@indigoai-us/hq-cli 5.219.0 → 5.221.0

package/dist/lib/flag-registry.d.ts

@@ -17,7 +17,10 @@ interface WorkerLike {
 }
 export interface FlagRegistryDependencies {
     endpoint?: string;
-    createWorker?: (filename: URL, options: WorkerOptions) => WorkerLike;
+    createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
+    /** Test seam for exercising the no-source fail-open path. */
+    workerSource?: string;
+    captureWorkerFailure?: (error: Error, tags: Record<string, string>) => void;
 }
 export interface ProcessFlagCompanyContext {
     companyUid?: string;

package/dist/lib/flag-registry.js

@@ -12,8 +12,10 @@ import { readMachineCompanyBinding } from "./work-context/company.js";
 import { readSessionState } from "./work-context/state.js";
 import { workContextRoot } from "./work-context/paths.js";
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
-import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
+import { loadCachedTokens, resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
+import { FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, flagRegistryStateDir, flagRegistryWorkerModeCachePath, readCachedFlagRegistryWorkerMode, writeCachedFlagRegistryWorkerMode, } from "./flag-registry-worker-mode-cache.js";
+import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
 const COMPANY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -99,6 +101,75 @@ function processSnapshotReader(companyIdentifiers) {
         },
     };
 }
+function personSubjectForWorkerMode(idToken) {
+    if (typeof idToken !== "string")
+        return null;
+    const payload = idToken.split(".")[1];
+    if (!payload)
+        return null;
+    try {
+        const subject = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).sub;
+        return typeof subject === "string" && subject.trim() ? subject : null;
+    }
+    catch {
+        Sentry.captureMessage("Could not scope cached flag-registry worker mode because the cached ID token payload is invalid", { level: "warning", tags: { component: "flag-registry-worker-mode-cache" } });
+        return null;
+    }
+}
+/** Scope a persisted rollout value to the same identity that fetched it. */
+function workerModeCacheScopes(company) {
+    const tokens = loadCachedTokens();
+    const personSubject = tokens ? personSubjectForWorkerMode(tokens.idToken) : null;
+    if (tokens && !personSubject)
+        return null;
+    return [
+        ...(company.companyUid ? [`company:${company.companyUid}`] : []),
+        ...(company.companySlug ? [`company-slug:${company.companySlug}`] : []),
+        ...(personSubject ? [`person:${personSubject}`] : []),
+    ];
+}
+function selfContainedWorkerEnabled(company) {
+    const localOverride = readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env);
+    if (localOverride !== null)
+        return localOverride;
+    const scopes = workerModeCacheScopes(company);
+    if (!scopes)
+        return false;
+    const filePath = flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes);
+    try {
+        return readCachedFlagRegistryWorkerMode(filePath)?.value ?? false;
+    }
+    catch (error) {
+        Sentry.captureException(error, {
+            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        });
+        return false;
+    }
+}
+function cacheWorkerModeFromSnapshot(snapshot, company) {
+    // A developer's local hq-flags override is process-local and must not become
+    // the value selected by a future process.
+    if (readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env) !== null)
+        return;
+    const scopes = workerModeCacheScopes(company);
+    if (!scopes)
+        return;
+    const decision = resolveFlag({
+        flagKey: FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG,
+        env: {},
+        snapshot,
+        companyIdentifiers: [company.companyUid, company.companySlug].filter((value) => Boolean(value)),
+        lookup: { fallback: false },
+    });
+    try {
+        writeCachedFlagRegistryWorkerMode(flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes), { version: snapshot.version, value: decision.value });
+    }
+    catch (error) {
+        Sentry.captureException(error, {
+            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        });
+    }
+}
 /**
  * Begin one registry refresh without awaiting it or retaining the CLI process.
  *
@@ -117,23 +188,43 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
     processReader = processSnapshotReader(companyIdentifiers);
     try {
+        let workerSource = new URL("./flag-registry-worker.js", import.meta.url);
+        let workerOptions = { workerData: {
+                endpoint,
+                ...(companyUid ? { companyUid } : {}),
+                ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
+            } };
+        if (selfContainedWorkerEnabled(company)) {
+            // The worker source is generated and embedded in this parent module at
+            // build time. It is already resident before company, identity, and cache
+            // reads can yield to an updater replacing this package tree.
+            const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
+            if (embeddedSource.length === 0) {
+                (dependencies.captureWorkerFailure ?? ((error, tags) => {
+                    Sentry.captureException(error, { tags });
+                }))(new Error("Self-contained flag-registry worker source is unavailable"), {
+                    component: "flag-registry-worker-startup",
+                    worker: "flag-registry",
+                    flag_worker_failure: "embedded_source_unavailable",
+                });
+                return processReader;
+            }
+            workerSource = embeddedSource;
+            workerOptions = { ...workerOptions, eval: true };
+        }
         // The SDK's child-process integration captures every Worker error unless
         // its process-wide captureWorkerErrors option is disabled. Scope only this
         // worker so the reporting boundary can classify its startup errors without
         // changing capture for unrelated workers.
         const worker = Sentry.withScope((scope) => {
             scope.setTag("worker", "flag-registry");
-            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(new URL("./flag-registry-worker.js", import.meta.url), {
-                workerData: {
-                    endpoint,
-                    ...(companyUid ? { companyUid } : {}),
-                    ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
-                },
-            });
+            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(workerSource, workerOptions);
         });
         worker.on("message", (value) => {
-            if (isFlagSnapshot(value))
+            if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
+                cacheWorkerModeFromSnapshot(value, company);
+            }
         });
         // A failed background refresh must stay invisible to an offline CLI.
         worker.on("error", () => { });

package/dist/lib/lanes/questions.d.ts

@@ -16,7 +16,15 @@ export declare function assertQuestionBodySecretSafe(body: QuestionBody): void;
 export declare function questionRecordRefusalCode(err: unknown): "secret_text_refused" | "question_company_unavailable" | null;
 export declare function parseQuestionBodyStore(value: unknown): QuestionBodyStore;
 export declare function bodyStoreForLane(lane: Pick<LaneRecord, "company" | "mesh_company">, resolvedCompany?: LaneCompanyRef): QuestionBodyStore;
-export declare function resolveQuestionCompany(lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company">, activeCompany?: LaneCompanyRef | null): LaneCompanyRef;
+export declare function resolveQuestionCompany(lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company" | "project_id">, activeCompany?: LaneCompanyRef | null, hqRoot?: string): LaneCompanyRef;
+/**
+ * Resolve project ownership only when exactly one manifest company contains
+ * the project's directory. Multiple matches are unresolved so the caller can
+ * continue to an explicit active-company choice without picking an owner.
+ */
+export declare function resolveProjectQuestionCompany(hqRoot: string, lane: Pick<LaneRecord, "lane_id" | "project_id">): LaneCompanyRef | null;
+/** Resolve the lane/project company before lazily consulting active HQ scope. */
+export declare function resolveQuestionCompanyWithFallback(hqRoot: string, lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company" | "project_id">, resolveActiveCompany?: () => Promise<LaneCompanyRef | null>): Promise<LaneCompanyRef>;
 export declare function questionBodyRef(questionId: string): string;
 export declare function sha256Text(text: string): string;
 /** Tenant-store path for a question body (spec §6.2 / §10). Never the personal vault for company prose. */

package/dist/lib/lanes/questions.js

@@ -8,6 +8,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
 import { assertNoSecretText } from "./text-scan.js";
+import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { appendCappedHistory, createQuestion, retryUpdateQuestion, } from "./store.js";
 import { QUESTION_BODY_STORES, } from "./types.js";
 export function assertQuestionBodySecretSafe(body) {
@@ -39,13 +40,91 @@ export function parseQuestionBodyStore(value) {
 export function bodyStoreForLane(lane, resolvedCompany) {
     return lane.company || lane.mesh_company || resolvedCompany ? "company" : "personal";
 }
-export function resolveQuestionCompany(lane, activeCompany) {
-    const company = lane.company ?? lane.mesh_company ?? activeCompany;
+export function resolveQuestionCompany(lane, activeCompany, hqRoot) {
+    const laneCompany = lane.company ?? lane.mesh_company;
+    if (laneCompany !== null && laneCompany !== undefined) {
+        return requireQuestionCompany(laneCompany, lane.lane_id, "lane");
+    }
+    if (hqRoot) {
+        const projectCompany = resolveProjectQuestionCompany(hqRoot, lane);
+        if (projectCompany)
+            return projectCompany;
+    }
+    const company = activeCompany;
     if (!company || !company.slug.trim() || !company.uid.trim()) {
-        throw new LanesError("question_company_unavailable", `Cannot raise a question for lane ${lane.lane_id}: no lane, project, or active company could be resolved`, { lane_id: lane.lane_id });
+        throw new LanesError("question_company_unavailable", `Cannot raise a question for lane ${lane.lane_id}: no lane, project, or active company could be resolved`, { lane_id: lane.lane_id, resolution: "active_company_required" });
+    }
+    return company;
+}
+function requireQuestionCompany(company, laneId, source) {
+    if (!company.slug.trim() || !company.uid.trim()) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the ${source} company for lane ${laneId}: its slug or uid is missing`, { lane_id: laneId, resolution: `${source}_company_invalid` });
     }
     return company;
 }
+/**
+ * Resolve project ownership only when exactly one manifest company contains
+ * the project's directory. Multiple matches are unresolved so the caller can
+ * continue to an explicit active-company choice without picking an owner.
+ */
+export function resolveProjectQuestionCompany(hqRoot, lane) {
+    const projectId = lane.project_id?.trim();
+    if (!projectId)
+        return null;
+    if (projectId === "." || projectId === ".." || /[\\/\0]/.test(projectId)) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: its project id is invalid`, { lane_id: lane.lane_id, resolution: "project_id_invalid" });
+    }
+    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
+    if (!fs.existsSync(manifestPath))
+        return null;
+    const companies = readCompaniesManifestMap(hqRoot);
+    if (!companies) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: companies/manifest.yaml is unreadable or malformed`, { lane_id: lane.lane_id, resolution: "company_manifest_unavailable" });
+    }
+    const matches = [];
+    for (const [slug, entry] of Object.entries(companies)) {
+        if (!entry || typeof entry !== "object" || !slug || /[\\/\0]/.test(slug))
+            continue;
+        const projectDir = path.join(hqRoot, "companies", slug, "projects", projectId);
+        let isDirectory = false;
+        try {
+            isDirectory = fs.statSync(projectDir).isDirectory();
+        }
+        catch (err) {
+            if (err.code !== "ENOENT" && err.code !== "ENOTDIR") {
+                throw new LanesError("question_company_unavailable", `Cannot verify project ownership for lane ${lane.lane_id}`, { lane_id: lane.lane_id, resolution: "project_directory_unavailable" });
+            }
+        }
+        if (!isDirectory)
+            continue;
+        const uid = typeof entry.cloud_uid === "string" ? entry.cloud_uid.trim() : "";
+        matches.push({ slug, uid });
+    }
+    if (matches.length > 1)
+        return null;
+    const match = matches[0];
+    if (!match)
+        return null;
+    if (!match.uid) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: its manifest company has no cloud uid`, { lane_id: lane.lane_id, resolution: "project_company_uid_missing" });
+    }
+    return requireQuestionCompany({ slug: match.slug, uid: match.uid }, lane.lane_id, "project");
+}
+/** Resolve the lane/project company before lazily consulting active HQ scope. */
+export async function resolveQuestionCompanyWithFallback(hqRoot, lane, resolveActiveCompany) {
+    try {
+        return resolveQuestionCompany(lane, null, hqRoot);
+    }
+    catch (err) {
+        if (!(err instanceof LanesError) ||
+            err.error !== "question_company_unavailable" ||
+            err.details.resolution !== "active_company_required" ||
+            !resolveActiveCompany) {
+            throw err;
+        }
+        return resolveQuestionCompany(lane, await resolveActiveCompany(), hqRoot);
+    }
+}
 export function questionBodyRef(questionId) {
     return path.posix.join("lanes", "questions", `${questionId}.json`);
 }
@@ -82,7 +161,7 @@ export function writeQuestionBody(hqRoot, question, body) {
  */
 export function raiseLaneQuestion(input) {
     assertQuestionBodySecretSafe(input.body);
-    const company = resolveQuestionCompany(input.lane, input.activeCompany);
+    const company = resolveQuestionCompany(input.lane, input.activeCompany, input.hqRoot);
     const store = bodyStoreForLane(input.lane, company);
     let questionId = input.questionId;
     if (!questionId) {
@@ -282,7 +361,7 @@ export function raiseEnvelopeQuestions(hqRoot, lane, envelope, envelopeRef, at,
     for (const item of presentItems) {
         assertQuestionBodySecretSafe(envelopeQuestionBody(item));
     }
-    resolveQuestionCompany(lane, activeCompany);
+    resolveQuestionCompany(lane, activeCompany, hqRoot);
     const raised = [];
     for (let i = 0; i < items.length; i += 1) {
         const item = items[i];

package/dist/lib/lanes/reconcile.js

@@ -24,7 +24,7 @@ import { readLanesRegistryFlag } from "./registry-flag.js";
 import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT, LEAD_LANE_KEEP_ALIVE_MAX_RESUMES, LEAD_LANE_KEEP_ALIVE_RESUME_TEXT, keepAliveExclusion, loadRetiredLaneIds, leadLaneKeepAliveBackoffMs, } from "./keep-alive.js";
 import { providerSupportsSessionResume } from "./delivery.js";
 import { applyDefaultQuotaHold, readQuotaSignal, recordAccountQuota } from "./quota.js";
-import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, } from "./questions.js";
+import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { SILENCE_MS, classifyLaneExit, isPidAlive, missingExpectedEnvelopeFile, readLatestEnvelopeFile, readLatestEnvelopeRecord, watcherEventsPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshCompany, } from "./mesh-events.js";
 import { laneStories, storyStatusForEnvelope } from "./stories.js";
@@ -1054,10 +1054,8 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     latest &&
                     (latest.envelope.questions?.length ?? 0) > 0) {
                     const questionLane = readLane(hqRoot, lane.lane_id);
-                    const activeCompany = questionLane.company || questionLane.mesh_company
-                        ? undefined
-                        : await deps.resolveQuestionActiveCompany?.();
                     try {
+                        const activeCompany = await resolveQuestionCompanyWithFallback(hqRoot, questionLane, deps.resolveQuestionActiveCompany);
                         raiseEnvelopeQuestions(hqRoot, questionLane, latest.envelope, latest.ref, nowIso, undefined, activeCompany);
                     }
                     catch (err) {

package/dist/lib/lanes/timestamp.d.ts

@@ -0,0 +1,3 @@
+/** Parse an extended ISO timestamp and return JavaScript's canonical UTC form. */
+export declare function normalizeIsoTimestamp(value: unknown): string | null;
+//# sourceMappingURL=timestamp.d.ts.map

package/dist/lib/lanes/timestamp.js

@@ -0,0 +1,26 @@
+/** Parse an extended ISO timestamp and return JavaScript's canonical UTC form. */
+export function normalizeIsoTimestamp(value) {
+    if (typeof value !== "string")
+        return null;
+    const match = /^(\d{4})-(\d\d)-(\d\d)T(\d\d):(\d\d):(\d\d)(?:\.(\d+))?(Z|([+-])(\d\d):(\d\d))$/.exec(value);
+    if (!match)
+        return null;
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const hour = Number(match[4]);
+    const minute = Number(match[5]);
+    const second = Number(match[6]);
+    const offsetHour = match[9] === undefined ? 0 : Number(match[10]);
+    const offsetMinute = match[9] === undefined ? 0 : Number(match[11]);
+    const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const daysInMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1];
+    if (month < 1 || month > 12 || day < 1 || daysInMonth === undefined || day > daysInMonth ||
+        hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59)
+        return null;
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        return null;
+    return new Date(parsed).toISOString();
+}
+//# sourceMappingURL=timestamp.js.map

package/dist/lib/lanes/tracker-report-state.d.ts

@@ -0,0 +1,10 @@
+export declare const FIRST_TRACKER_REPORT_SINCE = "1970-01-01T00:00:00.000Z";
+export interface TrackerReportState {
+    schema_version: "hq-lanes-report-state.v1";
+    company: string;
+    last_report_at: string;
+}
+export declare function trackerReportStatePath(root: string, company: string): string;
+export declare function readTrackerReportState(root: string, company: string): TrackerReportState | null;
+export declare function writeTrackerReportState(root: string, company: string, at: string): TrackerReportState;
+//# sourceMappingURL=tracker-report-state.d.ts.map

package/dist/lib/lanes/tracker-report-state.js

@@ -0,0 +1,124 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import { LanesError } from "./errors.js";
+import { normalizeIsoTimestamp } from "./timestamp.js";
+export const FIRST_TRACKER_REPORT_SINCE = "1970-01-01T00:00:00.000Z";
+export function trackerReportStatePath(root, company) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(company) || company === "." || company === "..") {
+        throw new LanesError("tracker_report_company_invalid", "Company slug must be a safe path segment", { company });
+    }
+    return path.join(root, "workspace", "lane-briefs", "tracker-report-state", `${company}.json`);
+}
+function stateError(error, message, file) {
+    throw new LanesError(error, `${message}: ${file}`, { path: file });
+}
+function validReportTime(value, file) {
+    const normalized = normalizeIsoTimestamp(value);
+    if (normalized === null) {
+        return stateError("tracker_report_state_invalid", "Report state has an invalid last_report_at", file);
+    }
+    return normalized;
+}
+export function readTrackerReportState(root, company) {
+    const file = trackerReportStatePath(root, company);
+    if (stateDirectory(root, false) === null)
+        return null;
+    let raw;
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            return stateError("tracker_report_state_invalid", "Report state path must be a regular file", file);
+        }
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        if (err instanceof LanesError)
+            throw err;
+        return stateError("tracker_report_state_unreadable", `Report state could not be read: ${err instanceof Error ? err.message : String(err)}`, file);
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return stateError("tracker_report_state_malformed", "Report state contains invalid JSON", file);
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return stateError("tracker_report_state_invalid", "Report state must be an object", file);
+    }
+    const record = value;
+    if (record.schema_version !== "hq-lanes-report-state.v1" || record.company !== company) {
+        return stateError("tracker_report_state_invalid", "Report state schema or company does not match", file);
+    }
+    return {
+        schema_version: "hq-lanes-report-state.v1",
+        company,
+        last_report_at: validReportTime(record.last_report_at, file),
+    };
+}
+function stateDirectory(root, create) {
+    let rootReal;
+    try {
+        rootReal = fs.realpathSync(root);
+    }
+    catch (err) {
+        return stateError("tracker_report_state_root_invalid", `HQ root could not be resolved: ${err instanceof Error ? err.message : String(err)}`, root);
+    }
+    let current = rootReal;
+    for (const segment of ["workspace", "lane-briefs", "tracker-report-state"]) {
+        current = path.join(current, segment);
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch (err) {
+            if (err.code === "ENOENT" && !create)
+                return null;
+            if (err.code !== "ENOENT") {
+                return stateError("tracker_report_state_path_unreadable", `Report state directory could not be inspected: ${err instanceof Error ? err.message : String(err)}`, current);
+            }
+            try {
+                fs.mkdirSync(current, { mode: 0o700 });
+            }
+            catch (mkdirError) {
+                return stateError("tracker_report_state_path_unwritable", `Report state directory could not be created: ${mkdirError instanceof Error ? mkdirError.message : String(mkdirError)}`, current);
+            }
+            stat = fs.lstatSync(current);
+        }
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            return stateError("tracker_report_state_path_invalid", "Report state directory must be a real directory", current);
+        }
+    }
+    return current;
+}
+export function writeTrackerReportState(root, company, at) {
+    const canonicalAt = validReportTime(at, trackerReportStatePath(root, company));
+    const directory = stateDirectory(root, true);
+    if (directory === null)
+        return stateError("tracker_report_state_path_unavailable", "Report state directory is unavailable", trackerReportStatePath(root, company));
+    const file = trackerReportStatePath(root, company);
+    const temp = path.join(directory, `.${company}.${randomUUID()}.tmp`);
+    const value = { schema_version: "hq-lanes-report-state.v1", company, last_report_at: canonicalAt };
+    try {
+        fs.writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        fs.renameSync(temp, file);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(temp);
+        }
+        catch (cleanupError) {
+            if (cleanupError.code !== "ENOENT") {
+                throw new LanesError("tracker_report_state_cleanup_failed", `Report state temporary file could not be removed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { path: temp });
+            }
+        }
+        if (err instanceof LanesError)
+            throw err;
+        return stateError("tracker_report_state_write_failed", `Report state could not be written: ${err instanceof Error ? err.message : String(err)}`, file);
+    }
+    return value;
+}
+//# sourceMappingURL=tracker-report-state.js.map