@askexenow/exe-os 0.9.400 → 0.9.402

package/dist/{chunk-FHBFNDIR.js → chunk-ABYV3K3Y.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-NEHOQ3P2.js";
 import {
   isCrdtSyncEnabled
-} from "./chunk-V2Z23CEF.js";
+} from "./chunk-PDKMK2GJ.js";
 import {
   orgMembershipsPath,
   orgModeActive
-} from "./chunk-M2RVBCVL.js";
+} from "./chunk-OAOEW2SZ.js";
 import {
   activeRecipientPubKeys,
   grantsPath,
   isGrantsMacPrimed,
   primeGrantsMacKey,
   warnActiveMonitoringOnce
-} from "./chunk-H6FPXML4.js";
+} from "./chunk-V5DXD4TU.js";
 import {
   assertGateAndGrantsColocated
 } from "./chunk-NPXIS2RY.js";
@@ -25,7 +25,7 @@ import {
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-QIOU2PXK.js";
+} from "./chunk-SWQRQB4M.js";
 import {
   isTransientDaemonTransportError,
   retryOnDaemonTransportError
@@ -36,17 +36,17 @@ import {
   encryptSyncBlob,
   initSyncCrypto,
   isSyncCryptoInitialized
-} from "./chunk-WB7TP6IW.js";
+} from "./chunk-O5ORPJJX.js";
 import {
   getClient,
   isGenuineCorruptionError,
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-T3CVFB3J.js";
+} from "./chunk-4OZXJX3M.js";
 import {
   loadDeviceId
-} from "./chunk-2PSEY7AN.js";
+} from "./chunk-DOUHD6KC.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -72,7 +72,7 @@ var _lastSealOrgMode = null;
 async function getSyncCipher() {
   if (_resolved) return _resolved;
   if (!orgModeActive()) {
-    const mod = await import("./founder-monitor-envelope-5OKQH6E4.js");
+    const mod = await import("./founder-monitor-envelope-WLOWBTTD.js");
     _monitoredWriter = mod.encryptMonitoredSyncBlob;
     _founderModuleLinked = true;
   }
@@ -1283,7 +1283,7 @@ async function cloudSync(config, options) {
           })
         };
         if (shouldUseCrdtMergeForCloudSync()) {
-          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-ZV7UD2MD.js");
+          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-H74HCZSY.js");
           initCrdtDoc();
           importExistingMemories(
             pullResult.records.map((rec) => ({
@@ -1844,7 +1844,7 @@ async function cloudSync(config, options) {
     const artifactResult = { pushed: 0, frozen: false, remaining: 0 };
     if (!shouldSkip("artifacts")) {
       try {
-        const { flushArtifactBackups } = await import("./artifact-backup-JLYSQRNJ.js");
+        const { flushArtifactBackups } = await import("./artifact-backup-AICTE3YO.js");
         const flushed = await flushArtifactBackups(cloudArtifactTransport(config));
         artifactResult.pushed = flushed.pushed;
         artifactResult.frozen = flushed.frozen;

package/dist/{chunk-PUQKRKQQ.js → chunk-AMRJS3UF.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-35GQRTAN.js";
+} from "./chunk-GVZPT5GJ.js";
 
 // src/lib/worktree.ts
 import { execFile, execFileSync, execSync } from "child_process";

package/dist/{chunk-GJ4XERZA.js → chunk-AR2K7SUC.js}

@@ -19,7 +19,7 @@ import {
 } from "./chunk-RT57D7C4.js";
 import {
   loadLicense
-} from "./chunk-2PSEY7AN.js";
+} from "./chunk-DOUHD6KC.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";
@@ -32,6 +32,73 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { parseDocument as parseYamlDocument } from "yaml";
 
+// src/lib/erp-asset-smoke.ts
+var REQUIRED_DESK_BUNDLES = {
+  "desk.bundle.js": "javascript",
+  "desk.bundle.css": "css"
+};
+var ASSET_PATH_PATTERN = /^\/assets\/[A-Za-z0-9_-]+\/dist\/(?:css|js)\/[^"' >]+$/;
+var CONTENT_TYPE_PATTERN = {
+  javascript: /javascript/i,
+  css: /(?:^|\/)css/i
+};
+async function verifyErpAssets(port, siteName, fetchPage = fetch) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error("ERP asset smoke refused an invalid loopback port");
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9.-]{0,252}$/.test(siteName)) {
+    throw new Error("ERP asset smoke refused an invalid site name");
+  }
+  const origin = `http://127.0.0.1:${port}`;
+  const signal = AbortSignal.timeout(6e4);
+  const get = async (path2) => {
+    let url = new URL(path2, origin);
+    for (let redirects = 0; redirects < 5; redirects++) {
+      if (url.origin !== origin) throw new Error("ERP asset smoke refused an external redirect");
+      const response = await fetchPage(url, { redirect: "manual", signal, headers: { Host: siteName } });
+      if (![301, 302, 303, 307, 308].includes(response.status)) return response;
+      const location = response.headers.get("location");
+      await response.body?.cancel();
+      if (!location) throw new Error("ERP asset smoke encountered a redirect without a location");
+      url = new URL(location, url);
+    }
+    throw new Error("ERP asset smoke exceeded its redirect limit");
+  };
+  const manifestResponse = await get("/assets/assets.json");
+  if (manifestResponse.status !== 200) {
+    await manifestResponse.body?.cancel();
+    throw new Error(`ERP asset smoke: assets.json manifest returned HTTP ${manifestResponse.status}`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(await manifestResponse.text());
+  } catch {
+    throw new Error("ERP asset smoke: assets.json manifest was not valid JSON");
+  }
+  if (typeof manifest !== "object" || manifest === null || Array.isArray(manifest)) {
+    throw new Error("ERP asset smoke: assets.json manifest was not a JSON object");
+  }
+  const assetPaths = /* @__PURE__ */ new Map();
+  for (const [key, kind] of Object.entries(REQUIRED_DESK_BUNDLES)) {
+    const value = manifest[key];
+    if (typeof value !== "string" || !ASSET_PATH_PATTERN.test(value)) {
+      throw new Error(`ERP asset smoke: assets.json manifest is missing the desk ${kind} bundle ("${key}")`);
+    }
+    assetPaths.set(value, kind);
+  }
+  for (const [asset, kind] of assetPaths) {
+    const response = await get(asset);
+    await response.body?.cancel();
+    if (response.status !== 200) {
+      throw new Error(`ERP asset smoke: ${asset} returned HTTP ${response.status}`);
+    }
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!CONTENT_TYPE_PATTERN[kind].test(contentType)) {
+      throw new Error(`ERP asset smoke: ${asset} did not return a ${kind} content type (got "${contentType}")`);
+    }
+  }
+}
+
 // src/lib/service-env-contract.ts
 import { parse as parseYaml } from "yaml";
 var SERVICE_ENV_CONTRACT = [
@@ -1211,8 +1278,9 @@ async function rollbackStackUpdate(options) {
     throw new Error("--retain-compose rollback refused an unscoped restart; restore the selected service from backup manually");
   }
   if (scopedServiceNames.length > 0 && lockData?.services) {
-    const scopedComposeServices = expandComposeServicesWithSidecars(
-      scopedServiceNames.map((serviceName) => lockData.services[serviceName]?.composeService ?? serviceName)
+    const scopedComposeServices = scopedComposeImageServices(
+      scopedServiceNames.map((serviceName) => lockData.services[serviceName]?.composeService ?? serviceName),
+      options.retainCompose
     );
     for (const composeServiceName of scopedComposeServices) {
       exec("docker", [...composeArgs, "up", "-d", ...options.retainCompose ? [] : ["--remove-orphans"], "--no-deps", composeServiceName]);
@@ -1246,7 +1314,10 @@ async function rollbackStackUpdate(options) {
       );
     }
   }
-  const rolledBackComposeServices = scopedServiceNames.length > 0 && lockData?.services ? [...new Set(expandComposeServicesWithSidecars(scopedServiceNames.map((name) => lockData.services[name]?.composeService ?? name)))] : [...new Set(Object.entries(lockData?.services ?? {}).map(([name, svc]) => svc.composeService ?? name))];
+  const rolledBackComposeServices = scopedServiceNames.length > 0 && lockData?.services ? [...new Set(scopedComposeImageServices(scopedServiceNames.map((name) => lockData.services[name]?.composeService ?? name), options.retainCompose))] : [...new Set(Object.entries(lockData?.services ?? {}).map(([name, svc]) => svc.composeService ?? name))];
+  if (options.retainCompose && rolledBackComposeServices.includes("exe-erp")) {
+    rolledBackComposeServices.push(ERP_RETAINED_OBSERVER);
+  }
   try {
     await verifyComposeServicesRunning(
       composeArgs,
@@ -1370,6 +1441,14 @@ function expandComposeServicesWithSidecars(primaryComposeServices) {
   }
   return expanded;
 }
+var ERP_RETAINED_IMAGE_SERVICES = ["exe-erp", "exe-erp-websocket", "exe-erp-queue", "exe-erp-scheduler"];
+var ERP_RETAINED_OBSERVER = "exe-erp-nginx";
+function retainedComposeImageServices(primaryComposeServices) {
+  return primaryComposeServices.length === 1 && primaryComposeServices[0] === "exe-erp" ? [...ERP_RETAINED_IMAGE_SERVICES] : expandComposeServicesWithSidecars(primaryComposeServices);
+}
+function scopedComposeImageServices(primaryComposeServices, retainCompose) {
+  return retainCompose ? retainedComposeImageServices(primaryComposeServices) : expandComposeServicesWithSidecars(primaryComposeServices);
+}
 function resolveOwningManifestService(composeService, services) {
   const direct = Object.entries(services).find(
     ([name, svc]) => name === composeService || (svc.composeService ?? name) === composeService
@@ -1618,6 +1697,26 @@ function parseEnv(raw) {
   }
   return env;
 }
+function unquoteComposeEnvValue(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length >= 2) {
+    const first = trimmed[0];
+    const last = trimmed[trimmed.length - 1];
+    if (first === '"' && last === '"') {
+      return trimmed.slice(1, -1).replace(/\\(["\\])/g, "$1");
+    }
+    if (first === "'" && last === "'") {
+      return trimmed.slice(1, -1);
+    }
+  }
+  return trimmed;
+}
+function resolveComposeEnvValue(env, key, fallback) {
+  const raw = env.get(key);
+  if (raw === void 0) return fallback;
+  const value = unquoteComposeEnvValue(raw);
+  return value !== "" ? value : fallback;
+}
 function patchEnv(raw, updates) {
   const seen = /* @__PURE__ */ new Set();
   const lines = raw.replace(/\n$/, "").split(/\r?\n/);
@@ -2511,8 +2610,11 @@ function assertRetainedComposePlan(input, plan, liveComposeRaw, envRaw, processE
   if (service.migrations || plan.release.migrations) {
     throw new Error("--retain-compose cannot run service or release migrations");
   }
-  const composeServices = expandComposeServicesWithSidecars([service.composeService ?? name]);
-  if (composeServices.length > 1 && !(name === "crm" && composeServices.length === 2 && composeServices[0] === "exe-crm" && composeServices[1] === "exe-crm-worker")) {
+  const allComposeServices = expandComposeServicesWithSidecars([service.composeService ?? name]);
+  const composeServices = retainedComposeImageServices([service.composeService ?? name]);
+  const isCrmGroup = name === "crm" && composeServices.length === 2 && composeServices[0] === "exe-crm" && composeServices[1] === "exe-crm-worker";
+  const isErpGroup = name === "erp" && allComposeServices.length === 5 && allComposeServices.every((target, index) => target === ["exe-erp", ERP_RETAINED_OBSERVER, ...ERP_RETAINED_IMAGE_SERVICES.slice(1)][index]) && composeServices.length === ERP_RETAINED_IMAGE_SERVICES.length;
+  if (allComposeServices.length > 1 && !isCrmGroup && !isErpGroup) {
     throw new Error("--retain-compose requires a service with no unsupported companion sidecars");
   }
   if (!service.env || plan.changes.length !== 1 || plan.changes[0].service !== name || plan.changes[0].key !== service.env) {
@@ -2546,6 +2648,9 @@ function assertRetainedComposePlan(input, plan, liveComposeRaw, envRaw, processE
       throw new Error(`--retain-compose refused: rendered selected service ${composeService} image differs from signed image pin`);
     }
   }
+  if (isErpGroup) {
+    retainedErpNginxImageRef(liveComposeRaw, liveOverrideRaw);
+  }
   const env = parseEnv(envRaw);
   const monitorKey = env.get("EXE_MONITOR_KEY") ?? "";
   if (!monitorKey.trim() || /CHANGEME/.test(monitorKey)) {
@@ -3926,6 +4031,7 @@ async function runStackUpdateUnlocked(options) {
     removeService: options.removeService,
     rollback: options.rollback
   }, plan, composeRaw, envRaw, process.env, retainedComposeFiles?.override ?? null);
+  const erpNginxRef = options.retainCompose && Object.keys(plan.release.services).length === 1 && plan.release.services.erp ? retainedErpNginxImageRef(composeRaw, retainedComposeFiles?.override ?? null) : null;
   const retainedOverrideHash = retainedComposeFiles ? retainedComposeFiles.override === null ? null : createHash("sha256").update(retainedComposeFiles.override).digest("hex") : void 0;
   const stagedCompose = readStagedComposeTemplate(options, composeRaw);
   const targetRelease = manifest.stacks[plan.targetVersion];
@@ -3984,7 +4090,7 @@ ${lines.join("\n")}`
     if (options.retainCompose) {
       const [name, service] = Object.entries(plan.release.services)[0];
       const composeArgs2 = composeArgsForStack(options.composeFile, options.envFile);
-      for (const target of expandComposeServicesWithSidecars([service.composeService ?? name])) {
+      for (const target of retainedComposeImageServices([service.composeService ?? name])) {
         assertRetainedComposeRunningService(
           composeArgs2,
           target,
@@ -3998,6 +4104,25 @@ ${lines.join("\n")}`
           options.composeConfigCapture ?? defaultComposeConfigCapture
         );
       }
+      if (erpNginxRef) {
+        assertRetainedComposeRunningService(
+          composeArgs2,
+          ERP_RETAINED_OBSERVER,
+          options.composePsCapture ?? defaultComposePsCapture
+        );
+        assertRetainedComposeRenderedFixedImage(
+          composeArgs2,
+          ERP_RETAINED_OBSERVER,
+          erpNginxRef,
+          options.composeConfigCapture ?? defaultComposeConfigCapture
+        );
+        assertRetainedComposeImageWitness(
+          composeArgs2,
+          ERP_RETAINED_OBSERVER,
+          erpNginxRef,
+          options.retainedImageIds ?? captureRetainedComposeImageIds
+        );
+      }
     }
     const hostState = listHostComposeServices(
       composeArgsForStack(options.composeFile, options.envFile),
@@ -4375,8 +4500,9 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         );
       }
     }
-    const composePullTargets = expandComposeServicesWithSidecars(
-      Object.entries(plan.release.services).map(([name, svc]) => svc.composeService ?? name)
+    const composePullTargets = scopedComposeImageServices(
+      Object.entries(plan.release.services).map(([name, svc]) => svc.composeService ?? name),
+      options.retainCompose
     );
     try {
       if (composePullTargets.length > 0) {
@@ -4490,7 +4616,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       // tunnel — restarted last so services are healthy before it connects
     ];
     const primaryComposeServices = Object.entries(plan.release.services).map(([serviceName, service]) => service.composeService ?? serviceName);
-    const scopedComposeServices = expandComposeServicesWithSidecars(primaryComposeServices);
+    const scopedComposeServices = scopedComposeImageServices(primaryComposeServices, options.retainCompose);
     const restartOrder = [
       ...RESTART_ORDER.filter((service) => scopedComposeServices.includes(service)),
       ...scopedComposeServices.filter((service) => !RESTART_ORDER.includes(service))
@@ -4534,6 +4660,40 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
           plan.changes[0].after,
           options.composeConfigCapture ?? defaultComposeConfigCapture
         );
+        if (erpNginxRef) {
+          const beforeWait = parseRetainedContainerHealth(
+            (options.composePsCapture ?? defaultComposePsCapture)(composeArgs)
+          ).get(ERP_RETAINED_OBSERVER);
+          if (!beforeWait?.id || beforeWait.id !== retainedHealthBaseline?.containers.get(ERP_RETAINED_OBSERVER)?.id) {
+            throw new Error("--retain-compose refused: ERP nginx observer changed before restart");
+          }
+          await verifyComposeServicesRunning(
+            composeArgs,
+            [ERP_RETAINED_OBSERVER],
+            90,
+            options.composePsCapture,
+            void 0,
+            true
+          );
+          const currentNginx = parseRetainedContainerHealth(
+            (options.composePsCapture ?? defaultComposePsCapture)(composeArgs)
+          ).get(ERP_RETAINED_OBSERVER);
+          if (currentNginx?.id !== beforeWait.id || !retainedContainerIsHealthy(currentNginx)) {
+            throw new Error("--retain-compose refused: ERP nginx observer changed before restart");
+          }
+          assertRetainedComposeRenderedFixedImage(
+            composeArgs,
+            ERP_RETAINED_OBSERVER,
+            erpNginxRef,
+            options.composeConfigCapture ?? defaultComposeConfigCapture
+          );
+          assertRetainedComposeImageWitness(
+            composeArgs,
+            ERP_RETAINED_OBSERVER,
+            erpNginxRef,
+            options.retainedImageIds ?? captureRetainedComposeImageIds
+          );
+        }
       }
       progress.logServiceStep(restartIndex, service, "Restarting");
       if (service === "exe-wiki") {
@@ -4642,6 +4802,16 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       }
     }
     if (retainedHealthBaseline) {
+      if (erpNginxRef) {
+        await verifyComposeServicesRunning(
+          composeArgs,
+          [ERP_RETAINED_OBSERVER],
+          90,
+          options.composePsCapture,
+          void 0,
+          true
+        );
+      }
       const capture = (timeoutMs) => parseRetainedContainerHealth(
         (options.composePsCapture ?? defaultComposePsCapture)(composeArgs, timeoutMs)
       );
@@ -4651,6 +4821,29 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       if (regressions.length > 0) {
         throw new Error(`--retain-compose health regression after update: ${regressions.join(", ")}`);
       }
+      if (erpNginxRef) {
+        const beforeNginx = retainedHealthBaseline.containers.get(ERP_RETAINED_OBSERVER);
+        const afterNginx = after.get(ERP_RETAINED_OBSERVER);
+        if (!beforeNginx?.id || afterNginx?.id !== beforeNginx.id) {
+          throw new Error("--retain-compose ERP nginx observer changed container identity");
+        }
+        assertRetainedComposeRenderedFixedImage(
+          composeArgs,
+          ERP_RETAINED_OBSERVER,
+          erpNginxRef,
+          options.composeConfigCapture ?? defaultComposeConfigCapture
+        );
+        assertRetainedComposeImageWitness(
+          composeArgs,
+          ERP_RETAINED_OBSERVER,
+          erpNginxRef,
+          options.retainedImageIds ?? captureRetainedComposeImageIds
+        );
+        const smokeEnv = parseEnv(readFileSync(options.envFile, "utf8"));
+        const portRaw = resolveComposeEnvValue(smokeEnv, "ERP_API_PORT", "8069");
+        const siteName = resolveComposeEnvValue(smokeEnv, "ERP_SITE_NAME", "erp.askexe.com");
+        await (options.verifyErpAssets ?? verifyErpAssets)(Number(portRaw), siteName);
+      }
     }
     {
       const cfIngressConfigPath = path.join(path.dirname(options.composeFile), "cloudflared", "config.yml");
@@ -4791,7 +4984,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         // pre-existing companion on an older digest as this service's failed
         // delivery. Retained health and image witnesses still cover the selected
         // service and its required dependencies before and after the update.
-        artifactComposeServices: options.retainCompose ? Object.entries(plan.release.services).flatMap(([name, service]) => expandComposeServicesWithSidecars([service.composeService ?? name])) : void 0
+        artifactComposeServices: options.retainCompose ? Object.entries(plan.release.services).flatMap(([name, service]) => scopedComposeImageServices([service.composeService ?? name], options.retainCompose)) : void 0
       });
       const securityFailures = [];
       for (const r of verifyReport.results) {
@@ -4905,7 +5098,7 @@ Fix these before the stack is safe to operate.`);
         const composeService = service.composeService ?? name;
         try {
           syncImagePinsWithProcessEnv(envRaw, [service.env]);
-          const restored = expandComposeServicesWithSidecars([composeService]);
+          const restored = scopedComposeImageServices([composeService], options.retainCompose);
           for (const target of restored) {
             exec("docker", [...composeArgs, "up", "-d", "--no-deps", target]);
           }
@@ -5195,6 +5388,26 @@ function assertRetainedComposeRenderedImage(composeArgs, service, imageEnvKey, e
     throw new Error(`--retain-compose refused: effective Compose image for ${service} differs from signed image pin or could not be observed`);
   }
 }
+function retainedErpNginxImageRef(baseRaw, overrideRaw) {
+  const base = parseComposeServiceImages(baseRaw);
+  const override = overrideRaw === null ? /* @__PURE__ */ new Map() : parseComposeServiceImages(overrideRaw);
+  const expression = override.get(ERP_RETAINED_OBSERVER) ?? base.get(ERP_RETAINED_OBSERVER);
+  if (!expression || envRefsInImageExpression(expression).length || !/@sha256:[a-f0-9]{64}$/i.test(expression)) {
+    throw new Error("--retain-compose refused: ERP nginx observer must use a fixed digest-pinned image");
+  }
+  return expression;
+}
+function assertRetainedComposeRenderedFixedImage(composeArgs, service, expectedRef, capture = defaultComposeConfigCapture) {
+  let rendered;
+  try {
+    const raw = capture(composeArgs, process.env);
+    rendered = raw ? JSON.parse(raw).services?.[service]?.image : void 0;
+  } catch {
+  }
+  if (rendered !== expectedRef) {
+    throw new Error(`--retain-compose refused: effective Compose image for ${service} differs from signed fixed image`);
+  }
+}
 function captureRetainedComposeImageIds(composeArgs, service, expectedRef) {
   const capture = (args) => {
     const result = spawnSync2("docker", args, { encoding: "utf8", timeout: 2e4 });
@@ -5758,6 +5971,7 @@ export {
   runReleaseMigrations,
   isExecFormMigration,
   expandComposeServicesWithSidecars,
+  retainedComposeImageServices,
   resolveOwningManifestService,
   reconcileStackLockFromContainers,
   readRetainedComposeFiles,
@@ -5768,6 +5982,8 @@ export {
   loadStackManifestWithFallback,
   reportStackManifestSource,
   parseEnv,
+  unquoteComposeEnvValue,
+  resolveComposeEnvValue,
   patchEnv,
   removeEnvKeys,
   expandComposeExpression,
@@ -5839,6 +6055,8 @@ export {
   composePsYieldsRecords,
   assertRetainedComposeRunningService,
   assertRetainedComposeRenderedImage,
+  retainedErpNginxImageRef,
+  assertRetainedComposeRenderedFixedImage,
   assertRetainedComposeImageWitness,
   verifyComposeServicesRunning,
   isComposeNetworkHost,

package/dist/{chunk-QWROXB2K.js → chunk-ATI6PPTU.js}

@@ -1,6 +1,6 @@
 import {
   getMasterKey
-} from "./chunk-O2HIMMKW.js";
+} from "./chunk-4XRQEQNK.js";
 import {
   PRIVATE_DIR_MODE,
   PRIVATE_FILE_MODE,

package/dist/{chunk-LJGWR76V.js → chunk-B2U5UPDC.js}

@@ -4,10 +4,10 @@ import {
   extractIdentifiers,
   isGarbageEntity,
   normalizeEntityName
-} from "./chunk-TJMYWOLH.js";
+} from "./chunk-4MUU33NJ.js";
 import {
   getClient
-} from "./chunk-T3CVFB3J.js";
+} from "./chunk-4OZXJX3M.js";
 
 // src/lib/memory-graph-extractor.ts
 function relationshipId(sourceId, targetId, relType) {
@@ -432,7 +432,7 @@ async function upsertMemoryGraph(result, memoryId, opts) {
     });
   }
   try {
-    const { createCoOccurrenceEdges } = await import("./co-occurrence-5WZMOKZY.js");
+    const { createCoOccurrenceEdges } = await import("./co-occurrence-IZSNRYOZ.js");
     await createCoOccurrenceEdges(result.entities, memoryId, { linkOnly });
   } catch {
   }

package/dist/{chunk-BTQVKT7H.js → chunk-BPMY52GP.js}

@@ -1,13 +1,13 @@
 import {
   isExeSession
-} from "./chunk-2HJOCTAM.js";
+} from "./chunk-ROGZRDCU.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-35GQRTAN.js";
+} from "./chunk-GVZPT5GJ.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-T3CVFB3J.js";
+} from "./chunk-4OZXJX3M.js";
 import {
   isDaemonAlive
 } from "./chunk-QH5ZQ5SJ.js";

package/dist/{chunk-HOZM5RL2.js → chunk-BPRV4W4F.js}

@@ -1,13 +1,13 @@
 import {
   registerDaemonScopedQueryChokepoint
-} from "./chunk-4ZAS2F3K.js";
+} from "./chunk-GI44KWJA.js";
 import {
   orgPartnerModeActive,
   requireOrgPartnerBinding,
   resolveOrgPartnerBindings,
   resolvePartnerIdentities,
   rosterKeyLookupFor
-} from "./chunk-ELBQHL5A.js";
+} from "./chunk-EMKSTLBG.js";
 import {
   createMailboxInboxPoller,
   getMailboxInboxState
@@ -20,7 +20,7 @@ import {
   isConsentMacPrimed,
   primeTaskOriginMarkerKey,
   scopedQueryChokepointStatus
-} from "./chunk-KFIHF5RO.js";
+} from "./chunk-J77FASSK.js";
 import {
   flushMailboxOutbox
 } from "./chunk-3FGBBJYM.js";

package/dist/{chunk-BQQLAUN7.js → chunk-BPTTQRMJ.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-GJ4XERZA.js";
+} from "./chunk-AR2K7SUC.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-JQVM4YIU.js → chunk-C57T744G.js}

@@ -8,7 +8,7 @@ import {
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-2PSEY7AN.js";
+} from "./chunk-DOUHD6KC.js";
 import {
   EXE_AI_DIR,
   loadConfig

package/dist/{chunk-OTY62DK2.js → chunk-CBOD7BPX.js}

@@ -1,7 +1,7 @@
 import {
   completeReminder,
   formatAmbiguousReminder
-} from "./chunk-HY3E4VPO.js";
+} from "./chunk-UR3DB6QM.js";
 
 // src/mcp/tools/complete-reminder.ts
 import { z } from "zod";

package/dist/{chunk-JOMPRQPW.js → chunk-CMXGHLDK.js}

@@ -22,7 +22,7 @@ var OrgOriginProvenanceError = class extends Error {
 async function mintOrgOriginStamp(input) {
   if (!input.orgId) throw new OrgOriginProvenanceError("An org-origin stamp requires a non-empty org_id (\xA71.5)");
   if (!input.requestId) throw new OrgOriginProvenanceError("An org-origin stamp requires a request id");
-  const { getTaskRequest } = await import("./task-request-inbox-56VQUXKG.js");
+  const { getTaskRequest } = await import("./task-request-inbox-JFPPW6JF.js");
   const req = getTaskRequest(input.orgId, input.requestId);
   if (!req) {
     throw new OrgOriginProvenanceError(

package/dist/{chunk-E5KBHWDR.js → chunk-D37B4WEF.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-T3CVFB3J.js";
+} from "./chunk-4OZXJX3M.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-CPYHFFGE.js → chunk-D53HVC4X.js}

@@ -132,7 +132,7 @@ async function verifyOrBlock(hookPath) {
     process.stderr.write(`[SECURITY] Hook tamper detected: ${filename} \u2014 ${result.reason}
 `);
     try {
-      const { pushNotifyAsync } = await import("./push-notifications-VY2WM6OW.js");
+      const { pushNotifyAsync } = await import("./push-notifications-KAV2I7BT.js");
       pushNotifyAsync({
         event: "security_alert",
         title: "Hook tamper detected",

package/dist/{chunk-4ZI4FXNC.js → chunk-D6I4RTPF.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-35GQRTAN.js";
+} from "./chunk-GVZPT5GJ.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-HSGBZSCA.js";

package/dist/{chunk-FJ7MZAF7.js → chunk-DCKRZG4B.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-RGPEUXOE.js";
 import {
   sessionScopeFilter
-} from "./chunk-2HJOCTAM.js";
+} from "./chunk-ROGZRDCU.js";
 import {
   isWithin
 } from "./chunk-YRUZK2QA.js";
@@ -297,7 +297,7 @@ async function sweepTasks(projectName, options = {}) {
     }
     if (!dryRun) {
       try {
-        const { updateTaskStatus } = await import("./tasks-crud-LEDUFYKV.js");
+        const { updateTaskStatus } = await import("./tasks-crud-XSCWP2ZQ.js");
         await updateTaskStatus({
           taskId: task.id,
           status: "needs_review",

package/dist/{chunk-CAPWUB4N.js → chunk-DLU6DGSY.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-BTSWFMEH.js";
 import {
   getClient
-} from "./chunk-T3CVFB3J.js";
+} from "./chunk-4OZXJX3M.js";
 
 // src/lib/work-claims.ts
 var CLAIM_TTL_MINUTES = 90;
@@ -306,7 +306,7 @@ async function heartbeatClaims(holderSession, ttlMinutes = CLAIM_TTL_MINUTES) {
 }
 async function recordClaimEvent(eventType, sessionScope, agentId, payload, severity) {
   try {
-    const { recordOrchestrationEventBestEffort } = await import("./orchestration-events-OBH4XY2J.js");
+    const { recordOrchestrationEventBestEffort } = await import("./orchestration-events-7JWQRUVB.js");
     recordOrchestrationEventBestEffort({
       eventType,
       source: "work-claims",

package/dist/{chunk-2PSEY7AN.js → chunk-DOUHD6KC.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-3R7UDPVR.js";
 import {
   getDeviceInfo
-} from "./chunk-NYL3M7GZ.js";
+} from "./chunk-K25XOKDF.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";