@askexenow/exe-os 0.9.365 → 0.9.368

package/dist/chunk-W5MCOZTW.js

@@ -0,0 +1,304 @@
+// src/lib/delivery-truth.ts
+var DIGEST_RE = /@(sha256:[0-9a-f]{64})\b/i;
+function parseDigest(ref) {
+  const m = DIGEST_RE.exec(ref ?? "");
+  return m?.[1] ? m[1].toLowerCase() : null;
+}
+function repositoryKey(ref) {
+  const withoutDigest = (ref ?? "").split("@")[0] ?? "";
+  const withoutTag = withoutDigest.replace(/:[^/:]+$/, "");
+  const segments = withoutTag.split("/").filter(Boolean);
+  return segments[segments.length - 1] ?? withoutTag;
+}
+function compareLiveArtifacts(running, declared, options) {
+  const declaredByDigest = /* @__PURE__ */ new Map();
+  const declaredByRepo = /* @__PURE__ */ new Map();
+  for (const d of declared) {
+    if (d.digest) declaredByDigest.set(d.digest.toLowerCase(), d);
+    declaredByRepo.set(repositoryKey(d.ref), d);
+  }
+  const entries = [];
+  const matchedDeclared = /* @__PURE__ */ new Set();
+  for (const r of running) {
+    const digest = r.digest ?? parseDigest(r.ref);
+    const repo = repositoryKey(r.ref);
+    const runningSide = { ref: r.ref, digest, containers: r.containers };
+    if (digest && declaredByDigest.has(digest)) {
+      const d = declaredByDigest.get(digest);
+      matchedDeclared.add(d.service);
+      entries.push({
+        service: d.service,
+        verdict: "agrees",
+        channel: d.channel,
+        running: runningSide,
+        declared: { ref: d.ref, digest: d.digest },
+        detail: `running digest is the digest the signed manifest pins`
+      });
+      continue;
+    }
+    const byRepo = declaredByRepo.get(repo);
+    if (byRepo) {
+      matchedDeclared.add(byRepo.service);
+      if (!digest) {
+        entries.push({
+          service: byRepo.service,
+          verdict: "unknown-provenance",
+          channel: byRepo.channel,
+          running: runningSide,
+          declared: { ref: byRepo.ref, digest: byRepo.digest },
+          detail: `running ref "${r.ref}" carries no resolvable digest, so what is running cannot be traced to any published artifact \u2014 it cannot be shown to match or to differ from the manifest pin`
+        });
+        continue;
+      }
+      entries.push({
+        service: byRepo.service,
+        verdict: "disagrees",
+        channel: byRepo.channel,
+        running: runningSide,
+        declared: { ref: byRepo.ref, digest: byRepo.digest },
+        detail: `running ${digest} but the signed manifest pins ${byRepo.digest ?? "(no digest)"} \u2014 production is not the artifact we signed`
+      });
+      continue;
+    }
+    if (!digest) {
+      entries.push({
+        service: repo,
+        verdict: "unknown-provenance",
+        channel: "signed-manifest",
+        running: runningSide,
+        detail: `running ref "${r.ref}" carries no resolvable digest and matches no declared repository \u2014 provenance unknown`
+      });
+      continue;
+    }
+    entries.push({
+      service: repo,
+      verdict: "undeclared",
+      channel: "signed-manifest",
+      running: runningSide,
+      detail: `running ${digest} under repository "${repo}", which the signed manifest does not declare at all \u2014 this artifact is outside the release contract`
+    });
+  }
+  if (options?.reportNotRunning) {
+    for (const d of declared) {
+      if (matchedDeclared.has(d.service)) continue;
+      entries.push({
+        service: d.service,
+        verdict: "not-running",
+        channel: d.channel,
+        declared: { ref: d.ref, digest: d.digest },
+        detail: `declared and pinned, but no running artifact in the inspected inventory carries this digest or repository`
+      });
+    }
+  }
+  const counts = {
+    agrees: 0,
+    disagrees: 0,
+    undeclared: 0,
+    "unknown-provenance": 0,
+    "not-running": 0
+  };
+  for (const e of entries) counts[e.verdict]++;
+  return {
+    entries,
+    findings: entries.filter((e) => e.verdict !== "agrees"),
+    counts,
+    inventory: {
+      runningArtifacts: running.length,
+      declaredArtifacts: declared.length,
+      source: options?.source ?? "unspecified"
+    }
+  };
+}
+function declaredArtifactsFromManifest(manifest, options) {
+  const m = manifest;
+  if (!m || typeof m !== "object" || !m.stacks) {
+    throw new Error("manifest has no `stacks` object");
+  }
+  const version = options?.stackVersion ?? m.latest;
+  if (!version) throw new Error("manifest has no `latest` and no stack version was given");
+  const stack = m.stacks[version];
+  if (!stack?.services) throw new Error(`manifest stack "${version}" is missing or has no services`);
+  const out = [];
+  for (const [service, svc] of Object.entries(stack.services)) {
+    const ref = typeof svc?.image === "string" ? svc.image : "";
+    if (!ref) continue;
+    out.push({ service, ref, digest: parseDigest(ref), channel: "signed-manifest" });
+  }
+  return out;
+}
+function evaluateDeliveryChannels(input) {
+  const { detected, registry, npmFiles } = input;
+  const normalizedFiles = npmFiles.map((f) => f.replace(/^\.\//, "").replace(/\/+$/, ""));
+  const covered = (p) => {
+    const path = p.replace(/^\.\//, "").replace(/\/+$/, "");
+    return normalizedFiles.some((f) => f === path || path.startsWith(`${f}/`));
+  };
+  const out = [];
+  for (const d of detected) {
+    const channel = registry[d.path] ?? null;
+    if (!channel) {
+      out.push({
+        path: d.path,
+        channel: null,
+        verdict: "unclassified",
+        detail: `${d.path} is deployable (${d.evidence}) but declares no delivery channel. Nothing can say whether a change here reaches a customer.`
+      });
+      continue;
+    }
+    if (channel === "no-release-path") {
+      out.push({
+        path: d.path,
+        channel,
+        verdict: "no-release-path",
+        detail: `${d.path} has NO delivery path. Merging here delivers nothing to anyone.`
+      });
+      continue;
+    }
+    if (channel === "not-shipped") {
+      out.push({
+        path: d.path,
+        channel,
+        verdict: "not-shipped",
+        detail: `${d.path} ships nowhere itself. A change here reaches a customer only once it is vendored into a consuming artifact AND that artifact is rebuilt.`
+      });
+      continue;
+    }
+    if (channel === "npm" && !covered(d.path)) {
+      out.push({
+        path: d.path,
+        channel,
+        verdict: "undelivered",
+        detail: `${d.path} declares the npm channel but is not covered by package.json \`files\`, so it is in the git tag and ABSENT from the published tarball. Tag ancestry is not proof of delivery.`
+      });
+      continue;
+    }
+    out.push({
+      path: d.path,
+      channel,
+      verdict: "delivered",
+      detail: `${d.path} ships via ${channel}`
+    });
+  }
+  return out;
+}
+var GATE_COOKIE_RE = /\bexe_[a-z0-9_]*token[a-z0-9_]*\b/gi;
+function extractGateCookieNames(html) {
+  const found = /* @__PURE__ */ new Set();
+  for (const m of (html ?? "").matchAll(GATE_COOKIE_RE)) found.add(m[0].toLowerCase());
+  return [...found].sort();
+}
+function evaluateAnonymousGate(input) {
+  const { service, url, html, setterNames } = input;
+  const gateCookies = extractGateCookieNames(html);
+  if (gateCookies.length === 0) {
+    return {
+      service,
+      url,
+      status: "no-client-gate",
+      gateCookies,
+      detail: `no SSO-shaped cookie name in the served document \u2014 this product does not gate client-side (it may bridge server-side, which is correct)`
+    };
+  }
+  const setters = new Set(setterNames.map((s) => s.toLowerCase()));
+  if (setters.size === 0) {
+    return {
+      service,
+      url,
+      status: "inconclusive",
+      gateCookies,
+      detail: `the auth origin exposed no cookie name, so there is nothing to compare against. The probe cannot answer the question \u2014 fix the probe or the auth surface. This is NOT a pass.`
+    };
+  }
+  const unsatisfiable = gateCookies.filter((c) => !setters.has(c));
+  if (unsatisfiable.length === gateCookies.length) {
+    return {
+      service,
+      url,
+      status: "unsatisfiable",
+      gateCookies,
+      detail: `gates on ${unsatisfiable.join(", ")}, which NO origin in the live auth flow sets (auth hands out: ${[...setters].sort().join(", ")}). Every visitor bounces between this product and auth forever. The served page answers HTTP 200 with zero redirects because the loop is client-side, so a status-code check sees a healthy service.`
+    };
+  }
+  return {
+    service,
+    url,
+    status: "satisfiable",
+    gateCookies,
+    detail: `gates on ${gateCookies.join(", ")}; the live auth flow sets a matching name`
+  };
+}
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var DEPARTMENT_RE = /^(the\s+)?(team|eng|engineering|ops|devops|sre|infra|platform|everyone|tbd|unknown|n\/?a)$/i;
+function applyLivenessAcks(input) {
+  const { findingKeys, acks, now } = input;
+  const present = new Set(findingKeys);
+  const evaluations = [];
+  const suppressed = /* @__PURE__ */ new Set();
+  for (const ack of acks) {
+    const missing = [];
+    if (!ack?.key) missing.push("key");
+    const owner = (ack?.owner ?? "").trim();
+    if (owner.length < 2) missing.push("owner");
+    else if (DEPARTMENT_RE.test(owner)) missing.push("owner (a person, not a team)");
+    if (!ack?.bug) missing.push("bug");
+    if (!ack?.expires || !ISO_DATE_RE.test(ack.expires)) missing.push("expires (YYYY-MM-DD)");
+    if (missing.length > 0) {
+      evaluations.push({
+        ack,
+        state: "invalid",
+        detail: `ack for "${ack?.key ?? "(no key)"}" is missing ${missing.join(", ")} \u2014 it suppresses nothing. An ack needs a person who defends it and a tracked fix, or it is just a mute.`
+      });
+      continue;
+    }
+    const expiry = /* @__PURE__ */ new Date(`${ack.expires}T23:59:59Z`);
+    if (Number.isNaN(expiry.getTime()) || expiry.getTime() < now.getTime()) {
+      evaluations.push({
+        ack,
+        state: "expired",
+        detail: `ack for "${ack.key}" expired on ${ack.expires} (owner: ${ack.owner}, bug: ${ack.bug}). The finding is failing again, and the lapsed ack is itself a failure. Fix it or re-ack with a new date and a reason.`
+      });
+      continue;
+    }
+    if (!present.has(ack.key)) {
+      evaluations.push({
+        ack,
+        state: "stale",
+        detail: `ack for "${ack.key}" (owner: ${ack.owner}) suppresses a finding that is no longer present. Delete it \u2014 a suppression list that only grows becomes a permanent allow-list.`
+      });
+      continue;
+    }
+    suppressed.add(ack.key);
+  }
+  return {
+    failing: findingKeys.filter((k) => !suppressed.has(k)),
+    acknowledged: [...suppressed],
+    ackProblems: evaluations
+  };
+}
+function findingKey(f) {
+  return `${f.service}:${f.verdict}`;
+}
+function deliveryStateOf(report) {
+  return report.entries.map((e) => ({
+    service: e.service,
+    channel: e.channel,
+    delivered: e.verdict === "agrees" ? true : e.verdict === "unknown-provenance" ? null : false,
+    liveIdentity: e.running?.digest ?? e.running?.ref ?? null,
+    declaredIdentity: e.declared?.digest ?? e.declared?.ref ?? null,
+    verdict: e.verdict,
+    detail: e.detail
+  }));
+}
+
+export {
+  parseDigest,
+  repositoryKey,
+  compareLiveArtifacts,
+  declaredArtifactsFromManifest,
+  evaluateDeliveryChannels,
+  extractGateCookieNames,
+  evaluateAnonymousGate,
+  applyLivenessAcks,
+  findingKey,
+  deliveryStateOf
+};

package/dist/{chunk-2ESB5SDP.js → chunk-WJOJWRN5.js}

@@ -5,6 +5,9 @@ import {
   supportTaskIdSchema,
   supportVersionSchema
 } from "./chunk-5H47VHB7.js";
+import {
+  buildVerificationArtifact
+} from "./chunk-KZXMP6JG.js";
 import {
   SUPPORT_PRODUCTS,
   sanitizeProductFilter,
@@ -14,16 +17,88 @@ import {
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-ZDUO6QBH.js";
+} from "./chunk-6UZ3DEQI.js";
 
 // src/mcp/tools/support-inbox.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 import { readFileSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
+
+// src/lib/support-verification-input.ts
+import { z } from "zod";
+function isVerifiedStatus(status) {
+  return status === "fixed" || status === "closed";
+}
+var verificationArtifactInputSchema = {
+  verification_kind: z.enum(["regression_test", "manual"]).optional().describe(
+    "REQUIRED to set status=fixed or closed. 'regression_test' when you actually RAN a test that fails at the parent commit and passes at the fix. 'manual' when a named person reproduced the original defect and confirmed it is gone."
+  ),
+  fix_commit: supportCommitSchema.optional().describe("SHA of the merged commit containing the fix. Its diff is measured locally \u2014 a comment-only or test-only commit is refused."),
+  repo_path: z.string().optional().describe("Absolute path to the repository containing fix_commit. Required when the fix landed outside the current working repo (e.g. exe-gateway, exe-crm). Defaults to the current directory."),
+  regression_test_id: z.string().optional().describe("regression_test only: the test that detects the defect, e.g. 'tests/raw-event-backlog.test.ts::counts unprocessed events'."),
+  parent_result: z.enum(["fail", "pass", "error"]).optional().describe("regression_test only: the result you OBSERVED running that test at the parent commit. Must be 'fail' \u2014 a test that already passed does not detect the defect."),
+  fix_result: z.enum(["fail", "pass", "error"]).optional().describe("regression_test only: the result you OBSERVED running that test at the fix commit. Must be 'pass'."),
+  verifier: z.string().optional().describe("manual only: the identity of the person or employee who confirmed the defect is gone. Checked server-side against the bug's filer and assignee \u2014 it may not be either. Placeholders ('me', 'agent') are refused."),
+  verification_method: z.string().optional().describe("manual only: how it was verified, in enough detail for someone else to repeat it."),
+  verification_observation: z.string().optional().describe("manual only: what was observed that shows the DEFECT IS ABSENT \u2014 not what the change did. 'It is fixed' is refused."),
+  delivery_proof: z.string().optional().describe('Optional JSON delivery declaration, e.g. {"channel":"npm","version":"0.9.364","tarball_shasum":"\u2026","fix_path_published":true}. Recorded, not required \u2014 delivery does not gate closing. A declaration that is present must still be true.')
+};
+var NO_ARTIFACT_HELP = [
+  "Refused locally: setting status=fixed or closed requires evidence that the defect is ABSENT.",
+  "",
+  "Supply ONE of:",
+  "  regression_test \u2014 verification_kind='regression_test', fix_commit, repo_path,",
+  "      regression_test_id, parent_result (must be the result you observed at the parent),",
+  "      fix_result. Use this when you actually ran the test at both commits.",
+  "  manual \u2014 verification_kind='manual', fix_commit, repo_path, verifier (a real identity,",
+  "      not the bug's filer or assignee), verification_method, verification_observation",
+  "      describing what you saw that shows the defect is gone.",
+  "",
+  "The fix commit's diff is measured from the repository; substance is never taken from the caller.",
+  "If you have not verified the defect is absent, do not close it \u2014 record what you found with notes instead."
+].join("\n");
+function resolveVerificationArtifact(status, input, context = {}) {
+  if (!isVerifiedStatus(status)) return { ok: true };
+  if (!input.verification_kind && !input.fix_commit) {
+    return { ok: false, message: NO_ARTIFACT_HELP };
+  }
+  if (!input.verification_kind) {
+    return { ok: false, message: "verification_kind is required (regression_test or manual) when setting status=fixed or closed." };
+  }
+  if (!input.fix_commit) {
+    return { ok: false, message: "fix_commit is required when setting status=fixed or closed \u2014 the diff is measured, not described." };
+  }
+  const request = {
+    kind: input.verification_kind,
+    fix_commit: input.fix_commit,
+    repo_path: input.repo_path?.trim() || process.cwd(),
+    test_id: input.regression_test_id,
+    parent_result: input.parent_result,
+    fix_result: input.fix_result,
+    verifier: input.verifier,
+    method: input.verification_method,
+    observation: input.verification_observation
+  };
+  const built = buildVerificationArtifact(request, context);
+  if (!built.ok) {
+    return { ok: false, message: `Refused locally [${built.code}]: ${built.message}` };
+  }
+  return { ok: true, artifact: built.artifact };
+}
+function parseDeliveryProof(raw) {
+  if (raw === void 0 || !raw.trim()) return { ok: true };
+  try {
+    return { ok: true, value: JSON.parse(raw) };
+  } catch {
+    return { ok: false, message: "delivery_proof must be valid JSON (or omitted \u2014 delivery does not gate closing)." };
+  }
+}
+
+// src/mcp/tools/support-inbox.ts
 var DEFAULT_ENDPOINT = "https://api.askexe.com/admin/support/bug-reports";
 var DEFAULT_OWNER_ENDPOINT = "https://api.askexe.com/v1/support/bug-reports";
-var STATUS = z.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
+var STATUS = z2.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
 var SupportHttpError = class extends Error {
   constructor(status, message) {
     super(message);
@@ -158,13 +233,13 @@ function registerListBugReports(server) {
       title: "List Bug Reports",
       description: "AskExe-internal only: list incoming customer bug reports from the support inbox.",
       inputSchema: {
-        status: z.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
-        severity: z.enum(["p0", "p1", "p2", "p3"]).optional(),
+        status: z2.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
+        severity: z2.enum(["p0", "p1", "p2", "p3"]).optional(),
         // Round 8: constrain to the known enum at the schema — a `product` filter is
         // NOT free text, and it was sent raw as a query param.
-        product: z.enum(SUPPORT_PRODUCTS).optional().describe("Filter by product"),
-        limit: z.number().int().min(1).max(500).default(25),
-        offset: z.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
+        product: z2.enum(SUPPORT_PRODUCTS).optional().describe("Filter by product"),
+        limit: z2.number().int().min(1).max(500).default(25),
+        offset: z2.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
       }
     },
     async ({ status, severity, product, limit, offset }) => {
@@ -215,7 +290,7 @@ function registerAddBugReportComment(server) {
       description: "AskExe-internal only: append a comment to a bug report's thread (POST /comments). Non-destructive \u2014 does not touch triage_notes or status.",
       inputSchema: {
         id: supportIdSchema,
-        comment: z.string().min(1).describe("Comment text to append to the bug report thread")
+        comment: z2.string().min(1).describe("Comment text to append to the bug report thread")
       }
     },
     async ({ id, comment }) => {
@@ -246,22 +321,50 @@ function registerTriageBugReport(server) {
     "triage_bug_report",
     {
       title: "Triage Bug Report",
-      description: "AskExe-internal only: update bug report status and link task/commit/release metadata.",
+      description: "AskExe-internal only: update bug report status and link task/commit/release metadata. Setting status=fixed or closed requires a verification artifact (verification_kind + fix_commit + either the regression-test fields or the manual verifier fields); the fix commit's diff is measured locally.",
       inputSchema: {
         id: supportIdSchema,
         status: STATUS.optional(),
-        triage_notes: z.string().optional(),
-        add_note: z.string().optional().describe("Append a timestamped progress note without changing status or replacing triage_notes"),
+        triage_notes: z2.string().optional(),
+        add_note: z2.string().optional().describe("Append a timestamped progress note without changing status or replacing triage_notes"),
         linked_task_id: supportTaskIdSchema.optional(),
         linked_commit: supportCommitSchema.optional(),
         fixed_version: supportVersionSchema.optional(),
-        product: supportProductSchema.optional().describe("Re-label this bug's product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp")
+        product: supportProductSchema.optional().describe("Re-label this bug's product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        ...verificationArtifactInputSchema
       }
     },
-    async ({ id, status, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product }) => {
-      const data = await requestJson(`${endpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`, {
+    async ({ id, status, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product, ...verification }) => {
+      const bugUrl = `${endpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`;
+      let authorIdentities = [];
+      if (isVerifiedStatus(status) && verification.verification_kind === "manual") {
+        try {
+          const row = await requestJson(bugUrl);
+          authorIdentities = [row?.agent_id, row?.license_email];
+        } catch {
+        }
+      }
+      const resolved = resolveVerificationArtifact(status, verification, { authorIdentities });
+      if (!resolved.ok) {
+        return { isError: true, content: [{ type: "text", text: resolved.message }] };
+      }
+      const delivery = parseDeliveryProof(verification.delivery_proof);
+      if (!delivery.ok) {
+        return { isError: true, content: [{ type: "text", text: delivery.message }] };
+      }
+      const data = await requestJson(bugUrl, {
         method: "PATCH",
-        body: sanitizedUpstreamBody({ status, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product }, "support-inbox:triage_bug")
+        body: sanitizedUpstreamBody({
+          status,
+          triage_notes,
+          add_note,
+          linked_task_id,
+          linked_commit,
+          fixed_version,
+          product,
+          verification_artifact: resolved.artifact,
+          delivery_proof: delivery.value
+        }, "support-inbox:triage_bug")
       });
       const response = fixed_version && !status ? withStatusNotice(
         data,
@@ -271,7 +374,7 @@ function registerTriageBugReport(server) {
     }
   );
 }
-var FEATURE_STATUS = z.enum(["open", "planned", "in_progress", "shipped", "closed", "wontdo"]);
+var FEATURE_STATUS = z2.enum(["open", "planned", "in_progress", "shipped", "closed", "wontdo"]);
 function featureEndpoint() {
   return endpoint().replace(/\/bug-reports\/?$/, "/feature-requests");
 }
@@ -285,11 +388,11 @@ function registerListFeatureRequests(server) {
       title: "List Feature Requests",
       description: "AskExe-internal only: list incoming customer feature requests from the support inbox.",
       inputSchema: {
-        status: z.enum(["all", "open", "planned", "in_progress", "shipped", "closed", "wontdo"]).default("open"),
-        priority: z.enum(["p0", "p1", "p2", "p3"]).optional(),
-        product: z.string().optional().describe("Filter by product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
-        limit: z.number().int().min(1).max(500).default(25),
-        offset: z.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
+        status: z2.enum(["all", "open", "planned", "in_progress", "shipped", "closed", "wontdo"]).default("open"),
+        priority: z2.enum(["p0", "p1", "p2", "p3"]).optional(),
+        product: z2.string().optional().describe("Filter by product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        limit: z2.number().int().min(1).max(500).default(25),
+        offset: z2.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
       }
     },
     async ({ status, priority, product, limit, offset }) => {
@@ -328,8 +431,8 @@ function registerTriageFeatureRequest(server) {
       inputSchema: {
         id: supportIdSchema,
         status: FEATURE_STATUS.optional(),
-        response_notes: z.string().optional(),
-        add_note: z.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
+        response_notes: z2.string().optional(),
+        add_note: z2.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
         target_version: supportVersionSchema.optional(),
         shipped_version: supportVersionSchema.optional(),
         // bug b8e990ed: allow admin re-label of a feature's product. Typed with the
@@ -350,7 +453,7 @@ function registerTriageFeatureRequest(server) {
     }
   );
 }
-var REVIEW_STATUS = z.enum(["open", "in_review", "approved", "merged", "closed", "rejected"]);
+var REVIEW_STATUS = z2.enum(["open", "in_review", "approved", "merged", "closed", "rejected"]);
 function reviewEndpoint() {
   return endpoint().replace(/\/bug-reports\/?$/, "/reviews");
 }
@@ -361,10 +464,10 @@ function registerListReviews(server) {
       title: "List Reviews",
       description: "AskExe-internal only: list incoming review requests from the support inbox.",
       inputSchema: {
-        status: z.enum(["all", "open", "in_review", "approved", "merged", "closed", "rejected"]).default("open"),
-        priority: z.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z.number().int().min(1).max(500).default(25),
-        offset: z.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
+        status: z2.enum(["all", "open", "in_review", "approved", "merged", "closed", "rejected"]).default("open"),
+        priority: z2.enum(["p0", "p1", "p2", "p3"]).optional(),
+        limit: z2.number().int().min(1).max(500).default(25),
+        offset: z2.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
       }
     },
     async ({ status, priority, limit, offset }) => {
@@ -401,10 +504,10 @@ function registerTriageReview(server) {
       inputSchema: {
         id: supportIdSchema,
         status: REVIEW_STATUS.optional(),
-        response_notes: z.string().optional(),
-        add_note: z.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
-        resolution: z.string().optional(),
-        pr_url: z.string().optional()
+        response_notes: z2.string().optional(),
+        add_note: z2.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
+        resolution: z2.string().optional(),
+        pr_url: z2.string().optional()
       }
     },
     async ({ id, status, response_notes, add_note, resolution, pr_url }) => {
@@ -418,6 +521,9 @@ function registerTriageReview(server) {
 }
 
 export {
+  verificationArtifactInputSchema,
+  resolveVerificationArtifact,
+  parseDeliveryProof,
   registerListBugReports,
   registerGetBugReport,
   registerAddBugReportComment,

package/dist/{chunk-CPILYY2K.js → chunk-X4MRVNR3.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-3NBWARKC.js";
+} from "./chunk-SXAERZL2.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-EPDNWY5P.js → chunk-XBTQPQN7.js}

@@ -351,7 +351,7 @@ async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
   await new Promise((resolve) => server.listen(options.port, options.host, resolve));
   console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
   console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
-  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-FBCMPC4J.js");
+  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-5VE5OSTV.js");
   const syncConfig = licenseSyncConfigFromEnv();
   if (syncConfig) {
     startLicenseSyncScheduler(syncConfig);