJ4.js";
-import "./chunk-OMXJMOBD.js";
+import "./chunk-ESGLOI6Q.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
-import "./chunk-YMUZWC33.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-PRJBAIHV.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-BRZR76TS.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-BCZF3AGJ.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {
   cleanupSessionMarkers,

package/dist/{active-agent-DMKNHGSG.js → active-agent-UZAQUW7E.js}

@@ -6,21 +6,22 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-WRP5AG4D.js";
+} from "./chunk-AUSKITKI.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-EA5FVACM.js";
-import "./chunk-2I23RPSI.js";
-import "./chunk-5YEUPUV4.js";
-import "./chunk-Z2PAVJJ4.js";
-import "./chunk-OMXJMOBD.js";
+import "./chunk-ESGLOI6Q.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
-import "./chunk-YMUZWC33.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-PRJBAIHV.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-BRZR76TS.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-BCZF3AGJ.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {
   cleanupSessionMarkers,

package/dist/{agentic-ontology-3233PNKV.js → agentic-ontology-EHUWSJCG.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-BGYCUZYK.js";
+} from "./chunk-3NPMPEAC.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,

package/dist/{backfill-gate-DA7UT6UD.js → backfill-gate-LRX77SUD.js}

@@ -5,9 +5,10 @@ import {
   backfillKillSwitchEnabled,
   computeBackfillDisabled,
   countActionableNullVectors
-} from "./chunk-QX7RWICL.js";
-import "./chunk-BCZF3AGJ.js";
+} from "./chunk-PU7UYQRC.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {
   NOT_PARKED_SQL,

package/dist/{backfill-metadata-4DS4A5U3.js → backfill-metadata-CTSVPOC6.js}

@@ -2,11 +2,11 @@
 import {
   disposeStore,
   initStore
-} from "./chunk-W5YV2PZE.js";
-import "./chunk-ZMYXQU4L.js";
+} from "./chunk-GWBD5P7E.js";
+import "./chunk-STDYMMOX.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-FVWI2AR4.js";
+import "./chunk-LRSBJCDL.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
@@ -15,22 +15,23 @@ import {
   getClient,
   getEmployeeNamesByRole,
   loadEmployeesSync
-} from "./chunk-EA5FVACM.js";
-import "./chunk-2I23RPSI.js";
-import "./chunk-5YEUPUV4.js";
-import "./chunk-Z2PAVJJ4.js";
-import "./chunk-OMXJMOBD.js";
+} from "./chunk-ESGLOI6Q.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
-import "./chunk-YMUZWC33.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-PRJBAIHV.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-BRZR76TS.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-QWVXN224.js";
-import "./chunk-BCZF3AGJ.js";
+import "./chunk-HPXFKUGU.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
 // src/bin/backfill-metadata.ts

package/dist/{background-jobs-XGTLESKM.js → background-jobs-Z6KHCWES.js}

@@ -9,9 +9,10 @@ import {
   releaseJobLock,
   reniceCurrentProcess,
   startManagedJob
-} from "./chunk-YEOIPUFO.js";
-import "./chunk-BCZF3AGJ.js";
+} from "./chunk-ZR4CQBAP.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {
   acquireJobLock,

package/dist/{backup-verify-JNYKXIU2.js → backup-verify-YJMSP24E.js}

@@ -4,10 +4,11 @@ import {
 import {
   getLatestBackup,
   reasonFromBackupName
-} from "./chunk-Z2PAVJJ4.js";
-import "./chunk-YMUZWC33.js";
-import "./chunk-BCZF3AGJ.js";
+} from "./chunk-PRJBAIHV.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
 // src/lib/backup-verify.ts
@@ -300,7 +301,7 @@ async function compareToLive(name, gotCounts, opts) {
 }
 async function recordVerdict(res) {
   try {
-    const { recordDbRestoreEvent } = await import("./db-restore-events-ZLD2HRQV.js");
+    const { recordDbRestoreEvent } = await import("./db-restore-events-TFCZ4CPM.js");
     if (res.ok) {
       recordDbRestoreEvent({
         kind: "restore-verify-pass",

package/dist/{behavior-injection-CGAMI552.js → behavior-injection-DTFGF6DT.js}

@@ -1,31 +1,39 @@
 import {
   listBehaviors
-} from "./chunk-6LY3QSJA.js";
-import "./chunk-W5YV2PZE.js";
-import "./chunk-ZMYXQU4L.js";
+} from "./chunk-PE4DEYIW.js";
+import "./chunk-ZZEKOI2M.js";
+import "./chunk-QGGH7LOU.js";
+import "./chunk-GWBD5P7E.js";
+import "./chunk-STDYMMOX.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-FVWI2AR4.js";
+import "./chunk-LRSBJCDL.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
 import {
   incrementSkillUsage
-} from "./chunk-6WHYSLGF.js";
+} from "./chunk-J5QNK5VL.js";
+import "./chunk-6EM6USV7.js";
+import "./chunk-HISFWAAK.js";
+import "./chunk-NLEW62VC.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-EA5FVACM.js";
-import "./chunk-2I23RPSI.js";
-import "./chunk-5YEUPUV4.js";
-import "./chunk-Z2PAVJJ4.js";
-import "./chunk-OMXJMOBD.js";
+import "./chunk-ESGLOI6Q.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
-import "./chunk-YMUZWC33.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-PRJBAIHV.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-BRZR76TS.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-QWVXN224.js";
-import "./chunk-BCZF3AGJ.js";
+import "./chunk-HPXFKUGU.js";
+import "./chunk-QILQ5FCG.js";
+import "./chunk-ARX6TAGN.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
 // src/lib/behavior-injection.ts

package/dist/{behaviors-57AMN5IP.js → behaviors-XW7ZZKHF.js}

@@ -12,29 +12,37 @@ import {
   reactivateBehavior,
   storeBehavior,
   storeReflexBehavior
-} from "./chunk-6LY3QSJA.js";
-import "./chunk-W5YV2PZE.js";
-import "./chunk-ZMYXQU4L.js";
+} from "./chunk-PE4DEYIW.js";
+import "./chunk-ZZEKOI2M.js";
+import "./chunk-QGGH7LOU.js";
+import "./chunk-GWBD5P7E.js";
+import "./chunk-STDYMMOX.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-FVWI2AR4.js";
+import "./chunk-LRSBJCDL.js";
 import "./chunk-5MOYSU5A.js";
 import "./chunk-4QCFFW2H.js";
 import "./chunk-76CJBM36.js";
+import "./chunk-6EM6USV7.js";
+import "./chunk-HISFWAAK.js";
+import "./chunk-NLEW62VC.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-EA5FVACM.js";
-import "./chunk-2I23RPSI.js";
-import "./chunk-5YEUPUV4.js";
-import "./chunk-Z2PAVJJ4.js";
-import "./chunk-OMXJMOBD.js";
+import "./chunk-ESGLOI6Q.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
-import "./chunk-YMUZWC33.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-PRJBAIHV.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-BRZR76TS.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-QWVXN224.js";
-import "./chunk-BCZF3AGJ.js";
+import "./chunk-HPXFKUGU.js";
+import "./chunk-QILQ5FCG.js";
+import "./chunk-ARX6TAGN.js";
+import "./chunk-BRIZ6OZ3.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {
   GHOST_BEHAVIOR_SQL,

package/dist/bin/age-ontology-load.js

@@ -5,9 +5,10 @@ import {
 import {
   politeBatchPause,
   startManagedJob
-} from "../chunk-YEOIPUFO.js";
-import "../chunk-BCZF3AGJ.js";
+} from "../chunk-ZR4CQBAP.js";
+import "../chunk-BRIZ6OZ3.js";
 import "../chunk-HSGBZSCA.js";
+import "../chunk-JKKZGDLP.js";
 import "../chunk-MLKGABMK.js";
 
 // src/bin/age-ontology-load.ts