@indigoai-us/hq-cli 5.101.5 → 5.101.7

package/dist/lib/mesh/api.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Native work-mesh client for `hq mesh`.
+ *
+ * Talks to hq-pro over the shared vault fetch + Cognito session. Writes the
+ * machine cache apps already read. Does not spawn the pack helper and does
+ * not start MQTT listen.
+ */
+export declare const STORY_STATUSES: Set<string>;
+export declare const ACTIVE_STATUSES: Set<string>;
+export interface MeshCompany {
+    companyUid: string;
+    companySlug: string;
+}
+export interface MeshThread {
+    threadId?: string;
+    projectId?: string;
+    companyUid?: string;
+    threadStatus?: string;
+    ownerUid?: string;
+    progressSummary?: string;
+    sourceSignalSummary?: string;
+    blockedReason?: string;
+    lastActivityAt?: string;
+    createdAt?: string;
+}
+export declare function meshJson(token: string, path: string, init?: {
+    method?: string;
+    body?: Record<string, unknown>;
+    query?: Record<string, string>;
+}): Promise<unknown>;
+export declare function resolveMeshCompany(token: string, company?: string): Promise<MeshCompany>;
+export declare function requireToken(): Promise<string>;
+export declare function listActiveThreads(token: string, companyUid: string, projectId?: string): Promise<MeshThread[]>;
+export declare function clamp(value: string, max: number): string;
+export declare function eventPayload(kind: string, opts: {
+    summary?: string;
+    reason?: string;
+    ask?: string[];
+}, claimedBy: string): Record<string, unknown>;
+export declare function ensureProjectThread(token: string, company: MeshCompany, projectId: string, opts: {
+    threadId?: string;
+    summary?: string;
+}): Promise<{
+    threadId: string;
+    created: boolean;
+}>;
+export declare function appendThreadEvent(token: string, companyUid: string, threadId: string, eventKind: string, payload: Record<string, unknown>): Promise<{
+    eventId?: string;
+    createdAt?: string;
+}>;
+export declare function patchStoryStatus(token: string, companyUid: string, projectId: string, storyId: string, status: string): Promise<{
+    status: string;
+    version?: number;
+    projectId: string;
+}>;
+export declare function pairDmUidsFromInbox(inbox: unknown): string[];
+export interface WarmCacheResult {
+    directory: boolean;
+    inbox: boolean;
+    contacts: boolean;
+    threads: number;
+    cacheRoot: string;
+}
+/** Warm inbox + contacts + pair threads + directory into the local cache. */
+export declare function warmMeshConversationCache(token: string, principalUid: string, cacheRoot?: string): Promise<WarmCacheResult>;
+export declare function entityUidFromJwt(token: string): string | undefined;
+export declare function principalUidFromTopic(topic: unknown): string | undefined;
+/** Extract prs_/agt_ from a realtime credentials payload. Never returns secrets. */
+export declare function principalUidFromRealtimePayload(data: unknown): string | undefined;
+/**
+ * Cache key for directory/inbox/contacts. `custom:entityUid` rides the ID
+ * token (access tokens only have email/sub), so prefer the cached idToken.
+ */
+export declare function meshCachePrincipalUid(tokens: {
+    idToken?: string;
+    accessToken?: string;
+} | null | undefined, fallbackToken?: string): string;
+/**
+ * Resolve the cache principal. JWT first; if the human access/id tokens have
+ * no entityUid, ask `/v1/realtime/credentials` (same fallback as the pack
+ * doctor). Only the uid is kept — credentials are discarded.
+ */
+export declare function resolveMeshPrincipalUid(token: string, tokens?: {
+    idToken?: string;
+    accessToken?: string;
+} | null): Promise<string>;
+export declare function callerLabelFromToken(token: string): string;
+//# sourceMappingURL=api.d.ts.map

package/dist/lib/mesh/api.js

@@ -0,0 +1,319 @@
+/**
+ * Native work-mesh client for `hq mesh`.
+ *
+ * Talks to hq-pro over the shared vault fetch + Cognito session. Writes the
+ * machine cache apps already read. Does not spawn the pack helper and does
+ * not start MQTT listen.
+ */
+import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { peekIdToken } from "../../utils/id-token.js";
+import { getCompanyUid, vaultApiFetch } from "../../utils/vault-api.js";
+import { meshCacheRoot, removeSessionFallbackFiles, writeMeshCacheFile, } from "./cache.js";
+const PRINCIPAL_UID = /^(prs|agt)_/;
+export const STORY_STATUSES = new Set([
+    "queued",
+    "in_progress",
+    "review",
+    "done",
+]);
+export const ACTIVE_STATUSES = new Set([
+    "open",
+    "claimed",
+    "in-progress",
+    "blocked",
+    "needs-human",
+]);
+export async function meshJson(token, path, init = {}) {
+    const res = await vaultApiFetch({
+        token,
+        path,
+        method: init.method,
+        body: init.body,
+        query: init.query,
+    });
+    const text = await res.text();
+    let data = {};
+    if (text) {
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            data = { raw: text };
+        }
+    }
+    if (!res.ok) {
+        const err = data;
+        throw new Error(err.error || err.message || `${res.status} ${res.statusText}`);
+    }
+    return data;
+}
+export async function resolveMeshCompany(token, company) {
+    const explicit = process.env.HQ_WORK_MESH_COMPANY_UID || process.env.HQ_COMPANY_UID;
+    if (explicit?.trim()) {
+        return { companyUid: explicit.trim(), companySlug: company || explicit.trim() };
+    }
+    if (company && /^(cmp|co)_/.test(company)) {
+        return { companyUid: company, companySlug: company };
+    }
+    const uid = await getCompanyUid(token, company);
+    return { companyUid: uid, companySlug: company || uid };
+}
+export async function requireToken() {
+    return ensureCognitoToken();
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+export async function listActiveThreads(token, companyUid, projectId) {
+    const collected = [];
+    for (const status of ACTIVE_STATUSES) {
+        let cursor = "";
+        for (let page = 0; page < 10; page += 1) {
+            const query = {
+                companyUid,
+                status,
+                limit: "100",
+            };
+            if (cursor)
+                query.cursor = cursor;
+            const data = asRecord(await meshJson(token, "/v1/work-mesh/threads", { query }));
+            const rows = Array.isArray(data?.threads)
+                ? data.threads
+                : Array.isArray(data?.items)
+                    ? data.items
+                    : [];
+            for (const row of rows) {
+                const rec = asRecord(row);
+                if (!rec)
+                    continue;
+                collected.push(rec);
+            }
+            cursor = typeof data?.nextCursor === "string" ? data.nextCursor : "";
+            if (!cursor)
+                break;
+        }
+    }
+    return collected
+        .filter((thread) => !projectId || thread.projectId === projectId)
+        .sort((a, b) => String(b.lastActivityAt || b.createdAt || "").localeCompare(String(a.lastActivityAt || a.createdAt || "")));
+}
+export function clamp(value, max) {
+    return value.length <= max ? value : value.slice(0, max);
+}
+export function eventPayload(kind, opts, claimedBy) {
+    if (kind === "claim") {
+        return {
+            claimedBy: clamp(claimedBy, 120),
+            leaseTtlIso: new Date(Date.now() + 120 * 60 * 1000).toISOString(),
+            note: clamp(opts.summary || "Starting HQ project work.", 280),
+        };
+    }
+    if (kind === "progress") {
+        return { summary: clamp(opts.summary || "Project work is in progress.", 280) };
+    }
+    if (kind === "blocked") {
+        return {
+            reason: clamp(opts.reason || opts.summary || "Project work is blocked.", 500),
+            asks: (opts.ask ?? []).filter(Boolean).slice(0, 5),
+        };
+    }
+    if (kind === "done") {
+        return { summary: clamp(opts.summary || "Project work completed.", 280) };
+    }
+    return {
+        text: clamp(opts.summary || "HQ project note.", 500),
+        noteKind: "audit",
+    };
+}
+export async function ensureProjectThread(token, company, projectId, opts) {
+    if (opts.threadId)
+        return { threadId: opts.threadId, created: false };
+    const existing = (await listActiveThreads(token, company.companyUid, projectId))[0];
+    if (existing?.threadId)
+        return { threadId: existing.threadId, created: false };
+    const created = asRecord(await meshJson(token, "/v1/work-mesh/threads", {
+        method: "POST",
+        body: {
+            companyUid: company.companyUid,
+            projectId,
+            sourceSignalSummary: clamp(opts.summary || `HQ project ${projectId}`, 280),
+            routing: {
+                priority: "normal",
+                tags: ["hq-project", `project:${projectId}`],
+            },
+        },
+    }));
+    const threadId = String(created?.threadId || "").trim();
+    if (!threadId)
+        throw new Error("Work mesh did not return a threadId");
+    return { threadId, created: true };
+}
+export async function appendThreadEvent(token, companyUid, threadId, eventKind, payload) {
+    const data = asRecord(await meshJson(token, `/v1/work-mesh/threads/${encodeURIComponent(threadId)}/events`, {
+        method: "POST",
+        body: { companyUid, eventKind, payload },
+    }));
+    return {
+        eventId: typeof data?.eventId === "string" ? data.eventId : undefined,
+        createdAt: typeof data?.createdAt === "string" ? data.createdAt : undefined,
+    };
+}
+export async function patchStoryStatus(token, companyUid, projectId, storyId, status) {
+    const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/stories/${encodeURIComponent(storyId)}`, {
+        method: "PATCH",
+        body: { companyUid, status },
+    }));
+    if (view && typeof view.projectId === "string" && typeof view.companyUid === "string") {
+        writeMeshCacheFile(["projects", view.companyUid, `${view.projectId}.json`], view);
+    }
+    const stories = Array.isArray(view?.stories) ? view.stories : [];
+    const patched = stories
+        .map(asRecord)
+        .find((row) => row && row.id === storyId);
+    return {
+        projectId: String(view?.projectId || projectId),
+        status: typeof patched?.status === "string" ? patched.status : status,
+        version: typeof view?.version === "number" ? view.version : undefined,
+    };
+}
+export function pairDmUidsFromInbox(inbox) {
+    const rec = asRecord(inbox);
+    const ids = new Set();
+    const events = Array.isArray(rec?.events) ? rec.events : [];
+    for (const event of events) {
+        const row = asRecord(event);
+        const uid = String(row?.fromPersonUid || "").trim();
+        if (/^(prs|agt)_[A-Za-z0-9]+$/.test(uid))
+            ids.add(uid);
+    }
+    const pairs = Array.isArray(rec?.pairUnreads) ? rec.pairUnreads : [];
+    for (const pair of pairs) {
+        const row = asRecord(pair);
+        const uid = String(row?.withPersonUid || "").trim();
+        if (/^(prs|agt)_[A-Za-z0-9]+$/.test(uid))
+            ids.add(uid);
+    }
+    return [...ids].sort();
+}
+/** Warm inbox + contacts + pair threads + directory into the local cache. */
+export async function warmMeshConversationCache(token, principalUid, cacheRoot = meshCacheRoot()) {
+    const result = {
+        directory: false,
+        inbox: false,
+        contacts: false,
+        threads: 0,
+        cacheRoot,
+    };
+    try {
+        const directory = await meshJson(token, "/v1/notify/channels", {
+            query: { cursor: "" },
+        });
+        writeMeshCacheFile(["directory", `${principalUid}.json`], directory, cacheRoot);
+        result.directory = true;
+    }
+    catch {
+        // Directory warm is best-effort; inbox is the pair-DM path.
+    }
+    const inbox = await meshJson(token, "/v1/notify/inbox", {
+        query: { limit: "50" },
+    });
+    writeMeshCacheFile(["inbox", `${principalUid}.json`], inbox, cacheRoot);
+    result.inbox = true;
+    try {
+        const contacts = await meshJson(token, "/v1/notify/contacts");
+        writeMeshCacheFile(["contacts", `${principalUid}.json`], contacts, cacheRoot);
+        result.contacts = true;
+    }
+    catch {
+        // Contacts roster is optional for the rail.
+    }
+    for (const uid of pairDmUidsFromInbox(inbox)) {
+        try {
+            const thread = await meshJson(token, "/v1/notify/thread", {
+                query: { withPersonUid: uid, limit: "50" },
+            });
+            writeMeshCacheFile(["dms", `${uid}.json`], thread, cacheRoot);
+            result.threads += 1;
+        }
+        catch {
+            // one pair must not fail the rest
+        }
+    }
+    if (PRINCIPAL_UID.test(principalUid)) {
+        removeSessionFallbackFiles(cacheRoot);
+    }
+    return result;
+}
+export function entityUidFromJwt(token) {
+    const uid = peekIdToken(token)["custom:entityUid"];
+    return typeof uid === "string" && PRINCIPAL_UID.test(uid) ? uid : undefined;
+}
+export function principalUidFromTopic(topic) {
+    if (typeof topic !== "string")
+        return undefined;
+    const match = /^hq\/((?:prs|agt)_[0-9A-HJKMNP-TV-Z]{26})(?:\/|$)/.exec(topic);
+    return match?.[1];
+}
+/** Extract prs_/agt_ from a realtime credentials payload. Never returns secrets. */
+export function principalUidFromRealtimePayload(data) {
+    const rec = asRecord(data);
+    if (!rec)
+        return undefined;
+    const claimed = rec.principalUid;
+    if (typeof claimed === "string" && PRINCIPAL_UID.test(claimed))
+        return claimed;
+    const topics = asRecord(rec.topics);
+    return (principalUidFromTopic(topics?.dm) ||
+        principalUidFromTopic(rec.topic));
+}
+/**
+ * Cache key for directory/inbox/contacts. `custom:entityUid` rides the ID
+ * token (access tokens only have email/sub), so prefer the cached idToken.
+ */
+export function meshCachePrincipalUid(tokens, fallbackToken) {
+    for (const token of [tokens?.idToken, tokens?.accessToken, fallbackToken]) {
+        if (!token)
+            continue;
+        const uid = entityUidFromJwt(token);
+        if (uid)
+            return uid;
+    }
+    return "session";
+}
+/**
+ * Resolve the cache principal. JWT first; if the human access/id tokens have
+ * no entityUid, ask `/v1/realtime/credentials` (same fallback as the pack
+ * doctor). Only the uid is kept — credentials are discarded.
+ */
+export async function resolveMeshPrincipalUid(token, tokens) {
+    const fromJwt = meshCachePrincipalUid(tokens, token);
+    if (fromJwt !== "session")
+        return fromJwt;
+    try {
+        const data = await meshJson(token, "/v1/realtime/credentials", {
+            method: "POST",
+            body: { contractVersion: 2 },
+        });
+        const uid = principalUidFromRealtimePayload(data);
+        if (uid)
+            return uid;
+    }
+    catch {
+        // best-effort; session.json is worse than failing doctor
+    }
+    return "session";
+}
+export function callerLabelFromToken(token) {
+    const claims = peekIdToken(token);
+    const entityUid = claims["custom:entityUid"];
+    if (typeof entityUid === "string" && entityUid)
+        return entityUid;
+    if (typeof claims.email === "string" && claims.email)
+        return claims.email;
+    if (typeof claims.sub === "string" && claims.sub)
+        return claims.sub;
+    return "hq-cli";
+}
+//# sourceMappingURL=api.js.map

package/dist/lib/mesh/cache.d.ts

@@ -0,0 +1,10 @@
+/**
+ * On-disk work-mesh cache. Same layout the desktop/web apps and the pack
+ * helper read: ~/.hq/work-mesh/cache/{projects,channels,directory,inbox,contacts,dms}.
+ */
+export declare function meshCacheRoot(home?: string, env?: NodeJS.ProcessEnv): string;
+export declare function isSafeCacheSegment(value: string): boolean;
+export declare function writeMeshCacheFile(segments: string[], value: unknown, root?: string): string | null;
+/** Drop leftover session.json once we know the real prs_/agt_ cache key. */
+export declare function removeSessionFallbackFiles(root?: string): void;
+//# sourceMappingURL=cache.d.ts.map

package/dist/lib/mesh/cache.js

@@ -0,0 +1,42 @@
+/**
+ * On-disk work-mesh cache. Same layout the desktop/web apps and the pack
+ * helper read: ~/.hq/work-mesh/cache/{projects,channels,directory,inbox,contacts,dms}.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export function meshCacheRoot(home = os.homedir(), env = process.env) {
+    const override = env.HQ_WORK_MESH_CACHE?.trim();
+    if (override)
+        return override;
+    return path.join(home, ".hq", "work-mesh", "cache");
+}
+export function isSafeCacheSegment(value) {
+    const trimmed = value.trim();
+    return Boolean(trimmed &&
+        trimmed.length <= 128 &&
+        !trimmed.includes("..") &&
+        /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(trimmed));
+}
+export function writeMeshCacheFile(segments, value, root = meshCacheRoot()) {
+    if (segments.length === 0 || !segments.every(isSafeCacheSegment))
+        return null;
+    const dest = path.join(root, ...segments);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    const tmp = `${dest}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`);
+    fs.renameSync(tmp, dest);
+    return dest;
+}
+/** Drop leftover session.json once we know the real prs_/agt_ cache key. */
+export function removeSessionFallbackFiles(root = meshCacheRoot()) {
+    for (const dir of ["directory", "inbox", "contacts"]) {
+        try {
+            fs.unlinkSync(path.join(root, dir, "session.json"));
+        }
+        catch {
+            // missing is fine
+        }
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/main.js

@@ -61,6 +61,7 @@ import { registerCoreCommands } from "./commands/core.js";
 import { registerSearchCommand } from "./commands/search.js";
 import { registerIndexCommand } from "./commands/index-cmd.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
+import { registerMeshCommand } from "./commands/mesh.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { networkTransportErrorMessage } from "./utils/network-transport-error.js";
@@ -274,6 +275,9 @@ registerIndexCommand(program);
 // check registry so later check families (vault, sync, MCP, …) plug in without
 // engine changes.
 registerDoctorCommand(program);
+// Work mesh (subcommand group — `hq mesh …`). Native REST + cache. Distinct
+// from `hq doctor` (hook guardrails). Does not start MQTT listen.
+registerMeshCommand(program);
 program.hook("preAction", async () => {
     await emitCliSessionStarted();
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.101.5",
+  "version": "5.101.7",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -24,12 +24,13 @@
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "vitest": "vitest",
-    "clean": "rm -rf dist"
+    "clean": "rm -rf dist",
+    "prepare": "husky || true"
   },
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "~6.15.0",
+    "@indigoai-us/hq-cloud": "~6.15.5",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",
@@ -52,6 +53,8 @@
     "@vitest/coverage-v8": "4.1.6",
     "aws-sdk-client-mock": "^4.1.0",
     "eslint": "^10.5.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^15.5.2",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.61.1",
     "vitest": "^4.1.2"
@@ -77,5 +80,8 @@
     "onlyBuiltDependencies": [
       "better-sqlite3"
     ]
+  },
+  "lint-staged": {
+    "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   }
 }

package/dist/commands/outposts-heartbeat.d.ts

@@ -1,96 +0,0 @@
-/**
- * `hq outposts heartbeat` — publish this box's agent-session summary to the
- * realtime fabric.
- *
- * Runs ON an Outpost, under systemd. It enumerates the box's local Claude Code
- * and Codex sessions with cheap scandir + stat + bounded reads, projects them
- * down to the compact secret-free `AgentSession[]` payload, and publishes to
- * `hq/{personUid}/sessions` so Mission Control can see what the box is doing.
- *
- * ## Why the cadence lives in here
- *
- * The original box-side design was a bash `while` loop that, every 5 seconds,
- * ran `hq auth refresh` and then `npx -y --package=@indigoai-us/hq-cloud@latest
- * outpost-session-heartbeat-runner`. That is ~35k process launches a day, and
- * every `npx` re-resolves the package and re-reads it off disk — on a t3 box
- * whose EBS budget is the scarce resource, that is a meaningful, permanent tax
- * for a job that should be nearly free.
- *
- * So the loop lives in-process instead:
- *   - identity is resolved ONCE per process, not once per tick;
- *   - the Cognito session refreshes itself on demand (`ensureCognitoToken`
- *     returns the cached token until it is close to expiry), so there is no
- *     separate per-tick `hq auth refresh`;
- *   - the IoT client is cached across ticks by the publisher and only rebuilt
- *     when its credentials near expiry.
- *
- * The loop is deliberately unkillable-by-transients: a failed publish, a failed
- * enumeration, or a not-yet-warm session are all logged and retried on the next
- * tick. Nothing here should ever take the service down, because a service that
- * exits looks identical to a service that is quietly failing.
- */
-import type { Command } from "commander";
-import { type FileSystemPort, type PublishPort, type SessionsHeartbeatPayload } from "../outpost/session-heartbeat.js";
-/** Everything the loop touches, injected so it is testable without a box. */
-export interface HeartbeatLoopDeps {
-    fs: FileSystemPort;
-    publish: PublishPort;
-    /** Resolve the caller's canonical `prs_*` id. Called once per process. */
-    getPersonUid: () => Promise<string>;
-    /**
-     * Wait between ticks. MUST return early when `signal` aborts — otherwise a
-     * SIGTERM arriving mid-sleep is not noticed until the full interval elapses,
-     * and systemd force-kills the process instead of it stopping cooperatively.
-     */
-    sleep: (ms: number, signal?: AbortSignal) => Promise<void>;
-    now: () => Date;
-    log: (line: string) => void;
-    /**
-     * Record that a heartbeat actually LANDED. Called only after a successful
-     * publish — never on failure, or the freshness signal it feeds would always
-     * read fresh and be worth nothing.
-     */
-    onPublished?: (payload: SessionsHeartbeatPayload) => Promise<void>;
-}
-export interface HeartbeatLoopOptions {
-    /** Emit a single heartbeat and return. */
-    once?: boolean;
-    /** Cadence between ticks. Defaults to {@link DEFAULT_HEARTBEAT_INTERVAL_SECONDS}. */
-    intervalSeconds?: number;
-    /** Home directory to scan (defaults to the process HOME). */
-    home?: string;
-    /** Print each published payload as JSON. */
-    json?: boolean;
-    /** Stop the loop cooperatively. */
-    signal?: AbortSignal;
-    /** Bound the loop — used by tests; production runs until aborted. */
-    maxTicks?: number;
-}
-/**
- * Resolve the cadence from the flag, then the environment, then the default.
- * Floored at 1s: a sub-second cadence hammers the fabric for no benefit, and a
- * zero/negative value would spin the loop hot.
- */
-export declare function resolveIntervalSeconds(flag: string | undefined, env?: NodeJS.ProcessEnv): number;
-/**
- * Where the box records its last LANDED heartbeat. The post-provision audit
- * reads this file's freshness, because "systemd says the unit is active" is not
- * evidence that anything was published — that gap is what let a heartbeat fail
- * every five seconds for nine days while every dashboard stayed green.
- *
- * Lives under the service user's home so the unit (User=ec2-user) can write it
- * without extra tmpfiles.d wiring; the SSM collector reads it as root.
- */
-export declare const DEFAULT_HEARTBEAT_STATE_FILE: string;
-/** Persist the liveness marker the box audit reads. */
-export declare function writeHeartbeatState(path: string, payload: SessionsHeartbeatPayload): Promise<void>;
-/**
- * Run the heartbeat loop. Returns the number of ticks performed.
- *
- * A "tick" is one attempt, whether or not it published — the count is the
- * loop's liveness, not its success rate.
- */
-export declare function runHeartbeatLoop(options: HeartbeatLoopOptions, deps: HeartbeatLoopDeps): Promise<number>;
-/** Wire the production dependencies and register the subcommand. */
-export declare function registerHeartbeatCommand(outposts: Command): void;
-//# sourceMappingURL=outposts-heartbeat.d.ts.map