@indigoai-us/hq-cli 5.115.6 → 5.116.0

package/dist/lib/agent-kit/run/mesh-listener.js

@@ -0,0 +1,193 @@
+/**
+ * Kit service: work-mesh doorbell listener.
+ *
+ * Policy hq-work-mesh-source-of-truth: the work mesh (REST) is the source of
+ * truth; MQTT carries IDS-ONLY doorbells on the agent's personal topics
+ * `hq/{agt_*}/{dm,work,sessions,notifications}`. This listener is the cache
+ * writer: on any doorbell it refetches through the REST API into
+ * ~/.hq/work-mesh/cache (warmMeshConversationCache) — message bodies are
+ * never taken from MQTT. A periodic refresh covers missed doorbells.
+ *
+ * Credentials come from the same contract-3 vend the mesh daemon uses
+ * (POST /v1/realtime/credentials); the WSS URL is SigV4-presigned. The
+ * connection is rebuilt before the vended credentials expire. `component-mesh`
+ * is stamped ok while subscribed and refreshing, error otherwise.
+ */
+import mqtt from "mqtt";
+import { warmMeshConversationCache } from "../../mesh/api.js";
+import { createContract3Fetcher, MQTT_KEEPALIVE_SECONDS, renewalDelayMs, } from "../../mesh/live/daemon/credentials.js";
+import { presignIotWssUrl } from "../../mesh/live/daemon/presign.js";
+import { writeComponentStatus } from "../creds.js";
+export const DOORBELL_KINDS = ["dm", "work", "sessions", "notifications"];
+export const DOORBELL_DEBOUNCE_MS = 2_000;
+export const RECONNECT_BASE_MS = 1_000;
+export const RECONNECT_MAX_MS = 60_000;
+export function doorbellTopics(actorUid) {
+    return DOORBELL_KINDS.map((k) => `hq/${actorUid}/${k}`);
+}
+function backoff(attempt, random) {
+    const cap = Math.min(RECONNECT_MAX_MS, RECONNECT_BASE_MS * 2 ** attempt);
+    return Math.max(RECONNECT_BASE_MS, Math.floor(random() * cap));
+}
+export async function startMeshListener(deps) {
+    const now = deps.now ?? (() => new Date());
+    const random = deps.random ?? Math.random;
+    const setT = deps.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+    const clearT = deps.clearTimeout ?? ((h) => clearTimeout(h));
+    const connect = deps.connect ?? ((url, opts) => mqtt.connect(url, opts));
+    const refetch = deps.refetch ?? ((token, uid) => warmMeshConversationCache(token, uid));
+    const fetchCredentials = deps.fetchCredentials ??
+        (async () => {
+            const token = await deps.getToken();
+            return createContract3Fetcher({ token, baseUrl: deps.apiBaseUrl })();
+        });
+    let state = "idle";
+    let client = null;
+    let stopped = false;
+    let attempt = 0;
+    let debounce = null;
+    let renewal = null;
+    let periodic = null;
+    let refetching = null;
+    let pendingReason = null;
+    const doRefetch = async (reason) => {
+        if (refetching) {
+            pendingReason = reason;
+            return refetching;
+        }
+        refetching = (async () => {
+            try {
+                const token = await deps.getToken();
+                await refetch(token, deps.agentUid);
+                writeComponentStatus(deps.paths, "mesh", state === "subscribed" ? "ok" : "error");
+                deps.log("info", `cache refetched (${reason})`);
+            }
+            catch (err) {
+                writeComponentStatus(deps.paths, "mesh", "error");
+                deps.log("error", `refetch failed (${reason}): ${err instanceof Error ? err.message : String(err)}`);
+            }
+            finally {
+                refetching = null;
+            }
+            if (pendingReason) {
+                const next = pendingReason;
+                pendingReason = null;
+                await doRefetch(next);
+            }
+        })();
+        return refetching;
+    };
+    const ring = (topic) => {
+        if (debounce)
+            clearT(debounce);
+        debounce = setT(() => {
+            debounce = null;
+            void doRefetch(`doorbell ${topic}`);
+        }, DOORBELL_DEBOUNCE_MS);
+    };
+    const schedulePeriodic = () => {
+        if (periodic)
+            clearT(periodic);
+        periodic = setT(() => {
+            periodic = null;
+            void doRefetch("periodic").then(schedulePeriodic);
+        }, deps.refreshMs);
+    };
+    const scheduleReconnect = () => {
+        if (stopped)
+            return;
+        const delay = backoff(attempt, random);
+        attempt += 1;
+        deps.log("warn", `mqtt reconnect in ${delay}ms (attempt ${attempt})`);
+        setT(() => void connectOnce(), delay);
+    };
+    const connectOnce = async () => {
+        if (stopped)
+            return;
+        state = "connecting";
+        let bundle;
+        try {
+            bundle = await fetchCredentials();
+            if (bundle.actorUid !== deps.agentUid) {
+                throw new Error(`realtime vend is for ${bundle.actorUid}, expected ${deps.agentUid}`);
+            }
+        }
+        catch (err) {
+            writeComponentStatus(deps.paths, "mesh", "error");
+            deps.log("error", `credential vend failed: ${err instanceof Error ? err.message : String(err)}`);
+            scheduleReconnect();
+            return;
+        }
+        const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, now());
+        const c = connect(url, {
+            clientId: bundle.clientId,
+            keepalive: MQTT_KEEPALIVE_SECONDS,
+            clean: true,
+            reconnectPeriod: 0,
+            protocolVersion: 4,
+        });
+        client = c;
+        let settled = false;
+        c.on("connect", () => {
+            c.subscribe(doorbellTopics(bundle.actorUid), { qos: 1 }, (err) => {
+                if (err) {
+                    deps.log("error", `subscribe failed: ${err.message}`);
+                    c.end(true);
+                    return;
+                }
+                settled = true;
+                attempt = 0;
+                state = "subscribed";
+                writeComponentStatus(deps.paths, "mesh", "ok");
+                deps.log("info", `subscribed to ${doorbellTopics(bundle.actorUid).length} doorbell topics`);
+                void doRefetch("connect");
+                if (renewal)
+                    clearT(renewal);
+                renewal = setT(() => {
+                    deps.log("info", "renewing realtime credentials");
+                    c.end(true);
+                }, renewalDelayMs(now().getTime(), bundle.expiresAt));
+            });
+        });
+        c.on("message", (topic) => {
+            // Ids-only doorbell: the payload is never parsed for content.
+            ring(topic);
+        });
+        c.on("error", (err) => {
+            deps.log("warn", `mqtt error: ${err.message}`);
+        });
+        c.on("close", () => {
+            if (client !== c)
+                return;
+            client = null;
+            const wasSubscribed = state === "subscribed";
+            state = stopped ? "closed" : "idle";
+            writeComponentStatus(deps.paths, "mesh", "error");
+            if (!settled || !wasSubscribed)
+                deps.log("warn", "mqtt closed before subscribe settled");
+            scheduleReconnect();
+        });
+    };
+    schedulePeriodic();
+    await connectOnce();
+    return {
+        stop: async () => {
+            stopped = true;
+            state = "closed";
+            if (debounce)
+                clearT(debounce);
+            if (renewal)
+                clearT(renewal);
+            if (periodic)
+                clearT(periodic);
+            const c = client;
+            client = null;
+            if (c)
+                await new Promise((r) => c.end(true, undefined, () => r()));
+        },
+        refetchNow: doRefetch,
+        ring,
+        state: () => state,
+    };
+}
+//# sourceMappingURL=mesh-listener.js.map

package/dist/lib/agent-kit/run/sync.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Kit service: company vault sync loop.
+ *
+ * Mirrors the hosted box's hq-agent-sync.service, which runs hq-cloud's
+ * `hq-sync-runner --companies --direction both --on-conflict keep` on a
+ * loop and writes `component-sync`. Here the equivalent is the CLI's own
+ * `hq sync pull --all --on-conflict keep --hq-root <kit hqRoot>`, run as a
+ * child of the same node + hq binary this service was launched with, so the
+ * machine identity, creds path and version are exactly the service's own.
+ *
+ * Honest health: exit 0 = ok, anything else = error (the heartbeat turns a
+ * stale stamp into error on its own).
+ */
+import type { KitLogger } from "../log.js";
+import type { AgentKitPaths } from "../paths.js";
+export interface SyncRunDeps {
+    paths: AgentKitPaths;
+    hqRoot: string;
+    intervalMs: number;
+    log: KitLogger;
+    nodeBinary?: string;
+    hqBinary?: string;
+    /** Injected child runner (tests). Resolves with the exit code. */
+    runPull?: (args: string[]) => Promise<number>;
+    sleep?: (ms: number) => Promise<void>;
+    /** Stop after this many passes (tests); default runs forever. */
+    maxPasses?: number;
+}
+export declare function syncPullArgs(hqRoot: string): string[];
+export declare function defaultRunPull(nodeBinary: string, hqBinary: string, env: NodeJS.ProcessEnv): (args: string[]) => Promise<number>;
+export declare function runSyncOnce(deps: SyncRunDeps): Promise<boolean>;
+export declare function runSyncLoop(deps: SyncRunDeps): Promise<void>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/lib/agent-kit/run/sync.js

@@ -0,0 +1,58 @@
+/**
+ * Kit service: company vault sync loop.
+ *
+ * Mirrors the hosted box's hq-agent-sync.service, which runs hq-cloud's
+ * `hq-sync-runner --companies --direction both --on-conflict keep` on a
+ * loop and writes `component-sync`. Here the equivalent is the CLI's own
+ * `hq sync pull --all --on-conflict keep --hq-root <kit hqRoot>`, run as a
+ * child of the same node + hq binary this service was launched with, so the
+ * machine identity, creds path and version are exactly the service's own.
+ *
+ * Honest health: exit 0 = ok, anything else = error (the heartbeat turns a
+ * stale stamp into error on its own).
+ */
+import { spawn } from "node:child_process";
+import { writeComponentStatus } from "../creds.js";
+export function syncPullArgs(hqRoot) {
+    return ["sync", "pull", "--all", "--on-conflict", "keep", "--hq-root", hqRoot];
+}
+export function defaultRunPull(nodeBinary, hqBinary, env) {
+    return (args) => new Promise((resolve) => {
+        const child = spawn(nodeBinary, [hqBinary, ...args], {
+            env,
+            stdio: ["ignore", "inherit", "inherit"],
+        });
+        child.on("error", () => resolve(127));
+        child.on("exit", (code) => resolve(code ?? 1));
+    });
+}
+export async function runSyncOnce(deps) {
+    const runPull = deps.runPull ??
+        defaultRunPull(deps.nodeBinary ?? process.execPath, deps.hqBinary ?? process.argv[1], process.env);
+    const args = syncPullArgs(deps.hqRoot);
+    deps.log("info", `sync start hq-root=${deps.hqRoot}`);
+    let code;
+    try {
+        code = await runPull(args);
+    }
+    catch (err) {
+        deps.log("error", `sync spawn failed: ${err instanceof Error ? err.message : String(err)}`);
+        code = 1;
+    }
+    const ok = code === 0;
+    writeComponentStatus(deps.paths, "sync", ok ? "ok" : "error");
+    deps.log(ok ? "info" : "error", `sync ${ok ? "ok" : `failed exit=${code}`}`);
+    return ok;
+}
+export async function runSyncLoop(deps) {
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let passes = 0;
+    for (;;) {
+        await runSyncOnce(deps);
+        passes += 1;
+        if (deps.maxPasses !== undefined && passes >= deps.maxPasses)
+            return;
+        await sleep(deps.intervalMs);
+    }
+}
+//# sourceMappingURL=sync.js.map

package/dist/lib/agent-kit/services.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The four kit services and how each is launched. Every unit runs
+ * `node hq agent kit run <service>`; the service reads kit.json and the
+ * machine-creds file itself, so the units carry paths and nothing else.
+ */
+import type { ServiceSpec } from "../service-manager/types.js";
+import type { AgentKitPaths } from "./paths.js";
+export type KitService = "sync" | "mesh" | "inbox" | "heartbeat";
+export declare const KIT_SERVICES: readonly KitService[];
+export declare const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
+export declare function isKitService(value: string): value is KitService;
+/**
+ * Environment every service inherits. HQ_MACHINE_CREDS_FILE pins hq-cloud's
+ * mint to the kit's creds file; HQ_REQUIRE_MACHINE_IDENTITY makes a missing
+ * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
+ * relocated kit consistent across restarts.
+ */
+export declare function kitServiceEnv(paths: AgentKitPaths): Record<string, string>;
+export declare function kitServiceSpec(service: KitService, paths: AgentKitPaths): ServiceSpec;
+export declare function kitServiceSpecs(paths: AgentKitPaths): ServiceSpec[];
+//# sourceMappingURL=services.d.ts.map

package/dist/lib/agent-kit/services.js

@@ -0,0 +1,46 @@
+/**
+ * The four kit services and how each is launched. Every unit runs
+ * `node hq agent kit run <service>`; the service reads kit.json and the
+ * machine-creds file itself, so the units carry paths and nothing else.
+ */
+import { serviceLogPath } from "./paths.js";
+export const KIT_SERVICES = ["sync", "mesh", "inbox", "heartbeat"];
+export const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
+export function isKitService(value) {
+    return KIT_SERVICES.includes(value);
+}
+const DESCRIPTIONS = {
+    sync: "HQ agent kit: company vault sync loop",
+    mesh: "HQ agent kit: work-mesh doorbell listener",
+    inbox: "HQ agent kit: inbox poller",
+    heartbeat: "HQ agent kit: heartbeat reporter",
+};
+/**
+ * Environment every service inherits. HQ_MACHINE_CREDS_FILE pins hq-cloud's
+ * mint to the kit's creds file; HQ_REQUIRE_MACHINE_IDENTITY makes a missing
+ * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
+ * relocated kit consistent across restarts.
+ */
+export function kitServiceEnv(paths) {
+    return {
+        HQ_AGENT_DIR: paths.agentDir,
+        HQ_MACHINE_CREDS_FILE: paths.machineCredsPath,
+        HQ_REQUIRE_MACHINE_IDENTITY: "1",
+    };
+}
+export function kitServiceSpec(service, paths) {
+    return {
+        name: service,
+        label: `${KIT_LABEL_PREFIX}.${service}`,
+        description: DESCRIPTIONS[service],
+        args: ["agent", "kit", "run", service],
+        logPath: serviceLogPath(paths, service),
+        workingDir: paths.agentDir,
+        env: kitServiceEnv(paths),
+        restartSec: 10,
+    };
+}
+export function kitServiceSpecs(paths) {
+    return KIT_SERVICES.map((s) => kitServiceSpec(s, paths));
+}
+//# sourceMappingURL=services.js.map

package/dist/lib/agent-kit/skills.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The skills directory the kit ships to ~/.hq-agent/skills/<name>/SKILL.md.
+ *
+ * agentskills.io format: YAML frontmatter with `name` and `description`, then
+ * markdown the bot's framework loads as an instruction. Each skill drives
+ * the `hq` CLI, which authenticates as the machine identity on its own, so
+ * no skill ever embeds or asks for a token or secret value.
+ */
+import type { AgentKitPaths } from "./paths.js";
+export interface KitSkill {
+    name: string;
+    description: string;
+    body: string;
+}
+export declare const KIT_SKILLS: readonly KitSkill[];
+export declare function renderSkillMarkdown(skill: KitSkill): string;
+export declare function writeKitSkills(paths: Pick<AgentKitPaths, "skillsDir">): string[];
+//# sourceMappingURL=skills.d.ts.map

package/dist/lib/agent-kit/skills.js

@@ -0,0 +1,149 @@
+/**
+ * The skills directory the kit ships to ~/.hq-agent/skills/<name>/SKILL.md.
+ *
+ * agentskills.io format: YAML frontmatter with `name` and `description`, then
+ * markdown the bot's framework loads as an instruction. Each skill drives
+ * the `hq` CLI, which authenticates as the machine identity on its own, so
+ * no skill ever embeds or asks for a token or secret value.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const KIT_SKILLS = [
+    {
+        name: "dm",
+        description: "Send and read HQ direct messages and channel messages as this agent using the hq CLI.",
+        body: `# HQ direct messages
+
+Use the \`hq dm\` command to talk to teammates (people and other agents) in HQ.
+The CLI authenticates as this agent automatically — never ask for a token.
+
+## Send
+
+\`\`\`bash
+hq dm <email-or-uid> "message text"        # 1:1 to a person (prs_…) or agent (agt_…)
+hq dm <uid1>,<uid2> "message text"         # group DM
+hq dm '#channel-name' "message text"       # channel
+\`\`\`
+
+## Read
+
+\`\`\`bash
+hq dm inbox --unread            # unread DMs addressed to you
+hq dm thread <email-or-uid>     # the 1:1 conversation
+hq dm inbox --mark-read         # mark what you have read
+hq dm channel <name>            # read a channel
+\`\`\`
+
+New inbound messages are also mirrored by the kit's inbox poller to
+\`~/.hq-agent/inbox/<id>.json\` (and \`inbox.jsonl\`) — check there when
+you are asked whether anyone has messaged you.
+
+## Rules
+
+- Reply in the same thread you were messaged in.
+- Keep messages short; link to files in the vault instead of pasting them.
+- Never include secrets or credentials in a message.
+`,
+    },
+    {
+        name: "search",
+        description: "Search the company vault (documents, knowledge, meeting notes) with the hq CLI's local index.",
+        body: `# HQ search
+
+The company vault is synced to the kit's HQ root (see \`~/.hq-agent/kit.json\`,
+\`hqRoot\`). Search it with:
+
+\`\`\`bash
+hq search "<query>"                        # ranked results across the synced vault
+hq search "<query>" --mode hybrid          # keyword + semantic
+hq search "<query>" --json                 # machine-readable
+hq files search "<query>" --company <slug> # server-side vault search (no local index needed)
+\`\`\`
+
+If results look stale, the sync loop may not have run yet:
+\`hq sync pull --all --on-conflict keep --hq-root <hqRoot>\` pulls now.
+
+Cite the file path of anything you quote so a teammate can open it.
+`,
+    },
+    {
+        name: "files",
+        description: "Read, list and write files in the company vault through the hq CLI (hq files).",
+        body: `# HQ vault files
+
+\`\`\`bash
+hq files browse companies/<slug>/<folder>   # list a vault folder without syncing it
+hq files cat companies/<slug>/<file>        # print one file
+hq files get companies/<slug>/<file>        # fetch one file into the local HQ tree
+hq files share companies/<slug>/<path>      # share a path with a teammate
+hq files versions companies/<slug>/<file>   # version history
+\`\`\`
+
+Paths are vault-relative and start with \`companies/<slug>/\`. The synced copy
+lives under the kit's HQ root (\`~/.hq-agent/kit.json\` → \`hqRoot\`); edit files
+there and run \`hq sync push --hq-root <hqRoot>\` to publish. Writes are
+audited under this agent's identity — only write where you were asked to,
+and prefer creating a new file over overwriting one you did not author.
+`,
+    },
+    {
+        name: "secrets-exec",
+        description: "Run a command with company secrets injected as environment variables, without ever printing them.",
+        body: `# Run with HQ secrets
+
+Secrets never appear in chat, logs or files. Inject them into a child
+process instead:
+
+\`\`\`bash
+hq secrets list                                   # names only, never values
+hq secrets exec --only <NAME>[,<NAME>] -- <cmd>   # run <cmd> with those vars set
+hq run <script>                                   # run a vault script with its declared secrets
+\`\`\`
+
+Rules:
+
+- Never \`echo\`, \`printenv\` or otherwise print a secret, even to "check" it.
+- Request the narrowest \`--only\` set the command needs.
+- If a secret is missing, say which NAME is missing and ask a human admin to
+  add it with \`hq secrets set\` — do not ask for the value in chat.
+`,
+    },
+    {
+        name: "work-mesh-status",
+        description: "Report and update this agent's live work status and read the team's work mesh via the hq CLI.",
+        body: `# Work mesh status
+
+The work mesh is HQ's live board of who is working on what. It is the source
+of truth for project stories and active sessions; the kit's listener keeps a
+local cache under \`~/.hq/work-mesh/cache/\`.
+
+\`\`\`bash
+hq mesh session status --company <slug>          # who is working on what right now
+hq mesh start --company <slug> --project <slug> --summary "<what you are starting>"
+hq mesh progress --company <slug> --project <slug> --summary "<what changed>"
+hq mesh blocked --company <slug> --project <slug> --summary "<what blocks you>"
+hq mesh done --company <slug> --project <slug> --summary "<what you finished>"
+hq mesh note --company <slug> --project <slug> --summary "<short note>"
+\`\`\`
+
+Post \`start\` when you pick up a piece of work and \`done\` when you finish it.
+Keep entries to one line. Presence (online / stale / offline) is derived
+from the kit heartbeat automatically — you do not need to report it.
+`,
+    },
+];
+export function renderSkillMarkdown(skill) {
+    return `---\nname: ${skill.name}\ndescription: ${JSON.stringify(skill.description)}\n---\n\n${skill.body}`;
+}
+export function writeKitSkills(paths) {
+    const written = [];
+    for (const skill of KIT_SKILLS) {
+        const dir = path.join(paths.skillsDir, skill.name);
+        fs.mkdirSync(dir, { recursive: true, mode: 0o755 });
+        const dest = path.join(dir, "SKILL.md");
+        fs.writeFileSync(dest, renderSkillMarkdown(skill), { mode: 0o644 });
+        written.push(dest);
+    }
+    return written;
+}
+//# sourceMappingURL=skills.js.map

package/dist/lib/service-manager/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Install / uninstall / status for a SET of user-level services, dispatching
+ * to launchd or systemd. All filesystem and process-control effects are
+ * injectable so the kit tests exercise the real rendering and dispatch
+ * without touching the host's service manager.
+ */
+import * as fs from "node:fs";
+import { type RunCommand } from "./launchd.js";
+import { type ServiceHostPaths, type ServicePlatform, type ServiceSpec } from "./types.js";
+export type { ServiceSpec, ServiceHostPaths, ServicePlatform } from "./types.js";
+export { detectServicePlatform } from "./types.js";
+export { renderLaunchdPlist } from "./launchd.js";
+export { renderSystemdUserUnit, systemdUnitName } from "./systemd.js";
+export declare const defaultRunCommand: RunCommand;
+export interface ServiceManagerDeps {
+    platform?: ServicePlatform;
+    run?: RunCommand;
+    writeFileSync?: typeof fs.writeFileSync;
+    mkdirSync?: typeof fs.mkdirSync;
+    unlinkSync?: typeof fs.unlinkSync;
+    existsSync?: typeof fs.existsSync;
+    /** When false, render + write units but do not (de)activate them. */
+    activate?: boolean;
+}
+export interface ServiceUnitResult {
+    name: string;
+    unitPath: string;
+    rendered?: string;
+    installed: boolean;
+    running?: boolean;
+    error?: string;
+}
+export interface ServiceSetResult {
+    platform: ServicePlatform;
+    units: ServiceUnitResult[];
+    /** Human hint when the platform has no service manager integration. */
+    manualCommands?: string[];
+}
+export declare function renderUnit(platform: ServicePlatform, spec: ServiceSpec, host: ServiceHostPaths): string;
+export declare function installServices(specs: ServiceSpec[], host: ServiceHostPaths, deps?: ServiceManagerDeps): ServiceSetResult;
+export declare function uninstallServices(specs: ServiceSpec[], host: ServiceHostPaths, deps?: ServiceManagerDeps): ServiceSetResult;
+export declare function servicesStatus(specs: ServiceSpec[], host: ServiceHostPaths, deps?: ServiceManagerDeps): ServiceSetResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/service-manager/index.js

@@ -0,0 +1,114 @@
+/**
+ * Install / uninstall / status for a SET of user-level services, dispatching
+ * to launchd or systemd. All filesystem and process-control effects are
+ * injectable so the kit tests exercise the real rendering and dispatch
+ * without touching the host's service manager.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import { activateLaunchd, deactivateLaunchd, launchAgentsDir, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "./launchd.js";
+import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdIsActive, systemdUnitName, systemdUnitPath, systemdUserDir, } from "./systemd.js";
+import { detectServicePlatform, } from "./types.js";
+export { detectServicePlatform } from "./types.js";
+export { renderLaunchdPlist } from "./launchd.js";
+export { renderSystemdUserUnit, systemdUnitName } from "./systemd.js";
+export const defaultRunCommand = (cmd, args) => {
+    const r = spawnSync(cmd, args, { encoding: "utf8" });
+    return {
+        status: r.status,
+        stdout: r.stdout ?? "",
+        stderr: r.error ? r.error.message : (r.stderr ?? ""),
+    };
+};
+function unitPathFor(platform, home, spec) {
+    return platform === "darwin" ? launchdPlistPath(home, spec) : systemdUnitPath(home, spec);
+}
+export function renderUnit(platform, spec, host) {
+    return platform === "darwin"
+        ? renderLaunchdPlist(spec, host)
+        : renderSystemdUserUnit(spec, host);
+}
+export function installServices(specs, host, deps = {}) {
+    const platform = deps.platform ?? detectServicePlatform();
+    const run = deps.run ?? defaultRunCommand;
+    const writeFileSync = deps.writeFileSync ?? fs.writeFileSync;
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    const activate = deps.activate ?? true;
+    if (platform === "other") {
+        return {
+            platform,
+            units: specs.map((s) => ({ name: s.name, unitPath: "", installed: false })),
+            manualCommands: specs.map((s) => `${host.nodeBinary} ${host.hqBinary} ${s.args.join(" ")}  # >> ${s.logPath}`),
+        };
+    }
+    const dir = platform === "darwin" ? launchAgentsDir(host.home) : systemdUserDir(host.home);
+    mkdirSync(dir, { recursive: true });
+    const units = [];
+    for (const spec of specs) {
+        const unitPath = unitPathFor(platform, host.home, spec);
+        const rendered = renderUnit(platform, spec, host);
+        writeFileSync(unitPath, rendered, { mode: 0o600 });
+        const unit = { name: spec.name, unitPath, rendered, installed: true };
+        if (activate) {
+            try {
+                if (platform === "darwin")
+                    activateLaunchd(unitPath, run);
+                else
+                    activateSystemd(systemdUnitName(spec), run);
+                unit.running = true;
+            }
+            catch (err) {
+                unit.running = false;
+                unit.error = err instanceof Error ? err.message : String(err);
+            }
+        }
+        units.push(unit);
+    }
+    return { platform, units };
+}
+export function uninstallServices(specs, host, deps = {}) {
+    const platform = deps.platform ?? detectServicePlatform();
+    const run = deps.run ?? defaultRunCommand;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const activate = deps.activate ?? true;
+    if (platform === "other") {
+        return { platform, units: specs.map((s) => ({ name: s.name, unitPath: "", installed: false })) };
+    }
+    const units = [];
+    for (const spec of specs) {
+        const unitPath = unitPathFor(platform, host.home, spec);
+        const present = existsSync(unitPath);
+        if (present) {
+            if (activate) {
+                if (platform === "darwin")
+                    deactivateLaunchd(unitPath, run);
+                else
+                    deactivateSystemd(systemdUnitName(spec), run);
+            }
+            unlinkSync(unitPath);
+        }
+        units.push({ name: spec.name, unitPath, installed: false, running: false });
+    }
+    return { platform, units };
+}
+export function servicesStatus(specs, host, deps = {}) {
+    const platform = deps.platform ?? detectServicePlatform();
+    const run = deps.run ?? defaultRunCommand;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    if (platform === "other") {
+        return { platform, units: specs.map((s) => ({ name: s.name, unitPath: "", installed: false })) };
+    }
+    const units = specs.map((spec) => {
+        const unitPath = unitPathFor(platform, host.home, spec);
+        const installed = existsSync(unitPath);
+        const running = installed
+            ? platform === "darwin"
+                ? launchdIsLoaded(spec.label, run)
+                : systemdIsActive(systemdUnitName(spec), run)
+            : false;
+        return { name: spec.name, unitPath, installed, running };
+    });
+    return { platform, units };
+}
+//# sourceMappingURL=index.js.map