@indigoai-us/hq-cli 5.108.0 → 5.108.2

package/dist/lib/mesh/live/session-events-client.d.ts

@@ -0,0 +1,58 @@
+/**
+ * POST /v1/work-mesh/session-events batch client.
+ * Uses Cognito session (ensureCognitoToken / requireToken) and DEFAULT_VAULT_API_URL.
+ * Never reads or writes sessions-bind.json.
+ */
+import type { ClassificationState } from "../../work-context/contract.js";
+export declare const SESSION_EVENTS_PATH = "/v1/work-mesh/session-events";
+export declare const SESSION_EVENTS_BATCH_MAX = 100;
+/** Writable contextStatus values accepted by the server (contract §2.2). */
+export declare const WRITABLE_CONTEXT_STATUSES: Set<ClassificationState>;
+export interface SessionEventsBatchBody {
+    contractVersion: 1;
+    companyUid: string;
+    sessionId: string;
+    contextStatus: ClassificationState;
+    bindingEpisodeId?: string;
+    projectId?: string;
+    taskId?: string;
+    events: Record<string, unknown>[];
+}
+export interface SessionEventsPostResult {
+    status: number;
+    body: unknown;
+    ok: boolean;
+    retryable: boolean;
+    networkError?: boolean;
+}
+/** Contract §2.3 batch ingest ack (parsed from a 2xx body). */
+export interface SessionEventsBatchAck {
+    accepted: number;
+    duplicates: number;
+    rejected: Array<{
+        eventId: string;
+        code: string;
+    }>;
+}
+/**
+ * Parse a batch ingest response body. Returns null when the body is not an
+ * object (caller should retain events rather than treating them as posted).
+ */
+export declare function parseSessionEventsBatchAck(body: unknown): SessionEventsBatchAck | null;
+export type SessionEventsPoster = (body: SessionEventsBatchBody) => Promise<SessionEventsPostResult>;
+export declare function classifySessionEventsResponse(status: number, networkError?: boolean): Pick<SessionEventsPostResult, "ok" | "retryable" | "networkError">;
+/**
+ * Build a poster that uses vaultApiFetch + Cognito token.
+ * `post` override is for tests (never hits the network).
+ */
+export declare function createSessionEventsPoster(opts: {
+    token: string;
+    baseUrl?: string;
+    post?: (path: string, body: SessionEventsBatchBody) => Promise<{
+        status: number;
+        body: unknown;
+    }>;
+}): SessionEventsPoster;
+/** Resolve API base: HQ_VAULT_API_URL overrides DEFAULT_VAULT_API_URL. */
+export declare function resolveVaultApiBase(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=session-events-client.d.ts.map

package/dist/lib/mesh/live/session-events-client.js

@@ -0,0 +1,120 @@
+/**
+ * POST /v1/work-mesh/session-events batch client.
+ * Uses Cognito session (ensureCognitoToken / requireToken) and DEFAULT_VAULT_API_URL.
+ * Never reads or writes sessions-bind.json.
+ */
+import { vaultApiFetch } from "../../../utils/vault-api.js";
+import { DEFAULT_VAULT_API_URL } from "../../../utils/cognito-session.js";
+export const SESSION_EVENTS_PATH = "/v1/work-mesh/session-events";
+export const SESSION_EVENTS_BATCH_MAX = 100;
+/** Writable contextStatus values accepted by the server (contract §2.2). */
+export const WRITABLE_CONTEXT_STATUSES = new Set([
+    "unresolved",
+    "needs_project",
+    "needs_task",
+    "bound",
+    "migration_pending",
+]);
+/**
+ * Parse a batch ingest response body. Returns null when the body is not an
+ * object (caller should retain events rather than treating them as posted).
+ */
+export function parseSessionEventsBatchAck(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return null;
+    const rec = body;
+    const accepted = typeof rec.accepted === "number" ? rec.accepted : 0;
+    const duplicates = typeof rec.duplicates === "number" ? rec.duplicates : 0;
+    const rejected = [];
+    if (Array.isArray(rec.rejected)) {
+        for (const row of rec.rejected) {
+            if (!row || typeof row !== "object" || Array.isArray(row))
+                continue;
+            const r = row;
+            if (typeof r.eventId !== "string" || !r.eventId.trim())
+                continue;
+            const code = typeof r.code === "string"
+                ? r.code
+                : typeof r.code === "number"
+                    ? String(r.code)
+                    : "REJECTED";
+            rejected.push({ eventId: r.eventId.trim(), code });
+        }
+    }
+    return { accepted, duplicates, rejected };
+}
+export function classifySessionEventsResponse(status, networkError = false) {
+    if (networkError || status === 0) {
+        return { ok: false, retryable: true, networkError: true };
+    }
+    if (status >= 200 && status < 300) {
+        return { ok: true, retryable: false };
+    }
+    if (status === 429 || status >= 500) {
+        return { ok: false, retryable: true };
+    }
+    // Other 4xx → dead-letter (not retryable).
+    return { ok: false, retryable: false };
+}
+/**
+ * Build a poster that uses vaultApiFetch + Cognito token.
+ * `post` override is for tests (never hits the network).
+ */
+export function createSessionEventsPoster(opts) {
+    return async (body) => {
+        try {
+            if (opts.post) {
+                const res = await opts.post(SESSION_EVENTS_PATH, body);
+                return {
+                    status: res.status,
+                    body: res.body,
+                    ...classifySessionEventsResponse(res.status),
+                };
+            }
+            const res = await vaultApiFetch({
+                token: opts.token,
+                path: SESSION_EVENTS_PATH,
+                method: "POST",
+                body: body,
+                baseUrl: opts.baseUrl ?? DEFAULT_VAULT_API_URL,
+            });
+            const text = await res.text();
+            let parsed = {};
+            if (text) {
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch {
+                    parsed = { raw: text };
+                }
+            }
+            return {
+                status: res.status,
+                body: parsed,
+                ...classifySessionEventsResponse(res.status),
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // Auth hard-fail: treat 401/403 text from meshJson-style throws as non-retryable.
+            if (/^401\b|^403\b|unauthorized|forbidden/i.test(message)) {
+                return {
+                    status: 401,
+                    body: { error: message },
+                    ok: false,
+                    retryable: false,
+                };
+            }
+            return {
+                status: 0,
+                body: { error: message },
+                ...classifySessionEventsResponse(0, true),
+            };
+        }
+    };
+}
+/** Resolve API base: HQ_VAULT_API_URL overrides DEFAULT_VAULT_API_URL. */
+export function resolveVaultApiBase(env = process.env) {
+    return env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
+}
+//# sourceMappingURL=session-events-client.js.map

package/dist/lib/mesh/live/session-identity.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Canonical session identity for Work Mesh Live (US-007A).
+ *
+ * Mirrors assets/scaffold/core/scripts/lib/session-id.sh precedence:
+ *   HQ_SESSION_ID, CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID,
+ *   CODEX_SESSION_ID, CODEX_THREAD_ID, then the observation's provider session id.
+ *
+ * Never mints an id. Unstable or missing ids raise InvalidSessionIdentityError.
+ */
+export declare const SESSION_ID_ENV_KEYS: readonly ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"];
+export declare class InvalidSessionIdentityError extends Error {
+    readonly code: "InvalidSessionIdentityError";
+    constructor(message?: string);
+}
+/** Conservative charset matching session-id.sh (path-safe segment). */
+export declare function isValidSessionId(id: string | undefined | null): boolean;
+/**
+ * Resolve the first valid session id from env (shell precedence), or undefined.
+ */
+export declare function sessionIdFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
+export interface NormalizeSessionIdentityInput {
+    /** Observation identity.sessionId (may be empty / placeholder). */
+    sessionId?: string;
+    /** Observation identity.providerSessionId — last resort after env. */
+    providerSessionId?: string;
+    env?: NodeJS.ProcessEnv;
+}
+export interface NormalizedSessionIdentity {
+    sessionId: string;
+    providerSessionId?: string;
+    source: "HQ_SESSION_ID" | "CLAUDE_CODE_SESSION_ID" | "CLAUDE_SESSION_ID" | "CODEX_SESSION_ID" | "CODEX_THREAD_ID" | "providerSessionId" | "observation";
+}
+/**
+ * Normalize session identity. Env wins over observation.sessionId;
+ * providerSessionId is used only when env yields nothing and observation.sessionId
+ * is absent/invalid.
+ */
+export declare function normalizeSessionIdentity(input?: NormalizeSessionIdentityInput): NormalizedSessionIdentity;
+//# sourceMappingURL=session-identity.d.ts.map

package/dist/lib/mesh/live/session-identity.js

@@ -0,0 +1,91 @@
+/**
+ * Canonical session identity for Work Mesh Live (US-007A).
+ *
+ * Mirrors assets/scaffold/core/scripts/lib/session-id.sh precedence:
+ *   HQ_SESSION_ID, CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID,
+ *   CODEX_SESSION_ID, CODEX_THREAD_ID, then the observation's provider session id.
+ *
+ * Never mints an id. Unstable or missing ids raise InvalidSessionIdentityError.
+ */
+export const SESSION_ID_ENV_KEYS = [
+    "HQ_SESSION_ID",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_SESSION_ID",
+    "CODEX_SESSION_ID",
+    "CODEX_THREAD_ID",
+];
+export class InvalidSessionIdentityError extends Error {
+    code = "InvalidSessionIdentityError";
+    constructor(message = "Session identity is missing or invalid") {
+        super(message);
+        this.name = "InvalidSessionIdentityError";
+    }
+}
+/** Conservative charset matching session-id.sh (path-safe segment). */
+export function isValidSessionId(id) {
+    if (!id)
+        return false;
+    const trimmed = id.replace(/\s+/g, "");
+    if (!trimmed || trimmed === "." || trimmed === "..")
+        return false;
+    if (trimmed.length > 128)
+        return false;
+    return /^[A-Za-z0-9._-]+$/.test(trimmed);
+}
+function sanitize(value) {
+    if (value == null)
+        return undefined;
+    const trimmed = String(value).replace(/[\s]+/g, "");
+    return trimmed || undefined;
+}
+/**
+ * Resolve the first valid session id from env (shell precedence), or undefined.
+ */
+export function sessionIdFromEnv(env = process.env) {
+    for (const key of SESSION_ID_ENV_KEYS) {
+        const val = sanitize(env[key]);
+        if (val && isValidSessionId(val))
+            return val;
+    }
+    return undefined;
+}
+/**
+ * Normalize session identity. Env wins over observation.sessionId;
+ * providerSessionId is used only when env yields nothing and observation.sessionId
+ * is absent/invalid.
+ */
+export function normalizeSessionIdentity(input = {}) {
+    const env = input.env ?? process.env;
+    for (const key of SESSION_ID_ENV_KEYS) {
+        const val = sanitize(env[key]);
+        if (val && isValidSessionId(val)) {
+            const provider = sanitize(input.providerSessionId);
+            return {
+                sessionId: val,
+                providerSessionId: provider && isValidSessionId(provider) ? provider : undefined,
+                source: key,
+            };
+        }
+    }
+    const observed = sanitize(input.sessionId);
+    if (observed && isValidSessionId(observed)) {
+        const provider = sanitize(input.providerSessionId);
+        return {
+            sessionId: observed,
+            providerSessionId: provider && isValidSessionId(provider) && provider !== observed
+                ? provider
+                : undefined,
+            source: "observation",
+        };
+    }
+    const provider = sanitize(input.providerSessionId);
+    if (provider && isValidSessionId(provider)) {
+        return {
+            sessionId: provider,
+            providerSessionId: provider,
+            source: "providerSessionId",
+        };
+    }
+    throw new InvalidSessionIdentityError("No stable session id in env or observation (refusing to mint one)");
+}
+//# sourceMappingURL=session-identity.js.map

package/dist/lib/mesh/live/spool.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Append-only spool / held / dead-letter under ~/.hq/work-mesh/.
+ * Create 0600; append with O_APPEND so concurrent writers never interleave
+ * partial lines (one writeSync per line, under PIPE_BUF).
+ */
+/** Linux PIPE_BUF is typically 4096; keep a conservative ceiling for one line. */
+export declare const SPOOL_LINE_MAX_BYTES = 4096;
+export declare class SpoolWriteError extends Error {
+    readonly code: "SPOOL_WRITE_ERROR";
+    constructor(message: string);
+}
+/**
+ * Ensure the jsonl file exists at mode 0600 inside an owner-only directory.
+ */
+export declare function ensureSpoolFile(filePath: string): void;
+/**
+ * Append one JSON line (without newline in `line`) as a single write under O_APPEND.
+ */
+export declare function appendJsonlLine(filePath: string, line: string): void;
+export declare function appendSpoolLine(line: string, root?: string): string;
+export declare function appendHeldLine(line: string, root?: string): string;
+export declare function appendDeadLetterLine(line: string, root?: string): string;
+export declare function appendDroppedReceipt(receipt: Record<string, unknown>, root?: string): string;
+export interface ClaimResult {
+    claimPath: string | null;
+    lines: string[];
+}
+/**
+ * Claim a jsonl file by renaming it aside (never read-then-truncate).
+ * Concurrent appends after the rename land on a fresh file.
+ */
+export declare function claimJsonlByRename(sourcePath: string, claimPath: string): ClaimResult;
+export declare function claimSpool(root: string, ts?: string): ClaimResult;
+export declare function claimHeld(root: string, ts?: string): ClaimResult;
+/**
+ * List orphan claim files left by a crash mid-flush.
+ * Process these before claiming live spool/held (idempotent).
+ */
+export declare function listOrphanClaimFiles(root: string): string[];
+export declare function readClaimFileLines(claimPath: string): string[];
+/**
+ * Recover orphaned claim files: read their lines and return paths to unlink
+ * after the flush dispositions them.
+ */
+export declare function recoverOrphanClaims(root: string): {
+    lines: string[];
+    claimPaths: string[];
+};
+export declare function removeClaimFile(claimPath: string | null): void;
+export declare function deadLetterNonEmpty(root?: string): boolean;
+export declare function countJsonlLines(filePath: string): number;
+//# sourceMappingURL=spool.d.ts.map

package/dist/lib/mesh/live/spool.js

@@ -0,0 +1,193 @@
+/**
+ * Append-only spool / held / dead-letter under ~/.hq/work-mesh/.
+ * Create 0600; append with O_APPEND so concurrent writers never interleave
+ * partial lines (one writeSync per line, under PIPE_BUF).
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ensureOwnerDir } from "../../work-context/atomic.js";
+import { workMeshClaimPath, workMeshDeadLetterPath, workMeshDroppedReceiptPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "./paths.js";
+/** Linux PIPE_BUF is typically 4096; keep a conservative ceiling for one line. */
+export const SPOOL_LINE_MAX_BYTES = 4096;
+export class SpoolWriteError extends Error {
+    code = "SPOOL_WRITE_ERROR";
+    constructor(message) {
+        super(message);
+        this.name = "SpoolWriteError";
+    }
+}
+function chmodOwnerFile(filePath) {
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // ignore exotic FS
+    }
+}
+/**
+ * Ensure the jsonl file exists at mode 0600 inside an owner-only directory.
+ */
+export function ensureSpoolFile(filePath) {
+    const dir = ensureOwnerDir(path.dirname(filePath));
+    const resolved = path.join(dir, path.basename(filePath));
+    if (!fs.existsSync(resolved)) {
+        const fd = fs.openSync(resolved, "wx", 0o600);
+        fs.closeSync(fd);
+    }
+    chmodOwnerFile(resolved);
+}
+/**
+ * Append one JSON line (without newline in `line`) as a single write under O_APPEND.
+ */
+export function appendJsonlLine(filePath, line) {
+    const payload = `${line}\n`;
+    const buf = Buffer.from(payload, "utf8");
+    if (buf.length > SPOOL_LINE_MAX_BYTES) {
+        throw new SpoolWriteError(`Spool line exceeds PIPE_BUF budget (${buf.length} > ${SPOOL_LINE_MAX_BYTES})`);
+    }
+    ensureSpoolFile(filePath);
+    const fd = fs.openSync(filePath, fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_WRONLY, 0o600);
+    try {
+        const written = fs.writeSync(fd, buf, 0, buf.length);
+        if (written !== buf.length) {
+            throw new SpoolWriteError(`Short write to spool (${written} of ${buf.length} bytes)`);
+        }
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    chmodOwnerFile(filePath);
+}
+export function appendSpoolLine(line, root) {
+    const spool = workMeshSpoolPath(root ?? workMeshRoot());
+    appendJsonlLine(spool, line);
+    return spool;
+}
+export function appendHeldLine(line, root) {
+    const held = workMeshHeldPath(root ?? workMeshRoot());
+    appendJsonlLine(held, line);
+    return held;
+}
+export function appendDeadLetterLine(line, root) {
+    const dl = workMeshDeadLetterPath(root ?? workMeshRoot());
+    appendJsonlLine(dl, line);
+    return dl;
+}
+export function appendDroppedReceipt(receipt, root) {
+    const dest = workMeshDroppedReceiptPath(root ?? workMeshRoot());
+    appendJsonlLine(dest, JSON.stringify(receipt));
+    return dest;
+}
+/**
+ * Claim a jsonl file by renaming it aside (never read-then-truncate).
+ * Concurrent appends after the rename land on a fresh file.
+ */
+export function claimJsonlByRename(sourcePath, claimPath) {
+    try {
+        fs.renameSync(sourcePath, claimPath);
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") {
+            return { claimPath: null, lines: [] };
+        }
+        throw err;
+    }
+    const raw = fs.readFileSync(claimPath, "utf8");
+    const lines = [];
+    for (const line of raw.split("\n")) {
+        if (!line.trim())
+            continue;
+        lines.push(line);
+    }
+    return { claimPath, lines };
+}
+export function claimSpool(root, ts = `${Date.now()}`) {
+    ensureOwnerDir(root);
+    return claimJsonlByRename(workMeshSpoolPath(root), workMeshClaimPath("spool", ts, root));
+}
+export function claimHeld(root, ts = `${Date.now()}`) {
+    ensureOwnerDir(root);
+    return claimJsonlByRename(workMeshHeldPath(root), workMeshClaimPath("held", ts, root));
+}
+/** Match leftover claim files: spool.<ts>.claimed / held.<ts>.claimed (and held.<ts>.held.claimed). */
+const ORPHAN_CLAIM_RE = /^(spool|held)\..+\.claimed$/;
+/**
+ * List orphan claim files left by a crash mid-flush.
+ * Process these before claiming live spool/held (idempotent).
+ */
+export function listOrphanClaimFiles(root) {
+    if (!fs.existsSync(root))
+        return [];
+    const names = fs.readdirSync(root);
+    const out = [];
+    for (const name of names) {
+        if (!ORPHAN_CLAIM_RE.test(name))
+            continue;
+        out.push(path.join(root, name));
+    }
+    return out.sort();
+}
+export function readClaimFileLines(claimPath) {
+    if (!fs.existsSync(claimPath))
+        return [];
+    try {
+        const raw = fs.readFileSync(claimPath, "utf8");
+        const lines = [];
+        for (const line of raw.split("\n")) {
+            if (!line.trim())
+                continue;
+            lines.push(line);
+        }
+        return lines;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Recover orphaned claim files: read their lines and return paths to unlink
+ * after the flush dispositions them.
+ */
+export function recoverOrphanClaims(root) {
+    const claimPaths = listOrphanClaimFiles(root);
+    const lines = [];
+    for (const p of claimPaths) {
+        lines.push(...readClaimFileLines(p));
+    }
+    return { lines, claimPaths };
+}
+export function removeClaimFile(claimPath) {
+    if (!claimPath)
+        return;
+    try {
+        fs.unlinkSync(claimPath);
+    }
+    catch {
+        // leave for audit if unlink fails
+    }
+}
+export function deadLetterNonEmpty(root) {
+    const dl = workMeshDeadLetterPath(root ?? workMeshRoot());
+    if (!fs.existsSync(dl))
+        return false;
+    try {
+        const st = fs.statSync(dl);
+        return st.size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function countJsonlLines(filePath) {
+    if (!fs.existsSync(filePath))
+        return 0;
+    const raw = fs.readFileSync(filePath, "utf8");
+    let n = 0;
+    for (const line of raw.split("\n")) {
+        if (line.trim())
+            n += 1;
+    }
+    return n;
+}
+//# sourceMappingURL=spool.js.map

package/dist/lib/mesh/live/ulid.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Crockford-base32 ULID (26 chars). Matches the session-event schema pattern
+ * and the shell generator in assets/scaffold/core/scripts/lib/work-mesh-enqueue.sh.
+ */
+/** Encode an unsigned integer into `length` Crockford base32 characters (big-endian). */
+export declare function encodeCrockford(value: bigint, length: number): string;
+/**
+ * Generate a ULID: 48-bit timestamp (ms) + 80-bit randomness → 26 Crockford chars.
+ */
+export declare function generateUlid(nowMs?: number, entropy?: Buffer): string;
+export declare function isUlid(value: string): boolean;
+//# sourceMappingURL=ulid.d.ts.map

package/dist/lib/mesh/live/ulid.js

@@ -0,0 +1,39 @@
+/**
+ * Crockford-base32 ULID (26 chars). Matches the session-event schema pattern
+ * and the shell generator in assets/scaffold/core/scripts/lib/work-mesh-enqueue.sh.
+ */
+import { randomBytes } from "node:crypto";
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+/** Encode an unsigned integer into `length` Crockford base32 characters (big-endian). */
+export function encodeCrockford(value, length) {
+    let n = value;
+    const chars = new Array(length);
+    for (let i = length - 1; i >= 0; i -= 1) {
+        chars[i] = CROCKFORD[Number(n & 0x1fn)];
+        n >>= 5n;
+    }
+    return chars.join("");
+}
+/**
+ * Generate a ULID: 48-bit timestamp (ms) + 80-bit randomness → 26 Crockford chars.
+ */
+export function generateUlid(nowMs = Date.now(), entropy) {
+    const time = BigInt(nowMs) & 0xffffffffffffn;
+    const timePart = encodeCrockford(time, 10);
+    const bytes = entropy ?? randomBytes(10);
+    if (bytes.length < 10) {
+        throw new Error("ULID entropy must be at least 10 bytes");
+    }
+    let rand = 0n;
+    for (let i = 0; i < 10; i += 1) {
+        rand = (rand << 8n) | BigInt(bytes[i]);
+    }
+    // 80 bits → 16 Crockford chars
+    const randPart = encodeCrockford(rand, 16);
+    return timePart + randPart;
+}
+const ULID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+export function isUlid(value) {
+    return ULID_RE.test(value);
+}
+//# sourceMappingURL=ulid.js.map

package/dist/lib/mesh/live/validate-session-event.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Work Mesh Live — session-event validator (US-001).
+ *
+ * Uses Ajv draft 2020-12 against the verbatim schema copy. Prohibited content
+ * classes are rejected (additionalProperties: false). Error messages never
+ * echo prohibited marker values (redaction assertion surface).
+ */
+import type { ValidateFunction } from "ajv";
+export declare const SESSION_EVENT_SCHEMA_PATH: string;
+/** Expected SHA-256 of the canonical schema bytes (hq-pro + hq-cli must match). */
+export declare const SESSION_EVENT_SCHEMA_SHA256 = "be300120b4793a5c6f1e713bf9f72b2fd22f6ac082bef8eedfa507b684b09ccb";
+export declare const PROHIBITED_CONTENT_CLASSES: readonly ["prompts", "model_output", "transcripts", "message_bodies", "tokens", "credentials"];
+export type ProhibitedContentClass = (typeof PROHIBITED_CONTENT_CLASSES)[number];
+/** Fixture field name → prohibited class. */
+export declare const PROHIBITED_FIELD_BY_CLASS: Record<ProhibitedContentClass, string>;
+export interface SessionEventValidationResult {
+    ok: boolean;
+    errors: string[];
+}
+export declare function getSessionEventValidator(): ValidateFunction;
+/**
+ * Redact known prohibited markers from Ajv error text so diagnostics never
+ * leak prompt/token/credential material.
+ */
+export declare function redactValidationMessage(message: string): string;
+export declare function validateSessionEvent(candidate: unknown): SessionEventValidationResult;
+export declare function sha256File(path: string): string;
+export declare function sha256SessionEventSchema(): string;
+/**
+ * Resolve the hq-pro canonical schema path when available.
+ *
+ * Order: `HQ_PRO_SCHEMA_PATH` env override (absolute path to the hq-pro
+ * schema file) → sibling checkout
+ * `../hq-pro/src/vault-service/work-mesh/live/session-event.schema.json`
+ * from the hq-cli repo root → null.
+ * Shipped code must not hardcode machine-specific worktree paths.
+ */
+export declare function resolveHqProSchemaPath(): string | null;
+//# sourceMappingURL=validate-session-event.d.ts.map