@indigoai-us/hq-cli 5.144.0 → 5.146.0

package/dist/lib/mesh/live/daemon/credentials.js

@@ -2,9 +2,13 @@
  * Contract-3 realtime credential vend + 80%-of-lifetime renewal.
  * Never logs or persists credential material.
  */
+import * as fs from "node:fs";
+import * as path from "node:path";
 import { DEFAULT_VAULT_API_URL } from "../../../../utils/cognito-session.js";
 import { vaultApiFetch } from "../../../../utils/vault-api.js";
 import { readAgentIdentityCompanyUid } from "../../../work-context/company.js";
+import { readDeviceConfig } from "../../../work-context/config.js";
+import { workContextSessionsDir } from "../../../work-context/paths.js";
 export const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
 export const MQTT_KEEPALIVE_SECONDS = 15;
 /** Renew at 80% of credential lifetime. */
@@ -20,6 +24,12 @@ export const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 /** Cap any single retry so a bogus Retry-After cannot park the daemon. */
 export const MAX_RETRY_DELAY_MS = 24 * 60 * 60 * 1000;
+/** Contract-3 vend accepts at most this many preferred company uids. */
+export const PREFERRED_COMPANY_LIMIT = 5;
+/** Session files older than this do not count as companies in use. */
+export const PREFERRED_SESSION_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** Preferred-set changes re-vend at most this often. */
+export const PREFERRED_REVEND_MIN_MS = 60_000;
 /**
  * Typed vend failure. `refused` = server will not vend right now
  * (FEATURE_DISABLED / REALTIME_CONTRACT_UNSUPPORTED / 403); daemon should
@@ -241,8 +251,14 @@ export function normalizeContract3Bundle(raw) {
         const companyUid = typeof row.companyUid === "string" ? row.companyUid.trim() : "";
         if (!companyUid)
             continue;
+        const slug = typeof row.companySlug === "string"
+            ? row.companySlug.trim()
+            : typeof row.slug === "string"
+                ? row.slug.trim()
+                : "";
         droppedCompanies.push({
             companyUid,
+            ...(slug ? { label: slug } : {}),
             reason: typeof row.reason === "string" && row.reason.trim()
                 ? row.reason.trim()
                 : "not included",
@@ -282,6 +298,101 @@ export function scopeBundleToAgentIdentity(bundle, env = process.env) {
     }
     return { ...bundle, companies: matched };
 }
+function pushDistinct(out, seen, uid) {
+    const trimmed = uid?.trim();
+    if (!trimmed || seen.has(trimmed) || out.length >= PREFERRED_COMPANY_LIMIT)
+        return;
+    seen.add(trimmed);
+    out.push(trimmed);
+}
+/**
+ * Device default first, then distinct company uids from session files updated
+ * in the last 24 hours, newest first, max 5. Any read error returns undefined
+ * so the vend body omits the field.
+ */
+export function readPreferredCompanyUids(input) {
+    try {
+        const nowMs = input.nowMs ?? Date.now();
+        const config = readDeviceConfig({ root: input.workContextRoot });
+        const out = [];
+        const seen = new Set();
+        if (config.defaultCompany?.enabled && config.defaultCompany.uid) {
+            pushDistinct(out, seen, config.defaultCompany.uid);
+        }
+        const dir = workContextSessionsDir(input.workContextRoot);
+        let names = [];
+        try {
+            names = fs.readdirSync(dir);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "ENOENT")
+                throw err;
+        }
+        const recent = [];
+        for (const name of names) {
+            if (!name.endsWith(".json"))
+                continue;
+            const full = path.join(dir, name);
+            const stat = fs.statSync(full);
+            if (!stat.isFile())
+                continue;
+            const raw = JSON.parse(fs.readFileSync(full, "utf8"));
+            const parsedAt = typeof raw.updatedAt === "string" ? Date.parse(raw.updatedAt) : Number.NaN;
+            const at = Number.isFinite(parsedAt) ? parsedAt : stat.mtimeMs;
+            if (!Number.isFinite(at) || nowMs - at > PREFERRED_SESSION_WINDOW_MS)
+                continue;
+            if (nowMs < at)
+                continue;
+            if (typeof raw.companyUid !== "string")
+                continue;
+            recent.push({ uid: raw.companyUid, at });
+        }
+        recent.sort((a, b) => b.at - a.at || a.uid.localeCompare(b.uid));
+        for (const row of recent)
+            pushDistinct(out, seen, row.uid);
+        return out;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function preferredCompanyKey(uids) {
+    return (uids ?? []).join("\n");
+}
+/** True when a new preferred set should force a vend, at most once per minute. */
+export function shouldRevendPreferredCompanies(input) {
+    if (!input.next)
+        return false;
+    if (preferredCompanyKey(input.previous) === preferredCompanyKey(input.next)) {
+        return false;
+    }
+    const min = input.minIntervalMs ?? PREFERRED_REVEND_MIN_MS;
+    return input.nowMs - input.lastVendMs >= min;
+}
+export function contract3VendBody(preferredCompanyUids) {
+    const body = {
+        contractVersion: 3,
+    };
+    if (preferredCompanyUids && preferredCompanyUids.length > 0) {
+        body.preferredCompanyUids = preferredCompanyUids.slice(0, PREFERRED_COMPANY_LIMIT);
+    }
+    return body;
+}
+/** Plain doctor line for one company the vend left out. */
+export function formatDroppedPresenceCompany(company) {
+    const name = company.label?.trim() || company.companyUid;
+    if (company.reason === "gate_disabled") {
+        return `${name}: not included (presence is turned off for this company)`;
+    }
+    if (company.reason === "policy_budget") {
+        return `${name}: not included (too many companies for one credential)`;
+    }
+    if (!company.reason || company.reason === "unknown" || company.reason === "not included") {
+        return `${name}: not included`;
+    }
+    return `${name}: not included (${company.reason})`;
+}
 function headerGet(headers, name) {
     if (!headers)
         return null;
@@ -294,11 +405,19 @@ function headerGet(headers, name) {
 }
 export function createContract3Fetcher(opts) {
     return async () => {
+        let preferred;
+        if (opts.readPreferredCompanyUids) {
+            try {
+                preferred = opts.readPreferredCompanyUids();
+            }
+            catch {
+                preferred = undefined;
+            }
+        }
+        const body = contract3VendBody(preferred);
         let bundle;
         if (opts.post) {
-            const res = await opts.post(REALTIME_CREDENTIALS_PATH, {
-                contractVersion: 3,
-            });
+            const res = await opts.post(REALTIME_CREDENTIALS_PATH, body);
             if (res.status < 200 || res.status >= 300) {
                 throw classifyCredentialVendFailure(res.status, res.body, headerGet(res.headers, "Retry-After"));
             }
@@ -309,23 +428,23 @@ export function createContract3Fetcher(opts) {
                 token: opts.token,
                 path: REALTIME_CREDENTIALS_PATH,
                 method: "POST",
-                body: { contractVersion: 3 },
+                body,
                 baseUrl: opts.baseUrl ?? DEFAULT_VAULT_API_URL,
             });
             const text = await res.text();
-            let body = {};
+            let parsed = {};
             if (text) {
                 try {
-                    body = JSON.parse(text);
+                    parsed = JSON.parse(text);
                 }
                 catch {
-                    body = { raw: text.slice(0, 200) };
+                    parsed = { raw: text.slice(0, 200) };
                 }
             }
             if (!res.ok) {
-                throw classifyCredentialVendFailure(res.status, body, res.headers.get("Retry-After"));
+                throw classifyCredentialVendFailure(res.status, parsed, res.headers.get("Retry-After"));
             }
-            bundle = normalizeContract3Bundle(body);
+            bundle = normalizeContract3Bundle(parsed);
         }
         return scopeBundleToAgentIdentity(bundle, opts.env ?? process.env);
     };
@@ -344,6 +463,7 @@ export class CredentialRenewalManager {
     random;
     handle = null;
     stopped = false;
+    inflight = false;
     constructor(fetchCredentials, onRenewed, onError = () => { }, timers = realTimerHost, retryDelayMs = 30_000, refusedRetryMs = DEFAULT_REFUSED_RETRY_MS, random = Math.random) {
         this.fetchCredentials = fetchCredentials;
         this.onRenewed = onRenewed;
@@ -360,9 +480,17 @@ export class CredentialRenewalManager {
         const delay = renewalDelayMs(this.timers.now(), bundle.expiresAt);
         this.handle = scheduleBoundedTimeout(this.timers, () => void this.renew(), delay);
     }
+    /** Vend now (preferred companies changed). No-op while a vend is in flight. */
+    renewNow() {
+        if (this.stopped || this.inflight)
+            return;
+        this.clear();
+        void this.renew();
+    }
     async renew() {
-        if (this.stopped)
+        if (this.stopped || this.inflight)
             return;
+        this.inflight = true;
         try {
             const bundle = await this.fetchCredentials();
             if (this.stopped)
@@ -389,6 +517,9 @@ export class CredentialRenewalManager {
                 return;
             this.handle = scheduleBoundedTimeout(this.timers, () => void this.renew(), delay);
         }
+        finally {
+            this.inflight = false;
+        }
     }
     stop() {
         this.stopped = true;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -9,6 +9,7 @@ import { describeCognitoTokenSource, formatCognitoSubject, loadMachineCachedToke
 import { listOutboxOperations, outboxStats, } from "../../../work-context/outbox.js";
 import { readSessionState } from "../../../work-context/state.js";
 import { workContextRoot } from "../../../work-context/paths.js";
+import { formatDroppedPresenceCompany } from "./credentials.js";
 import { countJsonlLines, countUnattributedEvents, } from "../spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../paths.js";
 import { daemonDir, daemonPidPath } from "./paths.js";
@@ -239,9 +240,9 @@ export function formatDaemonDoctor(report) {
     if (report.presenceDroppedCompanies.length > 0) {
         lines.push(`presence not published for ${report.presenceDroppedCompanies.length} companies: ` +
             report.presenceDroppedCompanies
-                .map((company) => `${company.companyUid} (${company.reason})`)
-                .join(", ") +
-            `; presence credential holds ${report.companiesOnline.length} companies; these were not included`);
+                .map((company) => formatDroppedPresenceCompany(company))
+                .join("; ") +
+            `; presence credential holds ${report.companiesOnline.length} companies`);
     }
     if (report.unhealthy) {
         lines.push(`health: UNHEALTHY`);

package/dist/lib/mesh/live/daemon/presence.d.ts

@@ -84,6 +84,13 @@ export interface PresenceClientOptions {
     onRefusal?: (refusal: PresenceRefusal | null) => void;
     now?: () => Date;
     env?: NodeJS.ProcessEnv;
+    /**
+     * Companies the daemon is working in. When the set changes, presence
+     * re-vends instead of waiting for credential expiry (at most once a minute).
+     * Undefined means a read failed — do not re-vend.
+     */
+    readPreferredCompanyUids?: () => string[] | undefined;
+    preferredRevendMinMs?: number;
 }
 /**
  * Full-jitter capped exponential backoff (1s base → 60s cap by default),
@@ -123,6 +130,9 @@ export declare class PresenceClient {
     /** Last refusal code we logged via onError (episode dedupe). */
     private loggedRefusalKey;
     private refusal;
+    private preferredHandle;
+    private preferredSnapshot;
+    private lastPreferredVendMs;
     private readonly mqttConnect;
     private readonly timers;
     private readonly random;
@@ -137,6 +147,11 @@ export declare class PresenceClient {
     getRefusal(): PresenceRefusal | null;
     /** Topics this client has published to (for doctor / tests). */
     getPublishedTopics(): readonly string[];
+    private preferredMinMs;
+    private notePreferredVend;
+    private clearPreferredWatch;
+    private armPreferredWatch;
+    private maybeRevendPreferred;
     private setState;
     start(): Promise<void>;
     /**

package/dist/lib/mesh/live/daemon/presence.js

@@ -12,7 +12,7 @@
  * - Server credential refusals use a long retry (default 10m ±20%)
  */
 import mqtt from "mqtt";
-import { CredentialVendError, CredentialRenewalManager, MQTT_KEEPALIVE_SECONDS, clampRetryDelayMs, defaultRefusedRetryMs, realTimerHost, refusedRetryDelayMs, scheduleBoundedTimeout, } from "./credentials.js";
+import { CredentialVendError, CredentialRenewalManager, MQTT_KEEPALIVE_SECONDS, PREFERRED_REVEND_MIN_MS, clampRetryDelayMs, defaultRefusedRetryMs, realTimerHost, refusedRetryDelayMs, scheduleBoundedTimeout, shouldRevendPreferredCompanies, } from "./credentials.js";
 import { presignIotWssUrl } from "./presign.js";
 /**
  * A connection that drops before this grace window after `connect` is treated
@@ -93,6 +93,9 @@ export class PresenceClient {
     /** Last refusal code we logged via onError (episode dedupe). */
     loggedRefusalKey = null;
     refusal = null;
+    preferredHandle = null;
+    preferredSnapshot = [];
+    lastPreferredVendMs = 0;
     mqttConnect;
     timers;
     random;
@@ -128,6 +131,67 @@ export class PresenceClient {
     getPublishedTopics() {
         return this.publishedTopics;
     }
+    preferredMinMs() {
+        return this.options.preferredRevendMinMs ?? PREFERRED_REVEND_MIN_MS;
+    }
+    notePreferredVend() {
+        const read = this.options.readPreferredCompanyUids;
+        if (!read)
+            return;
+        let next;
+        try {
+            next = read();
+        }
+        catch {
+            return;
+        }
+        if (!next)
+            return;
+        this.preferredSnapshot = next;
+        this.lastPreferredVendMs = this.timers.now();
+    }
+    clearPreferredWatch() {
+        if (this.preferredHandle) {
+            this.preferredHandle.clear();
+            this.preferredHandle = null;
+        }
+    }
+    armPreferredWatch() {
+        if (!this.options.readPreferredCompanyUids || this.stopped)
+            return;
+        this.clearPreferredWatch();
+        this.preferredHandle = scheduleBoundedTimeout(this.timers, () => {
+            this.preferredHandle = null;
+            if (this.stopped)
+                return;
+            this.maybeRevendPreferred();
+            this.armPreferredWatch();
+        }, this.preferredMinMs());
+    }
+    maybeRevendPreferred() {
+        const read = this.options.readPreferredCompanyUids;
+        if (!read || this.stopped || this.refusal)
+            return;
+        let next;
+        try {
+            next = read();
+        }
+        catch {
+            return;
+        }
+        if (!shouldRevendPreferredCompanies({
+            previous: this.preferredSnapshot,
+            next,
+            lastVendMs: this.lastPreferredVendMs,
+            nowMs: this.timers.now(),
+            minIntervalMs: this.preferredMinMs(),
+        })) {
+            return;
+        }
+        this.lastPreferredVendMs = this.timers.now();
+        this.preferredSnapshot = next;
+        this.renewal.renewNow();
+    }
     setState(state) {
         if (this.state === state)
             return;
@@ -149,6 +213,7 @@ export class PresenceClient {
         this.stopped = true;
         this.generation += 1;
         this.renewal.stop();
+        this.clearPreferredWatch();
         this.clearReconnect();
         this.clearStableTimer();
         this.connectedAtMs = null;
@@ -190,6 +255,7 @@ export class PresenceClient {
     }
     async onCredentialsRenewed(bundle) {
         this.bundle = bundle;
+        this.notePreferredVend();
         // Successful vend ends a refusal episode (renewal skips connectOnce's vend path).
         this.clearRefusal(true);
         if (this.stopped)
@@ -249,6 +315,8 @@ export class PresenceClient {
                 // Successful vend ends a refusal episode (even before MQTT connects).
                 this.clearRefusal(true);
                 this.renewal.schedule(this.bundle);
+                this.notePreferredVend();
+                this.armPreferredWatch();
             }
             const bundle = this.bundle;
             const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, this.now());

package/dist/lib/mesh/live/daemon/run.js

@@ -26,7 +26,7 @@ import { backfillHeldSessions, } from "../backfill-held.js";
 import { reconcileObservation } from "../../../work-context/reconcile.js";
 import { workMeshRoot, workMeshSpoolPath } from "../paths.js";
 import { createVaultBoardReader, refreshBoundSessionBoards, BOARD_REFRESH_INTERVAL_MS, } from "./board-refresh.js";
-import { createContract3Fetcher, createPersonalRealtimeFetcher, realTimerHost, } from "./credentials.js";
+import { createContract3Fetcher, createPersonalRealtimeFetcher, readPreferredCompanyUids, realTimerHost, } from "./credentials.js";
 import { appendDaemonLog, daemonLogLine, ensureDaemonLog } from "./log.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock, } from "./pid-lock.js";
 import { daemonDir } from "./paths.js";
@@ -392,6 +392,7 @@ export async function runMeshDaemon(deps = {}) {
                     token: t,
                     baseUrl: resolveVaultApiBase(env),
                     env,
+                    readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
                 })();
             });
         const fetchCredentials = async () => {
@@ -418,6 +419,7 @@ export async function runMeshDaemon(deps = {}) {
                 }, now);
                 log(dir, `presence online companies=${companies.length}`);
             },
+            readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
             onRefusal: (refusal) => {
                 patchDaemonState(dir, {
                     presenceRefusal: refusal,

package/dist/lib/mesh/project-board.d.ts

@@ -1,4 +1,18 @@
 import { type MeshCompany, type MeshProjectRegistration, type MeshProjectRepo, type MeshProjectStoryInput, type MeshProjectView } from "./api.js";
+/**
+ * POST /v1/work-mesh/projects/{id}/register always binds the server-derived
+ * proj- thread (projectGenesisThreadId). It does not accept a client threadId.
+ * Close a thread only when this same ensure created it and register returned
+ * a different canonical id. An already-open thread stays open on a re-run.
+ * The Board view reads the registered thread.
+ */
+export declare function closeSupersededProjectThread(input: {
+    token: string;
+    companyUid: string;
+    openedThreadId: string;
+    canonicalThreadId: string;
+    created: boolean;
+}): Promise<void>;
 /**
  * Create a missing Board. Register returns 403 PROJECT_NOT_IN_COMPANY until
  * the genesis thread and the project view both exist, so the order is fixed:

package/dist/lib/mesh/project-board.js

@@ -1,4 +1,20 @@
-import { ensureProjectThread, getProjectView, putProjectView, registerMeshProject, } from "./api.js";
+import { appendThreadEvent, ensureProjectThread, getProjectView, putProjectView, registerMeshProject, } from "./api.js";
+/**
+ * POST /v1/work-mesh/projects/{id}/register always binds the server-derived
+ * proj- thread (projectGenesisThreadId). It does not accept a client threadId.
+ * Close a thread only when this same ensure created it and register returned
+ * a different canonical id. An already-open thread stays open on a re-run.
+ * The Board view reads the registered thread.
+ */
+export async function closeSupersededProjectThread(input) {
+    if (!input.created)
+        return;
+    if (!input.openedThreadId || input.openedThreadId === input.canonicalThreadId)
+        return;
+    await appendThreadEvent(input.token, input.companyUid, input.openedThreadId, "done", {
+        summary: "Superseded by the registered project thread.",
+    });
+}
 /**
  * Create a missing Board. Register returns 403 PROJECT_NOT_IN_COMPANY until
  * the genesis thread and the project view both exist, so the order is fixed:
@@ -18,6 +34,13 @@ export async function ensureProjectBoard(input) {
         repos: input.repos ?? [],
     });
     const registration = await registerMeshProject(input.token, input.company.companyUid, input.projectId);
+    await closeSupersededProjectThread({
+        token: input.token,
+        companyUid: input.company.companyUid,
+        openedThreadId: genesis.threadId,
+        canonicalThreadId: registration.threadId,
+        created: genesis.created,
+    });
     const view = await getProjectView(input.token, input.company.companyUid, input.projectId);
     if (view.projectId !== input.projectId || view.companyUid !== input.company.companyUid) {
         throw new Error(`Work mesh project board does not match ${input.company.companyUid}/${input.projectId}.`);

package/dist/lib/work-context/bind-best.d.ts

@@ -41,6 +41,8 @@ export declare function discoverProjects(input: {
     env?: NodeJS.ProcessEnv;
     home?: string;
 }): CatalogProject[];
+/** discoverProjects memoized by directory mtime. A cache hit does not rescan. */
+export declare function discoverProjectsCached(input: Parameters<typeof discoverProjects>[0], nowMs?: number): CatalogProject[];
 export declare function refineProjectBinding(input: {
     hint?: string;
     hqRoot?: string;

package/dist/lib/work-context/bind-best.js

@@ -188,11 +188,44 @@ export function discoverProjects(input) {
     }
     return [...map.values()];
 }
+const CATALOG_CACHE_TTL_MS = 5000;
+let catalogCache = null;
+function catalogStamp(input) {
+    const hqRoot = input.hqRoot?.trim();
+    const slug = input.companySlug?.trim();
+    const dirs = [
+        hqRoot && slug ? path.join(hqRoot, "companies", slug, "projects") : "",
+        hqRoot ? path.join(hqRoot, "personal", "projects") : "",
+        input.companyUid
+            ? path.join(meshCacheRoot(input.home ?? os.homedir(), input.env), "projects", input.companyUid)
+            : "",
+    ];
+    return dirs.map((dir) => {
+        if (!dir)
+            return "0";
+        try {
+            return String(fs.statSync(dir).mtimeMs);
+        }
+        catch {
+            return "0";
+        }
+    }).join("|");
+}
+/** discoverProjects memoized by directory mtime. A cache hit does not rescan. */
+export function discoverProjectsCached(input, nowMs = Date.now()) {
+    const key = `${input.hqRoot ?? ""}|${input.companySlug ?? ""}|${input.companyUid ?? ""}|${input.home ?? ""}|${catalogStamp(input)}`;
+    if (catalogCache && catalogCache.key === key && nowMs - catalogCache.at < CATALOG_CACHE_TTL_MS) {
+        return catalogCache.rows;
+    }
+    const rows = discoverProjects(input);
+    catalogCache = { key, at: nowMs, rows };
+    return rows;
+}
 export function refineProjectBinding(input) {
     const hint = input.hint?.trim();
     if (!hint)
         return { action: "keep" };
-    const catalog = discoverProjects(input);
+    const catalog = discoverProjectsCached(input, input.nowMs ?? Date.now());
     const exact = catalog.find((row) => row.projectId === hint);
     if (exact?.hasBoard) {
         return { action: "bind", projectId: hint, reason: "exact slug has a Board" };

package/dist/lib/work-context/bind-calling-session.d.ts

@@ -0,0 +1,26 @@
+/**
+ * US-040: when this process ensures a project, bind the calling session
+ * if it is still unresolved in the same company. Never move a session
+ * that is already on a different project.
+ */
+export interface CallingCompany {
+    companyUid: string;
+    companySlug: string;
+}
+export type BindCallingResult = {
+    bound: true;
+    sessionId: string;
+    projectId: string;
+} | {
+    bound: false;
+    reason: "no_session" | "no_state" | "company_mismatch" | "different_project" | "already_bound" | "not_unresolved";
+};
+export declare function bindCallingSession(input: {
+    root: string;
+    env?: NodeJS.ProcessEnv;
+    projectId: string;
+    company: CallingCompany;
+    now?: () => Date;
+}): BindCallingResult;
+export declare function formatSessionBoundLine(sessionId: string, projectId: string): string;
+//# sourceMappingURL=bind-calling-session.d.ts.map

package/dist/lib/work-context/bind-calling-session.js

@@ -0,0 +1,63 @@
+/**
+ * US-040: when this process ensures a project, bind the calling session
+ * if it is still unresolved in the same company. Never move a session
+ * that is already on a different project.
+ */
+import { sessionIdFromEnv } from "../mesh/live/session-identity.js";
+import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
+import { readSessionState, updateSessionState } from "./state.js";
+function sameCompany(state, company) {
+    if (state.companyUid && state.companyUid === company.companyUid)
+        return true;
+    if (state.companySlug &&
+        company.companySlug &&
+        state.companySlug.toLowerCase() === company.companySlug.toLowerCase()) {
+        return true;
+    }
+    return false;
+}
+export function bindCallingSession(input) {
+    const sessionId = sessionIdFromEnv(input.env ?? process.env);
+    if (!sessionId)
+        return { bound: false, reason: "no_session" };
+    const current = readSessionState(sessionId, input.root);
+    if (!current)
+        return { bound: false, reason: "no_state" };
+    if (!sameCompany(current, input.company))
+        return { bound: false, reason: "company_mismatch" };
+    if (current.projectId && current.projectId !== input.projectId) {
+        return { bound: false, reason: "different_project" };
+    }
+    if (current.projectId === input.projectId && (current.contextStatus === "bound" || current.contextStatus === "needs_task")) {
+        return { bound: false, reason: "already_bound" };
+    }
+    if (current.contextStatus !== "needs_project" && current.contextStatus !== "unresolved") {
+        return { bound: false, reason: "not_unresolved" };
+    }
+    const nowIso = (input.now ?? (() => new Date()))().toISOString();
+    const updated = updateSessionState(sessionId, input.root, (state) => {
+        if (!state)
+            return null;
+        if (state.projectId && state.projectId !== input.projectId)
+            return state;
+        return {
+            ...state,
+            contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
+            contextStatus: state.taskId ? "bound" : "needs_task",
+            projectId: input.projectId,
+            projectGate: undefined,
+            projectCandidates: undefined,
+            projectHint: undefined,
+            projectBindReason: `bound by project ensure to ${input.projectId}`,
+            updatedAt: nowIso,
+        };
+    });
+    if (!updated || updated.projectId !== input.projectId) {
+        return { bound: false, reason: "different_project" };
+    }
+    return { bound: true, sessionId, projectId: input.projectId };
+}
+export function formatSessionBoundLine(sessionId, projectId) {
+    return `Work mesh: session ${sessionId} bound to project ${projectId}`;
+}
+//# sourceMappingURL=bind-calling-session.js.map

package/dist/lib/work-context/prd-sync.d.ts

@@ -0,0 +1,34 @@
+/**
+ * US-040: diff a bound project's prd.json and describe task_status events.
+ * Planning never touches the network. The snapshot is written only after
+ * the caller accepts the plan (commit), so a failed emit can retry.
+ */
+export interface PrdStatusEvent {
+    taskId: string;
+    status: "done" | "in_progress";
+}
+export interface PrdSnapshot {
+    stories: Record<string, {
+        passes: boolean;
+        status?: string;
+    }>;
+    seq: number;
+}
+export declare function prdSnapshotPath(sessionId: string, root: string): string;
+export declare function readPrdSnapshot(sessionId: string, root: string): PrdSnapshot | null;
+export declare function prdBelongsToProject(file: string, projectId: string, companySlug: string | undefined): boolean;
+export interface PrdSyncPlan {
+    changed: boolean;
+    skip?: "no_state" | "not_bound" | "different_project" | "unreadable";
+    events: PrdStatusEvent[];
+    /** Story most recently moved to in_progress, if any. */
+    taskId?: string;
+    seqStart: number;
+    commit: () => void;
+}
+export declare function planPrdSync(input: {
+    sessionId: string;
+    file: string;
+    root: string;
+}): PrdSyncPlan;
+//# sourceMappingURL=prd-sync.d.ts.map