@askexenow/exe-os 0.9.372 → 0.9.374

package/dist/{org-key-pin-5WUSPGVN.js → org-key-pin-WHWHVWUO.js}

@@ -12,12 +12,13 @@ import {
   pinnedOrgIds,
   readOrgKeyPin,
   unpinOrgKey
-} from "./chunk-H37FSTF2.js";
+} from "./chunk-UBMZ3YQU.js";
 import "./chunk-MPVXHYD5.js";
-import "./chunk-JTB5V6BV.js";
+import "./chunk-3SXHEQ7X.js";
 import "./chunk-HPXFKUGU.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{org-membership-ESALTLLN.js → org-membership-WRT2IHJK.js}

@@ -12,13 +12,14 @@ import {
   orgModeActive,
   readActiveOrgMemberships,
   upsertOrgMembership
-} from "./chunk-CW2UCKHS.js";
-import "./chunk-VV5EZZNT.js";
-import "./chunk-JTB5V6BV.js";
+} from "./chunk-TADAO3HV.js";
+import "./chunk-HTBEVCO2.js";
+import "./chunk-3SXHEQ7X.js";
 import "./chunk-EEZOBN6X.js";
 import "./chunk-HPXFKUGU.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{org-partner-config-YKHPDPZR.js → org-partner-config-B7T4CL2T.js}

@@ -4,16 +4,17 @@ import {
   resolveOrgPartnerBindings,
   resolvePartnerIdentities,
   rosterKeyLookupFor
-} from "./chunk-PVEM537A.js";
-import "./chunk-H37FSTF2.js";
+} from "./chunk-4YLBKEL5.js";
+import "./chunk-UBMZ3YQU.js";
 import "./chunk-MPVXHYD5.js";
-import "./chunk-CW2UCKHS.js";
-import "./chunk-VV5EZZNT.js";
-import "./chunk-JTB5V6BV.js";
+import "./chunk-TADAO3HV.js";
+import "./chunk-HTBEVCO2.js";
+import "./chunk-3SXHEQ7X.js";
 import "./chunk-EEZOBN6X.js";
 import "./chunk-HPXFKUGU.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{org-partner-runtime-UJDGECZ4.js → org-partner-runtime-FODONVTM.js}

@@ -5,33 +5,34 @@ import {
   initOrgPartnerRuntime,
   orgPartnerRuntimeStatus,
   stopOrgPartnerRuntime
-} from "./chunk-VX2F4ZUY.js";
+} from "./chunk-6SCGLHJ7.js";
 import "./chunk-A6PDF4BO.js";
-import "./chunk-YFCNWQAM.js";
-import "./chunk-PVEM537A.js";
-import "./chunk-H37FSTF2.js";
-import "./chunk-RUVO3NJC.js";
+import "./chunk-DJOIMFKV.js";
+import "./chunk-4YLBKEL5.js";
+import "./chunk-UBMZ3YQU.js";
+import "./chunk-IN6CAM4F.js";
 import "./chunk-MPVXHYD5.js";
 import "./chunk-5OPAUFLP.js";
 import "./chunk-4LWBC7CM.js";
-import "./chunk-CW2UCKHS.js";
-import "./chunk-VV5EZZNT.js";
-import "./chunk-JTB5V6BV.js";
+import "./chunk-TADAO3HV.js";
+import "./chunk-HTBEVCO2.js";
+import "./chunk-3SXHEQ7X.js";
 import "./chunk-EEZOBN6X.js";
 import "./chunk-WT4RI36X.js";
-import "./chunk-5DCCKHDY.js";
-import "./chunk-TKDITWDN.js";
+import "./chunk-TAMDAOCU.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-UTDMTQNH.js";
+import "./chunk-DSJI76XL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-HPXFKUGU.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{org-row-visibility-V5DXIHTE.js → org-row-visibility-VX4AVV5Q.js}

@@ -5,7 +5,7 @@ import {
   mintOrgOriginStamp,
   orgOriginOf,
   resolveRowVisibility
-} from "./chunk-44C7QNZS.js";
+} from "./chunk-3KDCORDO.js";
 import "./chunk-WT4RI36X.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{pipeline-router-YY5FQKTY.js → pipeline-router-6GGT2ZW3.js}

@@ -1,18 +1,19 @@
 import {
   ingest
-} from "./chunk-TK4MI6F6.js";
-import "./chunk-5DCCKHDY.js";
-import "./chunk-TKDITWDN.js";
+} from "./chunk-YSLGFPWX.js";
+import "./chunk-TAMDAOCU.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-UTDMTQNH.js";
+import "./chunk-DSJI76XL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{plan-limits-OVX6SN6B.js → plan-limits-FUN76LYY.js}

@@ -6,22 +6,23 @@ import {
   assertMemoryLimit,
   countActiveMemories,
   getLicenseSync
-} from "./chunk-HIIXCAEE.js";
-import "./chunk-5DCCKHDY.js";
-import "./chunk-TKDITWDN.js";
+} from "./chunk-6YVUR3OU.js";
+import "./chunk-TAMDAOCU.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-UTDMTQNH.js";
+import "./chunk-DSJI76XL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-DKBPCOU4.js";
+import "./chunk-L6RXG36J.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GB3AHV5F.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-GQOEWNVM.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{platform-procedures-I57ITMDC.js → platform-procedures-7YSCLF4Z.js}

@@ -3,7 +3,7 @@ import {
   PLATFORM_PROCEDURE_TITLES,
   PLATFORM_REFERENCE_PROCEDURES,
   getPlatformReferenceMarkdown
-} from "./chunk-THIJIOE2.js";
+} from "./chunk-PY3FOMRN.js";
 import "./chunk-MLKGABMK.js";
 export {
   PLATFORM_PROCEDURES,

package/dist/{postinstall-failure-B2JHNFPM.js → postinstall-failure-O6TSSNJB.js}

@@ -5,9 +5,10 @@ import {
   postinstallFailureMarkerPath,
   readPostinstallFailureMarker,
   recordPostinstallFailure
-} from "./chunk-SBJV2PCU.js";
-import "./chunk-QMSEL5YS.js";
+} from "./chunk-PHBU4LGO.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{project-boot-LXLU2J32.js → project-boot-3Q65LCIP.js}

@@ -1,7 +1,8 @@
 import {
   EXE_AI_DIR
-} from "./chunk-QMSEL5YS.js";
+} from "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/project-name-LJVFMYTQ.js

@@ -0,0 +1,30 @@
+import {
+  _resetCache,
+  getProjectName,
+  isEphemeralWorktreeProject,
+  isPhantomSessionBucket,
+  resolveProjectName
+} from "./chunk-JTVIANUB.js";
+import "./chunk-GJV3WDWM.js";
+import "./chunk-TAMDAOCU.js";
+import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-DSJI76XL.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-NJFJWQNN.js";
+import "./chunk-V3W3SATA.js";
+import "./chunk-JY5GAZYC.js";
+import "./chunk-FXU7JOXK.js";
+import "./chunk-ZIG7VPJV.js";
+import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
+import "./chunk-JKKZGDLP.js";
+import "./chunk-MLKGABMK.js";
+export {
+  _resetCache,
+  getProjectName,
+  isEphemeralWorktreeProject,
+  isPhantomSessionBucket,
+  resolveProjectName
+};

package/dist/{projection-worker-D2472IOD.js → projection-worker-4OANGP5K.js}

@@ -5,14 +5,15 @@ import {
   inferOutcome,
   inferSemanticLabel,
   ontologyPayload
-} from "./chunk-VJSDGDNS.js";
+} from "./chunk-WSQASFLP.js";
 import {
   processCRMEvent
-} from "./chunk-ADNBOKYZ.js";
+} from "./chunk-GM7TLYOK.js";
 import {
   loadConfig
-} from "./chunk-QMSEL5YS.js";
+} from "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
@@ -613,7 +614,7 @@ async function pushToWikiApi(payload, _timestamp) {
     return false;
   }
   try {
-    const { createWikiClient, uploadDocumentToWiki } = await import("./wiki-client-AXNM5FWY.js");
+    const { createWikiClient, uploadDocumentToWiki } = await import("./wiki-client-W65IOSWF.js");
     const client = await createWikiClient();
     if (!client) return false;
     const rawText = String(payload.raw_text ?? "");

package/dist/{prospective-memory-JXO2A6PL.js → prospective-memory-KR3P4T6N.js}

@@ -1,17 +1,18 @@
 import {
   getClient
-} from "./chunk-5DCCKHDY.js";
-import "./chunk-TKDITWDN.js";
+} from "./chunk-TAMDAOCU.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-UTDMTQNH.js";
+import "./chunk-DSJI76XL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 

package/dist/{push-notifications-HR3FZRDI.js → push-notifications-NCZLH6DI.js}

@@ -3,57 +3,60 @@ import {
   loadPushConfig,
   pushNotify,
   pushNotifyAsync
-} from "./chunk-3KTQWMHI.js";
-import "./chunk-XHYHX6F7.js";
+} from "./chunk-JSMDRKPJ.js";
+import "./chunk-AKLQSC6W.js";
 import "./chunk-BTSWFMEH.js";
-import "./chunk-WAEKYKTK.js";
-import "./chunk-44C7QNZS.js";
-import "./chunk-JTWTBX2M.js";
+import "./chunk-6RKKVPYF.js";
+import "./chunk-4EN3IZ3Q.js";
 import "./chunk-KI5PFRG6.js";
+import "./chunk-3KDCORDO.js";
 import "./chunk-WT4RI36X.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-QAEWWYHL.js";
 import "./chunk-EIKATSE4.js";
-import "./chunk-MDGYXUOV.js";
-import "./chunk-GBNB4EWD.js";
-import "./chunk-UXLO7VHX.js";
-import "./chunk-DSOQUQTV.js";
-import "./chunk-E2WEFZOR.js";
+import "./chunk-MJCSEIFI.js";
+import "./chunk-XH7YL7JM.js";
+import "./chunk-ORM7ZFKC.js";
+import "./chunk-VI4ATC6I.js";
+import "./chunk-A27Q27CT.js";
+import "./chunk-W75GTHR3.js";
 import "./chunk-AJIXH5JF.js";
-import "./chunk-L6ZNURWN.js";
-import "./chunk-XTWHNLGD.js";
+import "./chunk-7GE2EQ23.js";
+import "./chunk-GZOG2MAX.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-HIIXCAEE.js";
+import "./chunk-6YVUR3OU.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-QZL6E4UB.js";
-import "./chunk-CDUB5Q6J.js";
-import "./chunk-UQUUNGTP.js";
-import "./chunk-IVU3WN7S.js";
-import "./chunk-RIECV7SR.js";
-import "./chunk-LNOS24GV.js";
+import "./chunk-GOMQ7PVQ.js";
+import "./chunk-4IK2K3B3.js";
+import "./chunk-NUK7EEN5.js";
+import "./chunk-ZG62LIK3.js";
+import "./chunk-EKYYMIVT.js";
 import "./chunk-NLEW62VC.js";
-import "./chunk-W2IRQJ6R.js";
+import "./chunk-SLLLOOEI.js";
+import "./chunk-V3WLC5TJ.js";
+import "./chunk-JTVIANUB.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-5DCCKHDY.js";
-import "./chunk-TKDITWDN.js";
+import "./chunk-TAMDAOCU.js";
 import "./chunk-BBMTVAE3.js";
+import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-UTDMTQNH.js";
+import "./chunk-DSJI76XL.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-DKBPCOU4.js";
+import "./chunk-L6RXG36J.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-GB3AHV5F.js";
+import "./chunk-GQOEWNVM.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
-import "./chunk-QMSEL5YS.js";
+import "./chunk-ZIG7VPJV.js";
 import "./chunk-HSGBZSCA.js";
+import "./chunk-RH4AH3YB.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/ref-provenance-gate-M4AQO4OT.js

@@ -0,0 +1,269 @@
+import "./chunk-MLKGABMK.js";
+
+// scripts/lib/ref-provenance-gate.mjs
+import { execFileSync } from "child_process";
+
+// scripts/lib/gate-inventory.mjs
+import { existsSync, readFileSync } from "fs";
+var GateError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GateError";
+    this.isGateError = true;
+  }
+};
+function loadJsonInventory(inventoryPath, { missing = "empty", fallback = {} } = {}) {
+  if (!existsSync(inventoryPath)) {
+    if (missing === "fail") {
+      throw new GateError(
+        `inventory not found: ${inventoryPath}
+
+This is a hard failure, not a skip. The inventory also carries this
+repository's fork-parent DECLARATION, and a repo that has not declared
+what it forked from cannot be adjudicated.
+
+Create it \u2014 see gates/upstream-content-inventory.README.md for the shape.`
+      );
+    }
+    return fallback;
+  }
+  let text;
+  try {
+    text = readFileSync(inventoryPath, "utf8");
+  } catch (err) {
+    throw new GateError(`inventory could not be read: ${inventoryPath}
+  ${err.message}`);
+  }
+  if (text.trim() === "") {
+    throw new GateError(
+      `inventory is empty: ${inventoryPath}
+
+An empty file is not an empty allowlist \u2014 it is a file that was
+truncated or half-written. Restore it from git, or write an explicit
+inventory with empty check arrays.`
+    );
+  }
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new GateError(
+        `inventory is not a JSON object: ${inventoryPath}
+
+Parsed as ${Array.isArray(parsed) ? "an array" : typeof parsed}. The inventory must be a
+JSON object with a \`checks\` map.`
+      );
+    }
+    return parsed;
+  } catch (err) {
+    if (err.isGateError) throw err;
+    throw new GateError(
+      `inventory is not valid JSON: ${inventoryPath}
+
+  ${err.message}
+
+Fix the file by hand. There is deliberately no tool that rewrites it, so
+a malformed inventory cannot be silently regenerated \u2014 and it must never
+be treated as 'no entries', which would quietly widen what is allowed.`
+    );
+  }
+}
+
+// scripts/lib/ref-provenance-gate.mjs
+var ASKEXE_IDENTITIES = /* @__PURE__ */ new Set([
+  "askexenow@gmail.com",
+  "root@srv1406006.hstgr.cloud"
+]);
+function normalizeEmail(raw) {
+  return (raw ?? "").trim().replace(/^</, "").replace(/>$/, "").toLowerCase();
+}
+function isOurIdentity(email) {
+  return ASKEXE_IDENTITIES.has(normalizeEmail(email));
+}
+var RELEASE_NAMESPACE_PATTERNS = [
+  /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?$/,
+  /^stack-v\d+\.\d+\.\d+$/
+];
+function inReleaseNamespace(tagName) {
+  return RELEASE_NAMESPACE_PATTERNS.some((re) => re.test(tagName));
+}
+function parseVersion(tagName) {
+  const m = /(\d+)\.(\d+)(?:\.(\d+))?(?:[-+]([0-9A-Za-z][0-9A-Za-z.-]*))?/.exec(tagName);
+  if (!m) return null;
+  return {
+    major: Number(m[1]),
+    minor: Number(m[2]),
+    patch: m[3] === void 0 ? 0 : Number(m[3]),
+    prerelease: m[4] ?? null
+  };
+}
+function comparePrerelease(a, b) {
+  if (a === null && b === null) return 0;
+  if (a === null) return 1;
+  if (b === null) return -1;
+  const pa = a.split(".");
+  const pb = b.split(".");
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const x = pa[i];
+    const y = pb[i];
+    if (x === void 0) return -1;
+    if (y === void 0) return 1;
+    const nx = /^\d+$/.test(x);
+    const ny = /^\d+$/.test(y);
+    if (nx && ny) {
+      if (Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1;
+    } else if (nx !== ny) {
+      return nx ? -1 : 1;
+    } else if (x !== y) {
+      return x < y ? -1 : 1;
+    }
+  }
+  return 0;
+}
+function compareVersions(a, b) {
+  if (a === null && b === null) return 0;
+  if (a === null) return -1;
+  if (b === null) return 1;
+  for (const key of ["major", "minor", "patch"]) {
+    if (a[key] !== b[key]) return a[key] < b[key] ? -1 : 1;
+  }
+  return comparePrerelease(a.prerelease, b.prerelease);
+}
+var FIELD_SEP = "";
+var FORMAT = [
+  "%(refname:short)",
+  "%(objecttype)",
+  "%(objectname)",
+  "%(taggeremail)",
+  "%(authoremail)",
+  "%(*authoremail)",
+  "%(creatordate:iso8601)"
+].join(FIELD_SEP);
+function enumerateTags(repoRoot) {
+  const out = execFileSync(
+    "git",
+    ["-C", repoRoot, "for-each-ref", `--format=${FORMAT}`, "refs/tags"],
+    { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
+  );
+  const tags = [];
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const [name, objecttype, objectname, taggerEmail, authorEmail, derefAuthorEmail, date] = line.split(FIELD_SEP);
+    const annotated = objecttype === "tag";
+    const creator = normalizeEmail(
+      annotated ? taggerEmail || derefAuthorEmail : authorEmail || derefAuthorEmail
+    );
+    tags.push({
+      name,
+      annotated,
+      sha: objectname,
+      creator,
+      date: (date ?? "").trim(),
+      class: isOurIdentity(creator) ? "OURS" : "UPSTREAM",
+      version: parseVersion(name)
+    });
+  }
+  return tags;
+}
+function checkProvenance(tags) {
+  return tags.filter((t) => t.class !== "OURS").map((t) => ({
+    check: "ref-provenance",
+    ref: t.name,
+    site: t.name,
+    detail: `tag \`${t.name}\` (${t.sha.slice(0, 12)}) was created by \`${t.creator || "<no identity>"}\`, which is not an AskExe identity \u2014 this ref was inherited from upstream, not authored here`
+  }));
+}
+function checkNamespace(tags) {
+  return tags.filter((t) => !inReleaseNamespace(t.name)).map((t) => ({
+    check: "ref-namespace",
+    ref: t.name,
+    site: t.name,
+    detail: `tag \`${t.name}\` is outside the AskExe release namespace (vMAJOR.MINOR.PATCH[-suffix] or stack-vMAJOR.MINOR.PATCH) \u2014 release tooling, \`git describe\` and status reporting all read this namespace`
+  }));
+}
+function checkLatestTag(tags) {
+  const ranked = tags.filter((t) => t.version !== null);
+  if (ranked.length === 0) return [];
+  let top = ranked[0].version;
+  for (const t of ranked) if (compareVersions(t.version, top) > 0) top = t.version;
+  const winners = ranked.filter((t) => compareVersions(t.version, top) === 0);
+  const foreign = winners.filter((t) => t.class !== "OURS");
+  if (foreign.length === 0) return [];
+  const ours = ranked.filter((t) => t.class === "OURS");
+  let bestOurs = null;
+  for (const t of ours) if (bestOurs === null || compareVersions(t.version, bestOurs.version) > 0) bestOurs = t;
+  return foreign.map((t) => ({
+    check: "latest-tag-sanity",
+    ref: t.name,
+    site: t.name,
+    detail: `the highest tag by semver order is \`${t.name}\`, created by \`${t.creator || "<no identity>"}\` (UPSTREAM). Our highest tag is \`${bestOurs ? bestOurs.name : "<none>"}\`, which ranks BELOW it. Every tool that asks git for the newest tag \u2014 \`git describe\`, \`git tag --sort=-v:refname\`, GitHub "latest release", our own status reporting \u2014 will report a ref we did not create (this is bug 970ec2b5). Do not cut a release until this is resolved.`
+  }));
+}
+var CHECKS = [
+  {
+    id: "ref-provenance",
+    title: "A. PROVENANCE \u2014 every ref must have been created by an AskExe identity",
+    allowlistable: true,
+    run: checkProvenance
+  },
+  {
+    id: "ref-namespace",
+    title: "B. NAMESPACE \u2014 every tag must be inside the AskExe release namespace",
+    allowlistable: true,
+    run: checkNamespace
+  },
+  {
+    id: "latest-tag-sanity",
+    title: "C. LATEST-TAG SANITY \u2014 the highest tag by semver order must be ours",
+    allowlistable: false,
+    run: checkLatestTag
+  }
+];
+function analyzeRefs(repoRoot) {
+  const tags = enumerateTags(repoRoot);
+  const violations = [];
+  for (const check of CHECKS) violations.push(...check.run(tags));
+  return { tags, violations };
+}
+function loadInventory(inventoryPath) {
+  return loadJsonInventory(inventoryPath, { missing: "empty", fallback: { checks: {} } });
+}
+function reconcile(violations, inventory) {
+  const allowlistable = new Set(CHECKS.filter((c) => c.allowlistable).map((c) => c.id));
+  const allowed = /* @__PURE__ */ new Set();
+  const forbidden = [];
+  for (const [checkId, entries] of Object.entries(inventory.checks ?? {})) {
+    for (const entry of entries ?? []) {
+      if (!allowlistable.has(checkId)) {
+        forbidden.push({ check: checkId, site: entry.site });
+        continue;
+      }
+      allowed.add(`${checkId}|${entry.site}`);
+    }
+  }
+  const live = new Set(violations.map((v) => `${v.check}|${v.site}`));
+  const unexpected = violations.filter((v) => !allowed.has(`${v.check}|${v.site}`));
+  const stale = [];
+  for (const [checkId, entries] of Object.entries(inventory.checks ?? {})) {
+    if (!allowlistable.has(checkId)) continue;
+    for (const entry of entries ?? []) {
+      if (!live.has(`${checkId}|${entry.site}`)) stale.push({ check: checkId, site: entry.site });
+    }
+  }
+  return { unexpected, stale, forbidden };
+}
+export {
+  ASKEXE_IDENTITIES,
+  CHECKS,
+  RELEASE_NAMESPACE_PATTERNS,
+  analyzeRefs,
+  checkLatestTag,
+  checkNamespace,
+  checkProvenance,
+  compareVersions,
+  enumerateTags,
+  inReleaseNamespace,
+  isOurIdentity,
+  loadInventory,
+  parseVersion,
+  reconcile
+};