@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/{chunk-4AAMFWJT.js → chunk-OHZSTZXN.js}

@@ -1,9 +1,9 @@
 import {
   listBehaviors
-} from "./chunk-S26CV7BE.js";
+} from "./chunk-YA5LK6KB.js";
 import {
   incrementSkillUsage
-} from "./chunk-VJEJ7JNB.js";
+} from "./chunk-N32DVIKY.js";
 
 // src/lib/behavior-injection.ts
 import { appendFile } from "fs/promises";
@@ -349,6 +349,8 @@ async function injectBehaviors(opts) {
       `[behavior-injection] ${opts.assignedTo} <- ${selected.length}/${behaviors.length} behaviour(s) for "${opts.title.slice(0, 60)}": ` + selected.map((s) => `${s.behavior.id.slice(0, 8)}(${s.score.toFixed(2)})`).join(" ") + "\n"
     );
     await incrementSkillUsage(selected.map((s) => s.behavior));
+    const { recordBehaviorsConsulted } = await import("./skill-usage-NDB67PU2.js");
+    await recordBehaviorsConsulted(selected.map((s) => s.behavior.id));
     return selected;
   } catch (err) {
     process.stderr.write(

package/dist/chunk-OSIS7ZQW.js

@@ -0,0 +1,344 @@
+import {
+  orgMembershipsPath,
+  readActiveOrgMemberships
+} from "./chunk-GDLB6BPM.js";
+import {
+  resolveExeDataDir
+} from "./chunk-NPXIS2RY.js";
+
+// src/lib/org-departure.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import os2 from "os";
+import path3 from "path";
+
+// src/lib/seat-heartbeat.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { createHash } from "crypto";
+import path from "path";
+import os from "os";
+var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
+var STATE_PATH = path.join(EXE_DIR, "seat-presence.json");
+var WEEK_MS = 7 * 24 * 60 * 60 * 1e3;
+var HOUR_MS = 60 * 60 * 1e3;
+var JITTER_HALF_WIDTH_MS = 72 * HOUR_MS;
+var JITTER_BASE_OFFSET_MS = 84 * HOUR_MS;
+var MAX_TRACKED_WINDOWS = 8;
+function emptyOrgs() {
+  return /* @__PURE__ */ Object.create(null);
+}
+var EMPTY_STATE = { version: 1, orgs: emptyOrgs() };
+function readSeatPresenceState() {
+  try {
+    if (!existsSync(STATE_PATH)) return { ...EMPTY_STATE, orgs: emptyOrgs() };
+    const parsed = JSON.parse(readFileSync(STATE_PATH, "utf-8"));
+    if (!parsed || typeof parsed !== "object" || typeof parsed.orgs !== "object" || parsed.orgs === null) {
+      return { ...EMPTY_STATE, orgs: emptyOrgs() };
+    }
+    const orgs = emptyOrgs();
+    for (const [org, entry] of Object.entries(parsed.orgs)) {
+      const e = entry;
+      orgs[org] = {
+        observed: sanitizeWindows(e?.observed),
+        sent: sanitizeWindows(e?.sent)
+      };
+    }
+    return { version: 1, orgs };
+  } catch {
+    return { ...EMPTY_STATE, orgs: emptyOrgs() };
+  }
+}
+function sanitizeWindows(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((v) => typeof v === "string" && /^\d{4}-W\d{2}$/.test(v)).slice(-MAX_TRACKED_WINDOWS);
+}
+function writeSeatPresenceState(state) {
+  try {
+    mkdirSync(EXE_DIR, { recursive: true });
+    writeFileSync(STATE_PATH, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+}
+function forgetSeatPresence(orgId) {
+  const state = readSeatPresenceState();
+  if (!(orgId in state.orgs)) return;
+  delete state.orgs[orgId];
+  writeSeatPresenceState(state);
+}
+
+// src/lib/org-admin-scope.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import path2 from "path";
+var ORG_ADMIN_SCOPE_FILENAME = "org-admin-scope.json";
+var ORG_ID_RE = /^(?!\.{1,2}$)[a-z0-9._:-]{1,128}$/;
+function orgAdminScopePath() {
+  return path2.join(resolveExeDataDir(), ORG_ADMIN_SCOPE_FILENAME);
+}
+function normalizeOrgId(raw) {
+  if (typeof raw !== "string") return null;
+  const folded = raw.trim().toLowerCase();
+  return ORG_ID_RE.test(folded) ? folded : null;
+}
+function readAdministeredOrgs() {
+  const file = orgAdminScopePath();
+  if (!existsSync2(file)) return [];
+  let raw;
+  try {
+    raw = readFileSync2(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  const parsed = JSON.parse(raw);
+  const orgs = parsed?.orgs;
+  if (!Array.isArray(orgs)) return [];
+  const out = [];
+  for (const entry of orgs) {
+    const id = normalizeOrgId(entry);
+    if (id && !out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function listAdministeredOrgs() {
+  try {
+    return readAdministeredOrgs();
+  } catch {
+    return [];
+  }
+}
+function recordOrgAdminship(orgId) {
+  const id = normalizeOrgId(orgId);
+  if (!id) return;
+  try {
+    const existing = readAdministeredOrgs();
+    if (existing.includes(id)) return;
+    const next = { version: 1, orgs: [...existing, id] };
+    const file = orgAdminScopePath();
+    mkdirSync2(path2.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp`;
+    writeFileSync2(tmp, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+    renameSync(tmp, file);
+  } catch {
+  }
+}
+function forgetOrgAdminship(orgId) {
+  const id = normalizeOrgId(orgId);
+  if (!id) return false;
+  const existing = listAdministeredOrgs();
+  if (!existing.includes(id)) return false;
+  const next = { version: 1, orgs: existing.filter((o) => o !== id) };
+  const file = orgAdminScopePath();
+  mkdirSync2(path2.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  renameSync(tmp, file);
+  return true;
+}
+function candidateAdminOrgIds() {
+  const out = [...listAdministeredOrgs()];
+  let memberships = [];
+  try {
+    memberships = readActiveOrgMemberships();
+  } catch {
+    memberships = [];
+  }
+  for (const m of memberships) {
+    const id = normalizeOrgId(m.org_id);
+    if (id && !out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function orgAdminScopePresent() {
+  return candidateAdminOrgIds().length > 0;
+}
+function resolveTargetOrgId(explicit) {
+  if (explicit !== void 0 && explicit.trim() !== "") {
+    const id = normalizeOrgId(explicit);
+    if (!id) {
+      return {
+        error: `"${explicit}" is not a usable org id. An org id is a handle, not a company name: 1-128 characters of [a-z0-9._:-] (capitals are folded).`
+      };
+    }
+    return { orgId: id };
+  }
+  const candidates = candidateAdminOrgIds();
+  if (candidates.length === 1) return { orgId: candidates[0] };
+  if (candidates.length === 0) {
+    return {
+      error: "No org_id given and this install knows of no org. Pass org_id explicitly, or create one with org_create / join one with org_join first."
+    };
+  }
+  return {
+    error: `No org_id given and this install knows of ${candidates.length}: ${candidates.join(", ")}. Pass org_id explicitly \u2014 guessing which company an administrative action lands on is not a thing this tool will do.`
+  };
+}
+
+// src/lib/org-departure.ts
+var EXE_DIR2 = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path3.join(os2.homedir(), ".exe-os");
+var PER_ORG_STATE_DIRS = [
+  {
+    root: path3.join(EXE_DIR2, "org-outbox"),
+    store: "mailbox outbox",
+    why: "queued sealed envelopes addressed to the org \u2014 an outbound channel to a former employer"
+  },
+  {
+    root: path3.join(EXE_DIR2, "org-inbox"),
+    store: "mailbox inbox",
+    why: "poll cursors and sequence state that keep this install polling an org it left"
+  },
+  {
+    root: path3.join(EXE_DIR2, "org-requests"),
+    store: "task requests",
+    why: "inbound task_requests that could still be accepted into the task list after leaving"
+  }
+];
+function orgSegment(orgId) {
+  return orgId.replace(/[^A-Za-z0-9._:-]/g, "_").slice(0, 128);
+}
+function readMembershipsFile() {
+  const p = orgMembershipsPath();
+  if (!existsSync3(p)) return { version: 1, memberships: [] };
+  try {
+    const parsed = JSON.parse(readFileSync3(p, "utf-8"));
+    if (!Array.isArray(parsed?.memberships)) return { version: 1, memberships: [] };
+    return { version: typeof parsed.version === "number" ? parsed.version : 1, memberships: parsed.memberships };
+  } catch {
+    return { version: 1, memberships: [] };
+  }
+}
+function writeMembershipsFile(file) {
+  const p = orgMembershipsPath();
+  mkdirSync3(path3.dirname(p), { recursive: true });
+  writeFileSync3(p, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
+}
+async function departOrgToPersonalFreeTier(orgIdRaw, cause = "left") {
+  const orgId = orgIdRaw.trim().toLowerCase();
+  const notes = [];
+  const failures = [];
+  const file = readMembershipsFile();
+  let changed = false;
+  for (const m of file.memberships) {
+    if (typeof m.org_id === "string" && m.org_id.toLowerCase() === orgId && m.status !== "revoked") {
+      m.status = "revoked";
+      m.departed_cause = cause;
+      changed = true;
+    }
+  }
+  if (changed) {
+    try {
+      writeMembershipsFile(file);
+    } catch (err) {
+      failures.push(
+        `the local membership record was NOT updated (${err instanceof Error ? err.message : String(err)}). Your Partner is unaffected and the org side has already ended the membership, but this install still believes it belongs to the org.`
+      );
+    }
+  }
+  let consentCleared = false;
+  const consentStatePath = path3.join(EXE_DIR2, "org-consent", orgSegment(orgId), "consent-state.json");
+  if (!existsSync3(consentStatePath)) {
+    consentCleared = true;
+    notes.push(`No standing consent policies existed for ${orgId}; there was nothing to disarm.`);
+  } else try {
+    const { clearStandingPolicies } = await import("./org-consent-policy-KFUP7QPG.js");
+    await clearStandingPolicies(orgId);
+    consentCleared = true;
+  } catch (err) {
+    failures.push(
+      `standing consent policies for ${orgId} were NOT cleared (${err instanceof Error ? err.message : String(err)}). They may still be armed. Re-run the departure from a session with consent initialized, or clear them explicitly.`
+    );
+  }
+  let presenceForgotten = false;
+  try {
+    forgetSeatPresence(orgId);
+    presenceForgotten = true;
+  } catch (err) {
+    failures.push(
+      `seat presence for ${orgId} was NOT forgotten (${err instanceof Error ? err.message : String(err)}). This install may keep reporting presence for an org it has left.`
+    );
+  }
+  let pollerStopped = false;
+  try {
+    const { stopOrgPartnerPollerFor } = await import("./org-partner-runtime-TH3LMPII.js");
+    pollerStopped = await stopOrgPartnerPollerFor(orgId);
+  } catch (err) {
+    failures.push(
+      `the inbox poller for ${orgId} was NOT stopped (${err instanceof Error ? err.message : String(err)}). It may keep polling the org and may recreate the state removed below. Restart this install to be certain it has stopped.`
+    );
+  }
+  let seqFloor = 0;
+  try {
+    const { preserveOutboundSeqFloor } = await import("./task-request-inbox-PKJCYKJV.js");
+    seqFloor = preserveOutboundSeqFloor(orgId);
+    if (seqFloor > 0) {
+      notes.push(
+        `Outbound envelope seq ${seqFloor} recorded as spent for ${orgId}, so rejoining this org from this device resumes the series instead of restarting it.`
+      );
+    }
+  } catch (err) {
+    failures.push(
+      `the outbound seq floor for ${orgId} was NOT recorded (${err instanceof Error ? err.message : String(err)}). If this device rejoins this org, its receipts and briefs may be refused as replays until the counter passes the relay's watermark.`
+    );
+  }
+  const purged = [];
+  for (const { root, store, why } of PER_ORG_STATE_DIRS) {
+    const dir = path3.join(root, orgSegment(orgId));
+    try {
+      if (!existsSync3(dir)) continue;
+      rmSync(dir, { recursive: true, force: true });
+      purged.push(store);
+    } catch (err) {
+      failures.push(
+        `${store} state for ${orgId} was NOT removed (${err instanceof Error ? err.message : String(err)}): ${why}.`
+      );
+    }
+  }
+  let adminScopeForgotten = false;
+  try {
+    adminScopeForgotten = forgetOrgAdminship(orgId);
+  } catch (err) {
+    failures.push(
+      `the local adminship note for ${orgId} was NOT removed (${err instanceof Error ? err.message : String(err)}).`
+    );
+  }
+  const remaining = readMembershipsFile().memberships.filter((m) => m.status !== "revoked").map((m) => String(m.org_id));
+  notes.push(
+    "Your Partner, your keys, and your memory are untouched and stay on this machine. You continue on the personal FREE tier at no cost \u2014 leaving an organization never requires you to buy a plan to keep what is yours."
+  );
+  if (remaining.length === 0) {
+    notes.push(
+      "This install now belongs to no organization. It keeps working as a personal Partner; org-mode protections stay latched (clearing them is a separate, deliberate action)."
+    );
+  }
+  return {
+    org_id: orgId,
+    cause,
+    changed,
+    remaining_orgs: remaining,
+    personal_plan: "free",
+    partner_retained: true,
+    memory_retained: true,
+    consent_cleared: consentCleared,
+    seat_presence_forgotten: presenceForgotten,
+    state_dirs_purged: purged,
+    poller_stopped: pollerStopped,
+    outbound_seq_floor: seqFloor,
+    admin_scope_forgotten: adminScopeForgotten,
+    failures,
+    complete: failures.length === 0,
+    notes
+  };
+}
+function seatReportingOrgIds() {
+  return readMembershipsFile().memberships.filter((m) => m.status === "active").map((m) => String(m.org_id).toLowerCase());
+}
+
+export {
+  listAdministeredOrgs,
+  recordOrgAdminship,
+  candidateAdminOrgIds,
+  orgAdminScopePresent,
+  resolveTargetOrgId,
+  departOrgToPersonalFreeTier,
+  seatReportingOrgIds
+};

package/dist/{chunk-E3ZM32LF.js → chunk-P22VFGFK.js}

@@ -3,25 +3,25 @@ import {
 } from "./chunk-X2X3IGZU.js";
 import {
   resolvePartnerIdentities
-} from "./chunk-VOVFUKEB.js";
+} from "./chunk-AIB2EWO2.js";
 import {
   OrgKeyPinConflictError,
   orgKeyPinConfirmation,
   pinOrgKey,
   readOrgKeyPin
-} from "./chunk-ZAEUEDTN.js";
+} from "./chunk-ZD6FZ3WL.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   signKeyFingerprint
-} from "./chunk-DMUOTCDN.js";
+} from "./chunk-E5CKRHIZ.js";
 import {
   establishOrgMode,
   upsertOrgMembership
-} from "./chunk-JA3Y5TV6.js";
+} from "./chunk-GDLB6BPM.js";
 import {
   isValidX25519Recipient
-} from "./chunk-4AR5XKCH.js";
+} from "./chunk-CL2MU3OX.js";
 
 // src/lib/org-join.ts
 import { createHash, sign } from "crypto";
@@ -181,6 +181,11 @@ async function completeOrgJoin(input) {
       `Refusing to pin the Org Key without the exact confirmation phrase ("${expected}").`
     );
   }
+  if (!input.claimPassphrase || input.claimPassphrase.trim().length === 0) {
+    throw new InviteError(
+      "Refusing to redeem without claim_passphrase \u2014 the passphrase issued alongside the invite code. An invite code by itself does not claim a seat."
+    );
+  }
   const existing = readOrgKeyPin(input.offer.orgId);
   if (existing) {
     if (existing.org_key_sign_pub !== input.offer.orgKeySignPub || existing.org_key_x25519_pub !== input.offer.orgKeyX25519Pub) {
@@ -208,6 +213,10 @@ async function completeOrgJoin(input) {
       headers,
       body: JSON.stringify({
         token: code,
+        // THE SECOND SECRET. MANDATORY for every redeem — see the field doc
+        // on CompleteOrgJoinInput. Checked already, above; sent here so the
+        // server's own compare-and-swap is the authority, not this client.
+        claim_passphrase: input.claimPassphrase,
         // MANDATORY. The server checks this INSIDE the compare-and-swap, so the
         // pin is something we DEMAND, not something the server announces to us.
         // Together with the response comparison below it means a substitution

package/dist/{chunk-KILR4FBR.js → chunk-PAFLR7WD.js}

@@ -1,10 +1,10 @@
 import {
   withScopedReadWindow
-} from "./chunk-IGJMS7C5.js";
+} from "./chunk-GOVGG7HU.js";
 import {
   requireOrgPartnerBinding,
   resolvePartnerIdentities
-} from "./chunk-VOVFUKEB.js";
+} from "./chunk-AIB2EWO2.js";
 import {
   allocateOutboundSeq,
   approveBriefManually,
@@ -22,7 +22,7 @@ import {
   sealMailboxEnvelope,
   unrecordedText,
   verifyManifest
-} from "./chunk-YLFCH3VA.js";
+} from "./chunk-FDWI3T6I.js";
 import {
   queueMailboxDeposit
 } from "./chunk-3FGBBJYM.js";

package/dist/{chunk-R3CZWFFC.js → chunk-PEYQ6MWO.js}

@@ -77,6 +77,7 @@ function spawnDbWriteWorker(dbPath, encryptionKey, opts) {
     if (msg.error) cb.reject(new Error(msg.error));
     else if (msg.memoryId) cb.resolve({ memoryId: msg.memoryId, version: msg.version, deduped: msg.deduped });
     else if (typeof msg.deleted === "number") cb.resolve({ deleted: msg.deleted });
+    else if (msg.ok) cb.resolve({ ok: true, result: msg.result });
     else cb.reject(new Error("invalid write-worker response"));
   });
   _worker.on("error", (err) => {
@@ -108,12 +109,22 @@ async function sweepSessionEventsRetentionInWorker(retentionDays) {
   });
   return { deleted: Number(result.deleted ?? 0) };
 }
-async function sweepConversationsRetentionInWorker(retentionDays) {
+async function sweepConversationsRetentionInWorker(retentionDays, retentionMode) {
   const result = await sendWriteWorkerRequest({
     type: "sweep-conversations-retention",
-    retentionDays
+    retentionDays,
+    retentionMode
   });
-  return { deleted: Number(result.deleted ?? 0) };
+  return {
+    deleted: Number(result.deleted ?? 0),
+    archived: Number(result.archived ?? 0),
+    purged: Number(result.purged ?? 0),
+    mode: String(result.mode ?? "archive")
+  };
+}
+async function requestMaintenanceWrite(jobId, jobName, kind, payload) {
+  const result = await sendWriteWorkerRequest({ type: "maintenance-job-write", jobId, jobName, kind, payload });
+  return result.result;
 }
 function sendWriteWorkerRequest(payload) {
   if (!_worker || !_workerReady) {
@@ -158,6 +169,7 @@ export {
   writeMemoryInWorker,
   sweepSessionEventsRetentionInWorker,
   sweepConversationsRetentionInWorker,
+  requestMaintenanceWrite,
   _getDbWriteWorkerForTests,
   disposeDbWriteWorker
 };

package/dist/{chunk-RDWIKDMY.js → chunk-PZR54BEI.js}

@@ -138,7 +138,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-ZQQ5YYPJ.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-U53FBVCQ.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {
@@ -383,7 +383,7 @@ function registryProxyOptionsFromEnv(env = process.env) {
     upstreamToken,
     pullTokens,
     allowedNamespace: env.EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE || "askexe",
-    licenseValidatorUrl: env.EXE_REGISTRY_PROXY_LICENSE_VALIDATOR_URL || "https://api.askexe.com/v1/license/validate",
+    licenseValidatorUrl: env.EXE_REGISTRY_PROXY_LICENSE_VALIDATOR_URL || "https://cloud.askexe.com/auth/activate",
     databaseUrl: env.EXE_REGISTRY_PROXY_DATABASE_URL || env.DATABASE_URL || void 0,
     publisherTokens: parsePublisherTokens(env.EXE_REGISTRY_PROXY_PUBLISHER_TOKENS),
     stackPublicKeyPem: readStackPublicKey(env)
@@ -424,10 +424,12 @@ async function validateLicenseKey(licenseKey, validatorUrl) {
     const res = await fetch(validatorUrl, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ licenseKey }),
+      body: JSON.stringify({ apiKey: licenseKey }),
       signal: AbortSignal.timeout(5e3)
     });
-    return res.ok;
+    if (!res.ok) return false;
+    const verdict = await res.json();
+    return verdict.valid === true;
   } catch {
     return false;
   }
@@ -637,23 +639,9 @@ function createRegistryProxyServer(options) {
     }
     return manifestPoolInit;
   }
-  async function isLicenseKeyValidLocally(pool, token) {
-    try {
-      const r = await pool.query(
-        "SELECT 1 FROM billing.licenses WHERE key = $1 AND status = 'active' AND (expires_at IS NULL OR expires_at > now()) LIMIT 1",
-        [token]
-      );
-      return r.rows.length > 0;
-    } catch (err) {
-      console.error("[registry-proxy] local license validation failed:", err instanceof Error ? err.message : String(err));
-      return false;
-    }
-  }
   async function isManifestAuthorized(token) {
     if (timingSafeIncludes(options.pullTokens, token)) return true;
     if (!isLicenseKeyFormat(token)) return false;
-    const pool = await getManifestPool();
-    if (pool && await isLicenseKeyValidLocally(pool, token)) return true;
     if (options.licenseValidatorUrl) return validateLicenseKey(token, options.licenseValidatorUrl);
     return false;
   }
@@ -937,12 +925,12 @@ async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
   await new Promise((resolve) => server.listen(options.port, options.host, resolve));
   console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
   console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
-  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-BVSG3WMW.js");
+  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-76JVI2M5.js");
   const syncConfig = licenseSyncConfigFromEnv();
   if (syncConfig) {
     startLicenseSyncScheduler(syncConfig);
     console.log(
-      `[license-sync] scheduler started (interval=${syncConfig.intervalMs ?? 36e5}ms, D1\u2192billing.licenses, one-way)`
+      `[license-sync] scheduler started (interval=${syncConfig.intervalMs ?? 36e5}ms, GoTrue\u2192billing.licenses, one-way)`
     );
   }
 }

package/dist/{chunk-2FKU4ZEO.js → chunk-QDBKMEYY.js}

@@ -2,7 +2,7 @@ import {
   dispatchTaskToEmployee,
   markTaskNotificationsRead,
   notifyTaskDone
-} from "./chunk-P2UY34XE.js";
+} from "./chunk-D4C57S2H.js";
 import {
   clearCurrentTask,
   writeCurrentTask
@@ -19,7 +19,7 @@ import {
   strictSessionScopeFilter,
   updateTaskStatus,
   writeNotification
-} from "./chunk-7UHZBVP3.js";
+} from "./chunk-QDVLVLXP.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
@@ -30,7 +30,7 @@ import {
   getClient,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 import {
   isAutonomousTmuxSpawnEnabled
 } from "./chunk-MMS2HBRT.js";
@@ -85,7 +85,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
   if (unblockedRows.rows.length > 0 && !process.env.VITEST) {
     const autonomousSpawnAllowed = isAutonomousTmuxSpawnEnabled();
     try {
-      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-7PBE4U7T.js");
+      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-YND5MKWJ.js");
       const dispatched = /* @__PURE__ */ new Set();
       for (const ur of unblockedRows.rows) {
         if (!unblockedRowMayAutoDispatch(ur, autonomousSpawnAllowed)) continue;
@@ -97,7 +97,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
       }
     } catch {
       try {
-        const { queueIntercom } = await import("./intercom-queue-4FFXCBHO.js");
+        const { queueIntercom } = await import("./intercom-queue-OE25GJF2.js");
         const dispatched = /* @__PURE__ */ new Set();
         for (const ur of unblockedRows.rows) {
           if (!unblockedRowIsDurableTmux(ur)) continue;
@@ -313,7 +313,7 @@ async function updateTask(input, deps = {}) {
         try {
           process.stderr.write(`[tasks] EVENT: tmux delivery failed for reviewer="${reviewer}". Queueing for daemon delivery.
 `);
-          const { queueIntercom } = await import("./intercom-queue-4FFXCBHO.js");
+          const { queueIntercom } = await import("./intercom-queue-OE25GJF2.js");
           const { resolveExeSession } = await import("./lib/tmux-routing.js");
           const exeSession = row.session_scope ? String(row.session_scope) : resolveExeSession();
           if (exeSession) {
@@ -330,7 +330,7 @@ async function updateTask(input, deps = {}) {
         }
       }
       try {
-        const { pushNotifyAsync } = await import("./push-notifications-M7YU63FY.js");
+        const { pushNotifyAsync } = await import("./push-notifications-XC6EQEXF.js");
         pushNotifyAsync({
           event: "review_ready",
           title: `Review ready: ${taskTitle.slice(0, 50)}`,
@@ -342,7 +342,7 @@ async function updateTask(input, deps = {}) {
     }
     if (isLegacyExecution && !isCoordinator && isCompletionReviewTransition) {
       try {
-        const { pushNotifyAsync } = await import("./push-notifications-M7YU63FY.js");
+        const { pushNotifyAsync } = await import("./push-notifications-XC6EQEXF.js");
         const event = input.status === "needs_review" ? "review_ready" : "task_complete";
         pushNotifyAsync({
           event,
@@ -357,7 +357,7 @@ async function updateTask(input, deps = {}) {
     await markTaskNotificationsRead(taskFile);
     if (isLegacyExecution && isCompletionReviewTransition && !isCoordinator && row.reviewer) {
       try {
-        const { writeNotification: writeNotification2 } = await import("./notifications-JE3PX55X.js");
+        const { writeNotification: writeNotification2 } = await import("./notifications-3R6HNHDR.js");
         const reviewer = String(row.reviewer);
         await writeNotification2({
           agentId: reviewer,