@askexenow/exe-os 0.9.381 → 0.9.382

package/dist/{update-support-NWGGDGBT.js → update-support-V3ZCJR6L.js}

@@ -1,6 +1,6 @@
 import {
   persistSupportArtifact
-} from "./chunk-ATKH4YHE.js";
+} from "./chunk-TK544DEW.js";
 import {
   supportIdSchema,
   supportVersionSchema
@@ -10,14 +10,14 @@ import {
 } from "./chunk-7THUQU44.js";
 import "./chunk-MMRUBN3I.js";
 import "./chunk-CKOJP7JI.js";
-import "./chunk-OKLZXKO6.js";
-import "./chunk-TYAM2ROO.js";
+import "./chunk-CO5ZVE3D.js";
+import "./chunk-ZEGEFBZV.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-SFUNP5Q6.js";
+import "./chunk-M2B35MUK.js";
 import {
   getActiveAgent
-} from "./chunk-TKTEFYPH.js";
+} from "./chunk-F6H7GP2O.js";
 import "./chunk-K4ESASPL.js";
 import "./chunk-5MOYSU5A.js";
 import {
@@ -40,11 +40,11 @@ import "./chunk-GPJIBLP4.js";
 import "./chunk-V3WLC5TJ.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-MAOKR5AL.js";
+import "./chunk-AY2U4NZ5.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-GODDBYPL.js";
+import "./chunk-FU5O2REK.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";
@@ -54,9 +54,9 @@ import "./chunk-AVMLC2MR.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-UVM3HYIC.js";
+} from "./chunk-5DFE2NAF.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-2XIMJNWB.js";
+import "./chunk-O34F5EP5.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import {

package/dist/wiki-acl-NUBAPLCD.js

@@ -0,0 +1,19 @@
+import {
+  checkWikiAccess,
+  filterWikiRecallResults,
+  getWorkspaceVisibility,
+  grantWikiAccess,
+  listUserWikiAccess,
+  listWorkspaceUsers,
+  revokeWikiAccess
+} from "./chunk-C7H2D7LX.js";
+import "./chunk-MLKGABMK.js";
+export {
+  checkWikiAccess,
+  filterWikiRecallResults,
+  getWorkspaceVisibility,
+  grantWikiAccess,
+  listUserWikiAccess,
+  listWorkspaceUsers,
+  revokeWikiAccess
+};

package/dist/{work-claims-OFNMCIKF.js → work-claims-Q2NU6JON.js}

@@ -15,15 +15,15 @@ import {
   normalizeWorkRef,
   releaseClaim,
   resolveHolderSession
-} from "./chunk-G3RANZRO.js";
+} from "./chunk-Y4T5IUEP.js";
 import "./chunk-PHUHIVD5.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-BTSWFMEH.js";
-import "./chunk-MAOKR5AL.js";
+import "./chunk-AY2U4NZ5.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-GODDBYPL.js";
+import "./chunk-FU5O2REK.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/dist/{work-state-heartbeat-PZFJI7LF.js → work-state-heartbeat-HAQRV3RK.js}

@@ -9,7 +9,7 @@ import {
   runWorkStateTick,
   shouldWriteWorkState,
   upsertWorkState
-} from "./chunk-TYAM2ROO.js";
+} from "./chunk-ZEGEFBZV.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{workflow-engine-WE6GMJGU.js → workflow-engine-GEWPU5YR.js}

@@ -11,8 +11,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-WH25C4IE.js";
-import "./chunk-JTOS2R26.js";
+} from "./chunk-3MUARHPO.js";
+import "./chunk-Q3DN5J6F.js";
 import "./chunk-MLKGABMK.js";
 export {
   MAX_WORKFLOW_STEPS,

package/dist/{worktree-WV722AND.js → worktree-C7LFMRKW.js}

@@ -19,13 +19,13 @@ import {
   resolveGitWithRetrySync,
   worktreeBranch,
   worktreePath
-} from "./chunk-5WCRSUOT.js";
-import "./chunk-O6NASQJQ.js";
-import "./chunk-MAOKR5AL.js";
+} from "./chunk-SFFXAPYK.js";
+import "./chunk-VUOAPKPI.js";
+import "./chunk-AY2U4NZ5.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-GODDBYPL.js";
+import "./chunk-FU5O2REK.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/dist/{worktree-sweep-ZYQWLIHA.js → worktree-sweep-SYF62ANH.js}

@@ -4,14 +4,14 @@ import {
   discoverRepoPathsAsync,
   isWorktreePathOccupiedByCwd,
   sweepWorktrees
-} from "./chunk-3PFQKTW3.js";
-import "./chunk-5WCRSUOT.js";
-import "./chunk-O6NASQJQ.js";
-import "./chunk-MAOKR5AL.js";
+} from "./chunk-R4VNGRKU.js";
+import "./chunk-SFFXAPYK.js";
+import "./chunk-VUOAPKPI.js";
+import "./chunk-AY2U4NZ5.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-GODDBYPL.js";
+import "./chunk-FU5O2REK.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-CL4J4757.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.381",
+  "version": "0.9.382",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -121,7 +121,7 @@
     "typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
     "guard:mock-shape": "node scripts/check-mock-shape.mjs",
     "typecheck:workers": "tsc --noEmit -p api-router/tsconfig.json && tsc --noEmit -p api-router/tsconfig.test.json && tsc --noEmit -p worker/tsconfig.json",
-    "build": "node scripts/dist-ownership-guard.mjs && bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true) && node scripts/dist-integrity.mjs --record",
+    "build": "node scripts/dist-ownership-guard.mjs && node scripts/dist-integrity.mjs --pre-build-guard && bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true) && node scripts/dist-integrity.mjs --record",
     "deploy": "node dist/bin/pre-build-guard.js && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node scripts/dist-integrity.mjs --verify && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "node postinstall.mjs",
     "prepublishOnly": "npm run typecheck && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node dist/bin/prune-orphan-chunks.js --force && node scripts/dist-integrity.mjs --prune && npm run guard:esm-require && npm run guard:defect-classes && npm run guard:ref-provenance && npm run guard:upstream-content && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
@@ -152,7 +152,6 @@
     "test:smoke": "vitest run --maxWorkers=1 tests/smoke/",
     "smoke:runtime": "node --import tsx src/bin/runtime-smoke.ts",
     "check:release-conformance": "node scripts/check-release-conformance.mjs",
-    "test:e2e:sso-contract": "playwright test --config tests/e2e/playwright.config.ts tests/e2e/sso-contract.spec.ts",
     "test:e2e:sso-stack": "tests/e2e/stack/bin/run.sh"
   },
   "dependencies": {

package/release-notes.json

@@ -1,23 +1,21 @@
 {
-  "current": "0.9.381",
+  "current": "0.9.382",
   "notes": {
-    "0.9.381": {
-      "version": "0.9.381",
+    "0.9.382": {
+      "version": "0.9.382",
       "date": "2026-09-08",
       "features": [],
       "fixes": [
-        "quote multi-word .env values; ci-linux liveness sweep with no caller (bugs 5dc66955, 2177b2df) (#1055)",
-        "verify the registry after a SUCCESSFUL npm publish, not only after a failed one (#1054)",
-        "four small bugs (dispatch-ack age-out, ci-runner host name, auth scheme, tsconfig coverage) (#1052)",
-        "exempt deterministic checks from host-noise masking; fix db.lock test isolation (bugs 86c1c829, 165a38df) (#1053)",
-        "recognize Bearer API clients and stop caching stale backend IPs (bugs cc40e9ea, 94a6a19a) (#1051)",
-        "automatic plan re-check on boot + in the daemon (bug ee8a63f4) (#1047)"
+        "make the required smoke check determinate so it cannot resolve to SKIPPED (bug 3bd43972 follow-up) (#1071)",
+        "size the npm ingestion window to measured 202 latency (bug e1208011) (#1073)",
+        "fail-closed recall visibility for restricted workspaces (bug a5b4b41f) (#1044)",
+        "detect and warn when a hand-patched dist is about to be overwritten (bug 7308d257) (#1069)",
+        "do not rescan commits already on the remote (merge false positive) (#1070)",
+        "verify pinned digests actually match their tags in the registry (bug a893833c) (#1072)"
       ],
       "security": [],
       "other": [
-        "bump to v0.9.381 — first release with a truthful npm publisher (#1056)",
-        "release(stack): pin exe-wiki v0.9.33 — the shared design tokens reach customers (#1059)",
-        "release(stack): pin exe-auth v0.6.5 — the login-flash fix reaches customers (#1057)"
+        "bump v0.9.382 for stack release (#1088)"
       ],
       "migration_notes": []
     },

package/stack.release.json

@@ -4,23 +4,23 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.381",
-  "image": "ghcr.io/askexe/exe-os:v0.9.380",
+  "version": "0.9.382",
+  "image": "ghcr.io/askexe/exe-os:v0.9.382",
   "imageEnv": "EXE_OS_IMAGE_TAG",
-  "imageDigestTodo": "TODO(bug 32d6e02f), NARROWED by bug 81ca8903. The top-level `image` is tag-only BY CONSTRUCTION and that is correct: it names the tag the release run is about to build, whose digest does not exist until the push (see the 'Cross-check built digest against the manifest pin' step in .github/workflows/release-stack-image.yml). Demanding a digest here is unsatisfiable, which is why this TODO kept surviving. The one genuinely resolvable case it also covered \u2014 components.erp, built in a DIFFERENT repo and therefore already sitting in the registry \u2014 is now resolved and digest-pinned below. What remains open is ONLY components.dashboard, and not for the reason this TODO claimed: ghcr.io/askexe/exe-dashboard:v0.9.372 DOES NOT EXIST. .github/workflows/release-dashboard-image.yml has produced exactly one run in its lifetime (id 32405074431, 2026-08-20, tag v0.9.374) and that run FAILED, so the dashboard release lane has never emitted a single v* tag \u2014 the only refs in ghcr.io/askexe/exe-dashboard are the floating :main and :sha-<sha> dev refs from dashboard-image.yml. The dashboard pin is therefore a PHANTOM, not an unresolved digest, and it is deliberately left tag-only here rather than silently repointed at a :main digest, because choosing which dashboard bytes constitute a release is a release decision, not a lint fix. FAIL-CLOSED still holds and is enforced where it bites: scripts/publish-stack-release.mjs verifyServicePin() refuses to publish any tag-only app image into the customer manifest.",
+  "imageDigestTodo": "TODO(bug 32d6e02f), NARROWED by bug 81ca8903. The top-level `image` is tag-only BY CONSTRUCTION and that is correct: it names the tag the release run is about to build, whose digest does not exist until the push (see the 'Cross-check built digest against the manifest pin' step in .github/workflows/release-stack-image.yml). Demanding a digest here is unsatisfiable, which is why this TODO kept surviving. The one genuinely resolvable case it also covered — components.erp, built in a DIFFERENT repo and therefore already sitting in the registry — is now resolved and digest-pinned below. What remains open is ONLY components.dashboard, and not for the reason this TODO claimed: ghcr.io/askexe/exe-dashboard:v0.9.372 DOES NOT EXIST. .github/workflows/release-dashboard-image.yml has produced exactly one run in its lifetime (id 32405074431, 2026-08-20, tag v0.9.374) and that run FAILED, so the dashboard release lane has never emitted a single v* tag — the only refs in ghcr.io/askexe/exe-dashboard are the floating :main and :sha-<sha> dev refs from dashboard-image.yml. The dashboard pin is therefore a PHANTOM, not an unresolved digest, and it is deliberately left tag-only here rather than silently repointed at a :main digest, because choosing which dashboard bytes constitute a release is a release decision, not a lint fix. FAIL-CLOSED still holds and is enforced where it bites: scripts/publish-stack-release.mjs verifyServicePin() refuses to publish any tag-only app image into the customer manifest.",
   "components": {
     "erp": {
       "image": "ghcr.io/askexe/exe-erp:v0.3.4@sha256:7e21680fdb2bf488010edbbd5cc09dcc15fa677f466326c35e1439b1c5f8a820",
       "env": "ERP_IMAGE_TAG",
       "composeService": "exe-erp",
-      "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` \u2014 a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
+      "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` — a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
     },
     "dashboard": {
-      "image": "ghcr.io/askexe/exe-dashboard:v0.9.381",
+      "image": "ghcr.io/askexe/exe-dashboard:v0.9.382",
       "env": "DASHBOARD_IMAGE_TAG",
       "composeService": "exe-dashboard",
       "versionLockstep": true,
-      "note": "The customer dashboard served at dashboard.<apex> (credits, usage, API keys, billing). Built from THIS repo \u2014 context dashboard-page/, a static nginx image \u2014 by .github/workflows/release-dashboard-image.yml on a release tag, so it ships in lockstep with exe-os. `versionLockstep: true` is what now authorises bumpVersions() to rebase this tag: after bug 81ca8903 the rebase is opt-in per component instead of applying to everything. Before 2026-08-20 it was outside the release lane entirely: only .github/workflows/dashboard-image.yml built it, publishing floating :main / :sha-<sha> refs with no org.opencontainers.image.version, and no descriptor pinned it. Production consequently ran sha256:950699473914\u2026 from commit 1d5b69cffa8d (#703, 2026-08-13) \u2014 three builds stale \u2014 with nothing able to detect or correct it. OPEN (bug 81ca8903): that is STILL the situation. This tag is a phantom \u2014 see imageDigestTodo. The release lane exists but has never completed a run, so no v* dashboard image exists to pin. Fixing the lane is tracked separately; do not paper over it by pinning a :main digest here."
+      "note": "The customer dashboard served at dashboard.<apex> (credits, usage, API keys, billing). Built from THIS repo — context dashboard-page/, a static nginx image — by .github/workflows/release-dashboard-image.yml on a release tag, so it ships in lockstep with exe-os. `versionLockstep: true` is what now authorises bumpVersions() to rebase this tag: after bug 81ca8903 the rebase is opt-in per component instead of applying to everything. Before 2026-08-20 it was outside the release lane entirely: only .github/workflows/dashboard-image.yml built it, publishing floating :main / :sha-<sha> refs with no org.opencontainers.image.version, and no descriptor pinned it. Production consequently ran sha256:950699473914… from commit 1d5b69cffa8d (#703, 2026-08-13) — three builds stale — with nothing able to detect or correct it. OPEN (bug 81ca8903): that is STILL the situation. This tag is a phantom — see imageDigestTodo. The release lane exists but has never completed a run, so no v* dashboard image exists to pin. Fixing the lane is tracked separately; do not paper over it by pinning a :main digest here."
     },
     "exe-db": {
       "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
@@ -47,13 +47,13 @@
       "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
       "composeService": "cloudflared",
       "category": "infra",
-      "note": "Bug 4948fc48: digest-pinned tunnel \u2014 no env override, managed in compose."
+      "note": "Bug 4948fc48: digest-pinned tunnel — no env override, managed in compose."
     },
     "exe-sso-edge": {
       "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
       "composeService": "exe-sso-edge",
       "category": "infra",
-      "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP \u2014 uses stock nginx:alpine."
+      "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP — uses stock nginx:alpine."
     },
     "exe-otel-collector": {
       "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
@@ -66,7 +66,7 @@
       "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
       "composeService": "gotrue",
       "category": "infra",
-      "note": "Bug 4948fc48: GoTrue auth backend \u2014 digest-pinned in compose."
+      "note": "Bug 4948fc48: GoTrue auth backend — digest-pinned in compose."
     }
   },
   "stackParticipation": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.380"
-}
+  "sourceVersion": "0.9.382"
+}

package/dist/wiki-acl-OLXP4N4T.js

@@ -1,111 +0,0 @@
-import "./chunk-MLKGABMK.js";
-
-// src/lib/wiki-acl.ts
-async function checkWikiAccess(userId, workspace, requiredLevel = "read") {
-  if (!userId) {
-    return {
-      allowed: requiredLevel === "read",
-      actualLevel: "read"
-    };
-  }
-  try {
-    const { getClient } = await import("./lib/database.js");
-    const client = getClient();
-    const result = await client.execute({
-      sql: `SELECT access_level FROM wiki_acl WHERE user_id = ? AND workspace = ?`,
-      args: [userId, workspace]
-    });
-    if (result.rows.length > 0) {
-      const actualLevel = String(result.rows[0].access_level);
-      return {
-        allowed: accessLevelSatisfies(actualLevel, requiredLevel),
-        actualLevel
-      };
-    }
-    const wildcardResult = await client.execute({
-      sql: `SELECT access_level FROM wiki_acl WHERE user_id = ? AND workspace = '*'`,
-      args: [userId]
-    });
-    if (wildcardResult.rows.length > 0) {
-      const actualLevel = String(wildcardResult.rows[0].access_level);
-      return {
-        allowed: accessLevelSatisfies(actualLevel, requiredLevel),
-        actualLevel
-      };
-    }
-    return {
-      allowed: requiredLevel === "read",
-      actualLevel: "read"
-    };
-  } catch {
-    return {
-      allowed: requiredLevel === "read",
-      actualLevel: "read"
-    };
-  }
-}
-async function grantWikiAccess(userId, workspace, accessLevel, grantedBy) {
-  const { getClient } = await import("./lib/database.js");
-  const client = getClient();
-  await client.execute({
-    sql: `INSERT OR REPLACE INTO wiki_acl (user_id, workspace, access_level, granted_by, created_at)
-          VALUES (?, ?, ?, ?, ?)`,
-    args: [userId, workspace, accessLevel, grantedBy, (/* @__PURE__ */ new Date()).toISOString()]
-  });
-}
-async function revokeWikiAccess(userId, workspace) {
-  const { getClient } = await import("./lib/database.js");
-  const client = getClient();
-  const result = await client.execute({
-    sql: `DELETE FROM wiki_acl WHERE user_id = ? AND workspace = ?`,
-    args: [userId, workspace]
-  });
-  return (result.rowsAffected ?? 0) > 0;
-}
-async function listUserWikiAccess(userId) {
-  const { getClient } = await import("./lib/database.js");
-  const client = getClient();
-  const result = await client.execute({
-    sql: `SELECT user_id, workspace, access_level, granted_by, created_at
-          FROM wiki_acl WHERE user_id = ? ORDER BY workspace`,
-    args: [userId]
-  });
-  return result.rows.map((r) => ({
-    userId: String(r.user_id),
-    workspace: String(r.workspace),
-    accessLevel: String(r.access_level),
-    grantedBy: String(r.granted_by),
-    createdAt: String(r.created_at)
-  }));
-}
-async function listWorkspaceUsers(workspace) {
-  const { getClient } = await import("./lib/database.js");
-  const client = getClient();
-  const result = await client.execute({
-    sql: `SELECT user_id, workspace, access_level, granted_by, created_at
-          FROM wiki_acl WHERE workspace = ? OR workspace = '*' ORDER BY user_id`,
-    args: [workspace]
-  });
-  return result.rows.map((r) => ({
-    userId: String(r.user_id),
-    workspace: String(r.workspace),
-    accessLevel: String(r.access_level),
-    grantedBy: String(r.granted_by),
-    createdAt: String(r.created_at)
-  }));
-}
-var ACCESS_HIERARCHY = {
-  read: 1,
-  write: 2,
-  admin: 3
-};
-function accessLevelSatisfies(actual, required) {
-  return (ACCESS_HIERARCHY[actual] ?? 0) >= (ACCESS_HIERARCHY[required] ?? 0);
-}
-export {
-  checkWikiAccess,
-  grantWikiAccess,
-  listUserWikiAccess,
-  listWorkspaceUsers,
-  revokeWikiAccess
-};

package/dist/{chunk-ZFAZT3KX.js → chunk-ZDIXMHY7.js}

@@ -1,15 +1,15 @@
 import {
   resolvePartnerIdentities
 } from "./chunk-7BMSBACY.js";
-import {
-  asOrgBillablePlan
-} from "./chunk-X2X3IGZU.js";
 import {
   OrgKeyPinConflictError,
   orgKeyPinConfirmation,
   pinOrgKey,
   readOrgKeyPin
 } from "./chunk-7HLJ4BSF.js";
+import {
+  asOrgBillablePlan
+} from "./chunk-X2X3IGZU.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,